// This assembly is included in the following assemblies:
//
// master.adoc

[id='security-{context}']
= Security

{ProductName} supports encrypted communication between the Kafka and {ProductName} components using the TLS protocol.
Communication between Kafka brokers (interbroker communication), between Zookeeper nodes (internodal communication), and between these and the {ProductName} operators is always encrypted.
Communication between Kafka clients and Kafka brokers is encrypted according to how the cluster is configured.
For the Kafka and {ProductName} components, TLS certificates are also used for authentication.

The Cluster Operator automatically sets up TLS certificates to enable encryption and authentication within your cluster.
It also sets up other TLS certificates if you want to enable encryption or TLS authentication between Kafka brokers and clients.

ifdef::SecurityImg[]

.Example architecture diagram of the communication secured by TLS.
image::secure_communication.png[Secure Communication]

endif::SecurityImg[]

include::con-certificate-authorities.adoc[leveloffset=+1]

include::ref-certificates-and-secrets.adoc[leveloffset=+1]

include::proc-installing-your-own-ca-certificates.adoc[leveloffset=+1]

include::con-certificate-renewal.adoc[leveloffset=+1]

include::proc-renewing-your-own-ca-certificates.adoc[leveloffset=+1]

include::con-tls-connections.adoc[leveloffset=+1]

include::proc-configuring-internal-clients-to-trust-cluster-ca.adoc[leveloffset=+1]

include::proc-configuring-external-clients-to-trust-cluster-ca.adoc[leveloffset=+1]
