// Module included in the following assemblies:
//
// assembly-securing-kafka.adoc

[id='proc-securing-kafka-{context}']
= Securing Kafka brokers

This procedure shows the steps involved in securing Kafka brokers when running Strimzi.

The security implemented for Kafka brokers must be compatible with the security implemented for the clients requiring access.

* `Kafka.spec.kafka.listeners[*].authentication` matches `KafkaUser.spec.authentication`
* `Kafka.spec.kafka.authorization` matches `KafkaUser.spec.authorization`

The steps show the configuration for simple authorization and a listener using TLS authentication.
For more information on listener configuration, see xref:type-GenericKafkaListener-reference[`GenericKafkaListener` schema reference].

Alternatively, you can use SCRAM-SHA or OAuth 2.0 for xref:con-securing-kafka-authentication-{context}[listener authentication],
and OAuth 2.0 or OPA for xref:con-securing-kafka-authorization-{context}[Kafka authorization].

.Procedure

. Configure the `Kafka` resource.
.. Configure the `authorization` property for authorization.
.. Configure the `listeners` property to create a listener with authentication.
+
For example:
+
[source,yaml,subs=attributes+]
----
apiVersion: {KafkaApiVersion}
kind: Kafka
spec:
  kafka:
    # ...
    authorization: <1>
      type: simple
      superUsers: <2>
        - CN=client_1
        - user_2
        - CN=client_3
    listeners:
      - name: tls
        port: 9093
        type: internal
        tls: true
        authentication:
          type: tls <3>
        useServiceDnsDomain: true <4>
    # ...
  zookeeper:
    # ...
----
<1> Authorization xref:con-securing-kafka-authorization-str[enables `simple` authorization on the Kafka broker using the `AclAuthorizer` Kafka plugin].
<2> List of user principals with unlimited access to Kafka. _CN_ is the common name from the client certificate when TLS authentication is used.
<3> Listener authentication mechanisms may be configured for each listener, and xref:assembly-securing-kafka-brokers-{context}[specified as mutual TLS, SCRAM-SHA-512 or token-based OAuth 2.0].
<4> Defines whether the fully-qualified DNS names including the cluster service suffix (usually `.cluster.local`) are assigned.
+
If you are configuring an external listener, the configuration is dependent on the chosen connection mechanism.

. Create or update the `Kafka` resource.
+
[source,shell,subs=+quotes]
kubectl apply -f _KAFKA-CONFIG-FILE_
+
The Kafka cluster is configured with a Kafka broker listener using TLS authentication.
+
A service is created for each Kafka broker pod.
+
A service is created to serve as the _bootstrap address_ for connection to the Kafka cluster.
+
The cluster CA certificate to verify the identity of the kafka brokers is also created with the same name as the `Kafka` resource.
