To set up Kafka brokers for TLS encryption or authentication, see Confluent's guide.
Configuration Recommendation
Broker-side (set within the server.properties file) offsets.retention.minutes=20160 (14 days or greater).
Broker-side (configured manually via Apache Kafka script or otherwise) Spread partition replicas evenly across availability zones (default if using 3 brokers) to ensure high availability of partitions. Kafka does not guarantee this when topics are created.