The Real-Time Context Engine is now generally available. The Real-Time Context Engine delivers real-time data from your Kafka topics to AI agents through the Model Context Protocol (MCP). You enable the Real-Time Context Engine on a topic, and your agents can immediately query the most current data. For more information, see Real-Time Context Engine.

Managed MCP servers for Confluent Cloud are now generally available. You can connect your AI assistant to Confluent Cloud to explore environments, inspect topics and schemas, debug connectors, and query metrics using natural language. For more information, see Managed MCP Servers.

You can use the Confluent open-source MCP server to connect AI assistants to Confluent Cloud, Confluent Platform, and other on-premises Kafka deployments. For more information, see Open-Source MCP Server.

Confluent agent skills are now generally available. You can use AI-powered guides with coding agents like Claude Code, Cursor, and GitHub Copilot to build production-ready streaming applications. For more information, see Agent Skills.

Streaming Agents in Confluent Intelligence are now generally available, and you can now create, manage, and monitor Streaming Agents in the Confluent Cloud Console. For more information, see Streaming Agents and Manage Agents in the Console.

The AI_DETECT_PII built-in function is now available as an Early Access feature. Use AI_DETECT_PII to detect and optionally redact personally identifiable information (PII) in streaming text with Flink SQL. For more information, see Detect PII in Text.

Global API keys are now available. A global API key is a new authentication credential type that works across Confluent Cloud services and resources based on the principal’s assigned permissions. Use global API keys to simplify multi-resource management in Terraform, enable seamless client transitions between clusters without changing authentication, and streamline development workflows that access multiple Confluent Cloud resources with a single credential. Global API keys support Cloud Management APIs, REST APIs, Kafka clusters (Dedicated, Enterprise, and Freight), Schema Registry on private networking, Tableflow, Flink, and ksqlDB. Global API keys do not currently support Basic or Standard Kafka clusters, or Schema Registry clusters on public networking. For more information, refer to Global API keys. For information about quota limits, refer to Service Quotas for Confluent Cloud.

Materialized tables in Confluent Cloud for Apache Flink are now generally available. A materialized table is a persistent, declarative object that combines a table definition, a continuous query, and the ability to evolve the pipeline over time, all in a single manageable asset. Use materialized tables for long-running streaming queries that act as incremental materialized views, with automated in-place migration when the query or schema changes. For more information, see Materialized Tables in Confluent Cloud for Apache Flink.

You can now deregister Confluent Platform clusters and Connect clusters from USM using the Confluent Cloud Console. For more information, see Deregister a Kafka cluster and Deregister a Connect cluster.

The service quota for Confluent Cloud API keys per organization has been increased from 1,000 to 3,000. The quota is tracked using the iam.max_cloud_api_keys.per_org service quota code.

The service quota for API keys per Dedicated Kafka cluster has been increased from 2,000 to 20,000. For Enterprise and Freight clusters, the limit has been increased from 500 to 2,500. The quota is tracked using the kafka.max_api_keys.per_cluster service quota code. For more information, see API keys and Cluster limit comparison.

The fully-managed Solace Source connector for Confluent Cloud is now generally available for your Apache Kafka® clusters on AWS, Azure, and Google Cloud. The connector moves messages from a Solace PubSub+ event broker to an Kafka topic. For more information, see Solace Source Connector for Confluent Cloud.

The fully-managed Azure Log Analytics Sink V2 connector for Confluent Cloud is now generally available for your Apache Kafka® clusters on AWS, Azure, and Google Cloud. The connector streams records from Kafka topics to an Azure Log Analytics workspace using the Azure Logs Ingestion API. For more information, see Azure Log Analytics Sink V2 Connector for Confluent Cloud.

The fully-managed MongoDB Change Data Capture Source (Debezium) connector for Confluent Cloud is now generally available for your Apache Kafka® clusters on AWS, Azure, and Google Cloud. The connector provides a high-availability pipeline that captures real-time document-level changes from MongoDB replica sets or sharded clusters and delivers structured event streams to Kafka without the need for complex polling logic. For more information, see MongoDB CDC Source (Debezium) Connector for Confluent Cloud.

The Confluent Cloud API documentation has been redesigned for a better user experience and is now AI agent optimized. Enhancements include versioned OpenAPI specifications with llms.txt for improved AI agent discovery, lifecycle stage indicators, Command+K search, dark mode, auto-generated code samples in over 30 languages, and responsive mobile design. For more information, see API Reference for Confluent Cloud.

Azure Private Link connectivity now uses the gateway model, replacing the PrivateLink Attachment resource with ingress PrivateLink Gateway and PrivateLink Access Point resources. Gateways provide unique fully qualified domain names (FQDNs) for each Private Link connection, enabling private connectivity from a single VNet to multiple Confluent Cloud environments. For more information, see Use Azure Private Link for Serverless Products on Confluent Cloud.

Google Cloud Private Service Connect connectivity now uses the gateway model, replacing the PrivateLink Attachment resource with ingress PrivateLink Gateway and PrivateLink Access Point resources. Gateways provide unique FQDNs for each Private Service Connect connection, enabling private connectivity from a single VPC to multiple Confluent Cloud environments. For more information, see Use Google Cloud Private Service Connect for Serverless Products on Confluent Cloud.

The TimescaleDb (Debezium) Single Message Transform (SMT) is now available for fully-managed Debezium PostgreSQL CDC V2 Source connectors in Confluent Cloud. The SMT processes raw change event records captured from TimescaleDB databases, enabling logical routing, metadata enrichment, and streamlined handling of time-series data. For more information, see Kafka Connect TimescaleDB (Debezium) SMT Usage Reference for Confluent Cloud.

For OAuth/OIDC identity providers with a common issuer URI and JWKS URI, such as Google (https://accounts.google.com), new identity pool filters under that identity provider must now include a filter on the sub (subject) or aud (audience) claim. When creating or updating an identity pool, Confluent Cloud verifies that the filter includes a meaningful conditional on either sub or aud to enforce tenant validation on the token at authentication time. For more information, see OAuth/OIDC Identity Pool Filters Requirement Update in Confluent Cloud.

Confluent Cloud now supports native integrations to DataDog as a third-party observability integration. This is an Early Access feature. This integration routes and stores your logging data to your preferred centralized platforms. For more information, see Manage observability integrations.

Self-managed encryption keys (BYOK) can now be deleted immediately when you delete a cluster, instead of after a five-day hold period. This change applies to AWS, Azure, and Google Cloud. However, deleted keys cannot be reused to create another cluster for five days. For more information, see Use Self-Managed Encryption Keys in Confluent Cloud on AWS, Use Self-Managed Encryption Keys in Confluent Cloud on Azure, and Use Self-Managed Encryption Keys in Confluent Cloud on Google Cloud.

Egress PrivateLink connectivity is now generally available for Confluent Cloud custom connectors on AWS. You can use AWS PrivateLink egress access points with custom connectors on Enterprise clusters in AWS. For more information, see Use AWS Egress PrivateLink Endpoints for Serverless Products on Confluent Cloud.

Confluent Cloud for Apache Flink now supports writing the Schema Registry schema ID to the Kafka record header. Set the new key.format.id-encoding and value.format.id-encoding table options to header to produce records without the Confluent wire-format payload prefix. This is useful when downstream consumers expect raw payloads or read schema IDs from the record header.

Consumer lag monitoring for Confluent Platform clusters in USM now includes a searchable and sortable list of consumer groups. The list features new columns for Protocol, Consumers, and Topics, and supports CSV export. For more information, see Monitor Consumer Lag for Confluent Platform Clusters.

The Salesforce Bulk API 2.0 Source connector now supports custom SOQL queries, giving you control over which fields and records are retrieved from Salesforce. For more information, see Custom query support.

Snapshot queries in Confluent Cloud for Apache Flink are now available as an Open Preview feature. Query your data in batch mode across Kafka on all clouds and union reads from Kafka and Tableflow on AWS with snapshot queries in Flink. For more information, refer to Snapshot Queries in Confluent Cloud for Apache Flink.

Streaming Agents now support reflection workflows (Open Preview), which iteratively refine agent output through a drafter-critic loop. For more information, refer to Improve Agent Output with Reflection Workflows.

Streaming Agents now support system log tables (Open Preview), which capture detailed agent execution logs. For more information, see Monitor Streaming Agents with Confluent Cloud.

The fully-managed Google BigQuery Sink V2 connector now supports the String input format. The connector consumes raw string from an Kafka topic and writes it to BigQuery without parsing the string even if it contains valid JSON data. For more information, see Google BigQuery Sink V2 Connector for Confluent Cloud.

You can now increase the number of partitions for a topic directly from the Confluent Cloud Console. Navigate to your topic, select Settings, click Edit settings, and update the Number of partitions value. Note that the topic cannot have active traffic when increasing partitions. For more information, see num.partitions.

The service quota for pending user account invitations per organization has been increased from 150 to 300, allowing organizations to invite more users simultaneously. The quota is tracked using the iam.max_pending_invitations.per_org service quota code. For more information, see User accounts.

Confluent Cloud for Apache Flink® now supports Custom Late Data Handling to prevent data loss when using aggressive watermarking strategies. Late data handling enables you to filter late-arriving events at the source and preserve them in System Tables for later reconciliation or backfill. Configure late data behavior with the late-handling.mode table property set to either pass-through (default) or filter. Filtered late data is automatically available in System Tables with the $late suffix. For more information, see Handle Late-Arriving Data.

The Metrics API now includes a new metric, io.confluent.kafka.server/connection_accept_count, which provides a count of new connections accepted by your Kafka cluster. This metric helps you understand and monitor your ECKU scaling. For more information, see Query for connection accept count to monitor ECKU scaling.

Confluent Cloud for Apache Flink® now supports transparent decryption for Client-Side Field Level Encryption and Client-Side Payload Encryption as a Limited Availability release. When you grant DeveloperRead permission on Key Encryption Keys, Flink automatically decrypts encrypted fields for processing, enabling all SQL operations on encrypted data while maintaining end-to-end encryption. This feature supports both authorized and unauthorized access patterns with deterministic encryption for limited operations. For more information, see Process Encrypted Data with Confluent Cloud for Apache Flink.

Event-time timers are now available for process table functions (PTFs) in Confluent Cloud for Apache Flink®. Timers enable PTFs to schedule callbacks at specific event-time watermark positions, enabling patterns like inactivity detection, session timeouts, and delayed processing. Register timers with TimeContext.registerOnTime(), handle callbacks in onTimer(), and use REQUIRE_ON_TIME to bind a watermarked timestamp column. For more information, see Event-time timers.

The following fully-managed connectors are now deprecated and will reach their end of life (EOL) on April 6, 2027:

• Azure Cosmos DB Source [Deprecated]

• Azure Cosmos DB Sink [Deprecated]

• ServiceNow Source (Legacy) [Deprecated]

• Redis Sink [Deprecated]

• Elasticsearch Service Sink [Deprecated]

For more information about deprecated connectors and migration guidance, see Deprecated and end of life connectors.

Client-Side Payload Encryption (CSPE) is now generally available. You can use CSPE to encrypt Kafka message payloads on the client side before producing data to Confluent Cloud, providing end-to-end protection for highly sensitive data. CSPE integrates with Schema Registry for policy enforcement and uses envelope encryption with customer-managed keys backed by external Key Management Systems (KMS). This feature simplifies protection of fully sensitive datasets and complements existing client-side encryption capabilities such as Client-Side Field-Level Encryption (CSFLE). For more information, see Protect Sensitive Data Using Client-Side Payload Encryption.

Confluent Cloud for Apache Flink® introduces default compute pools, which are created automatically when you first use Flink in an environment and region. With a default compute pool, you can start running SQL statements immediately without creating a compute pool manually. Default pools scale automatically based on your workload needs, up to 50 CFUs by default, and are shared across all users in the same environment and region who don’t specify a user-created pool. You can still create compute pools for advanced use cases like workload isolation, budgeting, and security isolation. For more information, see default compute pools.

