Strimzi Kafka Operator

Messaging & Workflow

Apache Kafka running on Kubernetes

strimzi/strimzi-kafka-operator Website Documentation

1.2.0Aug 20, 202654 days after 1.1.0

View on GitHub

Part of Databases

Barmanrelease/3.20.0
Barman Cloud Pluginv0.15.0
CloudNativePGv1.30.1
Percona Backup for MongoDBv2.16.0
pg_cronv1.6.8
pg_duckdbv1.1.1
pgaudit18.0
pgBackRestrelease/2.59.1
PgDogv0.1.60
pgmoneta0.21.0
Scylla Operatorv1.22.0
Valkey Operatorv0.7.0
WAL-Gv3.0.9

1.2.0

Aug 20, 2026Compare GitHub

⚠️ ⚠️ ⚠️ Important: From Strimzi 1.0.0, the only supported version of CRD API is v1. The older v1beta2, v1beta1, and v1alpha1 APIs are no longer supported. Before upgrading to Strimzi 1.0.0 and above, make sure to convert all custom resources and upgrade the CRDs.

Main Changes Since 1.1.0

The most important new features are:

Apache Kafka 4.3.1 support
Templated (per-pod) additional volumes
Stop auto-mounting Service Account tokens into Pods and mount them through a volume instead
ServerSideApplyPhase1 feature gate moves to GA stage and is permanently enabled
Configuring Maven mirrors for Kafka Connect Build
Connectors that request the stopped or paused state via .spec.state are now created directly in that state instead of being started first and then stopped or paused.
Support for broker cordoning during auto-rebalancing on scale down for Kafka 4.3+
And many more ...

There are also some important changes to the installation files:

The Cluster, Topic, and User Operator YAML installation files and the Cluster Operator Helm Chart now use the default container security context that matches the Restricted Kubernetes Pod Security Standard. If needed, you can override the default security context by updating the securityContext property in the YAML installation files or use the securityContext property in the Cluster Operator Helm Chart values.

All changes can be found under the 1.2.0 milestone or in the CHANGELOG.md.

Upgrading from Strimzi 1.1.0

See the documentation for upgrade instructions.

Maven Artifacts

To test the Maven artifacts that are part of this release, use the 1.2.0 version in your pom.xml.

Container Images

The following container images are part of this release:

Name	Image
Operators	`quay.io/strimzi/operator@sha256:77f8fa8121a67561c3418de985783d197f51b8931e9a47f793dc0437dc6bb21f`
Apache Kafka 4.2.0	`quay.io/strimzi/kafka@sha256:57a8fc7f50d37a62c7dc1afbf8300bb7b18b74c6979dd42992e9b8bf93b21d66`
Apache Kafka 4.2.1	`quay.io/strimzi/kafka@sha256:47ea0bd5cd416a92cbcfa248ae4b4b01a1e5d6b87aeafa67a691abdc29e20d0d`
Apache Kafka 4.3.0	`quay.io/strimzi/kafka@sha256:fef34b5438e8556cc08c01f3e254e47346f061b53a4e38d4289853777e0ea7f1`
Apache Kafka 4.3.1	`quay.io/strimzi/kafka@sha256:e90a1a74af4226f3ca4d1ebef3ab13bdb09754ae17ca4c1444f7fcbb0ca8ea9a`
Strimzi Bridge	`quay.io/strimzi/kafka-bridge@sha256:3a03af635b3ba64505527864bd0f6ad7b5118637491d8a5b32be78e11733e65a`
Kaniko Executor	`quay.io/strimzi/kaniko-executor@sha256:ca8838eb04f394cd3ae6268d70dd9bc7852c5c603aa30ae6aff407c2c5a29639`
Maven Builder	`quay.io/strimzi/maven-builder@sha256:dc6becc287c4adc887ff404502595a635e1087c5e444803dec33a3a1dcc8cd8f`
Buildah Builder	`quay.io/strimzi/buildah@sha256:3ac4d8fde6eca2ad837dc5258390f5ea704949b0539c77a394eb33a63c806b97`

