Redpanda Provider

# Pulumi.yaml provider configuration file
name: configuration-example
runtime: nodejs
config:
    redpanda:clientId:
        value: your_client_id
    redpanda:clientSecret:
        value: your_client_secret

import * as pulumi from "@pulumi/pulumi";

# Pulumi.yaml provider configuration file
name: configuration-example
runtime: python
config:
    redpanda:clientId:
        value: your_client_id
    redpanda:clientSecret:
        value: your_client_secret

import pulumi

# Pulumi.yaml provider configuration file
name: configuration-example
runtime: dotnet
config:
    redpanda:clientId:
        value: your_client_id
    redpanda:clientSecret:
        value: your_client_secret

using System.Collections.Generic;
using System.Linq;
using Pulumi;

return await Deployment.RunAsync(() =>
{
});

# Pulumi.yaml provider configuration file
name: configuration-example
runtime: go
config:
    redpanda:clientId:
        value: your_client_id
    redpanda:clientSecret:
        value: your_client_secret

package main

import (
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		return nil
	})
}

# Pulumi.yaml provider configuration file
name: configuration-example
runtime: yaml
config:
    redpanda:clientId:
        value: your_client_id
    redpanda:clientSecret:
        value: your_client_secret

{}

# Pulumi.yaml provider configuration file
name: configuration-example
runtime: java
config:
    redpanda:clientId:
        value: your_client_id
    redpanda:clientSecret:
        value: your_client_secret

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
    }
}

# Pulumi.yaml provider configuration file
name: configuration-example
runtime: nodejs

import * as pulumi from "@pulumi/pulumi";
import * as redpanda from "@pulumi/redpanda";

const test = new redpanda.ResourceGroup("test", {name: resourceGroupName});
const testNetwork = new redpanda.Network("test", {
    name: networkName,
    resourceGroupId: test.id,
    cloudProvider: cloudProvider,
    region: region,
    clusterType: "dedicated",
    cidrBlock: "10.0.0.0/20",
    timeouts: {
        create: "20m",
        "delete": "20m",
    },
});
const testCluster = new redpanda.Cluster("test", {
    name: clusterName,
    resourceGroupId: test.id,
    networkId: testNetwork.id,
    cloudProvider: cloudProvider,
    region: region,
    clusterType: "dedicated",
    connectionType: "public",
    throughputTier: throughputTier,
    zones: zones,
    allowDeletion: clusterAllowDeletion,
    clusterConfiguration: {
        customPropertiesJson: JSON.stringify({
            enable_shadow_linking: clusterEnableShadowLinking,
            schema_registry_enable_authorization: true,
        }),
    },
    maintenanceWindowConfig: {
        dayHour: {
            dayOfWeek: maintenanceDayOfWeek,
            hourOfDay: maintenanceHourOfDay,
        },
    },
    tags: clusterTags,
    timeouts: {
        create: "90m",
    },
});
const testUser = new redpanda.User("test", {
    name: userName,
    password: userPasswordWo != null ? null : userPw,
    passwordWo: userPasswordWo,
    passwordWoVersion: userPasswordWoVersion,
    mechanism: mechanism,
    clusterApiUrl: testCluster.clusterApiUrl,
    allowDeletion: userAllowDeletion,
});
const testTopic = new redpanda.Topic("test", {
    name: topicName,
    partitionCount: partitionCount,
    replicationFactor: replicationFactor,
    clusterApiUrl: testCluster.clusterApiUrl,
    allowDeletion: true,
    configuration: topicConfiguration != null ? topicConfiguration : {
        "cleanup.policy": "delete",
        "retention.ms": topicRetentionMs,
    },
}, {
    dependsOn: [testUser],
});
// Bootstrap SR ACL grants for the provider's own Bearer-token principal.
// Two grants are required: the SUBJECT-scope grant authorizes
// POST /subjects/<subj>/versions; the REGISTRY-scope grant authorizes the
// follow-up GET /schemas/ids/<id>/versions that the SR client (franz-go) makes
// to fetch the full schema metadata after create. Without the REGISTRY grant,
// the schema is created but the follow-up GET 403s and the resource fails.
// User:* is broader than necessary; tighten once the exact principal is
// documented as discoverable.
const providerBootstrapSubject = new redpanda.SchemaRegistryAcl("provider_bootstrap_subject", {
    clusterId: testCluster.id,
    principal: "User:*",
    resourceType: "SUBJECT",
    resourceName: topicName,
    patternType: "PREFIXED",
    host: "*",
    operation: "ALL",
    permission: "ALLOW",
    allowDeletion: true,
});
const providerBootstrapRegistry = new redpanda.SchemaRegistryAcl("provider_bootstrap_registry", {
    clusterId: testCluster.id,
    principal: "User:*",
    resourceType: "REGISTRY",
    resourceName: "*",
    patternType: "LITERAL",
    host: "*",
    operation: "ALL",
    permission: "ALLOW",
    allowDeletion: true,
});
const clusterAdmin = new redpanda.Acl("cluster_admin", {
    resourceType: "CLUSTER",
    resourceName: "kafka-cluster",
    resourcePatternType: "LITERAL",
    principal: pulumi.interpolate`User:${testUser.name}`,
    host: "*",
    operation: "ALL",
    permissionType: "ALLOW",
    clusterApiUrl: testCluster.clusterApiUrl,
    allowDeletion: aclAllowDeletion,
});
const schemaRegistryAdmin = new redpanda.Acl("schema_registry_admin", {
    resourceType: "CLUSTER",
    resourceName: "kafka-cluster",
    resourcePatternType: "LITERAL",
    principal: pulumi.interpolate`User:${testUser.name}`,
    host: "*",
    operation: "ALTER",
    permissionType: "ALLOW",
    clusterApiUrl: testCluster.clusterApiUrl,
    allowDeletion: aclAllowDeletion,
});
const clusterAction = new redpanda.Acl("cluster_action", {
    resourceType: "CLUSTER",
    resourceName: "kafka-cluster",
    resourcePatternType: "LITERAL",
    principal: pulumi.interpolate`User:${testUser.name}`,
    host: "*",
    operation: "CLUSTER_ACTION",
    permissionType: "ALLOW",
    clusterApiUrl: testCluster.clusterApiUrl,
    allowDeletion: aclAllowDeletion,
});
const topicAccess = new redpanda.Acl("topic_access", {
    resourceType: "TOPIC",
    resourceName: testTopic.name,
    resourcePatternType: "LITERAL",
    principal: pulumi.interpolate`User:${testUser.name}`,
    host: "*",
    operation: "ALL",
    permissionType: "ALLOW",
    clusterApiUrl: testCluster.clusterApiUrl,
    allowDeletion: aclAllowDeletion,
});
const allTestTopic = new redpanda.SchemaRegistryAcl("all_test_topic", {
    clusterId: testCluster.id,
    principal: pulumi.interpolate`User:${testUser.name}`,
    resourceType: "SUBJECT",
    resourceName: `${topicName}-`,
    patternType: "PREFIXED",
    host: "*",
    operation: "ALL",
    permission: "ALLOW",
    allowDeletion: true,
}, {
    dependsOn: [
        clusterAdmin,
        schemaRegistryAdmin,
    ],
});
const describeRegistry = new redpanda.SchemaRegistryAcl("describe_registry", {
    clusterId: testCluster.id,
    principal: pulumi.interpolate`User:${testUser.name}`,
    resourceType: "REGISTRY",
    resourceName: "*",
    patternType: "LITERAL",
    host: "*",
    operation: "DESCRIBE",
    permission: "ALLOW",
    allowDeletion: true,
}, {
    dependsOn: [
        clusterAdmin,
        schemaRegistryAdmin,
    ],
});
const alterConfigsRegistry = new redpanda.SchemaRegistryAcl("alter_configs_registry", {
    clusterId: testCluster.id,
    principal: pulumi.interpolate`User:${testUser.name}`,
    resourceType: "REGISTRY",
    resourceName: "*",
    patternType: "LITERAL",
    host: "*",
    operation: "ALTER_CONFIGS",
    permission: "ALLOW",
    allowDeletion: true,
}, {
    dependsOn: [
        clusterAdmin,
        schemaRegistryAdmin,
    ],
});
const readRegistry = new redpanda.SchemaRegistryAcl("read_registry", {
    clusterId: testCluster.id,
    principal: pulumi.interpolate`User:${testUser.name}`,
    resourceType: "REGISTRY",
    resourceName: "*",
    patternType: "LITERAL",
    host: "*",
    operation: "READ",
    permission: "ALLOW",
    allowDeletion: true,
}, {
    dependsOn: [
        clusterAdmin,
        schemaRegistryAdmin,
    ],
});
const writeRegistry = new redpanda.SchemaRegistryAcl("write_registry", {
    clusterId: testCluster.id,
    principal: pulumi.interpolate`User:${testUser.name}`,
    resourceType: "REGISTRY",
    resourceName: "*",
    patternType: "LITERAL",
    host: "*",
    operation: "WRITE",
    permission: "ALLOW",
    allowDeletion: true,
}, {
    dependsOn: [
        clusterAdmin,
        schemaRegistryAdmin,
    ],
});
const userSchema = new redpanda.Schema("user_schema", {
    clusterId: testCluster.id,
    subject: `${topicName}-value`,
    schemaType: schemaType,
    schema: userSchemaDefinition,
    allowDeletion: true,
}, {
    dependsOn: [
        clusterAdmin,
        schemaRegistryAdmin,
        clusterAction,
        topicAccess,
        providerBootstrapSubject,
        providerBootstrapRegistry,
        allTestTopic,
        describeRegistry,
        alterConfigsRegistry,
        readRegistry,
        writeRegistry,
    ],
});
const userEventSchema = new redpanda.Schema("user_event_schema", {
    clusterId: testCluster.id,
    subject: `${topicName}-events-value`,
    schemaType: schemaType,
    schema: userEventSchemaDefinition,
    allowDeletion: true,
    references: [{
        name: "User",
        subject: userSchema.subject,
        version: userSchema.version,
    }],
}, {
    dependsOn: [
        clusterAdmin,
        schemaRegistryAdmin,
        clusterAction,
        topicAccess,
        providerBootstrapSubject,
        providerBootstrapRegistry,
        allTestTopic,
        describeRegistry,
        alterConfigsRegistry,
        readRegistry,
        writeRegistry,
    ],
});
const productSchema = new redpanda.Schema("product_schema", {
    clusterId: testCluster.id,
    subject: `${topicName}-product-value`,
    schemaType: schemaType,
    schema: productSchemaDefinition,
    compatibility: compatibilityLevel,
    allowDeletion: true,
}, {
    dependsOn: [
        clusterAdmin,
        schemaRegistryAdmin,
        clusterAction,
        topicAccess,
        providerBootstrapSubject,
        providerBootstrapRegistry,
        allTestTopic,
        describeRegistry,
        alterConfigsRegistry,
        readRegistry,
        writeRegistry,
    ],
});
const developer = new redpanda.Role("developer", {
    name: roleName,
    clusterApiUrl: testCluster.clusterApiUrl,
    allowDeletion: roleAllowDeletion,
});
const roleTopicRead = new redpanda.Acl("role_topic_read", {
    resourceType: "TOPIC",
    resourceName: testTopic.name,
    resourcePatternType: "LITERAL",
    principal: pulumi.interpolate`RedpandaRole:${developer.name}`,
    host: "*",
    operation: "READ",
    permissionType: "ALLOW",
    clusterApiUrl: testCluster.clusterApiUrl,
    allowDeletion: aclAllowDeletion,
});
const readProduct = new redpanda.SchemaRegistryAcl("read_product", {
    clusterId: testCluster.id,
    principal: pulumi.interpolate`User:${testUser.name}`,
    resourceType: "SUBJECT",
    resourceName: "product-",
    patternType: "PREFIXED",
    host: "*",
    operation: "READ",
    permission: "ALLOW",
    allowDeletion: srAclAllowDeletion,
}, {
    dependsOn: [
        clusterAdmin,
        schemaRegistryAdmin,
    ],
});
const writeOrders = new redpanda.SchemaRegistryAcl("write_orders", {
    clusterId: testCluster.id,
    principal: pulumi.interpolate`User:${testUser.name}`,
    resourceType: "SUBJECT",
    resourceName: "orders-value",
    patternType: "LITERAL",
    host: "*",
    operation: "WRITE",
    permission: "ALLOW",
    allowDeletion: true,
}, {
    dependsOn: [
        clusterAdmin,
        schemaRegistryAdmin,
    ],
});
const developerAssignment = new redpanda.RoleAssignment("developer_assignment", {
    roleName: developer.name,
    principal: pulumi.interpolate`User:${testUser.name}`,
    clusterApiUrl: testCluster.clusterApiUrl,
}, {
    dependsOn: [testUser],
});
export const userSchemaInfo = {
    id: userSchema.schemaId,
    subject: userSchema.subject,
    version: userSchema.version,
    type: userSchema.schemaType,
};
export const userEventSchemaInfo = {
    id: userEventSchema.schemaId,
    subject: userEventSchema.subject,
    version: userEventSchema.version,
    type: userEventSchema.schemaType,
    references: userEventSchema.references,
};
export const productSchemaInfo = {
    id: productSchema.schemaId,
    subject: productSchema.subject,
    version: productSchema.version,
    type: productSchema.schemaType,
    compatibility: productSchema.compatibility,
};

