<a id="release-notes"></a>

# Confluent for Kubernetes Release Notes

Confluent for Kubernetes is continuously updated with new features and enhancements. This topic
highlights significant new and updated features, bug fixes, and known limitations in
each release.

- For Confluent Platform and CFK compatibility information, see
  [Confluent Platform](co-supported-environments.md#co-operator-supported-versions).
- For CFK image tags by version, see [Confluent for Kubernetes image tags](co-supported-environments.md#co-operator-image-tags).
- To learn how to install CFK and Confluent Platform, see [Deploy Confluent for Kubernetes](co-deploy-operator.md#co-deploy-operator)
  and [Deploy Confluent Platform using Confluent for Kubernetes](co-deploy-cp.md#co-deploy-cp).

#### NOTE
For the list of security and vulnerability issues fixed in any release,
see [Security Advisories and Security Release Notes](https://support.confluent.io/hc/en-us/sections/360008413952-Security-Advisories-and-Security-Release-Notes).

<a id="co-rn-3-3-0"></a>

## [23 June, 2026] Confluent for Kubernetes 3.3.0 Release Notes

### Compatibility and container images

CFK 3.3.0 allows you to deploy and manage Confluent Platform versions from 7.5.x to 8.3.x on
Kubernetes versions 1.28 - 1.36 (OpenShift 4.15 - 4.22).

The images released in CFK 3.3.0 are:

* `confluentinc/confluent-operator:0.1718.10`
* `confluentinc/confluent-init-container:3.3.0`
* `confluentinc/confluent-observer-container:3.3.0`

### Breaking changes

There are no breaking changes in this release.

### New features

* Adds preview support for managing Confluent Platform Flink SQL objects through CFK with
  six new custom resources. See [Manage Flink SQL Statements Using Confluent for Kubernetes](co-manage-flink-sql.md#co-manage-flink-sql).
* Expands the FlinkEnvironment and FlinkApplication schemas with new
  configuration and status fields. See [Create a Flink environment](co-manage-flink-environments.md#co-flink-environment).
* Adds support for the migration pre-check utility for single-cluster KRaft migrations. See [Step 3.2: Enable the ZooKeeper metadata preflight check](co-migrate-kraft-procedure.md#co-migrate-kraft-enable-preflight-v2).
* Supports ZooKeeper to KRaft migration for 2.5 datacenter (2.5DC) deployments. See [Two-and-a-half datacenter (2.5DC) considerations](co-migrate-kraft-prerequisites.md#co-migrate-kraft-2-5dc-considerations-v2).
* Supports scaling up KRaftController replicas on dynamic quorum clusters
  without rolling existing controllers or co-located Kafka brokers. See
  [Scale up the controller quorum](co-configure-kraft-dynamic-quorum.md#co-kraft-dynamic-quorum-scale).
* Adds opt-in hot-reload for eligible Gateway configuration changes.
* Adds `mountedSecrets` and `mountedVolumes` to the Gateway CR for mounting
  custom secrets and volumes.
* Supports running the Gateway with `readOnlyRootFilesystem: true` by
  provisioning writable `emptyDir` volumes for the log and temporary file
  paths.
* Supports OAuth-to-OAuth authentication swap through the Gateway. See
  [Configure authentication swapping](gateway/co-gateway-security.md#co-gateway-authn-swap).
* Runs the liveness probe as an `exec` probe backed by the `cfkprober`
  binary. See [Liveness probe change to exec in CFK 3.3.0](co-upgrade-overview.md#co-upgrade-liveness-exec-probe).
* Pauses a maintenance-mode pod inside its main container instead of the init
  container, giving direct access to the component’s command-line tools. See
  [Configure maintenance mode](co-configure-misc.md#co-maintenance-mode).

### Enhancements

* Masks sensitive credentials in CFK log output through a centralized
  redaction wrapper, so plaintext credentials are sanitized before reaching any
  log sink.
* Generates the KRaft admin-client properties file for dynamic quorum
  deployments.
* Revokes the corresponding Metadata Service (MDS) role binding when you remove an entry
  from `spec.resourcePatterns` on the ConfluentRolebinding CR, preventing
  orphaned bindings from persisting. See [Update a rolebinding](co-manage-rbac.md#co-update-rolebinding).
* Supports a new `useProcNetPortCheck` liveness and readiness probe method
  that reports liveness from the `/proc/net/tcp` file instead of performing an
  actual handshake. This helps avoid TLS-related errors.
* Supports adding a sidecar container to a Pod Overlay for in-pod debugging and
  connectivity checks. This has always been possible, but it becomes more
  important starting with Confluent Platform 8.3, because images now use the `ubi9-micro`
  base image instead of `ubi9-minimal` and no longer include `curl` and
  other command-line tools. See [Customize Confluent Platform pods with Pod Overlay](co-configure-misc.md#co-pod-overlay).
* Adds a disaster recovery procedure for recovering a multi-region dynamic
  KRaft cluster after a controller quorum loss. See
  [Disaster Recovery for Multi-Region KRaft Clusters](co-disaster-recovery.md#co-disaster-recovery).

