From f5484dd67f43f90a11b689fa497ac59d55afaab5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Tailland?= <stephane@sttlab.eu>
Date: Mon, 31 Aug 2026 14:56:06 +0200
Subject: [PATCH] Add the supply account beside the one it replaces

Two at once so the consumer can move without a gap; the old one goes as soon as
it has.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 kafka-topology/classic-models.yaml | 35 ++++++++++++++++++++++++++++--
 1 file changed, 33 insertions(+), 2 deletions(-)

diff --git a/kafka-topology/classic-models.yaml b/kafka-topology/classic-models.yaml
index 36d605e..1548288 100644
--- a/kafka-topology/classic-models.yaml
+++ b/kafka-topology/classic-models.yaml
@@ -92,8 +92,39 @@ spec:
           - Write
           - Describe
 ---
-# The Approvisionnement agent. Reads the catalog topic only — an agent whose job
-# is stock has no business reading who paid what.
+# The supply agent. Reads the catalog topic only — an agent whose job is stock
+# has no business reading who paid what.
+apiVersion: kafka.strimzi.io/v1
+kind: KafkaUser
+metadata:
+  name: classic-models-agent-supply
+  namespace: kafka
+  labels:
+    strimzi.io/cluster: kafka
+spec:
+  authentication:
+    type: scram-sha-512
+  authorization:
+    type: simple
+    acls:
+      - resource:
+          type: topic
+          name: classic-models.catalog
+          patternType: literal
+        operations:
+          - Read
+          - Describe
+      - resource:
+          type: group
+          name: supply-
+          patternType: prefix
+        operations:
+          - Read
+          - Describe
+---
+# The same account under its old French name, kept only until the consumer has
+# moved to the one above. Delete it then — two accounts for one consumer is a
+# second credential nobody is rotating.
 apiVersion: kafka.strimzi.io/v1
 kind: KafkaUser
 metadata: