Running Dekaf behind Cilium Gateway API

[playworker]

Hi there, I'm having some trouble running Dekaf on a Kubernetes cluster using Cilium as CNI and using Cilium's Gateway API support - Cilium uses Envoy, Dekaf seems to use Envoy and I think the problem is that they're both trying to handle the gRPC traffic. Is there any way of disabling or bypassing the Dekaf built-in Envoy?

[visortelle]

Hi @playworker,
Dekaf use Envoy to translate grpc-web HTTP request between browser and Dekaf gRPC server endpoint.
It starts Envoy as a child process on random free ports.
Visual chart on how it works: https://github.com/visortelle/dekaf/blob/main/ARCHITECTURE.md#api-communication

If we would like to get-rid of Envoy, there are possible ways:

• Migrate all UI code from grpc-web to ConnectRPC, which has implemented Java server implementation.
• Wait for grpc-web support in java-grpc and/or ScalaPB, which is quite a lot of work.

At this point, both options don't look possible/easy to implement, therefore there are not plans of removing Envoy usage in Dekaf.

I wonder how built-in Dekaf Envoy can affect traffic on your Cilium setup.
I didn't use Cilium and probably miss something, but from my understanding, Dekaf's Docker container exposes HTTP port which should be used as a the target for you Cilium Gateway with HTTPRoute.

Could you provide some configs you use and logs to I could better understand the issue?