Administer the Kafka topology centrally

Topics and accounts on the shared cluster belong to the platform team, for the
same reason the gateway defaults do: an ACL is not a team's decision to make
about itself, and a partition count is not a team's decision to make about the
cluster.

They had been pushed into the application repos on the argument that ownership
follows use. That argument holds for a contract, not for a grant.

Self-service is a different thing and does not come from moving these files: it
comes from an event gateway that virtualises topics and a developer portal that
socialises them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

kafka-topology/classic-models.yaml

@@ -0,0 +1,123 @@
+# The classic-models estate on the shared Kafka cluster.
+#
+# Everything here is created in the `kafka` namespace, because that is the only
+# one Strimzi watches (`watchAnyNamespace=false`). A CR elsewhere is ignored in
+# silence — no status, no Secret, no log line.
+#
+# The events these topics carry are specified by their producer, in
+# classic-models-api/docs/DOMAIN_EVENTS.md. This file grants access; it does not
+# define meaning.
+
+# --- topics -----------------------------------------------------------------
+#
+# One per aggregate, not one per event type: per type would lose the order
+# between product.created and product.stock_changed for the same product, which
+# is the one ordering a consumer actually needs.
+#
+# Declared rather than auto-created — the accounts below have no Create ACL, so
+# a producer would simply be denied, and an auto-created topic takes broker
+# defaults nobody chose. Partition count is the ceiling on consumer parallelism
+# and cannot be lowered later.
+---
+apiVersion: kafka.strimzi.io/v1
+kind: KafkaTopic
+metadata:
+  name: classic-models.catalog
+  namespace: kafka
+  labels:
+    strimzi.io/cluster: kafka
+spec:
+  partitions: 3
+  replicas: 1
+  config:
+    retention.ms: "604800000"   # 7 days
+    cleanup.policy: delete
+    min.insync.replicas: "1"
+---
+apiVersion: kafka.strimzi.io/v1
+kind: KafkaTopic
+metadata:
+  name: classic-models.sales
+  namespace: kafka
+  labels:
+    strimzi.io/cluster: kafka
+spec:
+  partitions: 3
+  replicas: 1
+  config:
+    retention.ms: "604800000"
+    cleanup.policy: delete
+    min.insync.replicas: "1"
+---
+apiVersion: kafka.strimzi.io/v1
+kind: KafkaTopic
+metadata:
+  name: classic-models.payments
+  namespace: kafka
+  labels:
+    strimzi.io/cluster: kafka
+spec:
+  partitions: 3
+  replicas: 1
+  config:
+    retention.ms: "604800000"
+    cleanup.policy: delete
+    min.insync.replicas: "1"
+
+# --- accounts ---------------------------------------------------------------
+#
+# One direction each, on one prefix. A producer that could also read every topic
+# exfiltrates every other application's data if it is ever compromised, and a
+# consumer that could write can raise an event someone else acts on.
+---
+# classic-models-api. Publishes domain events, consumes nothing.
+apiVersion: kafka.strimzi.io/v1
+kind: KafkaUser
+metadata:
+  name: classic-models-api
+  namespace: kafka
+  labels:
+    strimzi.io/cluster: kafka
+spec:
+  authentication:
+    type: scram-sha-512
+  authorization:
+    type: simple
+    acls:
+      - resource:
+          type: topic
+          name: classic-models.
+          patternType: prefix
+        operations:
+          - Write
+          - Describe
+---
+# The Approvisionnement agent. Reads the catalog topic only — an agent whose job
+# is stock has no business reading who paid what.
+apiVersion: kafka.strimzi.io/v1
+kind: KafkaUser
+metadata:
+  name: classic-models-agent-approvisionnement
+  namespace: kafka
+  labels:
+    strimzi.io/cluster: kafka
+spec:
+  authentication:
+    type: scram-sha-512
+  authorization:
+    type: simple
+    acls:
+      - resource:
+          type: topic
+          name: classic-models.catalog
+          patternType: literal
+        operations:
+          - Read
+          - Describe
+      - resource:
+          type: group
+          name: approvisionnement-
+          patternType: prefix
+        operations:
+          - Read
+          - Describe