Confluent Cloud Gateway version 1.2.0 is now available. This release introduces the following features to simplify cloud migrations, provide flexible authentication options, and expand client support:

• SASL/SCRAM authentication support. Confluent Cloud Gateway now supports SASL/SCRAM for client-to-Confluent Gateway communication. This enables authentication translation from SCRAM to mTLS and other SASL protocols, helping you migrate existing SCRAM workloads from Amazon MSK and other Kafka deployments to Confluent Cloud. For more information, see Authentication configuration.

• NONE authentication mode. The NONE authentication mode allows you to disable authentication for client-to-Confluent Gateway or Confluent Gateway-to-cluster connections. This mode supports seamless authentication swapping between NONE and SASL mechanisms during deployment transitions. For more information, see Configure authentication swapping mode.

• Fencing filter for traffic management. The fencing filter enables you to pause and resume client traffic on specific routes. This capability supports zero-cutover migrations by controlling client access to routes during critical migration windows. For more information, see Configure and Deploy Confluent Cloud Gateway.

• Expanded librdkafka support. Confluent Cloud Gateway now supports librdkafka client versions 2.0.0 through 2.13.0. This update enables non-Java clients to use the full range of Confluent Gateway capabilities.

Process table functions (PTFs) are now available as an Early Access feature in Confluent Cloud for Apache Flink®. PTFs enable custom, stateful stream processing logic with managed state. Use PTFs to implement complex windowing, deduplication, state machines, and real-time analytics that cannot be expressed with standard SQL. PTFs are written in Java and deployed as artifacts to Confluent Cloud. Timers are not included in this release. For more information, see Process Table Functions.

The Metrics API has been enhanced to include a principal.name field in responses that contain a principal.id. The principal.name field is only returned when a name has been set for the principal. This field provides the human-readable name associated with the principal.id, making it easier to identify and understand metrics related to specific principals. For more information, see Query for metrics for a specific Principal ID.

Custom Single Message Transforms (SMT) is now generally available for your Apache Kafka® clusters on Google Cloud (GCP) regions. This update expands the existing Custom SMT support beyond AWS and Azure to include all supported Google Cloud regions. For more information, see Custom SMT for Confluent Cloud Limitations and Support.

Secret manager integration with Confluent Cloud is now generally available. This feature enables Confluent Cloud to fetch sensitive configuration values such as secrets for your connectors at runtime, removing the need to persist secrets within Confluent’s boundary. The secret manager supports integration with Azure Key Vault and AWS Secrets Manager. To explore its full range of features and get started, see Create a secret manager integration in Confluent Cloud.

The enable.dynamic.flush configuration property is now available for the fully-managed Snowflake Sink Connector for Confluent Cloud. Use this property to allow each connector task to consume up to twice as many topic partitions, depending on the buffer size. This setting optimizes workloads that have many partitions but low throughput per partition.

The disable.mqcsp.authentication configuration property is now available for the fully-managed IBM MQ Source Connector for Confluent Cloud. Use this property to disable MQCSP authentication in the connector.

Added two new auditable event methods for OAuth/OIDC identity provider JWKS key management:

• RefreshIdentityProviderKeys: Tracks user-initiated requests to refresh JWKS keys for an identity provider.

• ScheduledJwksRefresh: Tracks automated scheduled refreshes of JWKS keys for an identity provider.

Confluent Cloud for Apache Flink® now supports dbt (data build tool) for deploying and managing Flink SQL transformations. The dbt-confluent adapter enables you to define streaming transformations as dbt models, test them, and deploy them through CI/CD pipelines. For more information, see Deploy Flink SQL Statements with dbt and Confluent Cloud for Apache Flink.

Confluent Cloud for Apache Flink is now available in six additional regions across AWS, Azure, and Google Cloud:

• AWS: ap-southeast-7 (Thailand)

• Azure: swedencentral (Gävle, Sweden)

• Google Cloud: asia-east1 (Taiwan), australia-southeast2 (Melbourne, Australia), me-central2 (Dammam, Saudi Arabia), us-south1 (Dallas, USA)

All new regions support both public and private networking. For the complete list of supported regions, see Supported Cloud Regions for Confluent Cloud for Apache Flink.

Google Cloud Private Service Connect (PSC) support is now available for the fully-managed Couchbase Source and Sink connectors in Confluent Cloud. To configure these connectors with an Egress PSC on Google Cloud, see:

• Couchbase Source on Google Cloud

• Couchbase Sink on Google Cloud

The snowflake.disable.ocsp.checks configuration property is now available for the fully-managed Snowflake Sink Connector for Confluent Cloud. Use this property to disable Online Certificate Status Protocol (OCSP) certificate revocation checks for Snowflake JDBC connections.

The following configuration property updates are now available for the fully-managed MongoDB Atlas Sink Connector for Confluent Cloud:

• A new configuration property topic.override.map to override sink connector properties for specific topics.

• A new DATA value for mongo.errors.tolerance configuration property to provide more granular error handling than the Connect frameworks.

The following notification enhancements are now available:

• Granular resource-level notifications that enable alerts to be configured directly on individual resources such as connectors and clusters. This allows teams to subscribe only to what they care about.

• Environment-level muting which enables you to suppress notifications for environments.

For more information, see Manage notifications for a resource.

Confluent Intelligence now supports new built-in AI functions for anomaly detection (AI_DETECT_ANOMALIES), forecasting (AI_FORECAST), and sentiment analysis (AI_SENTIMENT). For more information, see Built-in AI/ML Functions with Confluent Cloud for Apache Flink.

Confluent Cloud for Apache Flink® now supports external connectivity for user-defined functions (UDFs) as an Early Access feature. External connectivity enables UDFs to interact with external systems and services, like REST APIs, directly from your UDF code. You create Connection objects in Confluent Cloud to manage endpoints and secrets securely, bind connections to UDFs by using the USING CONNECTIONS clause in CREATE FUNCTION, and access connection details at runtime through FunctionContext. For the Early Access release, only Java stateless scalar and table functions with public endpoints are supported. For more information, see External connectivity and Step 0: Create a connection (optional).

Data time-to-live (TTL) is now available in Limited Availability for Tableflow. With data TTL, you can configure Tableflow to automatically delete table rows when they become older than a specified retention period, helping reduce storage costs for time-sensitive data. For more information, see Data TTL.

The Query Profiler for Confluent Cloud for Apache Flink® now includes data skew metrics and subtask analysis. A new Skew column on the Task and Operator metrics tables shows data distribution imbalances across parallel subtasks. A new subtask breakdown view enables per-subtask analysis to pinpoint hot subtasks. For more information, see Data skew and Subtask breakdown.

The Query Profiler for Confluent Cloud for Apache Flink now supports DEGRADED statements, enabling you to diagnose performance issues on statements that are unable to make consistent progress.

Confluent Intelligence now supports Amazon S3 Vectors as a vector search provider. You can use Flink SQL to perform vector similarity searches on S3 Vectors databases for real-time retrieval-augmented generation (RAG) use cases. For more information, see Vector Search with External Databases.

Support for Schema IDs in Kafka headers is now generally available in Confluent Cloud. This feature enables you to store schema IDs in message headers instead of the message payload. For more information, see Wire format and Blog: Schema IDs in Kafka Headers - Data Governance.

Confluent Intelligence now supports Anthropic and Fireworks AI as remote model providers. For more information, see Run an AI Model with Confluent Cloud.

Confluent Cloud for Apache Flink® updates the default watermark strategy (SOURCE_WATERMARK()) to use a fixed out-of-orderness tolerance of 180 milliseconds. The new strategy produces watermarks immediately without requiring a minimum number of records per partition. The idle timeout for progressive idleness detection now starts at 10 seconds instead of 15 seconds. Additionally, when a partition becomes idle, it forwards its latest event time so that idle partitions no longer block query results. If your data has out-of-orderness that exceeds 180ms, define a custom watermark strategy. For more information, see SOURCE_WATERMARK.

Confluent Intelligence now supports vector search with Azure Cosmos DB. You can use Flink SQL to perform vector similarity searches on Cosmos DB vector databases for real-time retrieval-augmented generation (RAG) use cases. For more information, see Vector Search with External Databases.

mTLS authentication is now generally available on AWS Enterprise and Freight clusters. For details, see Configure Mutual TLS (mTLS) Authentication.

The query configuration property is now available for the following Confluent Cloud JDBC source connectors. Use this property to execute custom SQL queries for joining tables or selecting specific data subsets.

• Microsoft SQL Server Source (JDBC)

• MySQL Source (JDBC)

• Oracle Database Source (JDBC)

• PostgreSQL Source (JDBC)

The Streams Rebalance Protocol (KIP-1071) is now generally available for Kafka Streams applications with Enterprise and Dedicated clusters. This broker-driven rebalancing system reduces coordination overhead and improves failure detection, leading to more stable and responsive stream processing workloads. Kafka Streams client version 4.2 or later is required to use this feature. For more information, see Streams Rebalance Protocol.

Queues for Kafka provides queue semantics and elastic consumer scaling natively to Kafka through share groups and share consumers. This feature enables organizations to consolidate their messaging infrastructure while gaining elastic consumer scaling and per-message processing controls. Share groups and share consumers complement Kafka’s traditional consumer API and consumer groups.

Confluent Cloud supports all client and group level configs from KIP-932 and introduces a new share partition lag metric in the metrics API.

Added compressed documentation index for use in AI coding agents. This index provides a persistent context to AI coding agents by mapping documentation topics to their source files. For more information, see Compressed documentation index for coding agents.

The mq.destination.suppress.rfh2 configuration property is now available for the Confluent Cloud IBM MQ Sink connector. Use this property when migrating from self-managed connectors to match previous message formatting behavior.

Confluent Cloud now includes Kafka KIP-890 Transactions Server-Side Defense, which prevents hanging transactions. Updates in the newest version:

• Infinite out-of-order sequence errors are prevented.

• Transactional producers reject non-zero sequences when no producer ID state exists on the partition for the transaction.

To receive the full benefits of KIP-890, use Apache Kafka® 4.1 or higher compatible clients. For more information, see kafka’s Transaction Protocol.

Confluent Cloud now supports ingress gateways for private connections with your virtual private clouds (VPCs) in AWS. With a gateway, you can connect your VPC to multiple Confluent Cloud environments through AWS PrivateLink. To establish a connection, you register an interface VPC endpoint with a gateway access point. For more information, see Use AWS PrivateLink for Serverless Products on Confluent Cloud.

Gateways and access points are now the supported resources for private connections between AWS and Confluent Cloud. They replace PrivateLink Attachment (PLATT) resources and PLATT connections. Support for PLATT will end in a future release.

The fully-managed Elasticsearch Sink V2 connector for Confluent Cloud is now generally available for your Apache Kafka® clusters on AWS, Azure, and Google Cloud. The connector writes data from a topic in Kafka to an Elasticsearch index. To explore a full range of features and get started with the connector, see Elasticsearch Sink V2 connector.

Expanded the Operator role to include the ability to describe access granted to resources through RBAC.

The maximum CKU limit for Dedicated clusters on AWS has increased from 152 to 252 CKUs. For more information, see Confluent Unit for Kafka.

The fully-managed Google BigQuery Sink V2 Connector for Confluent Cloud supports a hexadecimal converter for _CHANGE_SEQUENCE_NUMBER values. The converter automatically transforms decimal values to hexadecimal format, which BigQuery requires to ensure correct record ordering and compatibility with BigQuery specifications.

Confluent Cloud for Apache Flink® introduces finer-grained permissions for Flink: The FlinkDeveloper role now can be bound to a compute pool, which enables granting access to an individual compute pool and all statements running in the pool. Also, Flink introduces a complementary role, FlinkFunctionDeveloper, to enable access to user-defined function (UDF) artifacts and external connectivity. For more information, see FlinkDeveloper and FlinkFunctionDeveloper.

