// Module included in the following assemblies:
//
// assembly-security.adoc

[id='tls-connections-{context}']
= TLS connections

== ZooKeeper communication

Communication between the ZooKeeper nodes on all ports, as well as between clients and ZooKeeper, is encrypted using TLS.

Communication between Kafka brokers and ZooKeeper nodes is also encrypted.

== Kafka inter-broker communication

Communication between Kafka brokers is always encrypted using TLS.
The connections between the Kafka controller and brokers use an internal _control plane listener_ on port 9090.
Replication of data between brokers, as well as internal connections from Strimzi operators, Cruise Control, or the Kafka Exporter use the _replication listener_ on port 9091.
These internal listeners are not available to Kafka clients.

== Topic and User Operators

All Operators use encryption for communication with both Kafka and ZooKeeper.
In Topic and User Operators, a TLS sidecar is used when communicating with ZooKeeper.

== Cruise Control

Cruise Control uses encryption for communication with both Kafka and ZooKeeper.
A TLS sidecar is used when communicating with ZooKeeper.

== Kafka Client connections

Encrypted or unencrypted communication between Kafka brokers and clients is configured using the `tls` property for `spec.kafka.listeners`.
