Red Hat SummitRelease Notes for Streams for Apache Kafka 3.0 on RHEL
Highlights of what's new and what's changed with this release of Streams for Apache Kafka on Red Hat Enterprise Linux
Abstract
Chapter 1. Kafka 4 impact and adoption schedule
Streams for Apache Kafka 3.0 is scheduled for release in 2025. The introduction of Apache Kafka 4 in the release brings significant changes to how Kafka clusters are deployed, configured, and operated.
For more information on how these changes affect the Streams for Apache Kafka 3.0 release, refer to the article Streams for Apache Kafka 3.0: Kafka 4 Impact and Adoption.
Chapter 2. Documentation updates
Streams for Apache Kafka documentation is updated with each release to support new features and enhancements, where applicable. For more information, see the Streams for Apache Kafka documentation for release 3.0.
Chapter 3. Features
Features introduced in Streams for Apache Kafka 3.0.
Streams for Apache Kafka 3.0 on RHEL is based on Apache Kafka 4.0.
To view all the enhancements and bugs that are resolved in this release, see the Streams for Apache Kafka Jira project.
3.1. Kafka 4.0 support
Streams for Apache Kafka now supports and uses Apache Kafka version 4.0. Only Kafka distributions built by Red Hat are supported.
For upgrade instructions, see Using Streams for Apache Kafka on RHEL in KRaft mode.
Refer to the Kafka 4.0 Release Notes for additional information.
Kafka 3.9.x is supported only for the purpose of upgrading to Streams for Apache Kafka 3.0. We recommend that you perform a rolling update to use the new binaries.
Support for ZooKeeper ends
Kafka 4.0 operates only in KRaft mode, where Kafka runs without ZooKeeper by utilizing the Raft protocol. Kafka 3.9 was the final version to support ZooKeeper. Consequently, Streams for Apache Kafka 2.9.x (LTS) is the last version compatible with Kafka clusters using ZooKeeper.
Migrate ZooKeeper-based Kafka clusters
To upgrade to Streams for Apache Kafka 3.0 or later, you must first migrate your Kafka clusters to KRaft mode.
KRaft mode limitations
For Kafka 3.8 and earlier, the controller quorums (which replace Zookeeper) were of fixed size (static). Dynamic controller quorums were introduced in Kafka 3.9.
Migration between Kafka’s static and dynamic controller quorums is not currently supported. For more information, see KAFKA-16538.
Streams for Apache Kafka 3.0 on RHEL supports static and dynamic controller quorums, with dynamic quorums recommended for new deployments.
3.2. Streams for Apache Kafka
3.2.1. Full adoption of KRaft mode
In line with the removal of ZooKeeper support in Apache Kafka 4.0, this release fully adopts KRaft mode (Kafka Raft metadata mode) for managing Kafka metadata. Streams for Apache Kafka no longer supports ZooKeeper-based deployments.
The move to KRaft simplifies deployment, streamlines management of Kafka clusters, and aligns with the Kafka 4.0 architecture.
Make sure that Kafka clusters are using KRaft before upgrading to Streams for Apache Kafka 3.0 or later.
For more information, see Migrating your Kafka cluster to KRaft mode.
3.2.2. MirrorMaker 1 removed
Support for MirrorMaker 1 has been removed. From Streams for Apache Kafka 3.0, only MirrorMaker 2 is supported.
Make sure to migrate to MirrorMaker 2 before before upgrading to Streams for Apache Kafka 3.0 or later.
To replicate the behavior of MirrorMaker 1, configure MirrorMaker 2 with the IdentityReplicationPolicy property.
3.2.3. Tiered storage
Tiered storage moves from early access and is now suitable for production environments.
Tiered storage introduces a flexible approach to managing Kafka data whereby log segments are moved to a separate storage system. Tiered storage requires an implementation of Kafka’s RemoteStorageManager interface to handle communication between Kafka and the remote storage system, which is enabled through configuration of the Kafka resource.
