// Module included in the following assemblies:
//
// assembly-configuring-kafka-listeners.adoc

[id='proc-accessing-kafka-using-loadbalancers-{context}']
= Accessing Kafka using loadbalancers

This procedure describes how to access a Strimzi Kafka cluster from an external client using loadbalancers.

To connect to a broker, you need the address of the _bootstrap loadbalancer_,
as well as the certificate used for TLS encryption.

.Prerequisites

* A Kubernetes cluster
* A running Cluster Operator

.Procedure

. Configure a `Kafka` resource with an external listener set to the `loadbalancer` type.
+
For example:
+
[source,yaml,subs=attributes+]
----
apiVersion: {KafkaApiVersion}
kind: Kafka
spec:
  kafka:
    # ...
    listeners:
      - name: external
        port: 9094
        type: loadbalancer
        tls: true
        # ...
    # ...
  zookeeper:
    # ...
----

. Create or update the resource.
+
[source,shell,subs=+quotes]
kubectl apply -f _KAFKA-CONFIG-FILE_
+
`loadbalancer` type services and loadbalancers are created for each Kafka broker, as well as an external _bootstrap service_.
The bootstrap service routes external traffic to all Kafka brokers.
DNS names and IP addresses used for connection are propagated to the `status` of each service.
+
The cluster CA certificate to verify the identity of the kafka brokers is also created with the same name as the `Kafka` resource.

. Retrieve the address of the bootstrap service you can use to access the Kafka cluster from the status of the `Kafka` resource.
+
[source,shell,subs=+quotes]
kubectl get kafka _KAFKA-CLUSTER-NAME_ -o=jsonpath='{.status.listeners[?(@.type=="external")].bootstrapServers}{"\n"}'

. If TLS encryption is enabled, extract the public certificate of the broker certification authority.
+
[source,shell,subs=+quotes]
kubectl get secret _KAFKA-CLUSTER-NAME_-cluster-ca-cert -o jsonpath='{.data.ca\.crt}' | base64 -d > ca.crt
+
Use the extracted certificate in your Kafka client to configure TLS connection.
If you enabled any authentication, you will also need to configure SASL or TLS authentication.
