Confluent Developer Marketplace Get started
  1. Home
  2. Platform
  3. CFK

Confluent for Kubernetes Release Notes

To get the latest product updates delivered to you in an RSS feed, add the URL of this page to your feed reader or add the feed's URL directly
https://docs.confluent.io/operator/3.4/release-notes.xml

Confluent for Kubernetes is continuously updated with new features and enhancements. This topic highlights significant new and updated features, bug fixes, and known limitations in each release.

Note

For the list of security and vulnerability issues fixed in any release, see Security Advisories and Security Release Notes.

[28 October, 2026] Confluent for Kubernetes 3.4.0 Release Notes

Compatibility and container images

CFK 3.4.0 allows you to deploy and manage Confluent Platform versions from 7.6.x to 8.4.x on Kubernetes versions 1.28 - 1.36 (OpenShift 4.15 - 4.22).

The images released in CFK 3.4.0 are:

  • confluentinc/confluent-operator:0.2038.1

  • confluentinc/confluent-init-container:3.4.0

  • confluentinc/confluent-observer-container:3.4.0

Breaking changes

There are no breaking changes in this release.

Upgrade considerations

Previously, the default JVM heap for Kafka brokers and KRaftControllers was 100% of the pod memory request. The default heap is now capped as follows:

  • Kafka brokers: The smaller of 50% of requests.memory and 32 Gi.

  • KRaftControllers: The smaller of 80% of requests.memory and 32 Gi.

If you have already set the heap in spec.configOverrides.jvm, this change doesn’t affect you. If you don’t, check the heap that each broker and KRaftController runs with today. If that heap is larger than the new cap, set it in spec.configOverrides.jvm before you upgrade. If you don’t, the upgrade reduces the heap to the cap. For more information, see Kafka broker and KRaftController heap-size default change in CFK 3.4.0 and Default JVM heap size.

New features

  • Supports multi-tenancy for Kafka clusters. For more information, see Enable Confluent Private Cloud Multi-Tenancy on a Kafka cluster.

  • Captures multi-tenancy state in kubectl confluent support-bundle, including LogicalKafkaCluster CRs and tenant-scoped Services. For more information, see Multi-tenancy information in the support bundle.

  • CFK now manages its own custom resource definitions (CRDs) at startup. It reconciles the CRDs to the highest version, guards against downgrades, and never deletes CRDs. You no longer need to apply the CRDs manually with kubectl apply -f crds/ during upgrades. For more information, see Step 5: Upgrade Confluent Platform Custom Resource Definitions (CRDs).

  • Adds kubectl confluent block-reconcile and kubectl confluent enable-reconcile plugin commands. For more information, see kubectl confluent block-reconcile and kubectl confluent enable-reconcile.

  • Supports a dedicated password encoder secret on the KRaftController CR for ZooKeeper to KRaft migration. You no longer need to store password.encoder.secret in plaintext through configOverrides.server. When a co-located Kafka CR sets spec.passwordEncoder, the KRaftController uses it automatically. In lite mode, where there is no Kafka CR, set spec.dependencies.migration.passwordEncoder explicitly. For more information, see Manage Password Encoder Secrets for Confluent Platform Using Confluent for Kubernetes.

  • Supports staticForHostBasedRouting for external access to Metadata Service (MDS) through Routes.

  • Supports changing the replication factor of a KafkaTopic. Updating spec.replicas on the KafkaTopic CR now drives the change to completion. For more information, see Change the replication factor of a topic.

  • Adds drift protection for Day-2 CRs. CFK now prevents orphaned resources when you edit a spec. You can also opt in to detect and correct drift against the live cluster state for ConfluentRolebinding, KafkaTopic, ClusterLink, and other Day-2 CRs. For more information, see Annotate Confluent custom resources.

  • Adds fencing v2 to the Confluent Gateway CR. You can fence traffic at the topic level and fence a specific type of traffic, produce or consume. For more information, see Fencing filter.

  • Adds dynamic routing to Confluent Gateway as an Early Access feature. For more information, see Configure routes.

  • Supports field-level and payload encryption on Confluent Gateway through the new dataGovernance policy. For more information, see Configure encryption.

  • Supports multiple Schema Registry URLs in the Confluent Gateway SchemaRegistry client dependency for high availability and failover. For more information, see Connect to Schema Registry.

  • Adds a pod annotation that triggers a kubelet sync for faster Confluent Gateway hot-reload.

  • Adds commandHandler support to the USM Agent CR. This runs the command-handler container in the USM Agent pod, which receives connector management commands from Confluent Cloud and runs them against the configured Connect clusters. For more information, see Configure the Command Handler for connector management.

