Broker behind Traefik Ingress

[Syndlex]

I am currently trying to set up an Artemis broker behind a Traefik ingress.

The problem is that Traefik does not support TLS passthrough on a standard Kubernetes Ingress resource (as far as I know), so I tried using an IngressRouteTCP instead:

acceptors:
  - name: mqtt
    expose: false
    port: 8883
    protocols: mqtt
    sslEnabled: true
    sslSecret: mqtt-server-cert
    bindToAllInterfaces: true
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: arkmq-ssl-acceptor
spec:
  entryPoints:
    - mqtt
  routes:
    - match: HostSNI(`mqtt-dev.*.*`)
      services:
        - name: artemis-broker-mqtt-0-svc
          port: 8883
  tls:
    passthrough: true

However, this configuration didn’t work. Created its own EntryPoint but testing the cert served there allways gave me my default cert for https traffic:
openssl s_client -connect mqtt-dev.*.*:8883 -servername mqtt-dev.*.* -showcerts 2>&1 | head -30

Is there a way to expose the broker using LoadBalancer-type services, similar to how Strimzi does it for Kafka?
For example: https://strimzi.io/blog/2019/05/13/accessing-kafka-part-4/

[subhidh-agarwal]

Not sure why you need sslPassthrough. When i was using nginx ingress, I had no choice but to use sslPassthrough.
After I changed to Traefik, I terminate the SSL at ingress (traefik) and its working fine for me.

[Syndlex]

We want to use the mtls cert to decide which topics a client can access. Without the passthrough we never get the certificate on the broker.

[brusdev]

You can use a resource template to customize the service created by the operator for the acceptor or ignore it and create your own custom service. With a resource template, you can customize the acceptor service type, i.e.

apiVersion: broker.amq.io/v1beta1
kind: ActiveMQArtemis
metadata:
  name: artemis-broker
spec:
  acceptors:
    - name: mqtt
      expose: false
      port: 8883
      protocols: mqtt
      sslEnabled: true
      sslSecret: mqtt-server-cert
      bindToAllInterfaces: true
  resourceTemplates:
  - selector:
      kind: "Service"
      name: "artemis-broker-mqtt-[0-9]+-svc"
    patch:
      kind: "Service"
      spec:
        type: LoadBalancer