Chapter 2. Evaluate AMQ Streams

Procedure

1. Ensure your subscription has been activated and your system is registered.

   For more information about using the Customer Portal to activate your Red Hat subscription and register your system for packages, see Appendix A, Using Your Subscription.

2. Download the amq-streams-x.y.z-ocp-install-examples.zip file from the AMQ Streams download site.

3. Unzip the file to any destination.

   • Windows or Mac: Extract the contents of the ZIP archive by double clicking on the ZIP file.
   • Red Hat Enterprise Linux: Open a terminal window in the target machine and navigate to where the ZIP file was downloaded.

   Extract the ZIP file with this command:

   unzip amq-streams-x.y.z-ocp-install-examples.zip

   Copy to Clipboard Toggle word wrap

Procedure

1. Login in to the OpenShift cluster using an account that has cluster admin privileges.

   For example:

   oc login -u system:admin

   Copy to Clipboard Toggle word wrap

2. Create a new kafka (project) namespace for the AMQ Streams Kafka Cluster Operator.

   oc new-project kafka

   Copy to Clipboard Toggle word wrap

3. Modify the installation files to reference the new kafka namespace where you will install the AMQ Streams Kafka Cluster Operator.

   Note

   By default, the files work in the myproject namespace.

   • On Linux, use:

   sed -i 's/namespace: .*/namespace: kafka/' install/cluster-operator/*RoleBinding*.yaml

   Copy to Clipboard Toggle word wrap
   • On Mac, use:

   sed -i '' 's/namespace: .*/namespace: kafka/' install/cluster-operator/*RoleBinding*.yaml

   Copy to Clipboard Toggle word wrap

4. Deploy the CRDs and role-based access control (RBAC) resources to manage the CRDs.

   oc project kafka
   oc apply -f install/cluster-operator/

   Copy to Clipboard Toggle word wrap

5. Create a new my-kafka-project namespace where you will deploy your Kafka cluster.

   oc new-project my-kafka-project

   Copy to Clipboard Toggle word wrap

6. Give access to my-kafka-project to a non-admin user developer.

   For example:

   oc adm policy add-role-to-user admin developer -n my-kafka-project

   Copy to Clipboard Toggle word wrap

7. Set the value of the STRIMZI_NAMESPACE environment variable to give permission to the Cluster Operator to watch the my-kafka-project namespace.

   oc set env deploy/strimzi-cluster-operator STRIMZI_NAMESPACE=kafka,my-kafka-project -n kafka

   Copy to Clipboard Toggle word wrap

   oc apply -f install/cluster-operator/020-RoleBinding-strimzi-cluster-operator.yaml -n my-kafka-project

   Copy to Clipboard Toggle word wrap

   oc apply -f install/cluster-operator/032-RoleBinding-strimzi-cluster-operator-topic-operator-delegation.yaml -n my-kafka-project

   Copy to Clipboard Toggle word wrap

   oc apply -f install/cluster-operator/031-RoleBinding-strimzi-cluster-operator-entity-operator-delegation.yaml -n my-kafka-project

   Copy to Clipboard Toggle word wrap

   The commands create role bindings that grant permission for the Cluster Operator to access the Kafka cluster.

8. Create a new cluster role strimzi-admin.

   oc apply -f install/strimzi-admin

   Copy to Clipboard Toggle word wrap

9. Add the role to the non-admin user developer.

   oc adm policy add-cluster-role-to-user strimzi-admin developer

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to the my-kafka-project namespace as user developer.

   For example:

   oc login -u developer
   oc project my-kafka-project

   Copy to Clipboard Toggle word wrap

   After new users log in to OpenShift Container Platform, an account is created for that user.

2. Create a new my-cluster Kafka cluster with 3 Zookeeper and 3 broker nodes.

   • Use ephemeral storage

   • Expose the Kafka cluster outside of the OpenShift cluster using an external listener configured to use route.

     cat << EOF | oc create -f -
     apiVersion: kafka.strimzi.io/v1beta1
     kind: Kafka
     metadata:
       name: my-cluster
     spec:
       kafka:
         replicas: 3
         listeners:
           - name: plain
             port: 9092
             type: internal
             tls: false
           - name: tls
             port: 9093
             type: internal
             tls: true
           - name: external
             port: 9094
             type: route 

     1

     
             tls: true
         storage:
           type: ephemeral
       zookeeper:
         replicas: 3
         storage:
           type: ephemeral
       entityOperator:
         topicOperator: {}
     EOF

     Copy to Clipboard Toggle word wrap

3. Wait for the cluster to be deployed:

   oc wait my-kafka-project/my-cluster --for=condition=Ready --timeout=300s -n kafka

   Copy to Clipboard Toggle word wrap

4. When your cluster is ready, create a topic to publish and subscribe from your external client.

   Create the following my-topic custom resource definition with 3 replicas and 3 partitions in the my-cluster Kafka cluster:

   cat << EOF | oc create -f -
   apiVersion: kafka.strimzi.io/v1beta1
   kind: KafkaTopic
   metadata:
     name: my-topic
     labels:
       strimzi.io/cluster: "my-cluster"
   spec:
     partitions: 3
     replicas: 3
   EOF

   Copy to Clipboard Toggle word wrap

Procedure

1. Find the address of the bootstrap route:

   oc get routes my-cluster-kafka-bootstrap -o=jsonpath='{.status.ingress[0].host}{"\n"}'

   Copy to Clipboard Toggle word wrap

   Use the address together with port 443 in your Kafka client as the bootstrap address.

2. Extract the public certificate of the broker certification authority:

   oc extract secret/my-cluster-cluster-ca-cert --keys=ca.crt --to=- > ca.crt

   Copy to Clipboard Toggle word wrap

3. Import the trusted certificate to a truststore:

   keytool -keystore client.truststore.jks -alias CARoot -import -file ca.crt

   Copy to Clipboard Toggle word wrap

   You are now ready to start sending and receiving messages.

Procedure

1. Download the latest version of the AMQ Streams archive (amq-streams-x.y.z-bin.zip) from the AMQ Streams download site.

   Unzip the file to any destination.

2. Open a terminal, and start the Kafka console producer with the topic my-topic and the authentication properties for TLS:

   bin/kafka-console-producer.sh --broker-list ROUTE-ADDRESS:443 --producer-property security.protocol=SSL --producer-property ssl.truststore.password=password --producer-property ssl.truststore.location=./client.truststore.jks --topic my-topic

   Copy to Clipboard Toggle word wrap
3. Type your message into the console where the producer is running.
4. Press Enter to send the message.

5. Open a new terminal tab or window, and start the Kafka console consumer to receive the messages:

   bin/kafka-console-consumer.sh --bootstrap-server ROUTE-ADDRESS:443 --consumer-property security.protocol=SSL --consumer-property ssl.truststore.password=password --consumer-property ssl.truststore.location=./client.truststore.jks --topic my-topic --from-beginning

   Copy to Clipboard Toggle word wrap
6. Confirm that you see the incoming messages in the consumer console.
7. Press Crtl+C to exit the Kafka console producer and consumer.