// Module included in the following assemblies:
//
// assembly-kafka-broker-listener-network-policies.adoc

[id='proc-restricting-access-to-listeners-using-network-policies-{context}']
= Restricting access to Kafka listeners using network policies

You can restrict access to a listener to only selected applications by using the `networkPolicyPeers` property.

.Prerequisites

* A Kubernetes cluster with support for Ingress NetworkPolicies.
* The Cluster Operator is running.

.Procedure

. Open the `Kafka` resource.

. In the `networkPolicyPeers` property, define the application pods or namespaces that will be allowed to access the Kafka cluster.
+
For example, to configure a `tls` listener to allow connections only from application pods with the label `app` set to `kafka-client`:
+
[source,yaml,subs=attributes+]
----
apiVersion: {KafkaApiVersion}
kind: Kafka
spec:
  kafka:
    # ...
    listeners:
      - name: tls
        port: 9093
        type: internal
        tls: true
        authentication:
          type: tls
        networkPolicyPeers:
          - podSelector:
              matchLabels:
                app: kafka-client
    # ...
  zookeeper:
    # ...
----

. Create or update the resource.
+
Use `kubectl apply`:
[source,shell,subs=+quotes]
kubectl apply -f _your-file_

.Additional resources
* For more information about the schema, see the {K8sNetworkPolicyPeerAPI} and the xref:type-GenericKafkaListener-reference[`GenericKafkaListener` schema reference].