# Pulumi.yaml provider configuration file
name: configuration-example
runtime: python

import pulumi
import json
import pulumi_redpanda as redpanda

test = redpanda.ResourceGroup("test", name=resource_group_name)
test_network = redpanda.Network("test",
    name=network_name,
    resource_group_id=test.id,
    cloud_provider=cloud_provider,
    region=region,
    cluster_type="dedicated",
    cidr_block="10.0.0.0/20",
    timeouts={
        "create": "20m",
        "delete": "20m",
    })
test_cluster = redpanda.Cluster("test",
    name=cluster_name,
    resource_group_id=test.id,
    network_id=test_network.id,
    cloud_provider=cloud_provider,
    region=region,
    cluster_type="dedicated",
    connection_type="public",
    throughput_tier=throughput_tier,
    zones=zones,
    allow_deletion=cluster_allow_deletion,
    cluster_configuration={
        "custom_properties_json": json.dumps({
            "enable_shadow_linking": cluster_enable_shadow_linking,
            "schema_registry_enable_authorization": True,
        }),
    },
    maintenance_window_config={
        "day_hour": {
            "day_of_week": maintenance_day_of_week,
            "hour_of_day": maintenance_hour_of_day,
        },
    },
    tags=cluster_tags,
    timeouts={
        "create": "90m",
    })
test_user = redpanda.User("test",
    name=user_name,
    password=None if user_password_wo != None else user_pw,
    password_wo=user_password_wo,
    password_wo_version=user_password_wo_version,
    mechanism=mechanism,
    cluster_api_url=test_cluster.cluster_api_url,
    allow_deletion=user_allow_deletion)
test_topic = redpanda.Topic("test",
    name=topic_name,
    partition_count=partition_count,
    replication_factor=replication_factor,
    cluster_api_url=test_cluster.cluster_api_url,
    allow_deletion=True,
    configuration=topic_configuration if topic_configuration != None else {
        "cleanup.policy": "delete",
        "retention.ms": topic_retention_ms,
    },
    opts = pulumi.ResourceOptions(depends_on=[test_user]))
# Bootstrap SR ACL grants for the provider's own Bearer-token principal.
# Two grants are required: the SUBJECT-scope grant authorizes
# POST /subjects/<subj>/versions; the REGISTRY-scope grant authorizes the
# follow-up GET /schemas/ids/<id>/versions that the SR client (franz-go) makes
# to fetch the full schema metadata after create. Without the REGISTRY grant,
# the schema is created but the follow-up GET 403s and the resource fails.
# User:* is broader than necessary; tighten once the exact principal is
# documented as discoverable.
provider_bootstrap_subject = redpanda.SchemaRegistryAcl("provider_bootstrap_subject",
    cluster_id=test_cluster.id,
    principal="User:*",
    resource_type="SUBJECT",
    resource_name_=topic_name,
    pattern_type="PREFIXED",
    host="*",
    operation="ALL",
    permission="ALLOW",
    allow_deletion=True)
provider_bootstrap_registry = redpanda.SchemaRegistryAcl("provider_bootstrap_registry",
    cluster_id=test_cluster.id,
    principal="User:*",
    resource_type="REGISTRY",
    resource_name_="*",
    pattern_type="LITERAL",
    host="*",
    operation="ALL",
    permission="ALLOW",
    allow_deletion=True)
cluster_admin = redpanda.Acl("cluster_admin",
    resource_type="CLUSTER",
    resource_name_="kafka-cluster",
    resource_pattern_type="LITERAL",
    principal=test_user.name.apply(lambda name: f"User:{name}"),
    host="*",
    operation="ALL",
    permission_type="ALLOW",
    cluster_api_url=test_cluster.cluster_api_url,
    allow_deletion=acl_allow_deletion)
schema_registry_admin = redpanda.Acl("schema_registry_admin",
    resource_type="CLUSTER",
    resource_name_="kafka-cluster",
    resource_pattern_type="LITERAL",
    principal=test_user.name.apply(lambda name: f"User:{name}"),
    host="*",
    operation="ALTER",
    permission_type="ALLOW",
    cluster_api_url=test_cluster.cluster_api_url,
    allow_deletion=acl_allow_deletion)
cluster_action = redpanda.Acl("cluster_action",
    resource_type="CLUSTER",
    resource_name_="kafka-cluster",
    resource_pattern_type="LITERAL",
    principal=test_user.name.apply(lambda name: f"User:{name}"),
    host="*",
    operation="CLUSTER_ACTION",
    permission_type="ALLOW",
    cluster_api_url=test_cluster.cluster_api_url,
    allow_deletion=acl_allow_deletion)
topic_access = redpanda.Acl("topic_access",
    resource_type="TOPIC",
    resource_name_=test_topic.name,
    resource_pattern_type="LITERAL",
    principal=test_user.name.apply(lambda name: f"User:{name}"),
    host="*",
    operation="ALL",
    permission_type="ALLOW",
    cluster_api_url=test_cluster.cluster_api_url,
    allow_deletion=acl_allow_deletion)
all_test_topic = redpanda.SchemaRegistryAcl("all_test_topic",
    cluster_id=test_cluster.id,
    principal=test_user.name.apply(lambda name: f"User:{name}"),
    resource_type="SUBJECT",
    resource_name_=f"{topic_name}-",
    pattern_type="PREFIXED",
    host="*",
    operation="ALL",
    permission="ALLOW",
    allow_deletion=True,
    opts = pulumi.ResourceOptions(depends_on=[
            cluster_admin,
            schema_registry_admin,
        ]))
describe_registry = redpanda.SchemaRegistryAcl("describe_registry",
    cluster_id=test_cluster.id,
    principal=test_user.name.apply(lambda name: f"User:{name}"),
    resource_type="REGISTRY",
    resource_name_="*",
    pattern_type="LITERAL",
    host="*",
    operation="DESCRIBE",
    permission="ALLOW",
    allow_deletion=True,
    opts = pulumi.ResourceOptions(depends_on=[
            cluster_admin,
            schema_registry_admin,
        ]))
alter_configs_registry = redpanda.SchemaRegistryAcl("alter_configs_registry",
    cluster_id=test_cluster.id,
    principal=test_user.name.apply(lambda name: f"User:{name}"),
    resource_type="REGISTRY",
    resource_name_="*",
    pattern_type="LITERAL",
    host="*",
    operation="ALTER_CONFIGS",
    permission="ALLOW",
    allow_deletion=True,
    opts = pulumi.ResourceOptions(depends_on=[
            cluster_admin,
            schema_registry_admin,
        ]))
read_registry = redpanda.SchemaRegistryAcl("read_registry",
    cluster_id=test_cluster.id,
    principal=test_user.name.apply(lambda name: f"User:{name}"),
    resource_type="REGISTRY",
    resource_name_="*",
    pattern_type="LITERAL",
    host="*",
    operation="READ",
    permission="ALLOW",
    allow_deletion=True,
    opts = pulumi.ResourceOptions(depends_on=[
            cluster_admin,
            schema_registry_admin,
        ]))
write_registry = redpanda.SchemaRegistryAcl("write_registry",
    cluster_id=test_cluster.id,
    principal=test_user.name.apply(lambda name: f"User:{name}"),
    resource_type="REGISTRY",
    resource_name_="*",
    pattern_type="LITERAL",
    host="*",
    operation="WRITE",
    permission="ALLOW",
    allow_deletion=True,
    opts = pulumi.ResourceOptions(depends_on=[
            cluster_admin,
            schema_registry_admin,
        ]))
user_schema = redpanda.Schema("user_schema",
    cluster_id=test_cluster.id,
    subject=f"{topic_name}-value",
    schema_type=schema_type,
    schema=user_schema_definition,
    allow_deletion=True,
    opts = pulumi.ResourceOptions(depends_on=[
            cluster_admin,
            schema_registry_admin,
            cluster_action,
            topic_access,
            provider_bootstrap_subject,
            provider_bootstrap_registry,
            all_test_topic,
            describe_registry,
            alter_configs_registry,
            read_registry,
            write_registry,
        ]))
user_event_schema = redpanda.Schema("user_event_schema",
    cluster_id=test_cluster.id,
    subject=f"{topic_name}-events-value",
    schema_type=schema_type,
    schema=user_event_schema_definition,
    allow_deletion=True,
    references=[{
        "name": "User",
        "subject": user_schema.subject,
        "version": user_schema.version,
    }],
    opts = pulumi.ResourceOptions(depends_on=[
            cluster_admin,
            schema_registry_admin,
            cluster_action,
            topic_access,
            provider_bootstrap_subject,
            provider_bootstrap_registry,
            all_test_topic,
            describe_registry,
            alter_configs_registry,
            read_registry,
            write_registry,
        ]))
product_schema = redpanda.Schema("product_schema",
    cluster_id=test_cluster.id,
    subject=f"{topic_name}-product-value",
    schema_type=schema_type,
    schema=product_schema_definition,
    compatibility=compatibility_level,
    allow_deletion=True,
    opts = pulumi.ResourceOptions(depends_on=[
            cluster_admin,
            schema_registry_admin,
            cluster_action,
            topic_access,
            provider_bootstrap_subject,
            provider_bootstrap_registry,
            all_test_topic,
            describe_registry,
            alter_configs_registry,
            read_registry,
            write_registry,
        ]))
developer = redpanda.Role("developer",
    name=role_name,
    cluster_api_url=test_cluster.cluster_api_url,
    allow_deletion=role_allow_deletion)
role_topic_read = redpanda.Acl("role_topic_read",
    resource_type="TOPIC",
    resource_name_=test_topic.name,
    resource_pattern_type="LITERAL",
    principal=developer.name.apply(lambda name: f"RedpandaRole:{name}"),
    host="*",
    operation="READ",
    permission_type="ALLOW",
    cluster_api_url=test_cluster.cluster_api_url,
    allow_deletion=acl_allow_deletion)
read_product = redpanda.SchemaRegistryAcl("read_product",
    cluster_id=test_cluster.id,
    principal=test_user.name.apply(lambda name: f"User:{name}"),
    resource_type="SUBJECT",
    resource_name_="product-",
    pattern_type="PREFIXED",
    host="*",
    operation="READ",
    permission="ALLOW",
    allow_deletion=sr_acl_allow_deletion,
    opts = pulumi.ResourceOptions(depends_on=[
            cluster_admin,
            schema_registry_admin,
        ]))
write_orders = redpanda.SchemaRegistryAcl("write_orders",
    cluster_id=test_cluster.id,
    principal=test_user.name.apply(lambda name: f"User:{name}"),
    resource_type="SUBJECT",
    resource_name_="orders-value",
    pattern_type="LITERAL",
    host="*",
    operation="WRITE",
    permission="ALLOW",
    allow_deletion=True,
    opts = pulumi.ResourceOptions(depends_on=[
            cluster_admin,
            schema_registry_admin,
        ]))
developer_assignment = redpanda.RoleAssignment("developer_assignment",
    role_name=developer.name,
    principal=test_user.name.apply(lambda name: f"User:{name}"),
    cluster_api_url=test_cluster.cluster_api_url,
    opts = pulumi.ResourceOptions(depends_on=[test_user]))
pulumi.export("userSchemaInfo", {
    "id": user_schema.schema_id,
    "subject": user_schema.subject,
    "version": user_schema.version,
    "type": user_schema.schema_type,
})
pulumi.export("userEventSchemaInfo", {
    "id": user_event_schema.schema_id,
    "subject": user_event_schema.subject,
    "version": user_event_schema.version,
    "type": user_event_schema.schema_type,
    "references": user_event_schema.references,
})
pulumi.export("productSchemaInfo", {
    "id": product_schema.schema_id,
    "subject": product_schema.subject,
    "version": product_schema.version,
    "type": product_schema.schema_type,
    "compatibility": product_schema.compatibility,
})

