<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> <p class="MsoNormal">Jakub,<o:p></o:p></p> <p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color:black">We are trying to install Strmzi in our DEV cluster. The thing is that there are certain restrictions and we’ve come across a problem:<o:p></o:p></span></p> <p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p> <p class="MsoNormal">$ oc create -f 02-role.yaml <o:p></o:p></p> <p class="MsoNormal">Error from server (Forbidden): error when creating "02-role.yaml": roles.rbac.authorization.k8s.io "strimzi-cluster-controller-role" is forbidden: attempt to grant extra privileges: [PolicyRule{Resources:["events"], APIGroups:[""], Verbs:["create"]} PolicyRule{Resources:["replicationcontrollers"], APIGroups:["extensions"], Verbs:["get"]} PolicyRule{Resources:["replicationcontrollers"], APIGroups:["extensions"], Verbs:["list"]} PolicyRule{Resources:["replicationcontrollers"], APIGroups:["extensions"], Verbs:["watch"]} PolicyRule{Resources:["replicationcontrollers"], APIGroups:["extensions"], Verbs:["create"]} PolicyRule{Resources:["replicationcontrollers"], APIGroups:["extensions"], Verbs:["delete"]} PolicyRule{Resources:["replicationcontrollers"], APIGroups:["extensions"], Verbs:["patch"]} PolicyRule{Resources:["replicationcontrollers"], APIGroups:["extensions"], Verbs:["update"]} PolicyRule{Resources:["deploymentconfigs/status"], APIGroups:["apps.openshift.io"], Verbs:["create"]} PolicyRule{Resources:["deploymentconfigs/status"], APIGroups:["apps.openshift.io"], Verbs:["delete"]} PolicyRule{Resources:["deploymentconfigs/status"], APIGroups:["apps.openshift.io"], Verbs:["patch"]} PolicyRule{Resources:["deploymentconfigs/status"], APIGroups:["apps.openshift.io"], Verbs:["update"]} PolicyRule{Resources:["deploymentconfigs/finalizers"], APIGroups:["apps.openshift.io"], Verbs:["get"]} PolicyRule{Resources:["deploymentconfigs/finalizers"], APIGroups:["apps.openshift.io"], Verbs:["list"]} PolicyRule{Resources:["deploymentconfigs/finalizers"], APIGroups:["apps.openshift.io"], Verbs:["watch"]} PolicyRule{Resources:["deploymentconfigs/finalizers"], APIGroups:["apps.openshift.io"], Verbs:["create"]} PolicyRule{Resources:["deploymentconfigs/finalizers"], APIGroups:["apps.openshift.io"], Verbs:["delete"]} PolicyRule{Resources:["deploymentconfigs/finalizers"], APIGroups:["apps.openshift.io"], Verbs:["patch"]} PolicyRule{Resources:["deploymentconfigs/finalizers"], APIGroups:["apps.openshift.io"], Verbs:["update"]} PolicyRule{Resources:["imagestreams/status"], APIGroups:["image.openshift.io"], Verbs:["create"]} PolicyRule{Resources:["imagestreams/status"], APIGroups:["image.openshift.io"], Verbs:["delete"]} PolicyRule{Resources:["imagestreams/status"], APIGroups:["image.openshift.io"], Verbs:["patch"]} PolicyRule{Resources:["imagestreams/status"], APIGroups:["image.openshift.io"], Verbs:["update"]}] user=&{SG0556477 …<o:p></o:p></p> <p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p> <p class="MsoNormal" style="margin-bottom:10.0pt;line-height:115%"><span style="color:black">What we are wondering is if all permissions (<a href="https://github.com/strimzi/strimzi/blob/master/examples/install/cluster-controller/02-role.yaml">https://github.com/strimzi/strimzi/blob/master/examples/install/cluster-controller/02-role.yaml</a>) are required? For example we don’t need to install Strimzi in other namespaces. We want to start with only operating within one namespace. Do you think we may reduce permissions (which?) and hence solve the issue (temporarily until our admins give us cluster admin role). <o:p></o:p></span></p> <p class="MsoNormal" style="margin-bottom:10.0pt;line-height:115%">Also, we observed that after installing Strimzi, there is one ZK pod. Should it not be more e.g. 3 for HA ? What topology would you recommend for a start (3+3 ? ) <o:p></o:p></p> <p class="MsoNormal" style="margin-bottom:10.0pt;line-height:115%">Piotr, Krzysztof – please add if needed. <o:p></o:p></p> <p class="MsoNormal" style="margin-bottom:10.0pt;line-height:115%">Przemek<o:p></o:p></p> <p class="MsoNormal"><o:p> </o:p></p> <p class="MsoNormal"><b>From:</b> Jakub Scholz [mailto:jakub@scholz.cz] <br> <b>Sent:</b> Tuesday, April 17, 2018 6:42 PM<br> <b>To:</b> Budzik, Przemyslaw <Przemyslaw.Budzik@sabre.com><br> <b>Cc:</b> strimzi@redhat.com; Chylek, Artur <Artur.Chylek@sabre.com>; Wnuk, Norbert <Norbert.Wnuk@sabre.com><br> <b>Subject:</b> Re: [Strimzi] RC1 of Strimzi 0.3.0 available<o:p></o:p></p> <p class="MsoNormal"><o:p> </o:p></p> <div> <p class="MsoNormal">One of the problems is that the config map is a namespaced resource. But if you want a Kafka cluster which serves multiple namespaces then Kafka topic is not namespaced resource. That means a lot of complications. For example what should we do when the same topic is configured within different namespaces? So I do not think we can see the presence of the config map for given topic in the namespace as a proof of ownership for the topic.<o:p></o:p></p> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">I think that the general idea is quite good. But the implementation might not be trivial. I think I will need some more time to think about it. Either way this is far beyond the 0.3.0 scope.<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">Thanks<o:p></o:p></p> </div> <div> <p class="MsoNormal">Jakub<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> <div> <p class="MsoNormal">On Mon, Apr 16, 2018 at 10:24 AM, Budzik, Przemyslaw <<a href="mailto:Przemyslaw.Budzik@sabre.com" target="_blank">Przemyslaw.Budzik@sabre.com</a>> wrote:<o:p></o:p></p> <blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in"> <div> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Thank you Jakub. I have a question. Is there any way to bind namespace with topic in terms of authorization? Consider a scenario.