Confluent documentation now offers both HTML and Markdown versions of all content. LLMs and AI-powered IDEs can parse Markdown content more efficiently than traditional HTML content. By offering Markdown alongside HTML, Confluent documentation provides content optimized for both humans and AI tools.

• AI agents can request the Markdown version of any document directly.

• LLMs can scrape Confluent documentation much more efficiently, leading to better-ranked and more accurate results.

The ResourceOwner role now includes permissions to create, describe, update, and delete API keys associated with the service accounts owned by the ResourceOwner. For more information about this RBAC role, see the support advisory.

Exactly once semantics (EOS) is now generally available for fully-managed IBM MQ Sink connector on Confluent Cloud. For more information, see Exactly once semantics.

Confluent Cloud for Apache Flink® now supports multi-way join optimization for queries joining three or more tables on a common key. By using the MULTI_JOIN hint, the optimizer can reduce state by eliminating intermediate join results. For more information, see Multi-way join optimization.

Confluent Cloud for Apache Flink now supports soft and hard limits on the amount of state that a Flink application can accumulate. You receive warnings proactively if a Flink application is within 80% of reaching its soft or hard limits. If a Flink application hits the soft limit, the statement is stopped, and you can decide whether you want to allow the application to keep running or resubmit the application with State TTL to reduce the amount of state. For more information, see Limits on state size.

Size limits for tag definitions, tags, and business metadata are in effect. No action is needed for resources created prior to January 22, 2026. If newly created resources exceed the limits, the Confluent Cloud Console, Confluent CLI, or API will display a warning message indicating that the given resource exceeds the limit, and the resource will not be created. To learn more and view the size limits, see Size limits for tags and metadata.

Secret manager integration with Confluent Cloud is now available as an Early Access feature. This feature enables Confluent Cloud to fetch sensitive configuration values such as secrets for your connectors at runtime, removing the need to persist secrets within Confluent’s boundary. Currently, the secret manager supports Azure Key Vault integration only. To explore its full range of features and get started, see Create a secret manager integration in Confluent Cloud.

Tableflow is now generally available on Azure. You can now use Tableflow to expose Apache Kafka® topics as Apache Iceberg™ and Delta Lake tables stored in Azure Data Lake Storage Gen2. On Azure, Tableflow can utilize private endpoints to connect to Azure Storage Accounts that don’t allow connections from the public internet. For more information, see Use Azure Private Networking with Tableflow.

Changelog mode is now available in SQL workspaces. You can now switch between table or changelog mode when viewing the results of a statement. For more information, see Changelog entries.

The fully-managed Amazon DocumentDB Sink connector for Confluent Cloud is now generally available for your Apache Kafka® clusters on AWS, Azure, and Google Cloud. Configure it to map and persist events from Apache Kafka® topics directly to a DocumentDB database collection. To explore its full range of features and get started, see Amazon DocumentDB Sink Connector for Confluent Cloud.

Provider Integration support for AWS MemoryDB and AWS ElastiCache is now enabled for the following Confluent Cloud fully-managed connectors:

• Redis Kafka Sink connector

• Redis Kafka Source connector

Confluent Cloud for Apache Flink® now supports Python User-Defined Functions (UDFs) as an Early Access feature. You can implement UDFs in Python and use them in Flink SQL statements by registering them with the CREATE FUNCTION statement. For more information, see Create a User-Defined Function.

Custom Single Message Transforms (SMT) is now generally available for your Apache Kafka® clusters on Microsoft Azure. You can now bring your own SMTs to Confluent Cloud and use them with fully-managed connectors. For more information, see Custom SMT for Confluent Cloud.

The fully-managed IBM MQ Sink connector is now generally available for your Apache Kafka® clusters on AWS, Azure, and Google Cloud. Configure it to send messages from Kafka to an IBM MQ cluster. To explore its full range of features and get started, see IBM MQ Sink Connector for Confluent Cloud.

Connections are now generally available in Confluent Cloud for Apache Flink®. You can use this feature to create secure connections to external services and data sources. Use the CREATE CONNECTION statement to register a connection for use in your Flink statements. For more information, see Manage Connections in Confluent Cloud for Apache Flink.

Support for Mutual TLS (mTLS) security protocol with Enterprise clusters is now available in all AWS regions as Limited Availability release. For more information, see Configure Mutual TLS Authentication on Confluent Cloud.

To sign up to try mTLS on Enterprise clusters, use this form: Sign up form for Limited Availability with mTLS Enterprise clusters

New Confluent versions of Kafka Clients powered by librdkafka 2.13.0 are now available, including Python, JavaScript, .NET, Go, and C++. Included in this release are:

• Python async and improved developer experience: Asyncio support is now GA with better context managers (with) and shutdown behavior (close()), richer message objects, deterministic partitioners, and type hints. Addressed issues addressed in the Python repo, significantly improving the developer experience around async and long‑running workloads.

• Security, stability and performance: Updated support for KIP‑482 by upgrading key admin APIs by improving compatibility and future‑proofing admin operations. Fixes addressing SSL, thread‑safety, memory‑safety, and OAuth token refresh handling, including targeted performance improvements in .NET, Go, and JavaScript to keep high‑throughput workloads stable.

• Schema Registry: Cross‑language upgrades for Avro schema references and associations, stricter validation flags, and multiple fixes for wrapped unions, bytes serialization, and caching. These improvements make Schema Registry usage smoother and more predictable across Python, .NET, Go, and JavaScript clients.

• For more information, see librdkafka 2.13 changelog and the Kafka client guides.

Metrics API: Resource names now included in responses.

Confluent Cloud now supports human‑readable resource names in Metrics API responses for the following resource types:

• Kafka clusters

• Connect clusters

• ksqlDB applications

• Schema Registry clusters

• Compute pools

• Flink statements

Previously, the Metrics API returned only resource IDs. Now, responses include both the resource ID and the resource name, so you can more easily find and understand metrics in your troubleshooting workflows.

Confluent Cloud for Apache Flink® now supports soft and hard limits on the amount of state that a Flink application can accumulate. You receive warnings proactively if a Flink application is within 80% of reaching its soft or hard limits. If a Flink application hits the soft limit, the statement is stopped, and you can decide whether you want to allow the application to keep running or resubmit the application with State TTL to reduce the amount of state. For more information, see Limits on state size.

Confluent Cloud now supports Fetch from Follower on AWS for Enterprise clusters with Private Network Interface (PNI) networking, adding to the existing support for Dedicated with VPC Peering and Freight with Private Network Interface (PNI) networking.

The feature allows consumers to read from zone-local replicas to reduce cross-availability zone egress costs.

For more information, see Optimize Egress Costs with Follower Fetching on Confluent Cloud in AWS.

Enterprise and Freight clusters now support applying throughput limits to specific principals by configuring Client Quotas to service accounts or identity pools. For more information see Multi-Tenancy and Client Quotas on Confluent Cloud.

Topic and Subject Resource level roles (for example ResourceOwner) can now view and attach metadata such as Tags, Description and Business Metadata. To learn more, see Access control (RBAC) for Stream Catalog.

Enterprise clusters with a 32 eCKU maximum limit is Generally Available in all three cloud providers. To scale Enterprise clusters up to a maximum of 32 eCKU on AWS, your cluster networking must use Private Network Interface (PNI). For more information, see Cluster provisioning and scaling.

You can reduce the maximum capacity on your elastic cluster by configuring a lower maximum eCKU than the default. Use this feature with caution. Maximum eCKU limits the cluster’s capacity, which can lead to throttling or workload impact when the reduced capacity limit is reached. For more information, see Update Kafka clusters.

The following Single Message Transforms (SMTs) for fully-managed connectors are generally available:

• AdjustPrecisionAndScale

• BytesToString

• ExtractNestedField

• ExtractXPath

• SetMaximumPrecision (Only available for fully-managed Source connectors)

• TimestampNow

• TimestampNowField

Confluent Cloud Console meets the Web Content Accessibility Guidelines (WCAG) 2.2 standards. Read the revised Accessibility Conformance Report published to the Confluent Trust Center with a publish date of November 2025.

Confluent Cloud now supports Google Cloud Private Service Connect connections for self-managed services. This feature uses Egress Private Service Connect (PSC) Endpoints to enable fully-managed connectors in Confluent Cloud to securely access your internal services using Google Cloud Private Service Connect. For more information, see Egress Private Service Connect Endpoints Setup Guide: Self-Managed Services on Google Cloud for Confluent Cloud.

Cross-cloud Cluster Linking on private networking is now generally available. You can link clusters on private networks across different cloud providers. For more information, see Manage Private Networking for Cluster Linking on Confluent Cloud and billing details for cross-cloud Cluster Linking on private networks.

Confluent Cloud for Apache Flink now enforces strict type conversion rules when deserializing JSON data. If an incoming JSON type cannot be safely converted to the target SQL type defined in your table schema, the statement fails with a deserialization error. For the complete conversion matrix, see JSON deserialization conversion behavior.

You can now use Client-Side Payload Encryption (CSPE) to make your data more secure on fully-managed connectors. For more information on CSPE setup in supported source and sink connectors, see Manage CSPE for fully-managed connectors.

This feature complements the existing Client-Side Field Level Encryption (CSFLE), allowing you to send all sensitive data to Confluent while maintaining full control over data access.

Google Cloud private networking support is now available for the fully-managed Neo4j Sink connector in Confluent Cloud. To configure a Neo4j Sink connector with an Egress Private Service Connect on Google Cloud, see Egress Private Service Connect Endpoint Setup: Neo4j on Google Cloud for Confluent Cloud.

Google Cloud Functions (GCF) Gen 2 Sink connector enhancements:

• You can now configure a custom URL for your Google Cloud Function, eliminating the need to use the default format (https://<region-name>-<project-id>.cloudfunctions.net/<function-name>)

• The connector now adopts robust mTLS/SSL security standards. This allows you to configure essential parameters (such as keystore and truststore) to enforce TLS v1.3 for highly secure data transfer.

For more information, see Google Cloud Functions Gen 2 Sink Connector for Confluent Cloud.

Exactly once semantics (EOS) is now available as an Early Access feature on Confluent Cloud for the following connectors:

• IBM MQ Source Connector

• PostgreSQL CDC Source V2 (Debezium) Connector

Client-side field level encryption (CSFLE) is now extended to support the following fully-managed connectors for Confluent Cloud:

• Azure Data Lake Storage Gen2 Sink connector

• Azure Service Bus Source connector

• Microsoft SQL Server Source (JDBC) connector

• SFTP Source connector

Confluent Cloud custom connectors are now supported with Egress PrivateLink on AWS in Limited Availability. If you would like to participate in the Limited Availability Program, contact Confluent Support.

With this launch, you can bring custom-built connectors and run them within Confluent Cloud PrivateLink environments with private connectivity to external target systems.

Dedicated and Enterprise clusters can use Egress PrivateLink to access external systems for custom connectors.

Initial availability is in the AWS regions; other AWS region enablement is planned as a follow‑on.

• us-east-1

• us-east-2

• us-west-1

• us-west-2

• eu-central-1

• ap-southeast-1

• ap-southeast-2

• ap-south-1

• eu-west-2

• ca-central-1

Support for Mutual TLS (mTLS) security protocol with Enterprise clusters is now a Limited Availability release for the following regions:

• ap-southeast-4 — Australia (Melbourne).

• ap-southeast-5 — Malaysia.

• eu-south-1 — Italy (Milan).

• eu-west-3 — France (Paris).

• me-south-1 — Bahrain.

• ap-east-1 — Hong Kong SAR.

• ap-south-2 — India (Hyderabad).

• eu-south-2 — Spain (Madrid).

• me-central-1 — Middle East (UAE)

• ap-northeast-2 — South Korea (Seoul).

• ap-northeast-3 — Japan (Osaka).

• ca-central-1 — Canada (Central/Montreal area).

