Stéphane Tailland
e6699912a5
The repo had accreted one estate's accounts, topics and prose. An application's account and its topics belong to the application, whose own repo says what it may read and write — so that adding or removing the application adds or removes its access. What is left is the cluster, the admin and smoke-test accounts, the cross-namespace credentials store, and the pattern to copy. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
91 lines
2.7 KiB
YAML
91 lines
2.7 KiB
YAML
---
|
|
# Admin account: super user (declared in Kafka CR → authorization.superUsers).
|
|
# Strimzi-generated secret: kubectl -n kafka get secret kafka-admin
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaUser
|
|
metadata:
|
|
name: kafka-admin
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
authentication:
|
|
type: scram-sha-512
|
|
---
|
|
# Application account with explicit ACLs — duplicate per application.
|
|
# Strimzi-generated secret: kubectl -n kafka get secret kafka-client
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaUser
|
|
metadata:
|
|
name: kafka-client
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
authentication:
|
|
type: scram-sha-512
|
|
authorization:
|
|
type: simple
|
|
acls:
|
|
- resource:
|
|
type: topic
|
|
name: "*"
|
|
patternType: literal
|
|
operations:
|
|
- Read
|
|
- Write
|
|
- Create
|
|
- Delete
|
|
- Describe
|
|
- DescribeConfigs
|
|
- resource:
|
|
type: group
|
|
name: "*"
|
|
patternType: literal
|
|
operations:
|
|
- Read
|
|
- Describe
|
|
- resource:
|
|
type: transactionalId
|
|
name: "*"
|
|
patternType: literal
|
|
operations:
|
|
- Describe
|
|
- Write
|
|
|
|
# --- adding an application account ----------------------------------------
|
|
#
|
|
# Do not add one here. An account belongs to the application that uses it: its
|
|
# own repo says what it may read and write, and adding or removing the
|
|
# application adds or removes its access. This repo deploys a cluster and holds
|
|
# no opinion about who uses it.
|
|
#
|
|
# Create the CR from the application's own repo, in **this** namespace — Strimzi
|
|
# runs with `watchAnyNamespace=false`, so a KafkaUser anywhere else is ignored,
|
|
# silently. Copy the shape below and cut it down to what the application does:
|
|
#
|
|
# apiVersion: kafka.strimzi.io/v1
|
|
# kind: KafkaUser
|
|
# metadata:
|
|
# name: <application>
|
|
# namespace: kafka
|
|
# labels:
|
|
# strimzi.io/cluster: kafka
|
|
# spec:
|
|
# authentication:
|
|
# type: scram-sha-512
|
|
# authorization:
|
|
# type: simple
|
|
# acls:
|
|
# - resource: {type: topic, name: <prefix>, patternType: prefix}
|
|
# operations: [Write, Describe] # a producer
|
|
# - resource: {type: group, name: <prefix>, patternType: prefix}
|
|
# operations: [Read, Describe] # a consumer's group
|
|
#
|
|
# A producer that can also read every topic exfiltrates every other
|
|
# application's data if it is ever compromised, and a consumer that can write
|
|
# can raise an event someone else acts on. Grant one direction, on one prefix.
|
|
#
|
|
# `kafka-client` above is the wide-open template: useful for a smoke test, and
|
|
# for nothing that runs unattended.
|