oc project <cp4ba-namespace>

Replace <cp4ba-namespace>

# Get details of the Kafka resource to validate that it is installed.
oc get kafka -o name

If Kafka is installed, the output of the command above should look similar to kafka.ibmevents.ibm.com/iaf-system


# Get bootstrap server from CP4BA installation
BOOTSTRAP_SERVER=$(oc get cartridgerequirements icp4ba -o jsonpath='{.status.components.kafka.endpoints[?(.scope=="External")].bootstrapServers}')
# Store information into bash file
echo "BOOTSTRAP_SERVER=${BOOTSTRAP_SERVER}" > .kafka-connection-info

Inspect the.kafka-connection-info file and make sure that the expression ${BOOTSTRAP_SERVER} was properly replaced with the actual value.

# Find Kubernetes secret where username and password were stored during installation
KAFKA_SECRET=$(oc get cartridgerequirements icp4ba -o jsonpath='{.status.components.kafka.endpoints[?(.scope=="External")].authentication.secret.secretName}')
# Get SCRAM username
KAFKA_USERNAME=${KAFKA_SECRET}
# Get SCRAM password
KAFKA_PASSWORD=$(oc extract secret/${KAFKA_SECRET} --keys=password --to=-)
# Store information into bash file
echo "KAFKA_USERNAME=${KAFKA_USERNAME}" >> .kafka-connection-info
echo "KAFKA_PASSWORD=${KAFKA_PASSWORD}" >> .kafka-connection-info

Inspect the .kafka-connection-info file to make sure that ${KAFKA_USERNAME} and ${KAFKA_PASSWORD} were properly replaced with the actual values.

# Copy bash file into a Kafka pod. In this case we are choosing kafka-0
oc cp .kafka-connection-info $(oc get pods | grep -i kafka-0 | awk '{print $1}'):/tmp/.kafka-connection-info

Notice that we are copying this file into the very first Kafka pod, broker node zero, but you can choose any other node available.

# Login into Kafka pod.  In this case we are connecting to kafka-0
oc rsh $(oc get pods | grep -i kafka-0 | awk '{print $1}')

export PATH=$PATH:/opt/kafka/bin

You can validate the commands are now accessible by running the kafka-topics.sh command as a test. If the command is accessible, you should be able to see help content for the command.

# Run kafka-topics command to get help details
kafka-topics.sh

# Go too /tmp directory
cd /tmp

# Make variables previously defined available
source /tmp/.kafka-connection-info
# Get password to access truststore from strimzi configuration file 
TS_PASSWORD=$(cat /tmp/strimzi.properties | grep "zookeeper.ssl.truststore.password"  | cut -d= -f 2)
# Get location of truststore from strimzi configuration file 
TS_LOCATION=$(cat /tmp/strimzi.properties | grep "zookeeper.ssl.truststore.location"  | cut -d= -f 2)
    
# Create new properties file with the properties used by the CLI
cat <<EOF > /tmp/kafka-cli.properties
##########
# Kafka CLI parameters
##########
security.protocol=SASL_SSL
sasl.mechanism=SCRAM-SHA-512
sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="${KAFKA_USERNAME}" password="${KAFKA_PASSWORD}";
ssl.truststore.type=JKS
ssl.truststore.password=${TS_PASSWORD}
ssl.truststore.location=${TS_LOCATION}
EOF

Notice how we are setting security.protocol and sasl.mechanims to the general security configuration values previously discussed. We are also leveraging the username and password obtained for SCRAM based authentication. Finally to properly configure the SSL communication between the Kafka services and the Kafka CLI, we are going to use a truststore already generated during installation which contains the certificate applied to all Kafka brokers. The ssl.truststore.location and ssl.truststore.password are used to configure the location of the truststore file within the pod and the password required to access the truststore respectively. 

Before moving on to the next step, inspect the /tmp/kafka-cli.properties file and make sure that the values for the TS_PASSWORD, TS_LOCATION, KAFKA_USERNAME and KAFKA_PASSWORD were substituted properly.

# Make variables such as BOOTSTRAP_SERVER available
source /tmp/.kafka-connection-info
# List topics in this Kafka installation
kafka-topics.sh --list --bootstrap-server ${BOOTSTRAP_SERVER} --command-config /tmp/kafka-cli.properties

Notice that many commands of the Kafka CLI require you to specify the bootstrap server to connect. The BOOTSTRAP_SERVER variable holding the Kafka bootstrap server was previously added to the .kafka-connection-info bash file.

In this example, we used the --command-config flag to provide the connection details required by the kafka-topics.sh command. The name of this flag can vary from command to command. For example the kafka-console-producer.sh command uses the --producer.config flag instead. While the flag name can be different, the same property file can be used across commands.

# Copy the kafka-cli.properties file to the machine where the oc command is running
oc cp $(oc get pods | grep -i kafka-0 | awk '{print $1}'):/tmp/kafka-cli.properties ./kafka-cli.properties