• eu-central-2 — Switzerland (Zurich).

For more information, see Configure Mutual TLS Authentication on Confluent Cloud.

Confluent Cloud now supports iam.max_certificate_pools.per_certificate_authority and iam.max_identity_pools.per_identity_provider resource scopes for service quota notifications and the Quotas API.

ExtractTimeStamp SMT is now generally available for fully-managed HTTP V2 Sink, MongoDB Sink, and JDBC Sink connectors.

ChangeTopicCase SMT is now generally available for fully-managed JDBC Source, CDC Source, and MongoDB Source connectors.

Confluent Hub has been relaunched as Confluent Marketplace, a centralized destination for partners and community developers to share their contributions to the Confluent Cloud ecosystem. The developer experience is now simplified, and access to Developer Tools requires a login. To get started, visit the new Confluent Marketplace.

Confluent Cloud for Apache Flink now supports infinite scrolling UI for Flink statements. The Confluent Cloud Console now handles environments with large numbers of statements directly from the backend, instead of relying on client-side logic. This improvement enhances the user experience by providing faster page-load times and more robust filtering and sorting capabilities for listing Flink statements.

Cluster Linking can now link external Apache Kafka® or Amazon MSK clusters to Confluent Cloud clusters over a private network. This supports a variety of use cases, including high availability data replication, disaster recovery, or data migration. Cluster Linking preserves offsets from your external sources to destination Confluent Cloud clusters, and provides an efficient, secure, and seamless experience. To learn more and get started quickly with the tutorial example, see Link external clusters to |ccloud| over a private network.

The following Confluent Cloud connectors are now generally available for your Apache Kafka® clusters on Amazon Web Services (AWS), Microsoft Azure (Azure), or Google Cloud:

• The fully-managed InfluxDB 3 Sink connector for Confluent Cloud writes data from an Apache Kafka® topic to an InfluxDB table. To explore a full range of features and get started with the connector, see InfluxDB 3 Sink Connector for Confluent Cloud.

• The fully-managed Neo4j Sink connector for Confluent Cloud moves data moves data from Apache Kafka® to Neo4j and Aura databases. To explore a full range of features and get started with the connector, see Neo4j Sink connector for Confluent Cloud.

The following connectors now support partitioning data using the DefaultPartitioner class. This option is available in addition to the FieldPartitioner and TimeBasedPartitioner fields.

• Amazon S3 Sink

• Azure Blob Storage Sink

• Google Cloud Storage Sink

Azure Provider Integration support is now enabled for the following Confluent Cloud fully-managed connectors:

• Azure Blob Storage Sink connector

• Microsoft SQL Server CDC Source V2 (Debezium) connector

AWS Egress PrivateLink Endpoints are available for Confluent Cloud for Apache Flink in all regions where Flink is supported. Your Confluent Cloud Enterprise clusters can now access supported AWS services and other endpoint services powered by AWS PrivateLink, for example, external tables and AWS S3. For more information, see Enable private networking with Egress PrivateLink Endpoints.

External table access in Confluent Cloud for Apache Flink is now generally available. You can use Flink SQL statements to search over external tables from Confluent Cloud. For more information, see:

• Key search with external sources

• Text search with external sources

• Vector search with external sources

Egress and ingress data transfers from Flink are offered at no cost until 3/31/2026.

The io.confluent.kafka.server/max_pending_rebalance_time_milliseconds metric is now available in the Metrics API. This metric can be used to understand how long consumer group rebalancing events take, as well as the frequency of those events in a given time range. For more information, see Monitor Consumer Lag in Confluent Cloud.

Confluent Cloud Gateway is now generally available. You can use Confluent Gateway to secure and manage your Kafka clusters in Confluent Cloud. For more information, see Gateway in Confluent Cloud.

The first release of Confluent Cloud Gateway, 1.1.0, offers the following features:

• Enables disaster recovery solutions and client migrations without client changes and client restarts.

• Facilitates secure external partner access with public endpoints for private Kafka clusters exposure, authentication swapping, and advanced traffic controls.

• Supports customizable routing and streaming domains.

• Supports multiple combinations of authentication swapping with secure credential storage and retrieval.

• Confluent Gateway now supports two license modes:

  • Trial mode (default) - No license required, and Confluent Gateway starts automatically in the trial mode.

  • Enterprise mode for Confluent Gateway - A valid Confluent Cloud Gateway license is required to have access to the full functionality of Confluent Gateway.

The Confluent Gateway documentation is available at Confluent Cloud Gateway Overview.

Gateway deployment, route, and domain configuration samples are available on GitHub: Confluent Gateway GitHub repository.

The /discovery endpoint for the Metrics API is now available. Use the /discovery endpoint to configure your monitoring tool to dynamically discover and scrape metrics from all authorized Confluent Cloud resources. This is especially useful when you want to monitor resources that are frequently created and deleted such as connectors. With the /discovery endpoint, you no longer need to update your Metrics API request to monitor such resources. For more information, see Discovery endpoint.

Google Cloud Provider Integration support is now enabled for the following Confluent Cloud fully-managed connectors:

• Google Cloud Pub/Sub Source connector

• Google Cloud Storage (GCS) Source connector

Early Access for Client-Side Payload Encryption (CSPE) in Confluent Cloud. With CSPE you can encrypt the entire payload, providing additional flexibility for comprehensive data protection. This feature complements our existing Client-Side Field Level Encryption (CSFLE), allowing you to send all sensitive data to Confluent while maintaining full control over data access. For more information, see Protect Sensitive Data Using Client-Side Payload Encryption on Confluent Cloud.

The fully-managed Oracle XStream CDC Source Connector for Confluent Cloud now supports ad-hoc blocking snapshot and two-way TLS (mutual TLS) with client wallets.

HTTP Source V2 Connector for Confluent Cloud now supports Chaining offset with Timestamp mode, that combines chaining-based pagination with timestamp-based filtering.

Confluent Cloud for Apache Flink is now available in 13 new regions:

• AWS

  • af-south-1

  • ap-southeast-3

  • eu-south-1

  • eu-west-3

  • me-central-1

• Azure

  • japaneast

  • newzealandnorth

  • norwayeast

  • switzerlandnorth

• Google Cloud

  • asia-northeast1

  • europe-north1

  • europe-west8

  • southamerica-east1

For more information, see Supported Cloud Regions.

The Real-Time Context Engine with Confluent Intelligence is available for early access. You can now enable AI agents to understand and act on live business context, directly from governed Apache Kafka® topics. AI agents can now conduct low-latency queries on real-time Kafka topics because the Context Engine exposes topics as tools by using a fully managed MCP server. This gives AI agents, LLMs, and apps secure access to the freshest data without duplication, ETL, or spinning up infrastructure. For more information, see Real-Time Context Engine.

Streaming Agents are available as an Open Preview feature with Confluent Intelligence. You can now create Streaming Agents by using components like models, prompts, tools, and configuration like max_iterations for the agent. You can use Streaming Agents for more complex tasks requiring multiple iterations for reasoning and accurate results. Also, you can now define tools as resources in Flink, and these tools can be UDFs or MCP server tools. For more information, see Streaming Agents in Confluent Cloud.

Tableflow is now available for early access in Azure regions eastus2 and westeurope. You can now expose your Kafka topics in near real-time as Apache Iceberg™ tables in Azure storage. For more information, see Tableflow in Confluent Cloud.

Tableflow now supports Dead-Letter Queue (DLQ) functionality. You can now configure Tableflow tables to send records that fail to materialize to a DLQ topic by using the Flink error-handling.mode and error-handling.log.target table properties or Tableflow configurations. For more information, see Tableflow Error-handling Mode.

Confluent Cloud introduces the Unified Stream Manager (USM), which allows you to connect your self-managed Confluent Platform clusters to Confluent Cloud. USM provides a single pane of glass for unified governance, observability, and data lineage within your data streaming platform, no matter where your clusters reside. This feature introduces the USM Agent, a new component that facilitates a secure, private connection from your Confluent Platform environment to Confluent Cloud.

It includes the following benefits:

• Apply consistent data policies and quality rules across all your cloud and on-premises clusters from a single interface.

• View the health and performance of all your Kafka topics, connectors, and clusters in a unified dashboard, and connect to existing monitoring tools such as Prometheus.

• Manage your self-hosted Confluent Platform resources from the Confluent Cloud Console to simplify hybrid operations and streamline migrations.

To get started, see Unified Stream Manager in Confluent Cloud.

The following cluster load metrics are now available on the /export endpoint of the Metrics API:

• cluster_load_percent

• cluster_load_percent_average

• cluster_load_percent_max

• dedicated_cku_count

For the full list of metrics available and exportable, see the metrics reference.

Azure private networking support is now available for the fully-managed ClickHouse Sink connector in Confluent Cloud. To configure a ClickHouse Sink connector with an Azure Egress Private Link Endpoint, see Egress Private Link Endpoint Setup.

The fully-managed Snowflake Sink connector for Confluent Cloud now supports OAuth 2.0-based database authentication.

SSL/TLS support has been enhanced for the MySQL CDC Source V2 (Debezium) and PostgreSQL CDC Source V2 (Debezium) connectors, enabling stricter authentication modes for greater security:

• The MySQL CDC Source V2 (Debezium) connector now supports the verify_ca and verify_identity SSL modes.

• The PostgreSQL CDC Source V2 (Debezium) connector now supports the verify-ca and verify-full SSL modes.

FromXML SMT is now generally available for HTTP V2 Source, HTTP V2 Sink, and IBM MQ Source connectors.

Confluent Cloud for Apache Flink enables creating tables that generate custom sample data. Now you can create faker tables that enable you to create custom data generators directly within your Flink stream-processing workflows. This capability enables you to generate a continuous stream of realistic test data without additional infrastructure or costs, streamlining development and testing processes. For more information, see Generate Custom Sample Data with Confluent Cloud for Apache Flink.

Delta Lake support for Tableflow is generally available. You can now use Tableflow to materialize Apache Kafka® topics as Delta Lake tables in your own storage. For more information, see Quick Start with Delta Lake Tables.

Google Cloud Provider Integration for Confluent Cloud and fully-managed connectors is now generally available:

• For provider integration setup, see Integrate with Google Cloud in Confluent Cloud.

• For connector configuration, see Manage Google Cloud Provider Integration for Fully-Managed Connectors.

Google Cloud Provider Integration support is now enabled for the following Confluent Cloud fully-managed connectors:

• Google BigQuery Sink V2 connector

• Google Cloud Storage Sink connector

• PostgreSQL CDC Source V2 (Debezium) connector

Azure Provider Integration for Confluent Cloud and fully-managed connectors is now generally available:

• For provider integration setup, see Integrate with Azure in Confluent Cloud.

• For connector configuration, see Manage Azure Provider Integration for Fully-Managed Connectors.

Azure Provider Integration support is now enabled for the following Confluent Cloud fully-managed connectors:

• Azure Cosmos DB Sink V2 connector

• Azure Data Lake Storage Gen2 Sink connector

• Azure Cosmos DB Source V2 connector

• Azure Event Hubs Source connector

Support for self-managed encryption keys (BYOK) with Tableflow is now available on AWS Dedicated clusters. You can now use your own encryption keys to encrypt Tableflow data, ensuring consistent encryption across your Kafka data and Tableflow tables. For more information, see Use self-managed encryption keys with Tableflow.

AI-assisted troubleshooting is now available as a Preview feature for fully-managed connectors, which provides auto-generated summaries of connector issues in the Confluent Cloud Console. For more information, see AI-Assisted Troubleshooting for Confluent Cloud Connectors.

The Confluent Cloud Translate API is now generally available. You can now translate a self-managed connector configuration to a fully-managed connector configuration using this API. For more information, see Migrate a connector configuration.

