14.5. Accessing Kafka using node ports

Procedure

1. Configure a Kafka resource with an external listener set to the nodeport type.

   For example:

   apiVersion: kafka.strimzi.io/v1beta2
   kind: Kafka
   metadata:
     labels:
       app: my-cluster
     name: my-cluster
     namespace: myproject
   spec:
     kafka:
       # ...
       listeners:
         - name: external4
           port: 9094
           type: nodeport
           tls: true
           authentication:
             type: tls
           # ...
       # ...
     zookeeper:
       # ...

2. Create or update the resource.

   oc apply -f <kafka_configuration_file>

   A cluster CA certificate to verify the identity of the kafka brokers is created in the secret my-cluster-cluster-ca-cert.

   NodePort type services are created for each Kafka broker, as well as an external bootstrap service.

   Node port services created for the bootstrap and brokers

   NAME                                  TYPE      CLUSTER-IP      PORT(S)
   my-cluster-kafka-external4-0          NodePort  172.30.55.13    9094:31789/TCP
   my-cluster-kafka-external4-1          NodePort  172.30.250.248  9094:30028/TCP
   my-cluster-kafka-external4-2          NodePort  172.30.115.81   9094:32650/TCP
   my-cluster-kafka-external4-bootstrap  NodePort  172.30.30.23    9094:32650/TCP

   The bootstrap address used for client connection is propagated to the status of the Kafka resource.

   Example status for the bootstrap address

   status:
     clusterId: Y_RJQDGKRXmNF7fEcWldJQ
     conditions:
       - lastTransitionTime: '2023-01-31T14:59:37.113630Z'
         status: 'True'
         type: Ready
     kafkaVersion: 3.7.0
     listeners:
       # ...
       - addresses:
           - host: ip-10-0-224-199.us-west-2.compute.internal
             port: 32650
         bootstrapServers: 'ip-10-0-224-199.us-west-2.compute.internal:32650'
         certificates:
           - |
             -----BEGIN CERTIFICATE-----
   
             -----END CERTIFICATE-----
         name: external4
     observedGeneration: 2
     operatorLastSuccessfulVersion: 2.7
    # ...

3. Retrieve the bootstrap address you can use to access the Kafka cluster from the status of the Kafka resource.

   oc get kafka my-cluster -o=jsonpath='{.status.listeners[?(@.name=="external4")].bootstrapServers}{"\n"}'
   
   ip-10-0-224-199.us-west-2.compute.internal:32650

4. Extract the cluster CA certificate.

   oc get secret my-cluster-cluster-ca-cert -o jsonpath='{.data.ca\.crt}' | base64 -d > ca.crt

5. Configure your client to connect to the brokers.

   1. Specify the bootstrap host and port in your Kafka client as the bootstrap address to connect to the Kafka cluster. For example, ip-10-0-224-199.us-west-2.compute.internal:32650.

   2. Add the extracted certificate to the truststore of your Kafka client to configure a TLS connection.

      If you enabled a client authentication mechanism, you will also need to configure it in your client.