KIP-12 — Kafka Sasl/Kerberos and SSL implementation

Accepted Security

Introduces SASL/Kerberos authentication and SSL/TLS encryption to Kafka brokers and clients by defining TransportLayer (PlainTextTransportLayer, SSLTransportLayer) and Authenticator (SaslServerAuthenticator, SaslClientAuthenticator) interfaces layered over the existing NIO channel abstraction. Kafka previously had no authentication or encryption, leaving multi-tenant and internet-facing deployments without wire security.

Details