// file included in the following:
//
// kroxylicious-operator/assemblies/assembly-operator-secure-client-proxy-connection.adoc

[id='con-kafka-client-mtls-{context}']
= Mutual TLS configuration for client-to-proxy connections

You can configure a virtual cluster ingress to request or require Kafka clients to authenticate to the proxy using TLS.
This configuration is known as mutual TLS (mTLS), because both the client and the proxy authenticate each other using TLS.

.Example `VirtualKafkaCluster` configuration requiring clients to present a trusted certificate
[source,yaml]
----
kind: VirtualKafkaCluster
metadata:
  # ...
spec:
  # ...
  ingresses:
    - ingressRef:
        name: cluster-ip
      tls:
        certificateRef:
          # ...
        trustAnchorRef: # <1>
          kind: ConfigMap # <2>
          name: trusted-cas # <3>
          key: trusted-cas.pem # <4>
        tlsClientAuthentication: REQUIRED <5>
----
<1> References a separate Kubernetes resource containing the trusted CA certificates.
<2> The `kind` is optional and defaults to `ConfigMap`.
<3> Name of the resource of the given `kind`, which must exist in the same namespace as the `VirtualKafkaCluster`.
<4> Key identifying the entry in the given resource. The corresponding value must be a set of CA certificates. Supported formats for the bundle are: `PEM`, `PKCS#12`, and `JKS`.
<5> Specifies whether client authentication is required (`REQUIRED`), requested (`REQUESTED`), or disabled (`NONE`). If a `trustAnchorRef` is specified, the default is `REQUIRED`.
