Kafka Security - A brief overview of its history ... #bbuzz
summary
Kafka adds real security milestones: SSL and Kerberos in 0.9 provide authentication and encryption, PLAIN then SCRAM avoid cleartext, and delegation tokens in 1.1 let long distributed jobs carry short‑lived Kafka‑only credentials (default one day, renewable up to seven). ACLs are stored in ZooKeeper (command tools require ZK access; ZK nodes can be world readable), and the system supports pluggable authorizers — example: custom authorizer using AD groups that maps principals to group memberships for topic/group ACL checks.
AI-written summary · about
chapters (8)
- 0:00Introduction and speaker intro
- 3:09Evolution of Kafka security
- 13:17Authentication methods overview
- 21:47Configuring authentication ports
- 23:11Authorization with ACLs
- 29:06Zookeeper security and ACL management
- 34:55Custom authorizers and group-based access
- 39:28Q&A and security strategies
related talks
30mThe Secure Metamorphosis: Streaming Logs with Kafka and TLS
07mDescribing Kafka security in AsyncAPI
27mTGI Vault: Securing Kafka with Vault PKI
43mAttacking (and Defending) Apache Kafka
38mA Tale of a Meshi Kafka: Securing Kafka Deployment When Istio Is Used
45mKafka and KSQL to help with detect...
47mPainless Multi-Tenant Kafka on Kubernetes with Istio at
30mFlink Security Enhancements