Option 1: Retrieving information for connection to Kafka using commands

Ensure security of communications from event emitters to Kafka.

1. Log in to the namespace where the Business Automation Insights is deployed.
2. Retrieve the bootstrap servers.

   BOOTSTRAP_SERVERS=$(oc get kafka iaf-system -o jsonpath='{.status.listeners[?(.name=="external")].bootstrapServers}')

3. Retrieve the Kafka username and password.

   KAFKA_SECRET=$(oc get kafkauser icp4ba-kafka-auth-0 -o jsonpath='{.status.secret}') KAFKA_USERNAME=${KAFKA_SECRET}
   
   KAFKA_PASSWORD=$(oc get secret ${KAFKA_SECRET} -o jsonpath='{.data.password}' | base64 -d)

4. Retrieve Kafka certificate either as plain text or a file to enable secure communications between the Kafka services and client event emitters.
   Note: Business Automation Insights Kafka components only support self-signed certificate that it generates.
   • Option 1: To retrieve the Kafka CA certificate in plain text:

     KAFKA_CA_CERT=$(oc get kafka iaf-system -o jsonpath='{.status.listeners[?(.name=="external")].certificates[0]}')

   • Option 2: To retrieve the Kafka CA certificate as a file:

     oc get secret/iaf-system-cluster-ca-cert -o "jsonpath={.data.ca\.crt}" | openssl enc -d -base64 -A > kafka-iaf-ca.crt

   • Option 3: Retrieve the truststore in the p12 and jks formats (for the IBM BPM and Case event emitters). For instructions on retrieving the truststore in p12 format, see Generating a truststore for the BPM event emitter or Generating a truststore for the Case event emitter. To retrieve the truststore in jks format, perform the following steps:
     1. Retrieve the environment information.

        JOB_MANAGER_POD=$(oc get pod -n <namespace> -l component=jobmanager --no-headers -o custom-columns=":metadata.name")
        TRUSTSTORE_PATH=$(oc get pods ${JOB_MANAGER_POD} -n <namespace> -o jsonpath='{.spec.containers[?(@.name=="flink-main-container")].env[?(@.name=="TRUSTSTORE_PATH")].value}')
        TRUSTSTORE_PASSWORD_PATH=$(oc get pods ${JOB_MANAGER_POD} -n <namespace> -o jsonpath='{.spec.containers[?(@.name=="flink-main-container")].env[?(@.name=="TRUSTSTORE_PASSWORD_PATH")].value}')
        

     2. Retrieve the truststore.

        oc cp -n <namespace> -c flink-main-container ${JOB_MANAGER_POD}:${TRUSTSTORE_PATH} truststore.p12

     3. Retrieve the truststore password in plain text.

        oc exec -it -c flink-main-container ${JOB_MANAGER_POD} -n <namespace> – cat ${TRUSTSTORE_PASSWORD_PATH}

5. Retrieve the SASL mechanism and security protocol.
   For the Kafka sasl.mechanism parameter, use SCRAM-SHA-512. For the Kafka security.protocol parameter, use SASL_SSL.