// Module included in the following assemblies:
//
// assembly-kafka-mirror-maker-authentication.adoc

[id='proc-configuring-kafka-mirror-maker-authentication-tls-{context}']
= Configuring TLS client authentication in Kafka MirrorMaker

.Prerequisites

* Source and target Kafka clusters are available
* A running Cluster Operator with a `tls` listener with `tls` authentication enabled
* If they exist, the name of the `Secret` with the public and private keys used for TLS Client Authentication, and the keys under which they are stored in the `Secret`

.Procedure

As the Kafka MirrorMaker connects to two Kafka clusters (source and target), you can choose to configure TLS client authentication for one or both of the clusters.
The following steps describe how to configure TLS client authentication on the consumer side for connecting to the source Kafka cluster:

. (Optional) If they do not already exist, prepare the keys used for authentication in a file and create the `Secret`:
+
[source,shell,subs=+quotes]
kubectl create secret generic _<my-secret>_ --from-file=_<my-public.crt>_ --from-file=_<my-private.key>_
+
NOTE: Secrets created by the User Operator may be used.

. Edit the `KafkaMirrorMaker.spec.consumer.authentication` property.
+
.An example TLS client authentication configuration
+
[source,yaml,subs=attributes+]
----
apiVersion: {KafkaApiVersion}
kind: KafkaMirrorMaker
metadata:
  name: my-mirror-maker
spec:
  # ...
  consumer:
    authentication:
      type: tls
      certificateAndKey:
        secretName: my-source-secret
        certificate: public.crt
        key: private.key
  # ...
  producer:
    authentication:
      type: tls
      certificateAndKey:
        secretName: my-target-secret
        certificate: public.crt
        key: private.key
  # ...
----

. Create or update the resource:
+
[source,shell,subs=+quotes]
kubectl apply -f _<your-file>_

Repeat the above steps for configuring TLS client authentication on the target Kafka cluster.
In this case, the secret containing the certificate has to be configured in the `KafkaMirrorMaker.spec.producer.authentication` property.
