Standalone User operator

[PatDS28]

Hi, i have a question about the standalone user operator. In a setup where I’m using standalone Strimzi Topic and User Operators connected to an AWS MSK cluster via SASL/SCRAM, is there a way to configure the User Operator so that it retains existing ACLs on the cluster (not created via Strimzi) while still managing users defined in KafkaUser CRs? Currently, it seems to reconcile KafkaUser resources and deletes ACLs not explicitly defined—how can I prevent this?”

I tested a sample KafkaUser cr to apply access to a topic, it was added but proceeds to delete all other acls that existed on the cluster before.

Thanks

[scholzj]

No. The operator will always delete all ACL rights that do not match any KafkaUser resources. The exceptions are the rights for the users ANONYMOUS or * which will be ignored.

[PatDS28]

Thanks for the reply, just to follow up, so if ever i executed some manual commands in our msk using kafka.acls, then it will also overwrite it?

[scholzj]

You mean manual commands to add/remove/change some ACLs? Yes, it would revert those changes unless they belong to one of the two special users.

[PatDS28]

Okay this is noted
I thought it will be possible to implement the standalone user operator without wiping out existing ACLs, example, can we scope the User Operator to manage only a subset of users without affecting global ACL state

[scholzj]

No, that is not possible. Sorry.