From prodsec-skills
Secures Kafka and AMQ Streams deployments with TLS encryption, SASL/SSL authentication, and ACL/OPA authorization. Useful when configuring brokers, custom resources, or client connectivity.
How this skill is triggered — by the user, by Claude, or both
Slash command
/prodsec-skills:kafka-amq-securityThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
By default, Kafka transmits data in **plaintext**, leaving it vulnerable to man-in-the-middle attacks.
By default, Kafka transmits data in plaintext, leaving it vulnerable to man-in-the-middle attacks.
AMQ Streams encrypts communication between brokers and operators using TLS by default. Client encryption depends on Kafka listener configuration:
Use SSL or SASL for client-to-broker and broker-to-broker authentication:
| Method | Use Case |
|---|---|
| SSL (mutual TLS) | Most common for managed services; two-way certificate authentication |
| SASL SCRAM-SHA-512 | Password-based; suitable for environments without certificate infrastructure |
| SASL Kerberos | Enterprise environments with existing Kerberos infrastructure |
| OAuth 2.0 | Token-based; integrates with RHSSO/Keycloak |
Authentication is disabled by default in AMQ Streams. Enable it per listener in the Kafka custom resource:
authentication property on each broker listenerLimit which clients can read and write to specific topics:
| Mechanism | Description |
|---|---|
| Simple ACL | Default Apache Kafka ACL plugin; rules stored in ZooKeeper, loaded at broker startup |
| OAuth 2.0 / Keycloak | Authorization rules managed in RHSSO/Keycloak; requires OAuth authentication |
| Open Policy Agent (OPA) | Externalized policy engine for fine-grained authorization |
Authorization is configured via the authorization property in the Kafka custom resource. If omitted, authorization is disabled.
npx claudepluginhub redhatproductsecurity/prodsec-skills --plugin prodsec-skillsAudits Kafka security configuration across codebase and live cluster via Lenses MCP. Checks SASL, SSL/TLS, ACLs, and credentials.
Guides securing MQTT broker and client deployments with authentication, topic ACLs, TLS, and payload encryption. Use when building, reviewing, or auditing MQTT or IoT messaging security.
Architect, build, and debug Kafka Streams apps (JVM-embedded stream processing). Use when user mentions KStream, KTable, topology, TopologyTestDriver, StreamsBuilder, interactive queries, GlobalKTable, joins/windows/aggregations, or debugging issues (rebalancing, state stores, lag, deserialization errors). Do NOT trigger for Flink, connectors, CDC, or plain producer/consumer.