Skip to main content
Quick navigation

Field level encryption and performance

Let's demonstrate field level encryption and performance

View the full demo in realtime

You can either follow all the steps manually, or watch the recording

Review the docker compose environment

As can be seen from docker-compose.yaml the demo environment consists of the following services:

  • gateway1
  • gateway2
  • kafka-client
  • kafka1
  • kafka2
  • kafka3
  • schema-registry
  • zookeeper
cat docker-compose.yaml

Starting the docker environment

Start all your docker processes, wait for them to be up and ready, then run in background

  • --wait: Wait for services to be running|healthy. Implies detached mode.
  • --detach: Detached mode: Run containers in the background
docker compose up --detach --wait

Creating virtual cluster teamA

Creating virtual cluster teamA on gateway gateway1 and reviewing the configuration file to access it

# Generate virtual cluster teamA with service account sa
token=$(curl \
--request POST "http://localhost:8888/admin/vclusters/v1/vcluster/teamA/username/sa" \
--header 'Content-Type: application/json' \
--user 'admin:conduktor' \
--silent \
--data-raw '{"lifeTimeSeconds": 7776000}' | jq -r ".token")

# Create access file
echo """
sasl.mechanism=PLAIN required username='sa' password='$token';
""" >

# Review file

Creating topic customers on teamA

Creating on teamA:

  • Topic customers with partitions:1 and replication-factor:1
kafka-topics \
--bootstrap-server localhost:6969 \
--command-config \
--replication-factor 1 \
--partitions 1 \
--create --if-not-exists \
--topic customers

Adding interceptor encrypt

We want to encrypt only two fields, with an in memory KMS.

cat step-07-encrypt.json | jq

curl \
--request POST "http://localhost:8888/admin/interceptors/v1/vcluster/teamA/interceptor/encrypt" \
--header 'Content-Type: application/json' \
--user 'admin:conduktor' \
--silent \
--data @step-07-encrypt.json | jq

Adding interceptor decrypt

Let's add the decrypt interceptor to decipher messages

cat step-08-decrypt.json | jq

curl \
--request POST "http://localhost:8888/admin/interceptors/v1/vcluster/teamA/interceptor/decrypt" \
--header 'Content-Type: application/json' \
--user 'admin:conduktor' \
--silent \
--data @step-08-decrypt.json | jq

Listing interceptors for teamA

Listing interceptors on gateway1 for virtual cluster teamA

curl \
--request GET 'http://localhost:8888/admin/interceptors/v1/vcluster/teamA' \
--header 'Content-Type: application/json' \
--user 'admin:conduktor' \
--silent | jq

Running kafka-producer-perf-test bundled with Apache Kafka

kafka-producer-perf-test \
--topic customers \
--throughput -1 \
--num-records 1000000 \
--producer-props \
bootstrap.servers=localhost:6969 \ \
compression.type=lz4 \
--producer.config \
--payload-file examples.json

Tearing down the docker environment

Remove all your docker processes and associated volumes

  • --volumes: Remove named volumes declared in the "volumes" section of the Compose file and anonymous volumes attached to containers.
docker compose down --volumes


Yes, encryption in the Kafka world can be simple ... and efficient!

[!NOTE] The best part is that this performance level is with the default security provider. You can use Bouncy Castle, Conscrypt etc to boost both your performance and compliancy!