To use TLS client authentication, set the `type` property to the value `tls`.
TLS client authentication uses a TLS certificate to authenticate.

=== `certificateAndKey`

The certificate is specified in the `certificateAndKey` property and is always loaded from a Kubernetes secret.
In the secret, the certificate must be stored in X509 format under two different keys: public and private.

You can use the secrets created by the User Operator,
or you can create your own TLS certificate file, with the keys used for authentication, then create a `Secret` from the file:

[source,shell,subs=+quotes]
kubectl create secret generic _MY-SECRET_ \
--from-file=_MY-PUBLIC-TLS-CERTIFICATE-FILE.crt_ \
--from-file=_MY-PRIVATE.key_

NOTE: TLS client authentication can only be used with TLS connections.

.Example TLS client authentication configuration
[source,yaml,subs=attributes+]
----
authentication:
  type: tls
  certificateAndKey:
    secretName: my-secret
    certificate: my-public-tls-certificate-file.crt
    key: private.key
----
