The document discusses securing Apache Kafka with SPIFFE and SPIRE at TransferWise. It describes how client-broker connections normally work with TLS and the problems with long-lived certificates. It then explains how SPIFFE and SPIRE can be used to issue short-lived certificates to clients through Envoy, eliminating the need for long-term certificate management and enabling diverse clients without problems. Envoy acts as a proxy between clients and brokers, enforcing mTLS using certificates issued by SPIRE. This allows securing Kafka with no code changes needed on the client side.

1. Securing Kafka with SPIFFE at
TransferWise.
Levani Kokhreidze, Jonathan Oddy

2. What is Kafka?

3. How client-broker connection works?

4. How client-broker connection works?

5. How client-broker connection works?

6. How client-broker connection works?

7. How client-broker connection works?

8. Client-Broker mTLS

9. Client-Broker mTLS

10. Client-Broker mTLS

11. Client-Broker mTLS

12. Client-Broker mTLS

13. Client-Broker mTLS

14. Client-Broker mTLS

15. Problems
Long-lived certificates
are hard to manage
Diverse clients ==
Problems
Hard to migrate
clients to the new
setup

16. SPIFFE with SPIRE to the rescue!

17. Client-Broker mTLS with SPIRE

18. Client-Broker mTLS with SPIRE

19. Client-Broker mTLS with SPIRE

20. Client-Broker mTLS with SPIRE

21. Client-Broker mTLS with SPIRE

22. Client-Broker mTLS with SPIRE

23. Client-Broker mTLS with SPIRE

24. Client-Broker mTLS with SPIRE

25. Client-Broker mTLS with SPIRE

26. Client-Broker mTLS with SPIRE

28. Envoy at TransferWise

29. Just add Kafka
● Kafka brokers are static (today)
● Envoy config templateised (Helm, Jinja2)
● No need to touch control plane

30. Just add Kafka
● Envoy tcp_proxy listener + single endpoint cluster per broker
● Cluster configured with tls transport socket
● bootstrap.servers=localhost:9101;localhost:9102...

31. Simplify bootstrapping
● Add extra cluster for all brokers
● bootstrap.servers=localhost:9100

32. Problems?
● Static broker configuration
● Overhead?
○ Better than Java native TLS!

33. Benefits
Unified service identity
across our infrastructure
Diverse clients !=
Problems
Zero code change
required on client side
No long-lived certs to
manage

34. Resources
● Example Envoy config: https://github.com/transferwise/spiffe-kafka-talk
● Traiana’s SPIFFE principal library: https://github.com/traiana/kafka-spiffe-principal