apiVersion: v1
kind: ConfigMap
metadata:
  name: realms
data:
  demo-realm.json: |-
    {
      "realm": "demo",
      "accessTokenLifespan": 2592000,
      "ssoSessionMaxLifespan": 32140800,
      "ssoSessionIdleTimeout": 32140800,
      "enabled": true,
      "sslRequired": "external",
      "users": [
        {
          "username": "alice",
          "enabled": true,
          "email": "alice@example.com",
          "credentials": [
            {
              "type": "password",
              "value": "alice-password"
            }
          ],
          "realmRoles": [
            "user"
          ],
          "clientRoles": {
            "kafka": [
              "kafka-topic:superapp_*:owner"
            ]
          }
        },
        {
          "username": "admin",
          "enabled": true,
          "email": "admin@example.com",
          "credentials": [
            {
              "type": "password",
              "value": "admin-password"
            }
          ],
          "realmRoles": [
            "admin"
          ],
          "clientRoles": {
            "realm-management": [
              "realm-admin"
            ],
            "kafka": [
              "kafka-admin"
            ]
          }
        },
        {
          "username": "service-account-kafka-broker",
          "enabled": true,
          "email": "service-account-kafka-broker@placeholder.org",
          "serviceAccountClientId": "kafka-broker",
          "clientRoles": {
            "kafka" : ["kafka-admin"]
          }
        },
        {
          "username": "service-account-kafka-producer-client",
          "enabled": true,
          "email": "service-account-kafka-producer-client@placeholder.org",
          "serviceAccountClientId": "kafka-producer-client"
        },
        {
          "username": "service-account-kafka-consumer-client",
          "enabled": true,
          "email": "service-account-kafka-consumer-client@placeholder.org",
          "serviceAccountClientId": "kafka-consumer-client",
          "clientRoles": {
            "kafka" : ["kafka-topic:superapp_*:consumer"]
          }
        }
      ],
      "roles": {
        "realm": [
          {
            "name": "user",
            "description": "User privileges"
          },
          {
            "name": "admin",
            "description": "Administrator privileges"
          }
        ],
        "client": {
          "kafka": [
            {
              "name": "kafka-admin",
              "description": "Kafka administrator - can perform any action on any Kafka resource",
              "clientRole": true
            },
            {
              "name": "kafka-topic:superapp_*:owner",
              "description": "Owner of topics that begin with 'superapp_' prefix. Can perform any operation on these topics.",
              "clientRole": true
            },
            {
              "name": "kafka-topic:superapp_*:consumer",
              "description": "Consumer of topics that begin with 'superapp_' prefix. Can perform READ, and DESCRIBE on these topics.",
              "clientRole": true
            }
          ]
        }
      },
      "scopeMappings": [
        {
          "client": "kafka-broker",
          "roles": [
            "offline_access"
          ]
        },
        {
          "client": "kafka-producer-client",
          "roles": [
            "offline_access"
          ]
        },
        {
          "client": "kafka-consumer-client",
          "roles": [
            "offline_access"
          ]
        },
        {
          "clientScope": "offline_access",
          "roles": [
            "offline_access"
          ]
        }
      ],
      "clientScopeMappings": {
        "kafka": [
          {
            "client": "kafka-broker",
            "roles": [
              "kafka-admin"
            ]
          },
          {
            "client": "kafka-consumer-client",
            "roles": [
              "kafka-topic:superapp_*:consumer"
            ]
          },
          {
            "client": "kafka-producer-client",
            "roles": [
              "kafka-topic:superapp_*:owner"
            ]
          }
        ]
      },
      "clients": [
        {
          "clientId": "kafka",
          "enabled": true,
          "publicClient": true,
          "bearerOnly": false,
          "standardFlowEnabled": false,
          "implicitFlowEnabled": false,
          "directAccessGrantsEnabled": false,
          "serviceAccountsEnabled": false,
          "consentRequired" : false,
          "fullScopeAllowed" : false
        },
        {
          "clientId": "kafka-broker",
          "enabled": true,
          "clientAuthenticatorType": "client-secret",
