// Module included in the following assemblies:
//
// assembly-kafka-mirror-maker-authentication.adoc

[id='proc-configuring-kafka-mirror-maker-authentication-tls-{context}']
= Configuring TLS client authentication in Kafka Mirror Maker

.Prerequisites

* An {ProductPlatformName} cluster
* A running Cluster Operator with a `tls` listener with `tls` authentication enabled

.Procedure

As the Kafka Mirror Maker connects to two Kafka clusters (source and target), you can choose to configure TLS client authentication for one or both the clusters.
The following steps describe how to configure TLS client authentication on the consumer side for connecting to the source Kafka cluster:

. Find out the name of the `Secret` with the public and private keys which should be used for TLS Client Authentication and the keys under which they are stored in the `Secret`.
If such a `Secret` does not exist yet, prepare the keys in a file and create the `Secret`.
+
ifdef::Kubernetes[]
On {KubernetesName} this can be done using `kubectl create`:
[source,shell,subs=+quotes]
kubectl create secret generic _<my-secret>_ --from-file=_<my-public.crt>_ --from-file=_<my-private.key>_
+
endif::Kubernetes[]
On {OpenShiftName} this can be done using `oc create`:
+
[source,shell,subs=+quotes]
oc create secret generic _<my-secret>_ --from-file=_<my-public.crt>_ --from-file=_<my-private.key>_
. Edit the `KafkaMirrorMaker.spec.consumer.authentication` property.
For example:
+
[source,yaml,subs=attributes+]
----
apiVersion: {KafkaApiVersion}
kind: KafkaMirrorMaker
metadata:
  name: my-mirror-maker
spec:
  # ...
  consumer:
    authentication:
      type: tls
      certificateAndKey:
        secretName: my-secret
        certificate: my-public.crt
        key: my-private.key
  # ...
----
+
. Create or update the resource.
+
ifdef::Kubernetes[]
On {KubernetesName} this can be done using `kubectl apply`:
[source,shell,subs=+quotes]
kubectl apply -f _<your-file>_
+
endif::Kubernetes[]
On {OpenShiftName} this can be done using `oc apply`:
+
[source,shell,subs=+quotes]
oc apply -f _<your-file>_

Repeat the above steps for configuring TLS client authentication on the target Kafka cluster.
In this case, the secret containing the certificate has to be configured in the `KafkaMirrorMaker.spec.producer.authentication` property.