When doing Clients CA renewal, only Kafka pods should be rolled, but RU will start also for EntityOperator, KafkaExporter and CruiseControl. That should not be needed since KE and CC do not use the Clients CA. UO uses it, but it is loading the certificates via Kube API in every reconciliation and not via volumes or environment variables.
Created by Strimzi#5810