// Module included in the following assemblies:
//
// assembly-kafka-mirror-maker-tls.adoc

[id='ref-kafka-mirror-maker-tls-{context}']
= TLS support in Kafka Mirror Maker

TLS support is configured in the `tls` sub-property of `consumer` and `producer` properties in `KafkaMirrorMaker.spec`.
The `tls` property contains a list of secrets with key names under which the certificates are stored.
The certificates should be stored in X.509 format.

.An example showing TLS configuration with multiple certificates
[source,yaml,subs=attributes+]
----
apiVersion: {KafkaApiVersion}
kind: KafkaMirrorMaker
metadata:
  name: my-mirror-maker
spec:
  # ...
  consumer:
    tls:
      trustedCertificates:
        - secretName: my-source-secret
          certificate: ca.crt
        - secretName: my-other-source-secret
          certificate: certificate.crt
  # ...
  producer:
    tls:
      trustedCertificates:
        - secretName: my-target-secret
          certificate: ca.crt
        - secretName: my-other-target-secret
          certificate: certificate.crt
  # ...
----

When multiple certificates are stored in the same secret, it can be listed multiple times.

.An example showing TLS configuration with multiple certificates from the same secret
[source,yaml,subs=attributes+]
----
apiVersion: {KafkaApiVersion}
kind: KafkaMirrorMaker
metadata:
  name: my-mirror-maker
spec:
  # ...
  consumer:
    tls:
      trustedCertificates:
        - secretName: my-source-secret
          certificate: ca.crt
        - secretName: my-source-secret
          certificate: ca2.crt
  # ...
  producer:
    tls:
      trustedCertificates:
        - secretName: my-target-secret
          certificate: ca.crt
        - secretName: my-target-secret
          certificate: ca2.crt
  # ...
----