          "secret": "kafka-broker-secret",
          "publicClient": false,
          "bearerOnly": false,
          "standardFlowEnabled": false,
          "implicitFlowEnabled": false,
          "directAccessGrantsEnabled": true,
          "serviceAccountsEnabled": true,
          "consentRequired" : false,
          "fullScopeAllowed" : false,
          "attributes": {
            "access.token.lifespan": "32140800"
          }
        },
        {
          "clientId": "kafka-producer-client",
          "enabled": true,
          "clientAuthenticatorType": "client-secret",
          "secret": "kafka-producer-client-secret",
          "publicClient": false,
          "bearerOnly": false,
          "standardFlowEnabled": false,
          "implicitFlowEnabled": false,
          "directAccessGrantsEnabled": true,
          "serviceAccountsEnabled": true,
          "consentRequired" : false,
          "fullScopeAllowed" : false,
          "attributes": {
            "access.token.lifespan": "36000"
          }
        },
        {
          "clientId": "kafka-consumer-client",
          "enabled": true,
          "clientAuthenticatorType": "client-secret",
          "secret": "kafka-consumer-client-secret",
          "publicClient": false,
          "bearerOnly": false,
          "standardFlowEnabled": false,
          "implicitFlowEnabled": false,
          "directAccessGrantsEnabled": true,
          "serviceAccountsEnabled": true,
          "consentRequired" : false,
          "fullScopeAllowed" : false,
          "attributes": {
            "access.token.lifespan": "32140800"
          }
        }
      ]
    }
  kafka-authz-realm.json: |
    {
      "realm": "kafka-authz",
      "accessTokenLifespan": 2592000,
      "ssoSessionIdleTimeout": 32140800,
      "ssoSessionMaxLifespan": 32140800,
      "enabled": true,
      "sslRequired": "external",
      "roles": {
        "realm": [
          {
            "name": "Dev Team A",
            "description": "Developer on Dev Team A"
          },
          {
            "name": "Dev Team B",
            "description": "Developer on Dev Team B"
          },
          {
            "name": "Ops Team",
            "description": "Operations team member"
          }
        ],
        "client": {
          "team-a-client": [],
          "team-b-client": [],
          "kafka-cli": [],
          "kafka": [
            {
              "name": "uma_protection",
              "clientRole": true
            },
            {
              "name": "kafka-user",
              "clientRole": true
            }
          ]
        }
      },
      "groups" : [
        {
          "name" : "ClusterManager Group",
          "path" : "/ClusterManager Group"
        }, {
          "name" : "ClusterManager-cluster2 Group",
          "path" : "/ClusterManager-cluster2 Group"
        }, {
          "name" : "Ops Team Group",
          "path" : "/Ops Team Group"
        }
      ],
      "users": [
        {
          "username" : "alice",
          "enabled" : true,
          "totp" : false,
          "emailVerified" : true,
          "firstName" : "Alice",
          "email" : "alice@strimzi.io",
          "credentials" : [ {
            "type" : "password",
            "secretData" : "{\"value\":\"KqABIiReBuRWbP4pBct3W067pNvYzeN7ILBV+8vT8nuF5cgYs2fdl2QikJT/7bGTW/PBXg6CYLwJQFYrBK9MWg==\",\"salt\":\"EPgscX9CQz7UnuZDNZxtMw==\"}",
            "credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\"}"
          } ],
          "disableableCredentialTypes" : [ ],
          "requiredActions" : [ ],
          "realmRoles" : [ "offline_access", "uma_authorization" ],
          "clientRoles" : {
            "account" : [ "view-profile", "manage-account" ]
          },
          "groups" : [ "/ClusterManager Group" ]
        }, {
          "username" : "bob",
          "enabled" : true,
          "totp" : false,
          "emailVerified" : true,
          "firstName" : "Bob",
          "email" : "bob@strimzi.io",
          "credentials" : [ {
            "type" : "password",
            "secretData" : "{\"value\":\"QhK0uLsKuBDrMm9Z9XHvq4EungecFRnktPgutfjKtgVv2OTPd8D390RXFvJ8KGvqIF8pdoNxHYQyvDNNwMORpg==\",\"salt\":\"yxkgwEyTnCGLn42Yr9GxBQ==\"}",
            "credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\"}"
          } ],
          "disableableCredentialTypes" : [ ],
          "requiredActions" : [ ],
          "realmRoles" : [ "offline_access", "uma_authorization" ],
          "clientRoles" : {
            "account" : [ "view-profile", "manage-account" ]
          },
          "groups" : [ "/ClusterManager-cluster2 Group" ]
        },
        {
          "username" : "service-account-team-a-client",