Confluent Cloud now supports Azure User Assigned Managed Identity (UAMI) for OAuth authentication. UAMI eliminates the need to manage static client IDs and secrets by leveraging Azure’s built-in identity management to automatically retrieve authentication tokens. This feature is available for Confluent Cloud and Confluent Platform 8.1 and later. For more information, see Configure Azure User Assigned Managed Identity OAuth for Confluent Cloud.

The new table filtering and column mapping configuration properties, including table.include.list, table.exclude.list, timestamp.columns.mapping, and incrementing.column.mapping are now available in the following Confluent Cloud JDBC source connectors. The legacy properties, such as timestamp.column.name and incrementing.column.name, are now deprecated. Confluent recommends using the new column mapping properties for all new implementations.

• Microsoft SQL Server Source (JDBC)

• MySQL Source (JDBC)

• Oracle Database Source (JDBC)

• PostgreSQL Source (JDBC)

Client-side field level encryption (CSFLE) now supports using multiple key vaults for high availability. You can configure multiple KEK registrations that reference the same encryption key material across regions or providers and implement client/proxy-driven failover if one key vault becomes unavailable. This feature supports cross-region disaster recovery scenarios and integration with on-premises Hardware Security Modules (HSMs) that distribute keys to multiple cloud key vaults. For more information, see the use of encrypt.alternate.kms.key.ids under kmsProps in KEK Parameters.

Partial success response for the /export endpoint on the Metrics API is available as a Limited Availability feature in Confluent Cloud. For more information, see How does the Metrics API handle requests that include inaccessible resources?.

Google Cloud VPC Service Controls (VPC-SC) is now supported for Confluent Cloud clusters using self-managed encryption keys. VPC-SC provides an additional security layer by restricting access to Google Cloud services such as Cloud Storage and Cloud KMS within a service perimeter. For configuration details, see Manage key policies with Google Cloud VPC Service Controls (advanced).

Autopilot scaling decisions for Confluent Cloud for Apache Flink are now available in the event logging. You can now view the scaling decisions for your Flink statements in the Confluent Cloud Console. For more information, see Event Logging for Statements

Confluent for VS Code supports the full development workflow for Flink user defined functions (UDFs). Now you can:

• Start Flink UDF projects from built-in templates.

• Develop, build and test artifacts and UDFs locally.

• Upload artifacts to Confluent Cloud.

• Register artifacts as UDFs.

• Author, submit, and view results of Flink SQL, referencing UDFs with the help of IntelliSense.

To get the Confluent for VS Code extension, visit:

• VS Code Marketplace: For VS Code and VS Code Insiders

• OpenVSX Registry: For Cursor and other VS Code-derived IDEs

Improvements to the Kafka Streams monitoring features in Confluent Cloud Console are generally available. You can now monitor metrics for your Kafka Streams applications, like application state, end-to-end latency, and process ratio. For more information, see Monitor Kafka Streams Applications in Confluent Cloud.

The Schema Registry C++ client (libschemaregistry) for Confluent Cloud is generally available. It supports Avro, Protobuf, and JSON Schema, plus Data Contracts and client-side field-level encryption (CSFLE). For details and examples, see Schema Registry C++ Client (libschemaregistry).

Upsert tables for Tableflow are generally available. Now you can insert, update, and delete individual rows in your analytics-ready tables, unlocking powerful new workflows for change data capture (CDC), append-mostly, and row-level data management. For more information see Upsert Mode.

Connection resources for AI/ML workloads can be created and managed directly by using Flink SQL. You can now use the CREATE CONNECTION statement in Flink SQL for creating connections to external databases and AI models. For more information, see Create a Connection Resource.

Fixed a bug where some users were unexpectedly logged out of the Confluent Cloud Console.

The Early Access program for UDF logging in Confluent Cloud for Apache Flink has ended. Log messages from user-defined functions (UDFs) now appear automatically in the Confluent Cloud Console’s statement logging page. For more information, see Log Debug Messages in UDFs.

The following Confluent Cloud connectors are now generally available for your Apache Kafka® clusters on AWS, Azure, and Google Cloud.

• The fully-managed Redis Kafka Sink connector for Confluent Cloud maps and writes records from Apache Kafka® topics directly to a Redis database. To explore a full range of features and get started with the connector, see Redis Kafka Sink connector for Confluent Cloud.

• The fully-managed Redis Kafka Source connector for Confluent Cloud moves data from a Redis database into an Apache Kafka® cluster in Confluent Cloud. To explore a full range of features and get started with the connector, see Redis Kafka Source connector for Confluent Cloud.

The MongoDB Atlas Sink connector for Confluent Cloud now supports X.509 certificate-based database authentication.

The OpenSearch Sink connector for Confluent Cloud supports upsert functionality for ingested data.

The HTTP V2 Sink connector for Confluent Cloud includes the following enhancements:

• The connector now enables upsert operations.

• The connector now adds support for the String data format.

• The connector now allows DELETE as a valid HTTP API request method.

Client-side field level encryption (CSFLE) is now extended to support the fully-managed Salesforce CDC connector for Confluent Cloud.

Support for Multiple Platform Events is now available in the Salesforce Platform Event Source Connector.

Support for enhanced replay ID handling is now available in the Salesforce Platform Event Source Connector and Salesforce Change Data Capture (CDC) Source connector. The connector now uses the invalid.replay.id.behaviour property to determine fallback behavior for invalid or expired event IDs.

Confluent Cloud network for Confluent Cloud for Apache Flink is now available on Azure for all types of networks, including Peering clusters. For more information, see Flink Private Networking.

Schema Registry Private Networking now supports Azure CCN Peering networks.

The heartbeat.action.query configuration is now available in the following connectors, which allows users to specify a custom SQL DML statement that executes on the source database to advance connector offsets during periods of low activity.

• Microsoft SQL Server CDC Source V2 (Debezium)

• PostgreSQL CDC Source V2 (Debezium)

Support for enhanced log stream capacity is now available in the Amazon CloudWatch Logs Source connector, enabling it to handle more than 50 log streams.

The legacy to Google BigQuery Sink V2 migration process has been enhanced to offer higher throughput, improved reliability, and better schema evolution support.

Confluent Cloud now maps PrivateLink endpoints to target clusters on the server side. This simplifies the client configuration and enables a more seamless client failover experience. This means Kafka clients that connect to AWS Enterprise clusters over AWS PrivateLink no longer require the logicalCluster OAuth extension parameter. For details, see OAuth Configuration Reference.

Permanent and in-line UDFs with the Table API on Confluent Cloud for Apache Flink are available as an Open Preview feature. For more information, see Create a User-Defined Function.

Support for self-managed encryption keys (including BYOK encryption) for Confluent Cloud Enterprise Kafka clusters and Dedicated Kafka clusters on Google Cloud is now generally available. For details, see Encryption of data at rest on Kafka clusters and Use Self-Managed Encryption Keys in Confluent Cloud on Google Cloud.

OAuth Auto Pool Mapping for Kafka clients and Kafka REST API is now generally available. This capability simplifies Kafka client configurations by reducing the complexity of managing multiple identity pools. You can use this functionality to:

• Automatically map client tokens to all matching identity pools.

• Grant clients the combined permissions from all matching pools.

• Eliminate the need to specify identity pool IDs in configurations.

For more information, see Use auto pool mapping with OAuth identity pools.

Confluent Cloud for Apache Flink now shows state size metrics in the Flink Statements page of the Confluent Cloud Console. You can now view the state size per statement directly for a deeper understanding of resource usage. Integrated visual charts show how state size changes over time, offering a comprehensive way to monitor and analyze data-processing performance. State size is exposed as a metric in the Metrics API, enabling you to integrate it into your own observability tooling. For more information, see Monitor and Manage SQL Statements and Use Query Profiler.

Private networking with Confluent Cloud for Apache Flink is now available in the following Google Cloud regions:

• asia-south2

• asia-southeast2

• australia-southeast1

Confluent Cloud for Apache Flink now supports public and private networking in all Confluent Cloud regions. For more information, see Private Networking with Confluent Cloud for Apache Flink.

Custom Connector Runtime Versioning for Confluent Cloud is now generally available. You can now configure the Kafka and Java runtime versions for your custom connector within your Confluent Cloud environments. For more information, see Confluent Cloud API and Confluent CLI for Custom Connectors.

Confluent Cloud now offers the ability to Infer a schema from messages, automating schema creation with a single click for new or existing schemaless topics with JSON messages. Avro, Protobuf, or JSON schemas can be auto-generated from sample JSON messages.

You can now specify a schema context to use with schema validation. The specified context will be used to search for the subject name and perform schema validation.

Cloud Console has an improved page for working with environments. A new environment overview brings all your environment details together, including clusters, compute pools, and network configurations. Manage tags and metadata directly from the environments page. See at a glance the type of Governance package available in the environment. For more information, see Environments on Confluent Cloud

Event logging for statements is generally available in Confluent Cloud for Apache Flink. You can now view the event logs for your Flink statements in the Confluent Cloud Console. For more information, see Event Logging for Statements

The fully-managed Snowflake Sink connector for Confluent Cloud now supports ingesting data into a Snowflake-managed Apache Iceberg table.

Share consumers and share groups are now available as a preview feature for Java clients (Queues for Kafka (KIP-932)). This feature introduces a concurrent processing model, allowing multiple consumers within a share group to process messages from the same topic partition simultaneously. This is an alternative to the traditional consumer group model, which assigns each partition to a single consumer. For more information, see the documentation and What’s New in Apache Kafka® 4.1 YouTube video.

The Oracle XStream CDC Source Connector for Confluent Cloud now supports capturing change data from the following Oracle database environments:

• The connector now supports Amazon RDS for Oracle, with the following specific configurations - Oracle Database 19c, a non-CDB architecture and non-custom deployment type.

• The connector supports capturing changes from databases encrypted with Oracle Transparent Data Encryption (TDE).

• The connector supports Oracle Exadata with TDE (Transparent Data Encryption) enabled.

Improved carry-over offsets for Confluent Cloud for Apache Flink are now generally available, enabling orchestrated updates of statement logic. You can now use carry-over offsets to start a new statement from the offsets of an existing statement. For more information, see Carry Over Offsets.

Enterprise clusters limit increase for connection attempts and total connections. Enterprise clusters get a maximum of 5,000 connection attempts and 180,000 total connections per cluster. For more information, see Kafka Cluster Types in Confluent Cloud.

Configuring Custom SMT (Single Message Transforms) through the Confluent Cloud Console is now generally available for your Apache Kafka® clusters on AWS. You can now bring your own SMTs to Confluent Cloud and use them with fully-managed connectors. For more information, see Custom SMT for Confluent Cloud.

Streaming Agents with Confluent Cloud for Apache Flink are available for preview. You can now use the AI_TOOL_INVOKE function to invoke tools in your AI workflows. For more information, see Invoke Tools in AI Workflows.

Searches over external tables are available for preview. You can now use the following search functions to query your data in external tables:

• Key Search

• Text Search

• Vector Search

For more information, see Searches over External Tables.

The CREATE CONNECTION statement in Confluent Cloud for Apache Flink is available for preview. You can now use Flink SQL to declare secure connections to external services for use in your Flink statements. For more information, see Manage Connections.

AI_COMPLETE as a native Flink function is available for preview. You can now generate text completions, summaries, or answers based on streaming data.

AI_EMBEDDING as a native Flink function is available for preview. You can now generate embeddings for your streaming text data.

ML_DETECT_ANOMALIES and ML_FORECAST as native Flink functions are now generally available. For more information, see Built-in AI/ML Functions.

The minimum number of CSUs for new ksqlDB clusters is now 4.

The fully-managed MongoDB Atlas Source and Sink connectors now support self-managed MongoDB instances, enabling customers to seamlessly connect to both self-managed and fully-managed deployments.

Support for external key managers (EKM) for Confluent Cloud Dedicated clusters is now generally available on AWS using your external key manager with AWS KMS External Key Store (XKS). For details, see Key creation and management.