# Pulumi.yaml provider configuration file
name: configuration-example
runtime: dotnet

using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Redpanda = Pulumi.Redpanda;

return await Deployment.RunAsync(() =>
{
    var test = new Redpanda.ResourceGroup("test", new()
    {
        Name = resourceGroupName,
    });

    var testNetwork = new Redpanda.Network("test", new()
    {
        Name = networkName,
        ResourceGroupId = test.Id,
        CloudProvider = cloudProvider,
        Region = region,
        ClusterType = "dedicated",
        CidrBlock = "10.0.0.0/20",
        Timeouts = new Redpanda.Inputs.NetworkTimeoutsArgs
        {
            Create = "20m",
            Delete = "20m",
        },
    });

    var testCluster = new Redpanda.Cluster("test", new()
    {
        Name = clusterName,
        ResourceGroupId = test.Id,
        NetworkId = testNetwork.Id,
        CloudProvider = cloudProvider,
        Region = region,
        ClusterType = "dedicated",
        ConnectionType = "public",
        ThroughputTier = throughputTier,
        Zones = zones,
        AllowDeletion = clusterAllowDeletion,
        ClusterConfiguration = new Redpanda.Inputs.ClusterClusterConfigurationArgs
        {
            CustomPropertiesJson = JsonSerializer.Serialize(new Dictionary<string, object?>
            {
                ["enable_shadow_linking"] = clusterEnableShadowLinking,
                ["schema_registry_enable_authorization"] = true,
            }),
        },
        MaintenanceWindowConfig = new Redpanda.Inputs.ClusterMaintenanceWindowConfigArgs
        {
            DayHour = new Redpanda.Inputs.ClusterMaintenanceWindowConfigDayHourArgs
            {
                DayOfWeek = maintenanceDayOfWeek,
                HourOfDay = maintenanceHourOfDay,
            },
        },
        Tags = clusterTags,
        Timeouts = new Redpanda.Inputs.ClusterTimeoutsArgs
        {
            Create = "90m",
        },
    });

    var testUser = new Redpanda.User("test", new()
    {
        Name = userName,
        Password = userPasswordWo != null ? null : userPw,
        PasswordWo = userPasswordWo,
        PasswordWoVersion = userPasswordWoVersion,
        Mechanism = mechanism,
        ClusterApiUrl = testCluster.ClusterApiUrl,
        AllowDeletion = userAllowDeletion,
    });

    var testTopic = new Redpanda.Topic("test", new()
    {
        Name = topicName,
        PartitionCount = partitionCount,
        ReplicationFactor = replicationFactor,
        ClusterApiUrl = testCluster.ClusterApiUrl,
        AllowDeletion = true,
        Configuration = topicConfiguration != null ? topicConfiguration :
        {
            { "cleanup.policy", "delete" },
            { "retention.ms", topicRetentionMs },
        },
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            testUser,
        },
    });

    // Bootstrap SR ACL grants for the provider's own Bearer-token principal.
    // Two grants are required: the SUBJECT-scope grant authorizes
    // POST /subjects/<subj>/versions; the REGISTRY-scope grant authorizes the
    // follow-up GET /schemas/ids/<id>/versions that the SR client (franz-go) makes
    // to fetch the full schema metadata after create. Without the REGISTRY grant,
    // the schema is created but the follow-up GET 403s and the resource fails.
    // User:* is broader than necessary; tighten once the exact principal is
    // documented as discoverable.
    var providerBootstrapSubject = new Redpanda.SchemaRegistryAcl("provider_bootstrap_subject", new()
    {
        ClusterId = testCluster.Id,
        Principal = "User:*",
        ResourceType = "SUBJECT",
        ResourceName = topicName,
        PatternType = "PREFIXED",
        Host = "*",
        Operation = "ALL",
        Permission = "ALLOW",
        AllowDeletion = true,
    });

    var providerBootstrapRegistry = new Redpanda.SchemaRegistryAcl("provider_bootstrap_registry", new()
    {
        ClusterId = testCluster.Id,
        Principal = "User:*",
        ResourceType = "REGISTRY",
        ResourceName = "*",
        PatternType = "LITERAL",
        Host = "*",
        Operation = "ALL",
        Permission = "ALLOW",
        AllowDeletion = true,
    });

