// Module included in the following assemblies:
//
// assembly-kafka-bridge-configuration.adoc

[id='ref-kafka-bridge-consumer-configuration-{context}']
= Kafka Bridge Consumer configuration

Kafka Bridge consumer is configured using the properties in `KafkaBridge.spec.consumer`.
This property contains the Kafka Bridge consumer configuration options as keys.
The values can be one of the following JSON types:

* String
* Number
* Boolean

Users can specify and configure the options listed in the {ApacheKafkaConsumerConfig} with the exception of those options which are managed directly by Strimzi.
Specifically, all configuration options with keys equal to or starting with one of the following strings are forbidden:

* `ssl.`
* `sasl.`
* `security.`
* `bootstrap.servers`
* `group.id`

When one of the forbidden options is present in the `config` property, it will be ignored and a warning message will be printed to the Cluster Operator log file.
All other options will be passed to Kafka

IMPORTANT: The Cluster Operator does not validate keys or values in the `config` object provided.
When an invalid configuration is provided, the Kafka Bridge cluster might not start or might become unstable.
In this circumstance, fix the configuration in the `KafkaBridge.spec.consumer.config` object, then the Cluster Operator can roll out the new configuration to all Kafka Bridge nodes.

There are exceptions to the forbidden options.
You can use three allowed `ssl` configuration options for client connection using a specific _cipher suite_ for a TLS version.
A cipher suite combines algorithms for secure connection and data transfer.
You can also configure the `ssl.endpoint.identification.algorithm` property to enable or disable hostname verification.

.Example Kafka Bridge consumer configuration
[source,yaml,subs="attributes+"]
----
apiVersion: {KafkaApiVersionPrev}
kind: KafkaBridge
metadata:
  name: my-bridge
spec:
  # ...
  consumer:
    config:
      auto.offset.reset: earliest
      enable.auto.commit: true
      ssl.cipher.suites: "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" <1>
      ssl.enabled.protocols: "TLSv1.2" <2>
      ssl.protocol: "TLSv1.2" <3>
      ssl.endpoint.identification.algorithm: HTTPS <4>
    # ...
----
<1> The cipher suite for TLS using a combination of `ECDHE` key exchange mechanism, `RSA` authentication algorithm,
`AES` bulk encyption algorithm and `SHA384` MAC algorithm.
<2> The SSl protocol `TLSv1.2` is enabled.
<3> Specifies the `TLSv1.2` protocol to generate the SSL context.
Allowed values are `TLSv1.1` and `TLSv1.2`.
<4> Hostname verification is enabled by setting to `HTTPS`. An empty string disables the verification.
