Confluent for Kubernetes Release Notes

Confluent for Kubernetes (CFK) provides a declarative API-driven control plane to deploy and manage Confluent Platform on Kubernetes.

The following sections summarize the technical details of the CFK 2.7 releases.

Confluent for Kubernetes 2.7.5 Release Notes

Confluent for Kubernetes (CFK) 2.7.5 allows you to deploy and manage Confluent Platform versions 7.4.x and 7.5.x on Kubernetes versions 1.23 - 1.27 (OpenShift 4.10 - 4.14).

Notable fixes

  • To prevent a possible data loss, you cannot change the Kafka cluster used by that Topic Custom Resource (CR) after you create a topic using the Topic CR.
  • Internal issues were resolved, including critical security and vulnerability issues.

Confluent for Kubernetes 2.7.4 Release Notes

Confluent for Kubernetes (CFK) 2.7.4 allows you to deploy and manage Confluent Platform versions 6.2.x, 7.4.x, and 7.5.x on Kubernetes versions 1.23 - 1.27 (OpenShift 4.10 - 4.14).

Notable fixes

  • Fixed an issue to avoid race conditions while updating certificates using cert-manager.
  • Fixed an issue in the ConfluentRolebinding custom resource (CR) which resulted in an incorrect state when you delete a resource-specific role binding from the CR.
  • When Kafka and KRaft roll, now information about under-replicated partitions (URPs) and log end offsets (LEOs) are logged.
  • The Kafka shrink workflow now considers the brokerID offset annotation as part of the self-balancing cluster (SBC) rebalancing.
  • Critical security and vulnerability issues were fixed.

Confluent for Kubernetes 2.7.3 Release Notes

Confluent for Kubernetes (CFK) 2.7.3 allows you to deploy and manage Confluent Platform versions 6.2.x, 7.4.x, and 7.5.x on Kubernetes versions 1.23 - 1.27 (OpenShift 4.10 - 4.14).

Notable fixes

  • The readiness and liveness port of Kafka has been changed from 9071 to 9072.

    Additionally, now in the Pod Template of a component CR (applicable to all components), you can customize/override the port and path of the readiness and liveness probe.

  • Critical security and vulnerability issues were fixed.

Confluent for Kubernetes 2.7.2 Release Notes

Confluent for Kubernetes (CFK) 2.7.2 allows you to deploy and manage Confluent Platform versions 6.2.x, 7.4.x, and 7.5.x on Kubernetes versions 1.23 - 1.27 (OpenShift 4.10 - 4.14).

Notable fixes

  • The Dynamic Kafka certificate update feature is now supported for Kubernetes cluster version 1.26.7 or higher.
  • Critical security and vulnerability issues were fixed.

Confluent for Kubernetes 2.7.1 Release Notes

Confluent for Kubernetes (CFK) 2.7.1 allows you to deploy and manage Confluent Platform versions 6.2.x, 7.4.x, and 7.5.x on Kubernetes versions 1.23 - 1.27 (OpenShift 4.10 - 4.14).

Notable fixes

  • Even when a configOverrides configuration is not in the key=value format, the dynamic certificate update no longer fails and causes the cluster to roll.
  • Updated Kubernetes client-go to patch version v0.26.4. The upgrade fixes an issue where client-go 0.26.0 returns a SIGSEGV error when used with Kubernetes server versions 1.27.0 through 1.27.3, such as when running helm install.
  • Fixed the issue where multiple CA certificates with the same name and different issuers were not recognized.
  • Resolved Kubernetes pod overlay conflicts with the container.resources field. Now kafka.spec.podTemplate.resources can be used along the pod overlay.
  • Fixed an issue where Confluent Control Center goes into CrashLoopBackOff when confluent.controlcenter.ui.basepath is added in the Confluent Control Center CRD under spec.configOverrides.server.

Notable enhancements and updates

  • Upgraded CFK to use Go 1.20.6 to fix a number of Go vulnerability issues.
  • Added support for removing the -Xms or -Xmx configurations from the Kafka configuration.

Confluent for Kubernetes 2.7.0 Release Notes

Confluent for Kubernetes (CFK) 2.7.0 allows you to deploy and manage Confluent Platform versions 6.2.x, 7.4.x, and 7.5.x on Kubernetes versions 1.23 - 1.27 (OpenShift 4.10 - 4.14).

New features

Single sign-on support for Confluent Control Center

Starting in this release, you can configure single sign-on for Control Center using the CFK API.

See Single sign-on authentication for Confluent Control Center.

Encrypted PKCS#8 format MDS private key support

CFK supports the encrypted PKCS#8 formatted private key to sign MDS.

See Enable RBAC for Kafka.

New Schema CRD properties

The new Schema properties are supported in the Schema CRD API:

  • mode: Sets the Schema Registry mode.
  • normalize: Normalize a schema to the Schema Registry.

See Manage Schemas using Confluent for Kubernetes.

Notable enhancements and updates

  • You can now configure and deploy a Connect worker to download connector plugins from both Confluent Hub and custom URL locations.

    See Configure Kafka Connect.

Notable fixes

  • The simple authorizer is supported for KRaft clusters.
  • For Kafka replication listeners, now you can use the JAAS method to set up LDAP credentials.
  • Now you can expose MDS externally using the OpenShift Route.

Known issues

  • When deploying CFK to Red Hat OpenShift with Red Hat’s Operator Lifecycle Manager (that is, using the Operator Hub), you must use OpenShift version 4.9 or higher.

