Stéphane Tailland
5fad740b7f
Strimzi 1.2.0 supports 4.2.0 through 4.3.1; the manifest still asked for 4.1.0, so the cluster sat NotReady with the reason only visible in the Kafka CR's status — the operator logs said nothing. Pinned to 4.3.1, and metadataVersion removed rather than guessed: the operator derives it, and a stale spelling there is the same failure one release later. Adds a KafkaUser for classic-models-api: Write and Describe on the classic-models. prefix, and no Read. It publishes domain events and consumes nothing, and a producer that can read every topic exfiltrates every other domain's events if it is ever compromised. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
82 lines
1.9 KiB
YAML
82 lines
1.9 KiB
YAML
---
|
|
# Admin account: super user (declared in Kafka CR → authorization.superUsers).
|
|
# Strimzi-generated secret: kubectl -n kafka get secret kafka-admin
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaUser
|
|
metadata:
|
|
name: kafka-admin
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
authentication:
|
|
type: scram-sha-512
|
|
---
|
|
# Application account with explicit ACLs — duplicate per application.
|
|
# Strimzi-generated secret: kubectl -n kafka get secret kafka-client
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaUser
|
|
metadata:
|
|
name: kafka-client
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
authentication:
|
|
type: scram-sha-512
|
|
authorization:
|
|
type: simple
|
|
acls:
|
|
- resource:
|
|
type: topic
|
|
name: "*"
|
|
patternType: literal
|
|
operations:
|
|
- Read
|
|
- Write
|
|
- Create
|
|
- Delete
|
|
- Describe
|
|
- DescribeConfigs
|
|
- resource:
|
|
type: group
|
|
name: "*"
|
|
patternType: literal
|
|
operations:
|
|
- Read
|
|
- Describe
|
|
- resource:
|
|
type: transactionalId
|
|
name: "*"
|
|
patternType: literal
|
|
operations:
|
|
- Describe
|
|
- Write
|
|
---
|
|
# The classic-models API, which publishes domain events and consumes nothing.
|
|
#
|
|
# Write-only and topic-scoped: a producer that can also read every topic is a
|
|
# producer that can exfiltrate every other domain's events if it is ever
|
|
# compromised. Describe is needed for metadata; it does not grant reads.
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaUser
|
|
metadata:
|
|
name: classic-models-api
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
authentication:
|
|
type: scram-sha-512
|
|
authorization:
|
|
type: simple
|
|
acls:
|
|
- resource:
|
|
type: topic
|
|
name: classic-models.
|
|
patternType: prefix
|
|
operations:
|
|
- Write
|
|
- Describe
|
|
|