    var clusterAdmin = new Redpanda.Acl("cluster_admin", new()
    {
        ResourceType = "CLUSTER",
        ResourceName = "kafka-cluster",
        ResourcePatternType = "LITERAL",
        Principal = testUser.Name.Apply(name => $"User:{name}"),
        Host = "*",
        Operation = "ALL",
        PermissionType = "ALLOW",
        ClusterApiUrl = testCluster.ClusterApiUrl,
        AllowDeletion = aclAllowDeletion,
    });

    var schemaRegistryAdmin = new Redpanda.Acl("schema_registry_admin", new()
    {
        ResourceType = "CLUSTER",
        ResourceName = "kafka-cluster",
        ResourcePatternType = "LITERAL",
        Principal = testUser.Name.Apply(name => $"User:{name}"),
        Host = "*",
        Operation = "ALTER",
        PermissionType = "ALLOW",
        ClusterApiUrl = testCluster.ClusterApiUrl,
        AllowDeletion = aclAllowDeletion,
    });

    var clusterAction = new Redpanda.Acl("cluster_action", new()
    {
        ResourceType = "CLUSTER",
        ResourceName = "kafka-cluster",
        ResourcePatternType = "LITERAL",
        Principal = testUser.Name.Apply(name => $"User:{name}"),
        Host = "*",
        Operation = "CLUSTER_ACTION",
        PermissionType = "ALLOW",
        ClusterApiUrl = testCluster.ClusterApiUrl,
        AllowDeletion = aclAllowDeletion,
    });

    var topicAccess = new Redpanda.Acl("topic_access", new()
    {
        ResourceType = "TOPIC",
        ResourceName = testTopic.Name,
        ResourcePatternType = "LITERAL",
        Principal = testUser.Name.Apply(name => $"User:{name}"),
        Host = "*",
        Operation = "ALL",
        PermissionType = "ALLOW",
        ClusterApiUrl = testCluster.ClusterApiUrl,
        AllowDeletion = aclAllowDeletion,
    });

    var allTestTopic = new Redpanda.SchemaRegistryAcl("all_test_topic", new()
    {
        ClusterId = testCluster.Id,
        Principal = testUser.Name.Apply(name => $"User:{name}"),
        ResourceType = "SUBJECT",
        ResourceName = $"{topicName}-",
        PatternType = "PREFIXED",
        Host = "*",
        Operation = "ALL",
        Permission = "ALLOW",
        AllowDeletion = true,
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            clusterAdmin,
            schemaRegistryAdmin,
        },
    });

    var describeRegistry = new Redpanda.SchemaRegistryAcl("describe_registry", new()
    {
        ClusterId = testCluster.Id,
        Principal = testUser.Name.Apply(name => $"User:{name}"),
        ResourceType = "REGISTRY",
        ResourceName = "*",
        PatternType = "LITERAL",
        Host = "*",
        Operation = "DESCRIBE",
        Permission = "ALLOW",
        AllowDeletion = true,
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            clusterAdmin,
            schemaRegistryAdmin,
        },
    });

    var alterConfigsRegistry = new Redpanda.SchemaRegistryAcl("alter_configs_registry", new()
    {
        ClusterId = testCluster.Id,
        Principal = testUser.Name.Apply(name => $"User:{name}"),
        ResourceType = "REGISTRY",
        ResourceName = "*",
        PatternType = "LITERAL",
        Host = "*",
        Operation = "ALTER_CONFIGS",
        Permission = "ALLOW",
        AllowDeletion = true,
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            clusterAdmin,
            schemaRegistryAdmin,
        },
    });

    var readRegistry = new Redpanda.SchemaRegistryAcl("read_registry", new()
    {
        ClusterId = testCluster.Id,
        Principal = testUser.Name.Apply(name => $"User:{name}"),
        ResourceType = "REGISTRY",
        ResourceName = "*",
        PatternType = "LITERAL",
        Host = "*",
        Operation = "READ",
        Permission = "ALLOW",
        AllowDeletion = true,
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            clusterAdmin,
            schemaRegistryAdmin,
        },
    });

    var writeRegistry = new Redpanda.SchemaRegistryAcl("write_registry", new()
    {
        ClusterId = testCluster.Id,
        Principal = testUser.Name.Apply(name => $"User:{name}"),
        ResourceType = "REGISTRY",
        ResourceName = "*",
        PatternType = "LITERAL",
        Host = "*",
        Operation = "WRITE",
        Permission = "ALLOW",
        AllowDeletion = true,
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            clusterAdmin,
            schemaRegistryAdmin,
        },
    });

    var userSchema = new Redpanda.Schema("user_schema", new()
    {
        ClusterId = testCluster.Id,
        Subject = $"{topicName}-value",
        SchemaType = schemaType,
        Schema = userSchemaDefinition,
        AllowDeletion = true,
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            clusterAdmin,
            schemaRegistryAdmin,
            clusterAction,
            topicAccess,
            providerBootstrapSubject,
            providerBootstrapRegistry,
            allTestTopic,
            describeRegistry,
            alterConfigsRegistry,
            readRegistry,
            writeRegistry,
        },
    });

    var userEventSchema = new Redpanda.Schema("user_event_schema", new()
    {
        ClusterId = testCluster.Id,
        Subject = $"{topicName}-events-value",
        SchemaType = schemaType,
        Schema = userEventSchemaDefinition,
        AllowDeletion = true,
        References = new[]
        {
            new Redpanda.Inputs.SchemaReferenceArgs
            {
                Name = "User",
                Subject = userSchema.Subject,
                Version = userSchema.Version,
            },
        },
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            clusterAdmin,
            schemaRegistryAdmin,
            clusterAction,
            topicAccess,
            providerBootstrapSubject,
            providerBootstrapRegistry,
            allTestTopic,
            describeRegistry,
            alterConfigsRegistry,
            readRegistry,
            writeRegistry,
        },
    });

    var productSchema = new Redpanda.Schema("product_schema", new()
    {
        ClusterId = testCluster.Id,
        Subject = $"{topicName}-product-value",
        SchemaType = schemaType,
        Schema = productSchemaDefinition,
        Compatibility = compatibilityLevel,
        AllowDeletion = true,
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            clusterAdmin,
            schemaRegistryAdmin,
            clusterAction,
            topicAccess,
            providerBootstrapSubject,
            providerBootstrapRegistry,
            allTestTopic,
            describeRegistry,
            alterConfigsRegistry,
            readRegistry,
            writeRegistry,
        },
    });

    var developer = new Redpanda.Role("developer", new()
    {
        Name = roleName,
        ClusterApiUrl = testCluster.ClusterApiUrl,
        AllowDeletion = roleAllowDeletion,
    });

    var roleTopicRead = new Redpanda.Acl("role_topic_read", new()
    {
        ResourceType = "TOPIC",
        ResourceName = testTopic.Name,
        ResourcePatternType = "LITERAL",
        Principal = developer.Name.Apply(name => $"RedpandaRole:{name}"),
        Host = "*",
        Operation = "READ",
        PermissionType = "ALLOW",
        ClusterApiUrl = testCluster.ClusterApiUrl,
        AllowDeletion = aclAllowDeletion,
    });

    var readProduct = new Redpanda.SchemaRegistryAcl("read_product", new()
    {
        ClusterId = testCluster.Id,
        Principal = testUser.Name.Apply(name => $"User:{name}"),
        ResourceType = "SUBJECT",
        ResourceName = "product-",
        PatternType = "PREFIXED",
        Host = "*",
        Operation = "READ",
        Permission = "ALLOW",
        AllowDeletion = srAclAllowDeletion,
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            clusterAdmin,
            schemaRegistryAdmin,
        },
    });