New Contributors

@BK202503 made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12885
@acgtun made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12895
@anxkhn made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12903
@bboyleonp666 made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12788
@gggeon96 made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12796
@rd-patrick-wegner made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12927
@ShashwatSinha03 made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12920
@marcus-chae made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12948
@DavidMachacek made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12928
@Mopsgeschwindigkeit made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12973
@KasparMetsa made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12974
@gferreir made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12999
@mariusandrian made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/13027

1.1.0

Jun 27, 2026Compare GitHub

Main changes since 1.0

This release contains the following new features and improvements:

Allow failed KafkaConnectors to be stopped and reject pausing of failed connectors since this operation is not supported by Kafka Connect
Add support for Apache Kafka 4.3.0 and 4.2.1
Remove support for Kafka 4.1.x
Reconcile Cruise Control before Entity Operator when both are enabled.
New Cluster operator configuration option STRIMZI_PKCS12_KEYSTORE_GENERATION to disable generating PKCS12 stores in CA and Kafka user Secret resources.
Support for Gateway API-based type: tlsroute listener
Support for dependency scope configuration of Maven artifacts in Kafka Connect Build
Support for configuring per-broker listener annotation and label templates.
Improved support for custom Apache Kafka versions
Add UseBackgroundPodDeletion feature gate (alpha, disabled by default) to use background deletion propagation when deleting pods during rolling updates.
Strimzi Drain Cleaner updated to 1.6.0 (included in the Strimzi installation files)
Strimzi Access Operator updated to 0.3.0 - included in Strimzi installation files, examples, and documentation
KafkaBridge and KafkaMirrorMaker2 now use PEM files instead of P12/JKS for TLS authentication and TLS truststore. PEM files are accessed directly from secrets using KubernetesSecretConfigProvider.
It's now possible to configure mTLS validityDays and renewalDays for each KafkaUser

All changes can be found under the 1.1.0 milestone or in the CHANGELOG.md.

Upgrading from Strimzi 0.51.0

See the documentation for upgrade instructions.

Container images

The following container images are part of this release:

Name	Image
Operators	`quay.io/strimzi/operator@sha256:0b18356206d5b98888bb1bca6acd389bbb302ecdcb5f7ea697ddfefbe1a653e6`
Apache Kafka 4.2.0	`quay.io/strimzi/kafka@sha256:79d91d6a9dc9dc08ea1e75cb8b5cf1a73069a1db265b67335f444b4043f72f5b`
Apache Kafka 4.2.1	`quay.io/strimzi/kafka@sha256:4cdf885bba8b67a637f8565058a8a26ed7115e1c7bdf76d6f32df3cd1aa38503`
Apache Kafka 4.3.0	`quay.io/strimzi/kafka@sha256:b6848a53c01eec98b37866450a1227c3a41707785ec65b37063d2733a105bf36`
Strimzi Bridge	`quay.io/strimzi/kafka-bridge@sha256:dcec1c978f4174c101b78fd290a698fad89f83439c9a868bbbd9c9750b146fdf`
Kaniko executor	`quay.io/strimzi/kaniko-executor@sha256:ca8838eb04f394cd3ae6268d70dd9bc7852c5c603aa30ae6aff407c2c5a29639`
Maven Builder	`quay.io/strimzi/maven-builder@sha256:4662f4f9714e24dd24c139e795f90e9cc4bbe454f244d3b73d9234857971fd16`
Buildah builder	`quay.io/strimzi/buildah@sha256:3ac4d8fde6eca2ad837dc5258390f5ea704949b0539c77a394eb33a63c806b97`

New Contributors

@neeraj-laad made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12652
@TheoBrigitte made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12691
@pkotak made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12743
@gilvansfilho made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12746
@gaganhr94 made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12656
@officialasishkumar made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12732
@afausti made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12783
@aveek22 made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12791
@won-seoop made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12776
@mahitha-ada made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12824
@chon3806 made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12675

1.0.1

Jun 17, 2026Compare GitHub

⚠️ ⚠️ ⚠️ Important: Strimzi 1.0.1 supports only the new v1 CRD API. The older v1beta2, v1beta1, and v1alpha1 APIs are no longer supported. Before upgrading to Strimzi 1.0.1, make sure to convert all custom resources and upgrade the CRDs.

