During our testing we found an issue with Kafka 4.1.0 and integration with OPA plugin for authz. We are getting these errors:
2025-11-19 10:48:42 ERROR [data-plane-kafka-request-handler-1] KafkaApis:79 - [KafkaApi-1] Unexpected error handling request RequestHeader(apiKey=METADATA, apiVersion=13, clientId=my-consumer, correlationId=2, headerVersion=2) -- MetadataRequestData(topics=[MetadataRequestTopic(topicId=AAAAAAAAAAAAAAAAAAAAAA, name='my-topic-109087719-1023545295')], allowAutoTopicCreation=true, includeClusterAuthorizedOperations=false, includeTopicAuthorizedOperations=false) with context RequestContext(header=RequestHeader(apiKey=METADATA, apiVersion=13, clientId=my-consumer, correlationId=2, headerVersion=2), connectionId='10.130.2.176:9093-10.128.3.11:43132-3-0', clientAddress=/10.128.3.11, principal=User:CN=good-user, listenerName=ListenerName(TLS-9093), securityProtocol=SSL, clientInformation=ClientInformation(softwareName=apache-kafka-java, softwareVersion=4.1.0.redhat-00002), fromPrivilegedListener=false, principalSerde=Optional[org.apache.kafka.common.security.authenticator.DefaultKafkaPrincipalBuilder@250e7721]) com.google.common.util.concurrent.ExecutionError: java.lang.NoClassDefFoundError: com/thoughtworks/paranamer/Paranamer at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2085) ~[guava-32.1.3.jre-redhat-00001.jar:?] at com.google.common.cache.LocalCache.get(LocalCache.java:4019) ~[guava-32.1.3.jre-redhat-00001.jar:?] at com.google.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4933) ~[guava-32.1.3.jre-redhat-00001.jar:?] at org.openpolicyagent.kafka.OpaAuthorizer.allowAccess$1(OpaAuthorizer.scala:190) ~[opa-authorizer-1.5.1.redhat-00017.jar:1.5.1.redhat-00017] at org.openpolicyagent.kafka.OpaAuthorizer.doAuthorize(OpaAuthorizer.scala:201) ~[opa-authorizer-1.5.1.redhat-00017.jar:1.5.1.redhat-00017] at org.openpolicyagent.kafka.OpaAuthorizer.authorizeAction(OpaAuthorizer.scala:157) ~[opa-authorizer-1.5.1.redhat-00017.jar:1.5.1.redhat-00017] at org.openpolicyagent.kafka.OpaAuthorizer.$anonfun$authorize$1(OpaAuthorizer.scala:55) ~[opa-authorizer-1.5.1.redhat-00017.jar:1.5.1.redhat-00017] at scala.collection.StrictOptimizedIterableOps.map(StrictOptimizedIterableOps.scala:100) ~[scala-library-2.13.16.redhat-00001.jar:?] at scala.collection.StrictOptimizedIterableOps.map$(StrictOptimizedIterableOps.scala:87) ~[scala-library-2.13.16.redhat-00001.jar:?] at scala.collection.mutable.ArrayBuffer.map(ArrayBuffer.scala:42) ~[scala-library-2.13.16.redhat-00001.jar:?] at org.openpolicyagent.kafka.OpaAuthorizer.authorize(OpaAuthorizer.scala:55) ~[opa-authorizer-1.5.1.redhat-00017.jar:1.5.1.redhat-00017] at kafka.server.AuthHelper.filterByAuthorized(AuthHelper.scala:113) ~[kafka_2.13-4.1.0.redhat-00003.jar:4.1.0.redhat-00003] at kafka.server.KafkaApis.handleTopicMetadataRequest(KafkaApis.scala:906) [kafka_2.13-4.1.0.redhat-00003.jar:4.1.0.redhat-00003] at kafka.server.KafkaApis.handle(KafkaApis.scala:172) [kafka_2.13-4.1.0.redhat-00003.jar:4.1.0.redhat-00003] at kafka.server.KafkaRequestHandler.run(KafkaRequestHandler.scala:158) [kafka_2.13-4.1.0.redhat-00003.jar:4.1.0.redhat-00003] at java.base/java.lang.Thread.run(Thread.java:840) [?:?] Caused by: java.lang.NoClassDefFoundError: com/thoughtworks/paranamer/Paranamer at com.fasterxml.jackson.module.scala.introspect.BeanIntrospector$.getCtorParams(BeanIntrospector.scala:245) ~[jackson-module-scala_2.13-2.19.2.redhat-00003.jar:?] at com.fasterxml.jackson.module.scala.introspect.BeanIntrospector$.$anonfun$apply$2(BeanIntrospector.scala:53) ~ ...
For Kafka 4.0.0 it seems that everything works just fine, it's issue just with Kafka 4.1.0.
- mentioned in
-
Page Loading...