// file included in the following:
//
// kroxylicious-operator/assemblies/assembly-operator-secure-proxy-broker-connection.adoc

[id='con-configuring-kafkaservice-cipher-{context}']
= TLS cipher suite configuration for proxy-to-cluster connections

include::../../snippets/snip-tls-cipher-suite.adoc[]

.Example `KafkaService` configured so that the proxy will negotiate TLS connection using only the listed ciphers.
[source,yaml]
----
kind: KafkaService
metadata:
  # ...
spec:
  bootstrapServers: kafka.example.com:9092
  tls:
    # ...
    cipherSuites: # <1>
      allow: # <2>
       - TLS_AES_128_GCM_SHA256
       - TLS_AES_256_GCM_SHA384
----
<1> The `cipherSuites` object configures the cipher suites.
<2> `allow` lists the cipher suites which are permitted.

The `cipherSuites` property also supports `deny`, if you prefer to list the cipher suites to exclude instead.

The names of the cipher suites supported depend on the JVM in the proxy container image.
See {cipherSuiteNames}.