Securing Producers and Consumers

An order producer works from a developer's laptop using an administrator credential. The deployment copies the same settings into a container, and the reporting consumer receives a copy too. Both applications connect successfully, but either can now perform operations far beyond its job.

Securing Kafka clients means carrying the intended access policy all the way into the running application. The right identity, trusted broker endpoints, protected secrets, and narrow permissions must agree. The application must also handle failures without leaking data or silently losing work.

This chapter develops a deployment for an order producer and reporting consumer using Apache Kafka 4.3.1, KRaft, and the Apache Kafka Java clients. The example uses SCRAM-SHA-256 over TLS and an existing cluster with ACL enforcement enabled.