Configures a Kafka cluster.

[id='property-kafka-listeners-{context}']
=== `listeners`

Use the `listeners` property to configure listeners to provide access to Kafka brokers.

.Example configuration of a plain (unencrypted) listener without authentication

[source,yaml,subs=attributes+]
----
apiVersion: {KafkaApiVersion}
kind: Kafka
spec:
  kafka:
    # ...
    listeners:
      - name: plain
        port: 9092
        type: internal
        tls: false
    # ...
  zookeeper:
    # ...
----

[id='property-kafka-config-{context}']
=== `config`

Use the `config` properties to configure Kafka brokers as keys with values in one of the following JSON types:

* String
* Number
* Boolean

You can specify and configure all of the options in the "Broker Configs" section of the {ApacheKafkaBrokerConfig} apart from those managed directly by Strimzi.
Specifically, all configuration options with keys equal to or starting with one of the following strings are forbidden:

* `listeners`
* `advertised.`
* `broker.`
* `listener.`
* `host.name`
* `port`
* `inter.broker.listener.name`
* `sasl.`
* `ssl.`
* `security.`
* `password.`
* `principal.builder.class`
* `log.dir`
* `zookeeper.connect`
* `zookeeper.set.acl`
* `authorizer.`
* `super.user`

When a forbidden option is present in the `config` property, it is ignored and a warning message is printed to the Cluster Operator log file.
All other supported options are passed to Kafka.

There are exceptions to the forbidden options.
For client connection using a specific _cipher suite_ for a TLS version, you can xref:con-common-configuration-ssl-reference[configure allowed `ssl` properties].
You can also configure the `zookeeper.connection.timeout.ms` property to set the maximum time allowed for establishing a ZooKeeper connection.

.Example Kafka broker configuration
[source,yaml,subs="attributes+"]
----
apiVersion: {KafkaApiVersion}
kind: Kafka
metadata:
  name: my-cluster
spec:
  kafka:
    # ...
    config:
      num.partitions: 1
      num.recovery.threads.per.data.dir: 1
      default.replication.factor: 3
      offsets.topic.replication.factor: 3
      transaction.state.log.replication.factor: 3
      transaction.state.log.min.isr: 1
      log.retention.hours: 168
      log.segment.bytes: 1073741824
      log.retention.check.interval.ms: 300000
      num.network.threads: 3
      num.io.threads: 8
      socket.send.buffer.bytes: 102400
      socket.receive.buffer.bytes: 102400
      socket.request.max.bytes: 104857600
      group.initial.rebalance.delay.ms: 0
      ssl.cipher.suites: "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
      ssl.enabled.protocols: "TLSv1.2"
      ssl.protocol: "TLSv1.2"
      zookeeper.connection.timeout.ms: 6000
    # ...
----