Main changes since 1.0.0

Entity Operator cross-namespace watching is now controlled by the STRIMZI_ENTITY_OPERATOR_WATCHED_NAMESPACE_ENABLED environment variable in the Cluster Operator. This feature is now disabled by default. If you have watchedNamespace configured in your Kafka CR's Entity Operator sections and it differs from the cluster namespace, you must set STRIMZI_ENTITY_OPERATOR_WATCHED_NAMESPACE_ENABLED=true in the Cluster Operator deployment:
```
env:
  - name: STRIMZI_ENTITY_OPERATOR_WATCHED_NAMESPACE_ENABLED
    value: "true"
```
Fixes CVE-2026-55225
Fixes CVE-2026-55226

Upgrading from Strimzi 0.51.0

See the documentation for upgrade instructions. Make sure to follow the CRD upgrade instructions!

Container images

The following container images are part of this release:

Name	Image
Operators	`quay.io/strimzi/operator@sha256:9c32dfe22d8602f43e8d8780706fbf65f023bcde3cef272688f35d1eead2640f`
Apache Kafka 4.1.0	`quay.io/strimzi/kafka@sha256:b7da827ad38b199877387893a6cdf381d4eddae92854141eefe4a7a3b31c3b8f`
Apache Kafka 4.1.1	`quay.io/strimzi/kafka@sha256:1c4811ff5ac8368a44327e24431775602fe9e008c20a45814858776c348658c8`
Apache Kafka 4.1.2	`quay.io/strimzi/kafka@sha256:39bce6f044fe43c62b1355b4e855866899685f316db15cd25a27f7f37fffa99f`
Apache Kafka 4.2.0	`quay.io/strimzi/kafka@sha256:8cbd25d7bb132cc64fde7ac8460a5e4198fc67deadfd1bef5430866a7befbe47`
Strimzi Bridge	`quay.io/strimzi/kafka-bridge@sha256:dcec1c978f4174c101b78fd290a698fad89f83439c9a868bbbd9c9750b146fdf`
Kaniko executor	`quay.io/strimzi/kaniko-executor@sha256:ca8838eb04f394cd3ae6268d70dd9bc7852c5c603aa30ae6aff407c2c5a29639`
Maven Builder	`quay.io/strimzi/maven-builder@sha256:101291b64945417a01d152d12803bc8b42a4d8c9b4735b61957c4c99e4ae9f35`
Buildah builder	`quay.io/strimzi/buildah@sha256:3ac4d8fde6eca2ad837dc5258390f5ea704949b0539c77a394eb33a63c806b97`

1.0.0

Apr 28, 2026Compare GitHub

⚠️ ⚠️ ⚠️ Important: Strimzi 1.0.0 supports only the new v1 CRD API. The older v1beta2, v1beta1, and v1alpha1 APIs are no longer supported. Before upgrading to Strimzi 1.0.0, make sure to convert all custom resources and upgrade the CRDs.

Main changes since 0.51

This release contains the following new features and improvements:

Remove support for the v1beta2 API (and v1alpha1 and v1beta2 for KafkaTopic and KafkaUser) and fully move to the v1 API
Add support for Kafka 4.1.2
Add support for advertisedPortTemplate in listener configuration to add more flexibility when configuring advertised ports.
Support for type: environment-variable rack awareness based on environment variables that do not require ClusterRoleBindings
Add support for TLS/SSL on the HTTP Bridge
Add support for force-renewal of KafkaUser certificates via strimzi.io/force-renew annotation
The UseConnectBuildWithBuildah feature gate moves to the beta stage and is enabled by default
And many more ...

All changes can be found under the 1.0.0 milestone or in the CHANGELOG.md.

Upgrading from Strimzi 0.51.0

See the documentation for upgrade instructions. Make sure to follow the CRD upgrade instructions!

