Skip to main content
Quick navigation

Data Masking

Let's demonstrate field level data masking

View the full demo in realtime​

You can either follow all the steps manually, or watch the recording

Review the docker compose environment​

As can be seen from docker-compose.yaml the demo environment consists of the following services:

  • gateway1
  • gateway2
  • kafka-client
  • kafka1
  • kafka2
  • kafka3
  • schema-registry
cat docker-compose.yaml

Starting the docker environment​

Start all your docker processes, wait for them to be up and ready, then run in background

  • --wait: Wait for services to be running|healthy. Implies detached mode.
  • --detach: Detached mode: Run containers in the background
docker compose up --detach --wait

Creating topic customers on gateway1​

Creating on gateway1:

  • Topic customers with partitions:1 and replication-factor:1
kafka-topics \
    --bootstrap-server localhost:6969 \
    --replication-factor 1 \
    --partitions 1 \
    --create --if-not-exists \
    --topic customers

Adding interceptor data-masking​

We want to data masking only two fields, with an in memory KMS.

step-06-data-masking-interceptor.json:

{
  "kind" : "Interceptor",
  "apiVersion" : "gateway/v2",
  "metadata" : {
    "name" : "data-masking"
  },
  "spec" : {
    "comment" : "Adding interceptor: data-masking",
    "pluginClass" : "io.conduktor.gateway.interceptor.FieldLevelDataMaskingPlugin",
    "priority" : 100,
    "config" : {
      "policies" : [ {
        "name" : "Mask password",
        "rule" : {
          "type" : "MASK_ALL"
        },
        "fields" : [ "password" ]
      }, {
        "name" : "Mask visa",
        "rule" : {
          "type" : "MASK_LAST_N",
          "maskingChar" : "X",
          "numberOfChars" : 4
        },
        "fields" : [ "visa", "a.b.c", "visa3" ]
      } ]
    }
  }
}
curl \
    --silent \
    --request PUT "http://localhost:8888/gateway/v2/interceptor" \
    --header "Content-Type: application/json" \
    --user "admin:conduktor" \
    --data @step-06-data-masking-interceptor.json | jq

Listing interceptors​

Listing interceptors on gateway1

curl \
    --silent \
    --request GET "http://localhost:8888/gateway/v2/interceptor" \
    --user "admin:conduktor" | jq

Let's send json​

We are using regular kafka tools

Sending 2 events

{
  "name" : "tom",
  "username" : "tom@conduktor.io",
  "password" : "motorhead",
  "visa" : "#abc123",
  "address" : "Chancery lane, London"
}
{
  "name" : "laura",
  "username" : "laura@conduktor.io",
  "password" : "kitesurf",
  "visa" : "#888999XZ;",
  "address" : "Dubai, UAE"
}
echo '{"name":"tom","username":"tom@conduktor.io","password":"motorhead","visa":"#abc123","address":"Chancery lane, London"}' | \
    kafka-console-producer \
        --bootstrap-server localhost:6969 \
        --topic customers

echo '{"name":"laura","username":"laura@conduktor.io","password":"kitesurf","visa":"#888999XZ;","address":"Dubai, UAE"}' | \
    kafka-console-producer \
        --bootstrap-server localhost:6969 \
        --topic customers

Let's consume the message, and confirm tom and laura fields are masked​

Let's consume the message, and confirm tom and laura fields are masked in cluster gateway1

kafka-console-consumer \
    --bootstrap-server localhost:6969 \
    --topic customers \
    --from-beginning \
    --max-messages 3 \
    --timeout-ms 3000 | jq

returns 2 events

{
  "name" : "tom",
  "username" : "tom@conduktor.io",
  "password" : "********",
  "visa" : "#abXXXX",
  "address" : "Chancery lane, London"
}
{
  "name" : "laura",
  "username" : "laura@conduktor.io",
  "password" : "********",
  "visa" : "#88899XXXX",
  "address" : "Dubai, UAE"
}

Remove interceptor data-masking​

curl \
    --silent \
    --request DELETE "http://localhost:8888/gateway/v2/interceptor/data-masking" \
    --header "Content-Type: application/json" \
    --user "admin:conduktor" \
    --data-raw '{
  "vCluster" : "passthrough"
}' | jq

Let's consume the message, and confirm tom and laura fields no more masked​

Let's consume the message, and confirm tom and laura fields no more masked in cluster gateway1

kafka-console-consumer \
    --bootstrap-server localhost:6969 \
    --topic customers \
    --from-beginning \
    --max-messages 3 \
    --timeout-ms 3000 | jq

returns 2 events

{
  "name" : "tom",
  "username" : "tom@conduktor.io",
  "password" : "motorhead",
  "visa" : "#abc123",
  "address" : "Chancery lane, London"
}
{
  "name" : "laura",
  "username" : "laura@conduktor.io",
  "password" : "kitesurf",
  "visa" : "#888999XZ;",
  "address" : "Dubai, UAE"
}

Tearing down the docker environment​

Remove all your docker processes and associated volumes

  • --volumes: Remove named volumes declared in the "volumes" section of the Compose file and anonymous volumes attached to containers.
docker compose down --volumes

Conclusion

Yes, encryption in the Kafka world can be simple!