Skip to main content

Kafka Connection Security Configuration Guide

caution

Kafka is used in all three images of this product: mingdaoyun-hap, mingdaoyun-hdp, and mingdaoyun-flink. Any adjustments to the security configuration must be applied to all of them accordingly.

Connection Configuration Parameters

Environment VariableDescriptionDefault Value
ENV_KAFKA_ENDPOINTSKafka broker address list. Multiple addresses should be separated by commas127.0.0.1:9092
ENV_KAFKA_SECURITY_PROTOCOLKafka security protocol modeEmpty
ENV_KAFKA_SASL_MECHANISMSASL authentication mechanismEmpty
ENV_KAFKA_SASL_USERNAMESASL usernameEmpty
ENV_KAFKA_SASL_PASSWORDSASL passwordEmpty
ENV_KAFKA_SSL_CA_LOCATIONKafka CA certificate pathEmpty
ENV_KAFKA_SSL_CLIENT_CA_LOCATIONKafka client certificate pathEmpty
ENV_KAFKA_SSL_CLIENT_KEY_LOCATIONKafka client private key pathEmpty

Security Protocol Modes

Kafka supports multiple security authentication modes, including Plaintext、SaslPlaintext、Ssl、SaslSsl.

1. Plaintext (Default Mode)

No security authentication mechanism is enabled. Communication is performed in plaintext, and no SASL or SSL-related parameters are required.

2. SaslPlaintext (SASL Authentication Enabled)

Uses the SASL mechanism for authentication, but data transmission remains in plaintext.

The following environment variables must be added to the configuration file:

Environment VariableDescription
ENV_KAFKA_SECURITY_PROTOCOLSet to SaslPlaintext
ENV_KAFKA_SASL_MECHANISMSASL authentication mechanism, fixed as PLAIN
ENV_KAFKA_SASL_USERNAMESASL username
ENV_KAFKA_SASL_PASSWORDSASL password

3. Ssl (TLS Encryption Enabled)

Uses TLS/SSL for encrypted communication but does not enable SASL authentication.

The following environment variables must be added to the configuration file:

Environment VariableDescription
ENV_KAFKA_SECURITY_PROTOCOLSet to Ssl
ENV_KAFKA_SSL_CA_LOCATIONCA root certificate path
ENV_KAFKA_SSL_CLIENT_CA_LOCATIONClient certificate path
ENV_KAFKA_SSL_CLIENT_KEY_LOCATIONClient private key path

4. SaslSsl (SASL + TLS Enabled)

Enables both SASL authentication and SSL encrypted communication (recommended security mode).

The following environment variables must be added to the configuration file:

Environment VariableDescription
ENV_KAFKA_SECURITY_PROTOCOLSet to SaslSsl
ENV_KAFKA_SASL_MECHANISMSASL authentication mechanism, fixed as PLAIN
ENV_KAFKA_SASL_USERNAMESASL username
ENV_KAFKA_SASL_PASSWORDSASL password
ENV_KAFKA_SSL_CA_LOCATIONCA root certificate (PEM format)
ENV_KAFKA_SSL_CLIENT_CA_LOCATIONClient certificate (PEM format)
ENV_KAFKA_SSL_CLIENT_KEY_LOCATIONClient private key (PEM format)

TLS Certificate Configuration

When using Ssl or SaslSsl, TLS certificates must be provided inside the container.

Certificate Files

Prepare the following PEM certificate files:

FileDescription
ca.crtKafka CA root certificate
client.crtClient certificate
client.keyClient private key

Directory example:

volume/kafka/
├─ ca.crt
├─ client.crt
└─ client.key

Docker Certificate Mount Example

The certificates need to be mounted into the container:

volumes:
- ./volume/kafka/ca.crt:/usr/local/kafka/ca.crt
- ./volume/kafka/client.crt:/usr/local/kafka/client.crt
- ./volume/kafka/client.key:/usr/local/kafka/client.key

The corresponding environment variable values should be as follows (the environment variable paths must match the paths inside the container):

ENV_KAFKA_SSL_CA_LOCATION: "/usr/local/kafka/ca.crt"
ENV_KAFKA_SSL_CLIENT_CA_LOCATION: "/usr/local/kafka/client.crt"
ENV_KAFKA_SSL_CLIENT_KEY_LOCATION: "/usr/local/kafka/client.key"