Configure Security

Confluent for Kubernetes takes an opinionated, automated approach to securing your Confluent deployment across authentication, authorization, network encryption, and configuration secrets.

Security topics covered in this section

• Configure Authentication: Configure authentication for Apache Kafka® and other Confluent Platform components.

• Configure Authorization: Configure role-based access control (RBAC) or access control list (ACL) authorization.

• Configure Network Encryption: Configure Transport Layer Security (TLS) network encryption.

• Security Compliance: Deploy Federal Information Processing Standards (FIPS) 140-2 or FIPS 140-3 compliant Confluent Platform components.

• Provide and Manage Sensitive Data: Provide and manage sensitive credentials and certificates.

Securing your Confluent deployment covers the following security dimensions:

• Authentication

• Authorization

• Network encryption

• Configuration secrets

As a best practice, use the following security configuration for production deployments:

For authentication

For Kafka client authentication, choose one of:

• Simple Authentication and Security Layer (SASL)/PLAIN

• SASL/PLAIN with Lightweight Directory Access Protocol (LDAP)

  For SASL/PLAIN, the identity can come from an LDAP server.

• mTLS

For authorization

Confluent role-based access control (RBAC) for authorization, with user or group identity coming from an LDAP server.

For network encryption

TLS for both internal (between Confluent components) and external (clients to Confluent components) traffic.

For configuration secrets

Manage the lifecycle using Kubernetes Secrets or vaults, and reference them in the Confluent component custom resources.

For a comprehensive tutorial scenario on configuring Confluent recommended security, see the Security Tutorial.

While this is the recommended way to run Confluent for Kubernetes in production, you can also deploy and operate Confluent for Kubernetes with different security configurations. The following outlines the supported security configurations, with links to detailed concepts and instructions:

• Authentication

  • Kafka authentication

    • No authentication

    • SASL/PLAIN authentication (username/password)

    • SASL/PLAIN with LDAP authentication

    • mTLS authentication (certificate-based)

    • OAuth/OpenID Connect (OIDC) authentication

  • ZooKeeper authentication

    Important

    Starting with Confluent Platform version 8.0, ZooKeeper is no longer part of Confluent Platform.

    For Confluent Platform versions before 8.0, ZooKeeper supports:

    • No authentication

    • Digest authentication

    • mTLS authentication

  • Confluent component authentication

    • No authentication

    • Basic authentication (username/password)

    • mTLS authentication

    • OAuth/OIDC authentication

    • LDAP authentication (for Control Center and Control Center (Legacy) only)

    • Single sign-on authentication (for Control Center and Control Center (Legacy) only)

• Authorization

  • No authorization

  • Confluent |rbac-long| authorization, with a dependency on an LDAP server

  • Kafka Access Control Lists

• Network encryption

  • No encryption

  • TLS encryption

• Configuration secrets

  • Kubernetes Secrets

  • HashiCorp Vault

  • Azure Key Vault

  • Mount custom Kubernetes secrets