// Module included in the following assemblies:
//
// assembly-configuring-kafka-listeners.adoc

[id='proc-accessing-kafka-using-ingress-{context}']
= Accessing Kafka using ingress

This procedure shows how to access a Strimzi Kafka cluster from an external client outside of Kubernetes using Nginx Ingress.

To connect to a broker, you need a hostname (advertised address) for the Ingress _bootstrap address_,
as well as the certificate used for authentication.

For access using Ingress, the port is always 443.

.TLS passthrough

Kafka uses a binary protocol over TCP, but the {NginxIngressController} is designed to work with the HTTP protocol.
To be able to pass the Kafka connections through the Ingress, Strimzi uses the TLS passthrough feature of the {NginxIngressController}.
Ensure TLS passthrough is enabled in your {NginxIngressController} deployment.

Because it is using the TLS passthrough functionality, TLS encryption cannot be disabled when exposing Kafka using `Ingress`.

For more information about enabling TLS passthrough, see {NginxIngressControllerTLSPassthrough}.

.Prerequisites

* Kubernetes cluster
* Deployed {NginxIngressController} with TLS passthrough enabled
* A running Cluster Operator

.Procedure

. Configure a `Kafka` resource with an external listener set to the `ingress` type.
+
Specify the Ingress hosts for the bootstrap service and Kafka brokers.
+
For example:
+
[source,yaml,subs=attributes+]
----
apiVersion: {KafkaApiVersion}
kind: Kafka
spec:
  kafka:
    # ...
    listeners:
      - name: external
        port: 9094
        type: ingress
        tls: true
        authentication:
          type: tls
        configuration: <1>
          bootstrap:
            host: bootstrap.myingress.com
          brokers:
          - broker: 0
            host: broker-0.myingress.com
          - broker: 1
            host: broker-1.myingress.com
          - broker: 2
            host: broker-2.myingress.com
    # ...
  zookeeper:
    # ...
----
<1> Ingress hosts for the bootstrap service and Kafka brokers.

. Create or update the resource.
+
[source,shell,subs=+quotes]
kubectl apply -f _<kafka_configuration_file>_
+
`ClusterIP` type services are created for each Kafka broker, as well as an additional _bootstrap service_.
These services are used by the Ingress controller to route traffic to the Kafka brokers.
An `Ingress` resource is also created for each service to expose them using the Ingress controller.
The Ingress hosts are propagated to the `status` of each service.
+
The cluster CA certificate to verify the identity of the kafka brokers is also created in the secret `_<cluster_name>_-cluster-ca-cert`.
+
Use the address for the bootstrap host you specified in the `configuration` and port 443 (_BOOTSTRAP-HOST:443_) in your Kafka client as the _bootstrap address_ to connect to the Kafka cluster.

. Extract the public certificate of the broker certificate authority.
+
[source,shell,subs=+quotes]
kubectl get secret _KAFKA-CLUSTER-NAME_-cluster-ca-cert -o jsonpath='{.data.ca\.crt}' | base64 -d > ca.crt
+
Use the extracted certificate in your Kafka client to configure the TLS connection.
If you enabled any authentication, you will also need to configure SASL or TLS authentication.