    This OpenShift version restriction does not apply when deploying CFK to Red Hat OpenShift in the standard way without using the Red Hat Operator Lifecycle Manager.

  • If the ksqlDB REST endpoint is using the auto-generated certificates, the ksqlDB deployment that points to Confluent Cloud requires trusting the Let’s Encrypt CA.

    For this to work, you must provide a CA bundle through cacerts.pem that contains both (1) the Confluent Cloud CA and (2) the self-signed CA to the ksqlDB CR.

  • When TLS is enabled, and when Confluent Control Center uses a different TLS certificate to communicate with MDS or Confluent Cloud Schema Registry, Control Center cannot use an auto-generated TLS certificate to connect to MDS or Confluent Cloud Schema Registry. See Troubleshooting Guide for a workaround.

  • When deploying the Schema Registry and Kafka CRs simultaneously, Schema Registry could fail because it cannot create topics with a replication factor of 3. It is because the Kafka brokers have not fully started.

    The workaround is to delete the Schema Registry deployment and re-deploy once Kafka is fully up.

  • When deploying an RBAC-enabled Kafka cluster in centralized mode, where another “secondary” Kafka is being used to store RBAC metadata, an error, “License Topic could not be created”, may return on the secondary Kafka cluster.

  • A periodic Kubernetes TCP probe on ZooKeeper causes frequent warning messages “client has closed socket” when warning logs are enabled.

  • REST Proxy configured with monitoring interceptors is missing the callback handler properties when RBAC is enabled. Interceptor would not work, and you would see an error message in the KafkaRestProxy log.

    As a workaround, manually add configuration overrides as shown in the following KafkaRestProxy CR:

    configOverrides:
  server:
    - confluent.monitoring.interceptor.sasl.login.callback.handler.class=io.confluent.kafka.clients.plugins.auth.token.TokenUserLoginCallbackHandler
    - consumer.confluent.monitoring.interceptor.sasl.login.callback.handler.class=io.confluent.kafka.clients.plugins.auth.token.TokenUserLoginCallbackHandler
    - producer.confluent.monitoring.interceptor.sasl.login.callback.handler.class=io.confluent.kafka.clients.plugins.auth.token.TokenUserLoginCallbackHandler

  • When configuring source-initiated cluster links with CFK where the source cluster has TLS enabled, do not set spec.tls, and do not set spec.authentication in the ClusterLink CR on the destination cluster if the source cluster has mTLS authentication.

    Instead, in the Destination mode ClusterLink CR, under the spec.configs section, set:

    • local.security.protocol: SSL for mTLS.
    • local.security.protocol: SASL_SSL for SASL authentication with TLS.

    For details about configuring the destination cluster for source-initiated Cluster Linking, see Configure the source-initiated cluster link on the destination cluster.

  • The Pod Disruption Budget (PDB) in CFK is set as shown below and is non-configurable using the first-class CFK API:

    • For Kafka: maxUnavailable := 1
    • For ZooKeeper, MaxUnavailable is based on the number of ZooKeeper nodes: maxUnavailable := (replicas - 1 ) / 2

    The PDB setting is typically used when upgrading a Kubernetes node. The pods are moved to different nodes for the node upgrade and then are moved back to the node. Or, when you want to reduce the size of the node pool, you would drain that node by moving the pods out of that node.

    If you have use cases when you need to change a PDB, manually set the PDB using the kubectl patch command as below:

    1. Block reconcile on Kafka to ensure that you do not overwrite anything. For example:

      kubectl annotate kafka kafka platform.confluent.io/block-reconcile=true

    2. Modify the PDB as required:

      kubectl patch pdb kafka -p '{"spec":{"maxUnavailable":<desired value>}}' --type=merge

      Use caution when you select the value. The wrong value could result in data loss or service disruption as you could bring down more Kafka nodes than ideal.

    3. Verify the change:

      kubectl get pdb

      An example output based on the above command:

      NAME        MIN AVAILABLE   MAX UNAVAILABLE   ALLOWED DISRUPTIONS   AGE
kafka       N/A             <desired value>   <desired value>       11m

    4. Perform node drains as required.

    5. Enable reconcile on Kafka. For example:

      kubectl annotate kafka kafka platform.confluent.io/block-reconcile-

  • RBAC authorization is not supported in the KRaft mode.

  • The Dynamic Kafka certificate update feature is not supported for Kubernetes cluster version 1.26.7 or higher. You must rotate your certificates without using this feature. This will trigger a rolling restart of the Kafka pods impacted by this. If you are already using this feature on Kubernetes 1.26 and 1.27, you must do an explicit Kafka pod roll to update the certificates.

    This issue is fixed in the CFK 2.7.2 release.

  • The CFK support bundle plugin on Windows systems does not capture all the logs.

    As a workaround, specify the --out-dir flag in the kubectl confluent support-bundle command to provide the output location for the support bundle.

Known gaps from Confluent Platform 7.5

CFK 2.7 does not support the following Confluent Platform 7.5 functionality:

  • Kafka authentication mechanisms: Kerberos and SASL/Scram

Known gaps in CFK Blueprints

CFK Blueprints 2.7 does not support the following CFK functionality:

  • Internal listener authentication change on the running cluster
  • A central Confluent Platform cluster serving as the RBAC metadata store for multiple Confluent Platform clusters
  • The StaticPortBasedRouting and NodePort external access methods
  • Monitoring multiple Kafka clusters in Confluent Control Center
  • Configuring and managing KRaft-based clusters
  • Single sign-on (SSO) authentication for Control Center using OpenID Connect (OIDC)