Stéphane Tailland
f5484dd67f
Two at once so the consumer can move without a gap; the old one goes as soon as it has. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
155 lines
4.0 KiB
YAML
155 lines
4.0 KiB
YAML
# The classic-models estate on the shared Kafka cluster.
|
|
#
|
|
# Everything here is created in the `kafka` namespace, because that is the only
|
|
# one Strimzi watches (`watchAnyNamespace=false`). A CR elsewhere is ignored in
|
|
# silence — no status, no Secret, no log line.
|
|
#
|
|
# The events these topics carry are specified by their producer, in
|
|
# classic-models-api/docs/DOMAIN_EVENTS.md. This file grants access; it does not
|
|
# define meaning.
|
|
|
|
# --- topics -----------------------------------------------------------------
|
|
#
|
|
# One per aggregate, not one per event type: per type would lose the order
|
|
# between product.created and product.stock_changed for the same product, which
|
|
# is the one ordering a consumer actually needs.
|
|
#
|
|
# Declared rather than auto-created — the accounts below have no Create ACL, so
|
|
# a producer would simply be denied, and an auto-created topic takes broker
|
|
# defaults nobody chose. Partition count is the ceiling on consumer parallelism
|
|
# and cannot be lowered later.
|
|
---
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaTopic
|
|
metadata:
|
|
name: classic-models.catalog
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
partitions: 3
|
|
replicas: 1
|
|
config:
|
|
retention.ms: "604800000" # 7 days
|
|
cleanup.policy: delete
|
|
min.insync.replicas: "1"
|
|
---
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaTopic
|
|
metadata:
|
|
name: classic-models.sales
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
partitions: 3
|
|
replicas: 1
|
|
config:
|
|
retention.ms: "604800000"
|
|
cleanup.policy: delete
|
|
min.insync.replicas: "1"
|
|
---
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaTopic
|
|
metadata:
|
|
name: classic-models.payments
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
partitions: 3
|
|
replicas: 1
|
|
config:
|
|
retention.ms: "604800000"
|
|
cleanup.policy: delete
|
|
min.insync.replicas: "1"
|
|
|
|
# --- accounts ---------------------------------------------------------------
|
|
#
|
|
# One direction each, on one prefix. A producer that could also read every topic
|
|
# exfiltrates every other application's data if it is ever compromised, and a
|
|
# consumer that could write can raise an event someone else acts on.
|
|
---
|
|
# classic-models-api. Publishes domain events, consumes nothing.
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaUser
|
|
metadata:
|
|
name: classic-models-api
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
authentication:
|
|
type: scram-sha-512
|
|
authorization:
|
|
type: simple
|
|
acls:
|
|
- resource:
|
|
type: topic
|
|
name: classic-models.
|
|
patternType: prefix
|
|
operations:
|
|
- Write
|
|
- Describe
|
|
---
|
|
# The supply agent. Reads the catalog topic only — an agent whose job is stock
|
|
# has no business reading who paid what.
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaUser
|
|
metadata:
|
|
name: classic-models-agent-supply
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
authentication:
|
|
type: scram-sha-512
|
|
authorization:
|
|
type: simple
|
|
acls:
|
|
- resource:
|
|
type: topic
|
|
name: classic-models.catalog
|
|
patternType: literal
|
|
operations:
|
|
- Read
|
|
- Describe
|
|
- resource:
|
|
type: group
|
|
name: supply-
|
|
patternType: prefix
|
|
operations:
|
|
- Read
|
|
- Describe
|
|
---
|
|
# The same account under its old French name, kept only until the consumer has
|
|
# moved to the one above. Delete it then — two accounts for one consumer is a
|
|
# second credential nobody is rotating.
|
|
apiVersion: kafka.strimzi.io/v1
|
|
kind: KafkaUser
|
|
metadata:
|
|
name: classic-models-agent-approvisionnement
|
|
namespace: kafka
|
|
labels:
|
|
strimzi.io/cluster: kafka
|
|
spec:
|
|
authentication:
|
|
type: scram-sha-512
|
|
authorization:
|
|
type: simple
|
|
acls:
|
|
- resource:
|
|
type: topic
|
|
name: classic-models.catalog
|
|
patternType: literal
|
|
operations:
|
|
- Read
|
|
- Describe
|
|
- resource:
|
|
type: group
|
|
name: approvisionnement-
|
|
patternType: prefix
|
|
operations:
|
|
- Read
|
|
- Describe
|