more

Author: amuraru

pkg/resources/envoygateway/envoygateway_test.go

@@ -166,3 +166,72 @@ func TestTCPRouteGeneration(t *testing.T) {
 		t.Errorf("Expected backend 'test-cluster-all-broker', got '%s'", tcpRoute.Spec.Rules[0].BackendRefs[0].Name)
 	}
 }
+
+func TestGatewayGenerationWithTLS(t *testing.T) {
+	cluster := &v1beta1.KafkaCluster{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-cluster",
+			Namespace: "test-namespace",
+		},
+		Spec: v1beta1.KafkaClusterSpec{
+			Brokers: []v1beta1.Broker{
+				{Id: 0},
+				{Id: 1},
+				{Id: 2},
+			},
+			EnvoyGatewayConfig: v1beta1.EnvoyGatewayIngressConfig{
+				GatewayClassName: "test-gateway-class",
+				TLSSecretName:    "test-tls-secret",
+			},
+		},
+	}
+
+	reconciler := &Reconciler{
+		Reconciler: resources.Reconciler{
+			KafkaCluster: cluster,
+		},
+	}
+
+	eListener := v1beta1.ExternalListenerConfig{
+		CommonListenerSpec: v1beta1.CommonListenerSpec{
+			Name:          "test-listener",
+			ContainerPort: 9092,
+		},
+		ExternalStartingPort: -1, // TLS enabled
+	}
+
+	ingressConfig := v1beta1.IngressConfig{
+		EnvoyGatewayConfig: &cluster.Spec.EnvoyGatewayConfig,
+	}
+
+	gateway := reconciler.gateway(eListener, ingressConfig)
+
+	gw, ok := gateway.(*gatewayv1.Gateway)
+	if !ok {
+		t.Fatal("Expected Gateway type")
+	}
+
+	// 3 brokers + 1 anycast = 4 listeners
+	if len(gw.Spec.Listeners) != 4 {
+		t.Errorf("Expected 4 listeners, got %d", len(gw.Spec.Listeners))
+	}
+
+	// When TLS is enabled (externalStartingPort == -1), all broker listeners should use the anycast port
+	expectedPort := gatewayv1.PortNumber(29092) // default anycast port
+	for i := 0; i < 3; i++ {
+		if gw.Spec.Listeners[i].Port != expectedPort {
+			t.Errorf("Expected broker %d port %d (anycast port when TLS enabled), got %d", i, expectedPort, gw.Spec.Listeners[i].Port)
+		}
+		if gw.Spec.Listeners[i].Protocol != gatewayv1.TLSProtocolType {
+			t.Errorf("Expected broker %d protocol TLS, got %s", i, gw.Spec.Listeners[i].Protocol)
+		}
+		if gw.Spec.Listeners[i].TLS == nil {
+			t.Errorf("Expected broker %d to have TLS config", i)
+		}
+	}
+
+	// Check anycast listener also uses the same port
+	if gw.Spec.Listeners[3].Port != expectedPort {
+		t.Errorf("Expected anycast port %d, got %d", expectedPort, gw.Spec.Listeners[3].Port)
+	}
+}

pkg/resources/envoygateway/gateway.go

@@ -54,7 +54,7 @@ func (r *Reconciler) gateway(eListener v1beta1.ExternalListenerConfig,
 	// Add listener for each broker
 	for _, broker := range r.KafkaCluster.Spec.Brokers {
 		listenerName := gatewayv1.SectionName(fmt.Sprintf("broker-%d", broker.Id))
-		port := eListener.ExternalStartingPort + broker.Id
+		port := eListener.GetBrokerPort(broker.Id)
 
 		listener := gatewayv1.Listener{
 			Name:     listenerName,

pkg/webhooks/kafkacluster_validator.go

@@ -142,6 +142,12 @@ func checkExternalListenerStartingPort(kafkaClusterSpec *banzaicloudv1beta1.Kafk
 	var allErrs field.ErrorList
 	const maxPort int32 = 65535
 	for i, extListener := range kafkaClusterSpec.ListenersConfig.ExternalListeners {
+		// Skip port validation when TLS is enabled (externalStartingPort == -1)
+		// In TLS mode, GetAnyCastPort() is used instead of externalStartingPort + brokerId
+		if extListener.TLSEnabled() {
+			continue
+		}
+
 		var outOfRangeBrokerIDs, collidingPortsBrokerIDs []int32
 		for _, broker := range kafkaClusterSpec.Brokers {
 			externalPort := util.GetExternalPortForBroker(extListener.ExternalStartingPort, broker.Id)

pkg/webhooks/kafkacluster_validator_test.go

@@ -248,6 +248,23 @@ func TestCheckExternalListenerStartingPort(t *testing.T) {
 						"test-external2", int32(8081), int32(8080), int32(29092), []int32{11})),
 			),
 		},
+		{
+			// When TLS is enabled (externalStartingPort == -1), port validation should be skipped
+			// because GetAnyCastPort() is used instead of externalStartingPort + brokerId
+			testName: "valid config: TLS enabled with externalStartingPort -1 (should skip port validation)",
+			kafkaClusterSpec: v1beta1.KafkaClusterSpec{
+				Brokers: []v1beta1.Broker{{Id: 0}, {Id: 1}, {Id: 2}},
+				ListenersConfig: v1beta1.ListenersConfig{
+					ExternalListeners: []v1beta1.ExternalListenerConfig{
+						{
+							CommonListenerSpec:   v1beta1.CommonListenerSpec{Name: "envoygateway"},
+							ExternalStartingPort: -1, // TLS enabled
+						},
+					},
+				},
+			},
+			expected: nil,
+		},
 	}
 
 	for _, testCase := range testCases {