Integrating leaf certificates for the Kafka route

You can configure Business Automation Insights production deployments to use leaf certificates instead of operator-generated certificates to secure Kafka route communications.

Before you begin

Make sure that you have the following prerequisites:

A valid TLS certificate issued by your certificate authority.
A private key for the certificate.
Permissions to create Kubernetes secrets.

About this task

User-provided certificates can be used to comply with your organization's security policies and integrate with existing processes in certificate lifecycle management.

The Business Automation Insights operator can retrieve certificates from Kubernetes secrets, which you can create directly in the cluster.

Procedure

Create a Kubernetes secret to include your certificate files.

apiVersion: v1
kind: Secret
metadata:
  name: custom-kafka-route-cert
  namespace: <namespace>
type: kubernetes.io/tls
data:
  tls.crt: <base64-leaf-certificate>
  tls.key: <base64-private-key>

Configure the Business Automation Insights deployment custom resource custom_kafka_route_certificate_secret parameter under the bai_configuration section with the name of the Kubernetes secret that contains the certificate and private key.
```
spec:
  bai_configuration:
    custom_kafka_route_certificate_secret: "custom-kafka-route-cert"
```
Note: If a secret is not specified, the Business Automation Insights operator generates self-signed certificates. For more information, see Common and administration services parameters.