Confluent Cloud now provides version 3.1.0 of the fully-managed Snowflake Sink connector along with a critical data loss fix (SNOW-2034182). This release introduces support for the snowflake.streaming.metadata.connectorPushTime property, enabling users to estimate ingestion latency.

Schema Registry Private Link now supports Google Cloud in a subset of regions.

For more information, see Schema Registry Private Networking.

User-defined functions (UDFs) with Confluent Cloud for Apache Flink are now generally available in the following AWS and Azure regions:

• AWS

  • ap-east-1

  • eu-north-1

  • me-south-1

• Azure

  • spaincentral

  • uaenorth

  • uksouth

  • westus3

For more information, see User-defined Functions in Confluent Cloud for Apache Flink.

The fully-managed Azure Data Lake Storage Gen2 (ADLS Gen2) Sink connector now supports WORM-enabled containers.

Private Network Interface (PNI) Support for Enterprise Clusters on AWS

You can now connect to Confluent Cloud Enterprise clusters on AWS using PNI, offering a secure and cost-effective private networking option in addition to AWS PrivateLink. This release delivers the following enhancements:

• Expanded private access: PNI for Enterprise provides the same security assurances as PrivateLink, with the added benefit of the cost efficiency similar to VPC peering.

• Dual networking: Enterprise clusters (on AWS only) now support dual connectivity via both PrivateLink and PNI, enabling seamless transitions between the two networking types without requiring cluster redeployment.

• Flexible transitions: Switching an Enterprise cluster between PrivateLink and PNI (or vice versa) is fully supported and does not require downtimes or redeployment.

• Multiple PNI gateways: Each Confluent Cloud environment can attach up to two PNI gateways per AWS region, accommodating complex networking topologies and high availability requirements.

• Endpoint visibility: For Enterprise clusters in AWS, all available endpoints (PrivateLink and PNI) are displayed to facilitate integration and management.

• Endpoint selection for the Confluent Cloud Console functionality: For Enterprise clusters in AWS, users must select which endpoint to use to unlock full Confluent Cloud Console functionality.

• Consistent developer experience: Connecting through PNI offers private IP-based access, supporting multiple clusters in an Environment and a Region (including planned support for additional services) via a single PNI gateway.

For more information about using PNI with Enterprise clusters, including setup, requirements, and considerations, see Private Network Interface (PNI) Support for Enterprise Clusters on AWS.

Confluent Cloud network with Schema Registry and Confluent Cloud for Apache Flink is now available on Azure for Private Link CCN.

For more information, see Schema Registry Private Networking and Flink Private Networking.

API key secrets created on or after July 30, 2025 have a cflt prefix. API key secrets created before this date do not have the cflt prefix, but all API key secrets continue to work normally for authentication. For more information, see API key format.

Data stream in the Dark

Dark Mode is now generally available in Confluent Cloud. This update gives you more flexibility and comfort while using the platform—whether you’re working late, reducing screen brightness, or simply prefer a darker interface. Confluent Cloud automatically matches your system preferences, or you can set your preferred mode manually—it’s entirely up to you.

This feature has been popularly requested, especially from developers and power users who spend long hours in front of their screens. Dark Mode can help reduce eye strain in low-light environments and offers improved accessibility for users with certain visual sensitivities. Most importantly, it’s about delivering a better, more comfortable user experience—where the interface works with you, not against you.

Beyond the visual benefits, this is part of a larger effort to make Confluent Cloud Console more user-friendly and responsive to the needs of the community. You may have already noticed a refreshed color theme rolled out earlier this year as a first step toward supporting Dark Mode. That change laid the foundation for a more flexible, modern interface, and today’s release brings it full circle.

Dark Mode is available now—no setup required unless you want to customize it. Just another way Confluent is making Confluent Cloud work better for you.

The fully-managed PostgreSQL CDC Source V2 (Debezium) connector now includes the publish.via.partition.root configurable property, which helps create the publication in the source database.

You can now view logs for managed connectors and custom SMTs with various search criteria using the Confluent CLI. For more information, see View Connector Events for Confluent Cloud.

Dark mode is available in Cloud Console for some customers during Early Access release. For more information, see Does Cloud Console have dark mode?.

Custom Connector Plugin Versioning for Confluent Cloud is now generally available. You can now manage different versions of your custom connector plugins within your Confluent Cloud environments, upload new versions, and update running connectors seamlessly while maintaining message offset continuity. For more information, see Confluent Cloud API and Confluent CLI for Custom Connectors.

Custom error handling rules for Confluent Cloud for Apache Flink are now generally available. Flink now supports custom error handling for deserialization errors. You can choose to fail, ignore, or log problematic records. When set to log, errors are sent to a Dead Letter Queue (DLQ) table. For more information, see error-handling.mode.

Query Profiler for Confluent Cloud for Apache Flink is now generally available. You can now view detailed information about the execution of your Flink statements, including the time taken for each stage, the number of records processed, and the amount of data transferred. For more information, see Query Profiler for Confluent Cloud.

Tableflow integration with Unity Catalog is available for Open Preview. Tableflow’s Unity Catalog integration enables you to publish materialized tables to Unity Catalog, making them accessible as external Delta Lake tables in Databricks. For more information, see Integrate Tableflow with Unity Catalog in Confluent Cloud.

Filter (Confluent) has now been extended to all Confluent Cloud fully-managed connectors.

New SMTs for fully-managed connectors are generally available:

• HeaderToValue

• Flatten (Confluent)

Custom Single Message Transforms (SMT) for Confluent Cloud is now generally available for your Apache Kafka® clusters on AWS. You can now bring your own SMTs to Confluent Cloud and use them with fully-managed connectors. For more information, see Custom SMT for Confluent Cloud.

CEL filters for SSO group mappings now support the startsWith and endsWith operators. For more information, see Supported CEL filter operators.

The maximum number of identity pools per OAuth identity provider has been increased from 300 to 1000.

Access Transparency is now in Limited Availability for Dedicated Kafka clusters. This feature provides visibility into when Confluent personnel access your Dedicated Kafka clusters for support, maintenance, or operational purposes, helping you meet compliance and governance requirements. For details, see Access Transparency on Confluent Cloud.

The fully-managed MariaDB CDC Source (Debezium) connector for Confluent Cloud is now generally available for your Apache Kafka® clusters on AWS, Azure, and Google Cloud. The connector obtain a snapshot of the existing data in a MariaDB database, then monitor and record all subsequent row-level changes. To explore a full range of features and get started with the connector, see MariaDB CDC Source (Debezium) connector for Confluent Cloud.

New features for Oracle XStream CDC Source connector for Confluent Cloud are generally available:

• The connector now captures changes from tables that contain large object (LOB) data types.

• The connector now supports Client-side field level encryption (CSFLE) to protect sensitive data.

• A diagnostics script, orclcdc_diag.sql is available to help troubleshooting by collecting key diagnostic information about the Oracle database and XStream configuration.

Custom Connectors are now supported on Google Cloud Platform. You can now create and manage them directly within specified GCP regions supported by Confluent Cloud.

Provider Integration support for AWS Identity and Access Management (IAM) role-based authorization in Amazon Redshift Sink connector is now available. For more information, see Manage Provider Integration for Fully-Managed Connectors in Confluent Cloud.

The fully-managed Snowflake Sink connector for Confluent Cloud now supports HTTPS proxy support. This feature enables you to use an HTTPS proxy to connect to Snowflake.

The following connectors now support partitioning data using the FieldPartitioner class. This option is available in addition to the default TimeBasedPartitioner.

• Amazon S3 Sink

• Azure Blob Storage Sink

• Google Cloud Storage Sink

General release (GA) of Schema Registry PrivateLink on Azure in the listed regions. This feature enables you to connect to Schema Registry using a private endpoint within your Virtual Private Cloud (VPC) without egressing to the public internet, enhancing security of your data streams.

This GA launch uses Private Link Attachments (PLATTs) for private connectivity to Schema Registry. For existing Dedicated SKU (DSKU) Kafka customers, you’ll need to create a PLATT in the same region as your Kafka cluster to get a private endpoint for Schema Registry. For Enterprise SKU (ESKU) customers, the existing PLATT used for ESKU will be reused.

The fully-managed ClickHouse sink connector for Confluent Cloud is now generally available for your Apache Kafka® clusters on AWS, Azure, and Google Cloud. The connector maps and persists events from Apache Kafka® topics directly to a ClickHouse database collection. To explore a full range of features and get started with the connector, see ClickHouse Sink connector for Confluent Cloud.

Private networking with Confluent Cloud for Apache Flink is now available in the following Google Cloud regions:

• asia-south1

• asia-southeast1

• europe-west1

• europe-west2

• europe-west3

• europe-west4

• northamerica-northeast1

• northamerica-northeast2

• us-central1

• us-east1

• us-east4

• us-west1

• us-west2

• us-west4

For more information, see Private Networking with Confluent Cloud for Apache Flink.

Confluent Cloud for Apache Flink is now available in the following regions:

• AWS

  • ap-east-1

  • eu-north-1

  • me-south-1

• Azure

  • spaincentral

  • uaenorth

  • uksouth

  • westus3

Public and private networking are available for all new regions. For more information, see Supported Cloud Regions for Confluent Cloud for Apache Flink.

Statement-level CFU consumption metrics are now available in Confluent Cloud for Apache Flink and the Metrics API. The statement CFU metrics give you insights into the resources consumed by individual Flink statements running inside your compute pools.

The statement CFU consumption metrics are available to view in the statements summary table and in the statement side panel.

For more information, see Statement CFU Metrics.

The following Confluent Cloud connectors are now generally available for your Apache Kafka® clusters on AWS, Azure, and Google Cloud.

• The fully-managed Couchbase Sink connector maps and persists events from Apache Kafka® topics directly to a Couchbase database collection. To explore a full range of features and get started with the connector, see Couchbase Sink connector for Confluent Cloud.

• The fully-managed Couchbase Source connector moves data from a Couchbase server into Apache Kafka® topics in Confluent Cloud. To explore a full range of features and get started with the connector, see Couchbase Source connector for Confluent Cloud.

HTTP URLs for CRLs are now supported for Confluent Cloud mTLS authentication. For details, see Configure Mutual TLS (mTLS) Authentication.

New features for Google BigQuery Sink V2 connector for Confluent Cloud are generally available.

• The connector now supports the sanitize.field.names.in.array configuration, which enables sanitization of field names inside array-type objects during data ingestion. This ensures that nested fields within arrays follow BigQuery column naming rules.

  • If the connector ingests records with unsanitized field names inside arrays and auto.update.schemas is enabled, enabling this configuration will automatically update the table schema to include the sanitized field names.

  • If auto.update.schemas is disabled, the connector will move records containing sanitized fields that do not match the existing schema to the Dead Letter Queue (DLQ), if configured.

• _CHANGE_SEQUENCE_NUMBER pseudo column support in CDC mode is now available. Contact Confluent Support to enable the feature in your connector.

You can now retrieve the Flink statement status from the Metrics API. This metric monitors and returns the status of a statement within the system.

For more information, see Query for the statement status of a Flink SQL statement.

Simplified Schema Registry Private Networking with CCN Support for AWS is now available on Confluent Cloud.

Simplified private networking for Confluent Cloud Schema Registry with CCN (Confluent Cloud network) support significantly streamlines the setup process for private access to Schema Registry. Configuring a CCN for Dedicated Kafka clusters on AWS automatically provides a unique private endpoint for Schema Registry, with no additional setup required. Similarly, if you already have a private network connection setup for Dedicated Kafka clusters (via PrivateLink, VPC Peering, or Transit Gateway), you automatically have Schema Registry private endpoints.

Key benefits are:

• Simplified Setup: No extra network configuration is required if you’re already using Dedicated Kafka clusters with private networking.

• Enhanced Security: Maintain private access to Schema Registry within your AWS environment.

• Broad Compatibility: Supports all types of CCNs (PrivateLink, VPC Peering, and Transit Gateway).

