Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: StrimziClear ×

Strimzi1.2.0Networking & MessagingAug 20, 2026

ACTION 2CHECK 3OTHER 7View full analysis

This release removes legacy CRD API versions and resource state metrics, and changes defaults for token mounting, feature gates, and container security contexts. It also adds Kafka and configuration capabilities and updates shipped dependencies.

Action needed (2)

breakingService Account token mounting
Service Account tokens are no longer auto-mounted into Pods. They are mounted through a volume instead.
breakingThe ServerSideApplyPhase1 feature gate, permanently enabled
The ServerSideApplyPhase1 feature gate has moved to GA and is permanently enabled. It can no longer be disabled.

Check if affected (3)

breakingLegacy CRD API versions, no longer supported
Applies before upgrading to Strimzi 1.0.0 or later if you use the v1beta2, v1beta1, or v1alpha1 APIs.
Strimzi 1.0.0 and later support only the v1 CRD API. The older v1beta2, v1beta1, and v1alpha1 APIs are no longer supported.
breakingResource state metrics, removed
Applicability is not stated in the release notes.
Deprecated resource state metrics have been removed. The kube-state-metrics project should be used instead.
breakingDefault securityContext for operator installations
Applies if you use the Cluster, Topic, and User Operator YAML installation files or the Cluster Operator Helm Chart.
The Cluster, Topic, and User Operator YAML installation files and the Cluster Operator Helm Chart now use a default container security context that matches the Restricted Kubernetes Pod Security Standard. The default can be overridden with the securityContext property in the YAML installation files or Cluster Operator Helm Chart values.

Source ↗

Strimzi1.1.0Networking & MessagingJun 27, 2026

CHECK 3OTHER 21View full analysis

This release adds operator-facing configuration and feature capabilities while updating supported Apache Kafka versions and related integrations. It also changes TLS file handling for KafkaBridge and KafkaMirrorMaker2 and renames entity-operator healthcheck ports, so those areas may require attention.

Check if affected (3)

breakingSupport for Kafka 4.1.x removed
Applies if you use Kafka 4.1.x.
Support for Kafka 4.1.x is removed in this release.
breakingPEM-based TLS files for KafkaBridge and KafkaMirrorMaker2
Applies if you use KafkaBridge or KafkaMirrorMaker2 with TLS authentication or a TLS truststore.
KafkaBridge and KafkaMirrorMaker2 now use PEM files instead of P12/JKS for TLS authentication and TLS truststores.
breakingEntity-operator healthcheck port names
Applies if you use entity-operator healthcheck ports.
The entity-operator healthcheck port names change from healthcheck to healthcheck-to for the topic operator and healthcheck-uo for the user operator.

Source ↗

Strimzi1.0.1Networking & MessagingJun 17, 2026

ACTION 2CHECK 2View full analysis

A release focused on CRD compatibility and Entity Operator watching defaults, with fixes for disclosed security vulnerabilities. It affects deployments using older CRD APIs or configuring cross-namespace watching.

Action needed (2)

securityhighFix for CVE-2026-55225
The release fixes CVE-2026-55225, also identified as GHSA-mw9r-p8xp-wx96.
securitymediumFix for CVE-2026-55226
The release fixes CVE-2026-55226, also identified as GHSA-r427-j2h7-wv3m.

Check if affected (2)

breakingSupported CRD API versions narrowed
Applies if you use the v1beta2, v1beta1, or v1alpha1 CRD APIs.
Only the new v1 CRD API is supported. The older v1beta2, v1beta1, and v1alpha1 APIs are no longer supported.
breakingEntity Operator cross-namespace watching default
Applies if you configure STRIMZI_ENTITY_OPERATOR_WATCHED_NAMESPACE_ENABLED or watchedNamespace.
Entity Operator cross-namespace watching is controlled by the STRIMZI_ENTITY_OPERATOR_WATCHED_NAMESPACE_ENABLED environment variable in the Cluster Operator. The feature is disabled by default.

Source ↗

Strimzi1.0.0Networking & MessagingApr 28, 2026

ACTION 2CHECK 4OTHER 12View full analysis

A release that removes older CRD API versions, changes defaults and configuration locations, and adds Kafka and HTTP Bridge capabilities. Monitoring configurations and standalone Topic Operator setups may require updates.

Action needed (2)

breakingThe UseConnectBuildWithBuildah feature gate, enabled by default
The UseConnectBuildWithBuildah feature gate moves to the beta stage and is enabled by default.
breakingThe /metrics endpoint, moved to the HTTP management interface
The /metrics endpoint is no longer available on the regular HTTP interface, which uses port 8080 by default. It is now available on the HTTP management interface on port 8081.

Check if affected (4)

breakingOlder CRD API versions, removed
Applies if you use the v1beta2, v1beta1, or v1alpha1 CRD APIs.
Strimzi 1.0.0 supports only the new v1 CRD API. The older v1beta2, v1beta1, and v1alpha1 APIs are no longer supported.
breakingThe Open Policy Agent (OPA) authorizer plugin, no longer bundled
Applies if you use the Open Policy Agent (OPA) authorizer plugin.
The Open Policy Agent (OPA) authorizer plugin is no longer bundled in Strimzi container images. It can be added as a custom plugin by building a custom Kafka container image or using additional volumes.
breakingLegacy TLS environment variables, ignored
Applies if you set any of STRIMZI_TLS_ENABLED, STRIMZI_TLS_AUTH_ENABLED, STRIMZI_PUBLIC_CA, STRIMZI_TRUSTSTORE_LOCATION, STRIMZI_TRUSTSTORE_PASSWORD, STRIMZI_KEYSTORE_LOCATION, or STRIMZI_KEYSTORE_PASSWORD.
The environment variables STRIMZI_TLS_ENABLED, STRIMZI_TLS_AUTH_ENABLED, STRIMZI_PUBLIC_CA, STRIMZI_TRUSTSTORE_LOCATION, STRIMZI_TRUSTSTORE_PASSWORD, STRIMZI_KEYSTORE_LOCATION, and STRIMZI_KEYSTORE_PASSWORD are no longer used and are ignored if set.
+ 1 more on the release page

Source ↗

Strimzi0.45.2Networking & MessagingMar 12, 2026

ACTION 8CHECK 1PLAN 3OTHER 5View full analysis

A maintenance release that narrows Kubernetes support to version 1.25 and newer and marks several older Kafka and extension components for removal. It adds Kafka 3.9.2 support and includes dependency updates addressing multiple CVEs and a GHSA advisory.

