// Module included in the following assemblies:
//
// assembly-using-the-user-operator.adoc

[id='proc-configuring-kafka-user-{context}']
= Securing user access to Kafka

Use the properties of the `KafkaUser` resource to configure a Kafka user.

You can use `kubectl apply` to create or modify users, and `kubectl delete` to delete existing users.

For example:

* `kubectl apply -f _USER-CONFIG-FILE_`
* `kubectl delete KafkaUser _USER-NAME_`

When you configure the `KafkaUser` authentication and authorization mechanisms, ensure they match the equivalent `Kafka` configuration:

* `KafkaUser.spec.authentication` matches `Kafka.spec.kafka.listeners[*].authentication`
* `KafkaUser.spec.authorization` matches `Kafka.spec.kafka.authorization`

This procedure shows how a user is created with TLS authentication.
You can also create a user with SCRAM-SHA authentication.

The authentication required depends on the xref:con-securing-kafka-authentication-{context}[type of authentication configured for the Kafka broker listener].

NOTE: Authentication between Kafka users and Kafka brokers depends on the authentication settings for each.
For example, it is not possible to authenticate a user with TLS if it is not also enabled in the Kafka configuration.

.Prerequisites

* A running Kafka cluster xref:con-mutual-tls-authentication-{context}[configured with a Kafka broker listener using TLS authentication and encryption].
* A running User Operator (typically xref:assembly-kafka-entity-operator-str[deployed with the Entity Operator]).

The authentication type in `KafkaUser` should match the authentication configured in `Kafka` brokers.

.Procedure

. Configure the `KafkaUser` resource.
+
For example:
+
[source,yaml,subs="attributes+"]
----
apiVersion: {KafkaUserApiVersion}
kind: KafkaUser
metadata:
  name: my-user
  labels:
    strimzi.io/cluster: my-cluster
spec:
  authentication: <1>
    type: tls
  authorization:
    type: simple <2>
    acls:
      - resource:
          type: topic
          name: my-topic
          patternType: literal
        operation: Read
      - resource:
          type: topic
          name: my-topic
          patternType: literal
        operation: Describe
      - resource:
          type: group
          name: my-group
          patternType: literal
        operation: Read
----
<1> User authentication mechanism, defined as mutual `tls` or `scram-sha-512`.
<2> Simple authorization, which requires an accompanying list of ACL rules.

. Create or update the `KafkaUser` resource.
+
[source,shell,subs=+quotes]
kubectl apply -f _USER-CONFIG-FILE_
+
The user is created, as well as a Secret with the same name as the `KafkaUser` resource.
The Secret contains a private and public key for TLS client authentication.

For information on configuring a Kafka client with properties for secure connection to Kafka brokers, see link:{BookURLDeploying}#setup-external-clients-str[Setting up access for clients outside of Kubernetes^] in the _Deploying and Upgrading Strimzi_ guide.
