// Module included in the following assemblies:
//
// assembly-configuring-kafka-listeners.adoc

[id='proc-accessing-kafka-using-nodeports-{context}']
= Accessing Kafka using node ports

This procedure describes how to access a Strimzi Kafka cluster from an external client using node ports.

To connect to a broker, you need a hostname and port number for the Kafka _bootstrap address_,
as well as the certificate used for authentication.

.Prerequisites

* A Kubernetes cluster
* A running Cluster Operator

.Procedure

. Configure a `Kafka` resource with an external listener set to the `nodeport` type.
+
For example:
+
[source,yaml,subs=attributes+]
----
apiVersion: {KafkaApiVersion}
kind: Kafka
spec:
  kafka:
    # ...
    listeners:
      - name: external
        port: 9094
        type: nodeport
        tls: true
        authentication:
          type: tls
        # ...
    # ...
  zookeeper:
    # ...
----

. Create or update the resource.
+
[source,shell,subs=+quotes]
kubectl apply -f _KAFKA-CONFIG-FILE_
+
`NodePort` type services are created for each Kafka broker, as well as an external _bootstrap service_.
The bootstrap service routes external traffic to the Kafka brokers.
Node addresses used for connection are propagated to the `status` of the Kafka custom resource.
+
The cluster CA certificate to verify the identity of the kafka brokers is also created with the same name as the `Kafka` resource.

. Retrieve the bootstrap address you can use to access the Kafka cluster from the status of the `Kafka` resource.
+
[source,shell,subs=+quotes]
kubectl get kafka _KAFKA-CLUSTER-NAME_ -o=jsonpath='{.status.listeners[?(@.type=="external")].bootstrapServers}{"\n"}'

. If TLS encryption is enabled, extract the public certificate of the broker certification authority.
+
[source,shell,subs=+quotes]
kubectl get secret _KAFKA-CLUSTER-NAME_-cluster-ca-cert -o jsonpath='{.data.ca\.crt}' | base64 -d > ca.crt
+
Use the extracted certificate in your Kafka client to configure TLS connection.
If you enabled any authentication, you will also need to configure SASL or TLS authentication.
