Exposing KafkaConnect Rest API over a route

[cstmgl]

Hi All,

We've built a visualization tool of the Kafka Connect REST APIs.
It does not do much but shows the configurations, topics, task status, etc...
I want to use this in a different Kubernetes cluster than my kafka so I'm trying to expose this REST API service over a route.
I'm using strimzi version 0.20.1

I have two setups, one using Openshift 3.11 and another using Openshift 4.6
In the one using Openshift 3.11 this works fine but in the one with Openshift 4.6 it does not work.
I believe this is because the cluster operator is generating network policies that prevents access to the KafkaConnect pod.
Anyway I'm trying to find ways to make this access to the service with the REST APIs working over the route but I can't seem to find a way, any ideas?
At the moment the only way I can make this work is inside the same cluster by providing access to the service directly but I would really like to do this over a Route.

[scholzj]

If you enabled the Connector operator, then there might be network policies - could that be the case? But you can easily add your own network policy with your own name to enable the access as you want it - including opening it for everyone. (I assume for routes, you might need to give the access to the HA Proxy / OCP Router pods? But right now I do not have OCP cluster around to give it a try and give you the exact network policy).

[scholzj]

So as I tried to explain ... your policy allows the access from the pods with label role: connect-rest-access in the same namespace (this is yours). If you wanna access it through a route, you would probably need to either configure the HA Proxy router in the from section or just open it completely by using:

  ingress:
    - ports:
        - protocol: TCP
          port: 8083

[cstmgl]

hum understood, I have to test it but I'm worried with the priority of contradicting policies, the one generated by the operator and mine.
That's why I was also trying to say there could be an access over the pod of connect itself

[scholzj]

Having multiple policies should not be an issue. They way they should be evaluated is that once at least one policies allows something then it should be allowed.

[cstmgl]

thank you it worked, I don't know why but I was assuming this network policies would be restrictive, meaning if something was preventing access you could only override it to a specific subset of criteria's not just do it like this.
but indeed it worked

[scholzj]

TBH, I do not really know the motivation for it ... but it is what it is I guess 🤷🏻‍♂️. Glad it works for you now.