fix: pin a Kafka version the operator supports, and add the API's producer

Strimzi 1.2.0 supports 4.2.0 through 4.3.1; the manifest still asked for 4.1.0, so the cluster sat NotReady with the reason only visible in the Kafka CR's status — the operator logs said nothing. Pinned to 4.3.1, and metadataVersion removed rather than guessed: the operator derives it, and a stale spelling there is the same failure one release later. Adds a KafkaUser for classic-models-api: Write and Describe on the classic-models. prefix, and no Read. It publishes domain events and consumes nothing, and a producer that can read every topic exfiltrates every other domain's events if it is ever compromised. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-30 16:12:30 +02:00
parent e99cc49b8a
commit 5fad740b7f
4 changed files with 37 additions and 5 deletions
@@ -16,8 +16,8 @@ GROUP        ?= my-group
 MAX          ?= 10
 PARTITIONS   ?= 1
 REPLICAS     ?= 1
-KAFKA_VER    ?= 4.1.0
-METADATA_VER ?= 4.1-IV0
+KAFKA_VER    ?= 4.3.1
+METADATA_VER ?= 4.3-IV0

 KUBECTL   := kubectl -n $(NAMESPACE)
 KEXEC     := $(KUBECTL) exec $(BROKER) --