Apache Kafka (KRaft, Hardened) — security notes

• No shared or default credentials are included in this image. Access uses the SSH key you supply at launch; any application credential is generated uniquely on your instance at first boot and stored only there — we never know it.
• Telemetry: none. Our images contain no phone-home, no usage beacons, no license servers. The only parties that know you deployed our software are you and your cloud provider's billing system.
• We have no access to your deployment. Your instance runs in your tenancy under your IAM; remote access for a support session exists only if you explicitly grant it, and you can revoke it at any time.
• Rebuild cadence: every image is rebuilt at least monthly against current OS security advisories, and event-driven when a critical CVE with an available fix lands. Vulnerability scanning gates every build.
• Report a vulnerability: disclosure policy.

Network exposure

Port	Purpose	State
22	SSH (key-only)	default-open
9092	Kafka broker — advertised as localhost (single-node evaluation posture)	customer-must-open (config + firewall)
9093	KRaft controller — localhost	optional

"customer-must-open" means a cloud firewall rule and, where noted, an in-image configuration change — both deliberate. Closed by default is the design.

Shared responsibility

We maintain	The hardened image: package selection, hardening baseline, CVE rebuilds, listing freshness, and these docs.
You control	The running instance: OS patching between image versions, network exposure, IAM, data, and backups.
Your cloud provides	Physical/hypervisor security, marketplace billing, and the firewall primitives this design relies on.