:experimental:
include::_assets/attributes.adoc[]

:context: record-encryption
:guide: record-encryption

[id="using-book-{context}"]
= Record Encryption Guide

include::modules/record-encryption/con-about-{guide}-guide.adoc[leveloffset=+1]

[role="_abstract"]
The Kroxylicious Record Encryption filter enhances the security of Kafka messages.
The filter uses industry-standard cryptographic techniques to apply encryption to Kafka messages, ensuring the confidentiality of data stored in the Kafka Cluster.
By centralizing topic-level encryption, Kroxylicious provides streamlined protection across Kafka clusters.

To use the filter, follow these steps:

1. Set up a Key Management System (KMS)
2. Establish encryption keys within the KMS for securing the topics
3. Configure the filter within Kroxylicious

The filter integrates with a Key Management Service (KMS), which is responsible for the safe storage of sensitive key material.
Kroxylicious supports the following KMS providers:

* HashiCorp Vault
* AWS Key Management Service.
ifdef::include-fortanix-dsm-kms[]
* Fortanix DSM
endif::[]

You can provide implementations for your specific KMS systems.
Additional KMS support may be added based on demand.

//overview of the record encryption process
include::modules/record-encryption/con-record-encryption-overview.adoc[leveloffset=+1]

// preparing the KMS (might be done by a KMS admin, rather
// than the person setting up the filter)
include::assemblies/assembly-preparing-kms.adoc[leveloffset=+1]

//configuring the record encryption filter
include::assemblies/assembly-configuring-record-encryption-filter.adoc[leveloffset=+1]

//monitoring the record encryption filter
include::assemblies/assembly-monitoring-record-encryption-filter.adoc[leveloffset=+1]

//operational issues affecting the record encryption filter
include::assemblies/assembly-operations-record-encryption-filter.adoc[leveloffset=+1]

//trademark notices
include::_assets/trademarks.adoc[leveloffset=+1]