Stéphane Tailland
f0ec5c47e2
Topics and accounts on the shared cluster belong to the platform team, for the same reason the gateway defaults do: an ACL is not a team's decision to make about itself, and a partition count is not a team's decision to make about the cluster. They had been pushed into the application repos on the argument that ownership follows use. That argument holds for a contract, not for a grant. Self-service is a different thing and does not come from moving these files: it comes from an event gateway that virtualises topics and a developer portal that socialises them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2.1 KiB
Kafka topology
Platform-owned. Topics and accounts on the shared Kafka cluster are administered here, not by the teams that use them.
That is the same reason gateway defaults are here: an ACL is not a team's
decision to make about itself. A team that declares its own KafkaUser grants
its own permissions, and a team that declares its own KafkaTopic sets a
partition count and a retention that the cluster then has to live with. Both are
platform decisions, taken with a view of the whole cluster.
It is also why this is not self-service, and should not be mistaken for it. See "Self-service" below.
What lives here
classic-models.yaml |
the classic-models estate: three topics, one producer account, one consumer account |
The cluster is not here — infra-kafka is a generic, reusable Strimzi
deployment and names no estate. This repo says who may publish what on it.
The events are not here either: their contract belongs to the application
that raises them, in classic-models-api/docs/DOMAIN_EVENTS.md. This repo grants
access; it does not define meaning.
Two things that bite
Every CR goes in the operator's namespace. Strimzi runs with
watchAnyNamespace=false, so a KafkaUser or KafkaTopic created anywhere else
is ignored silently — kubectl apply says created, kubectl get shows it,
and it never gets a status, a Secret, or a line in the operator's log. It looks
exactly like one still being reconciled.
Grant one direction, on one prefix. A producer that can also read every topic exfiltrates every other application's data if it is ever compromised; a consumer that can write can raise an event someone else acts on.
Self-service, when it comes
Not by letting teams declare CRs here or in their own repos. Through an event gateway, which virtualises topics so a consumer is given a contract rather than a broker address and an ACL, and through the developer portal, which socialises those topics the way it already socialises the REST APIs.
Until that exists, this directory is the request queue: a team asks, the platform team writes the entry.