[Yandex Cloud documentation](../index.md) > [Yandex Managed Service for Apache Kafka®](index.md) > Getting started

# Getting started with Managed Service for Apache Kafka®

To get started:
1. [Create a cluster](#cluster-create).
1. [Create a topic](#topic-create).
1. [Create a user](#account-create).
1. [Connect to the cluster](#connect).


## Getting started {#before-you-begin}

1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or sign up if not signed up yet.

1. If you do not have a folder yet, create one:

   1. In the [management console](https://console.yandex.cloud), in the top panel, click ![image](../_assets/console-icons/layout-side-content-left.svg) or ![image](../_assets/console-icons/chevron-down.svg) and select the [cloud](../resource-manager/concepts/resources-hierarchy.md#cloud).
   1. To the right of the cloud name, click ![image](../_assets/console-icons/ellipsis.svg).
   1. Select ![image](../_assets/console-icons/plus.svg) **Create folder**.
   
      ![create-folder1](../_assets/resource-manager/create-folder-1.png)
   
   1. Give your [folder](../resource-manager/concepts/resources-hierarchy.md#folder) a name. The naming requirements are as follows:
   
       * Length: between 3 and 63 characters.
       * It can only contain lowercase Latin letters, numbers, and hyphens.
       * It must start with a letter and cannot end with a hyphen.
   
   1. Optionally, specify the description for your folder.
   1. Select **Create a default network**. This will create a [network](../vpc/concepts/network.md#network) with subnets in each availability zone. Within this network, you will also have a [default security group](../vpc/concepts/security-groups.md#default-security-group), within which all network traffic will be allowed.
   1. Click **Create**.
   
      ![create-folder2](../_assets/resource-manager/create-folder-2.png)

1. [Assign](../iam/operations/roles/grant.md) the [vpc.user](../vpc/security/index.md#vpc-user) role and the [managed-kafka.editor role (or higher)](security/index.md#roles-list) to your Yandex Cloud account. These roles allow creating a cluster.

    {% note info %}
    
    If you cannot manage roles, contact your cloud or organization administrator.
    
    {% endnote %}

1. You can connect to an Apache Kafka® cluster from both inside and outside Yandex Cloud:

   * To connect from inside Yandex Cloud, create a [Linux](../compute/quickstart/quick-create-linux.md) VM in the same network as the cluster.

   * To connect to the cluster from the internet, enable public access when [creating](operations/cluster-create.md) it.

1. [Connect](../compute/operations/vm-connect/ssh.md) to your VM over SSH.

   {% note info %}

   It is assumed that you are connecting to the cluster from a [Linux](../compute/quickstart/quick-create-linux.md) VM.

   {% endnote %}

1. Install `kafkactl`, a command line interface for Apache Kafka®:

   ```bash
   wget https://github.com/deviceinsight/kafkactl/releases/download/v<version_number>/<archive_name>.tar.gz
   tar xzf <archive_name>.tar.gz kafkactl
   sudo mv kafkactl /usr/local/bin
   ```
   
   You can look up the archive version and name on the [`kafkactl` releases page](https://github.com/deviceinsight/kafkactl/releases).

   Check that you can [connect to the Managed Service for Apache Kafka® source cluster over SSL](operations/connect/clients.md#kafkactl) with `kafkactl`.


## Create a cluster {#cluster-create}

To create a cluster:
1. In the management console, select the folder where you want to create a cluster.
1. Navigate to **Managed Service for&nbsp;Kafka**.
1. Click **Create cluster**.
1. Specify the cluster settings and click **Create**. For more information, see [Creating a cluster](operations/cluster-create.md).
1. Wait until the cluster is ready: its status on the Managed Service for Apache Kafka® dashboard will change to `Running`, and its state, to `Alive`. This may take a while.

Then create a topic in the cluster.

## Create a topic {#topic-create}

A [topic](concepts/topics.md) is used to group message streams by category. [Producers](concepts/producers-consumers.md) write messages to a topic, and [consumers](concepts/producers-consumers.md) read messages from it.

