[id='proc-kafka-jmx-options-{context}']
= Configuring JMX options

Prerequisites

* A Kubernetes cluster
* A running Cluster Operator

You can configure JMX options by using the `jmxOptions` property in the following resources:

* `Kafka.spec.kafka`

You can configure username and password protection for the JMX port that is opened on the Kafka brokers.

.Securing the JMX Port
You can secure the JMX port to prevent unauthorized pods from accessing the port.
Currently the JMX port can only be secured using a username and password.
To enable security for the JMX port, set the `type` parameter in the `authentication` field to `password`.:
[source,yaml,subs=attributes+]
----
apiVersion: {KafkaApiVersion}
kind: Kafka
metadata:
  name: my-cluster
spec:
  kafka:
    # ...
    jmxOptions:
      authentication:
        type: "password"
    # ...
  zookeeper:
    # ...
----
This allows you to deploy a pod internally into a cluster and obtain JMX metrics by using the headless
service and specifying which broker you want to address.
To get JMX metrics from broker _0_ we address the headless service appending broker _0_ in front of the headless service:
[source,shell,subs="+quotes,attributes"]
----
"_<cluster-name>_-kafka-0-_<cluster-name>_-_<headless-service-name>_"
----
If the JMX port is secured, you can get the username and password by referencing them from the JMX secret in the
deployment of your pod.

.Using an open JMX port
To disable security for the JMX port, do not fill in the `authentication` field
[source,yaml,subs=attributes+]
----
apiVersion: {KafkaApiVersion}
kind: Kafka
metadata:
  name: my-cluster
spec:
  kafka:
    # ...
    jmxOptions: {}
    # ...
  zookeeper:
    # ...
----

This will just open the JMX Port on the headless service and you can follow a similar approach as described above
to deploy a pod into the cluster.
The only difference is that any pod will be able to read from the JMX port.