    var writeOrders = new Redpanda.SchemaRegistryAcl("write_orders", new()
    {
        ClusterId = testCluster.Id,
        Principal = testUser.Name.Apply(name => $"User:{name}"),
        ResourceType = "SUBJECT",
        ResourceName = "orders-value",
        PatternType = "LITERAL",
        Host = "*",
        Operation = "WRITE",
        Permission = "ALLOW",
        AllowDeletion = true,
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            clusterAdmin,
            schemaRegistryAdmin,
        },
    });

    var developerAssignment = new Redpanda.RoleAssignment("developer_assignment", new()
    {
        RoleName = developer.Name,
        Principal = testUser.Name.Apply(name => $"User:{name}"),
        ClusterApiUrl = testCluster.ClusterApiUrl,
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            testUser,
        },
    });

    return new Dictionary<string, object?>
    {
        ["userSchemaInfo"] =
        {
            { "id", userSchema.SchemaId },
            { "subject", userSchema.Subject },
            { "version", userSchema.Version },
            { "type", userSchema.SchemaType },
        },
        ["userEventSchemaInfo"] =
        {
            { "id", userEventSchema.SchemaId },
            { "subject", userEventSchema.Subject },
            { "version", userEventSchema.Version },
            { "type", userEventSchema.SchemaType },
            { "references", userEventSchema.References },
        },
        ["productSchemaInfo"] =
        {
            { "id", productSchema.SchemaId },
            { "subject", productSchema.Subject },
            { "version", productSchema.Version },
            { "type", productSchema.SchemaType },
            { "compatibility", productSchema.Compatibility },
        },
    };
});

# Pulumi.yaml provider configuration file
name: configuration-example
runtime: go

package main

import (
	"encoding/json"
	"fmt"

