Deprecates our own statefulset pod label kafka-broker-id

Author: solsson

README.md

@@ -68,6 +68,8 @@ For clusters that enfoce [RBAC](https://kubernetes.io/docs/admin/authorization/r
 kubectl apply -f rbac-namespace-default/
 ```
 
+For example rack awareness can fail without this, `logs -c init-config` showing `Error from server (Forbidden): pods "kafka-0" is forbidden: User "system:serviceaccount:kafka:default" cannot get pods in the namespace "kafka": Unknown user "system:serviceaccount:kafka:default"`.
+
 ## Tests
 
 Tests are based on the [kube-test](https://github.com/Yolean/kube-test) concept.

kafka/10broker-config.yml

@@ -23,6 +23,7 @@ data:
         sed -i "s/#init#broker.rack=#init#/broker.rack=$ZONE/" /etc/kafka/server.properties
       fi
 
+      # This requires additional RBAC, and won't be needed after https://github.com/kubernetes/kubernetes/pull/55329
       kubectl -n $POD_NAMESPACE label pod $POD_NAME kafka-broker-id=$KAFKA_BROKER_ID
 
       OUTSIDE_HOST=$(kubectl get node "$NODE_NAME" -o jsonpath='{.status.addresses[?(@.type=="InternalIP")].address}')