Administer the Kafka topology centrally

Topics and accounts on the shared cluster belong to the platform team, for the
same reason the gateway defaults do: an ACL is not a team's decision to make
about itself, and a partition count is not a team's decision to make about the
cluster.

They had been pushed into the application repos on the argument that ownership
follows use. That argument holds for a contract, not for a grant.

Self-service is a different thing and does not come from moving these files: it
comes from an event gateway that virtualises topics and a developer portal that
socialises them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

flux/kafka-topology.yaml

@@ -0,0 +1,21 @@
+# Topics and accounts on the shared Kafka cluster.
+#
+# Platform-owned, like the domain defaults beside it: an ACL is not a team's
+# decision to make about itself, and a partition count is not a team's decision
+# to make about the cluster.
+#
+# No targetNamespace — every object names `kafka` explicitly, because that is
+# the only namespace Strimzi watches and putting one anywhere else fails in
+# silence.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: kafka-topology
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: k8s-platform
+  path: ./kafka-topology
+  prune: true

flux/kustomization.yaml

@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
   - fluxinstance.yaml
   - gitrepository.yaml
+  - kafka-topology.yaml