Add username field on KafkaUser resource

[leisma]

Context / Use Case

We are running Kafka clusters installed on VMs (outside Kubernetes) and plan to manage them using the standalone User Operator and Topic Operator.

We have existing Kafka users whose usernames contain characters that are not valid in Kubernetes resource names — specifically the "@" character (e.g., service@environment). That actually wasn't the best naming idea but we now have them in place and the names within the CN of the existing client certificates.

Currently, the KafkaUser resource uses its .metadata.name as the Kafka username directly. This makes it impossible to manage users with "@" in their names.

Proposed Solution

Introduce an optional spec.userName field on the KafkaUser resource, analogous to spec.topicName on KafkaTopic:

kind: KafkaUser
metadata:
  name: service-at-environment   # valid Kubernetes name
spec:
  userName: "service@environment" # actual Kafka username
  authentication:
    type: tls-external

[scholzj]

This has been discussed (and rejected) many times in the past because this does not work well. The username and the name of the KafkaUser resource need to be something that can be easily derived from each other.

[leisma]

Thank you for the quick response. I understand the point that the username should be easily derivable from the KafkaUser resource.

Since my suggestion would introduce this as an optional field, the default behavior would remain unchanged and still be easy to derive. At the same time, it would allow users like us to adapt it to existing setups where the usernames are already fixed.

[scholzj]

But this is not about default behavior. The whole User Operator is designed around this premise. So it is a required behavior.