Chapter 4. Creating an OpenShift route to access a Kafka cluster

Procedure

1. Navigate in the web console to the Operators > Installed Operators page and select Streams for Apache Kafka to display the operator details.
2. Select the Kafka page to show the installed Kafka clusters.

3. Click the name of the Kafka cluster you are configuring to view its details.

   We use a Kafka cluster named my-cluster in this example.

4. Select the YAML page for the Kafka cluster my-cluster.

5. Add route listener configuration to create an OpenShift route named listener1.

   The listener configuration must be set to the route type. You add the listener configuration under listeners in the Kafka configuration.

   External route listener configuration

   apiVersion: kafka.strimzi.io/v1beta2
   kind: Kafka
   metadata:
     name: my-cluster
     namespace: streams-kafka
   spec:
     kafka:
       # ...
       listeners:
         # ...
         - name: listener1
           port: 9094
           type: route
           tls: true
   # ...

   The client connects on port 443, the default router port, but traffic is then routed to the port you configure, which is 9094 in this example.

6. Save the updated configuration.

7. Select the Resources page for the Kafka cluster my-cluster to locate the connection information you will need for your client.

   From the Resources page, you’ll find details for the route listener and the public cluster certificate you need to connect to the Kafka cluster.

8. Click the name of the my-cluster-kafka-listener1-bootstrap route created for the Kafka cluster to show the route details.

9. Make a note of the hostname.

   The hostname is specified with port 443 in a Kafka client as the bootstrap address for connecting to the Kafka cluster.

   You can also locate the bootstrap address by navigating to Networking > Routes and selecting the streams-kafka project to display the routes created in the namespace.

   Or you can use the oc tool to extract the bootstrap details.

   Extracting bootstrap information

   oc get routes my-cluster-kafka-listener1-bootstrap -o=jsonpath='{.status.ingress[0].host}{"\n"}'

10. Navigate back to the Resources page and click the name of the my-cluster-cluster-ca-cert to show the secret details for accessing the Kafka cluster.

    The ca.crt certificate file contains the public certificate of the Kafka cluster.

    You will need the certificate to access the Kafka broker.

11. Make a local copy of the ca.crt public certificate file.

    You can copy the details of the certificate or use the OpenShift oc tool to extract them.

    Extracting the public certificate

    oc extract secret/my-cluster-cluster-ca-cert --keys=ca.crt --to=- > ca.crt

12. Create a local truststore for the public cluster certificate using keytool.

    Creating a local truststore

    keytool -keystore client.truststore.jks -alias CARoot -import -file ca.crt

    When prompted, create a password for accessing the truststore.

    The truststore is specified in a Kafka client for authenticating access to the Kafka cluster.

    You are now ready to start sending and receiving messages.