To create a topic:
1. In the management console, select the folder containing the cluster.
1. Navigate to **Managed Service for&nbsp;Kafka**.
1. Click the cluster name and select the **Topics** tab.
1. Click **Create topic**.
1. Specify the topic settings and click **Create**. For details, see [Managing Apache Kafka® topics](operations/cluster-topics.md).

Then create users for producers and consumers.

## Create a user {#account-create}

User settings enable you to manage [producer and consumer](concepts/producers-consumers.md) permissions for cluster topics.

Learn more about the permissions you get with each role [here](concepts/account-roles.md).

To create a user:
1. In the management console, select the folder containing the cluster.
1. Navigate to **Managed Service for&nbsp;Kafka**.
1. Click the cluster name and select the **Users** tab.
1. Click **Create user**.
1. Enter a username and password (from 8 to 128 characters).
1. Click **![image](../_assets/console-icons/plus.svg) Add topic** and select the previously created topic from the drop-down list.
1. Grant access permissions for this topic to the producer and consumer. For more information, see [User management](operations/cluster-accounts.md).
1. Click **Create**.

Then connect to the cluster as this user.

## Connect to the cluster {#connect}

You can connect both the producer and consumer to the cluster as the same user. Both the producer and the consumer can work only with the topics that this user has access to.

To connect to your cluster:


1. If you are using security groups for your cloud network, [configure them](operations/connect/index.md#configuring-security-groups) to allow all relevant traffic between the cluster and the connecting host.


1. Install an SSL certificate on the VM:

   {% list tabs group=operating_system %}
   
   - Linux (Bash)/macOS (Zsh) {#linux-macos}
   
      ```bash
      mkdir -p /usr/local/share/ca-certificates/Yandex/ && \
      wget "https://storage.yandexcloud.net/cloud-certs/CA.pem" \
           --output-document /usr/local/share/ca-certificates/Yandex/YandexInternalRootCA.crt && \
      chmod 0655 /usr/local/share/ca-certificates/Yandex/YandexInternalRootCA.crt
      ```
   
      The certificate will be saved to the `/usr/local/share/ca-certificates/Yandex/YandexInternalRootCA.crt` file.
   
   - Windows (PowerShell) {#windows}
   
      ```powershell
      mkdir $HOME\.kafka; curl.exe -o $HOME\.kafka\YandexInternalRootCA.crt https://storage.yandexcloud.net/cloud-certs/CA.pem
      ```
   
      The certificate will be saved to the `$HOME\.kafka\YandexInternalRootCA.crt` file.
   
      Your corporate security policies and antivirus software may block the certificate download. For more information, see [FAQ](qa/index.md#get-ssl-error).
   
   {% endlist %}

1. Create a folder named `~/.config/kafkactl` and place the `config.yml` configuration file with your Apache Kafka® cluster connection parameters in that folder:

   ```bash
   cd ~/ && \
   mkdir --parents .config/kafkactl && \
   cd ~/.config/kafkactl
   ```

   Here is an example of the `config.yml` file:
   
   ```yaml
   contexts:
     default:
       brokers:
       - <broker_FQDN>:9091
       sasl:
         enabled: true
         username: <consumer_login>
         password: <consumer_password>
         mechanism: scram-sha512
       tls:
         enabled: true
         ca: /usr/local/share/ca-certificates/Yandex/YandexInternalRootCA.crt
   ```

   In the configuration file, specify the broker FQDN as well as the login and password of the Apache Kafka® user you created earlier.

   To learn how to get a broker host FQDN, see [this guide](operations/connect/index.md#get-fqdn).

1. To send a message to a topic, run this command:

   ```bash
   echo "test message" | kafkactl produce <topic_name>
   ```

1. To get messages from a topic, run the following command:

   ```bash
   kafkactl consume <topic_name>
   ```

For a detailed description of the Managed Service for Apache Kafka® cluster connection process, see [Connecting to topics in a cluster](operations/connect/clients.md).

## What's next {#whats-next}

* Read about the [service concepts](concepts/index.md).
* Learn more about [creating a cluster](operations/cluster-create.md) and [connecting to a cluster](operations/connect/index.md).