Container images

The following container images are part of this release:

Name	Image
Operators	`quay.io/strimzi/operator@sha256:fe09836e37ed891a5931292701ec7c81ccb3b0b26599f7d2326ea4af891247aa`
Apache Kafka 4.1.0	`quay.io/strimzi/kafka@sha256:70a7368438d1c5e0d5272848d588c812c53e3b853c68424c017b548039c23596`
Apache Kafka 4.1.1	`quay.io/strimzi/kafka@sha256:d48bbc220e28246c76342f6b77f9be53b07ac4909240ebfa4a6139d61a951bd4`
Apache Kafka 4.1.2	`quay.io/strimzi/kafka@sha256:6a52c514833a91ac08ee6cf10609b60961580170661caadec0a6992a7208c2a2`
Apache Kafka 4.2.0	`quay.io/strimzi/kafka@sha256:87c6b1c1081bfc25f88a0490d580f5696f5e419482d686df612cdfdf04711059`
Strimzi Bridge	`quay.io/strimzi/kafka-bridge@sha256:dcec1c978f4174c101b78fd290a698fad89f83439c9a868bbbd9c9750b146fdf`
Kaniko executor	`quay.io/strimzi/kaniko-executor@sha256:ca8838eb04f394cd3ae6268d70dd9bc7852c5c603aa30ae6aff407c2c5a29639`
Maven Builder	`quay.io/strimzi/maven-builder@sha256:326a67a6d60820e04757e40d3c9651046108e06aff2346256b772982d86d4b0e`
Buildah builder	`quay.io/strimzi/buildah@sha256:3ac4d8fde6eca2ad837dc5258390f5ea704949b0539c77a394eb33a63c806b97`

New Contributors

@marvin-roesch made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12477
@Paramesh324 made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12509
@marcelojscosta made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12527
@QuentinBisson made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12560
@guancioul made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12631
@mamccorm made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12506

0.45.2

Mar 12, 2026Compare GitHub

⚠️ Important: Strimzi 0.45 supports only Kubernetes 1.25 and newer. Kubernetes 1.23 and 1.24 are not supported anymore.

⚠️ Important: Strimzi 0.45.2 is the last patch release from the 0.45.x release branch, there will be no other patch release after this one.

⚠️ Important: For upgrades to Strimzi 0.46 and above, pay attention to the Upgrade to Strimzi 0.46-0.51 section of this release page.

[!NOTE] This release was tested on Kubernetes 1.25.0, 1.35.0, and 1.35.2.

Main changes since 0.45.1

This release contains the following new features and improvements:

Dependency updates and CVE fixes
Add support for Kafka 3.9.2

All changes can be found under the 0.45.2 milestone.

Watch out also for some notable changes, deprecations, and removals:

Strimzi 0.45 is the last minor Strimzi version with support for ZooKeeper-based Apache Kafka clusters and MirrorMaker 1 deployments. Please make sure to migrate to KRaft and MirrorMaker 2 before upgrading to Strimzi 0.46 or newer.
Strimzi 0.45 is the last Strimzi version to include the Strimzi EnvVar Configuration Provider (deprecated in Strimzi 0.38.0) and Strimzi MirrorMaker 2 Extensions (deprecated in Strimzi 0.28.0). Please use the Apache Kafka EnvVarConfigProvider and Identity Replication Policy instead.

Upgrade to Strimzi 0.46-0.51

Upgrade to Strimzi 0.46-0.51 is possible, however, if you are currently using Kafka 3.9.2, the operator will fail after the upgrade with an error similar to this:

2026-03-07 17:16:15 WARN  AbstractOperator:567 - Reconciliation #15(watch) Kafka(myproject/my-cluster): Failed to reconcile
io.strimzi.operator.cluster.model.KafkaUpgradeException: Unsupported Kafka.spec.kafka.version: 3.9.2. Supported versions are: [4.1.1, 4.2.0, 4.0.0, 4.0.1, 4.1.0, 3.0.0, 3.2.3, 3.3.2, 3.4.1, 3.5.0, 3.5.1, 3.6.0, 3.5.2, 3.6.1, 3.7.0, 3.6.2, 3.7.1, 3.8.0, 3.0.1, 3.1.0, 3.1.1, 3.2.0, 3.1.2, 3.2.1, 3.3.1, 3.4.0, 2.1.0, 3.8.1, 3.9.0, 3.9.1, 2.6.2, 2.7.1, 2.8.0, 2.8.1, 2.5.1, 2.6.0, 2.6.1, 2.7.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.1.1, 2.2.0, 2.2.1, 2.3.0]
        at io.strimzi.operator.cluster.model.KafkaVersion$Lookup.version(KafkaVersion.java:148)
        at io.strimzi.operator.cluster.operator.assembly.KRaftVersionChangeCreator.detectToAndFromVersions(KRaftVersionChangeCreator.java:157)
        at io.vertx.core.impl.future.Composition.complete(Composition.java:40)
        at io.vertx.core.impl.future.FutureBase.lambda$emitResult$0(FutureBase.java:59)
        at io.netty.util.concurrent.AbstractEventExecutor.runTask(AbstractEventExecutor.java:148)
        at io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:141)
        at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:535)
        at io.netty.channel.SingleThreadIoEventLoop.run(SingleThreadIoEventLoop.java:201)
        at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:1195)
        at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
        at java.base/java.lang.Thread.run(Thread.java:1583)

