TLS

TLS encrypts the connection between Kafka Gateway and your Kafka brokers by inserting a tls client binding between the kafka client binding and the tcp client binding in zilla.yaml. For client certificate authentication on top of encryption, see mTLS.

Public Certificate Authority

If the Kafka cluster presents a TLS server certificate issued by a public certificate authority, route the kafka client to a tls client binding with no trust configured. options.trustcacerts then defaults to true, so the public CA is trusted automatically:

bindings:
  south_kafka_client:
    type: kafka
    kind: client
    options:
      servers:
        - ${{env.KAFKA_BOOTSTRAP_SERVER}}
    exit: south_tls_client
  south_tls_client:
    type: tls
    kind: client
    exit: south_tcp_client
  south_tcp_client:
    type: tcp
    kind: client

Private Certificate Authority

If the Kafka cluster presents a certificate issued by a private certificate authority, configure a filesystem vault with the CA certificate in its truststore, and reference it from the tls client binding:

vaults:
  client_vault:
    type: filesystem
    options:
      trust:
        store: ${{env.TRUSTORE_PATH}}
        type: ${{env.TRUSTORE_TYPE}}
        password: ${{env.TRUSTORE_PASSWORD}}
bindings:
  south_kafka_client:
    type: kafka
    kind: client
    options:
      servers:
        - ${{env.KAFKA_BOOTSTRAP_SERVER}}
    exit: south_tls_client
  south_tls_client:
    type: tls
    kind: client
    vault: client_vault
    options:
      trust:
        - ${{env.CA_CERT_ALIAS}}
    exit: south_tcp_client
  south_tcp_client:
    type: tcp
    kind: client

See the tls client binding reference for the full set of options fields.