Stéphane Tailland
5fad740b7f
Strimzi 1.2.0 supports 4.2.0 through 4.3.1; the manifest still asked for 4.1.0, so the cluster sat NotReady with the reason only visible in the Kafka CR's status — the operator logs said nothing. Pinned to 4.3.1, and metadataVersion removed rather than guessed: the operator derives it, and a stale spelling there is the same failure one release later. Adds a KafkaUser for classic-models-api: Write and Describe on the classic-models. prefix, and no Read. It publishes domain events and consumes nothing, and a producer that can read every topic exfiltrates every other domain's events if it is ever compromised. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
60 lines
1.2 KiB
YAML
60 lines
1.2 KiB
YAML
---
|
|
# KRaft mode: single pod acting as both controller and broker.
|
|
# Storage is defined here (not in the Kafka CR) because node pools are enabled.
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaNodePool
|
|
metadata:
|
|
name: dual-role
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
replicas: 1
|
|
roles:
|
|
- controller
|
|
- broker
|
|
storage:
|
|
type: persistent-claim
|
|
size: 10Gi
|
|
deleteClaim: true
|
|
class: local-path
|
|
resources:
|
|
requests:
|
|
memory: 1Gi
|
|
cpu: "250m"
|
|
limits:
|
|
memory: 2Gi
|
|
cpu: "1000m"
|
|
---
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: Kafka
|
|
metadata:
|
|
name: kafka
|
|
namespace: kafka
|
|
annotations:
|
|
strimzi.io/node-pools: enabled
|
|
strimzi.io/kraft: enabled
|
|
spec:
|
|
kafka:
|
|
version: 4.3.1
|
|
listeners:
|
|
- name: tls
|
|
port: 9093
|
|
type: internal
|
|
tls: true
|
|
authentication:
|
|
type: scram-sha-512
|
|
authorization:
|
|
type: simple
|
|
superUsers:
|
|
- kafka-admin
|
|
config:
|
|
offsets.topic.replication.factor: "1"
|
|
transaction.state.log.replication.factor: "1"
|
|
transaction.state.log.min.isr: "1"
|
|
default.replication.factor: "1"
|
|
min.insync.replicas: "1"
|
|
entityOperator:
|
|
topicOperator: {}
|
|
userOperator: {}
|