Chapter 4. Creating an OpenShift route to access a Kafka cluster Create an OpenShift route to access a Kafka cluster outside of OpenShift. This procedure describes how to expose a Kafka cluster to clients outside the OpenShift environment. After the Kafka cluster is exposed, external clients can produce and consume messages from the Kafka cluster. To create an OpenShift route, a route listener is added to the configuration of a Kafka cluster installed on OpenShift. Warning An OpenShift Route address includes the name of the Kafka cluster, the name of the listener, and the name of the namespace it is created in. For example, my-cluster-kafka-listener1-bootstrap-amq-streams-kafka ( <cluster_name> -kafka- <listener_name> -bootstrap- <namespace> ). Be careful that the whole length of the address does not exceed a maximum limit of 63 characters. Prerequisites You have created a Kafka cluster on OpenShift . You need the OpenJDK keytool to manage certificates. (Optional) You can perform some of the steps using the OpenShift oc CLI tool. Procedure Navigate in the web console to the Operators > Installed Operators page and select Streams for Apache Kafka to display the operator details. Select the Kafka page to show the installed Kafka clusters. Click the name of the Kafka cluster you are configuring to view its details. We use a Kafka cluster named my-cluster in this example. Select the YAML page for the Kafka cluster my-cluster . Add route listener configuration to create an OpenShift route named listener1 . The listener configuration must be set to the route type. You add the listener configuration under listeners in the Kafka configuration. External route listener configuration apiVersion: kafka.strimzi.io/v1beta2 kind: Kafka metadata: name: my-cluster namespace: amq-streams-kafka spec: kafka: # ... listeners: # ... - name: listener1 port: 9094 type: route tls: true # ... The client connects on port 443, the default router port, but traffic is then routed to the port you configure, which is 9094 in this example. Save the updated configuration. Select the Resources page for the Kafka cluster my-cluster to locate the connection information you will need for your client. From the Resources page, you'll find details for the route listener and the public cluster certificate you need to connect to the Kafka cluster. Click the name of the my-cluster-kafka-listener1-bootstrap route created for the Kafka cluster to show the route details. Make a note of the hostname. The hostname is specified with port 443 in a Kafka client as the bootstrap address for connecting to the Kafka cluster. You can also locate the bootstrap address by navigating to Networking > Routes and selecting the amq-streams-kafka project to display the routes created in the namespace. Or you can use the oc tool to extract the bootstrap details. Extracting bootstrap information oc get routes my-cluster-kafka-listener1-bootstrap -o=jsonpath='{.status.ingress[0].host}{"\n"}' Navigate back to the Resources page and click the name of the my-cluster-cluster-ca-cert to show the secret details for accessing the Kafka cluster. The ca.crt certificate file contains the public certificate of the Kafka cluster. You will need the certificate to access the Kafka broker. Make a local copy of the ca.crt public certificate file. You can copy the details of the certificate or use the OpenShift oc tool to extract them. Extracting the public certificate oc extract secret/my-cluster-cluster-ca-cert --keys=ca.crt --to=- > ca.crt Create a local truststore for the public cluster certificate using keytool . Creating a local truststore keytool -keystore client.truststore.jks -alias CARoot -import -file ca.crt When prompted, create a password for accessing the truststore. The truststore is specified in a Kafka client for authenticating access to the Kafka cluster. You are now ready to start sending and receiving messages.

Commands:
apiVersion: kafka.strimzi.io/v1beta2 kind: Kafka metadata: name: my-cluster namespace: amq-streams-kafka spec: kafka: # listeners: # - name: listener1 port: 9094 type: route tls: true
get routes my-cluster-kafka-listener1-bootstrap -o=jsonpath='{.status.ingress[0].host}{"\n"}'
extract secret/my-cluster-cluster-ca-cert --keys=ca.crt --to=- > ca.crt
keytool -keystore client.truststore.jks -alias CARoot -import -file ca.crt