Event-Driven Notification Platform · View 25 of 26 · 6 · Assurance
Identity and Access — Producer Authentication
How a producing workload proves who it is without ever holding a long-lived secret.
Copy
PNG
PDF
⋯
Editable source
SVG
draw.io
All views
Producer workload
Producer workload
SPIRE Agent
SPIRE Agent
Keycloak
Keycloak
Envoy Gateway
Envoy Gateway
Ingest API
Ingest API
Kafka
Kafka
Vault
Vault
1. attest workload
1. attest workload
2. X.509 SVID · 1 h
2. X.509 SVID · 1 h
3. client_credentials grant
3. client_credentials grant
4. JWT · tenant_id · scopes · 15 min
4. JWT · tenant_id · scopes · 15 min
5. POST /v1/events · mTLS plus bearer
5. POST /v1/events · mTLS plus bearer
6. SPIFFE ID against tenant allow-list
6. SPIFFE ID against tenant allow-list
7. JWKS · cached 10 min
7. JWKS · cached 10 min
8. forward with verified claims
8. forward with verified claims
9. scope events:write · tenant match
9. scope events:write · tenant match
10. lease database credential · 1 h
10. lease database credential · 1 h
11. dynamic credential
11. dynamic credential
12. produce as tenant principal
12. produce as tenant principal
13. ACL denied · wrong tenant topic
13. ACL denied · wrong tenant topic
14. 202 Accepted · event_id
14. 202 Accepted · event_id
Identity and Access — Producer Authentication
Identity and Access — Producer Authentication
No long-lived secret is issued to a producer. The mTLS identity proves the workload, the JWT carries the tenant, and Kafka enforces the same tenant a second time so a bug in the API cannot cross a tenant boundary.
No long-lived secret is issued to a producer. The mTLS identity proves the workload, the JWT carries the tenant, and Kafka enforces the same tenant a second time so a bug in the API cannot cross a tenant boundary.
v 1.0 · owner Security Architecture · date 2026-08
v 1.0 · owner Security Architecture · date 2026-08
Text is not SVG - cannot display
Decisions
Two independent proofs: SPIRE attests the workload with a one-hour X.509 identity, Keycloak issues a 15-minute JWT carrying the tenant
Neither is sufficient alone, so a leaked token without the matching workload identity is unusable
Database and provider credentials are Vault leases, so nothing durable exists to steal
Defence in depth
Kafka enforces the tenant a second time by ACL, so a bug in the Ingest API cannot cross a tenant boundary
JWKS is cached for 10 minutes, bounding the window in which a revoked key still validates
Every admin action carries the acting identity into the audit record, not just the service account
Assumptions
Producers run in an environment SPIRE can attest — Kubernetes or a supported node attestor
Legacy producers that cannot do mTLS use a scoped API key with a documented lower trust level and a shorter quota; that exception has an expiry date
◀ Security Architecture — Trust Zones
All views
Failure Modes and Disaster Recovery ▶
