Stéphane Tailland
f810efbc04
An account belongs to the consumer, not the broker: this repo says what the agent may read, so adding or removing the agent adds or removes its access. It was in infra-kafka, which deploys a cluster and should hold no opinion about who uses it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
43 lines
1.3 KiB
YAML
43 lines
1.3 KiB
YAML
# This agent's Kafka account.
|
|
#
|
|
# It lives here rather than with the cluster because the account belongs to the
|
|
# consumer, not to the broker: the agent's repo says what the agent may read,
|
|
# and adding or removing the agent adds or removes its access. `infra-kafka`
|
|
# deploys a cluster and holds no opinion about who uses it.
|
|
#
|
|
# The CR itself must be created in the operator's namespace — Strimzi runs with
|
|
# `watchAnyNamespace=false`, so a KafkaUser anywhere else is simply ignored, with
|
|
# no error anywhere.
|
|
#
|
|
# Read on one topic and one consumer-group prefix. It cannot see sales or
|
|
# payments — an agent whose job is stock has no business reading who paid what —
|
|
# and it cannot write, so a compromised workflow can raise no event that another
|
|
# agent would then act on.
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaUser
|
|
metadata:
|
|
name: classic-models-agent-approvisionnement
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
authentication:
|
|
type: scram-sha-512
|
|
authorization:
|
|
type: simple
|
|
acls:
|
|
- resource:
|
|
type: topic
|
|
name: classic-models.catalog
|
|
patternType: literal
|
|
operations:
|
|
- Read
|
|
- Describe
|
|
- resource:
|
|
type: group
|
|
name: approvisionnement-
|
|
patternType: prefix
|
|
operations:
|
|
- Read
|
|
- Describe
|