When that happens, use the following command to update the Kafka version annotation on the Kafka Pods:

kubectl annotate pod -l strimzi.io/kind=Kafka,strimzi.io/component-type=kafka,strimzi.io/cluster=CLUSTER_NAME strimzi.io/kafka-version=3.9.1 --overwrite -n NAMESPACE_NAME

Where CLUSTER_NAME is the name of your cluster and NAMESPACE_NAME is its namespace.

Once you change the annotation, the upgrade will proceed.

[!IMPORTANT] Upgrading directly to Strimzi 1.0.0 or newer will not be supported.

Upgrading from Strimzi 0.45.1

See the documentation for upgrade instructions.

Upgrading from Strimzi 0.22 or earlier

Direct upgrade from Strimzi 0.22 or earlier is not supported anymore! You have to upgrade first to one of the previous versions of Strimzi. You will also need to convert the CRD resources. For more details, see the documentation.

Container images

The following container images are part of this release:

Name	Image
Operators	`quay.io/strimzi/operator@sha256:fbf54c39a3b066be84639dc88a3c14d2d90ff30618578a16080fe16375d7c641`
Apache Kafka 3.8.0	`quay.io/strimzi/kafka@sha256:24f83460f4a904a0511c81e981ba27d72229cef985b222e983dd7eb7a2f49d0f`
Apache Kafka 3.8.1	`quay.io/strimzi/kafka@sha256:4f52fd8232e61385f928539f6e2aa2d23c9ba9ce18390ee735f55f9ae110ecdc`
Apache Kafka 3.9.0	`quay.io/strimzi/kafka@sha256:50d6b41639435813d6e5458d100c619c91d8345f7868f7cd86330d2a0817922b`
Apache Kafka 3.9.1	`quay.io/strimzi/kafka@sha256:7d25fde4ae8c5f0611a03a1c150a7d9d2e81d287a96e2cac8e93bb657c599cb6`
Apache Kafka 3.9.2	`quay.io/strimzi/kafka@sha256:5d96fe7c68db643f4916146176a7587aaf9f91c32fa9da7300f013e3e79298d8`
Strimzi Bridge	`quay.io/strimzi/kafka-bridge@sha256:c462441a966f0732855e684b4840563bfad45391345c9511fa49e1630ba9c3e3`
Kaniko executor	`quay.io/strimzi/kaniko-executor@sha256:ef1a39c363e145041d80103c3c12da9429ce06cf21dff6fb1fb75d0c0ed9c35b`
Maven Builder	`quay.io/strimzi/maven-builder@sha256:a18ce42d8b882510ec848b3542b1a213707b3aa1ad160cdc95828c26a740725e`

