// This assembly is included in the following assemblies:
//
// assembly-kafka-bridge-overview.adoc

[id='con-securing-kafka-bridge-{context}']

= Securing the Kafka Bridge

Strimzi does not currently provide any encryption, authentication, or authorization for the Kafka Bridge. This means that requests sent from external clients to the Kafka Bridge are:

* Not encrypted, and must use HTTP rather than HTTPS

* Sent without authentication

However, you can secure the Kafka Bridge using other methods, such as:

* Kubernetes Network Policies that define which pods can access the Kafka Bridge.

* Reverse proxies with authentication or authorization, for example, OAuth2 proxies.

* API Gateways.

* Ingress or OpenShift Routes with TLS termination.

The Kafka Bridge supports TLS encryption and TLS and SASL authentication when connecting to the Kafka Brokers. Within your Kubernetes cluster, you can configure:

* TLS or SASL-based authentication between the Kafka Bridge and your Kafka cluster

* A TLS-encrypted connection between the Kafka Bridge and your Kafka cluster.

For more information, see xref:proc-config-kafka-bridge-str[]. 

You can use ACLs in Kafka brokers to restrict the topics that can be consumed and produced using the Kafka Bridge.
