// Module included in the following assemblies:
//
// assembly-kafka-broker-external-listeners-nodeports.adoc

[id='con-kafka-broker-external-listeners-nodeports-{context}']

= Exposing Kafka using node ports

When exposing Kafka using `NodePort` type `Services`, Kafka clients connect directly to the nodes of Kubernetes.
You must enable access to the ports on the Kubernetes nodes for each client (for example, in firewalls or security groups).
Each Kafka broker pod is then accessible on a separate port.

An additional `NodePort` type of service is created to serve as a Kafka bootstrap address.

When configuring the advertised addresses for the Kafka broker pods, {ProductName} uses the address of the node on which the given pod is running.
Nodes often have multiple addresses.
The address type used is based on the first type found in the following order of priority:

. ExternalDNS
. ExternalIP
. Hostname
. InternalDNS
. InternalIP

You can use the `preferredAddressType` property in your listener configuration to specify the first address type checked as the node address.
This property is useful, for example, if your deployment does not have DNS support, or you only want to expose a broker internally through an internal DNS or IP address.
If an address of this type is found, it is used.
If the preferred address type is not found, {ProductName} proceeds through the types in the standard order of priority.

.Example of an external listener configured with a preferred address type
[source,yaml,subs=attributes+]
----
apiVersion: {KafkaApiVersion}
kind: Kafka
spec:
  kafka:
    # ...
    listeners:
      external:
        type: nodeport
        tls: true
        authentication:
          type: tls
        configuration:
          preferredAddressType: InternalDNS
    # ...
  zookeeper:
    # ...
----

By default, TLS encryption is enabled.
To disable it, set the `tls` field to `false`.

NOTE: TLS hostname verification is not currently supported when exposing Kafka clusters using node ports.

By default, the port numbers used for the bootstrap and broker services are automatically assigned by Kubernetes.
However, you can override the assigned node ports by specifying the requested port numbers in the `overrides` property.
{ProductName} does not perform any validation on the requested ports; you must ensure that they are free and available for use.

.Example of an external listener configured with overrides for node ports
[source,yaml,subs="attributes+"]
----
# ...
listeners:
  external:
    type: nodeport
    tls: true
    authentication:
      type: tls
    overrides:
      bootstrap:
        nodePort: 32100
      brokers:
      - broker: 0
        nodePort: 32000
      - broker: 1
        nodePort: 32001
      - broker: 2
        nodePort: 32002
# ...
----

For more information on using node ports to access Kafka, see xref:proc-accessing-kafka-using-nodeports-{context}[].

= Customizing the DNS names of external node port listeners

On `nodeport` listeners, you can use the `dnsAnnotations` property to add additional annotations to the nodeport services.
You can use these annotations to instrument DNS tooling such as {KubernetesExternalDNS}, which automatically assigns DNS names to the cluster nodes.

.Example of an external listener of type `nodeport` using `dnsAnnotations`
[source,yaml,subs="attributes+"]
----
# ...
listeners:
  external:
    type: nodeport
    tls: true
    authentication:
      type: tls
    overrides:
      bootstrap:
        dnsAnnotations:
          external-dns.alpha.kubernetes.io/hostname: kafka-bootstrap.mydomain.com.
          external-dns.alpha.kubernetes.io/ttl: "60"
      brokers:
      - broker: 0
        dnsAnnotations:
          external-dns.alpha.kubernetes.io/hostname: kafka-broker-0.mydomain.com.
          external-dns.alpha.kubernetes.io/ttl: "60"
      - broker: 1
        dnsAnnotations:
          external-dns.alpha.kubernetes.io/hostname: kafka-broker-1.mydomain.com.
          external-dns.alpha.kubernetes.io/ttl: "60"
      - broker: 2
        dnsAnnotations:
          external-dns.alpha.kubernetes.io/hostname: kafka-broker-2.mydomain.com.
          external-dns.alpha.kubernetes.io/ttl: "60"
# ...
----
