OPA 1.9.0 version is not working with kafka .

[L040639]

Hello ,

I am using opa image image: openpolicyagent/opa:0.70.0 which is working fine with kafka as a authz sever , but when i upgraded the image to 1.9.0 version , i am getting below error , is this something i have to change any config changes here , because the same setup is working with the opa version 0.7.0 .

2025-11-03 05:57:46,481 WARN Exception in decision retrieval: java.net.ConnectException (org.openpolicyagent.kafka.OpaAuthorizer) [data-plane-kafka-request-handler-3]
2025-11-03

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: opa
  namespace: kafka-opa-service
  labels:
    app: opa
spec:
  replicas: 1
  selector:
    matchLabels:
      app: opa
  template:
    metadata:
      labels:
        app: opa
      name: opa
    spec:
      containers:
        - name: opa
          image: openpolicyagent/opa:1.9.0
          ports:
            - name: http
              containerPort: 8181
          args:
            - "run"
            - "--ignore=.*"
            - "--log-level=debug"
            - "--server"
            - "--set=decision_logs.console=true"
            - "--tls-cert-file=/certs/tls.crt"
            - "--tls-private-key-file=/certs/tls.key"
            - "--set=services.operator.url=http://<XXXX>/opa"
            - "--set=bundles.operator.resource=/bundles/kafka/bundle.tar.gz"
            # Persist requires OPA to have a volume or something to write to
            # - "--set=bundles.operator.persist=true"
          volumeMounts:
            - readOnly: true
              mountPath: /certs
              name: opa-cert
      volumes:
        - name: opa-cert
          secret:
            secretName: opa-cert-secret

apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  name: kafka-streams-poc-cluster
  namespace: kafka-streams-poc
  annotations:
    strimzi.io/node-pools: enabled
    strimzi.io/kraft: enabled
spec:
  kafka:
    authorization:
      type: opa
      url: https://opa.kafka-opa-service:8181/v1/data/kafka/allow
      allowOnError: false
      enableMetrics: true
      tlsTrustedCertificates:
        - secretName: lk-ca-root-bundle
          certificate: ca.crt  
    config:
      offsets.topic.replication.factor: 3
      transaction.state.log.replication.factor: 3
      transaction.state.log.min.isr: 2
      default.replication.factor: 3
      min.insync.replicas: 2
      # inter.broker.protocol.version: '3.9'
      connections.max.idle.ms: 1800000
      socket.connection.setup.timeout.ms: 30000
      socket.connection.setup.timeout.max.ms: 60000
      group.consumer.session.timeout.ms: 60000
      request.timeout.ms: 60000
      connection.failed.authentication.delay.ms: 1000
      # Thread pool tuning             
      queued.max.requests: 1000
      # Network buffer tuning
      replica.socket.receive.buffer.bytes: 1048576
      socket.send.buffer.bytes: 1048576
      socket.receive.buffer.bytes: 1048576
    logging:
      type: inline
      loggers:
        rootLogger.level: INFO
        logger.kafka.level: DEBUG
        logger.logcleaner.level: DEBUG
        logger.authorizer.level: TRACE
    # storage:
    #   type: persistent-claim
    #   size: 100Gi
    #   class: gp3
    listeners:
      - authentication:
          checkAccessTokenType: false
          clientId: <XXXX>
          clientSecret:
            key: secret
            secretName: entra-id-client
          jwksEndpointUri: 'https://login.microsoftonline.com/<XXX>/v2.0/keys'
          maxSecondsWithoutReauthentication: 3600
          enableMetrics: true
          type: oauth
          validIssuerUri: 'https://login.microsoftonline.com/<XXX>/v2.0'
          userNameClaim: azp
        configuration:
          brokerCertChainAndKey:
            certificate: tls.crt
            key: tls.key
            secretName: kafka-streams-poc-cert-secret
        name: oauth
        port: 9093
        tls: true
        type: internal
      - authentication:
          checkAccessTokenType: false
          clientId: <XXXXX>
          clientSecret:
            key: secret
            secretName: entra-id-client
          jwksEndpointUri: 'https://login.microsoftonline.com/<XXXX>/discovery/v2.0/keys'
          maxSecondsWithoutReauthentication: 3600
          enableMetrics: true
          type: oauth
          validIssuerUri: 'https://login.microsoftonline.com/<XXXX>/v2.0'
          userNameClaim: azp
        configuration:
          brokerCertChainAndKey:
            certificate: tls.crt
            key: tls.key
            secretName: kafka-streams-poc-cert-secret
          bootstrap:
            alternativeNames:
            - <XXXX>
            annotations:
              external-dns.alpha.kubernetes.io/hostname: <XXXX>.
              external-dns.alpha.kubernetes.io/access: "private"
          brokers:
          - broker: 0
            advertisedHost: <XXXX>
            annotations:
              external-dns.alpha.kubernetes.io/hostname: <XXXX>.
              external-dns.alpha.kubernetes.io/access: "private"
          - broker: 1
            advertisedHost: <XXXX>
            annotations:
              external-dns.alpha.kubernetes.io/hostname: <XXX>
              external-dns.alpha.kubernetes.io/access: "private"
          - broker: 2
            advertisedHost: <XXX>
            annotations:
              external-dns.alpha.kubernetes.io/hostname: <XXX>.
              external-dns.alpha.kubernetes.io/access: "private"
        name: external
        port: 9094
        tls: true
        type: loadbalancer
    version: 3.9.0
    # replicas: 3
    metricsConfig:
      type: jmxPrometheusExporter
      valueFrom:
        configMapKeyRef:
          key: kafka-metrics-config.yml
          name: kafka-streams-poc-metrics
    template:
      externalBootstrapService:
        metadata:
          annotations:
            service.beta.kubernetes.io/aws-load-balancer-type: nlb
            service.beta.kubernetes.io/aws-load-balancer-scheme: internal
            service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: instance
            service.beta.kubernetes.io/aws-load-balancer-internal: "true"
            service.beta.kubernetes.io/aws-load-balancer-connection-draining-enabled: "true"
            service.beta.kubernetes.io/aws-load-balancer-listener-attributes.TCP-9094: tcp.idle_timeout.seconds=4000
            service.beta.kubernetes.io/aws-load-balancer-target-node-labels: node-role.kubernetes.io/kafka=yes
      perPodService:
        metadata:
          annotations:
            service.beta.kubernetes.io/aws-load-balancer-type: nlb
            service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: instance
            service.beta.kubernetes.io/aws-load-balancer-scheme: internal
            service.beta.kubernetes.io/aws-load-balancer-internal: "true"
            service.beta.kubernetes.io/aws-load-balancer-connection-draining-enabled: "true"
            service.beta.kubernetes.io/aws-load-balancer-listener-attributes.TCP-9094: tcp.idle_timeout.seconds=4000
            service.beta.kubernetes.io/aws-load-balancer-target-node-labels: node-role.kubernetes.io/kafka=yes
      pod:
        metadata: #labels added
          labels:
            app: kafka-streams-poc-cluster
        affinity:
          nodeAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
                - matchExpressions:
                    - key: node-role.kubernetes.io/worker   ##dedicated nodegroup for kafka
                      operator: Exists
          podAntiAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              - labelSelector:
                  matchExpressions:
                    - key: strimzi.io/cluster
                      operator: In
                      values:
                        - kafka-streams-poc-cluster
                    - key: strimzi.io/component-type
                      operator: In
                      values:
                        - kafka
                topologyKey: kubernetes.io/hostname
        tolerations:
          - key: "node-role.kubernetes.io/kafka"
            operator: "Exists"
            effect: "NoSchedule"
        topologySpreadConstraints:
          - maxSkew: 1
            topologyKey: topology.kubernetes.io/zone
            whenUnsatisfiable: ScheduleAnyway
            labelSelector:
              matchLabels:
                strimzi.io/cluster: kafka-streams-poc-cluster
                strimzi.io/component-type: kafka
  entityOperator:
    topicOperator: {}
    userOperator: {}
    template:
      pod:
        affinity:
          nodeAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
                - matchExpressions:
                    - key: node-role.kubernetes.io/worker
                      operator: Exists
        tolerations:
          - key: "node-role.kubernetes.io/kafka"
            operator: "Exists"
            effect: "NoSchedule"
  kafkaExporter:
    topicRegex: ".*"
    groupRegex: ".*"
    template:
      pod:
        affinity:
          nodeAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
                - matchExpressions:
                    - key: node-role.kubernetes.io/worker
                      operator: Exists
        tolerations:
          - key: "node-role.kubernetes.io/kafka"
            operator: "Exists"
            effect: "NoSchedule"

[johanfylling]

Since v1.0.0, OPA listens on localhost by default. You can use the --addr flag to set the listening address. E.g. opa run -s --addr=:8080 to listen on port 8080 on all interfaces.

[L040639]

yeah this worked , added --addr=0.0.0.0:8181 to my opa server . Now it's working fine. .

[johanfylling]

Great to hear! 🙂