// Module included in the following assemblies:
//
// assembly-kafka-mirror-maker-tls.adoc

[id='proc-configuring-kafka-mirror-maker-tls-{context}']
= Configuring TLS encryption in Kafka Mirror Maker

.Prerequisites

* An {ProductPlatformName} cluster
* A running Cluster Operator

.Procedure

As the Kafka Mirror Maker connects to two Kafka clusters (source and target), you can choose to configure TLS for one or both the clusters.
The following steps describe how to configure TLS on the consumer side for connecting to the source Kafka cluster:

. Find out the name of the secret with the certificate which should be used for TLS Server Authentication and the key under which the certificate is stored in the secret.
If such secret does not exist yet, prepare the certificate in a file and create the secret.
+
ifdef::Kubernetes[]
On {KubernetesName} this can be done using `kubectl create`:
[source,shell,subs=+quotes]
kubectl create secret generic _<my-secret>_ --from-file=_<my-file.crt>_
+
endif::Kubernetes[]
On {OpenShiftName} this can be done using `oc create`:
+
[source,shell,subs=+quotes]
oc create secret generic _<my-secret>_ --from-file=_<my-file.crt>_
. Edit the `KafkaMirrorMaker.spec.consumer.tls` property.
For example:
+
[source,yaml,subs=attributes+]
----
apiVersion: {KafkaApiVersion}
kind: KafkaMirrorMaker
metadata:
  name: my-mirror-maker
spec:
  # ...
  consumer:
    tls:
      trustedCertificates:
        - secretName: my-cluster-cluster-cert
          certificate: ca.crt
  # ...
----
+
. Create or update the resource.
+
ifdef::Kubernetes[]
On {KubernetesName} this can be done using `kubectl apply`:
[source,shell,subs=+quotes]
kubectl apply -f _<your-file>_
+
endif::Kubernetes[]
On {OpenShiftName} this can be done using `oc apply`:
+
[source,shell,subs=+quotes]
oc apply -f _<your-file>_

Repeat the above steps for configuring TLS on the target Kafka cluster.
In this case, the secret containing the certificate has to be configured in the `KafkaMirrorMaker.spec.producer.tls` property.