• Confluent Platform to Confluent Cloud Schema Linking: Can be used for Schema Linking between Confluent Platform and Confluent Cloud.

• Comprehensive Support: Available via UI, CLI, and Terraform.

• Wide Regional Availability: Supported across 16 AWS regions.

Confluent Cloud for Apache Flink is now available in the following Google Cloud regions:

• asia-southeast2

• europe-west4

• northamerica-northeast1

• northamerica-northeast2

• us-west2

The limit for Flink compute pools per environment has increased from 10 to 50.

The logging UI has been completely redesigned and improved to simplify debugging for Confluent Cloud connectors. For more information, see View Connector Events for Confluent Cloud.

Client-side field level encryption (CSFLE) is now extended to support the following fully-managed connectors for Confluent Cloud:

• Azure Cosmos DB Source V2 connector

• Azure Cosmos DB Sink V2 connector

Aliases and versions support for AWS Lambda functions is now available. For more information, see AWS Lambda Sink Connector for Confluent Cloud.

Enhanced Debezium Envelope Detection for Confluent Cloud for Apache Flink and Tableflow: Effective for schemas created after May 19, 2025 at 09:00 UTC that are recognized as incorporating a Debezium envelope, the default inference for the following Confluent Cloud for Apache Flink and Tableflow table properties has been updated:

• value-format: The default inference has changed from *-registry to *-debezium-registry.

• changelog.mode:

  • The default has changed from append to retract.

  • Exception: If the Kafka cleanup.policy is set to compact, the changelog.mode is set to upsert.

A schema is considered to be incorporating a Debezium envelope if the data structure contains the fields after, before, and op.

This enhancement provides automatic detection and proper handling of Debezium CDC (Change Data Capture) streams without requiring manual configuration. For more information about working with Debezium formats, see Inferred tables.

Snapshot queries in Confluent Cloud for Apache Flink are enabled for Early Access. For more information, see Snapshot Queries in Confluent Cloud for Apache Flink.

User-defined functions (UDFs) with Confluent Cloud for Apache Flink are now generally available in the following Azure regions:

• australiaeast

• brazilsouth

• centralindia

• centralus

• eastus

• eastus2

• francecentral

• northeurope

• southcentralus

• southeastasia

• westeurope

• westus2

Provider Integration support for AWS Identity and Access Management (IAM) role-based authorization in Amazon DynamoDB Sink connector is now available. For more information, see Manage Provider Integration for Fully-Managed Connectors in Confluent Cloud.

Provider Integration support for AWS Identity and Access Management (IAM) role-based authorization has now been extended to the following Confluent Cloud fully-managed connectors:

• Amazon CloudWatch Logs Source connector

• Amazon Kinesis Source connector

• Amazon SQS Source connector

• MySQL CDC Source V2 connector

The following Confluent Cloud connectors are now generally available for your Apache Kafka® clusters on AWS, Azure, and Google Cloud.

• The fully-managed Azure Cosmos DB Sink V2 connector polls data from Apache Kafka® and writes to a Microsoft Azure Cosmos DB database. To explore a full range of features and get started with the connector, see Azure Cosmos DB Sink V2 connector for Confluent Cloud.

• The fully-managed Azure Cosmos DB Source V2 connector reads records from an Azure Cosmos DB database and writes data to Apache Kafka® topics in Confluent Cloud. To explore a full range of features and get started with the connector, see Azure Cosmos DB Source V2 connector for Confluent Cloud.

Confluent Cloud for Apache Flink now includes a Patch Method on the Statements endpoint. This method enables you to update the configuration of a Flink SQL statement without needing to pass in the entire statement object. For more information, see Patch a Statement.

Confluent Cloud for Apache Flink now includes the Statement Advisor feature, which analyzes Flink SQL statements when you submit them without blocking query execution and provides real-time warnings for queries that might lead to potential issues, like operational problems, high costs, or unexpected results. Key scenarios that trigger warnings include:

• Mismatched primary keys and derived upsert keys.

• High state usage without a configured state Time-to-Live (TTL).

• Incorrect GROUP BY clauses in window aggregations.

For more details on the warnings and how to resolve them, see Resolve Statement Issues.

Confluent Cloud now supports the new Consumer Rebalance Protocol (KIP-848) for use by consumers whose client libraries support the Kafka 4.0 version. For more information about using the protocol in your consumers, see the following:

• For general information about the consumer rebalance protocol, see Kafka Consumer Design: Consumers, Consumer Groups, and Offsets.

• For detailed information about consumers and consumer groups that use the new protocol, see Kafka Consumer for Confluent Cloud.

• Cloud Console displays the consumer group protocol type from the consumer group list on Consumer lag. For more information, see Monitor Consumer Group Rebalancing.

Client-side field level encryption (CSFLE) is now extended to support the following fully-managed connectors for Confluent Cloud:

• Azure Blob Storage Source connector

• Google BigQuery Sink V2 connector

• Google Cloud Functions Gen 2 Sink connector

• MongoDB Atlas Sink connector

The fully-managed Oracle XStream CDC Source connector for Confluent Cloud is now generally available for your Apache Kafka® clusters on AWS, Azure, and Google Cloud. The connector captures all changes made to rows in an Oracle database and represents the changes as change event records in Apache Kafka® topics.

To explore a full range of features and get started with the connector, see Oracle XStream CDC Source connector for Confluent Cloud.

The Operator role no longer has permissions to pause and resume connectors. Administrators can now grant the read-only Operator role to users who you want to be able to view metadata and monitor resources without the right to modify resources. The ConnectManager role can be used to grant users the ability to monitor, pause, and resume connectors in your clusters. For details, see Operator and ConnectManager.

Provider Integration support for AWS Identity and Access Management (IAM) role-based authorization in Amazon S3 Source connector and AWS Lambda Sink connector is now available. For more information, see Manage Provider Integration for Fully-Managed Connectors in Confluent Cloud.

Added the ability to configure common configuration properties for fully-managed connectors. These properties will help customers customize configurations and plan the migration from self-managed to fully-managed connectors. To explore a full list of supported configurations, for example, those for the Google BigQuery Sink V2 connector, see Additional Configurations.

TLS 1.3 has been progressively enabled across Confluent Cloud and is now used by default for all Confluent Cloud services, except for Kafka clusters. You can enable TLS 1.3 on Dedicated clusters, with support for other Confluent Cloud cluster types coming soon. For details, see Manage Data in Transit with TLS.

Confluent Cloud for Apache Flink is now available with public and private networking in the Azure regions canadacentral, eastasia, and germanywestcentral.

Schema generation from Cloud Console is now available. For more information, see Produce new messages to topics.

Azure: Support for self-managed encryption keys (aka BYOK) for Confluent Cloud Enterprise clusters is now available. For details, see Encryption of data at rest on Kafka clusters and Use Self-Managed Encryption Keys in Confluent Cloud on Azure.

The fully-managed Snowflake Source connector captures a snapshot of the existing data in specified Snowflake tables and then monitor and record all subsequent row-level changes to that data. To explore a full range of features and get started with the connector, see Snowflake Source Connector for Confluent Cloud.

Clustering support in BigQuery V2 Sink Connector is now available.

OAuth Auto Pool Mapping for Kafka Clients is now available as a Limited Availability feature. This capability simplifies Kafka client configurations, reducing the complexity of managing multiple identity pools. Use this functionality to:

• Automatically map client tokens to all matching identity pools.

• Grant clients the combined permissions from all matching pools.

• Eliminate the need to specify identity pool IDs in configurations.

For details and to sign up, see Use auto pool mapping with OAuth identity pools.

The Enterprise type clusters are generally available on Google Cloud.

Enterprise clusters are designed for production-ready functionality that requires private endpoint networking capabilities.

Enterprise clusters are available over Google Cloud Private Service Connect connections in the following Google Cloud regions:

• us-central1 (Iowa)

• us-east4 (N. Virginia)

• europe-west1 (Belgium)

• us-west4 (Las Vegas)

• us-east1 (S. Carolina)

• asia-southeast1 (Singapore)

• us-west2 (Los Angeles)

• us-west1 (Oregon)

• europe-west2 (London)

• asia-south1 (Mumbai)

For details about Enterprise clusters, see Kafka Cluster Types in Confluent Cloud.

As part of this release, you can now create PrivateLink Attachments in the supported Google Cloud regions. For details about PrivateLink Attachment on Google Cloud, see Use Google Cloud Private Service Connect for Serverless Products on Confluent Cloud.

Cluster Linking now supports Enterprise clusters and cross-cloud linking.

• For details on supported cluster combinations, see this high level table in the Cluster Linking overview: Supported cluster types and the detailed breakdown in the private networking section: Supported cluster combinations.

• This broadened support for cluster types streamlines Cluster Linking deployment for private networking on Azure and AWS, as described in How to use cluster links with private networking.

• To learn more about these enhancements and new supported cluster combinations for Cluster Linking, see the Confluent Q1 2025 blog post on new features and updates.

Confluent Cloud for Apache Flink now supports existing Confluent Cloud network to access private networking on AWS: this simplifies using Flink with Dedicated clusters using private networking (PrivateLink, VPC Peering and Transit Gateway). You no longer need to create any additional networking infrastructure (PLATT). Instead, you can access the Flink service by using use the same network connection established to connect to your Dedicated cluster. Also, this capability enables a specific DNS endpoint for every network, allowing various types of architectures. Existing users of private networking will see a new prompt in Confluent Cloud Console to choose the endpoint. For more information, see Private Networking with Confluent Cloud for Apache Flink.

IP Filtering support for Flink: you can now control access to a Flink public by using IP Filtering, which provides more flexibility to access Flink resources (statements and workspaces).

• Flexibility: going forward, access to Flink resources (statements and workspaces) is allowed from a public endpoint by default, and you can restrict access based on your needs.

• Backward compatibility: A default “deny all public IPs” rule has been applied to environments with an existing PrivateLink Attachment (PLATT) to maintain the same behavior that previously blocked public access once a PLATT was created in an environment. You can modify and open up this rule as you see fit to allow public access again.

Confluent Cloud for Apache Flink is now available with public and private networking in the AWS region ap-northeast-1.

Dead Letter Queue (DLQ) support for handling Lambda invocation failures in the fully-managed AWS Lambda Sink connector for Confluent Cloud is now available.

Client-side field level encryption (CSFLE) is now extended to support the following fully-managed connectors for Confluent Cloud: Microsoft SQL Server CDC Source V2 (Debezium) and MySQL CDC Source V2 (Debezium).

General release (GA) of Schema Registry PrivateLink. This feature enables client applications in the virtual private cloud (VPC) to securely access Schema Registry without egressing to the public internet from your VPC. Schema Registry PrivateLink is currently available in select regions on AWS.

The Stream Governance UI on the Confluent Cloud Console has also been revamped for better user experience.

The following SQL functions have been enhanced in Confluent Cloud for Apache Flink:

• TO_TIMESTAMP_LTZ function now offers overloaded functionality, supporting both numeric-based conversions (epoch seconds/milliseconds) and string-based conversions with format and timezone parameters. For more information, see TO_TIMESTAMP_LTZ.

• JSON_OBJECT and JSON_ARRAY functions now support nested JSON structures, allowing output from other JSON construction function calls to be inserted directly rather than as strings. This enables creating complex nested JSON structures with better readability and maintainability. For more information, see JSON_OBJECT and JSON_ARRAY.

New ConnectManager role

On April 11, 2025, Confluent removes permissions to pause and resume connectors from the Operator role. This change restores to administrators a read-only Operator role that can view metadata and monitor resources without the right to modify resources. Starting immediately, you can grant users the ConnectManager role to monitor, pause, and resume connectors in your clusters. For details, see Operator and ConnectManager.

New Google Cloud regions for Flink

Confluent Cloud for Apache Flink is now available in Google Cloud regions us-west1 (Oregon) and europe-west2 (London).