<o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:black"> </span><o:p></o:p></p> <ol start="1" type="1"> <li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1"> Team A creates a topic called “reservations”. They own the config map and of course they can publish to this topic.<o:p></o:p></li><li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1"> Team B is interested in consuming A’s messages. I am guessing if they know the name of the topic, they can use it ? Ideally since they are in the namespace B, we’d like to be able to say they can, but others can’t. Also I mean we give them read, but not write. Most likely it’s the creator of topic writing and other namespaces (or the same) consuming. <o:p></o:p></li></ol> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">If that is not supported, is that on your roadmap ?<o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b>From:</b> Jakub Scholz [mailto:<a href="mailto:jakub@scholz.cz" target="_blank">jakub@scholz.cz</a>] <br> <b>Sent:</b> Friday, April 13, 2018 2:44 PM<br> <b>To:</b> Budzik, Przemyslaw <<a href="mailto:Przemyslaw.Budzik@sabre.com" target="_blank">Przemyslaw.Budzik@sabre.com</a>><br> <b>Cc:</b> <a href="mailto:strimzi@redhat.com" target="_blank">strimzi@redhat.com</a>; Chylek, Artur <<a href="mailto:Artur.Chylek@sabre.com" target="_blank">Artur.Chylek@sabre.com</a>>; Wnuk, Norbert <<a href="mailto:Norbert.Wnuk@sabre.com" target="_blank">Norbert.Wnuk@sabre.com</a>><br> <b>Subject:</b> Re: [Strimzi] RC1 of Strimzi 0.3.0 available<o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Hi,<o:p></o:p></p> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p> </div> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Well, it is a release candidate. So while I hope that there will be no issues, there is always possibility. But feel free to give it a try. It doesn't bring any significant new features, but it improves a bit the resilience with which the controller reacts to different problems and situations. If you didn't experienced any issues with 0.2.0, you can just stay with it.<o:p></o:p></p> </div> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p> </div> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I hope the final release will be done early next week.<o:p></o:p></p> </div> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p> </div> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Thanks & Regards<o:p></o:p></p> </div> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Jakub<o:p></o:p></p> </div> </div> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">On Fri, Apr 13, 2018 at 1:10 AM, Budzik, Przemyslaw <<a href="mailto:Przemyslaw.Budzik@sabre.com" target="_blank">Przemyslaw.Budzik@sabre.com</a>> wrote:<o:p></o:p></p> <blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt"> <div> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Jakub,<o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:black"> </span><o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:black">Which version would you recommend using in our case ? One of the teams is now installing Strimzi in our DEV environment.</span><o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Thanks,<o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Przemek<o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b>From:</b> <a href="mailto:strimzi-bounces@redhat.com" target="_blank">strimzi-bounces@redhat.com</a> [mailto:<a href="mailto:strimzi-bounces@redhat.com" target="_blank">strimzi-bounces@redhat.com</a>] <b>On Behalf Of </b>Jakub Scholz<br> <b>Sent:</b> Friday, April 13, 2018 4:32 AM<br> <b>To:</b> <a href="mailto:strimzi@redhat.com" target="_blank">strimzi@redhat.com</a><br> <b>Subject:</b> [Strimzi] RC1 of Strimzi 0.3.0 available<o:p></o:p></p> <div> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:9.5pt;font-family:"Arial",sans-serif;color:#222222;background:white">Hi,</span><o:p></o:p></p> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white"> <span style="font-size:9.5pt;font-family:"Arial",sans-serif;color:#222222"> </span><o:p></o:p></p> </div> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white"> <span style="font-size:9.5pt;font-family:"Arial",sans-serif;color:#222222">The Release Candidate 1 for the first Strimzi 0.3.0 is now available. </span><o:p></o:p></p> </div> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white"> <span style="font-size:9.5pt;font-family:"Arial",sans-serif;color:#222222"> </span><o:p></o:p></p> </div> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white"> <span style="font-size:9.5pt;font-family:"Arial",sans-serif;color:#222222">If you are interested have a look at the release candidate and give us your feedback:</span><o:p></o:p></p> </div> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white"> <span style="font-size:9.5pt"><a href="https://github.com/strimzi/strimzi/releases/tag/0.3.0-rc1" target="_blank">https://github.com/strimzi/strimzi/releases/tag/0.3.0-rc1</a></span><o:p></o:p></p> </div> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white"> <span style="font-size:9.5pt;font-family:"Arial",sans-serif;color:#222222"> </span><o:p></o:p></p> </div> <div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white"> <span style="font-size:9.5pt;font-family:"Arial",sans-serif;color:#222222">Thanks & Regards</span><o:p></o:p></p> </div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Jakub<o:p></o:p></p> </div> </div> </div> </div> </div> </blockquote> </div> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p> </div> </div> </div> </blockquote> </div> <p class="MsoNormal"><o:p> </o:p></p> </div> </div> </body> </html>