          "enabled" : true,
          "serviceAccountClientId" : "team-a-client",
          "realmRoles" : [ "offline_access", "Dev Team A" ],
          "clientRoles" : {
            "account" : [ "manage-account", "view-profile" ]
          },
          "groups" : [ ]
        },
        {
          "username" : "service-account-team-b-client",
          "enabled" : true,
          "serviceAccountClientId" : "team-b-client",
          "realmRoles" : [ "offline_access", "Dev Team B" ],
          "clientRoles" : {
            "kafka" : [ "kafka-user" ],
            "account" : [ "manage-account", "view-profile" ]
          },
          "groups" : [ ]
        }
      ],
      "clients": [
        {
          "clientId": "team-a-client",
          "enabled": true,
          "clientAuthenticatorType": "client-secret",
          "secret": "team-a-client-secret",
          "bearerOnly": false,
          "consentRequired": false,
          "standardFlowEnabled": false,
          "implicitFlowEnabled": false,
          "directAccessGrantsEnabled": true,
          "serviceAccountsEnabled": true,
          "publicClient": false,
          "fullScopeAllowed": true
        },
        {
          "clientId": "team-b-client",
          "enabled": true,
          "clientAuthenticatorType": "client-secret",
          "secret": "team-b-client-secret",
          "bearerOnly": false,
          "consentRequired": false,
          "standardFlowEnabled": false,
          "implicitFlowEnabled": false,
          "directAccessGrantsEnabled": true,
          "serviceAccountsEnabled": true,
          "publicClient": false,
          "fullScopeAllowed": true
        },
        {
          "clientId": "kafka",
          "enabled": true,
          "clientAuthenticatorType": "client-secret",
          "secret": "kafka-secret",
          "bearerOnly": false,
          "consentRequired": false,
          "standardFlowEnabled": false,
          "implicitFlowEnabled": false,
          "directAccessGrantsEnabled": true,
          "serviceAccountsEnabled": true,
          "authorizationServicesEnabled": true,
          "publicClient": false,
          "fullScopeAllowed": true,
          "authorizationSettings": {
            "allowRemoteResourceManagement": true,
            "policyEnforcementMode": "ENFORCING",
            "resources": [
              {
                "name": "Topic:a_*",
                "type": "Topic",
                "ownerManagedAccess": false,
                "displayName": "Topics that start with a_",
                "attributes": {},
                "uris": [],
                "scopes": [
                  {
                    "name": "Create"
                  },
                  {
                    "name": "Delete"
                  },
                  {
                    "name": "Describe"
                  },
                  {
                    "name": "Write"
                  },
                  {
                    "name": "Read"
                  },
                  {
                    "name": "Alter"
                  },
                  {
                    "name": "DescribeConfigs"
                  },
                  {
                    "name": "AlterConfigs"
                  }
                ]
              },
              {
                "name": "Group:x_*",
                "type": "Group",
                "ownerManagedAccess": false,
                "displayName": "Consumer groups that start with x_",
                "attributes": {},
                "uris": [],
                "scopes": [
                  {
                    "name": "Describe"
                  },
                  {
                    "name": "Delete"
                  },
                  {
                    "name": "Read"
                  }
                ]
              },
              {
                "name": "Topic:x_*",
                "type": "Topic",
                "ownerManagedAccess": false,
                "displayName": "Topics that start with x_",
                "attributes": {},
                "uris": [],
                "scopes": [
                  {
                    "name": "Create"
                  },
                  {
                    "name": "Describe"
                  },
                  {
                    "name": "Delete"
                  },
                  {
                    "name": "Write"
                  },
                  {
                    "name": "Read"
                  },
                  {
                    "name": "Alter"
                  },
                  {
                    "name": "DescribeConfigs"
                  },
                  {
