variable "ibmcloud_api_key" {}
variable "es_reader_api_key" {}

provider "ibm" {
  ibmcloud_api_key = var.ibmcloud_api_key
  generation       = 1
}

data "ibm_resource_group" "group" {
  name = "Default"
}

resource "ibm_resource_instance" "es_instance" {
  name              = "terraform-integration"
  service           = "messagehub"
  plan              = "standard"
  location          = "us-south"
  resource_group_id = data.ibm_resource_group.group.id
}

resource "ibm_event_streams_topic" "es_topic" {
  resource_instance_id = ibm_resource_instance.es_instance.id
  name                 = "my-es-topic"
  partitions           = 1
  config = {
    "cleanup.policy"  = "compact,delete"
    "retention.ms"    = "86400000"
    "retention.bytes" = "1073741824"
    "segment.bytes"   = "536870912"
  }
}

// assume customer wants to deploy a kafka consumer application connecting to an Event Streams instance
resource "kafka_consumer_app" "my_kafka_app" {
  bootstrap_server = lookup(ibm_resource_instance.es_instance.extensions, "kafka_brokers_sasl", "")
  topic            = ibm_event_streams_topic.es_topic.name
  apikey           = var.es_reader_api_key // not ibmcloud_api_key(platform apikey), but a service-id-api-key with reduced privileges,eg.Reader role.
}