New Contributors

@shub-est made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12237

What's Changed

[release-0.45.x][ST] Fix setup Minio and freeze Minio version by @im-konge in https://github.com/strimzi/strimzi-kafka-operator/pull/11587
[AZP] Add cleanup phase to UTs/ITs job for build - release-0.45.x branch by @im-konge in https://github.com/strimzi/strimzi-kafka-operator/pull/11896
Fix kuberntes-client exclusion by @fvaleri in https://github.com/strimzi/strimzi-kafka-operator/pull/11892
[release-0.45.x] Fix Postgres issue in STs and clean the cache by @im-konge in https://github.com/strimzi/strimzi-kafka-operator/pull/12045
Bumped Vert.x and Netty to fix CVEs on 0.45.x branch by @ppatierno in https://github.com/strimzi/strimzi-kafka-operator/pull/12060
Bumped Vertx 4.5.22 and Netty 4.1.128.Final on 0.45.x branch by @ppatierno in https://github.com/strimzi/strimzi-kafka-operator/pull/12064
Upgrade Zookeeper to remediate CVE-2024-47554 by @shub-est in https://github.com/strimzi/strimzi-kafka-operator/pull/12237
Upgraded Nimbus Jose JWT to 10.0.2 to remediate CVE-2025-53864 by @shub-est in https://github.com/strimzi/strimzi-kafka-operator/pull/12247
Upgraded GRPC Netty Shaded to remediate CVE-2025-55163 by @shub-est in https://github.com/strimzi/strimzi-kafka-operator/pull/12251
Upgraded Cruise Control to 2.5.146 by @shub-est in https://github.com/strimzi/strimzi-kafka-operator/pull/12255
Updated Netty to 4.1.130.Final to resolve CVE-2025-67735 by @shub-est in https://github.com/strimzi/strimzi-kafka-operator/pull/12286
Updated Apache Log4J to 2.25.3 to remediate CVE-2025-68161 by @shub-est in https://github.com/strimzi/strimzi-kafka-operator/pull/12288
Update Vertx to 4.5.24 to remediate CVE-2026-1002 by @shub-est in https://github.com/strimzi/strimzi-kafka-operator/pull/12367
Add support for Kafka 3.9.2 by @im-konge in https://github.com/strimzi/strimzi-kafka-operator/pull/12321
Update Kafka Exporter to 1.9.0 - release-0.45.x by @im-konge in https://github.com/strimzi/strimzi-kafka-operator/pull/12449
[release-0.45.x] Update CHANGELOG with information about CVE fixes and other information by @im-konge in https://github.com/strimzi/strimzi-kafka-operator/pull/12460
Update Jackson to address CVE GHSA-72hv-8253-57qq by @MichaelMorrisEst in https://github.com/strimzi/strimzi-kafka-operator/pull/12485

0.51.0

Mar 6, 2026GitHub

⚠️ ⚠️ ⚠️ SECURITY: Strimzi 0.50.1 and 0.51.0 addresses CVE-2026-27133 and CVE-2026-27134. If you use Strimzi 0.47.0 or newer, please read the advisories and if you are affected, please upgrade to 0.50.1 or 0.51.0.

⚠️ Important: Strimzi 0.51 supports only Kubernetes 1.30 and newer. Kubernetes 1.27, 1.28, and 1.29 are not supported anymore.

⚠️ Important: Strimzi 0.49 introduced new API version v1 to all Strimzi custom resources.

Make sure to Upgrade the CRDs as part of the Strimzi upgrade as well (especially when using Helm).
The old API versions (v1alpha1, v1beta1, and v1beta2) will continue to be supported until Strimzi 1.0.0 / 0.52.0.
Before upgrading to Strimzi 0.51.0 from Strimzi 0.48 or older, make sure that you update your KafkaUser resources to use the .spec.authorization.acls[]operations field instead of the deprecated .spec.authorization.acls[]operation.
For more details about the migration to the v1 API and CRD upgrades, see the documentation.

Main changes since 0.50

This release contains the following new features and improvements:

Add support for Kafka 4.2.0 and remove support for Kafka 4.0.0 and 4.0.1
Allow configuration of additional Kafka options on a per-listener basis (connections.max.reauth.ms, max.connections, max.connections.* and max.connection.creation.rate)
ServerSideApplyPhase1 feature gate moved to beta, and is now enabled by default

All changes can be found under the 0.51.0 milestone.

Major changes, deprecations, and removals

There are also many important changes, deprecations, and removals:

The ingress listener type is deprecated due to the archiving of the Ingress NGINX Controller for Kubernetes (March 2026). The code remains in the Strimzi codebase, but no further improvements or development are planned.

Upgrading from Strimzi 0.50.0

See the documentation for upgrade instructions.

