// Module included in the following assemblies:
//
// assembly-evaluation.adoc

[id='proc-enabling-tls-{context}']
= Accessing the cluster

In this procedure you obtain a loadbalancer address and truststore, which are used to access your cluster.

As `loadbalancer` is used for external access to the cluster, a cluster CA certificate is required to enable TLS (Transport Layer Security) encryption between the broker and the client.

.Prerequisites

* A Kafka cluster running within the Kubernetes cluster
* A running Cluster Operator

.Procedure

. Find the IP address of the bootstrap `loadbalancer`:
+
[source, shell, subs=+quotes]
----
kubectl get service my-cluster-kafka-external-bootstrap -o=jsonpath='{.status.loadBalancer.ingress[0].ip}{"\n"}'
----
+
You will use the IP address together with port 9094 in your Kafka client as the bootstrap address for your consumer and producer.

. Extract the public certificate of the broker certification authority:
+
[source, shell, subs=+quotes]
----
kubectl get secret my-cluster-cluster-ca-cert -o jsonpath='{.data.ca\.crt}' | base64 -d > ca.crt
----

. Import the trusted certificate to a truststore:
+
[source, shell, subs=+quotes]
----
keytool -keystore client.truststore.jks -alias CARoot -import -file ca.crt
----
+
You now have the information needed to start sending and receiving messages.
