// This assembly is included in the following assemblies:
//
// configuring/configuring.adoc

[id='assembly-securing-access-{context}']
= Securing access to a Kafka cluster

[role="_abstract"]
Secure connections by configuring Kafka and Kafka users.
Through configuration, you can implement encryption, authentication, and authorization mechanisms.

.Kafka configuration 

To establish secure access to Kafka, configure the `Kafka` resource to set up the following configurations based on your specific requirements:

* Listeners with specified authentication types to define how clients authenticate
** TLS encryption for communication between Kafka and clients
** Supported TLS versions and cipher suites for additional security
* Authorization for the entire Kafka cluster
* Network policies for restricting access
* Super users for unconstrained access to brokers

Authentication is configured independently for each listener, while authorization is set up for the whole Kafka cluster.

For more information on access configuration for Kafka, see the link:{BookURLConfiguring}#type-Kafka-reference[`Kafka` schema reference^] and link:{BookURLConfiguring}#type-GenericKafkaListener-reference[`GenericKafkaListener` schema reference^].

.User (client-side) configuration

To enable secure client access to Kafka, configure `KafkaUser` resources. 
These resources represent clients and determine how they authenticate and authorize with the Kafka cluster.

Configure the `KafkaUser` resource to set up the following configurations based on your specific requirements:

* Authentication that must match the enabled listener authentication
** Supported TLS versions and cipher suites that must match the Kafka configuration
* Simple authorization to apply Access Control List (ACL) rules
** ACLs for fine-grained control over user access to topics and actions
* Quotas to limit client access based on byte rates or CPU utilization

The User Operator creates the user representing the client and the security credentials used for client authentication, based on the chosen authentication type.

For more information on access configuration for users, see the link:{BookURLConfiguring}#type-KafkaUser-reference[`KafkaUser` schema reference^].

//listener authn config
include::../../modules/security/con-securing-kafka-authentication.adoc[leveloffset=+1]
include::../../modules/security/proc-restricting-access-to-listeners-using-network-policies.adoc[leveloffset=+2]
include::../../modules/security/proc-installing-certs-per-listener.adoc[leveloffset=+2]
include::../../modules/security/ref-alternative-subjects-certs-for-listeners.adoc[leveloffset=+2]

//Kafka authz config
include::../../modules/security/con-securing-kafka-authorization.adoc[leveloffset=+1]

//Config options for clients
include::assembly-securing-kafka-clients.adoc[leveloffset=+1]

//client set up example with kafka and user config
include::../../modules/deploying/proc-deploy-setup-external-clients.adoc[leveloffset=+1]

//hostname verification with node ports
include::../../modules/deploying/con-hostname-verification-node-ports.adoc[leveloffset=+1]

