---
# Admin account: super user (declared in Kafka CR → authorization.superUsers).
# Strimzi-generated secret: kubectl -n kafka get secret kafka-admin
apiVersion: kafka.strimzi.io/v1
kind: KafkaUser
metadata:
  name: kafka-admin
  namespace: kafka
  labels:
    strimzi.io/cluster: kafka
spec:
  authentication:
    type: scram-sha-512
---
# Application account with explicit ACLs — duplicate per application.
# Strimzi-generated secret: kubectl -n kafka get secret kafka-client
apiVersion: kafka.strimzi.io/v1
kind: KafkaUser
metadata:
  name: kafka-client
  namespace: kafka
  labels:
    strimzi.io/cluster: kafka
spec:
  authentication:
    type: scram-sha-512
  authorization:
    type: simple
    acls:
      - resource:
          type: topic
          name: "*"
          patternType: literal
        operations:
          - Read
          - Write
          - Create
          - Delete
          - Describe
          - DescribeConfigs
      - resource:
          type: group
          name: "*"
          patternType: literal
        operations:
          - Read
          - Describe
      - resource:
          type: transactionalId
          name: "*"
          patternType: literal
        operations:
          - Describe
          - Write
---
# The classic-models API, which publishes domain events and consumes nothing.
#
# Write-only and topic-scoped: a producer that can also read every topic is a
# producer that can exfiltrate every other domain's events if it is ever
# compromised. Describe is needed for metadata; it does not grant reads.
apiVersion: kafka.strimzi.io/v1
kind: KafkaUser
metadata:
  name: classic-models-api
  namespace: kafka
  labels:
    strimzi.io/cluster: kafka
spec:
  authentication:
    type: scram-sha-512
  authorization:
    type: simple
    acls:
      - resource:
          type: topic
          name: classic-models.
          patternType: prefix
        operations:
          - Write
          - Describe

---
# The Approvisionnement agent, which is woken by catalog events.
#
# Read on one topic and one consumer-group prefix, nothing else. It cannot see
# sales or payments — an agent whose job is stock has no business reading who
# paid what — and it cannot write, so a compromised workflow can raise no event
# that another agent would then act on.
apiVersion: kafka.strimzi.io/v1
kind: KafkaUser
metadata:
  name: classic-models-agent-approvisionnement
  namespace: kafka
  labels:
    strimzi.io/cluster: kafka
spec:
  authentication:
    type: scram-sha-512
  authorization:
    type: simple
    acls:
      - resource:
          type: topic
          name: classic-models.catalog
          patternType: literal
        operations:
          - Read
          - Describe
      - resource:
          type: group
          name: approvisionnement-
          patternType: prefix
        operations:
          - Read
          - Describe