                    "name": "AlterConfigs"
                  }
                ]
              },
              {
                "name": "Group:a_*",
                "type": "Group",
                "ownerManagedAccess": false,
                "displayName": "Groups that start with a_",
                "attributes": {},
                "uris": [],
                "scopes": [
                  {
                    "name": "Describe"
                  },
                  {
                    "name": "Read"
                  }
                ]
              },
              {
                "name": "Group:*",
                "type": "Group",
                "ownerManagedAccess": false,
                "displayName": "Any group",
                "attributes": {},
                "uris": [],
                "scopes": [
                  {
                    "name": "Describe"
                  },
                  {
                    "name": "Read"
                  },
                  {
                    "name": "DescribeConfigs"
                  },
                  {
                    "name": "AlterConfigs"
                  }
                ]
              },
              {
                "name": "Topic:*",
                "type": "Topic",
                "ownerManagedAccess": false,
                "displayName": "Any topic",
                "attributes": {},
                "uris": [],
                "scopes": [
                  {
                    "name": "Create"
                  },
                  {
                    "name": "Delete"
                  },
                  {
                    "name": "Describe"
                  },
                  {
                    "name": "Write"
                  },
                  {
                    "name": "Read"
                  },
                  {
                    "name": "Alter"
                  },
                  {
                    "name": "DescribeConfigs"
                  },
                  {
                    "name": "AlterConfigs"
                  }
                ]
              },
              {
                "name": "kafka-cluster:cluster2,Topic:b_*",
                "type": "Topic",
                "ownerManagedAccess": false,
                "attributes": {},
                "uris": [],
                "scopes": [
                  {
                    "name": "Create"
                  },
                  {
                    "name": "Delete"
                  },
                  {
                    "name": "Describe"
                  },
                  {
                    "name": "Write"
                  },
                  {
                    "name": "Read"
                  },
                  {
                    "name": "Alter"
                  },
                  {
                    "name": "DescribeConfigs"
                  },
                  {
                    "name": "AlterConfigs"
                  }
                ]
              },
              {
                "name": "kafka-cluster:cluster2,Cluster:*",
                "type": "Cluster",
                "ownerManagedAccess": false,
                "displayName": "Cluster scope on cluster2",
                "attributes": {},
                "uris": [],
                "scopes": [
                  {
                    "name": "DescribeConfigs"
                  },
                  {
                    "name": "AlterConfigs"
                  },
                  {
                    "name": "ClusterAction"
                  }
                ]
              },
              {
                "name": "kafka-cluster:cluster2,Group:*",
                "type": "Group",
                "ownerManagedAccess": false,
                "displayName": "Any group on cluster2",
                "attributes": {},
                "uris": [],
                "scopes": [
                  {
                    "name": "Delete"
                  },
                  {
                    "name": "Describe"
                  },
                  {
                    "name": "Read"
                  },
                  {
                    "name": "DescribeConfigs"
                  },
                  {
                    "name": "AlterConfigs"
                  }
                ]
              },
              {
                "name": "kafka-cluster:cluster2,Topic:*",
                "type": "Topic",
                "ownerManagedAccess": false,
                "displayName": "Any topic on cluster2",
                "attributes": {},
                "uris": [],
                "scopes": [
                  {
                    "name": "Create"
