Why this matters
- VaultCommerce uses SASL/SCRAM-SHA-512 + TLS 1.3 on all broker and client connections.
- ACLs follow least privilege: inventory-service can READ orders, WRITE inventory-events only.
- Super users bypass ACLs — limit to break-glass admin principals.
- Security misconfiguration is a compliance audit failure, not just an ops issue.
Authentication stack
Clients present SCRAM credentials; brokers verify against KRaft-stored credentials (or LDAP). security.protocol=SASL_SSL combines encryption and auth. VaultCommerce rotates SCRAM passwords quarterly via Vault secrets injection into Kubernetes.
Key points
- SASL/SCRAM-SHA-512 — username/password challenge-response auth
- TLS/mTLS — encrypt traffic; mTLS adds client certificate identity
- ACL principal — User:service-name mapped from SASL or cert DN
- Operation — READ, WRITE, CREATE, DESCRIBE, CLUSTER_ACTION, etc.
- allow.everyone.if.no.acl.found — must be false in production
ACL patterns
Prefix ACLs: User:inventory-service has READ on vaultcommerce.orders.*, WRITE on vaultcommerce.inventory.*. Deny-by-default when allow.everyone.if.no.acl.found=false. Audit ACL changes — VaultCommerce logs to SIEM.
VaultCommerce rollout checklist
Before promoting changes that touch the VaultCommerce order and payment event backbone, run the staging KRaft cluster (Kafka 3.7+, Schema Registry 7.x) through a 10k events/min soak test. Compare producer request latency p99 and consumer lag per group against the pre-deploy baseline. SASL_SSL for auth + encryption. Document the change in the internal topic registry, attach Grafana screenshots to the change ticket, and keep an engineer on lag dashboards for 30 minutes after production rollout — roll back the service release before altering broker-level settings if lag or under-replicated partitions spike.
# VaultCommerce client — application.yml (Spring Kafka 3.x)
spring:
kafka:
properties:
security.protocol: SASL_SSL
sasl.mechanism: SCRAM-SHA-512
sasl.jaas.config: org.apache.kafka.common.security.scram.ScramLoginModule required username="inventory-service" password="${KAFKA_PASSWORD}";
ssl:
trust-store-location: file:/etc/kafka/truststore.jks
trust-store-password: ${TRUSTSTORE_PASSWORD}
# ACL: kafka-acls.sh --add --allow-principal User:inventory-service \
# --operation Read --topic vaultcommerce.orders --resource-pattern-type prefixed
Quick recall
Everything you need if you only revisit this box.
- SASL_SSL for auth + encryption.
- ACLs per service principal, least privilege.
- Disable allow-everyone-if-no-acl.
Test yourself
Answer these before moving on — recall is what makes it stick.