审计与保护 Schema Registry 访问

Teams secure brokers with SASL, ACLs, and TLS, but often leave the Schema Registry wide open. An attacker who can change schemas can break every consumer.

The registry controls the contracts between services. Threats include:

• Registering incompatible schemas to cause outages.
• Reading sensitive schema definitions.
• Deleting subjects.

First, serve the registry over TLS so credentials and schemas are encrypted in transit.

Protect the REST API with basic auth backed by a JAAS file. Clients must then present credentials.

Your Spring Boot app supplies the registry credentials so serializers can authenticate.

Grant least privilege:

• Producers need register and read on their own subjects.
• Consumers need only read.
• Only CI/CD or admins should delete.

Enforce a strict compatibility mode and forbid override so no client can weaken the contract checks.

Log every schema registration and deletion. Capture who, what subject, and which version, so you can trace a breaking change back to its source.

Place the registry on a private network segment. Only application services and CI should reach it; never expose it to the public internet.

Combine TLS, authentication, least-privilege roles, locked compatibility, audit logging, and network isolation. No single control is enough on its own.

Securing the registry completes your Kafka security story. Encrypt it, authenticate clients, restrict who can register or delete, and audit every change.

You learned to secure the Schema Registry.

• Serve it over TLS and require authentication.
• Apply least-privilege roles for register/read/delete.
• Lock the compatibility mode.
• Audit changes and isolate the registry on a private network.