Enable multiple external listeners using ingress

[jesussancheztellomm]

Hello,

I am trying to setup two external listeners using an ingress and i got some errors. Could you please clarify if it is possible to have this setup?

      listeners:
      - name: plain
        port: 9092
        tls: false
        type: internal
      - authentication:
          type: tls
        name: tls
        port: 9093
        tls: true
        type: internal
      - authentication:
          type: tls
        configuration:
          bootstrap:
            annotations:
              kubernetes.io/ingress.class: kafka-nginx
            host: kafka-bootstrap.kafka-lab-01.mydomain.com
          brokers:
          - advertisedPort: 443
            annotations:
              kubernetes.io/ingress.class: kafka-nginx
            broker: 0
            host: kafka-broker-0.kafka-lab-01.mydomain.com
          - advertisedPort: 443
            annotations:
              kubernetes.io/ingress.class: kafka-nginx
            broker: 1
            host: kafka-broker-1.kafka-lab-01.mydomain.com
          - advertisedPort: 443
            annotations:
              kubernetes.io/ingress.class: kafka-nginx
            broker: 2
            host: kafka-broker-2.kafka-lab-01.mydomain.com
        name: external
        port: 9094
        tls: true
        type: ingress
      - authentication:
          checkAccessTokenType: false
          jwksEndpointUri: https://authn.mydomain.com/.well-known/jwks.json
          type: oauth
          userNameClaim: preferred_username
          validIssuerUri: https://authn.mydomain.com
        configuration:
          bootstrap:
            annotations:
              kubernetes.io/ingress.class: kafka-nginx
            host: kafka-bootstrap.kafka-lab-01-oauth.mydomain.com
          brokers:
          - advertisedPort: 443
            annotations:
              kubernetes.io/ingress.class: kafka-nginx
            broker: 0
            host: kafka-broker-0.kafka-lab-01-oauth.mydomain.com
          - advertisedPort: 443
            annotations:
              kubernetes.io/ingress.class: kafka-nginx
            broker: 1
            host: kafka-broker-1.kafka-lab-01-oauth.mydomain.com
          - advertisedPort: 443
            annotations:
              kubernetes.io/ingress.class: kafka-nginx
            broker: 2
            host: kafka-broker-2.kafka-lab-01-oauth.mydomain.com
        name: oauth
        port: 9095
        tls: true
        type: ingress

Broker errors:

2021-01-29 11:01:05,787 ERROR Exiting Kafka due to fatal exception (kafka.Kafka$) [main]
java.lang.IllegalArgumentException: requirement failed: Each listener must have a different port, listeners: REPLICATION-9091://kafka-lab-01-kafka-0.kafka-lab-01-kafka-brokers.kafka-lab-01.svc:9091,PLAIN-9092://kafka-lab-01-kafka-0.kafka-lab-01-kafka-brokers.kafka-lab-01.svc:9092,TLS-9093://kafka-lab-01-kafka-0.kafka-lab-01-kafka-brokers.kafka-lab-01.svc:9093,EXTERNAL-9094://kafka-broker-0.kafka-lab-01.mydomain.com:443,OAUTH-9095://kafka-broker-0.kafka-lab-01-oauth.mydomain.com:443
	at kafka.utils.CoreUtils$.validate$1(CoreUtils.scala:257)
	at kafka.utils.CoreUtils$.listenerListToEndPoints(CoreUtils.scala:268)
	at kafka.server.KafkaConfig.advertisedListeners(KafkaConfig.scala:1621)
	at kafka.server.KafkaConfig.validateValues(KafkaConfig.scala:1696)
	at kafka.server.KafkaConfig.<init>(KafkaConfig.scala:1674)
	at kafka.server.KafkaConfig.<init>(KafkaConfig.scala:1238)
	at kafka.server.KafkaConfig$.fromProps(KafkaConfig.scala:1218)
	at kafka.server.KafkaServerStartable$.fromProps(KafkaServerStartable.scala:34)
	at kafka.server.KafkaServerStartable$.fromProps(KafkaServerStartable.scala:29)
	at kafka.Kafka$.main(Kafka.scala:68)
	at kafka.Kafka.main(Kafka.scala)

If i set the advertisedPort for the oauth listener to another port, it works, but as far as i know, the ingress only supports 443.

Thanks in advance,
All the best

[scholzj]

What version of Kafka are you using? This was a bug in Kafka which does not allow to use the same port number twice. It indeed makes it impossible to use two ingress listeners at the same time. IIRC, 2.7.0 was supposed to contain the fix.

[jesussancheztellomm]

I am using 2.5.0

[scholzj]

I think this is the issue: https://issues.apache.org/jira/browse/KAFKA-10478 ... fixed in 2.7.0. So I guess you would need to upgrade to make it possible.