Painless Multi-Tenant Kafka on Kubernetes with Istio at
summary
ASML runs a vanilla Kafka cluster on Kubernetes using K operator and Istio with SPIFFE workload identities so clients get zero‑config authentication. A small Envoy (Istio) plugin intercepts the first Kafka request, injects a SPIFFE ID as username and a dummy password, and a tiny broker plugin validates it; a 2,500‑line Go operator reconciles topic CRDs, topic access CRDs and tenant quotas into Kafka ACLs and quota callbacks. The system enforces tenant isolation, supports self‑service topic creation, and proves operational in production. custom CRDs tenant‑level quotas
AI-written summary · about
chapters (11)
- 0:00ASML and team intro
- 1:05ASML’s semiconductor role
- 10:20Digital transformation challenges
- 16:20ASML’s digital platform overview
- 22:18Multi-tenant Kafka on Kubernetes
- 24:28Kafka on Kubernetes challenges
- 28:25Kafka client auth with Istio/SPIFFY
- 34:04Kafka topic access control
- 38:39Noisy neighbor quotas
- 43:35Final architecture & open source
- 45:04Q&A
related talks
47mPainless Multi-Tenant Kafka on Kubernetes with Istio at ASML
38mA Tale of a Meshi Kafka: Securing Kafka Deployment When Istio Is Used
42mPartial Multi-Tenancy on Kafka Using Strimzi at LittleHorse
46mMulti-tenancy in Apache Kafka, Navigating a Major Topic
26mProduction Grade Kafka on K8s
23mManage Multi-tenant ML Workloads Using Istio
33mKafka Operator: Managing and Operating Kafka Clusters in Kubernetes [A]
34mHow to Survive Managing Strimzi in an Enterprise