Securing Kafka with SPIFFE at TransferWise
Talkat Production Identity Day: SPIFFE + SPIRE 2020 · on Tuesday, 2020-11-17· at 13:10· Virtual, Virtual·
summary
TransferWise replaces long‑lived Kafka certs with SPIFFE/SPIRE-issued SVIDs and Envoy sidecars to get mutual TLS without touching client code, rolling this out across around 300 microservices. Brokers use a JS SPIFFE library to present key/trust managers, Envoy maps localhost ports to broker advertise listeners for bootstrap, and SPIRE handles certificate rotation. Claim: zero code changes on clients; result: working production deployment with lower latency than Java TLS and no manual cert ops.
AI-written summary · about
chapters (8)
- 0:00Intro
- 0:12What is Kafka?
- 1:48How client-broker connection works?
- 4:24Client-Broker TLS
- 6:37Client-Broker mTLS with SPIRE
- 11:17Envoy at TransferWise
- 12:18Just add Kafka
- 18:17Resources
related talks
49mReal World SPIFFE Scenarios and Outcomes
36mFederated Identity for Distributed Systems: Understanding SPIFFE
32mA Platform-Agnostic Approach to Securing Workloads
36mSPIFFE: In Theory and in Practice
28mCan I Trust You? Service-to-Service Identity with SPIFFE
30mAdvancing Machine to Machine Workflows with the SPIFFE Identity Provider
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
37mSPIFFE Deep Dive