AKS internal loadbalancer - broker is listing with IP address not the dns name

[Veljen]

Hi,

we used external listener 9094 for the internal loadbalancer. we have no external dns installed on AKS, we manage the dns records through terraform / manual. I would like to get the dns name instead of IP address for the broker..

 3 brokers:
  broker 0 at 10.88.4.36:9094 (controller)
  broker 2 at 10.88.4.35:9094
  broker 1 at 10.88.4.37:9094

- authentication:
          type: tls
        configuration:
          bootstrap:
            annotations:
              service.beta.kubernetes.io/azure-load-balancer-internal: "true"
          brokers:
          - annotations:
              service.beta.kubernetes.io/azure-load-balancer-internal: "true"
            broker: 0
          - annotations:
              service.beta.kubernetes.io/azure-load-balancer-internal: "true"
            broker: 1
          - annotations:
              service.beta.kubernetes.io/azure-load-balancer-internal: "true"
            broker: 2
        name: external
        port: 9094
        tls: true
        type: loadbalancer

without external dns , how can we override the external dns name for the broker and bootstrap for the loadbalancer type ?

[scholzj]

I'm not sure I fully follow your question. Strimzi will use the load balancer address provided to it by Kubernetes / your infrastructure. If it is an IP, then it will use an IP. If that is a DNS, then it will use DNS. To be honest, I do not remember what Azure normally uses. I know Google uses IPs and Amazon uses DNS names.

If you want to override the address Strimzi will use, you can use the advertisedHost fields for it (check the docs for the exact YAML). But keep in mind that Strimzi does not manage your DNS, so you have to make sure to assign the DNS name to the loadbalancer with some other means - be it ExternalDNS or something else.

[Veljen]

Sure, I only want to advertise and we will manage the private dns zone for it from azure.. In Azure loadbalancer provides IP not the dns.

[Veljen]

ahentication:
type: tls
configuration:
bootstrap:
alternativeNames:
- strimzibootstrap.example.com
annotations:
service.beta.kubernetes.io/azure-load-balancer-internal: "true"
brokers:
- advertisedHost: strimzi1-kafka.example.com
annotations:
service.beta.kubernetes.io/azure-load-balancer-internal: "true"
broker: 0
- advertisedHost: strimzi2-kafka.example.com
annotations:
service.beta.kubernetes.io/azure-load-balancer-internal: "true"
broker: 1
- advertisedHost: strimzi3-kafka.example.com
annotations:
service.beta.kubernetes.io/azure-load-balancer-internal: "true"
broker: 2
name: external
port: 9094
tls: true
type: loadbalancer

Thanks @scholzj , it works using this above... alternativeNames for Bootstrap and advertisedHost for brokers.

[Veljen]

@scholzj , in this case, we need to use custom certficate for brokercertchain for the listener? getting error from the consumer

org.apache.kafka.clients.NetworkClient)
[2024-01-24 12:38:45,280] ERROR Error processing message, terminating consumer process: (kafka.tools.ConsoleConsumer$)
org.apache.kafka.common.errors.SslAuthenticationException: SSL handshake failed
Caused by: javax.net.ssl.SSLHandshakeException: No subject alternative DNS name matching strimzi2-kafka.xxxx.com found.

[scholzj]

You should not need it. The advertised host should be automatically added to the server certificates. And the alternativeNames field can be used for the bootstrap DNS address.