fix: pin a Kafka version the operator supports, and add the API's producer

Strimzi 1.2.0 supports 4.2.0 through 4.3.1; the manifest still asked for 4.1.0,
so the cluster sat NotReady with the reason only visible in the Kafka CR's
status — the operator logs said nothing. Pinned to 4.3.1, and metadataVersion
removed rather than guessed: the operator derives it, and a stale spelling there
is the same failure one release later.

Adds a KafkaUser for classic-models-api: Write and Describe on the
classic-models. prefix, and no Read. It publishes domain events and consumes
nothing, and a producer that can read every topic exfiltrates every other
domain's events if it is ever compromised.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

This commit is contained in:

Stéphane Tailland

2026-08-30 16:12:30 +02:00

parent e99cc49b8a

commit 5fad740b7f

4 changed files with 37 additions and 5 deletions

									
										kafka.yaml
									
		+1
		-2
	
												View File
												
				@@ -36,8 +36,7 @@ metadata:

				    strimzi.io/kraft: enabled

				spec:

				  kafka:

				    version: 4.1.0

				    metadataVersion: "4.1-IV0"

				    version: 4.3.1

				    listeners:

				      - name: tls

				        port: 9093