# This agent's Kafka account.
#
# It lives here rather than with the cluster because the account belongs to the
# consumer, not to the broker: the agent's repo says what the agent may read,
# and adding or removing the agent adds or removes its access. `infra-kafka`
# deploys a cluster and holds no opinion about who uses it.
#
# The CR itself must be created in the operator's namespace — Strimzi runs with
# `watchAnyNamespace=false`, so a KafkaUser anywhere else is simply ignored, with
# no error anywhere.
#
# Read on one topic and one consumer-group prefix. It cannot see sales or
# payments — an agent whose job is stock has no business reading who paid what —
# and it cannot write, so a compromised workflow can raise no event that another
# agent would then act on.
apiVersion: kafka.strimzi.io/v1
kind: KafkaUser
metadata:
  name: classic-models-agent-approvisionnement
  namespace: kafka
  labels:
    strimzi.io/cluster: kafka
spec:
  authentication:
    type: scram-sha-512
  authorization:
    type: simple
    acls:
      - resource:
          type: topic
          name: classic-models.catalog
          patternType: literal
        operations:
          - Read
          - Describe
      - resource:
          type: group
          name: approvisionnement-
          patternType: prefix
        operations:
          - Read
          - Describe