Zero trust with Kafka

Summary

Grab's real-time data platform team transitioned their large-scale Kafka infrastructure from basic network access controls to a zero-trust architecture. The platform implements mutual Transport Layer Security (mTLS) for offline peer authentication and encryption, driven by HashiCorp Vault's PKI engine and Strimzi on Kubernetes. Policy-Based Access Control is enforced using dedicated Open Policy Agent deployments per cluster, backed by GitOps workflows where topic owners approve JSON authorization rules. To simplify client integration, the team enhanced their Go SDK to handle ephemeral in-memory certificates, automatic renewals, and configurable retries. While the security posture improved, the Java encryption and decryption overhead caused a drop in streaming throughput.

Takeaways

1. 1

   mTLS was chosen over OAuth and SCRAM because it permits offline peer identity verification across disparate network environments without a live connection to a central auth authority.

2. 2

   The Golang client SDK stores ephemeral certificates and private keys exclusively in memory and automatically initiates renewals at two-thirds of their TTL to eliminate CRL maintenance and reduce attack surfaces.

3. 3

   Each Kafka cluster runs a dedicated Open Policy Agent deployment spanning matching Availability Zones, isolating the blast radius and allowing broker pods to cache authorization decisions locally.