Repository navigation
feat(cli): kates deploy detects cluster admin and offers an admin-less profile - #451
Merged
Merged
Conversation
…s profile kates deploy asks `kubectl auth can-i '*' '*' --all-namespaces` before anything else. A cluster admin gets the full profile, as before. Any other account is told why and, on a terminal, offered the admin-less profile; with --yes or without a terminal it stops and prints the command. `kates deploy --adminless` installs Kafka, Kafka Connect with its PostgreSQL, MirrorMaker 2, Apicurio, Kafka UI and Kates (rbac.scope=namespace) into one existing namespace (--namespace, default the kube context's). It skips every cluster-scoped step: Strimzi, cert-manager, Kyverno, monitoring, Litmus, node introspection and namespace creation, and refuses the flags that ask for them. Before installing it checks that Strimzi's resources exist and that the account may create what the stack needs in the namespace, naming what is missing. The Kafka version follows the repository's Strimzi pin, since the installed operator can't be read without cluster-wide reads, and the DNS domain is taken to be cluster.local.
…spaces `kates deploy --adminless` no longer forces --topology single. It follows --topology and the --*-ns flags as a full deploy does, so by default each component goes into its own namespace (Kafka, Connect, PostgreSQL, Kates, Kafka UI, MirrorMaker 2), all of which must exist. --topology single still puts everything in --namespace, or the kube context's namespace. The prerequisite check now asks, per namespace, for what is created there: the core resources in every one, and Strimzi's where each is made (the Kafka cluster, topics and users in the Kafka namespace, Connect's in the Connect namespace, MirrorMaker 2's in its own). A refusal names its namespace.
This was referenced Oct 22, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
kates deploynow checks whether the account is cluster-admin (kubectl auth can-i '*' '*' --all-namespaces) before anything else.--yesor without a terminal it stops and prints the--adminlesscommand.kates deploy --adminlessinstalls Kafka, Kafka Connect with its PostgreSQL, MirrorMaker 2, Apicurio, Kafka UI and Kates (rbac.scope=namespace) into existing namespaces placed by--topologyand the--*-nsflags, as a full deploy does: one per component by default, or all in--namespace(default the kube context's) with--topology single. It skips Strimzi, cert-manager, Kyverno, monitoring, Litmus, node introspection and namespace creation, and refuses--with-chaos,--with-monitoringand the other cluster-scoped toggles.Before installing it checks that Strimzi's resources exist and that the account may create what the stack needs in each namespace (core resources everywhere, Strimzi's where each is made), and names what is missing per namespace (with the
strimzi-kafka-operator.createAggregateRoles=truehint for Strimzi's resources).Conformity: Kates's read-only Role in the Kafka namespace is installed only when the account holds every read it grants (RBAC refuses a Role for permissions the creator lacks, and the built-in
adminrole has no PodMonitor reads). Otherwise Kates installs withrbac.kafkaNamespaceRole=false, and deploy names the missing reads and prints thehelm template … | kubectl applycommand that turns conformity on.Limits
--strimzi-versionmatches another release.cluster.local.Docs
10-cli-reference.md(flag + profiles) and a "Deploying Without Cluster Admin" section in12-deployment.md.Tests
deploy_adminless_test.go: the can-i answer, the non-admin suggestion with no Helm calls, the admin-less install in both topologies (each release in its namespace, none cluster-scoped, Kates withrbac.scope=namespace), the per-namespace grants, the prerequisite checks, the refused flag.go test ./...incli/passes;golangci-lint --new-from-rev=origin/mainreports 0 issues.