Stéphane Tailland
9e0f908f19
Read on one topic and one consumer-group prefix. It cannot see sales or payments, and it cannot write, so a compromised workflow can raise no event another agent would act on. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
116 lines
2.8 KiB
YAML
116 lines
2.8 KiB
YAML
---
|
|
# Admin account: super user (declared in Kafka CR → authorization.superUsers).
|
|
# Strimzi-generated secret: kubectl -n kafka get secret kafka-admin
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaUser
|
|
metadata:
|
|
name: kafka-admin
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
authentication:
|
|
type: scram-sha-512
|
|
---
|
|
# Application account with explicit ACLs — duplicate per application.
|
|
# Strimzi-generated secret: kubectl -n kafka get secret kafka-client
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaUser
|
|
metadata:
|
|
name: kafka-client
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
authentication:
|
|
type: scram-sha-512
|
|
authorization:
|
|
type: simple
|
|
acls:
|
|
- resource:
|
|
type: topic
|
|
name: "*"
|
|
patternType: literal
|
|
operations:
|
|
- Read
|
|
- Write
|
|
- Create
|
|
- Delete
|
|
- Describe
|
|
- DescribeConfigs
|
|
- resource:
|
|
type: group
|
|
name: "*"
|
|
patternType: literal
|
|
operations:
|
|
- Read
|
|
- Describe
|
|
- resource:
|
|
type: transactionalId
|
|
name: "*"
|
|
patternType: literal
|
|
operations:
|
|
- Describe
|
|
- Write
|
|
---
|
|
# The classic-models API, which publishes domain events and consumes nothing.
|
|
#
|
|
# Write-only and topic-scoped: a producer that can also read every topic is a
|
|
# producer that can exfiltrate every other domain's events if it is ever
|
|
# compromised. Describe is needed for metadata; it does not grant reads.
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaUser
|
|
metadata:
|
|
name: classic-models-api
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
authentication:
|
|
type: scram-sha-512
|
|
authorization:
|
|
type: simple
|
|
acls:
|
|
- resource:
|
|
type: topic
|
|
name: classic-models.
|
|
patternType: prefix
|
|
operations:
|
|
- Write
|
|
- Describe
|
|
|
|
---
|
|
# The Approvisionnement agent, which is woken by catalog events.
|
|
#
|
|
# Read on one topic and one consumer-group prefix, nothing else. It cannot see
|
|
# sales or payments — an agent whose job is stock has no business reading who
|
|
# paid what — and it cannot write, so a compromised workflow can raise no event
|
|
# that another agent would then act on.
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaUser
|
|
metadata:
|
|
name: classic-models-agent-approvisionnement
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
authentication:
|
|
type: scram-sha-512
|
|
authorization:
|
|
type: simple
|
|
acls:
|
|
- resource:
|
|
type: topic
|
|
name: classic-models.catalog
|
|
patternType: literal
|
|
operations:
|
|
- Read
|
|
- Describe
|
|
- resource:
|
|
type: group
|
|
name: approvisionnement-
|
|
patternType: prefix
|
|
operations:
|
|
- Read
|
|
- Describe
|