From 9e0f908f19942d4c0f617f1547c8d638ac45aaaa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Tailland?= Date: Mon, 31 Aug 2026 07:46:24 +0200 Subject: [PATCH] Add the Approvisionnement consumer account Read on one topic and one consumer-group prefix. It cannot see sales or payments, and it cannot write, so a compromised workflow can raise no event another agent would act on. Co-Authored-By: Claude Opus 5 --- kafka-users.yaml | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/kafka-users.yaml b/kafka-users.yaml index d3c097e..1c3e7e6 100644 --- a/kafka-users.yaml +++ b/kafka-users.yaml @@ -79,3 +79,37 @@ spec: - Write - Describe +--- +# The Approvisionnement agent, which is woken by catalog events. +# +# Read on one topic and one consumer-group prefix, nothing else. It cannot see +# sales or payments — an agent whose job is stock has no business reading who +# paid what — and it cannot write, so a compromised workflow can raise no event +# that another agent would then act on. +apiVersion: kafka.strimzi.io/v1 +kind: KafkaUser +metadata: + name: classic-models-agent-approvisionnement + namespace: kafka + labels: + strimzi.io/cluster: kafka +spec: + authentication: + type: scram-sha-512 + authorization: + type: simple + acls: + - resource: + type: topic + name: classic-models.catalog + patternType: literal + operations: + - Read + - Describe + - resource: + type: group + name: approvisionnement- + patternType: prefix + operations: + - Read + - Describe