// This assembly is included in the following assemblies:
//
// // assembly-securing-access.adoc

[id='assembly-securing-kafka-{context}']
= Securing access to Kafka brokers

[role="_abstract"]
To establish secure access to Kafka brokers, you configure and apply:

* A `Kafka` resource to:
** Create listeners with a specified authentication type
** Configure authorization for the whole Kafka cluster
* A `KafkaUser` resource to access the Kafka brokers securely through the listeners

Configure the `Kafka` resource to set up:

* Listener authentication
* Network policies that restrict access to Kafka listeners
* Kafka authorization
* Super users for unconstrained access to brokers

Authentication is configured independently for each listener.
Authorization is always configured for the whole Kafka cluster.

The Cluster Operator creates the listeners and sets up the cluster and client certificate authority (CA) certificates to enable authentication within the Kafka cluster.

You can replace the certificates generated by the Cluster Operator by xref:installing-your-own-ca-certificates-str[installing your own certificates].

You can also provide your own server certificates and private keys for any listener with TLS encryption enabled.
These user-provided certificates are called _Kafka listener certificates_.
Providing Kafka listener certificates allows you to leverage existing security infrastructure, such as your organization's private CA or a public CA.
Kafka clients will need to trust the CA which was used to sign the listener certificate.
You must manually renew Kafka listener certificates when needed.
Certificates are available in PKCS #12 format (.p12) and PEM (.crt) formats.

Use `KafkaUser` to enable the authentication and authorization mechanisms that a specific client uses to access Kafka.

Configure the `KafkaUser` resource to set up:

* Authentication to match the enabled listener authentication
* Authorization to match the enabled Kafka authorization
* Quotas to control the use of resources by clients

The User Operator creates the user representing the client and the security credentials used for client authentication, based on the chosen authentication type.

Refer to the schema reference for more information on access configuration properties:

* link:{BookURLConfiguring}#type-Kafka-reference[`Kafka` schema reference^]
* link:{BookURLConfiguring}#type-KafkaUser-reference[`KafkaUser` schema reference^]
* link:{BookURLConfiguring}#type-GenericKafkaListener-reference[`GenericKafkaListener` schema reference^]

//steps to secure the brokers
include::../../modules/security/proc-securing-kafka.adoc[leveloffset=+1]
include::../../modules/security/proc-configuring-secure-kafka-user.adoc[leveloffset=+1]
include::../../modules/security/proc-restricting-access-to-listeners-using-network-policies.adoc[leveloffset=+1]
//using listener certificates
include::../../modules/security/proc-installing-certs-per-listener.adoc[leveloffset=+1]
include::../../modules/security/ref-alternative-subjects-certs-for-listeners.adoc[leveloffset=+1]
