A Tale of a Meshi Kafka: Securing Kafka Deployment When Istio Is Used
Talkat Cloud Native Security Day North America 2020 · on Tuesday, 2020-11-17· at 13:40· Virtual , VIrtual·
summary
Explains that running Kafka on Kubernetes with Istio needs two fixes to be practical: sidecar as first-class so Envoy is ready before brokers and Zookeeper, and an Envoy Kafka filter or WASM module to parse messages for auth. Describes a working interim setup using Strimzi operator, an OPA plugin for Kafka authorizer, and Portshift for policy UI, demoing ArgoCD + Lenses on OpenShift where topic read/write is blocked globally then an IP is allowed, with decisions cached to avoid performance regressions.
AI-written summary · about
chapters (21)
- 0:00Start
- 2:19Who Are We? (Nikolas)
- 3:17Microservices introduce communication complexity
- 4:14Microservices Asynchronous Message Passing
- 4:36Apache Kafka
- 6:18Kafka Security challenges
- 7:37Strimzi Kafka Security Building Blocks
- 9:14Security in Kubernetes
- 9:56Security Aspects: Kubernetes, Kafka, Istio
- 10:49Istio + Kafka NOT A "Match-Made in Heaven"
- 14:39Envoy: The Key For "Kafka-Friendly" istio
- 18:03Microservices Authentication
- 18:58Encryption
- 20:18OPA for Kafka Microservices Authorization
- 23:44The Legacy System
- 24:49Moving To Cloud-Native Microservices
- 25:38The architecture
- 26:49The problem with traditional firewalls
- 28:01Portshift Solution
- 28:31DEMO
- 36:57Summary
related talks
47mPainless Multi-Tenant Kafka on Kubernetes with Istio at
32mIstio: Sailing to a Secure Services Mesh
02h 48mKafka: Map of Pitfalls for Developers and Ops
26mService Mesh Journey - Building Security and Reliability One Si...
55mEmpower Your Microservices with Istio Service Mesh
31mEvent driven communication with Kafka on Kubernetes
40mIstio, your K8S cluster best friend
32mRunning Databases in Istio's Service Mesh