// Module included in the following assemblies:
//
// assembly-kafka-broker-external-listeners-ingress.adoc

[id='con-kafka-broker-external-listeners-ingress-{context}']

= Exposing Kafka using Kubernetes `Ingress`

When exposing Kafka using using Kubernetes `Ingress` and the {NginxIngressController}, a dedicated `Ingress` resource is created for every Kafka broker pod.
An additional `Ingress` resource is created to serve as a Kafka bootstrap address.
Kafka clients can use these `Ingress` resources to connect to Kafka on port 443.

NOTE: External listeners using `Ingress` have been currently tested only with the {NginxIngressController}.

{ProductName} uses the TLS passthrough feature of the {NginxIngressController}.
Make sure TLS passthrough is enabled in your {NginxIngressController} deployment.
For more information about enabling TLS passthrough see {NginxIngressControllerTLSPassthrough}.
Because it is using the TLS passthrough functionality, TLS encryption cannot be disabled when exposing Kafka using `Ingress`.

The Ingress controller does not assign any hostnames automatically.
You have to specify the hostnames which should be used by the bootstrap and per-broker services in the `spec.kafka.listeners.external.configuration` section.
You also have to make sure that the hostnames resolve to the Ingress endpoints.
{ProductName} will not perform any validation that the requested hosts are available and properly routed to the Ingress endpoints.

.Example of an external listener of type `ingress`
[source,yaml,subs="attributes+"]
----
# ...
listeners:
  external:
    type: ingress
    authentication:
      type: tls
    configuration:
      bootstrap:
        host: bootstrap.myingress.com
      brokers:
      - broker: 0
        host: broker-0.myingress.com
      - broker: 1
        host: broker-1.myingress.com
      - broker: 2
        host: broker-2.myingress.com
# ...
----

For more information on using `Ingress` to access Kafka, see xref:proc-accessing-kafka-using-ingress-{context}[].

= Configuring the `Ingress` class

By default, the `Ingress` class is set to `nginx`.
You can change the `Ingress` class using the `class` property.

.Example of an external listener of type `ingress` using `Ingress` class `nginx-internal`
[source,yaml,subs="attributes+"]
----
# ...
listeners:
  external:
    type: ingress
    class: nginx-internal
    # ...
# ...
----

= Customizing the DNS names of external ingress listeners

On `ingress` listeners, you can use the `dnsAnnotations` property to add additional annotations to the ingress resources.
You can use these annotations to instrument DNS tooling such as {KubernetesExternalDNS}, which automatically assigns DNS names to the ingress resources.

.Example of an external listener of type `ingress` using `dnsAnnotations`
[source,yaml,subs="attributes+"]
----
# ...
listeners:
  external:
    type: ingress
    authentication:
      type: tls
    configuration:
      bootstrap:
        dnsAnnotations:
          external-dns.alpha.kubernetes.io/hostname: bootstrap.myingress.com.
          external-dns.alpha.kubernetes.io/ttl: "60"
        host: bootstrap.myingress.com
      brokers:
      - broker: 0
        dnsAnnotations:
          external-dns.alpha.kubernetes.io/hostname: broker-0.myingress.com.
          external-dns.alpha.kubernetes.io/ttl: "60"
        host: broker-0.myingress.com
      - broker: 1
        dnsAnnotations:
          external-dns.alpha.kubernetes.io/hostname: broker-1.myingress.com.
          external-dns.alpha.kubernetes.io/ttl: "60"
        host: broker-1.myingress.com
      - broker: 2
        dnsAnnotations:
          external-dns.alpha.kubernetes.io/hostname: broker-2.myingress.com.
          external-dns.alpha.kubernetes.io/ttl: "60"
        host: broker-2.myingress.com
# ...
----
