Support for Open Policy Agent (OPA) integration into IBM Event Streams for access control and policy enforcement in Kafka Clusters

Integrating OPA with IBM Event Streams will allow us to define, enforce, and manage access policies in a centralized manner, enhancing the security and compliance of our Kafka setup. This support will benefit teams managing sensitive data and needing fine-grained access controls across our Kafka clusters. It will also help the operators managing the cluster in an efficient manner and scale the solution. Integrating OPA would allow us to offer IBM Event Streams as multi-tenant solution for different projects with streaming needs within our organization. Strimzi already supports OPA integration, as detailed in https://www.openpolicyagent.org/integrations/strimzi/, making it a valuable for IBM Event Streams too.

Our setup includes access control needs within a Kafka environment. We are planning to implement OPA to define policies for Kafka topic access, consumer group management, and producer authorization. We require support in configuring and optimizing the integration with IBM Event Streams to meet our organization’s compliance and security standards.

Apart from this when using a custom authorizer (such as OPA), the Event Streams Operator should stop to continually add ACLs back to the KafkaUser custom resources (CRD) during reconciliation. This behavior currently makes it impossible to use OPA other custom authorizers.