From 15dc79196c44009ba9a1aa1ef576b62f97ede3a8 Mon Sep 17 00:00:00 2001
From: Kochetkov S <kochetkov.s@sarex.io>
Date: Fri, 10 Jul 2026 12:36:37 +0300
Subject: [PATCH] fix user import vs create mechanic

---
 infrastructure.yaml                   | 13 +++++++++++--
 live/prod/kafka-topics/terragrunt.hcl | 14 ++++++++++++++
 modules/kafka-topics-yc/variables.tf  |  6 +++---
 3 files changed, 28 insertions(+), 5 deletions(-)

diff --git a/infrastructure.yaml b/infrastructure.yaml
index 9048d85..b651c52 100644
--- a/infrastructure.yaml
+++ b/infrastructure.yaml
@@ -660,6 +660,7 @@ environments:
       users:
         - name: iam
           clusterRef: prod
+          adopt: true
           permissions:
             - topic: ams-sync
               roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
@@ -701,6 +702,7 @@ environments:
               roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
         - name: inspections
           clusterRef: prod
+          adopt: true
           permissions:
             - topic: assets_broadcast
               roles: [ACCESS_ROLE_CONSUMER]
@@ -724,6 +726,7 @@ environments:
               roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
         - name: issues
           clusterRef: prod
+          adopt: true
           permissions:
             - topic: assets_broadcast
               roles: [ACCESS_ROLE_CONSUMER]
@@ -751,11 +754,13 @@ environments:
               roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
         - name: kafka-topics-test
           clusterRef: prod
+          adopt: true
           permissions:
             - topic: sarex.prod.kafka-topics-test.events.v1
               roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
         - name: message-hub-user
           clusterRef: prod
+          adopt: true
           permissions:
             - topic: assets_broadcast
               roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
@@ -765,6 +770,7 @@ environments:
               roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
         - name: platform
           clusterRef: prod
+          adopt: true
           permissions:
             - topic: ams-sync
               roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER, ACCESS_ROLE_TOPIC_ADMIN]
@@ -800,6 +806,7 @@ environments:
               roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
         - name: pm
           clusterRef: prod
+          adopt: true
           permissions:
             - topic: assets_broadcast
               roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
@@ -807,7 +814,7 @@ environments:
               roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
         - name: premises
           clusterRef: prod
-          adoptExisting: true
+          adopt: true
           permissions:
             - topic: assets_broadcast
               roles: [ACCESS_ROLE_CONSUMER]
@@ -895,6 +902,7 @@ environments:
               roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
         - name: sarex-backend-prod
           clusterRef: prod
+          adopt: true
           permissions:
             - topic: ams-sync
               roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
@@ -904,7 +912,7 @@ environments:
               roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
         - name: srx-broadcast
           clusterRef: prod
-          adoptExisting: true
+          adopt: true
           permissions:
             - topic: assets_broadcast
               roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
@@ -924,6 +932,7 @@ environments:
               roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
         - name: system_log_user
           clusterRef: prod
+          adopt: true
           permissions:
             - topic: bru.cde.folders.prod
               roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
diff --git a/live/prod/kafka-topics/terragrunt.hcl b/live/prod/kafka-topics/terragrunt.hcl
index f105b21..b5b7248 100644
--- a/live/prod/kafka-topics/terragrunt.hcl
+++ b/live/prod/kafka-topics/terragrunt.hcl
@@ -28,6 +28,20 @@ terraform {
   source = "${get_terragrunt_dir()}/../../../modules//kafka-topics-yc"
 }
 
+generate "import_existing" {
+  path      = "import_existing.tf"
+  if_exists = "overwrite"
+  contents = join("\n\n", [
+    for user in local.kafka_users : <<-EOF
+      import {
+        to = yandex_mdb_kafka_user.this["${user.clusterRef}:${user.name}"]
+        id = "${local.kafka_cluster_refs[user.clusterRef].cluster_id}:${user.name}"
+      }
+    EOF
+    if try(user.adopt, false)
+  ])
+}
+
 inputs = {
   environment          = local.env_name
   topics               = local.kafka_topics
diff --git a/modules/kafka-topics-yc/variables.tf b/modules/kafka-topics-yc/variables.tf
index 10fa5e9..48830da 100644
--- a/modules/kafka-topics-yc/variables.tf
+++ b/modules/kafka-topics-yc/variables.tf
@@ -22,9 +22,9 @@ variable "topics" {
 variable "users" {
   description = "User-centric Kafka access declarations from infrastructure.yaml under environments.<env>.kafka.users."
   type = list(object({
-    name          = string
-    clusterRef    = string
-    adoptExisting = optional(bool, false)
+    name       = string
+    clusterRef = string
+    adopt      = optional(bool, false)
     permissions = optional(list(object({
       topic = string
       roles = list(string)