// Module included in the following assemblies:
//
// assembly-zookeeper-node-configuration.adoc

[id='ref-zookeeper-node-configuration-{context}']
= ZooKeeper configuration

ZooKeeper nodes are configured using the `config` property in `Kafka.spec.zookeeper`.
This property contains the ZooKeeper configuration options as keys.
The values can be described using one of the following JSON types:

* String
* Number
* Boolean

Users can specify and configure the options listed in {ApacheZookeeperConfig} with the exception of those options which are managed directly by Strimzi.
Specifically, all configuration options with keys equal to or starting with one of the following strings are forbidden:

* `server.`
* `dataDir`
* `dataLogDir`
* `clientPort`
* `authProvider`
* `quorum.auth`
* `requireClientAuthScheme`

When one of the forbidden options is present in the `config` property, it is ignored and a warning message is printed to the Cluster Operator log file.
All other options are passed to ZooKeeper.

IMPORTANT: The Cluster Operator does not validate keys or values in the provided `config` object.
When invalid configuration is provided, the ZooKeeper cluster might not start or might become unstable.
In such cases, the configuration in the `Kafka.spec.zookeeper.config` object should be fixed and the Cluster Operator will roll out the new configuration to all ZooKeeper nodes.

Selected options have default values:

* `timeTick` with default value `2000`
* `initLimit` with default value `5`
* `syncLimit` with default value `2`
* `autopurge.purgeInterval` with default value `1`

These options will be automatically configured when they are not present in the `Kafka.spec.zookeeper.config` property.

Use the three allowed `ssl` configuration options for client connection using a specific _cipher suite_ for a TLS version.
A cipher suite combines algorithms for secure connection and data transfer.

.Example ZooKeeper configuration
[source,yaml,subs="attributes+"]
----
apiVersion: {KafkaApiVersion}
kind: Kafka
spec:
  kafka:
    # ...
  zookeeper:
    # ...
    config:
      autopurge.snapRetainCount: 3
      autopurge.purgeInterval: 1
      ssl.cipher.suites: "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" <1>
      ssl.enabled.protocols: "TLSv1.2" <2>
      ssl.protocol: "TLSv1.2" <3>
    # ...
----
<1> The cipher suite for TLS using a combination of `ECDHE` key exchange mechanism, `RSA` authentication algorithm,
`AES` bulk encyption algorithm and `SHA384` MAC algorithm.
<2> The SSl protocol `TLSv1.2` is enabled.
<3> Specifies the `TLSv1.2` protocol to generate the SSL context.
Allowed values are `TLSv1.1` and `TLSv1.2`.
