[
https://issues.apache.org/jira/browse/KAFKA-1176?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13987459#comment-13987459
]
Jim Hoagland commented on KAFKA-1176:
-------------------------------------
I think this issue will benefit from having a goal of secure mutli-tenancy for
a Kafka cluster. That is, there can be independent parties using the same
Kafka cluster. It might be useful to envision a hypothetical scenario where a
company's IT is hosting Kafka cluster and has three tenants:
* the e-commerce team, using it for a record of online sales
* the security monitoring team, using it to receive a stream of
security-related events for analysis
* a product dev team, receiving anonymized product telemetry from the field and
using a third party to analyze it
What secure multi-tenancy would mean to me (other people may have different
ideas) includes:
* tenants shouldn’t be able to see each others data: different tenants should
not be able to read the contents of other tenants topics (by default at least)
* tenants shouldn’t be able to see what each other is doing: they shouldn't be
able to see each others topics or metadata about the topic such as size
* non-interference: tenants should not be able to interfere with each other.
This suggests quotas along the lines of what is in KAFKA-656, including disk
quotas and caps that would limit CPU and disk I/O resource usage. This also
suggests limits on the ability to add to a topic or to cause messages to be
deleted.
In addition, I could image cases in which the team producing the messages wants
to allow users (not necessarily on their team) to access certain topics.
Of course you need authentication to form the basis for identity. If would be
best to make it easy for organization to tie this to their existing
authentication mechanisms.
I'm new to Kafka, but hopefully this makes sense.
> Secure Kafka
> ------------
>
> Key: KAFKA-1176
> URL: https://issues.apache.org/jira/browse/KAFKA-1176
> Project: Kafka
> Issue Type: New Feature
> Reporter: Pradeep Gollakota
>
> Implement Authentication, Authorization, Encryption, ACL's for Kafka.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