Streams for Apache Kafka includes plugin libraries from the open-source tiered-storage-for-apache-kafka project from Aiven for AWS S3 and file system storage by default in Kafka v4.0 and later. Using these plugins you can configure tiered storage using the following types of remote storage:
- AWS S3 remote storage
- File system remote storage
Streams for Apache Kafka supports a set of optional tuning properties for the tiered storage plugin. These properties can help optimize storage performance, throughput, and resource usage depending on your environment.
3.2.4. Metrics Reporter (Tech Preview)
The Streams for Apache Kafka Metrics Reporter is introduced as a Tech Preview. The reporter exposes Kafka metrics directly over HTTP in a Prometheus-compatible format. It integrates with Kafka brokers, clients, Kafka Connect, MirrorMaker 2, and Kafka Streams applications.
3.3. Kafka Bridge
3.3.1. Metrics Reporter (Tech Preview)
The Tech Preview for the Metrics Reporter can also be enabled on the Kafka Bridge by setting the bridge.metrics option to strimziMetricsReporter.
3.3.2. Support for custom Prometheus JMX Exporter configuration
Set bridge.metrics.exporter.config.path=/<path_to>/my-exporter-config.yml to use your custom configuration.
Chapter 4. Enhancements
Enhancements introduced in Streams for Apache Kafka 3.0.
4.1. Kafka 4.0 enhancements
For an overview of the enhancements introduced with Kafka 4.0, refer to the Kafka 4.0 Release Notes.
4.2. Kafka Bridge
4.2.1. Change to enabling JMX Reporter
The auto.include.jmx.reporter property was removed in Kafka 4.0. The JMX Reporter (org.apache.kafka.common.metrics.JmxReporter) remains enabled by default. To preserve JMX metric reporting, include the JMX Reporter in the metric.reporters list if you are using that property.
Chapter 5. Kafka breaking changes
This section describes any changes to Kafka that required a corresponding change to Streams for Apache Kafka to continue to work.
5.1. ZooKeeper no longer supported
From Kafka 4.0, ZooKeeper is no longer supported. Kafka clusters must operate in KRaft mode.
5.2. Kafka MirrorMaker 1
Kafka MirrorMaker 1 has been removed in Kafka 4.0. MirrorMaker 2 is the only version available. MirrorMaker 2 is based on the Kafka Connect framework, connectors managing the transfer of data between clusters.
If you’re using MirrorMaker 1, you can replicate its functionality in MirrorMaker 2 by using the IdentityReplicationPolicy class. By default, MirrorMaker 2 renames topics replicated to a target cluster, but IdentityReplicationPolicy preserves the original topic names, enabling the same active/passive unidirectional replication as MirrorMaker 1.
5.3. Auto-include of JMXReporter removed
The auto.include.jmx.reporter configuration has been removed in Kafka. From Kafka 4.0, to enable the JMXReporter you must either enable metrics in .spec.kafka.metrics, or explicitly add JMXReporter in metric.reporters.
5.4. Log4j2 for logging
Logging framework has been migrated from Log4j to Log4j2. If you have any custom logging configuration, you might need to update it during the upgrade to Kafka 4.0.
Chapter 6. Deprecated features
This section lists features that are deprecated (still supported but planned for removal) and removed (no longer supported as of this release) in Streams for Apache Kafka 3.0.
6.1. Deprecated features
Features marked as deprecated are still functional but will be removed in a future release. Plan to update your configurations to use the recommended alternatives.
6.1.1. Kafka Bridge
6.1.1.1. Kafka Bridge span attributes
The following Kafka Bridge span attributes are deprecated with replacements shown where applicable:
-
http.methodreplaced byhttp.request.method -
http.urlreplaced byurl.scheme,url.path, andurl.query -
messaging.destinationreplaced bymessaging.destination.name -
http.status_codereplaced byhttp.response.status_code -
messaging.destination.kind=topicwithout replacement
Kafka Bridge uses OpenTelemetry for distributed tracing. The changes are inline with changes to OpenTelemetry semantic conventions. The attributes will be removed in a future release of the Kafka Bridge
6.1.1.2. KAFKA_BRIDGE_METRICS_ENABLED
The KAFKA_BRIDGE_METRICS_ENABLED environment variable used to enable metrics for the Strimzi Kafka Bridge is now deprecated. Users who are currently using KAFKA_BRIDGE_METRICS_ENABLED should migrate to using bridge.metrics. Specifically, they should set bridge.metrics=jmxPrometheusExporter in their application.properties file to continue using Prometheus JMX Exporter.
