mTLS

Mutual TLS (mTLS) extends TLS with client certificate authentication: the Kafka brokers verify Kafka Gateway's certificate in addition to Kafka Gateway verifying the brokers' certificate. This is commonly required by managed Kafka services such as Amazon MSK when configured for two-way TLS authentication.

Configuring the Connection

Prepare a truststore containing the trusted server certificates or certificate authority, and a keystore containing Kafka Gateway's signed client certificate. Configure a filesystem vault with both, then reference it from the tls client binding along with the certificate aliases to use:

vaults:
  client_vault:
    type: filesystem
    options:
      trust:
        store: ${{env.TRUSTORE_PATH}}
        type: ${{env.TRUSTORE_TYPE}}
        password: ${{env.TRUSTORE_PASSWORD}}
      keys:
        store: ${{env.KEYSTORE_PATH}}
        type: ${{env.KEYSTORE_TYPE}}
        password: ${{env.KEYSTORE_PASSWORD}}
bindings:
  south_kafka_client:
    type: kafka
    kind: client
    options:
      servers:
        - ${{env.KAFKA_BOOTSTRAP_SERVER}}
    exit: south_tls_client
  south_tls_client:
    type: tls
    kind: client
    vault: client_vault
    options:
      trust:
        - ${{env.CA_CERT_ALIAS}}
      keys:
        - ${{env.SIGNED_CLIENT_CERT_ALIAS}}
    exit: south_tcp_client
  south_tcp_client:
    type: tcp
    kind: client

See the tls client binding reference for the full set of options fields, including options.mutual.

For a full walkthrough of mTLS with Amazon MSK, see Amazon MSK Mutual TLS authentication.