Confluent Streaming Event 2019

1. Scaling Kafka Permission
Management to a Multi-Team
EnvironmentIvan Greguric Ortolan
Solution Architect and Consultant
mimacom

2. How do we ensure
easy to maintain security in
a cluster shared by many teams?
Photo by Chris Lawton on Unsplash

3. Copyright: mimacom ag, 2019. All rights reserved.
What is
Kafka security?
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Photo by Silas Köhler on Unsplash

4. Copyright: mimacom ag, 2019. All rights reserved.
What is
Kafka security?
Encryption
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Photo by Silas Köhler on Unsplash

5. Copyright: mimacom ag, 2019. All rights reserved.
What is
Kafka security?
Encryption
Authentication
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Photo by Silas Köhler on Unsplash

6. Copyright: mimacom ag, 2019. All rights reserved.
Photo by Silas Köhler on Unsplash
What is
Kafka security?
Encryption
Authentication Authorization
11.11.2019 / Confluent Stream - Zurich / @ntrpivan

7. Let’s talk about
Authorization
Photo by James Sutton on Unsplash

8. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
AccessControlLists
“User alice can write to topic clickStream”
“User bob cannot read topic cardEvents”

9. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
AccessControlLists
“User alice can write to topic clickStream”

10. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
AccessControlLists
“User alice can write to topic clickStream”

11. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
AccessControlLists
“User alice can write to topic clickStream”

12. Photo by Nik Shuliahin on Unsplash
This approach has many
pitfalls

13. Photo by Nik Shuliahin on Unsplash
This approach has many
pitfalls
Complex

14. Photo by Nik Shuliahin on Unsplash
This approach has many
pitfalls
Complex
Tedious

15. Photo by Nik Shuliahin on Unsplash
This approach has many
pitfalls
Complex
Error prone
Tedious

16. Photo by Nik Shuliahin on Unsplash
This approach has many
pitfalls
Complex
Error prone
Tedious
Difficult
to secure

17. Photo by Nik Shuliahin on Unsplash
This approach has many
pitfalls
Complex
Difficult
to audit
Error prone
Tedious
Difficult
to secure

18. Photo by Nik Shuliahin on Unsplash
This approach has many
pitfalls
Complex
Difficult
to audit
Error prone
Tedious
Difficult
to secure
Kill me
please...

19. Copyright: mimacom ag, 2019. All rights reserved.
Welcome the
Kafka
Security
Manager
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Photo by Srh Hrbch on Unsplash

20. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Kafka Security Manager
S3
KSM
poll

21. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Kafka Security Manager
KSM
applypoll
S3

22. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Kafka Security Manager
KSM
notify
applypoll
S3

23. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Kafka Security Manager
KSM
notify
applypoll
S3

24. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Our Workflow
KSM
notify
channel
apply
Pull request
notify approve
maintainer
developer
poll

25. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
KSM
notify
channel
apply
Pull request
notify approve
maintainer
developer
poll
Our Workflow

26. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
KSM
notify
channel
apply
Pull request
notify approve
maintainer
developer
poll
Our Workflow

27. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
KSM
notify
channel
apply
Pull request
notify approve
maintainer
developer
poll
Our Workflow

28. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
KSM
notify
channel
applypoll
Pull request
notify approve
maintainer
developer
Our Workflow

29. Photo by MalcolmLightbody on Unsplash
How do we
set it up ?

30. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Kafka Security Manager
How to

31. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Kafka Security Manager
How to

32. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Kafka Security Manager
How to

33. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Kafka Security Manager
How to

34. Photo by Yi Liu on Unsplash

35. Can we
do
better?
Photo by Yi Liu on Unsplash

36. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Kafka Security Manager (enhanced)
KSM

37. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Kafka Security Manager (enhanced)
KSM
YAML support

38. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Kafka Security Manager (enhanced)
KSM
YAML support
Simplified syntax

39. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Kafka Security Manager (enhanced)
KSM
YAML support
Simplified syntax
Directory
support

40. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Kafka Security Manager (enhanced)
KSM
YAML support
Simplified syntax
Directory
support
Stability bug fixes

41. How do we use all this new
features to build a
seamless experience?
Photo by Simon Migaj on Unsplash

42. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Split ACLs into Files

43. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
CODEOWNERS File

44. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Pull Request Template

45. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
CircleCI Linting

46. Copyright: mimacom ag, 2019. All rights reserved.
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
Slack Notifications

47. Let’s
sum up..
Photo by Antoine Dautry on Unsplash

48. I need it!
Photo by Edwin Andrade on Unsplash

49. Unfortunately,
the features
are not merged back yet ...
Photo by FranciscoMoreno on Unsplash

50. ... but don’t worry,
they will be!
Photo by Rowen Smith on Unsplash

51. Copyright: mimacom ag, 2019. All rights reserved.
Questions?
Meet me at the mimacom booth
THANKS!
11.11.2019 / Confluent Stream - Zurich / @ntrpivan
CREDITS:
- Unsplash and SlideGo for backgrounds and resources
- Carbon for the code snippets
ivan.g.ortolan@gmail.com
/ntrp
/ntrp
/in/goivan
@ntrpivan