anchor.diff:  # Delete the existing secret
   oc delete secret _<ca-key-secret>_
   # Create the new one
  -oc create secret generic _<ca-key-secret>_ \
  -  --from-file=ca.key=_<ca-key-file>_ \
  -  && oc label secret _<ca-key-secret>_ \
  -  strimzi.io/kind=Kafka \
  -  strimzi.io/cluster=_<my-cluster>_
  +oc create secret generic _<ca-key-secret>_ --from-file=ca.key=_<ca-key-file>_
  +----
  +
  +. Label both `Secrets` with labels `strimzi.io/kind=Kafka` and `strimzi.io/cluster=_<my-cluster>_`:
  +ifdef::Kubernetes[]
  ++
  +On {KubernetesName}, run the following commands:
  ++
  +[source,shell,subs="+quotes"]
  +----
  +kubectl label secret _<ca-cert-secret>_ strimzi.io/kind=Kafka strimzi.io/cluster=_<my-cluster>_
  +kubectl label secret _<ca-key-secret>_ strimzi.io/kind=Kafka strimzi.io/cluster=_<my-cluster>_
  +----
  +endif::Kubernetes[]
  ++
  +On {OpenShiftName}, run the following commands:
  ++
  +[source,shell,subs="+quotes"]
  +----
  +oc label secret _<ca-cert-secret>_ strimzi.io/kind=Kafka strimzi.io/cluster=_<my-cluster>_
  +oc label secret _<ca-key-secret>_ strimzi.io/kind=Kafka strimzi.io/cluster=_<my-cluster>_
   ----
   
   . Create the `Kafka` resource for your cluster, configuring either the `Kafka.spec.clusterCa` or the `Kafka.spec.clientsCa` object to _not_ use generated CAs:
  
positive.code: .Prerequisites
  
  * The Cluster Operator is running.
  * A `Kafka` resource within {ProductPlatformName}
  * Your own X.509 certificates and keys in PEM format for the cluster CA or clients CA. For example, these could be generated by `openssl`, using a command such as:
  +
  [source,shell,subs="+quotes"]
  openssl req -x509 -new -days _<validity>_ --nodes -out ca.crt -keyout ca.key
  
  
  .Procedure
  
  
negative.code: # Delete any existing secret (ignore "Not Exists" errors)
  oc delete secret _<ca-cert-secret>_
  # Create the new one
  oc create secret generic _<ca-cert-secret>_ --from-file=ca.crt=_<ca-cert-file>_
  ----
  
  . Put your CA key in the corresponding `Secret` (`_<cluster>_-cluster-ca` for the cluster CA or `_<cluster>_-clients-ca` for the clients CA)
  