Securing a Kafka cluster means protecting data in transit and at rest, verifying the identity of every client and broker, and restricting what authenticated identities are allowed to do.
Key Points: • Enable SSL/TLS on all listeners to encrypt data moving between clients, brokers, and between brokers themselves. • Use SASL (e.g. SASL/SCRAM or SASL/Kerberos) so clients and brokers must authenticate before connecting. • Define Access Control Lists (ACLs) so authenticated principals only get the read/write/admin permissions they actually need on specific topics or consumer groups. • Keep brokers and clients patched against known CVEs and rotate certificates and credentials periodically. • Log and monitor authentication failures and ACL denials to catch unauthorized access attempts. • Restrict network exposure with firewalls, private subnets, and security groups so brokers aren't reachable from untrusted networks.
Example: A team might configure each broker listener with SSL for encryption and SASL/SCRAM for authentication, then add an ACL that only lets the "billing-service" principal produce to the billing-events topic, denying every other client.
Interview Tip: A concise interview answer is:
"I secure a Kafka cluster by enabling SSL/TLS for encryption in transit, SASL for client and broker authentication, and ACLs for fine-grained authorization, on top of keeping the cluster patched, network-isolated, and monitored for unauthorized access."