Maximize Apache Kafka Security with Secret Protection | Confluent

This post introduces Secret Protection, a commercial feature in Confluent Platform 5.3, which uses envelope encryption to encrypt secrets within configuration files. It extends previous KIPs for securing passwords in ZooKeeper and Connect configurations to cover all Confluent Platform components. The feature uses a master passphrase to derive a master encryption key, which then encrypts a data encryption key. This data encryption key is used to encrypt the actual secrets. The post details the workflow for generating the master key, encrypting configuration parameters (e.g., `config.storage.topic`), updating secrets, and operationalizing the workflow for production environments, including distributing the master key and secrets file, and restarting services.