Chapter 22. KafkaAuthorizationOpa schema reference

type

string

Must be opa.

url

string

The URL used to connect to the Open Policy Agent server. The URL has to include the policy which will be queried by the authorizer. This option is required.

allowOnError

boolean

Defines whether a Kafka client should be allowed or denied by default when the authorizer fails to query the Open Policy Agent, for example, when it is temporarily unavailable). Defaults to false - all actions will be denied.

initialCacheCapacity

integer

Initial capacity of the local cache used by the authorizer to avoid querying the Open Policy Agent for every request Defaults to 5000.

maximumCacheSize

integer

Maximum capacity of the local cache used by the authorizer to avoid querying the Open Policy Agent for every request. Defaults to 50000.

expireAfterMs

integer

The expiration of the records kept in the local cache to avoid querying the Open Policy Agent for every request. Defines how often the cached authorization decisions are reloaded from the Open Policy Agent server. In milliseconds. Defaults to 3600000.

tlsTrustedCertificates

CertSecretSource array

Trusted certificates for TLS connection to the OPA server.

superUsers

string array

List of super users, which is specifically a list of user principals that have unlimited access rights.

enableMetrics

boolean

Defines whether the Open Policy Agent authorizer plugin should provide metrics. Defaults to false.