                  },
                  {
                    "name": "Delete"
                  },
                  {
                    "name": "Describe"
                  },
                  {
                    "name": "Write"
                  },
                  {
                    "name": "IdempotentWrite"
                  },
                  {
                    "name": "Read"
                  },
                  {
                    "name": "Alter"
                  },
                  {
                    "name": "DescribeConfigs"
                  },
                  {
                    "name": "AlterConfigs"
                  }
                ]
              },
              {
                "name" : "Cluster:*",
                "type" : "Cluster",
                "ownerManagedAccess" : false,
                "attributes" : { },
                "uris" : [ ]
              }
            ],
            "policies": [
              {
                "name": "Dev Team A",
                "type": "role",
                "logic": "POSITIVE",
                "decisionStrategy": "UNANIMOUS",
                "config": {
                  "roles": "[{\"id\":\"Dev Team A\",\"required\":true}]"
                }
              },
              {
                "name": "Default Policy",
                "description": "A policy that grants access only for users within this realm",
                "type": "js",
                "logic": "POSITIVE",
                "decisionStrategy": "AFFIRMATIVE",
                "config": {
                  "code": "// by default, grants any permission associated with this policy\n$evaluation.grant();\n"
                }
              },
              {
                "name": "Dev Team B",
                "type": "role",
                "logic": "POSITIVE",
                "decisionStrategy": "UNANIMOUS",
                "config": {
                  "roles": "[{\"id\":\"Dev Team B\",\"required\":true}]"
                }
              },
              {
                "name": "Ops Team",
                "type": "role",
                "logic": "POSITIVE",
                "decisionStrategy": "UNANIMOUS",
                "config": {
                  "roles": "[{\"id\":\"Ops Team\",\"required\":true}]"
                }
              },
              {
                "name" : "ClusterManager Group",
                "type" : "group",
                "logic" : "POSITIVE",
                "decisionStrategy" : "UNANIMOUS",
                "config" : {
                  "groups" : "[{\"path\":\"/ClusterManager Group\",\"extendChildren\":false}]"
                }
              }, {
                "name" : "ClusterManager of cluster2 Group",
                "type" : "group",
                "logic" : "POSITIVE",
                "decisionStrategy" : "UNANIMOUS",
                "config" : {
                  "groups" : "[{\"path\":\"/ClusterManager-cluster2 Group\",\"extendChildren\":false}]"
                }
              },
              {
                "name": "Dev Team A owns topics that start with a_ on any cluster",
                "type": "resource",
                "logic": "POSITIVE",
                "decisionStrategy": "UNANIMOUS",
                "config": {
                  "resources": "[\"Topic:a_*\"]",
                  "applyPolicies": "[\"Dev Team A\"]"
                }
              },
              {
                "name": "Dev Team A can write to topics that start with x_ on any cluster",
                "type": "scope",
                "logic": "POSITIVE",
                "decisionStrategy": "UNANIMOUS",
                "config": {
                  "resources": "[\"Topic:x_*\"]",
                  "scopes": "[\"Describe\",\"Write\"]",
                  "applyPolicies": "[\"Dev Team A\"]"
                }
              },
              {
                "name": "Dev Team B owns topics that start with b_ on cluster cluster2",
                "type": "resource",
                "logic": "POSITIVE",
                "decisionStrategy": "UNANIMOUS",
                "config": {
                  "resources": "[\"kafka-cluster:cluster2,Topic:b_*\"]",
                  "applyPolicies": "[\"Dev Team B\"]"
                }
              },
              {
                "name": "Dev Team B can read from topics that start with x_ on any cluster",
                "type": "scope",
                "logic": "POSITIVE",
                "decisionStrategy": "UNANIMOUS",
                "config": {
                  "resources": "[\"Topic:x_*\"]",
                  "scopes": "[\"Describe\",\"Read\"]",
                  "applyPolicies": "[\"Dev Team B\"]"
                }
