• Incrementally bounce the cluster nodes to open additional secured port(s).
• Restart clients using the secured rather than PLAINTEXT port (assuming you are securing the client-broker connection).
• Incrementally bounce the cluster again to enable broker-to-broker security (if this is required)
• A final incremental bounce to close the PLAINTEXT port.

The specific steps for configuring SSL and SASL are described in sections and 7.3. Follow these steps to enable security for your desired protocol(s).

The security implementation lets you configure different protocols for both broker-client and broker-broker communication. These must be enabled in separate bounces. A PLAINTEXT port must be left open throughout so brokers and/or clients can continue to communicate.

When performing an incremental bounce stop the brokers cleanly via a SIGTERM. It’s also good practice to wait for restarted replicas to return to the ISR list before moving onto the next node.

We then restart the clients, changing their config to point at the newly opened, secured port:

security.protocol = SSL
...etc

In the second incremental server bounce we instruct Kafka to use SSL as the broker-broker protocol (which will use the same SSL port):

In the final bounce we secure the cluster by closing the PLAINTEXT port:

security.inter.broker.protocol=SSL

We would then restart the clients, changing their config to point at the newly opened, SASL & SSL secured port:

...etc

The second server bounce would switch the cluster to use encrypted broker-broker communication via the SSL port we previously opened on port 9092:

The final bounce secures the cluster by closing the PLAINTEXT port.

listeners=SSL://broker1:9092,SASL_SSL://broker1:9093