Kafka security

What are folk currently doing to secure Kafka and Zk sockets in a cluster ?

Firewalls?
Ssh tunnels between machines in the cluster and wider servers?
Private hand cranked mods to the source code?
Other?

What's been seen to work out in the wild?

Thanks