Ingress configurations for individual brokers.

[Sai-Charan-Madhvaraj]

Hi Team,

when we are creating an external listener type ingress. we are providing bootstrap and brokers details in configuration section. This is creating 4 ingress ( one for bootstrap and 3 for each individual broker) .

After reading docs of strimzi, understood that when kafka client hits bootstrap ingress , bootstrap will provide the metadata of brokers and then kafka client will then connect to each individual broker ingress.

Can strimzi bootstrap establish the connection to individual brokers via per broker services (cluster IP) instead of individual broker ingress so that the number of ingress created by strimzi can be reduced.

The number of ingress resources keeps increasing as we increase the broker count.

apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  name: kafka
  namespace: kafka
spec:
  kafka:
    version: 3.0.0
    replicas: 3
    listeners:
      - name: external
        port: 9094
        type: ingress
        tls: true
        authentication:
          type: scram-sha-512
        configuration:
          bootstrap:
            host: kafka-bootstrap.digital.net
          brokers:
          - broker: 0
            host: kafka-kafka-0.digital.net
          - broker: 1
            host: kafka-kafka-1.digital.net
          - broker: 2
            host: kafka-kafka-2.digital.net
          brokerCertChainAndKey:
            certificate: tls.crt
            key: tls.key
            secretName: kafka-listener-cert
      - name: tls
        port: 9093
        type: internal
        tls: true

[scholzj]

If your clients can use Cluster-IP services to connect to the brokers (which normally means they are running inside the same Kubernetes cluster), you do not need the ingress listener at all and you can just use either the internal or the cluster-ip type listeners.

[Sai-Charan-Madhvaraj]

@scholzj , our clients are hosted outside of kubernetes cluster hence we are using external listener. i am just thinking if there can be a possibility to reduce the no of ingress resources.

[scholzj]

But it's the client who needs to connect directly to the brokers. So if the client is running outside, it needs the per-broker Ingress resources to be able to connect to the brokers.

[scholzj]

I mean ... you you would replace it with the cluster-ip services, the client will not be able to reach them and would not work.

[Sai-Charan-Madhvaraj]

Okay got it , which means per broker ingress is mandatory for all the clients running outside of kubernetes cluster.