How curityio/kafka-zero-trust works
Kafka Zero Trust is a demonstration of secure asynchronous messaging between an Orders API and an Invoices API. A user authenticates in the console client, submits an order through the gateway, and the Orders API prices and records it before exchanging the user token for a reduced-privilege, long-lived token bound to the event and transaction. It publishes the event to Kafka; the Invoices API validates the token before calculating and recording an invoice. The README documents this end-to-end behavior; some internal route and consumer wiring is not shown in the sampled source.
Main entry points: ordersService.ts Order service · invoicingService.ts Invoicing service · index.ts Console client · messageBroker.ts Kafka consumer
Components 20
Client access
- Console client
console-client/src/index.ts - OAuth login
console-client/src/oauthClient.ts - Order request
console-client/src/apiClient.ts - API gateway
api-gateway/kong-template.yml
Order processing
- Orders HTTP API
orders-api/src/infrastructure/httpServer.ts - Order service
orders-api/src/logic/ordersService.ts - Price calculator
orders-api/src/logic/priceCalculator.ts - Order transaction
orders-api/src/logic/orderTransaction.ts
Secure messaging
- Token exchange
orders-api/src/infrastructure/authorizer.ts - Order event
orders-api/src/logic/orderCreatedEvent.ts - Kafka producer
orders-api/src/infrastructure/messageBroker.ts - Kafka consumer
invoices-api/src/infrastructure/messageBroker.ts - Token validation
invoices-api/src/infrastructure/authorizer.ts
Invoice processing
- Invoices HTTP API
invoices-api/src/infrastructure/httpServer.ts - Invoicing service
invoices-api/src/logic/invoicingService.ts - Amount calculator
invoices-api/src/logic/invoiceCalculator.ts - Invoice
invoices-api/src/logic/invoice.ts
Other components
- User
- Identity server
- Kafka
Connections 21
- User → Console client: starts
- Console client → OAuth login: logs in
- OAuth login → Identity server: gets token
- Console client → Order request: submits order
- Order request → API gateway: sends request
- API gateway → Orders HTTP API: routes request
- Orders HTTP API → Order service: creates order
- Order service → Price calculator: calculates prices
- Order service → Order transaction: records transaction
- Order service → Token exchange: exchanges token
- Token exchange → Identity server: exchanges token
- Order service → Order event: builds event
- Order service → Kafka producer: publishes event
- Kafka producer → Kafka: sends message
- Kafka → Kafka consumer: delivers message
- Kafka consumer → Token validation: validates token
- Token validation → Identity server: checks token
- Kafka consumer → Invoicing service: processes event
- Invoices HTTP API → Invoicing service: handles request
- Invoicing service → Amount calculator: calculates amount
- Invoicing service → Invoice: records invoice