Stéphane Tailland
f0ec5c47e2
Topics and accounts on the shared cluster belong to the platform team, for the same reason the gateway defaults do: an ACL is not a team's decision to make about itself, and a partition count is not a team's decision to make about the cluster. They had been pushed into the application repos on the argument that ownership follows use. That argument holds for a contract, not for a grant. Self-service is a different thing and does not come from moving these files: it comes from an event gateway that virtualises topics and a developer portal that socialises them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
124 lines
3.3 KiB
YAML
124 lines
3.3 KiB
YAML
# The classic-models estate on the shared Kafka cluster.
|
|
#
|
|
# Everything here is created in the `kafka` namespace, because that is the only
|
|
# one Strimzi watches (`watchAnyNamespace=false`). A CR elsewhere is ignored in
|
|
# silence — no status, no Secret, no log line.
|
|
#
|
|
# The events these topics carry are specified by their producer, in
|
|
# classic-models-api/docs/DOMAIN_EVENTS.md. This file grants access; it does not
|
|
# define meaning.
|
|
|
|
# --- topics -----------------------------------------------------------------
|
|
#
|
|
# One per aggregate, not one per event type: per type would lose the order
|
|
# between product.created and product.stock_changed for the same product, which
|
|
# is the one ordering a consumer actually needs.
|
|
#
|
|
# Declared rather than auto-created — the accounts below have no Create ACL, so
|
|
# a producer would simply be denied, and an auto-created topic takes broker
|
|
# defaults nobody chose. Partition count is the ceiling on consumer parallelism
|
|
# and cannot be lowered later.
|
|
---
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaTopic
|
|
metadata:
|
|
name: classic-models.catalog
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
partitions: 3
|
|
replicas: 1
|
|
config:
|
|
retention.ms: "604800000" # 7 days
|
|
cleanup.policy: delete
|
|
min.insync.replicas: "1"
|
|
---
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaTopic
|
|
metadata:
|
|
name: classic-models.sales
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
partitions: 3
|
|
replicas: 1
|
|
config:
|
|
retention.ms: "604800000"
|
|
cleanup.policy: delete
|
|
min.insync.replicas: "1"
|
|
---
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaTopic
|
|
metadata:
|
|
name: classic-models.payments
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
partitions: 3
|
|
replicas: 1
|
|
config:
|
|
retention.ms: "604800000"
|
|
cleanup.policy: delete
|
|
min.insync.replicas: "1"
|
|
|
|
# --- accounts ---------------------------------------------------------------
|
|
#
|
|
# One direction each, on one prefix. A producer that could also read every topic
|
|
# exfiltrates every other application's data if it is ever compromised, and a
|
|
# consumer that could write can raise an event someone else acts on.
|
|
---
|
|
# classic-models-api. Publishes domain events, consumes nothing.
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaUser
|
|
metadata:
|
|
name: classic-models-api
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
authentication:
|
|
type: scram-sha-512
|
|
authorization:
|
|
type: simple
|
|
acls:
|
|
- resource:
|
|
type: topic
|
|
name: classic-models.
|
|
patternType: prefix
|
|
operations:
|
|
- Write
|
|
- Describe
|
|
---
|
|
# The Approvisionnement agent. Reads the catalog topic only — an agent whose job
|
|
# is stock has no business reading who paid what.
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaUser
|
|
metadata:
|
|
name: classic-models-agent-approvisionnement
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
authentication:
|
|
type: scram-sha-512
|
|
authorization:
|
|
type: simple
|
|
acls:
|
|
- resource:
|
|
type: topic
|
|
name: classic-models.catalog
|
|
patternType: literal
|
|
operations:
|
|
- Read
|
|
- Describe
|
|
- resource:
|
|
type: group
|
|
name: approvisionnement-
|
|
patternType: prefix
|
|
operations:
|
|
- Read
|
|
- Describe
|