Ports which Strimzi used for inter POD communications?

[sreejesh123]

I am trying to make use ASM in GKE for my automatic certificate management for cluster-ca and client-ca. but as discussed and understood service mesh integration is not there for strimzi . as a workaround I am trying to exclude all the ports which strimzi uses from istio injection. is that something possible or tried in past? if so what are the definitive list of ports which I need to avoid?

[scholzj]

Do you need only who listens on which port? Or also what connects to which port? I guess the ports things listen on are like this:

• ZooKeeper
  • 2181
  • 2888
  • 3888
  • 9404 (metrics)
• Kafka
  • 9090
  • 9091
  • and whatever ports you configure in the .spec.kafka.listeners section
  • 9404 (metrics)
• Entity Operator
  • 8080 (Metrics)
  • 8081 (Metrics)

[sreejesh123]

Thank you, I may need to know the what connect to which port too? Assuming Operator connecting to ZK , Topic operator ( new to this.. so apologies if this is wrong assumption I am making )

[scholzj]

So ...

• The Cluster Operator connects to ZooKeeper on 2181 and to Kafka on 9091
• The Entity Operator connects to ZooKeeper on 2181 and to Kafka on 9091
• ZooKeeper connects to other ZooKeepers on 2181, 2888 and 3888
• Kafka connects to ZooKeeper on 2181 and other Kafka brokers on 9090 and 9091

[sreejesh123]

thanks again. to just check is this something which anyone who uses strimzi with GKE has tried in past? just to keep not high hope. if its already tried and wont work :-)

[scholzj]

I never heard about anyone trying it or using it - definitely not with ASM. IIRC most people using Strimzi with Istio opted to exclude Strimzi pods from being injected the sidecars and configured some routing on the client apps running inside Istio. But to be clear, I have no idea how ASM differs from Istio nor have I actually used Strimzi with Istio my self.