// Module included in the following assemblies:
//
// assembly-security.adoc

[id='certificates-and-secrets-{context}']
= Certificates and `Secrets`

{ProductName} stores CA, component and Kafka client private keys and certificates in `Secrets`.
All keys are 2048 bits in size.

CA certificate validity periods, expressed as a number of days after certificate generation, can be configured in `Kafka.spec.clusterCa.validityDays`
and `Kafka.spec.clusterCa.validityDays`.

== Cluster CA `Secrets`

.Cluster CA `Secrets` managed by the Cluster Operator in _<cluster>_
[cols="3,2,5"]
|===
|`Secret` name                     |Field within `Secret`     |Description

|`_<cluster>_-cluster-ca`          |`ca.key`                  |The current private key for the cluster CA.                                 
 
.2+|`_<cluster>_-cluster-ca-cert`  |`ca.crt`                  |The current certificate for the cluster CA.
                                   |`ca-_<date>_.crt`         |Former (but not yet expired) certificate for the cluster CA. `_<date>_` is the date the certificate will expire.
 
.2+|`_<cluster>_-kafka-brokers`    |`_<cluster>_-kafka-_<num>_.crt` |Certificate for Kafka broker pod _<num>_. Signed by a current or former cluster CA private key in `_<cluster>_-cluster-ca`.
                                   |`_<cluster>_-kafka-_<num>_.key` |Private key for Kafka broker pod _<num>_.
 
.2+|`_<cluster>_-zookeeper-nodes`  |`_<cluster>_-zookeeper-_<num>_.crt`  |Certificate for Zookeeper node _<num>_. Signed by a current or former cluster CA private key in `_<cluster>_-cluster-ca`.
                                   |`_<cluster>_-zookeeper-_<num>_.key` | Private key for Zookeeper pod _<num>_.

.3+|`_<cluster>_-entity-operator-certs` 
                                   |`entity-operator_.crt`    |Certificate for TLS communication between the Entity Operator and Kafka or Zookeeper.
                                   Signed by a current or former cluster CA private key in `_<cluster>_-cluster-ca`.
                                   |`entity-operator.key`     |Private key for TLS communication between the Entity Operator and Kafka or Zookeeper
|===

The CA certificates in `_<cluster>_-cluster-ca-cert` must be trusted by Kafka client applications so that they validate the Kafka broker certificates when connecting to Kafka brokers over TLS.

NOTE: Only `_<cluster>_-cluster-ca-cert` needs to be used by clients. 
All other `Secrets` in the table above only need to be accessed by the
 {ProductName} components.
 You can enforce this using {ProductPlatformName} role-based access controls if necessary.

== Client CA `Secrets`

.Clients CA `Secrets` managed by the Cluster Operator in _<cluster>_
[cols="3,2,5"]
|===
|`Secret` name                     |Field within `Secret`     |Description

|`_<cluster>_-clients-ca`          |`ca.key`                  |The current private key for the clients CA.                                 
 
.2+|`_<cluster>_-clients-ca-cert`  |`ca.crt`                  |The current certificate for the clients CA.
                                   |`ca-_<date>_.crt`         |Former (but not yet expired) certificate for the clients CA. `_<date>_` is the date the certificate will expire.
|===

The certificates in `_<cluster>_-clients-ca-cert` are those which the Kafka brokers trust.

NOTE: `_<cluster>_-cluster-ca` is used to sign certificates of client applications.
It needs to be accessible to the {ProductName} components and for administrative access if you are intending to issue application certificates without using the User Operator.
You can enforce this using {ProductPlatformName} role-based access controls if necessary.

== User `Secrets`

.`Secrets` managed by the User Operator
[cols="3,2,5"]
|===
|`Secret` name  |Field within `Secret`  |Description

.2+|`_<user>_`  |`user.crt`             |Certificate for the user, signed by the clients CA
                |`user.key`             |Private key for the user
|===
