Can I config the pulsar TLS Encryption at tenant level?

[snailxr]

Is it possible to config the pulsar TLS Encryption at the tenant level?
For example, I only want one specific tenant enables the TLS, and the other tenant to disable the TLS
I can only get how to set TLS encryption for the pulsar at https://pulsar.apache.org/docs/2.11.x/security-tls-transport/.

[yuweisung]

It is possible to do so but an operational headache.
You can turn on/off tls encryption (pulsar+ssl, or pulsar) and set the advertisedlistener in individual brokers. Then use tenant/namespace isolation to force subset of brokers to serve tenants.
Technically, it is doable. But it is error-prone.

[jak78]

@snailxr welcome to the community! As @yuweisung wrote: this is doable but cumbersome. @snailxr could you tell us why you want to disable TLS at the tenant level?

[snailxr]

Thanks for your reply @yuweisung .
@jak78 Our product serves different customers who use the same Pulsar cluster, but each customer has different security requirements.

[snailxr]

@yuweisung Could you give me some steps or some links that I can refer to?