This is an automated email from the ASF dual-hosted git repository.
jamesnetherton pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-quarkus.git
The following commit(s) were added to refs/heads/main by this push:
new 33faf6c3db Document TLS Registry usage for kafka
33faf6c3db is described below
commit 33faf6c3dbdeedad45177c684867eb01fde5b9e4
Author: James Netherton <[email protected]>
AuthorDate: Fri Sep 18 10:36:33 2026 +0100
Document TLS Registry usage for kafka
---
.../pages/reference/extensions/tls-registry.adoc | 27 ++++++++++++++++++++++
.../tls-registry/runtime/src/main/doc/usage.adoc | 26 +++++++++++++++++++++
2 files changed, 53 insertions(+)
diff --git a/docs/modules/ROOT/pages/reference/extensions/tls-registry.adoc
b/docs/modules/ROOT/pages/reference/extensions/tls-registry.adoc
index 482c941daa..03343549ba 100644
--- a/docs/modules/ROOT/pages/reference/extensions/tls-registry.adoc
+++ b/docs/modules/ROOT/pages/reference/extensions/tls-registry.adoc
@@ -170,6 +170,33 @@ Some `quarkus.tls.*` options have no equivalent in
`SSLContextParameters`, becau
These options continue to apply to Quarkus's own TLS consumers as normal. Only
the Camel bridge is affected.
+[id="extensions-tls-registry-usage-component-compatibility"]
+=== Component Compatibility
+
+Most components should work as per the usage instructions defined in this
guide.
+
+The Camel Kafka component cannot use an `SSLContextParameters` bean bridged
from a Quarkus TLS configuration, because it requires a keystore location and
password, which a bridged bean does not provide.
+
+To secure a Kafka endpoint with a `quarkus.tls.*` configuration, configure the
Kafka client to resolve that configuration itself:
+
+[source,java]
+----
+from("kafka:my-topic"
+ + "?securityProtocol=SSL"
+ +
"&additionalProperties.ssl.engine.factory.class=io.quarkus.kafka.client.tls.QuarkusKafkaSslEngineFactory"
+ + "&additionalProperties.tls-configuration-name=kafka-tls")
+----
+
+[source,properties]
+----
+quarkus.tls.kafka-tls.key-store.p12.path=/path/to/keystore.p12
+quarkus.tls.kafka-tls.key-store.p12.password=changeit
+quarkus.tls.kafka-tls.trust-store.p12.path=/path/to/truststore.p12
+quarkus.tls.kafka-tls.trust-store.p12.password=changeit
+----
+
+Do not set `sslContextParameters` on the endpoint as well. When
`tls-configuration-name` is set, the Kafka client ignores the SSL properties
derived from it.
+
[id="extensions-tls-registry-usage-certificate-reload"]
=== Certificate Reload
diff --git a/extensions/tls-registry/runtime/src/main/doc/usage.adoc
b/extensions/tls-registry/runtime/src/main/doc/usage.adoc
index aa7dd393ac..f9c7d6354b 100644
--- a/extensions/tls-registry/runtime/src/main/doc/usage.adoc
+++ b/extensions/tls-registry/runtime/src/main/doc/usage.adoc
@@ -123,6 +123,32 @@ Some `quarkus.tls.*` options have no equivalent in
`SSLContextParameters`, becau
These options continue to apply to Quarkus's own TLS consumers as normal. Only
the Camel bridge is affected.
+=== Component Compatibility
+
+Most components should work as per the usage instructions defined in this
guide.
+
+The Camel Kafka component cannot use an `SSLContextParameters` bean bridged
from a Quarkus TLS configuration, because it requires a keystore location and
password, which a bridged bean does not provide.
+
+To secure a Kafka endpoint with a `quarkus.tls.*` configuration, configure the
Kafka client to resolve that configuration itself:
+
+[source,java]
+----
+from("kafka:my-topic"
+ + "?securityProtocol=SSL"
+ +
"&additionalProperties.ssl.engine.factory.class=io.quarkus.kafka.client.tls.QuarkusKafkaSslEngineFactory"
+ + "&additionalProperties.tls-configuration-name=kafka-tls")
+----
+
+[source,properties]
+----
+quarkus.tls.kafka-tls.key-store.p12.path=/path/to/keystore.p12
+quarkus.tls.kafka-tls.key-store.p12.password=changeit
+quarkus.tls.kafka-tls.trust-store.p12.path=/path/to/truststore.p12
+quarkus.tls.kafka-tls.trust-store.p12.password=changeit
+----
+
+Do not set `sslContextParameters` on the endpoint as well. When
`tls-configuration-name` is set, the Kafka client ignores the SSL properties
derived from it.
+
=== Certificate Reload
The extension automatically observes certificate reload events from Quarkus
TLS registry.
