// Module included in the following assemblies:
//
// assembly-kafka-broker-listener-network-policies.adoc

[id='ref-kafka-listener-network-policy-example-{context}']
= Network policy configuration for a listener

The following example shows a `networkPolicyPeers` configuration for a `plain` and a `tls` listener:

[source,yaml,subs="attributes+"]
----
# ...
listeners:
  plain:
    authentication:
      type: scram-sha-512
    networkPolicyPeers:
      - podSelector:
          matchLabels:
            app: kafka-sasl-consumer
      - podSelector:
          matchLabels:
            app: kafka-sasl-producer
  tls:
    authentication:
      type: tls
    networkPolicyPeers:
      - namespaceSelector:
          matchLabels:
            project: myproject
      - namespaceSelector:
          matchLabels:
            project: myproject2
# ...
----

In the example:

* Only application pods matching the labels `app: kafka-sasl-consumer` and `app: kafka-sasl-producer` can connect to the `plain` listener.
The application pods must be running in the same namespace as the Kafka broker.
* Only application pods running in namespaces matching the labels `project: myproject` and `project: myproject2` can connect to the `tls` listener.

The syntax of the `networkPolicyPeers` field is the same as the `from` field in `NetworkPolicy` resources.
For more information about the schema, see {K8sNetworkPolicyPeerAPI} and the xref:type-KafkaListeners-reference[`KafkaListeners` schema reference].

NOTE: Your configuration of Kubernetes must support ingress NetworkPolicies in order to use network policies in {ProductName}.
