How to expose Kafka strimzi via Ingress (HTTP and not HTTPS)?

[pidumenk]

Good morning,

Could someone please guide me for strmizi configuration? First of all, I cannot see all exisitng options for kafka.listeners.authentication.type, where can I take a look at? The following link does not work anymore.

Next I want to expose kafka externally via Ingress. But I don't want to use SSL, cause this setup only for testing purposes. That forces me to change code on my client side. I want to expose kafka via Ingress and connecting to HTTP. How can I achive that?

There is my configuration files:

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaNodePool
metadata:
  name: dual-role
  labels:
    strimzi.io/cluster: kafka-stage
spec:
  replicas: 1
  roles:
    - controller
    - broker
  storage:
    type: jbod
    volumes:
      - id: 0
        type: persistent-claim
        size: 10Gi
        deleteClaim: false
        class: openebs-hostpath
---

apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  name: kafka-stage
  annotations:
    strimzi.io/node-pools: enabled
    strimzi.io/kraft: enabled
spec:
  kafka:
    version: 3.7.0
    metadataVersion: 3.7-IV4
    listeners:
      - name: plain
        port: 9092
        type: internal
        tls: false
      - name: tls
        port: 9093
        type: internal
        tls: true
      - name: external
        port: 9094
        type: ingress
        tls: true
        authentication:
          type: tls
        configuration:
          bootstrap:
            host: kafka.stage.local.vm
            annotations:
              nginx.ingress.kubernetes.io/force-ssl-redirect: "false"
              nginx.ingress.kubernetes.io/backend-protocol: HTTP
          brokers:
          - broker: 0
            host: node01.kafka.stage.local.vm
            annotations:
              nginx.ingress.kubernetes.io/force-ssl-redirect: "false"
              nginx.ingress.kubernetes.io/backend-protocol: HTTP
    config:
      offsets.topic.replication.factor: 1
      transaction.state.log.replication.factor: 1
      transaction.state.log.min.isr: 1
      default.replication.factor: 1
      min.insync.replicas: 1
  entityOperator:
    topicOperator: {}
    userOperator: {}

When I connet to DNS through my browser, I see this error type:

This site can’t provide a secure connection kafka.stage.local.vm didn’t accept your login certificate, or one may not have been provided.
Try contacting the system admin.
ERR_BAD_SSL_CLIENT_AUTH_CERT

[scholzj]

Could someone please guide me for strmizi configuration? First of all, I cannot see all exisitng options for kafka.listeners.authentication.type, where can I take a look at? The following link does not work anymore.

You should share where exactly did you find this link so that we can fix it. (Please keep in mind that the rendered docs that you are supposed to use are on the Strimzi website - if you browse the docs on GitHub than the links will not work of course)

Next I want to expose kafka externally via Ingress. But I don't want to use SSL, cause this setup only for testing purposes. That forces me to change code on my client side. I want to expose kafka via Ingress and connecting to HTTP. How can I achive that?

That is not possible because Kafka is not HTTP protocol. The only reason why it works as HTTPS is that it uses TLS passthrough where the Ingress controller never decodes the traffic and never tries out to read the HTTP communication. If you don't want to use TLS, you have to use nodeport or loadbalancer listeners.

[pidumenk]

@scholzj, thank you for information. It is clear now.

Talking about broken link, I found this here: https://github.com/strimzi/strimzi-kafka-operator/blob/main/documentation/modules/security/proc-accessing-kafka-using-ingress.adoc

[scholzj]

Right. But the links are not really supposed to work int he sources but in the generated documentation. For example on the web or in the release downloads: https://strimzi.io/documentation/