fix(kafka): Update the OPA plugin for Kafka 4

CHANGELOG.md

@@ -34,6 +34,7 @@ All notable changes to this project will be documented in this file.
 - patchable: Use long hashes, and myers diff algorithm for portability ([#1705]).
 - spark: Add 4.1.3 and 4.2.0 ([#1710]).
 - spark: Add HBase connector images for Spark 4.x. There is no connector release that supports Spark 4.x yet, so this is built from an upstream commit (`07f5791`) on the master branch ([#1723])
+- kafka: Add new image for `kafka/kafka-opa-plugin` that is compatible with Kafka 4.x. The image is built from a specific master commit because the project has not released an appropriate version ([#1730]).
 
 ### Changed
 
@@ -187,6 +188,7 @@ All notable changes to this project will be documented in this file.
 [#1721]: https://github.com/stackabletech/docker-images/pull/1721
 [#1723]: https://github.com/stackabletech/docker-images/pull/1723
 [#1725]: https://github.com/stackabletech/docker-images/pull/1725
+[#1730]: https://github.com/stackabletech/docker-images/pull/1730
 
 ## [26.7.0] - 2026-07-21
 

kafka/boil-config.toml

@@ -18,7 +18,7 @@ jmx-exporter-version = "1.3.0"
 java-base = "25"
 java-devel = "25"
 "kafka/kcat" = "1.7.0"
-"kafka/kafka-opa-plugin" = "1.5.1"
+"kafka/kafka-opa-plugin" = "977e4ad"
 # TODO: this is not used in this version but it's added
 # to avoid major changes to the Kafka image build on short notice.
 # Building this image is quick and in CI should not even be noticed.
@@ -33,7 +33,7 @@ jmx-exporter-version = "1.3.0"
 java-base = "25"
 java-devel = "25"
 "kafka/kcat" = "1.7.0"
-"kafka/kafka-opa-plugin" = "1.5.1"
+"kafka/kafka-opa-plugin" = "977e4ad"
 # TODO: this is not used in this version but it's added
 # to avoid major changes to the Kafka image build on short notice.
 # Building this image is quick and in CI should not even be noticed.

kafka/kafka-opa-plugin/boil-config.toml

@@ -1,2 +1,5 @@
 [versions."1.5.1".local-images]
 java-devel = "11"
+
+[versions."977e4ad".local-images]
+java-devel = "21"

kafka/kafka-opa-plugin/stackable/patches/977e4ad/0001-Align-jackson-module-scala-with-the-version-shipped-.patch

@@ -0,0 +1,23 @@
+From 55775a39f714464463785bf659abfc106bd8df28 Mon Sep 17 00:00:00 2001
+From: Razvan-Daniel Mihai <razvan.mihai@stackable.tech>
+Date: Thu, 29 Oct 2026 15:52:19 +0100
+Subject: Align jackson-module-scala with the version shipped by Kafka 4.2/4.3
+
+jackson-module-scala must match the jackson-databind version shipped by Kafka (2.21.2).
+---
+ build.gradle | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/build.gradle b/build.gradle
+index 9b910ad1429ba65ffc1228ba521dc705b337db7b..9fb85e87d75db462ca1ef52d5f8fcd10ea2261d5 100644
+--- a/build.gradle
++++ b/build.gradle
+@@ -25,7 +25,7 @@ repositories {
+ dependencies {
+     compileOnly group: 'org.apache.kafka', name: 'kafka_2.13', version: '4.0.0'
+     compileOnly group: 'com.typesafe.scala-logging', name: 'scala-logging_2.13', version: '3.9.5'
+-    implementation group: 'com.fasterxml.jackson.module', name: 'jackson-module-scala_2.13', version: '2.16.2'
++    implementation group: 'com.fasterxml.jackson.module', name: 'jackson-module-scala_2.13', version: '2.21.2'
+     implementation group: 'com.github.ben-manes.caffeine', name: 'caffeine', version: '3.2.0'
+
+     testImplementation group: 'org.scalatest', name: 'scalatest_2.13', version: '3.2.17'

kafka/kafka-opa-plugin/stackable/patches/977e4ad/0002-Set-version-to-the-patchable-version.patch

@@ -0,0 +1,32 @@
+From 04665506f39ad99ffbe76c61125761f2390c3d93 Mon Sep 17 00:00:00 2001
+From: Razvan-Daniel Mihai <razvan.mihai@stackable.tech>
+Date: Thu, 29 Oct 2026 15:52:19 +0100
+Subject: Set version to the patchable version
+
+The Stackable Dockerfiles expect the jar to be named opa-authorizer-<patchable version>-all.jar.
+---
+ build.gradle | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/build.gradle b/build.gradle
+index 9fb85e87d75db462ca1ef52d5f8fcd10ea2261d5..416e4622db67226b2ef33a87423271c6906651a9 100644
+--- a/build.gradle
++++ b/build.gradle
+@@ -8,7 +8,7 @@ plugins {
+ }
+
+ group 'org.openpolicyagent.kafka'
+-version '1.5.1'
++version '977e4ad'
+
+ java {
+     sourceCompatibility = JavaVersion.VERSION_17
+@@ -65,7 +65,7 @@ publishing {
+         mavenJava(MavenPublication) {
+             groupId ='org.openpolicyagent.kafka'
+             artifactId = 'opa-authorizer'
+-            version = '1.5.1'
++            version = '977e4ad'
+
+             from components.java
+

kafka/kafka-opa-plugin/stackable/patches/977e4ad/patchable.toml

@@ -0,0 +1,2 @@
+mirror = "https://github.com/stackabletech/opa-kafka-plugin"
+base = "977e4addd58a3597de4ca55aaa6a1e9e9e3075f6"