Configure Security for Confluent Platform with Confluent for Kubernetes¶
Confluent for Kubernetes takes an opinionated and automated approach of securing your Confluent deployment.
Securing your Confluent deployment covers the following security dimensions:
- Authentication
- Authorization
- Network Encryption
- Configuration Secrets
Confluent recommends the following security configuration for production deployments:
- For authentication
For Kafka client authentication, choose one of:
mTLS
SASL/PLAIN
SASL/PLAIN with LDAP
For SASL/PLAIN, the identity can come from LDAP server.
- For authorization
Confluent Role-Based Access Control (RBAC) for authorization, with user/group identity coming from LDAP server
- For network Encryption
TLS for both internal (between Confluent components) and external (clients to Confluent components)
- For configuration secrets
Manage the lifecycle using Kubernetes Secrets or Vaults, and reference them in the Confluent component custom resources
For a comprehensive tutorial scenario on configuring Confluent recommended security, see the Security Tutorial.
While the above is the recommended way to run Confluent for Kubernetes in production, you do have the option to deploy and operate Confluent for Kubernetes with different security configurations. Below is the outline of security configurations supported, with links to pages that cover concepts and instructions in detail:
- Authentication
- Kafka authentication
- No authentication
- SASL/PLAIN authentication (username/password)
- SASL/PLAIN with LDAP authentication
- mTLS authentication (certificate based)
- ZooKeeper authentication
- No authentication
- Digest authentication
- mTLS authentication
- Confluent component authentication
- No authentication
- Basic authentication (username/password)
- mTLS authentication
- LDAP authentication (for Confluent Control Center only)
- Kafka authentication
- Authorization
- No authorization
- Confluent Role Based Access Control (RBAC) authorization, with a dependency on LDAP server
- Kafka Access Control Lists
- Network Encryption
- No encryption
- TLS encryption