	"github.com/pulumi/pulumi-pulumi-provider/sdks/go/redpanda/v2/redpanda"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		test, err := redpanda.NewResourceGroup(ctx, "test", &redpanda.ResourceGroupArgs{
			Name: pulumi.Any(resourceGroupName),
		})
		if err != nil {
			return err
		}
		testNetwork, err := redpanda.NewNetwork(ctx, "test", &redpanda.NetworkArgs{
			Name:            pulumi.Any(networkName),
			ResourceGroupId: test.ID(),
			CloudProvider:   pulumi.Any(cloudProvider),
			Region:          pulumi.Any(region),
			ClusterType:     pulumi.String("dedicated"),
			CidrBlock:       pulumi.String("10.0.0.0/20"),
			Timeouts: &redpanda.NetworkTimeoutsArgs{
				Create: pulumi.String("20m"),
				Delete: pulumi.String("20m"),
			},
		})
		if err != nil {
			return err
		}
		tmpJSON0, err := json.Marshal(map[string]interface{}{
			"enable_shadow_linking":                clusterEnableShadowLinking,
			"schema_registry_enable_authorization": true,
		})
		if err != nil {
			return err
		}
		json0 := string(tmpJSON0)
		testCluster, err := redpanda.NewCluster(ctx, "test", &redpanda.ClusterArgs{
			Name:            pulumi.Any(clusterName),
			ResourceGroupId: test.ID(),
			NetworkId:       testNetwork.ID(),
			CloudProvider:   pulumi.Any(cloudProvider),
			Region:          pulumi.Any(region),
			ClusterType:     pulumi.String("dedicated"),
			ConnectionType:  pulumi.String("public"),
			ThroughputTier:  pulumi.Any(throughputTier),
			Zones:           pulumi.Any(zones),
			AllowDeletion:   pulumi.Any(clusterAllowDeletion),
			ClusterConfiguration: &redpanda.ClusterClusterConfigurationArgs{
				CustomPropertiesJson: pulumi.String(json0),
			},
			MaintenanceWindowConfig: &redpanda.ClusterMaintenanceWindowConfigArgs{
				DayHour: &redpanda.ClusterMaintenanceWindowConfigDayHourArgs{
					DayOfWeek: pulumi.Any(maintenanceDayOfWeek),
					HourOfDay: pulumi.Any(maintenanceHourOfDay),
				},
			},
			Tags: pulumi.Any(clusterTags),
			Timeouts: &redpanda.ClusterTimeoutsArgs{
				Create: pulumi.String("90m"),
			},
		})
		if err != nil {
			return err
		}
		var tmp0 pulumi.String
		if userPasswordWo != nil {
			tmp0 = nil
		} else {
			tmp0 = pulumi.Any(userPw)
		}
		testUser, err := redpanda.NewUser(ctx, "test", &redpanda.UserArgs{
			Name:              pulumi.Any(userName),
			Password:          pulumi.String(tmp0),
			PasswordWo:        pulumi.Any(userPasswordWo),
			PasswordWoVersion: pulumi.Any(userPasswordWoVersion),
			Mechanism:         pulumi.Any(mechanism),
			ClusterApiUrl:     testCluster.ClusterApiUrl,
			AllowDeletion:     pulumi.Any(userAllowDeletion),
		})
		if err != nil {
			return err
		}
		var tmp1 pulumi.StringMap
		if topicConfiguration != nil {
			tmp1 = pulumi.Any(topicConfiguration)
		} else {
			tmp1 = pulumi.StringMap{
				"cleanup.policy": pulumi.String("delete"),
				"retention.ms":   pulumi.Any(topicRetentionMs),
			}
		}
		testTopic, err := redpanda.NewTopic(ctx, "test", &redpanda.TopicArgs{
			Name:              pulumi.Any(topicName),
			PartitionCount:    pulumi.Any(partitionCount),
			ReplicationFactor: pulumi.Any(replicationFactor),
			ClusterApiUrl:     testCluster.ClusterApiUrl,
			AllowDeletion:     pulumi.Bool(true),
			Configuration:     pulumi.StringMap(tmp1),
		}, pulumi.DependsOn([]pulumi.Resource{
			testUser,
		}))
		if err != nil {
			return err
		}
		// Bootstrap SR ACL grants for the provider's own Bearer-token principal.
		// Two grants are required: the SUBJECT-scope grant authorizes
		// POST /subjects/<subj>/versions; the REGISTRY-scope grant authorizes the
		// follow-up GET /schemas/ids/<id>/versions that the SR client (franz-go) makes
		// to fetch the full schema metadata after create. Without the REGISTRY grant,
		// the schema is created but the follow-up GET 403s and the resource fails.
		// User:* is broader than necessary; tighten once the exact principal is
		// documented as discoverable.
		providerBootstrapSubject, err := redpanda.NewSchemaRegistryAcl(ctx, "provider_bootstrap_subject", &redpanda.SchemaRegistryAclArgs{
			ClusterId:     testCluster.ID(),
			Principal:     pulumi.String("User:*"),
			ResourceType:  pulumi.String("SUBJECT"),
			ResourceName:  pulumi.Any(topicName),
			PatternType:   pulumi.String("PREFIXED"),
			Host:          pulumi.String("*"),
			Operation:     pulumi.String("ALL"),
			Permission:    pulumi.String("ALLOW"),
			AllowDeletion: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		providerBootstrapRegistry, err := redpanda.NewSchemaRegistryAcl(ctx, "provider_bootstrap_registry", &redpanda.SchemaRegistryAclArgs{
			ClusterId:     testCluster.ID(),
			Principal:     pulumi.String("User:*"),
			ResourceType:  pulumi.String("REGISTRY"),
			ResourceName:  pulumi.String("*"),
			PatternType:   pulumi.String("LITERAL"),
			Host:          pulumi.String("*"),
			Operation:     pulumi.String("ALL"),
			Permission:    pulumi.String("ALLOW"),
			AllowDeletion: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		clusterAdmin, err := redpanda.NewAcl(ctx, "cluster_admin", &redpanda.AclArgs{
			ResourceType:        pulumi.String("CLUSTER"),
			ResourceName:        pulumi.String("kafka-cluster"),
			ResourcePatternType: pulumi.String("LITERAL"),
			Principal: testUser.Name.ApplyT(func(name string) (string, error) {
				return fmt.Sprintf("User:%v", name), nil
			}).(pulumi.StringOutput),
			Host:           pulumi.String("*"),
			Operation:      pulumi.String("ALL"),
			PermissionType: pulumi.String("ALLOW"),
			ClusterApiUrl:  testCluster.ClusterApiUrl,
			AllowDeletion:  pulumi.Any(aclAllowDeletion),
		})
		if err != nil {
			return err
		}
		schemaRegistryAdmin, err := redpanda.NewAcl(ctx, "schema_registry_admin", &redpanda.AclArgs{
			ResourceType:        pulumi.String("CLUSTER"),
			ResourceName:        pulumi.String("kafka-cluster"),
			ResourcePatternType: pulumi.String("LITERAL"),
			Principal: testUser.Name.ApplyT(func(name string) (string, error) {
				return fmt.Sprintf("User:%v", name), nil
			}).(pulumi.StringOutput),
			Host:           pulumi.String("*"),
			Operation:      pulumi.String("ALTER"),
			PermissionType: pulumi.String("ALLOW"),
			ClusterApiUrl:  testCluster.ClusterApiUrl,
			AllowDeletion:  pulumi.Any(aclAllowDeletion),
		})
		if err != nil {
			return err
		}
		clusterAction, err := redpanda.NewAcl(ctx, "cluster_action", &redpanda.AclArgs{
			ResourceType:        pulumi.String("CLUSTER"),
			ResourceName:        pulumi.String("kafka-cluster"),
			ResourcePatternType: pulumi.String("LITERAL"),
			Principal: testUser.Name.ApplyT(func(name string) (string, error) {
				return fmt.Sprintf("User:%v", name), nil
			}).(pulumi.StringOutput),
			Host:           pulumi.String("*"),
			Operation:      pulumi.String("CLUSTER_ACTION"),
			PermissionType: pulumi.String("ALLOW"),
			ClusterApiUrl:  testCluster.ClusterApiUrl,
			AllowDeletion:  pulumi.Any(aclAllowDeletion),
		})
		if err != nil {
			return err
		}
		topicAccess, err := redpanda.NewAcl(ctx, "topic_access", &redpanda.AclArgs{
			ResourceType:        pulumi.String("TOPIC"),
			ResourceName:        testTopic.Name,
			ResourcePatternType: pulumi.String("LITERAL"),
			Principal: testUser.Name.ApplyT(func(name string) (string, error) {
				return fmt.Sprintf("User:%v", name), nil
			}).(pulumi.StringOutput),
			Host:           pulumi.String("*"),
			Operation:      pulumi.String("ALL"),
			PermissionType: pulumi.String("ALLOW"),
			ClusterApiUrl:  testCluster.ClusterApiUrl,
			AllowDeletion:  pulumi.Any(aclAllowDeletion),
		})
		if err != nil {
			return err
		}
		allTestTopic, err := redpanda.NewSchemaRegistryAcl(ctx, "all_test_topic", &redpanda.SchemaRegistryAclArgs{
			ClusterId: testCluster.ID(),
			Principal: testUser.Name.ApplyT(func(name string) (string, error) {
				return fmt.Sprintf("User:%v", name), nil
			}).(pulumi.StringOutput),
			ResourceType:  pulumi.String("SUBJECT"),
			ResourceName:  pulumi.Sprintf("%v-", topicName),
			PatternType:   pulumi.String("PREFIXED"),
			Host:          pulumi.String("*"),
			Operation:     pulumi.String("ALL"),
			Permission:    pulumi.String("ALLOW"),
			AllowDeletion: pulumi.Bool(true),
		}, pulumi.DependsOn([]pulumi.Resource{
			clusterAdmin,
			schemaRegistryAdmin,
		}))
		if err != nil {
			return err
		}
		describeRegistry, err := redpanda.NewSchemaRegistryAcl(ctx, "describe_registry", &redpanda.SchemaRegistryAclArgs{
