Why won't Strimzi create external broker when nodeport listener is configured?

Using docker-desktop w/kubernetes in Windows 10

I cannot get my kafka image to expose external brokers using nodeport following this guide

Strimzi cluster-operator and entity operators are deployed - when I do

kubectl get deployments

the response is

NAME                         READY   UP-TO-DATE   AVAILABLE   AGE
my-cluster-entity-operator   1/1     1            1           27m
strimzi-cluster-operator     1/1     1            1           33m

but when I do

kubectl get svc

the response is

NAME                          TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                               AGE
my-cluster-kafka-bootstrap    ClusterIP   10.101.45.155   <none>        9091/TCP,9092/TCP,9093/TCP            28m
my-cluster-kafka-brokers      ClusterIP   None            <none>        9090/TCP,9091/TCP,9092/TCP,9093/TCP   28m
my-cluster-zookeeper-client   ClusterIP   10.110.47.4     <none>        2181/TCP                              32m
my-cluster-zookeeper-nodes    ClusterIP   None            <none>        2181/TCP,2888/TCP,3888/TCP            32m

I would think that an external bootstrap and external brokers would be started on 9094, but nothing appears. What am I doing wrong?

My kafka.yaml:

apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  name: my-cluster
spec:
  kafka:
    version: 3.2.0
    replicas: 3
    listeners:
      - name: plain
        port: 9092
        type: internal
        tls: false
      - name: tls
        port: 9093
        type: internal
        tls: true
      - name: external
        type: nodeport
        tls: false
        port: 9094
    config:
      offsets.topic.replication.factor: 3
      transaction.state.log.replication.factor: 3
      transaction.state.log.min.isr: 2
      default.replication.factor: 3
      min.insync.replicas: 2
      inter.broker.protocol.version: "3.2"
    storage:
      type: ephemeral
  zookeeper:
    replicas: 3
    storage:
      type: ephemeral
  entityOperator:
    topicOperator: {}
    userOperator: {}

Edit to include more resources:

status condition is showing the following:

Failure executing: GET at: https://10.96.0.1/apis/rbac.authorization.k8s.io/v1/clusterrolebindings/strimzi-debezium-my-cluster-kafka-init. Message: Forbidden!Configured service account doesn''t have access. Service account may have been revoked. clusterrolebindings.rbac.authorization.k8s.io "strimzi-debezium-my-cluster-kafka-init" is forbidden: User "system:serviceaccount:debezium:strimzi-cluster-operator" cannot get resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope

Seems like an obvious enough message, I'm thinking I need to figure out how to configure the service account