kafka-proxy with LoadBalancer service

kafka-gateway-external-lb.yaml

{{ range $i := until (int $.brokers) }}
---
apiVersion: v1
kind: Service
metadata:
  name: kafka-gateway-{{ $i }}-0
  namespace: kafka-gateway
spec:
  ports:
  - name: plain
    port: 32400
  selector:
    app: kafka-gateway
    node: kafka-gateway-{{ $i }}
  type: LoadBalancer
  loadBalancerSourceRanges:
    - x.x.x.x/32
{{ end }}

kafka-gateway-sts.yaml

{{ range $i := until (int $.brokers) }}
---
apiVersion: apps/v1beta2
kind: StatefulSet
metadata:
   name: kafka-gateway-{{ $i }}
   namespace: kafka-gateway
spec:
  selector:
    matchLabels:
      app: kafka-gateway
  replicas: 1
  podManagementPolicy: Parallel
  serviceName: kafka-gateway
  template:
    metadata:
      labels:
        app: kafka-gateway
        node: kafka-gateway-{{ $i }}
    spec:
      containers:
        - name: kafka-gateway
          image: grepplabs/kafka-proxy:latest
          args:
            - 'server'
            - '--log-format=json'
            - '--bootstrap-server-mapping=kafka-{{ $i }}-0:9093,0.0.0.0:32400,kafka-gateway-{{ $i }}-0.{{ $.dnszone }}:32400'
            {{- range $j := until (int $.brokers) }}
            - '--external-server-mapping=kafka-{{ $j }}-0:9093,kafka-gateway-{{ $j }}-0.{{ $.dnszone }}:32400'
            {{- end }}
            - '--tls-enable'
            - '--tls-ca-chain-cert-file=/var/run/secret/kafka-ca-chain-certificate/ca-chain.cert.pem'
            - '--tls-client-cert-file=/var/run/secret/kafka-clients-certificate/service-client-client.cert.pem'
            - '--tls-client-key-file=/var/run/secret/kafka-clients-key/service-client-client.key.pem'
            - '--tls-client-key-password=$(KAFKA_TLS_CLIENT_KEY_PASSWORD)'
            - '--sasl-enable'
            - '--sasl-jaas-config-file=/var/run/secret/kafka-client-jaas/kafka-client-jaas.config'
            - '--proxy-listener-tls-enable'
            - '--proxy-listener-cert-file=/var/run/secret/kafka-gateway-server-certificate/server.cert.pem'
            - '--proxy-listener-key-file=/var/run/secret/kafka-gateway-server-key/server.key.pem'
            - '--proxy-listener-key-password=$(KAFKA_GATEWAY_TLS_SERVER_KEY_PASSWORD)'
            - '--proxy-request-buffer-size=32768'
            - '--proxy-response-buffer-size=32768'
            - '--proxy-listener-read-buffer-size=32768'
            - '--proxy-listener-write-buffer-size=131072'
            - '--kafka-connection-read-buffer-size=131072'
            - '--kafka-connection-write-buffer-size=32768'
            - '--auth-gateway-server-enable'
            - '--auth-gateway-server-method=google-id'
            - '--auth-gateway-server-magic=3068974682682244952'
            - '--auth-gateway-server-command=/google-id-verify'
            - '--auth-gateway-server-param="--scope=kafka"'
          env:
          - name: KAFKA_TLS_CLIENT_KEY_PASSWORD
            valueFrom:
              secretKeyRef:
                name: kafka-clients-certificate-passphrase
                key: client-crt-passwd
          - name: KAFKA_GATEWAY_TLS_SERVER_KEY_PASSWORD
            valueFrom:
              secretKeyRef:
                name: kafka-gateway-server-key-passphrase
                key: server-key-passwd
          volumeMounts:
          - name: "kafka-client-jaas"
            mountPath: "/var/run/secret/kafka-client-jaas"
          - name: "ca-chain-certificate"
            mountPath: "/var/run/secret/kafka-ca-chain-certificate"
          - name: "kafka-clients-certificate"
            mountPath: "/var/run/secret/kafka-clients-certificate"
          - name: "kafka-clients-key"
            mountPath: "/var/run/secret/kafka-clients-key"
          - name: "kafka-gateway-server-certificate"
            mountPath: "/var/run/secret/kafka-gateway-server-certificate"
          - name: "kafka-gateway-server-key"
            mountPath: "/var/run/secret/kafka-gateway-server-key"
          ports:
          - name: metrics
            containerPort: 9080
          - name: kafka
            containerPort: 32400
          livenessProbe:
            httpGet:
              path: /health
              port: 9080
            initialDelaySeconds: 5
            periodSeconds: 3
          readinessProbe:
            httpGet:
              path: /health
              port: 9080
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 5
            successThreshold: 2
            failureThreshold: 5
          resources:
            requests:
              memory: 128Mi
              cpu: 1000m
      restartPolicy: Always
      terminationGracePeriodSeconds: 10
      volumes:
      - name: kafka-client-jaas
        secret:
          secretName: kafka-clients-jaas-config-kafkagateway
      - name: ca-chain-certificate
        secret:
          secretName: ca-chain-certificate
      - name: kafka-clients-certificate
        secret:
          secretName: kafka-clients-certificate
      - name: kafka-clients-key
        secret:
          secretName: kafka-clients-key
      - name: kafka-gateway-server-certificate
        secret:
          secretName: kafka-gateway-server-certificate
      - name: kafka-gateway-server-key
        secret:
          secretName: kafka-gateway-server-key
{{ end }}