Chapter 83. KafkaClientAuthenticationTls schema reference
Chapter 83. KafkaClientAuthenticationTls schema reference Used in: KafkaBridgeSpec , KafkaConnectSpec , KafkaMirrorMaker2ClusterSpec , KafkaMirrorMakerConsumerSpec , KafkaMirrorMakerProducerSpec Full list of KafkaClientAuthenticationTls schema properties To configure mTLS authentication, set the type property to the value tls . mTLS uses a TLS certificate to authenticate. The certificate is specified in the certificateAndKey property and is always loaded from an OpenShift secret. In the secret, the certificate must be stored in X509 format under two different keys: public and private. Example mTLS configuration authentication: type: tls certificateAndKey: secretName: my-secret certificate: my-public-tls-certificate-file.crt key: private.key You can use the secrets created by the User Operator, or you can create your own TLS certificate file, with the keys used for authentication, then create a Secret from the file: oc create secret generic <my_tls_secret> \ --from-file=<my_public_tls_certificate>.crt \ --from-file=<my_private_key>.key Example secret for mTLS client authentication apiVersion: v1 kind: Secret metadata: name: my-tls-secret type: Opaque data: tls.crt: LS0tLS1CRUdJTiBDRVJ... tls.key: LS0tLS1CRUdJTiBQUkl... Note mTLS authentication can only be used with TLS connections. 83.1. KafkaClientAuthenticationTls schema properties The type property is a discriminator that distinguishes use of the KafkaClientAuthenticationTls type from KafkaClientAuthenticationScramSha256 , KafkaClientAuthenticationScramSha512 , KafkaClientAuthenticationPlain , KafkaClientAuthenticationOAuth . It must have the value tls for the type KafkaClientAuthenticationTls . Property Property type Description type string Must be tls . certificateAndKey CertAndKeySecretSource Reference to the Secret which holds the certificate and private key pair.
authentication: type: tls certificateAndKey: secretName: my-secret certificate: my-public-tls-certificate-file.crt key: private.key create secret generic <my_tls_secret> --from-file=<my_public_tls_certificate>.crt --from-file=<my_private_key>.key apiVersion: v1 kind: Secret metadata: name: my-tls-secret type: Opaque data: tls.crt: LS0tLS1CRUdJTiBDRVJ tls.key: LS0tLS1CRUdJTiBQUkl