<p>These resources provide a great view into how to setup kafka security (encryption + ssl) and good idea of  kafka listeners.</p>
<ol>
<li><a href="https://jaceklaskowski.gitbooks.io/apache-kafka/kafka-demo-ssl-authentication.html" rel="nofollow noreferrer">setting up ssl auth</a></li>
<li>listeners and advertised-listeners: <a href="https://medium.com/@iamsuraj/what-is-advertised-listeners-in-kafka-72e6fae7d68e" rel="nofollow noreferrer">a</a>, <a href="https://stackoverflow.com/questions/42998859/kafka-server-configuration-listeners-vs-advertised-listeners">b</a>, <a href="https://stackoverflow.com/questions/54942080/configuring-kafka-listeners">c</a>, <a href="https://rmoff.net/2018/08/02/kafka-listeners-explained/" rel="nofollow noreferrer">d</a>(from confluent guy - Robin M)</li>
</ol>
<p>But this seems to work well in static environments, what about dynamic environments.<br />
When one uses K8S, and containers (docker with k8s over EC2 etc) or some other orchestration framworks, the hostnames and the number of replicas (even without autoscaling scenario) are not known in advance.
So how can we create the certificates and the keystores and the truststores on the fly. And how to configure the <code>listeners</code> values on the fly in server.properties file.</p>

<p>This creates a kafka broker but as a load balancer</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  annotations:
    cloud.google.com/load-balancer-type: Internal
  labels:
    app: kafka
  name: kafka-2-external
  namespace: default
spec:
  ports:
  - name: broker
    port: 9092
    protocol: TCP
    targetPort: kafka
  selector:
    app: kafka
    statefulset.kubernetes.io/pod-name: kafka-2
  sessionAffinity: None
  type: LoadBalancer
</code></pre>
