<a id="co-security-overview"></a>

# Configure Security for Confluent Platform with Confluent for Kubernetes

Confluent for Kubernetes takes an opinionated and automated approach of securing your Confluent
deployment.

Securing your Confluent deployment covers the following security dimensions:

- Authentication
- Authorization
- Network Encryption
- Configuration Secrets

Confluent recommends the following security configuration for production
deployments:

- For authentication
  : For Kafka client authentication, choose one of:
    - mTLS
    - SASL/PLAIN
    - SASL/PLAIN with LDAP
    <br/>
      For SASL/PLAIN, the identity can come from LDAP server.
- For authorization
  : Confluent Role-Based Access Control (RBAC) for authorization, with
    user/group identity coming from LDAP server
- For network Encryption
  : TLS for both internal (between Confluent components) and external (clients
    to Confluent components)
- For configuration secrets
  : Manage the lifecycle using Kubernetes Secrets or Vaults, and reference them
    in the Confluent component custom resources

For a comprehensive tutorial scenario on configuring Confluent recommended security,
see the [Security Tutorial](https://github.com/confluentinc/confluent-kubernetes-examples/tree/master/security/production-secure-deploy).

While the above is the recommended way to run Confluent for Kubernetes in production, you do
have the option to deploy and operate Confluent for Kubernetes  with different security
configurations. Below is the outline of security configurations supported, with
links to pages that cover concepts and instructions in detail:

- Authentication
  - Kafka authentication
    - No authentication
    - [SASL/PLAIN authentication](co-authenticate-kafka.md#co-authenticate-kafka-plain)
      (username/password)
    - [SASL/PLAIN with LDAP authentication](co-authenticate-kafka.md#co-authenticate-kafka-plain-ldap)
    - [mTLS authentication](co-authenticate-kafka.md#co-authenticate-kafka-mtls)
      (certificate based)
    - [OAuth/OIDC authentication](co-authenticate-kafka.md#co-authenticate-kafka-oauth)
  - ZooKeeper authentication

    #### IMPORTANT
    Starting with Confluent Platform version 8.0, ZooKeeper is no longer part of Confluent Platform.

    - No authentication
    - [Digest authentication](co-authenticate-cp.md#co-authenticate-zookeeper-digest)
    - [mTLS authentication](co-authenticate-cp.md#co-authenticate-zookeeper-mtls)
  - Confluent component authentication
    - No authentication
    - [Basic authentication](co-authenticate-cp.md#co-authenticate-cp-basic) (username/password)
    - [mTLS authentication](co-authenticate-cp.md#co-authenticate-cp-mtls)
    - [OAuth/OIDC authentication](co-authenticate-cp.md#co-authenticate-cp-oauth)
    - [LDAP authentication](co-authenticate-cp.md#co-authenticate-c3-ldap) (for Control Center and Control Center (Legacy) only)
    - [Single sign-on authentication](co-authenticate-cp.md#co-authenticate-c3-sso)
      (for Control Center and Control Center (Legacy) only)
- Authorization
  - No authorization
  - [Confluent Role Based Access Control (RBAC) authorization](co-rbac.md#co-rbac),
    with a dependency on LDAP server
  - [Kafka Access Control Lists](co-simple-acls.md#co-simple-acls)
- Network Encryption
  - No encryption
  - [TLS encryption](co-network-encryption.md#co-network-encryption)