  • Adds support for bringing your own Prometheus for Control Center. Control Center can skip its bundled Prometheus and Alertmanager and read metrics from an external Prometheus. For more information, see Bring your own Prometheus (BYOP).

Enhancements

  • Makes PublishNotReadyAddresses configurable for CFK-generated Services. For more information, see Configure Networking.

  • Adds an internalClientConfig field on the Kafka CR to override TLS hostname verification for the operator’s internal Kafka and REST client connections. For more information, see Disable TLS hostname verification for the Kafka internal client.

  • Caps the default JVM heap for Kafka brokers and KRaftControllers. For more information, see Default JVM heap size. Before you upgrade, review Kafka broker and KRaftController heap-size default change in CFK 3.4.0.

  • Removes hard-coded ParallelGCThreads=1 or ConcGCThreads=1 JVM defaults. For more information, see Default JVM settings.

  • Bundles the cfkprober binary in the operator bundle for Iron Bank and FedRAMP parity.

  • Gates the Confluent Gateway hot-reload informers on an RBAC preflight check.

  • Adds cluster-auth binding awareness and an enableCanary flag to the Confluent Gateway CR to optionally skip hot-reload canary validation.

  • Adds spec.configId to the Confluent Gateway custom resource (CR) for tracking hot-reload configuration revisions.

  • Sets confluent.catalog.collector.multitenant.cluster.link.enable=false on the KRaftController so that the catalog collector emits cluster-link metadata for USM on Confluent Platform. The upstream default for this property is true, which targets Confluent Cloud.

  • Updates the default USM Agent version to 1.2.1 from 1.2.0.

  • Flink resources that set skipApply now have their status refreshed through reconcile.

  • Rejects bringing your own Prometheus on Control Center images that predate external Prometheus support. Control Center now returns a clear error instead of failing silently.

  • Adds missing Control Center next-generation tenant quota, system, and cluster monitoring metrics to the telemetry allowlist and syncs the Prometheus recording rules.

Bug fixes

  • Fixed connectRest.endpoint dropping the query string when building REST URLs.

  • Fixed sasl.oauthbearer.expected.issuer not being rendered for OAuth listeners.

  • Fixed a crash in Control Center with OAuth. sasl.login.callback.handler.class was incorrectly stripped for RBAC with OAuth-typed Metadata Service (MDS) authentication.

  • Fixed Jolokia configuration options not rendering as a single comma-separated line.

  • Fixed the KRaftController so that it discovers its co-located Kafka CR for net-new KRaft deployments and sets the interbroker listener name to replication.

  • Fixed TLS handshake errors flooding Control Center Prometheus and Alertmanager logs, caused by Kubernetes health checks against TLS-enabled endpoints. Set useProcNetPortCheck: true under spec.podTemplate.probe.readiness or spec.podTemplate.probe.liveness on the ControlCenter CR to switch these health checks to a TLS-free method.

  • Fixed RBAC drift in the Operator Lifecycle Manager (OLM) bundle.

  • Fixed an issue that prevented installing or pinning to a specific, non-latest, CFK version through the OpenShift OperatorHub. Each release now retains a direct upgrade link to its predecessor in the Red Hat operator catalog. Also fixed missing usm, gateway, and observer images and a skipRange bound in the Red Hat bundle.

  • Fixed the CMF ownership annotation for FlinkStatement.

  • Fixed a cascade-delete regression on Flink CRDs. A CRD regeneration that relaxed enum validation introduced the regression.

  • Fixed FlinkEnvironment creation being rejected by CMF due to a name collision between metadata.name and the top-level name field.

  • Fixed Common Expression Language (CEL) validation for passthroughConfig on the Confluent Gateway CR.

  • Fixed Confluent Gateway authentication-swapping validation so oauthSettings.jwksEndpointUri is required only when swapping to OAuth authentication, and oauthSettings.audience is no longer always required.

  • Fixed a Confluent Gateway CEL rule bug.

  • Fixed duplicated container ports for Confluent Gateway host-based routes.

Known limitations

  • If the leader controller crashes while a KafkaTopic replication factor change is in progress, Self-Balancing can lose status tracking for the affected topics and not return them to CFK. CFK then cannot recover the full status of the in-flight change.

  • Changing the replication factor of a KafkaTopic by editing spec.replicas requires Confluent Platform 8.4 or later. Topics in a LogicalKafkaCluster are not supported.

Deprecations

There are no new deprecations in this release.