6.2. Removed features
The following features have been removed in Streams for Apache Kafka 3.0 and are no longer supported. Update your implementations accordingly.
6.2.1. Java 11 no longer supported
Java 11 is no longer supported. Use Java 17.
Streams for Apache Kafka 2.9 provides Long Term Support (LTS) if you must continue using Java 11. For information on the LTS terms and dates, see the Streams for Apache Kafka LTS Support Policy.
Support for Java 8 was removed in Streams for Apache Kafka 2.4.0. If you are currently using Java 8, plan to migrate to Java 17 in the same way.
6.2.2. ZooKeeper-based Kafka clusters no longer supported
Support for ZooKeeper-based Apache Kafka clusters has been removed. Streams for Apache Kafka now supports Kafka clusters that run only in KRaft mode.
If you are using a ZooKeeper-based Kafka cluster, you must migrate the cluster to KRaft before upgrading to Streams for Apache Kafka 3.0.
6.2.3. Streams for Apache Kafka
6.2.3.1. Environment variable configuration provider
The io.strimzi.kafka.EnvVarConfigProvider class is no longer available. Use org.apache.kafka.common.config.provider.EnvVarConfigProvider instead.
Example configuration to enable the environment variable configuration provider
config.providers.env.class=org.apache.kafka.common.config.provider.EnvVarConfigProvider6.2.3.2. MirrorMaker 1 removed
Support for MirrorMaker 1 has been removed. From Streams for Apache Kafka 3.0, only MirrorMaker 2 is supported.
6.2.3.3. Kafka MirrorMaker 2 identity replication policy
The mirror-maker-2-extensions component has been removed. Use org.apache.kafka.connect.mirror.IdentityReplicationPolicy instead.
6.2.4. Kafka Bridge
6.2.4.1. OpenAPI v2 (Swagger)
OpenAPI v2 is no longer supported, replaced by OpenAPI v3. The /openapi/v2 endpoint returns HTTP 410 Gone. Both the /openapi and /openapi/v3 endpoints return the OpenAPI v3 definition of the Kafka Bridge REST API.
Chapter 7. Fixed issues
Issues fixed in Streams for Apache Kafka 3.0 on RHEL.
For Kafka 4.0 fixes, refer to the Kafka 4.0 Release Notes.
7.1. Fixed issues for Streams for Apache Kafka 3.0.1
Streams for Apache Kafka 3.0.1 is the latest patch release.
The following issues have been resolved in the Streams for Apache Kafka 3.0.1 release:
| Issue Number | Description |
|---|---|
| CVE-2025-48924 org.apache.commons:commons-lang3 : Uncontrolled Recursion [amq-st-3.0] | |
| CVE-2025-55163 netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability [amq-st-3.0] |
7.2. Fixed issues for Streams for Apache Kafka 3.0.0
| Issue Number | Description |
|---|---|
| [HTTP BRIDGE] Deprecate and remove OpenAPI v2 (Swagger) support | |
| ENTMQST-5924 Remove OpenAPI v2 (Swagger) support | |
| Add support for Log4j2 | |
| Remove Mirror Maker 1 support | |
| Remove ZooKeeper support from Strimzi | |
| Supportable Tiered Storage |
7.3. Security updates
Check the latest information about Streams for Apache Kafka security updates in the Red Hat Product Advisories portal.
7.4. Erratas
Check the latest security and product enhancement advisories for Streams for Apache Kafka.
Chapter 8. Known issues
Known issues for Streams for Apache Kafka 3.0 on RHEL.
8.1. JMX authentication when running in FIPS mode
When running Streams for Apache Kafka in FIPS mode with JMX authentication enabled, clients may fail authentication. To work around this issue, do not enable JMX authentication while running in FIPS mode. We are investigating the issue and working to resolve it in a future release.
