ingress in Layer 7 or Layer 4

[lanzhiwang]

Kafka client and broker use specific protocols to communicate. Whether these protocols are encapsulated by Layer 7 protocol or Layer 4 protocol, that is, whether the communication data between kafka client and broker is placed in http body or sent directly through socket？

[scholzj]

It is just a regular Kafka protocol. No encapsulation in HTTP. When using Strimzi with Nginx Ingress listeners, you have to enable TLS passthrough in the Ingress controller. And the Kafka listener is always using TLS. That way you trick the Ingress which by default expects to do Layer 7 HTTP handling to just think the Kafka TCP connection with TLs encryption is a HTTPS connection which should be passed through into the Kafka broker. But since the Ingress does not terminate the TLS encryption, it does not really know that it is not routing some actual HTTP based protocol but Kafka protocol.

[lanzhiwang]

I can think that the connection between the Kafka client and the broker is a tcp connection. Normally, the data is transmitted through the socket.
The reason why you can use nginx ingress for forwarding is because the tcp connection uses TLS encryption so that nginx ingress mistakenly thinks this is an http connection.

[lanzhiwang]

Why does nginx Ingress mistakenly think that encrypted tcp connection is similar to http connection?

[scholzj]

It is not mistake per se ... more a hack or workaround. When you have TLS Passthrough it means that the whole TLS stream is just forwarded to the next endpoint. And because it is not decrypted, Nginx never knows what is inside. That is expected. It also means that if you would use this for some actual HTTP traffic, with TLS Passthrough you can just use TLS-SNI to route it to particular Kubernetes service. But it would not do for example routing based on the path from the URL.

[lanzhiwang]

I get ,thank you