Topics are declared rather than auto-created: the application account has no
Create ACL, so a producer would have been denied, and an auto-created topic
takes broker defaults nobody chose.
The credentials store lets an application namespace read its own KafkaUser
password and the cluster CA from the kafka namespace, so the password stays
generated and rotatable by Strimzi instead of being copied by hand.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Strimzi 1.2.0 supports 4.2.0 through 4.3.1; the manifest still asked for 4.1.0,
so the cluster sat NotReady with the reason only visible in the Kafka CR's
status — the operator logs said nothing. Pinned to 4.3.1, and metadataVersion
removed rather than guessed: the operator derives it, and a stale spelling there
is the same failure one release later.
Adds a KafkaUser for classic-models-api: Write and Describe on the
classic-models. prefix, and no Read. It publishes domain events and consumes
nothing, and a producer that can read every topic exfiltrates every other
domain's events if it is ever compromised.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Stéphane Tailland