feat(nifi): Add NiFi OPA Authorizer

CHANGELOG.md

@@ -33,6 +33,7 @@ All notable changes to this project will be documented in this file.
   `check-permissions-ownership.sh` provided in stackable-base image ([#1025]).
 - zookeeper: check for correct permissions and ownerships in /stackable folder via
   `check-permissions-ownership.sh` provided in stackable-base image ([#1043]).
+- nifi: Add OPA authorizer plugin with workaround ([#1058]).
 - nifi: Add [nifi-iceberg-bundle](https://github.com/stackabletech/nifi-iceberg-bundle) for NiFi `2.2.0` ([#1060], [#1106]).
 - java: Add JDK 24 ([#1097]).
 - ci: Add golang image to mirror workflow ([#1103]).
@@ -93,6 +94,7 @@ All notable changes to this project will be documented in this file.
 [#1054]: https://github.com/stackabletech/docker-images/pull/1054
 [#1055]: https://github.com/stackabletech/docker-images/pull/1055
 [#1056]: https://github.com/stackabletech/docker-images/pull/1056
+[#1058]: https://github.com/stackabletech/docker-images/pull/1058
 [#1060]: https://github.com/stackabletech/docker-images/pull/1060
 [#1090]: https://github.com/stackabletech/docker-images/pull/1090
 [#1091]: https://github.com/stackabletech/docker-images/pull/1091

nifi/Dockerfile

@@ -77,7 +77,7 @@ mkdir -p /stackable
 
 # NiFI 1.x natively supports Iceberg, no need to build an iceberg-bundle for it
 if [[ "${PRODUCT}" != 1.* ]] ; then
-    curl "https://github.com/stackabletech/nifi-iceberg-bundle/archive/refs/tags/${NIFI_ICEBERG_BUNDLE}.tar.gz" | tar -xzC .
+    curl -L "https://github.com/stackabletech/nifi-iceberg-bundle/archive/refs/tags/${NIFI_ICEBERG_BUNDLE}.tar.gz" | tar -xzC .
     cd nifi-iceberg-bundle-${NIFI_ICEBERG_BUNDLE} || exit
 
     mvn \
@@ -104,6 +104,36 @@ chmod g=u /stackable/*.sbom.json
 fi
 EOF
 
+FROM stackable/image/java-devel AS opa-authorizer-builder
+
+ARG NIFI_OPA_AUTHORIZER_PLUGIN
+ARG STACKABLE_USER_UID
+ARG PRODUCT
+
+USER ${STACKABLE_USER_UID}
+WORKDIR /build
+
+RUN <<EOF
+mkdir -p /stackable
+
+curl -L "https://github.com/DavidGitter/nifi-opa-plugin/archive/refs/tags/v${NIFI_OPA_AUTHORIZER_PLUGIN}.tar.gz" | tar -xzC .
+cd nifi-opa-plugin-${NIFI_OPA_AUTHORIZER_PLUGIN}/authorizer
+
+mvn \
+    --batch-mode \
+    --no-transfer-progress \
+    clean package \
+    -DskipTests \
+    -Pnifi-${PRODUCT}
+
+cd ..
+cp ./authorizer/target/opa-authorizer.nar /stackable/opa-authorizer.nar
+cp ./LICENSE /stackable/LICENSE
+
+# Set correct permissions
+chmod g=u /stackable/opa-authorizer.nar
+EOF
+
 FROM stackable/image/java-base AS final
 
 ARG PRODUCT
@@ -123,6 +153,8 @@ COPY --chown=${STACKABLE_USER_UID}:0 --from=nifi-builder /stackable/stackable-bc
 COPY --chown=${STACKABLE_USER_UID}:0 --from=nifi-iceberg-bundle-builder /stackable/*.nar /stackable/nifi-${PRODUCT}/lib/
 COPY --chown=${STACKABLE_USER_UID}:0 --from=nifi-iceberg-bundle-builder /stackable/*.sbom.json /stackable/nifi-${PRODUCT}/lib/
 
+COPY --chown=${STACKABLE_USER_UID}:0 --from=opa-authorizer-builder /stackable/opa-authorizer.nar /stackable/nifi-${PRODUCT}/extensions/opa-authorizer.nar
+COPY --chown=${STACKABLE_USER_UID}:0 --from=opa-authorizer-builder /stackable//LICENSE /licenses/NIFI_OPA_PLUGIN_LICENSE
 COPY --chown=${STACKABLE_USER_UID}:0 nifi/stackable/bin /stackable/bin
 COPY --chown=${STACKABLE_USER_UID}:0 nifi/licenses /licenses
 COPY --chown=${STACKABLE_USER_UID}:0 nifi/python /stackable/python

nifi/versions.py

@@ -3,16 +3,19 @@
         "product": "1.27.0",
         "java-base": "11",
         "java-devel": "11",  # There is an error when trying to use the jdk 21 (since nifi 1.26.0)
+        "nifi_opa_authorizer_plugin": "0.1.0",
     },
     {
         "product": "1.28.1",
         "java-base": "11",
         "java-devel": "11",
+        "nifi_opa_authorizer_plugin": "0.1.0",
     },
     {
         "product": "2.2.0",
         "java-base": "21",
         "java-devel": "21",
         "nifi_iceberg_bundle": "0.0.3",
+        "nifi_opa_authorizer_plugin": "0.1.0",
     },
 ]