Chapter 9. Supported Configurations
Supported configurations for Streams for Apache Kafka 3.0.
9.1. Supported platforms
The following platforms are tested for Streams for Apache Kafka 3.0 running with Kafka on the version of Red Hat Enterprise Linux (RHEL) stated.
| Operating System | Architecture | JVM |
|---|---|---|
| RHEL 8, 9, and 10 | x86, amd64, ppc64le (IBM Power), s390x (IBM Z and IBM® LinuxONE), aarch64 (64-bit ARM) | Java 17 and 21 |
Platforms are tested with OpenJDK 17 and 21. The IBM JDK is supported but not regularly tested against during each release.
FIPS compliance
Streams for Apache Kafka is designed for FIPS.
To check which versions of RHEL are approved by the National Institute of Standards and Technology (NIST), see the Cryptographic Module Validation Program on the NIST website.
9.2. Supported clients
Only client libraries built by Red Hat are supported for Streams for Apache Kafka. Currently, Streams for Apache Kafka only provides a Java client library, which is tested and supported on kafka-clients-3.9.0.redhat-00003 and newer.
Clients are tested with OpenJDK 17 and 21.
9.3. Supported Apache Kafka ecosystem
In Streams for Apache Kafka, only the following components released directly from the Apache Software Foundation are supported:
- Apache Kafka Broker
- Apache Kafka Connect
- Apache MirrorMaker
- Apache MirrorMaker 2
- Apache Kafka Java Producer, Consumer, Management clients, and Kafka Streams
- Apache ZooKeeper
Apache ZooKeeper is supported solely as an implementation detail of Apache Kafka and should not be modified for other purposes.
9.4. Additional supported features
- Kafka Bridge
- Cruise Control
- Distributed Tracing
See also, Chapter 11, Supported integration with Red Hat products.
9.5. Subscription limits and core usage
Cores used by Red Hat components and product operators do not count against subscription limits. Additionally, cores or vCPUs allocated to ZooKeeper nodes are excluded from subscription compliance calculations and do not count towards a subscription.
9.6. Storage requirements
Streams for Apache Kafka has been tested with block storage and is compatible with the XFS and ext4 file systems, which are commonly used with Kafka. File-based storage options, such as NFS, are not tested or supported for primary broker storage and may cause instability or degraded performance.
Kafka tiered storage is supported as an optional capability. For the remote storage tier, AWS S3 and NFS-backed storage are tested and supported. Other S3-compatible or cloud-based object storage systems might also work, but they have not been tested. If using an untested storage backend, evaluate performance and compatibility in your environment before using it in production.
Chapter 10. Component details
The following table shows the component versions for each Streams for Apache Kafka release.
Components like the operators, console, and proxy only apply to using Streams for Apache Kafka on OpenShift.
