From efcfb1e2f33c350143541db09ec4dd7013268f28 Mon Sep 17 00:00:00 2001
From: Kochetkov S <kochetkov.s@sarex.io>
Date: Fri, 17 Jul 2026 15:39:58 +0300
Subject: [PATCH] ++ fix kafka acl dup key, pin kafka provider 0.7.1

---
 live/terragrunt.hcl                    |  2 +-
 modules/kafka-topics-incluster/main.tf | 26 +++++++++++++++-----------
 2 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/live/terragrunt.hcl b/live/terragrunt.hcl
index c38e0ef..bb4cd4d 100644
--- a/live/terragrunt.hcl
+++ b/live/terragrunt.hcl
@@ -38,7 +38,7 @@ terraform {
   required_providers {
     kubernetes = { source = "hashicorp/kubernetes", version = "~> 2.23" }
     vault      = { source = "hashicorp/vault", version = "~> 4.2" }
-    kafka      = { source = "Mongey/kafka", version = "~> 0.7" }
+    kafka      = { source = "Mongey/kafka", version = "0.7.1" }
     postgresql = { source = "cyrilgdn/postgresql", version = "~> 1.21" }
     rabbitmq   = { source = "cyrilgdn/rabbitmq", version = "~> 1.8" }
     minio      = { source = "aminueza/minio", version = "~> 2.0" }
diff --git a/modules/kafka-topics-incluster/main.tf b/modules/kafka-topics-incluster/main.tf
index 3438c57..4d8dcc4 100644
--- a/modules/kafka-topics-incluster/main.tf
+++ b/modules/kafka-topics-incluster/main.tf
@@ -113,19 +113,23 @@ locals {
   }
 
   # Flatten (user, topic, role) permissions into individual ACL entries.
+  # A single operation (e.g. Topic:Describe) can come from several roles
+  # (PRODUCER and CONSUMER both grant it), so group by key and keep one.
   acl_entries = merge([
     for user_key, perms in local.user_permissions : {
-      for e in flatten([
-        for p in perms : [
-          for op in try(local.role_operations[p.role], []) : {
-            key           = "${user_key}:${p.topic_name}:${op.resource_type}:${op.operation}"
-            principal     = "User:${local.user_clusters[user_key].user}"
-            resource_type = op.resource_type
-            resource_name = op.resource_type == "Group" ? "*" : p.topic_name
-            operation     = op.operation
-          }
-        ]
-      ]) : e.key => e
+      for key, group in {
+        for e in flatten([
+          for p in perms : [
+            for op in try(local.role_operations[p.role], []) : {
+              key           = "${user_key}:${p.topic_name}:${op.resource_type}:${op.operation}"
+              principal     = "User:${local.user_clusters[user_key].user}"
+              resource_type = op.resource_type
+              resource_name = op.resource_type == "Group" ? "*" : p.topic_name
+              operation     = op.operation
+            }
+          ]
+        ]) : e.key => e...
+      } : key => group[0]
     }
   ]...)
 }