StyraInc / opa-kafka-plugin

Open Policy Agent (OPA) plug-in for Kafka authorization
Apache License 2.0
61 stars 20 forks source link

use learnings from kafka plugin for pulsar plugin #45

Open hpvd opened 1 year ago

hpvd commented 1 year ago

sorry this is probably not the perfect place for this question...

are there any plans to use the learnings from building this plugin for topic level authorization for kafka for a plugin for the georeplicated message and streaming platform apache pulsar ? see https://pulsar.apache.org/

Pulsars adaption is growing strong and since v2.7 it also supports topic level policies https://pulsar.apache.org/docs/2.11.x/admin-api-topics/

for authorization https://pulsar.apache.org/docs/2.11.x/security-extending/

anderseknert commented 1 year ago

Hi @hpvd 👋 This is as good place as any, I suppose 🙂 I had a look at that some month back, but I left it half-done as I didn't have the time to finish it. I could pick it up if it's of interest, but I have no experience using Pulsar, so needless to say it would be unsupported 😅 It would probably make sense to reuse e.g. config to as large extent as possible from this plugin, in order to ease transition between the two systems.

hpvd commented 1 year ago

thanks for your kind words... imho pulsar is worth it to be a first class citizen like kafka 🙂 There is also a chance to push the adaption of OPA and of pulsar further, thanks to the new arising opportunities/and also visibility from this "team"...

anderseknert commented 1 year ago

Yeah, just to be clear, this plugin is also not supported by Styra, at least not at this point in time. A huge difference is however that we have @scholzj present here as maintainer, and he definitely does use Kafka — the OPA plug-in is provided as part of his Strimzi project, which if I understand thinigs correctly is included even in a few commercial RedHat offerings. We don't have that luxury with regards to Pulsar, I'm afraid.

I'm quite busy for the next two weeks, but I'll try and wrap up my Pulsar plug-in after that. Would be nice to have at least something to start from.

hpvd commented 1 year ago

yes I understand that would be another "quality" at the beginning. But I'm pretty sure, having a first version, is the thing needed to get the ball rolling... If one can spread a word about it, maybe on your website and also directly in pulsars doc (in other fields there are already many third party connections listed) there will be some people giving it a try and it will start getting better and better... We are very interested in this topic for a project starting in summer - this was why I was looking if there is already a starting point to go this route...

hpvd commented 1 year ago

...and imho there could be no better start than being able to build on learnings from a plugin for another somehow similar messaging system 🙂

anderseknert commented 1 year ago

For sure. I can't promise anything, but we should be able to have an integration for testing before the summer.