Question regarding data security? TLS

[npandeya]

I am using the strimzi cluster and made sure the tls is true for all the listeners. Since kafka stores the data in EBS volumes and it is encrypted so data at rest is encrypted.
When we use TLS true and TLS type authentication is the data in transit (from producer to kafka or from kafka to consumer) is that encrypted as well?

[scholzj]

When you set the tls: true in the listener configuration, you enable TLS encryption for the connections to that listener. The internal connections (e.g. replication of data between the brokers) are encrypted by default. This does not impact the storage level encryption. That is property of the storage and can be configured in the Storage Class before the volumes are provisioned. (Also, the storage level encryption encrypts the data on the disk, but the broker will see them as unencrypted. So if you exec into the Pod you can basically see the data at rest).

[npandeya]

Thanks @scholzj . If you are coming to Kubecon next week we should catch up.
And also, when the TLS encryption for the connection to that listener is enabled that means consume request (from my consumer application to the Kafka listener) and produce request (from my producer application to the Kafka listener) is also encrypted right?

[scholzj]

If you are coming to Kubecon next week we should catch up.

I will be at KubeCon, yes. Feel free to ping me here or on Slack to sync up on some time.

And also, when the TLS encryption for the connection to that listener is enabled that means consume request (from my consumer application to the Kafka listener) and produce request (from my producer application to the Kafka listener) is also encrypted right?

Yes, correct.