How to use traefik ingress controller with Strimzi 0.24.0

[cdesch]

I need to use the Traefik ingress controller instead of the NGINX Ingress Controller for the Kafka Cluster. As I was looking at the Strimzi Ingress Docs, I saw that the bootstrap and brokers can be given alias addresses like this:

      - name: external2
        port: 9095
        type: ingress
        tls: true
        authentication:
          type: tls
        configuration:
          bootstrap:
            host: bootstrap.myingress.com
          brokers:
          - broker: 0
            host: broker-0.myingress.com
          - broker: 1
            host: broker-1.myingress.com
          - broker: 2
            host: broker-2.myingress.com

Is there a way to configure this with nodeport or loadbalancer to give the ingress address for a Traefik ingress controller?

My ingress controller would look like this:

apiVersion: v1
kind: Service
metadata:
  name: my-cluster-kafka-ingress-service
spec:
  type: ClusterIP
  selector:
    app: my-cluster-kafka-external-bootstrap
  ports:
    - port: 80
      protocol: TCP
      targetPort: 9094
  sessionAffinity: ClientIP
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: my-cluster-kafka-ingress
spec:
  entryPoints:
    - web
    - websecure
  routes:
    - kind: Rule
      match: Host(`my-cluster.mycompany.com`)
      services:
        - kind: Service
          name: my-cluster-kafka-ingress-service
          port: 80

I also have to use port 80 on the ingress controller route because of restrictions outside my control. So, I effectively need the producer/consumer to connect to my-cluster.mycompany.com:80 on the ingress my-cluster-kafka-ingress, then get passed to my-cluster-kafka-ingress-service to use port 9094.

How can I configure the kakfa listener in strimzi to allow connections from my-cluster.mycompany.com:80 (no TLS)?

[scholzj]

The easiest way to do it is probably to:

• Use type: internal listener
• Override the advertised hostname / port (see the advertisedHost and advertisedPort here: https://strimzi.io/docs/operators/latest/full/using.html#type-GenericKafkaListenerConfigurationBroker-reference)
• Create the IngressRoute resources manually

I'm not sure about Traefik - for Nginx you also need to have TLS enabled and configure the Ingress router for TLS passthrough.

[cdesch]

Thanks @scholzj! I think I understand but I haven't gotten it to work yet. When using the internal service on port 9095, as I have in my listener config below, how should I reference it from the ingress? Should I just use the service my-cluster-kafka-brokers on port 9095?

Here is my config for the internal listener:

apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  name: my-kafka-cluster
spec:
  kafka:
    replicas: 3
    listeners:
      - name: plain
        port: 9092
        type: internal
        tls: false
      - name: tls
        port: 9093
        type: internal
        tls: true
        authentication:
          type: tls
      - name: external
        port: 9094
        type: nodeport
        tls: false
      - name: external2
        port: 9095
        type: internal
        tls: false
        configuration:
          brokers:
            - broker: 0
              advertisedHost: my-cluster.mycompany.com
              advertisedPort: 80
          # - broker: 1
          #   advertisedHost: example.hostname.1
          #   advertisedPort: 12341
          # - broker: 2
          #   advertisedHost: example.hostname.2
          #   advertisedPort: 12342

And then my ingress:

apiVersion: v1
kind: Service
metadata:
  name: my-cluster-kafka-ingress-service
spec:
  type: ClusterIP
  selector:
    app: my-cluster-kafka-brokers
  ports:
    - port: 80
      protocol: TCP
      targetPort: 9095
  sessionAffinity: ClientIP
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: my-cluster-kafka-ingress
spec:
  entryPoints:
    - web
    - websecure
  routes:
    - kind: Rule
      match: Host(`my-cluster.mycompany.com`)
      services:
        - kind: Service
          name: my-cluster-kafka-ingress-service
          port: 80

[scholzj]

Should I just use the service my-cluster-kafka-brokers on port 9095?

Well, keep in mind that you need an Ingress resource (or IngresRoute) per broker (+ possibly one additional for bootstrap). The per-broker ones should route to the per-broker-services on port 9095. The bootstrap one to the bootstrap service on port 9095.

Also, with NGINX, it would work only with tls: true in the Kafka listener and TLS passthrough enabled in the Ingress. NGINX would not work without it because it does not understand the Kafka TCP connections - TLS passhtorugh it the only way to tell it to forward the connection and not investigate the content.

[azherullahkhan]

Thank you @cdesch for initiating this discussion.
I'm trying to configure my kafka cluster to use Traefik Ingress Controller with TLS enabled.
@scholzj @cdesch could you please advice if this has been tested? If so, what is the process to have Kafka SSL passthrough with Traefik?

[cdesch]

I was not able to get this to work or test successfully. I think the issue is on the Kafa side with Authorized/Advertised hosts and port mappings... but I'm not sure and I am not good enough with Kafka to troubleshoot.