TechPrufer
Sign inGet started

Blogs›Confluent›Kafka mTLS Authentication System

Kafka mTLS Authentication System

Kafka mTLS Authentication System

1
posts
2021

This post details Zendesk's implementation of a self-hosted mTLS authentication system for their Kafka clusters to secure inter-pod communication and enable a global event bus. It covers the problem statement, key requirements like automated certificate generation and rotation, and the decision to use mTLS over SASL. The solution components include using HashiCorp Vault as a private CA, a PKI auth manager sidecar for Kubernetes clients, and a TLS monitor for brokers to handle certificate hot-reloading. It also discusses security considerations like certificate revocation challenges and a robust root CA rotation strategy.

2021

How Zendesk Secures Kafka with Self-Hosted mTLS Authentication System

1/7/2021

Zendesk built a self-hosted mTLS authentication system for their Kafka clusters using HashiCorp Vault as a private CA. The system includes a PKI auth manager sidecar for Kubernetes clients and a TLS monitor for brokers to manage certificate generation, regeneration, and hot-reloading. The post details the architecture, solution components, and security considerations, including a strategy for root CA rotation due to limitations in certificate revocation.