Tableflow for Apache Iceberg™ is now generally available in Confluent Cloud with AWS. This feature enables managing streaming data in Apache Kafka® as tables in your data lake without the need for complex infrastructure management.

Key features

• GA status: Iceberg as a destination format is now generally available.

• Cluster support: Works with all cluster types in AWS, including Freight clusters.

• Networking: Supports all networking types, with private networks using “Bring Your Own Storage”.

• Storage options: You can store data in your own S3 bucket or use Confluent Managed Storage.

• Schema Registry formats: Supports all Schema Registry formats (JSON Schema, Avro, Protobuf) and data not serialized with Schema Registry clients.

• Schema evolution: Supports automatic schema evolution, including adding and widening columns.

• Table registration: Automatically registers tables as external tables in AWS Glue, Snowflake Open Catalog, and Apache Polaris catalogs.

• Table maintenance: Handles table maintenance such as compaction automatically.

• CLI and Terraform provider: Launch includes support for Confluent CLI and Confluent Terraform provider.

• Metrics: Offers a comprehensive suite of metrics including bytes and rows written, compaction metrics, latest offsets, and more.

For more information, see Tableflow in Confluent Cloud.

IP Filtering adds support for schema management operations. You can enhance the security of your Confluent Cloud resources by allowing access only from trusted network locations, either at the organization level or at the environment level. You can use the predefined No Public Networks group to block all public network locations.

Confluent Cloud now supports Jio Cloud

Confluent announces the general availability of Confluent Cloud in the Jio India West region, marking the exciting beginning of a multi-year strategic partnership with Jio Platforms Limited. With Confluent Cloud on Jio Cloud, Indian businesses have the tools to unlock valuable insights, improve operational efficiency, and deliver superior customer experiences . This offering is available immediately to all Jio Cloud customers. For more information, see Jio Cloud and How do I sign up for Confluent Cloud in Jio regions?.

Confluent Cloud networking

Support for /27 CIDR blocks is now generally available in Confluent Cloud. You can use /27 CIDR blocks with your VPC Peering and Transit Gateway on AWS for more efficient IP address allocation.

To learn more, see the Confluent Cloud network CIDR blocks and block size for peering and Transit Gateway section in Create Confluent Cloud Network on AWS.

ConnectManager Role

A new RBAC role, ConnectManager, grants permissions to describe, pause, read, restart, and resume managed connectors.

Topic Message Viewer Enhancements

We are thrilled to introduce significant updates to Topic Message Viewer in Confluent Cloud, a key tool for developers and operators. For more information, see Use Message Browser in Confluent Cloud.

This release includes the following enhancements:

• Default Page for Topics: The message viewer is now the default view when opening any topic in Confluent Cloud.

• Histogram Visualization: Message counts over time can now be visualized in a histogram. You can easily hover or scrub across the chart to filter by the selected time range.

• Increased Performance: You can now seamlessly stream, visualize, search, and filter up to 1,000,000 messages—a substantial increase from the previous limit of 1,000 messages. The search and filter operations are performed in memory, ensuring a superior user experience.

• Improved Timestamp Formats: Timestamps display in both ISO and UNIX epoch formats.

• New User-interface Controls: The interface has been completely redesigned for a modern look and feel.

Delegated workload identity management for service accounts, OAuth identity pools, and certificate identity pools is now generally available for Confluent Cloud. Use the ResourceOwner and Assigner roles to delegate management of workload identities to developers and other users. With these changes, the following roles can now create workload identities:

• EnvironmentAdmin

• CloudClusterAdmin

• KsqlAdmin

• ResourceOwner

CLI commands that create workload identities with the --resource-owner require require CLI version 4.18.0 or later.

For details, see Manage Workload Identities.

A configurable property, use.integer.for.int8.int16, for mapping INT8 and INT16 data types to INTEGER in Google BigQuery Sink V2 connector is now available.

Confluent Cloud now supports limiting user invitations to only verified organizations with trusted domains. For details, see Manage Trusted Domains on Confluent Cloud.

Confluent Cloud for Apache Flink now provides comprehensive support for Debezium CDC streams, making it easier to work with change data when building real-time applications that react to database changes.

To enable Debezium format for your tables, use the ALTER TABLE command:

-- Convert from regular Avro format to Avro Debezium format ALTER TABLE my_table SET (  'value.format' = 'avro-debezium-registry',  'changelog.mode' = 'retract' -- Choose the appropriate mode for your use case ); 

Note: Select the most appropriate changelog mode for your specific use case:

• Use ‘retract’ when changes to the same row are represented as paired operations

• Use ‘upsert’ when tracking state changes using a primary key (derived from Kafka message key)

• Use ‘append’ when each record should be treated as an independent operation

Cluster Linking is now generally available on Azure Private Networking (including Azure Private Link and VNet Peering) in a subset of Azure regions: centralus, eastus, eastus2, westus2, westus3. To learn more, see Cluster Linking between Confluent Cloud clusters using Azure, AWS, or Google Cloud private networking and Supported cluster combinations.

The fully-managed ServiceNow Source V2 connector is now generally available for your Apache Kafka® clusters on AWS, Azure, and Google Cloud. The connector allows you to fetch records from up to five ServiceNow tables simultaneously and add the records in Kafka topics in real time.

To explore a full range of features and get started with the connector, see ServiceNow Source V2 Connector for Confluent Cloud.

Confluent Cloud now features a new default user interface theme designed to enhance user experience. Key improvements include:

• Improved accessibility

• Enhanced text contrast

• Refined interactive states and elements

• Upgraded data visualizations

This new theme is active for all users. Log in to your Confluent Cloud account to experience the refreshed interface.

New features for Flink SQL Workspaces in Confluent Cloud for Apache Flink are generally available.

• Pre-submission error highlighting: The SQL editor now highlights any errors in your SQL before you submit a statement. The precise cause of an error is underlined with red squiggly lines to help you quickly determine what needs to be fixed.

• Tabbed workspaces: Previously, only a single SQL Workspace could be open at a given time. Now, each Workspace is its own in-browser tab that maintains state across tab visits, enabling you to run many more statements with less effort.

• Time-series visualization: The output of certain SQL statements can be rendered seamlessly as time-series charts. Whenever a statement’s output has at least one time column, and at least one numeric column, it is charted automatically in a time series when you toggle to chart mode. You can further customize charts by user interactions: you can choose a different x-axis column, add multiple series, change the chart’s time granularity, and filter the overall time range. For more information, see View Time Series Data.

Private networking with Confluent Cloud for Apache Flink is now generally available in all supported Azure regions. For more information, see Azure supported regions.

Freight clusters

Freight clusters, a new type of Confluent Cloud cluster, are generally available on AWS. Freight clusters are designed for high throughput workloads with relaxed latency requirements. With this new cluster type, you get:

• A managed streaming service that is up to 80% cheaper than self-managed open source Apache Kafka®

• Autoscaling capabilities up to 152 eCKU

• TCO-optimizing features including zone alignment and the Fetch from Follower feature

Freight clusters are supported by the new Private Network Interface networking type.

For more information, check out the release blog and the Freight Cluster documentation.

Support for self-managed encryption keys for Confluent Cloud Enterprise Kafka clusters on AWS is now available. For details, see Encryption of data at rest on Kafka clusters and Use Self-Managed Encryption Keys in Confluent Cloud on AWS.

Support for external key managers (EKM) for Confluent Cloud Dedicated clusters is now generally available for Google Cloud using your external key manager and Google Cloud External Key Manager (Cloud EKM). For details, see Key creation and management.

Confluent Cloud supports outbound Google Cloud Private Service Connect connections using Egress Private Service Connect Endpoints. Egress Private Service Connect Endpoints enable fully managed Confluent connectors to access services from Google Cloud Private Service Connect service providers, such as Google, MongoDB, Snowflake, and others.

With this capability, Confluent Cloud now supports private outbound connections for Dedicated clusters across all three cloud providers, AWS, Azure, and Google Cloud.

For details, see Google Cloud Egress Private Service Connect Endpoints for Dedicated Clusters.

Confluent Cloud supports resolving private DNS names from a DNS resolver within your own Google Cloud VPC via DNS forwarding. This feature enables fully-managed connectors to access endpoints using private DNS zones.

In addition to Google Cloud Peering, DNS forwarding is supported for AWS VPC peering, AWS Transit Gateway connection, or Azure VNet peering in Confluent Cloud.

For details, see DNS forwarding for Google Cloud Peering.

Confluent Cloud for Apache Flink is now available with public and private networking in the Azure region southcentralus.

Just-in-time user provisioning (JIT) for Confluent Cloud is now generally available for Azure Marketplace organizations. For more information, see JIT user provisioning.

The new support policy for fully-managed connectors in Confluent Cloud is now generally available. The policy outlines the lifecycle phases for fully-managed connectors, including details on deprecated connectors, end of life (EOL) timeframes, and migration recommendations by Confluent. To know more, see Support policy for Confluent Cloud connectors.

For information on how to upgrade to the most up-to-date, secure, and efficient version of the fully-managed connector, see Deprecated connectors and migration path.

Oracle Database versions 11g, 12c and 18c are deprecated. Confluent will end support for these versions on June 30, 2025. For more details, see Oracle CDC Source Connector for Confluent Cloud Overview and Features.

The following connectors are now generally available for your Apache Kafka® clusters on AWS, Azure, and Google Cloud.

• The fully-managed HTTP Source V2 connector integrates Apache Kafka® with an API using HTTP or HTTPS and allows you to configure one or more APIs seamlessly with an OpenAPI/Swagger specification file. To explore a full range of features and get started with the connector, see HTTP Source V2 Connector for Confluent Cloud.

• The fully-managed HTTP Sink V2 connector integrates Apache Kafka® with an API using HTTP or HTTPS and allows you to configure up to 15 APIs seamlessly with an OpenAPI specification file. To explore a full range of features and get started with the connector, see HTTP Sink V2 Connector for Confluent Cloud.

Five additional Confluent Cloud metrics are now available to query directly using the Metrics API. For more information, see Dedicated Cluster Performance and Expansion in Confluent Cloud.

• cluster_load_percent_avg

• cluster_load_percent_max

• dedicated_cku_count

• hot_partition_ingress

• hot_partition_egress

Enterprise clusters are now available in the swedencentral (Gävle) region in Azure.

Support for Avro unions in Confluent Cloud for Apache Flink has been added. Avro unions are used to define multiple event types in one topic. Previously, you could not read or write to tables that were backed by a schema using Avro unions. When Avro unions are used, the schema is inferred as a ROW type, similar to how the the feature is supported for JSON and Protobuf.

The JSON_QUERY function now supports returning arrays. JSON_QUERY is one of the Flink JSON functions that returns objects, arrays, and other non-scalar types. You can now specify the JSON_QUERY return type to be ARRAY<STRING>, instead of STRING.

The Kafka Connect Google BigQuery Sink V2 connector for Confluent Cloud now supports upsert and delete functionality for ingested data. With the upsert feature, you can insert new data, or update existing data with matching keys. The upsert and delete functionality adds the option to insert new data, update existing matching key data, or remove data with matching keys for tombstone records. For more details, see Google BigQuery Sink V2 Connector for Confluent Cloud.

You can now run a Flink SQL statement without stopping the currently running statement explicitly. Previously, an editor cell was completely locked while a statement was running. To run the next statement in the same cell, the running statement had to be stopped explicitly. This behavior has been improved so an editor cell is locked only while the statement is starting. As soon as the statement is running, the editor is unlocked and editable, and you can submit the next statement immediately.

Improved Flink compute pool deletion behavior so actively running statements stop automatically when a compute pool is deleted.

Statement sets are now supported within SQL editor cells in workspaces.

Improved synchronization between Flink statement status in an editor cell and the Flink statement’s details panel to prevent out-of-sync issues.

The catalog browser in workspaces is now horizontally resizable, making long topic names more accessible.