fix: pin a Kafka version the operator supports, and add the API's producer

Strimzi 1.2.0 supports 4.2.0 through 4.3.1; the manifest still asked for 4.1.0,
so the cluster sat NotReady with the reason only visible in the Kafka CR's
status — the operator logs said nothing. Pinned to 4.3.1, and metadataVersion
removed rather than guessed: the operator derives it, and a stale spelling there
is the same failure one release later.

Adds a KafkaUser for classic-models-api: Write and Describe on the
classic-models. prefix, and no Read. It publishes domain events and consumes
nothing, and a producer that can read every topic exfiltrates every other
domain's events if it is ever compromised.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Makefile

@@ -16,8 +16,8 @@ GROUP        ?= my-group
 MAX          ?= 10
 PARTITIONS   ?= 1
 REPLICAS     ?= 1
-KAFKA_VER    ?= 4.1.0
-METADATA_VER ?= 4.1-IV0
+KAFKA_VER    ?= 4.3.1
+METADATA_VER ?= 4.3-IV0
 
 KUBECTL   := kubectl -n $(NAMESPACE)
 KEXEC     := $(KUBECTL) exec $(BROKER) --

README.md

@@ -9,7 +9,7 @@ Single-broker Kafka cluster for dev/test, deployed via the [Strimzi](https://str
 ```
 kafka namespace
 ├── strimzi-cluster-operator   Strimzi operator — reconciles Kafka/KafkaUser/KafkaTopic CRs
-├── kafka-dual-role-0          Kafka 4.1.0 broker (KRaft, controller + broker in one pod)
+├── kafka-dual-role-0          Kafka 4.3.1 broker (KRaft, controller + broker in one pod)
 └── kafka-entity-operator      Topic Operator + User Operator (manages topics and users)
 ```
 
@@ -40,6 +40,12 @@ kafka-kafka-bootstrap.kafka.svc.cluster.local:9093
 |---|---|---|
 | `kafka-admin` | `kafka-admin` | Super user — unrestricted access |
 | `kafka-client` | `kafka-client` | Application user — Read/Write all topics and groups |
+| `classic-models-api` | `classic-models-api` | Producer for `classic-models.*` — **Write and Describe only**, no Read |
+
+`classic-models-api` publishes domain events and consumes nothing, so it is
+write-only and prefix-scoped. A producer that can also read every topic is a
+producer that exfiltrates every other domain's events if it is ever
+compromised.
 
 Strimzi stores credentials in Kubernetes secrets. Each secret contains two keys:
 - `password` — the SCRAM password

kafka-users.yaml

@@ -52,3 +52,30 @@ spec:
         operations:
           - Describe
           - Write
+---
+# The classic-models API, which publishes domain events and consumes nothing.
+#
+# Write-only and topic-scoped: a producer that can also read every topic is a
+# producer that can exfiltrate every other domain's events if it is ever
+# compromised. Describe is needed for metadata; it does not grant reads.
+apiVersion: kafka.strimzi.io/v1
+kind: KafkaUser
+metadata:
+  name: classic-models-api
+  namespace: kafka
+  labels:
+    strimzi.io/cluster: kafka
+spec:
+  authentication:
+    type: scram-sha-512
+  authorization:
+    type: simple
+    acls:
+      - resource:
+          type: topic
+          name: classic-models.
+          patternType: prefix
+        operations:
+          - Write
+          - Describe
+

kafka.yaml

@@ -36,8 +36,7 @@ metadata:
     strimzi.io/kraft: enabled
 spec:
   kafka:
-    version: 4.1.0
-    metadataVersion: "4.1-IV0"
+    version: 4.3.1
     listeners:
       - name: tls
         port: 9093