// This assembly is included in the following assemblies:
//
// master.adoc

[id='security-{context}']
= Security

{ProductName} supports encrypted communication between the Kafka and {ProductName} components using the TLS protocol.
Communication between Kafka brokers (interbroker communication), between ZooKeeper nodes (internodal communication), and between these and the {ProductName} operators is always encrypted.
Communication between Kafka clients and Kafka brokers is encrypted according to how the cluster is configured.
For the Kafka and {ProductName} components, TLS certificates are also used for authentication.

The Cluster Operator automatically sets up and renews TLS certificates to enable encryption and authentication within your cluster.
It also sets up other TLS certificates if you want to enable encryption or TLS authentication between Kafka brokers and clients.
Certificates provided by users are not renewed.

You can provide your own server certificates, called _Kafka listener certificates_, for TLS listeners or external listeners which have TLS encryption enabled. 
For more information, see xref:kafka-listener-certificates-str[].

ifdef::SecurityImg[]

.Example architecture diagram of the communication secured by TLS.
image::secure_communication.png[Secure Communication]

endif::SecurityImg[]

include::modules/con-certificate-authorities.adoc[leveloffset=+1]

include::modules/proc-installing-your-own-ca-certificates.adoc[leveloffset=+2]

include::modules/ref-certificates-and-secrets.adoc[leveloffset=+1]

include::modules/con-certificate-renewal.adoc[leveloffset=+1]

include::modules/proc-renewing-ca-certs-manually.adoc[leveloffset=+2]

include::modules/proc-renewing-your-own-ca-certificates.adoc[leveloffset=+2]

include::modules/proc-replacing-private-keys.adoc[leveloffset=+1]

include::modules/con-tls-connections.adoc[leveloffset=+1]

include::modules/proc-configuring-internal-clients-to-trust-cluster-ca.adoc[leveloffset=+1]

include::modules/proc-configuring-external-clients-to-trust-cluster-ca.adoc[leveloffset=+1]

include::modules/con-kafka-listener-certificates.adoc[leveloffset=+1]

include::modules/proc-installing-certs-per-listener.adoc[leveloffset=+2]

include::modules/ref-alternative-subjects-certs-for-listeners.adoc[leveloffset=+2]
