// This assembly is included in the following assemblies:
//
// // assembly-securing-access.adoc

[id='assembly-securing-kafka-{context}']
= Securing access to Kafka brokers

[role="_abstract"]
To establish secure access to Kafka brokers, you configure and apply:

* A `Kafka` resource to:
** Create listeners with a specified authentication type
** Configure authorization for the whole Kafka cluster
* A `KafkaUser` resource to access the Kafka brokers securely through the listeners

Configure the `Kafka` resource to set up:

* Listener authentication
* Network policies that restrict access to Kafka listeners
* Kafka authorization
* Super users for unconstrained access to brokers

Authentication is configured independently for each listener.
Authorization is always configured for the whole Kafka cluster.

The Cluster Operator creates the listeners and sets up the cluster and client certificate authority (CA) certificates to enable authentication within the Kafka cluster.

You can replace the certificates generated by the Cluster Operator by link:{BookURLUsing}#installing-your-own-ca-certificates-str[installing your own certificates^].
You can also link:{BookURLUsing}#kafka-listener-certificates-str[configure your listener to use a Kafka listener certificate managed by an external Certificate Authority^].
Certificates are available in PKCS #12 format (.p12) and PEM (.crt) formats.

Use `KafkaUser` to enable the authentication and authorization mechanisms that a specific client uses to access Kafka.

Configure the `KafkaUser` resource to set up:

* Authentication to match the enabled listener authentication
* Authorization to match the enabled Kafka authorization
* Quotas to control the use of resources by clients

The User Operator creates the user representing the client and the security credentials used for client authentication, based on the chosen authentication type.

Refer to the schema reference for more information on access configuration properties:

* xref:type-Kafka-reference[`Kafka` schema reference]
* xref:type-KafkaUser-reference[`KafkaUser` schema reference]
* xref:type-GenericKafkaListener-reference[`GenericKafkaListener` schema reference]

//steps to secure the brokers
include::../modules/proc-securing-kafka.adoc[leveloffset=+1]
include::../modules/proc-configuring-kafka-user.adoc[leveloffset=+1]
include::../modules/proc-restricting-access-to-listeners-using-network-policies.adoc[leveloffset=+1]
