Deploy a cluster, not an estate

The repo had accreted one estate's accounts, topics and prose. An application's account and its topics belong to the application, whose own repo says what it may read and write — so that adding or removing the application adds or removes its access. What is left is the cluster, the admin and smoke-test accounts, the cross-namespace credentials store, and the pattern to copy. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-31 08:43:14 +02:00
parent 979c9da6c0
commit e6699912a5
4 changed files with 62 additions and 144 deletions
@@ -52,64 +52,39 @@ spec:
        operations:
          - Describe
          - Write
---
-# The classic-models API, which publishes domain events and consumes nothing.
-#
-# Write-only and topic-scoped: a producer that can also read every topic is a
-# producer that can exfiltrate every other domain's events if it is ever
-# compromised. Describe is needed for metadata; it does not grant reads.
-apiVersion: kafka.strimzi.io/v1
-kind: KafkaUser
-metadata:
-  name: classic-models-api
-  namespace: kafka
-  labels:
-    strimzi.io/cluster: kafka
-spec:
-  authentication:
-    type: scram-sha-512
-  authorization:
-    type: simple
-    acls:
-      - resource:
-          type: topic
-          name: classic-models.
-          patternType: prefix
-        operations:
-          - Write
-          - Describe

---
-# The Approvisionnement agent, which is woken by catalog events.
+# --- adding an application account ----------------------------------------
 #
-# Read on one topic and one consumer-group prefix, nothing else. It cannot see
-# sales or payments — an agent whose job is stock has no business reading who
-# paid what — and it cannot write, so a compromised workflow can raise no event
-# that another agent would then act on.
-apiVersion: kafka.strimzi.io/v1
-kind: KafkaUser
-metadata:
-  name: classic-models-agent-approvisionnement
-  namespace: kafka
-  labels:
-    strimzi.io/cluster: kafka
-spec:
-  authentication:
-    type: scram-sha-512
-  authorization:
-    type: simple
-    acls:
-      - resource:
-          type: topic
-          name: classic-models.catalog
-          patternType: literal
-        operations:
-          - Read
-          - Describe
-      - resource:
-          type: group
-          name: approvisionnement-
-          patternType: prefix
-        operations:
-          - Read
-          - Describe
+# Do not add one here. An account belongs to the application that uses it: its
+# own repo says what it may read and write, and adding or removing the
+# application adds or removes its access. This repo deploys a cluster and holds
+# no opinion about who uses it.
+#
+# Create the CR from the application's own repo, in **this** namespace — Strimzi
+# runs with `watchAnyNamespace=false`, so a KafkaUser anywhere else is ignored,
+# silently. Copy the shape below and cut it down to what the application does:
+#
+#   apiVersion: kafka.strimzi.io/v1
+#   kind: KafkaUser
+#   metadata:
+#     name: <application>
+#     namespace: kafka
+#     labels:
+#       strimzi.io/cluster: kafka
+#   spec:
+#     authentication:
+#       type: scram-sha-512
+#     authorization:
+#       type: simple
+#       acls:
+#         - resource: {type: topic, name: <prefix>, patternType: prefix}
+#           operations: [Write, Describe]      # a producer
+#         - resource: {type: group, name: <prefix>, patternType: prefix}
+#           operations: [Read, Describe]       # a consumer's group
+#
+# A producer that can also read every topic exfiltrates every other
+# application's data if it is ever compromised, and a consumer that can write
+# can raise an event someone else acts on. Grant one direction, on one prefix.
+#
+# `kafka-client` above is the wide-open template: useful for a smoke test, and
+# for nothing that runs unattended.