Integration / Apache Kafka Interview questions
How do you secure a Kafka cluster with SASL and ACLs?
Kafka security generally layers two separate concerns: authentication (proving who a client is) and authorization (deciding what an authenticated client is allowed to do), typically combined with encryption in transit.
# broker config listeners=SASL_SSL://0.0.0.0:9093 sasl.enabled.mechanisms=SCRAM-SHA-512 security.inter.broker.protocol=SASL_SSL
SASL (commonly SCRAM or OAUTHBEARER in current deployments, PLAIN for simpler setups) handles authentication, verifying a client's credentials during connection setup; pairing it with SSL/TLS (SASL_SSL) also encrypts the connection itself, so credentials and data aren't sent in the clear.
kafka-acls.sh --add --allow-principal User:order-service \ --operation Write --topic orders --bootstrap-server localhost:9093
ACLs then handle authorization: once a client's identity is established, ACLs define exactly which operations (read, write, create, describe) that principal is permitted on which resources (specific topics, consumer groups, or the whole cluster). The combination is what lets a shared multi-tenant cluster enforce that, say, a billing service's producer can write to its own topic but has no read or write access to an unrelated HR topic on the same cluster.
More Related questions...
