// file included in the following:
//
// kroxylicious-operator/assemblies/assembly-operator-secure-client-proxy-connection.adoc

[id='con-kafka-client-tls-protocol-{context}']
= TLS version configuration for client-to-proxy connections

include::../../snippets/snip-tls-protocol-versions.adoc[]

You can restrict which TLS protocol versions the proxy supports for client-to-proxy connections by configuring the `protocols` property.

.Example `VirtualKafkaCluster` with restricted TLS protocol versions
[source,yaml]
----
kind: VirtualKafkaCluster
metadata:
  # ...
spec:
  # ...
  ingresses:
    - ingressRef:
        name: cluster-ip
      tls:
        certificateRef:
          # ...
        protocols: # <1>
          allow: # <2>
            - TLSv1.3
----
<1> Configures the TLS protocol versions used by the proxy.
<2> Lists the protocol versions explicitly allowed for TLS negotiation.

Alternatively, you can use `deny` to specify protocol versions to exclude.

The names of the TLS protocol versions supported depend on the JVM in the proxy container image.
See {tlsProtocolNames}.