| Streams for Apache Kafka | Apache Kafka | Strimzi Operators | Kafka Bridge | Oauth | Cruise Control | Console | Proxy |
|---|---|---|---|---|---|---|---|
| 3.0.1 | 4.0.0 | 0.46.1 | 0.32.0 | 0.16.2 | 2.5.142 | 0.8.6 | 0.13.0 |
| 3.0.0 | 4.0.0 | 0.46.1 | 0.32.0 | 0.16.2 | 2.5.142 | 0.8.0 | 0.13.0 |
| 2.9.1 | 3.9.1 | 0.45.0 | 0.31.1 | 0.15.0 | 2.5.142 | 0.6.6 | 0.9.0 |
| 2.9.0 | 3.9.0 | 0.45.0 | 0.31.1 | 0.15.0 | 2.5.141 | 0.6.3 | 0.9.0 |
| 2.8.0 | 3.8.0 | 0.43.0 | 0.30.0 | 0.15.0 | 2.5.138 | 0.1.0 | 0.8.0 |
| 2.7.0 | 3.7.0 | 0.40.0 | 0.28.0 | 0.15.0 | 2.5.137 | 0.1.0 | 0.5.1 |
| 2.6.0 | 3.6.0 | 0.38.0 | 0.27.0 | 0.14.0 | 2.5.128 | - | - |
| 2.5.2 | 3.5.0 (+3.5.2) | 0.36.0 | 0.26.0 | 0.13.0 | 2.5.123 | - | - |
| 2.5.1 | 3.5.0 | 0.36.0 | 0.26.0 | 0.13.0 | 2.5.123 | - | - |
| 2.5.0 | 3.5.0 | 0.36.0 | 0.26.0 | 0.13.0 | 2.5.123 | - | - |
| 2.4.0 | 3.4.0 | 0.34.0 | 0.25.0 | 0.12.0 | 2.5.112 | - | - |
| 2.3.0 | 3.3.1 | 0.32.0 | 0.22.3 | 0.11.0 | 2.5.103 | - | - |
| 2.2.2 | 3.2.3 | 0.29.0 | 0.21.5 | 0.10.0 | 2.5.103 | - | - |
| 2.2.1 | 3.2.3 | 0.29.0 | 0.21.5 | 0.10.0 | 2.5.103 | - | - |
| 2.2.0 | 3.2.3 | 0.29.0 | 0.21.5 | 0.10.0 | 2.5.89 | - | - |
| 2.1.0 | 3.1.0 | 0.28.0 | 0.21.4 | 0.10.0 | 2.5.82 | - | - |
| 2.0.1 | 3.0.0 | 0.26.0 | 0.20.3 | 0.9.0 | 2.5.73 | - | - |
| 2.0.0 | 3.0.0 | 0.26.0 | 0.20.3 | 0.9.0 | 2.5.73 | - | - |
| 1.8.4 | 2.8.0 | 0.24.0 | 0.20.1 | 0.8.1 | 2.5.59 | - | - |
| 1.8.0 | 2.8.0 | 0.24.0 | 0.20.1 | 0.8.1 | 2.5.59 | - | - |
| 1.7.0 | 2.7.0 | 0.22.1 | 0.19.0 | 0.7.1 | 2.5.37 | - | - |
| 1.6.7 | 2.6.3 | 0.20.1 | 0.19.0 | 0.6.1 | 2.5.11 | - | - |
| 1.6.6 | 2.6.3 | 0.20.1 | 0.19.0 | 0.6.1 | 2.5.11 | - | - |
| 1.6.5 | 2.6.2 | 0.20.1 | 0.19.0 | 0.6.1 | 2.5.11 | - | - |
| 1.6.4 | 2.6.2 | 0.20.1 | 0.19.0 | 0.6.1 | 2.5.11 | - | - |
| 1.6.0 | 2.6.0 | 0.20.0 | 0.19.0 | 0.6.1 | 2.5.11 | - | - |
| 1.5.0 | 2.5.0 | 0.18.0 | 0.16.0 | 0.5.0 | - | - | - |
| 1.4.1 | 2.4.0 | 0.17.0 | 0.15.2 | 0.3.0 | - | - | - |
| 1.4.0 | 2.4.0 | 0.17.0 | 0.15.2 | 0.3.0 | - | - | - |
| 1.3.0 | 2.3.0 | 0.14.0 | 0.14.0 | 0.1.0 | - | - | - |
| 1.2.0 | 2.2.1 | 0.12.1 | 0.12.2 | - | - | - | - |
| 1.1.1 | 2.1.1 | 0.11.4 | - | - | - | - | - |
| 1.1.0 | 2.1.1 | 0.11.1 | - | - | - | - | - |
| 1.0 | 2.0.0 | 0.8.1 | - | - | - | - | - |
Chapter 11. Supported integration with Red Hat products
Streams for Apache Kafka 3.0 supports integration with the Red Hat build of Keycloak, which provides OAuth 2.0 authentication and OAuth 2.0 authorization.
For information on the functionality Red Hat build of Keycloak can introduce to your Streams for Apache Kafka deployment, refer to the product documentation.
11.1. Red Hat build of Keycloak
Streams for Apache Kafka supports OAuth 2.0 token-based authorization through Red Hat build of Keycloak Authorization Services, providing centralized management of security policies and permissions.
Revised on 2026-02-04 16:25:29 UTC
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}