Implementing Security
1. Understanding Kafka Security Model
| Pillar | Description | Mechanism |
|---|---|---|
| Encryption | In-transit confidentiality | SSL/TLS |
| Authentication | Verify identity | SSL/SASL |
| Authorization | Access control | ACLs |
2. Enabling SSL Encryption
| Config | Description | Detail |
|---|---|---|
| security.protocol | SSL | Encrypt only |
| listeners | SSL://:9093 | Secure port |
| Overhead | CPU for TLS | No zero-copy |
3. Configuring SSL Certificates
| Config | Description | Detail |
|---|---|---|
| ssl.keystore.location | Server identity | JKS/PKCS12 |
| ssl.truststore.location | Trusted CAs | Verify peers |
| CA-Signed | Prod best practice | Chain of trust |
Example: Certificate config
ssl.keystore.location=/etc/kafka/ssl/server.keystore.jks
ssl.truststore.location=/etc/kafka/ssl/server.truststore.jks4. Setting Keystore Password
| Config | Description | Detail |
|---|---|---|
| ssl.keystore.password | Keystore file password | Required |
| ssl.key.password | Private key password | If different |
| Secrets | Externalize via providers | Not plaintext |
Warning: Avoid plaintext passwords in config; use a ConfigProvider or environment-based secret injection.
Example: Externalized password
ssl.keystore.password=${file:/etc/kafka/secrets.properties:keystore.pwd}5. Configuring SSL Endpoint Identification
| Config | Description | Detail |
|---|---|---|
| ssl.endpoint. identification.algorithm |
Hostname verification | https |
| Default | https (enabled) | Secure |
| Empty | Disables check | Risky |
6. Enabling SASL Authentication
| Config | Description | Detail |
|---|---|---|
| security.protocol | SASL_SSL / SASL_PLAINTEXT | Auth |
| sasl.mechanism | PLAIN/SCRAM/GSSAPI | Method |
| JAAS | Credentials config | sasl.jaas.config |
7. Configuring SASL/PLAIN
| Aspect | Description | Detail |
|---|---|---|
| PLAIN | Username/password | Simple |
| TLS Required | Must use SASL_SSL | No plaintext creds |
| Static | Users in JAAS | No rotation |
Example: SASL/PLAIN JAAS
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule \
required username="app" password="secret";8. Using SASL/SCRAM
| Aspect | Description | Detail |
|---|---|---|
| SCRAM | Salted challenge-response | SHA-256/512 |
| Storage | Credentials in metadata | kafka-configs |
| Rotation | Add/update users live | Dynamic |
Example: Create SCRAM user
kafka-configs.sh --bootstrap-server localhost:9092 --alter \
--add-config 'SCRAM-SHA-256=[password=secret]' \
--entity-type users --entity-name app9. Configuring SASL/GSSAPI
| Aspect | Description | Detail |
|---|---|---|
| GSSAPI | Kerberos auth | Enterprise |
| Keytab | Service principal creds | useKeyTab |
| service.name | Kerberos service | kafka |
Example: GSSAPI JAAS
sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required \
useKeyTab=true keyTab="/etc/security/kafka.keytab" \
principal="kafka/host@REALM";10. Setting Up SASL/OAUTHBEARER
| Aspect | Description | Detail |
|---|---|---|
| OAUTHBEARER | OAuth 2.0 tokens | OIDC |
| Token Endpoint | IdP issues JWT | sasl.oauthbearer |
| Refresh | Auto token renewal | Callback |
Example: OAuth config
sasl.mechanism=OAUTHBEARER
sasl.oauthbearer.token.endpoint.url=https://idp/token
sasl.login.callback.handler.class=org.apache.kafka.common.security.oauthbearer.secured.OAuthBearerLoginCallbackHandler11. Enabling Inter-Broker Security
| Config | Description | Detail |
|---|---|---|
| security.inter. broker.protocol |
Broker-to-broker | SSL/SASL_SSL |
| inter.broker. listener.name |
Dedicated listener | Alternative |
| Controller | Secure controller listener | KRaft |