In this hands-on example we send end-to-end encrypted messages through Apache Kafka.

Ockam encrypts messages from a Producer to a specific Consumer. Only that specific Consumer can decrypt these messages. This guarantees that your data cannot be observed or tampered as it passes through Kafka. Operators of the Kafka cluster only see end-to-end encrypted data. Any compromise of an operator's infrastructure cannot compromise your business data.

To learn how end-to-end trust is established, please read: “How does Ockam work?


This example requires Bash, Git, Curl, Docker, and Docker Compose. Please set up these tools for your operating system, then run the following commands:

# Clone the Ockam repo from Github.
git clone --depth 1 && cd ockam

# Navigate to this example’s directory.
cd examples/command/portals/kafka/apache/docker/

# Run the example, use Ctrl-C to exit at any point.

If everything runs as expected, you'll see the message: The example run was successful 🥳


The script that you ran above, and its accompanying files, are full of comments and meant to be read. The example setup is only a few simple steps, so please take some time to read and explore.


Kafka Operator

# Create a dedicated and isolated virtual network for kafka_operator.
    driver: bridge

Application Team

# Create a dedicated and isolated virtual network for application_team.
    driver: bridge


We sent end-to-end encrypted messages through Apache Kafka.

Messages are encrypted with strong forward secrecy as soon as they leave a Producer, and only the intended Consumer can decrypt those messages. Kafka brokers and other Consumers can only see encrypted messages.

All communication is mutually authenticated and authorized. Keys and credentials are automatically rotated. Access can be easily revoked.


To delete all containers and images:

./ cleanup

Last updated