Configuration for Kafka listeners.

[id='property-listener-config-brokerCertChainAndKey-{context}']
=== `brokerCertChainAndKey`

The `brokerCertChainAndKey` property is only used with listeners that have TLS encryption enabled.
You can use the property to providing your own Kafka listener certificates.

.Example configuration for a `loadbalancer` external listener with TLS encryption enabled
[source,yaml,subs="attributes+"]
----
listeners:
  #...
  - name: external
    port: 9094
    type: loadbalancer
    tls: true
    authentication:
      type: tls
    configuration:
      brokerCertChainAndKey:
        secretName: my-secret
        certificate: my-listener-certificate.crt
        key: my-listener-key.key
# ...
----

[id='property-listener-config-traffic-policy-{context}']
=== `externalTrafficPolicy`

The `externalTrafficPolicy` property is used with `loadbalancer` and `nodeport` listeners.
When exposing Kafka outside of Kubernetes you can choose `Local` or `Cluster`.
`Local` avoids hops to other nodes and preserves the client IP, whereas `Cluster` does neither.
The default is `Cluster`.

[id='property-listener-config-source-ranges-{context}']
=== `loadBalancerSourceRanges`

The `loadBalancerSourceRanges` property is only used with `loadbalancer` listeners.
When exposing Kafka outside of Kubernetes use source ranges, in addition to labels and annotations, to customize how a service is created.

.Example source ranges configured for a loadbalancer listener
[source,yaml,subs=attributes+]
----
listeners:
  #...
  - name: external
    port: 9094
    type: loadbalancer
    tls: false
    configuration:
      externalTrafficPolicy: Local
      loadBalancerSourceRanges:
        - 10.0.0.0/8
        - 88.208.76.87/32
      # ...
# ...
----

[id='property-listener-config-class-{context}']
=== `class`

The `class` property is only used with `ingress` listeners.
You can configure the `Ingress` class using the `class` property.

.Example of an external listener of type `ingress` using `Ingress` class `nginx-internal`
[source,yaml,subs="attributes+"]
----
listeners:
  #...
  - name: external
    port: 9094
    type: ingress
    tls: true
    configuration:
      class: nginx-internal
    # ...
# ...
----

[id='property-listener-config-preferredNodePortAddressType-{context}']
=== `preferredNodePortAddressType`

The `preferredNodePortAddressType` property is only used with `nodeport` listeners.

Use the `preferredNodePortAddressType` property in your listener configuration to specify the first address type checked as the node address.
This property is useful, for example, if your deployment does not have DNS support, or you only want to expose a broker internally through an internal DNS or IP address.
If an address of this type is found, it is used.
If the preferred address type is not found, Strimzi proceeds through the types in the standard order of priority:

. ExternalDNS
. ExternalIP
. Hostname
. InternalDNS
. InternalIP

.Example of an external listener configured with a preferred node port address type
[source,yaml,subs=attributes+]
----
listeners:
  #...
  - name: external
    port: 9094
    type: nodeport
    tls: false
    configuration:
      preferredNodePortAddressType: InternalDNS
      # ...
# ...
----

[id='property-listener-config-dns-{context}']
=== `useServiceDnsDomain`

The `useServiceDnsDomain` property is only used with `internal` listeners.
It defines whether the fully-qualified DNS names that include the cluster service suffix (usually `.cluster.local`) are used.
With `useServiceDnsDomain` set as `false`, the advertised addresses are generated without the service suffix; for example, `my-cluster-kafka-0.my-cluster-kafka-brokers.myproject.svc`.
With `useServiceDnsDomain` set as `true`, the advertised addresses are generated with the service suffix; for example, `my-cluster-kafka-0.my-cluster-kafka-brokers.myproject.svc.cluster.local`.
Default is `false`.

.Example of an internal listener configured to use the Service DNS domain
[source,yaml,subs=attributes+]
----
listeners:
  #...
  - name: plain
    port: 9092
    type: internal
    tls: false
    configuration:
      useServiceDnsDomain: true
      # ...
# ...
----

If your Kubernetes cluster uses a different service suffix than `.cluster.local`, you can configure the suffix using the `KUBERNETES_SERVICE_DNS_DOMAIN` environment variable in the Cluster Operator configuration.
See xref:ref-operator-cluster-str[] for more details.
