Configuring TLS encryption for Kafka listeners
Encrypting client and inter-broker traffic: keystores and truststores, listener and security protocol maps, hostname verification, enabled TLS protocols and certificate rotation without downtime.
Apache Kafka security
Specific Kafka security controls below the hardening overview: TLS and mTLS, SCRAM and Kerberos, ACL design, delegation tokens, Connect and JMX, encryption at rest, patching and testing.
Mutual TLS client authentication in Apache Kafka
Authenticating clients with certificates: ssl.client.auth required, mapping certificate subjects to principals for ACLs, issuing and revoking client certificates and why requested mode gives false comfort.
SASL/SCRAM authentication in KRaft-mode Kafka
Username and password authentication done safely: SCRAM-SHA-256 or 512 credentials in the metadata log, creating them at format time or with kafka-configs, TLS as a requirement and rotating credentials.
Kafka Kerberos authentication with SASL/GSSAPI
Using Kerberos for Kafka in Active Directory or FreeIPA environments: service principals and keytabs for brokers, client JAAS configuration, principal mapping rules and common ticket problems.
Designing Kafka ACLs for least privilege
Building an ACL model that scales: deny-by-default with the StandardAuthorizer, prefixed ACLs per team or application, producer and consumer convenience options, super users, and reviewing ACLs regularly.
Kafka delegation tokens for distributed processing frameworks
Letting Spark and other frameworks authenticate workers without distributing keytabs or passwords: obtaining, renewing and expiring delegation tokens and the ACL principal they carry.
Securing the Kafka Connect REST API and connector overrides
Closing the code-execution risk in Connect: restricting access to the REST API, the Allowlist client config override policy, trusted plugins only, worker principals and their ACLs.
Enabling TLS and SASL on a running Kafka cluster
Turning on security without an outage: adding secured listeners with rolling restarts, moving clients over, enabling inter-broker security, then closing plaintext listeners.
Encryption at rest for Apache Kafka data
Protecting Kafka data on disk when Kafka itself does not encrypt it: disk or volume encryption, encrypting tiered storage buckets, sensitive metadata stored unencrypted in KRaft, and application-level payload encryption.
Securing Kafka JMX and monitoring endpoints
Exposing metrics without exposing control: keeping remote JMX off, using an exporter on a restricted port, JMX authentication and TLS when needed, and network rules for monitoring traffic.
Tracking Apache Kafka CVEs and security releases
Staying patched on Kafka: the project CVE list, recent client and broker issues such as the OAUTHBEARER validation flaw, which releases receive fixes, and patching clients as well as brokers.
Penetration testing an Apache Kafka deployment
Scoping a security test of Kafka: listener exposure and plaintext ports, authentication bypass, ACL gaps, the Connect REST API, JMX, Schema Registry and UIs, run safely against production-like clusters.
