Chapter 22. KafkaAuthorizationOpa schema reference
Used in: KafkaClusterSpec
Full list of KafkaAuthorizationOpa
schema properties
To use Open Policy Agent authorization, set the type
property in the authorization
section to the value opa
, and configure OPA properties as required. Streams for Apache Kafka uses Open Policy Agent plugin for Kafka authorization as the authorizer. For more information about the format of the input data and policy examples, see Open Policy Agent plugin for Kafka authorization.
22.1. url
The URL used to connect to the Open Policy Agent server. The URL has to include the policy which will be queried by the authorizer. Required.
22.2. allowOnError
Defines whether a Kafka client should be allowed or denied by default when the authorizer fails to query the Open Policy Agent, for example, when it is temporarily unavailable. Defaults to false
- all actions will be denied.
22.3. initialCacheCapacity
Initial capacity of the local cache used by the authorizer to avoid querying the Open Policy Agent for every request. Defaults to 5000
.
22.4. maximumCacheSize
Maximum capacity of the local cache used by the authorizer to avoid querying the Open Policy Agent for every request. Defaults to 50000
.
22.5. expireAfterMs
The expiration of the records kept in the local cache to avoid querying the Open Policy Agent for every request. Defines how often the cached authorization decisions are reloaded from the Open Policy Agent server. In milliseconds. Defaults to 3600000
milliseconds (1 hour).
22.6. tlsTrustedCertificates
Trusted certificates for TLS connection to the OPA server.
22.7. superUsers
A list of user principals treated as super users, so that they are always allowed without querying the open Policy Agent policy.
An example of Open Policy Agent authorizer configuration
apiVersion: kafka.strimzi.io/v1beta2 kind: Kafka metadata: name: my-cluster namespace: myproject spec: kafka: # ... authorization: type: opa url: http://opa:8181/v1/data/kafka/allow allowOnError: false initialCacheCapacity: 1000 maximumCacheSize: 10000 expireAfterMs: 60000 superUsers: - CN=fred - sam - CN=edward # ...
22.8. KafkaAuthorizationOpa
schema properties
The type
property is a discriminator that distinguishes use of the KafkaAuthorizationOpa
type from KafkaAuthorizationSimple
, KafkaAuthorizationKeycloak
, KafkaAuthorizationCustom
. It must have the value opa
for the type KafkaAuthorizationOpa
.
Property | Property type | Description |
---|---|---|
type | string |
Must be |
url | string | The URL used to connect to the Open Policy Agent server. The URL has to include the policy which will be queried by the authorizer. This option is required. |
allowOnError | boolean |
Defines whether a Kafka client should be allowed or denied by default when the authorizer fails to query the Open Policy Agent, for example, when it is temporarily unavailable). Defaults to |
initialCacheCapacity | integer |
Initial capacity of the local cache used by the authorizer to avoid querying the Open Policy Agent for every request Defaults to |
maximumCacheSize | integer |
Maximum capacity of the local cache used by the authorizer to avoid querying the Open Policy Agent for every request. Defaults to |
expireAfterMs | integer |
The expiration of the records kept in the local cache to avoid querying the Open Policy Agent for every request. Defines how often the cached authorization decisions are reloaded from the Open Policy Agent server. In milliseconds. Defaults to |
tlsTrustedCertificates |
| Trusted certificates for TLS connection to the OPA server. |
superUsers | string array | List of super users, which is specifically a list of user principals that have unlimited access rights. |
enableMetrics | boolean |
Defines whether the Open Policy Agent authorizer plugin should provide metrics. Defaults to |