Deploy operator with access to a set of namespaces

[katheris]

Currently the Kafka Access Operator watches all namespaces. It should also support running in a single namespace.

The Java Operator SDK documentation has a section that talks about target namespaces https://javaoperatorsdk.io/docs/documentation/configuration/#dynamically-changing-target-namespaces

This should be implemented as follows:

• Optional env STRIMZI_NAMESPACE (to match the one in cluster operator) that when set indicates a comma-separated list of namespaces to watch. When omitted the operator will watch all namespaces as it does today
• Namespaces to watch are set at startup, so an operator restart is needed to change the list of watched namespaces
• A new RoleBinding yaml file should be added to bind the existing ClusterRole to specific namespaces

[ppatierno]

@katheris if @OwenCorrigan76 is working on this I guess it doesn't need triage anymore, or is there anything more to discuss?

[scholzj]

@ppatierno I think it does deserve the triage. I for example absolutely don't understand what does it mean when an operator with the goal of sharing credentials and cluster details between namespaces watches only one namespace.

[katheris]

In answer to your question @scholzj although I realise the title indicates a single namespace, the description and implementation does support a set of namespaces. However, I do think there is a use case for it being in a single namespace. The Access Operator shares credentials and cluster details across namespaces, but also collects those details into a single Secret and stores them under well-known field names. So it is possible that users might want to use the Access Operator to simplify their application configuration for applications within the same namespace as Kafka.

Regardless I am happy for this to remain as needs-triage.

[katheris]

Triaged on 18.12.2025: We're happy to have this feature, assuming that it allows for a set of namespaces, rather than just a single one.