			ClusterId: testCluster.ID(),
			Principal: testUser.Name.ApplyT(func(name string) (string, error) {
				return fmt.Sprintf("User:%v", name), nil
			}).(pulumi.StringOutput),
			ResourceType:  pulumi.String("REGISTRY"),
			ResourceName:  pulumi.String("*"),
			PatternType:   pulumi.String("LITERAL"),
			Host:          pulumi.String("*"),
			Operation:     pulumi.String("DESCRIBE"),
			Permission:    pulumi.String("ALLOW"),
			AllowDeletion: pulumi.Bool(true),
		}, pulumi.DependsOn([]pulumi.Resource{
			clusterAdmin,
			schemaRegistryAdmin,
		}))
		if err != nil {
			return err
		}
		alterConfigsRegistry, err := redpanda.NewSchemaRegistryAcl(ctx, "alter_configs_registry", &redpanda.SchemaRegistryAclArgs{
			ClusterId: testCluster.ID(),
			Principal: testUser.Name.ApplyT(func(name string) (string, error) {
				return fmt.Sprintf("User:%v", name), nil
			}).(pulumi.StringOutput),
			ResourceType:  pulumi.String("REGISTRY"),
			ResourceName:  pulumi.String("*"),
			PatternType:   pulumi.String("LITERAL"),
			Host:          pulumi.String("*"),
			Operation:     pulumi.String("ALTER_CONFIGS"),
			Permission:    pulumi.String("ALLOW"),
			AllowDeletion: pulumi.Bool(true),
		}, pulumi.DependsOn([]pulumi.Resource{
			clusterAdmin,
			schemaRegistryAdmin,
		}))
		if err != nil {
			return err
		}
		readRegistry, err := redpanda.NewSchemaRegistryAcl(ctx, "read_registry", &redpanda.SchemaRegistryAclArgs{
			ClusterId: testCluster.ID(),
			Principal: testUser.Name.ApplyT(func(name string) (string, error) {
				return fmt.Sprintf("User:%v", name), nil
			}).(pulumi.StringOutput),
			ResourceType:  pulumi.String("REGISTRY"),
			ResourceName:  pulumi.String("*"),
			PatternType:   pulumi.String("LITERAL"),
			Host:          pulumi.String("*"),
			Operation:     pulumi.String("READ"),
			Permission:    pulumi.String("ALLOW"),
			AllowDeletion: pulumi.Bool(true),
		}, pulumi.DependsOn([]pulumi.Resource{
			clusterAdmin,
			schemaRegistryAdmin,
		}))
		if err != nil {
			return err
		}
		writeRegistry, err := redpanda.NewSchemaRegistryAcl(ctx, "write_registry", &redpanda.SchemaRegistryAclArgs{
			ClusterId: testCluster.ID(),
			Principal: testUser.Name.ApplyT(func(name string) (string, error) {
				return fmt.Sprintf("User:%v", name), nil
			}).(pulumi.StringOutput),
			ResourceType:  pulumi.String("REGISTRY"),
			ResourceName:  pulumi.String("*"),
			PatternType:   pulumi.String("LITERAL"),
			Host:          pulumi.String("*"),
			Operation:     pulumi.String("WRITE"),
			Permission:    pulumi.String("ALLOW"),
			AllowDeletion: pulumi.Bool(true),
		}, pulumi.DependsOn([]pulumi.Resource{
			clusterAdmin,
			schemaRegistryAdmin,
		}))
		if err != nil {
			return err
		}
		userSchema, err := redpanda.NewSchema(ctx, "user_schema", &redpanda.SchemaArgs{
			ClusterId:     testCluster.ID(),
			Subject:       pulumi.Sprintf("%v-value", topicName),
			SchemaType:    pulumi.Any(schemaType),
			Schema:        pulumi.Any(userSchemaDefinition),
			AllowDeletion: pulumi.Bool(true),
		}, pulumi.DependsOn([]pulumi.Resource{
			clusterAdmin,
			schemaRegistryAdmin,
			clusterAction,
			topicAccess,
			providerBootstrapSubject,
			providerBootstrapRegistry,
			allTestTopic,
			describeRegistry,
			alterConfigsRegistry,
			readRegistry,
			writeRegistry,
		}))
		if err != nil {
			return err
		}
		userEventSchema, err := redpanda.NewSchema(ctx, "user_event_schema", &redpanda.SchemaArgs{
			ClusterId:     testCluster.ID(),
			Subject:       pulumi.Sprintf("%v-events-value", topicName),
			SchemaType:    pulumi.Any(schemaType),
			Schema:        pulumi.Any(userEventSchemaDefinition),
			AllowDeletion: pulumi.Bool(true),
			References: redpanda.SchemaReferenceArray{
				&redpanda.SchemaReferenceArgs{
					Name:    pulumi.String("User"),
					Subject: userSchema.Subject,
					Version: userSchema.Version,
				},
			},
		}, pulumi.DependsOn([]pulumi.Resource{
			clusterAdmin,
			schemaRegistryAdmin,
			clusterAction,
			topicAccess,
			providerBootstrapSubject,
			providerBootstrapRegistry,
			allTestTopic,
			describeRegistry,
			alterConfigsRegistry,
			readRegistry,
			writeRegistry,
		}))
		if err != nil {
			return err
		}
		productSchema, err := redpanda.NewSchema(ctx, "product_schema", &redpanda.SchemaArgs{
			ClusterId:     testCluster.ID(),
			Subject:       pulumi.Sprintf("%v-product-value", topicName),
			SchemaType:    pulumi.Any(schemaType),
			Schema:        pulumi.Any(productSchemaDefinition),
			Compatibility: pulumi.Any(compatibilityLevel),
			AllowDeletion: pulumi.Bool(true),
		}, pulumi.DependsOn([]pulumi.Resource{
			clusterAdmin,
			schemaRegistryAdmin,
			clusterAction,
			topicAccess,
			providerBootstrapSubject,
			providerBootstrapRegistry,
			allTestTopic,
			describeRegistry,
			alterConfigsRegistry,
			readRegistry,
			writeRegistry,
		}))
		if err != nil {
			return err
		}
		developer, err := redpanda.NewRole(ctx, "developer", &redpanda.RoleArgs{
			Name:          pulumi.Any(roleName),
			ClusterApiUrl: testCluster.ClusterApiUrl,
			AllowDeletion: pulumi.Any(roleAllowDeletion),
		})
		if err != nil {
			return err
		}
		_, err = redpanda.NewAcl(ctx, "role_topic_read", &redpanda.AclArgs{
			ResourceType:        pulumi.String("TOPIC"),
			ResourceName:        testTopic.Name,
			ResourcePatternType: pulumi.String("LITERAL"),
			Principal: developer.Name.ApplyT(func(name string) (string, error) {
				return fmt.Sprintf("RedpandaRole:%v", name), nil
			}).(pulumi.StringOutput),
			Host:           pulumi.String("*"),
			Operation:      pulumi.String("READ"),
			PermissionType: pulumi.String("ALLOW"),
			ClusterApiUrl:  testCluster.ClusterApiUrl,
			AllowDeletion:  pulumi.Any(aclAllowDeletion),
		})
		if err != nil {
			return err
		}
		_, err = redpanda.NewSchemaRegistryAcl(ctx, "read_product", &redpanda.SchemaRegistryAclArgs{
			ClusterId: testCluster.ID(),
			Principal: testUser.Name.ApplyT(func(name string) (string, error) {
				return fmt.Sprintf("User:%v", name), nil
			}).(pulumi.StringOutput),
			ResourceType:  pulumi.String("SUBJECT"),
			ResourceName:  pulumi.String("product-"),
			PatternType:   pulumi.String("PREFIXED"),
			Host:          pulumi.String("*"),
			Operation:     pulumi.String("READ"),
			Permission:    pulumi.String("ALLOW"),
			AllowDeletion: pulumi.Any(srAclAllowDeletion),
		}, pulumi.DependsOn([]pulumi.Resource{
			clusterAdmin,
			schemaRegistryAdmin,
		}))
		if err != nil {
			return err
		}
		_, err = redpanda.NewSchemaRegistryAcl(ctx, "write_orders", &redpanda.SchemaRegistryAclArgs{
			ClusterId: testCluster.ID(),
			Principal: testUser.Name.ApplyT(func(name string) (string, error) {
				return fmt.Sprintf("User:%v", name), nil
			}).(pulumi.StringOutput),
			ResourceType:  pulumi.String("SUBJECT"),
			ResourceName:  pulumi.String("orders-value"),
			PatternType:   pulumi.String("LITERAL"),
			Host:          pulumi.String("*"),
			Operation:     pulumi.String("WRITE"),
			Permission:    pulumi.String("ALLOW"),
			AllowDeletion: pulumi.Bool(true),
		}, pulumi.DependsOn([]pulumi.Resource{
			clusterAdmin,
			schemaRegistryAdmin,
		}))
		if err != nil {
			return err
		}
		_, err = redpanda.NewRoleAssignment(ctx, "developer_assignment", &redpanda.RoleAssignmentArgs{
			RoleName: developer.Name,
			Principal: testUser.Name.ApplyT(func(name string) (string, error) {
				return fmt.Sprintf("User:%v", name), nil
			}).(pulumi.StringOutput),
			ClusterApiUrl: testCluster.ClusterApiUrl,
		}, pulumi.DependsOn([]pulumi.Resource{
			testUser,
		}))
		if err != nil {
			return err
		}
		ctx.Export("userSchemaInfo", pulumi.Map{
			"id":      userSchema.SchemaId,
			"subject": userSchema.Subject,
			"version": userSchema.Version,
			"type":    userSchema.SchemaType,
		})
		ctx.Export("userEventSchemaInfo", pulumi.Map{
			"id":         userEventSchema.SchemaId,
			"subject":    userEventSchema.Subject,
			"version":    userEventSchema.Version,
			"type":       userEventSchema.SchemaType,
			"references": userEventSchema.References,
		})
		ctx.Export("productSchemaInfo", pulumi.Map{
			"id":            productSchema.SchemaId,
			"subject":       productSchema.Subject,
			"version":       productSchema.Version,
			"type":          productSchema.SchemaType,
			"compatibility": productSchema.Compatibility,
		})
		return nil
	})
}