stt/infra-kafka
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Declare the classic-models topics and a credentials store

Browse Source 
Topics are declared rather than auto-created: the application account has no
Create ACL, so a producer would have been denied, and an auto-created topic
takes broker defaults nobody chose.

The credentials store lets an application namespace read its own KafkaUser
password and the cluster CA from the kafka namespace, so the password stays
generated and rotatable by Strimzi instead of being copied by hand.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Stéphane Tailland
2026-08-31 07:34:55 +02:00
parent 5fad740b7f
commit 5770f78c99
3 changed files with 134 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+10 -5
View File
@@ -59,28 +59,31 @@ help:
# ── Cluster lifecycle ─────────────────────────────────────────────────────────
deploy:
@echo "==> [1/5] Creating namespace '$(NAMESPACE)'"
@echo "==> [1/6] Creating namespace '$(NAMESPACE)'"
@kubectl create namespace $(NAMESPACE) --dry-run=client -o yaml | kubectl apply -f -
@echo "==> [2/5] Installing Strimzi operator"
@echo "==> [2/6] Installing Strimzi operator"
@helm repo add strimzi https://strimzi.io/charts/ 2>/dev/null || true
@helm repo update strimzi 2>/dev/null
@helm upgrade --install strimzi-kafka-operator strimzi/strimzi-kafka-operator \
--namespace $(NAMESPACE) \
--set watchAnyNamespace=false \
--wait --timeout 5m
@echo "==> [3/5] Waiting for Strimzi CRDs"
@echo "==> [3/6] Waiting for Strimzi CRDs"
@for crd in kafkas.kafka.strimzi.io kafkanodepools.kafka.strimzi.io kafkausers.kafka.strimzi.io; do \
until kubectl get crd "$$crd" -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' 2>/dev/null | grep -q True; do sleep 2; done; \
echo " $$crd ready"; \
done
@echo "==> [4/5] Deploying Kafka cluster (KRaft, SASL_SSL, SCRAM-SHA-512)"
@echo "==> [4/6] Deploying Kafka cluster (KRaft, SASL_SSL, SCRAM-SHA-512)"
@kubectl apply -f $(SCRIPT_DIR)kafka.yaml
@kubectl wait kafka/$(KAFKA_NAME) --for=condition=Ready --timeout=10m -n $(NAMESPACE)
@echo "==> [5/5] Deploying KafkaUsers"
@echo "==> [5/6] Deploying KafkaUsers"
@kubectl apply -f $(SCRIPT_DIR)kafka-users.yaml
@for user in kafka-admin kafka-client; do \
kubectl wait kafkauser/$$user --for=condition=Ready --timeout=120s -n $(NAMESPACE); \
done
@echo "==> [6/6] Deploying topics and the credentials store"
@kubectl apply -f $(SCRIPT_DIR)kafka-topics.yaml
@kubectl apply -f $(SCRIPT_DIR)credentials-access.yaml
@echo ""
@echo "Cluster ready. Bootstrap: $(BOOTSTRAP)"
@@ -112,6 +115,8 @@ upgrade:
teardown:
@echo "==> Deleting KafkaUsers and Kafka cluster"
@kubectl delete -f $(SCRIPT_DIR)credentials-access.yaml --ignore-not-found
@kubectl delete -f $(SCRIPT_DIR)kafka-topics.yaml --ignore-not-found
@kubectl delete -f $(SCRIPT_DIR)kafka-users.yaml --ignore-not-found
@kubectl delete -f $(SCRIPT_DIR)kafka.yaml --ignore-not-found
@echo "==> Waiting for pods to terminate"