---
title: Charmhub | Deploy Apache Kafka Connect - K8s using Charmhub - The Open Operator
  Collection
description: Deploy the latest version of Apache Kafka Connect - K8s as a Kubernetes
  Operator on any cloud.
url: https://charmhub.io/kafka-connect-k8s/docs/r-listeners
---

# Apache Kafka Connect - K8s

[Canonical](https://charmhub.io/publisher/data-platform "View all packages from Canonical")

* [Canonical](https://charmhub.io/publisher/data-platform "View all packages from Canonical")

Platform:

4/stable 18

```
juju deploy kafka-connect-k8s --channel 4/stable
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

---

#### Relevant links

* [Homepage](https://github.com/canonical/kafka-connect-k8s-operator)

---

#### Contacts

##### Maintainers

+ [Canonical Data Platform](mailto:data-platform@lists.launchpad.net)

* [Submit a bug](https://github.com/canonical/kafka-connect-k8s-operator/issues)

---

Share your thoughts on this charm with the community on discourse.

[Join the discussion](https://discourse.charmhub.io/)

# Apache Kafka listeners

Charmed Apache Kafka comes with a set of listeners that can be enabled to allow for
inter- and intra-cluster communication.

* **Internal listeners** are used for internal traffic and exchange of information between Apache Kafka brokers
* **Client listeners** are used for clients within the Kubernetes cluster,
* **External listeners** are used for clients outside the Kubernetes cluster.

Listeners are optionally enabled based on the relations created on particular
charm endpoints. Each listener is characterized by a specific port, scope, security protocol and authentication mechanism.

In the following table, we summarize the protocols, the port, and
the relation that each listener is bound to. Note that based on whether a `certificates`
relation is present, one of two mutually exclusive types of listeners can be
opened.

| Security protocol | Authentication mechanism | Driving endpoints | Port | Scope | Listener name |
| --- | --- | --- | --- | --- | --- |
| SASL\_PLAINTEXT | SCRAM-SHA-512 | `cluster` | `19092` | INTERNAL | INTERNAL\_SASL\_PLAINTEXT\_SCRAM\_SHA\_512 |
| SASL\_SSL | SCRAM-SHA-512 | `cluster` + `certificates` | `19093` | INTERNAL | INTERNAL\_SASL\_SSL\_SCRAM\_SHA\_512 |
| SASL\_PLAINTEXT | SCRAM-SHA-512 | `kafka-client` | `9092` | CLIENT | CLIENT\_SASL\_PLAINTEXT\_SCRAM\_SHA\_512 |
| SASL\_SSL | SCRAM-SHA-512 | `kafka-client` + `certificates` | `9093` | CLIENT | CLIENT\_SASL\_SSL\_SCRAM\_SHA\_512 |
| SSL | SSL | (`trusted-certificate`|`trusted-ca`) + `certificates` | `9094` | CLIENT | CLIENT\_SSL\_SSL |
| SASL\_PLAINTEXT | OAUTHBEARER | `kafka-client` + `oauth` | `9095` | CLIENT | CLIENT\_SASL\_PLAINTEXT\_OAUTHBEARER |
| SASL\_SSL | OAUTHBEARER | `kafka-client` + `oauth` + `certificates` | `9096` | CLIENT | CLIENT\_SASL\_SSL\_OAUTHBEARER |
| SASL\_PLAINTEXT | SCRAM-SHA-512 | `kafka-client` | `29092` | EXTERNAL | EXTERNAL\_SASL\_PLAINTEXT\_SCRAM\_SHA\_512 |
| SASL\_SSL | SCRAM-SHA-512 | `kafka-client` + `certificates` | `29093` | EXTERNAL | EXTERNAL\_SASL\_SSL\_SCRAM\_SHA\_512 |
| SSL | SSL | (`trusted-certificate`|`trusted-ca`) + `certificates` | `29094` | EXTERNAL | EXTERNAL\_SSL\_SSL |
| SASL\_PLAINTEXT | OAUTHBEARER | `kafka-client` + `oauth` | `29095` | EXTERNAL | EXTERNAL\_SASL\_PLAINTEXT\_OAUTHBEARER |
| SASL\_SSL | OAUTHBEARER | `kafka-client` + `oauth` + `certificates` | `29096` | EXTERNAL | EXTERNAL\_SASL\_SSL\_OAUTHBEARER |

Since `cluster` is a peer relation, one of the two `INTERNAL_*` listeners is always enabled.

---