Ce contenu n'est pas disponible dans la langue sélectionnée.
Chapter 22. KafkaAuthorizationOpa schema reference
Used in: KafkaClusterSpec
Full list of KafkaAuthorizationOpa schema properties
To use Open Policy Agent authorization, set the type property in the authorization section to the value opa, and configure OPA properties as required. Streams for Apache Kafka uses Open Policy Agent plugin for Kafka authorization as the authorizer. For more information about the format of the input data and policy examples, see Open Policy Agent plugin for Kafka authorization.
22.1. url
The URL used to connect to the Open Policy Agent server. The URL has to include the policy which will be queried by the authorizer. Required.
22.2. allowOnError
Defines whether a Kafka client should be allowed or denied by default when the authorizer fails to query the Open Policy Agent, for example, when it is temporarily unavailable. Defaults to false - all actions will be denied.
22.3. initialCacheCapacity
Initial capacity of the local cache used by the authorizer to avoid querying the Open Policy Agent for every request. Defaults to 5000.
22.4. maximumCacheSize
Maximum capacity of the local cache used by the authorizer to avoid querying the Open Policy Agent for every request. Defaults to 50000.
22.5. expireAfterMs
The expiration of the records kept in the local cache to avoid querying the Open Policy Agent for every request. Defines how often the cached authorization decisions are reloaded from the Open Policy Agent server. In milliseconds. Defaults to 3600000 milliseconds (1 hour).
22.6. tlsTrustedCertificates
Trusted certificates for TLS connection to the OPA server.
22.7. superUsers
A list of user principals treated as super users, so that they are always allowed without querying the open Policy Agent policy.
An example of Open Policy Agent authorizer configuration
apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
name: my-cluster
namespace: myproject
spec:
kafka:
# ...
authorization:
type: opa
url: http://opa:8181/v1/data/kafka/allow
allowOnError: false
initialCacheCapacity: 1000
maximumCacheSize: 10000
expireAfterMs: 60000
superUsers:
- CN=fred
- sam
- CN=edward
# ...
22.8. KafkaAuthorizationOpa schema properties
The type property is a discriminator that distinguishes use of the KafkaAuthorizationOpa type from KafkaAuthorizationSimple, KafkaAuthorizationKeycloak, KafkaAuthorizationCustom. It must have the value opa for the type KafkaAuthorizationOpa.
| Property | Property type | Description |
|---|---|---|
| type | string |
Must be |
| url | string | The URL used to connect to the Open Policy Agent server. The URL has to include the policy which will be queried by the authorizer. This option is required. |
| allowOnError | boolean |
Defines whether a Kafka client should be allowed or denied by default when the authorizer fails to query the Open Policy Agent, for example, when it is temporarily unavailable). Defaults to |
| initialCacheCapacity | integer |
Initial capacity of the local cache used by the authorizer to avoid querying the Open Policy Agent for every request Defaults to |
| maximumCacheSize | integer |
Maximum capacity of the local cache used by the authorizer to avoid querying the Open Policy Agent for every request. Defaults to |
| expireAfterMs | integer |
The expiration of the records kept in the local cache to avoid querying the Open Policy Agent for every request. Defines how often the cached authorization decisions are reloaded from the Open Policy Agent server. In milliseconds. Defaults to |
| tlsTrustedCertificates |
| Trusted certificates for TLS connection to the OPA server. |
| superUsers | string array | List of super users, which is specifically a list of user principals that have unlimited access rights. |
| enableMetrics | boolean |
Defines whether the Open Policy Agent authorizer plugin should provide metrics. Defaults to |