### Bug fixes

* Fixed incorrect `advertised.listeners` ports when multiple user-defined
  listeners share the same static or nodePort offset.
* Fixed dynamic per-listener TLS certificate rotation triggering unnecessary
  Kafka broker rolling restarts. CFK now correctly classifies derived `PKCS12`
  secrets as dynamic-config secrets.
* Fixed the `zk-node-removal` plugin for RBAC and MRC deployments.
* Fixed MRC KRaft migration requiring a manual `zookeeper.connect`
  override on the KRaftController. For 2.5DC topologies, the manual ZooKeeper
  endpoint on the 0.5DC `KRaftController` is still required. See [Configure the IBP version](co-migrate-kraft-mrc.md#co-migrate-kraft-mrc-0-5dc-v2).
* Fixed an orphaned connector when a Connector CR is deleted after a failed
  create or update. CFK now issues the `REST DELETE` instead of skipping it.
* Fixed Jolokia file-reference password resolution to trim whitespace so
  passwords read from mounted secret files no longer fail.
* Fixed client-side `OAUTHBEARER` authentication failing through the Gateway.

### Known limitations

* Components that authenticate to Kafka using OAuth client assertions, such as
  Schema Registry, Connect, ksqlDB, Control Center, and REST Proxy, fail to start on Confluent Platform
  8.3.x. Kafka 4.3 enforces an empty, deny-by-default allowlist for the files
  used in the OAuth client-assertion flow, so the configured private-key file
  is rejected. As a workaround, set the
  `-Dorg.apache.kafka.sasl.oauthbearer.allowed.files` JVM system property on
  the affected component through its `*_OPTS` environment variable or
  `podTemplate`. If you configure issuer or JSON Web Key Set (JWKS) endpoint
  URLs, also set `-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls`.

<a id="co-mrc-rolebinding-limitation"></a>
* In Multi-Region Cluster (MRC) deployments, the co-ownership check only
  considers `ConfluentRolebinding` resources visible to the operator
  managing that cluster. A co-owning `ConfluentRolebinding` on another
  region’s cluster is not visible, so removing a pattern from (or deleting) a
  `ConfluentRolebinding` might revoke a binding that a `ConfluentRolebinding`
  in another region still declares. Use caution when removing patterns or
  deleting `ConfluentRolebinding` resources in MRC if the same
  `(principal, role, scope, resourcePattern)` might be declared on another
  region’s cluster. For details, see [Update a rolebinding](co-manage-rbac.md#co-update-rolebinding).
* A Confluent Gateway passthrough route that configures `cluster.extensionHeaders`
  fails admission validation. Injecting extension headers requires setting
  `client.authentication.type` to `oauth`, which triggers a CRD validation
  rule that mandates `oauthSettings.jwksEndpointUri` and
  `oauthSettings.audience`. Although Confluent Gateway ignores these fields at runtime
  on passthrough routes and forwards tokens unmodified, the validation rule
  still rejects the resource. As a workaround, you must provide placeholder
  values for the required OAuth fields. For details, see
  [OAUTHBEARER passthrough limitation](gateway/co-gateway-security.md#co-gateway-passthrough-oauth-limitation).
* If you manage the CFK `ServiceAccount` permissions manually instead of
  letting Helm create them, CFK 3.3.0 requires additional RBAC permissions
  that earlier versions did not. Without these permissions, the CFK pod
  repeatedly crashes with a `jobs.batch is forbidden` error. For details on
  the required permissions, see [Add RBAC permissions for custom roles before upgrading to 3.3](co-upgrade-overview.md#co-upgrade-custom-rbac-batch-jobs).
* CFK 3.3.x can trigger unnecessary Kafka or KRaftController rolling
  restarts when a metadata-only update changes a tracked secret’s
  `resourceVersion`. As a workaround, set
  `platform.confluent.io/secret-change-roll-cluster="false"` on the
  affected resources. Note that after applying this workaround, intentional
  secret rotations then require a manual roll.

### Deprecations

There are no new deprecations in this release.