IDENTITYoperator@demo.invalid
AuthenticatedTrusted proxy or local session
GOVERNED OPERATIONSRead broadly.
Read broadly.
Change deliberately.
Separate viewer, editor and administrator responsibilities, combine them with per-cluster capabilities, and bind high-impact changes to short-lived mutation plans.
DEFENCE IN DEPTH
Permission is checked at every meaningful boundary.
Identity
Use a trusted OAuth2 Proxy for external identity, or the secure local administrator when proxy authentication is absent. The modes are mutually exclusive.
Role resolution
Optionally resolve editor/admin elevation through Kubernetes SubjectAccessReview against synthetic namespaced BetterKafka roles.
Cluster capabilities
Read-only, general mutations, message production, ACLs, consumer groups and Strimzi rebalances are enabled independently per configured cluster.
Bound plans
High-impact operations bind actor, selected cluster, operation, resource, canonical payload, operator reason and expiry into a short-lived HMAC plan.
LICENSING
Online activation and offline entitlement are separate, signed workflows.
Online installations exchange a one-time activation key for short signed leases with renewal and bounded outage grace. Offline installations use an installation-bound, finite-expiry ES256 licence file and do not depend on the authority at runtime.
Without valid signed material, BetterKafka exposes only its repair surface and does not construct Kafka clients.
CONTROL THE CHANGE
Match capability to responsibility.
Start in viewer mode and introduce guarded operations cluster by cluster.