<p>I have a Kafka cluster that is running on K8S. I am using the confluent kafka image as and I have an EXTERNAL listeners that is working.
How can I add SSL encryption? Should I use an ingress? Where can I find good documentation?
Thank you</p>

CMPE
<p>You have a <a href="https://gist.github.com/aramalipoor/f62355cd440584986bfd91bd69e52c49#file-0-readme-md" rel="noreferrer">manual way in this gist</a>, which does not use the confluent image.</p>

<p>But for <a href="https://github.com/confluentinc/cp-helm-charts" rel="noreferrer">Confluent and its Helm chart</a> (see "<a href="https://www.confluent.io/blog/getting-started-apache-kafka-kubernetes/" rel="noreferrer">Confluent Operator: Getting Started with Apache Kafka and Kubernetes</a>" from <a href="https://twitter.com/rohit2b" rel="noreferrer">Rohit Bakhshi</a>), you can follow:</p>

<p>"<a href="https://medium.com/weareservian/encryption-authentication-and-external-access-for-confluent-kafka-on-kubernetes-69c723a612fc" rel="noreferrer">Encryption, authentication and external access for Confluent Kafka on Kubernetes</a>" from <a href="https://github.com/ryan-c-m" rel="noreferrer">Ryan Morris</a></p>

<blockquote>
  <p>Out of the box, the helm chart doesn’t support SSL configurations for encryption and authentication, or exposing the platform for access from outside the Kubernetes cluster. </p>
  
  <p>To implement these requirements, there are a few modifications to the installation needed.<br>
  In summary, they are:</p>
  
  <ul>
  <li>Generate some private keys/certificates for brokers and clients</li>
  <li>Create Kubernetes Secrets to provide them within your cluster</li>
  <li>Update the broker StatefulSet with your Secrets and SSL configuration</li>
  <li>Expose each broker pod via an external service</li>
  </ul>
</blockquote>