              },
              {
                "name": "Dev Team B can update consumer group offsets that start with x_ on any cluster",
                "type": "scope",
                "logic": "POSITIVE",
                "decisionStrategy": "UNANIMOUS",
                "config": {
                  "resources": "[\"Group:x_*\"]",
                  "scopes": "[\"Describe\",\"Read\"]",
                  "applyPolicies": "[\"Dev Team B\"]"
                }
              },
              {
                "name": "Dev Team A can use consumer groups that start with a_ on any cluster",
                "type": "resource",
                "logic": "POSITIVE",
                "decisionStrategy": "UNANIMOUS",
                "config": {
                  "resources": "[\"Group:a_*\"]",
                  "applyPolicies": "[\"Dev Team A\"]"
                }
              },
              {
                "name": "ClusterManager of cluster2 Group has full access to topics on cluster2",
                "type": "resource",
                "logic": "POSITIVE",
                "decisionStrategy": "UNANIMOUS",
                "config": {
                  "resources": "[\"kafka-cluster:cluster2,Topic:*\"]",
                  "applyPolicies": "[\"ClusterManager of cluster2 Group\"]"
                }
              },
              {
                "name": "ClusterManager of cluster2 Group has full access to consumer groups on cluster2",
                "type": "resource",
                "logic": "POSITIVE",
                "decisionStrategy": "UNANIMOUS",
                "config": {
                  "resources": "[\"kafka-cluster:cluster2,Group:*\"]",
                  "applyPolicies": "[\"ClusterManager of cluster2 Group\"]"
                }
              },
              {
                "name": "ClusterManager of cluster2 Group has full access to cluster config on cluster2",
                "type": "resource",
                "logic": "POSITIVE",
                "decisionStrategy": "UNANIMOUS",
                "config": {
                  "resources": "[\"kafka-cluster:cluster2,Cluster:*\"]",
                  "applyPolicies": "[\"ClusterManager of cluster2 Group\"]"
                }
              }, {
                "name" : "ClusterManager Group has full access to manage and affect groups",
                "type" : "resource",
                "logic" : "POSITIVE",
                "decisionStrategy" : "UNANIMOUS",
                "config" : {
                  "resources" : "[\"Group:*\"]",
                  "applyPolicies" : "[\"ClusterManager Group\"]"
                }
              }, {
                "name" : "ClusterManager Group has full access to manage and affect topics",
                "type" : "resource",
                "logic" : "POSITIVE",
                "decisionStrategy" : "UNANIMOUS",
                "config" : {
                  "resources" : "[\"Topic:*\"]",
                  "applyPolicies" : "[\"ClusterManager Group\"]"
                }
              }, {
                "name" : "ClusterManager Group has full access to cluster config",
                "type" : "resource",
                "logic" : "POSITIVE",
                "decisionStrategy" : "UNANIMOUS",
                "config" : {
                  "resources" : "[\"Cluster:*\"]",
                  "applyPolicies" : "[\"ClusterManager Group\"]"
                }
              }
            ],
            "scopes": [
              {
                "name": "Create"
              },
              {
                "name": "Read"
              },
              {
                "name": "Write"
              },
              {
                "name": "Delete"
              },
              {
                "name": "Alter"
              },
              {
                "name": "Describe"
              },
              {
                "name": "ClusterAction"
              },
              {
                "name": "DescribeConfigs"
              },
              {
                "name": "AlterConfigs"
              },
              {
                "name": "IdempotentWrite"
              }
            ],
            "decisionStrategy": "AFFIRMATIVE"
          }
        },
        {
          "clientId": "kafka-cli",
          "enabled": true,
          "clientAuthenticatorType": "client-secret",
          "secret": "kafka-cli-secret",
          "bearerOnly": false,
          "consentRequired": false,
          "standardFlowEnabled": false,
          "implicitFlowEnabled": false,
          "directAccessGrantsEnabled": true,
          "serviceAccountsEnabled": false,
          "publicClient": true,
          "fullScopeAllowed": true
        }
      ]
    }