Action needed (8)

securityhighGRPC Netty Shaded update for CVE-2025-55163
GRPC Netty Shaded was upgraded to remediate CVE-2025-55163.
securitymediumZookeeper update for CVE-2024-47554
The Zookeeper dependency was upgraded to remediate CVE-2024-47554.
securitymediumNimbus Jose JWT 10.0.2 update for CVE-2025-53864
Nimbus Jose JWT was upgraded to version 10.0.2 to remediate CVE-2025-53864.
securitymediumNetty 4.1.130.Final update for CVE-2025-67735
Netty was updated to version 4.1.130.Final to resolve CVE-2025-67735.
securitymediumApache Log4J 2.25.3 update for CVE-2025-68161
Apache Log4J was updated to version 2.25.3 to remediate CVE-2025-68161.
securitymediumVertx 4.5.24 update for CVE-2026-1002
Vertx was updated to version 4.5.24 to remediate CVE-2026-1002.
securitymediumJackson update for GHSA-72hv-8253-57qq
Jackson was updated to address GHSA-72hv-8253-57qq.
securityVert.x and Netty dependency updates
The Vert.x and Netty dependencies were bumped on the 0.45.x branch to fix CVEs.

Check if affected (1)

breakingKubernetes support narrowed to 1.25 and newer
Applies if you use Kubernetes 1.23 or Kubernetes 1.24.
Strimzi 0.45 supports only Kubernetes 1.25 and newer. Kubernetes 1.23 and Kubernetes 1.24 are no longer supported.

Plan ahead (3)

breakingStrimzi MirrorMaker 2 Extensions deprecationdeprecated since 0.28.0 · removal planned in 0.46
Applies if you use the Strimzi MirrorMaker 2 Extensions.
The Strimzi MirrorMaker 2 Extensions were deprecated in Strimzi 0.28.0.
breakingStrimzi EnvVar Configuration Provider inclusiondeprecated since 0.38.0 · removal planned in 0.46
Applies if you use the Strimzi EnvVar Configuration Provider.
Strimzi 0.45 is the last version to include the Strimzi EnvVar Configuration Provider, which was deprecated in Strimzi 0.38.0. The provider is removed in Strimzi 0.46.
deprecatedZooKeeper-based Kafka and MirrorMaker 1 supportremoval planned in 0.46
Applies if you use ZooKeeper-based Apache Kafka clusters or MirrorMaker 1 deployments.
Strimzi 0.45 is the last minor version with support for ZooKeeper-based Apache Kafka clusters and MirrorMaker 1 deployments. This support is removed in Strimzi 0.46.

Source ↗

Strimzi0.51.0Networking & MessagingMar 6, 2026

ACTION 2CHECK 2PLAN 1OTHER 2View full analysis

A release with fixes for two disclosed security vulnerabilities, updated Kubernetes and Kafka support, and a changed feature-gate default. It also adds Kafka 4.2.0 support and per-listener Kafka options, while the ingress listener type is deprecated; CRD upgrades and a KafkaUser field migration are upgrade prerequisites.

Action needed (2)

securityhighCVE-2026-27133 and CVE-2026-27134 security fixes
Security fixes in Strimzi 0.50.1 and 0.51.0 address CVE-2026-27133 and CVE-2026-27134, with advisories GHSA-2qwx-rq6j-8r6j and GHSA-6x85-j2f7-4xc5.
breakingThe ServerSideApplyPhase1 feature gate default
The ServerSideApplyPhase1 feature gate moved to beta and is enabled by default.

Check if affected (2)

breakingKubernetes version support
Applies if you use Kubernetes 1.27, 1.28, or 1.29.
Support is limited to Kubernetes 1.30 and newer. Kubernetes 1.27, 1.28, and 1.29 are no longer supported.
breakingKafka 4.0.0 and 4.0.1 support
Applies if you use Kafka 4.0.0 or 4.0.1.
Support for Kafka 4.0.0 and 4.0.1 is removed.

Plan ahead (1)

deprecatedThe ingress listener type deprecation
Applies if you configure the ingress listener type.
The ingress listener type is deprecated because the Ingress NGINX Controller for Kubernetes was archived.

Source ↗

Strimzi0.50.0Networking & MessagingJan 18, 2026

CHECK 1OTHER 1View full analysis

Strimzi 0.50.0 includes Java 21 adoption for the operators, with compatibility exceptions for several modules. It also changes connector plugin version configuration, so existing settings that use the rejected option are affected.

Check if affected (1)

breakingThe connector.plugin.version option, forbidden in connector configurations
Applies if you use connector.plugin.version in KafkaConnect or KafkaMirrorMaker2 connector configuration.
Strimzi 0.50.0 forbids connector.plugin.version in the KafkaConnect CR at .spec.config and in the KafkaMirrorMaker2 CR at .spec.mirrors[].sourceConnector.config and .spec.mirrors[].checkpointConnector.config. Use the dedicated version field instead.

Source ↗

Browse by month