// Module included in the following assemblies:
//
// assembly-kafka-mirror-maker-tls.adoc

[id='proc-configuring-kafka-mirror-maker-tls-{context}']
= Configuring TLS encryption in Kafka MirrorMaker

.Prerequisites

* xref:cluster-operator-str[{ProductName} and Kafka is deployed]
* Source and target Kafka clusters are available
* If they exist, the name of the `Secret` for the certificate used for TLS Server Authentication and the key under which the certificate is stored in the `Secret`

.Procedure

As the Kafka MirrorMaker connects to two Kafka clusters (source and target), you can choose to configure TLS for one or both of the clusters.
The following steps describe how to configure TLS on the consumer side for connecting to the source Kafka cluster:

. (Optional) If they do not already exist, prepare the TLS certificate used for authentication in a file and create a `Secret`:
+
[source,shell,subs=+quotes]
kubectl create secret generic _<my-secret>_ --from-file=_<my-file.crt>_
+
NOTE: The secrets created by the Cluster Operator for Kafka cluster may be used directly.

. Edit the `KafkaMirrorMaker.spec.consumer.tls` property.
+
.An example showing TLS configuration with multiple certificates
[source,yaml,subs=attributes+]
----
apiVersion: {KafkaApiVersion}
kind: KafkaMirrorMaker
metadata:
  name: my-mirror-maker
spec:
  # ...
  consumer:
    tls:
      trustedCertificates:
        - secretName: my-source-secret
          certificate: ca.crt
        - secretName: my-other-source-secret
          certificate: certificate.crt
  # ...
  producer:
    tls:
      trustedCertificates:
        - secretName: my-target-secret
          certificate: ca.crt
        - secretName: my-other-target-secret
          certificate: certificate.crt
  # ...
----
+
When multiple certificates are stored in the same secret, it can be listed multiple times.
+
.An example showing TLS configuration with multiple certificates from the same secret
[source,yaml,subs=attributes+]
----
apiVersion: {KafkaApiVersion}
kind: KafkaMirrorMaker
metadata:
  name: my-mirror-maker
spec:
  # ...
  consumer:
    tls:
      trustedCertificates:
        - secretName: my-source-secret
          certificate: ca.crt
        - secretName: my-source-secret
          certificate: ca2.crt
  # ...
  producer:
    tls:
      trustedCertificates:
        - secretName: my-target-secret
          certificate: ca.crt
        - secretName: my-target-secret
          certificate: ca2.crt
  # ...
----

. Create or update the resource:
+
[source,shell,subs=+quotes]
kubectl apply -f _<your-file>_

Repeat the above steps for configuring TLS on the target Kafka cluster.
In this case, the secret containing the certificate has to be configured in the `KafkaMirrorMaker.spec.producer.tls` property.
