// file included in the following:
//
// kroxylicious-operator/assemblies/assembly-operator-secure-proxy-broker-connection.adoc

[id='con-configuring-kafkaservice-protocol-{context}']
= TLS version configuration for proxy-to-cluster connections

include::../../snippets/snip-tls-protocol-versions.adoc[]

This example configures a `KafkaService` to allow only TLS v1.3 when connecting to `kafka.example.com`.

.Example `KafkaService` with restricted TLS protocol versions.
[source,yaml]
----
kind: KafkaService
metadata:
  # ...
spec:
  bootstrapServers: kafka.example.com:9092
  tls:
    # ...
    protocols: # <1>
      allow: # <2>
        - TLSv1.3
----
<1> The `protocols` property configures the TLS protocol versions
<2> `allow` lists the versions of TLS which are permitted.

The `protocols` property also supports `deny`, if you prefer to list the versions to exclude instead.

The names of the TLS protocol versions supported depend on the JVM in the proxy container image.
See {tlsProtocolNames}.