// Module included in the following assemblies:
//
// assembly-configuring-kafka-listeners.adoc

[id='proc-accessing-kafka-using-routes-{context}']
= Accessing Kafka using OpenShift routes

This procedure describes how to access a Strimzi Kafka cluster from an external client outside of OpenShift using routes.

To connect to a broker, you need a hostname for the route _bootstrap address_,
as well as the certificate used for TLS encryption.

For access using routes, the port is always 443.

.Prerequisites

* An OpenShift cluster
* A running Cluster Operator

.Procedure

. Configure a `Kafka` resource with an external listener set to the `route` type.
+
For example:
+
[source,yaml,subs=attributes+]
----
apiVersion: {KafkaApiVersion}
kind: Kafka
metadata:
  labels:
    app: my-cluster
  name: my-cluster
  namespace: myproject
spec:
  kafka:
    # ...
    listeners:
      - name: listener1
        port: 9094
        type: route
        tls: true
        # ...
    # ...
  zookeeper:
    # ...
----
+
WARNING: An OpenShift Route address comprises the name of the Kafka cluster, the name of the listener, and the name of the namespace it is created in.
For example, `my-cluster-kafka-listener1-bootstrap-myproject` (_CLUSTER-NAME_-kafka-_LISTENER-NAME_-bootstrap-_NAMESPACE_). Be careful that the whole length of the address does not exceed a maximum limit of 63 characters.

. Create or update the resource.
+
[source,shell,subs=+quotes]
kubectl apply -f _<kafka_configuration_file>_
+
`ClusterIP` type services are created for each Kafka broker, as well as an external _bootstrap service_.
The services route the traffic from the OpenShift Routes to the Kafka brokers.
An OpenShift `Route` resource is also created for each service to expose them using the HAProxy load balancer.
DNS addresses used for connection are propagated to the `status` of each service.
+
The cluster CA certificate to verify the identity of the kafka brokers is also created in the secret `_<cluster_name>_-cluster-ca-cert`.

. Retrieve the address of the bootstrap service you can use to access the Kafka cluster from the status of the `Kafka` resource.
+
[source,shell,subs=+quotes]
kubectl get kafka _<kafka_cluster_name>_ -o=jsonpath='{.status.listeners[?(@.name=="_<listener_name>_")].bootstrapServers}{"\n"}'
+
For example:
+
[source,shell,subs=+quotes]
kubectl get kafka my-cluster -o=jsonpath='{.status.listeners[?(@.name=="listener1")].bootstrapServers}{"\n"}'

. Extract the public certificate of the broker certification authority.
+
[source,shell,subs=+quotes]
kubectl get secret _KAFKA-CLUSTER-NAME_-cluster-ca-cert -o jsonpath='{.data.ca\.crt}' | base64 -d > ca.crt
+
Use the extracted certificate in your Kafka client to configure TLS connection.
If you enabled any authentication, you will also need to configure SASL or TLS authentication.
