[Bug]: No possibility to add annotations to clusterCA while it is possible for kafkauser.

[bernony]

Bug Description

Hi all,

I am trying to reflect kafka secrets like kafkauser and <cluster_name>-cluster-ca-cert to other namespaces.

For kafkauser, it is ok as the template allows it.

But for clusterCA, it is not possible. Indeed, the configuration, here, has no metadata section.

I may be wrong.

Do I miss something?

In the meantime, I'm setting up a cron to inject the annotations, in the related cluster-ca-cert secret.

Best regards.

Bernony

Steps to reproduce

No response

Expected behavior

No response

Strimzi version

0.45.0

Kubernetes version

1.31.x

Installation method

HELM,

Infrastructure

azure bench

Configuration files and logs

No response

Additional context

No response

[ppatierno]

What's the use case here?
There is no metadata section where you are referring to, because it's not a custom resource like the KafkaUser. It's part of the spec related to custom certificate handling.

In the meantime, I'm setting up a cron to inject the annotations, in the related cluster-ca-cert secret.

I should double check but it's also possible that the operator is reverting back your changes (unless the Secret is provided by you and the CA root is not generated by Strimzi).

[bernony]

You're right saying it is not a CRD, my mistake.

Indeed when I provide my own CA, there is no problem to add annotations I want.

In this case, I do no provide my own CA. Strimzi does generates the cluster CA.

I just want to be able to provide annotation for related secret -cluster-ca-cert generated by Strimzi.

I am using reflector.

[scholzj]

Annotations for the Cluster CA cert Secret are set through template: https://strimzi.io/docs/operators/latest/full/configuring.html#type-KafkaClusterTemplate-reference

[ppatierno]

Ah right there is the clusterCaCert field there. Thanks Jakub.

[bernony]

Oh, okay, I did not chack that one. I was focussing on clusterCA not clusterCaCert. i am going to try. Thank you. I'll let you know.

[bernony]

Hi guys,
All's working now. thank you.

But it is a bit difficult to know exactly where to put it. The doc could be more clear, I think.

I had to put it under spec.kafka.template to have it work.

kafka: template: clusterCaCert: metadata: annotations:
Many thanks

[bernony]

I close this bug as finally it is not a bug and I was provided with the inforamation I was looking for.