When UO or TO is configured to watch different namespace, the roles for TO and UO have to be created in this namespace. However, because they will be in a different namespace than the Kafka CR which created them, they should not use ownerReference. When the ownerReference is used, it can cause problems on older Kube versions, but on Kube 1.20 / OCP 4.7 it will be immediately garbage collected and the TO / UO do not work.