Container images

The following container images are part of this release:

Name	Image
Operators	`quay.io/strimzi/operator@sha256:ef3e406aa09449dd0241d53cdc81e15e58bf59b51f2425fb64384a179d676b1d`
Apache Kafka 4.1.0	`quay.io/strimzi/kafka@sha256:28741c73503a63d74da3cdb482ec2b8b3a07e570ffdcad94bbcf568856c6ef4b`
Apache Kafka 4.1.1	`quay.io/strimzi/kafka@sha256:b8826823abe035973631c939a45f060203d5b73aefee6b20eea777fbf1a4a08f`
Apache Kafka 4.2.0	`quay.io/strimzi/kafka@sha256:bb6a6020c44b7fc7910ac79f76e87e42aef1e9423e2bc9372f73834c5e5c8b22`
Strimzi Bridge	`quay.io/strimzi/kafka-bridge@sha256:c871fc40e920a69ab4b44efa80068a77849803142b20f22cd6f787c85cba481a`
Kaniko executor	`quay.io/strimzi/kaniko-executor@sha256:ca8838eb04f394cd3ae6268d70dd9bc7852c5c603aa30ae6aff407c2c5a29639`
Maven Builder	`quay.io/strimzi/maven-builder@sha256:a3899df1b46bc5f34f204c059e9716568497cab1043d3f1ffb973e7204626a49`
Buildah builder	`quay.io/strimzi/buildah@sha256:3ac4d8fde6eca2ad837dc5258390f5ea704949b0539c77a394eb33a63c806b97`

New Contributors

@alephys26 made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12368
@Pinimo made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12366
@mastermaxx03 made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12385
@nbarrientos made their first contribution in https://github.com/strimzi/strimzi-kafka-operator/pull/12401

Strimzi

Run Apache Kafka on Kubernetes and OpenShift

OpenSSF Best Practices OpenSSF Scorecard Build Status GitHub release License Twitter Follow Artifact Hub FOSSA Status Known Vulnerabilities

Strimzi provides a way to run an Apache Kafka® cluster on Kubernetes or OpenShift in various deployment configurations. See our website for more details about the project.

Quick Starts

To get up and running quickly, check our Quick Start for Minikube, OKD (OpenShift Origin) and Kubernetes Kind.

Documentation

Documentation for the current main branch as well as all releases can be found on our website.

Roadmap

The roadmap of the Strimzi Operator project is maintained as GitHub Project.

Getting help

If you encounter any issues while using Strimzi, you can get help using:

Strimzi Community Meetings

You can join our regular community meetings:

Thursday 9:00 AM UTC (every 4 weeks) - convert to your timezone
Thursday 4:00 PM UTC (every 4 weeks, offset by 2 weeks from above meeting) - convert to your timezone

Resources:

Contributing

You can contribute by:

Raising issues you find while using Strimzi
Fixing issues by opening Pull Requests
Improving Strimzi documentation
Talking about Strimzi

All bugs, tasks or enhancements are tracked as GitHub issues. Issues which might be a good start for new contributors are marked with "good-start" label.

The development guide describes how to quickly get set up to build Strimzi from source. Before submitting a patch, make sure you understand how to test your changes by reading the Test guide. The release checklist describes the steps needed for a new version release. The documentation contributor guide describes how to contribute to Strimzi documentation.

Developer Certificate of Origin

The Developer Certificate of Origin (DCO) is a lightweight way for contributors to certify that they wrote or otherwise have the right to submit the code they are contributing to the project. All commits must be signed off by adding a Signed-off-by line to the commit message.

This is my commit message

Signed-off-by: John Doe <JohnDoe@somewhere.org>

Git has a -s option to append this automatically:

git commit -s -m 'This is my commit message'

If you have already made a commit and forgot to include the sign-off, you can amend your last commit:

git commit --amend -s

Getting help with your contributions

If you want to get in touch with us first before contributing, you can use:

License

Strimzi is licensed under the Apache License, Version 2.0

Community Testing

Linux on IBM Z (s390x)

Jenkins

Note: This badge represents a community-led initiative and is not officially endorsed by the Strimzi project maintainers.

Container signatures

From the 0.38.0 release, Strimzi containers are signed using the cosign tool. Strimzi uses keyless signing since 0.49.0 release. To verify the container, you can run the following command:

cosign verify --certificate-identity-regexp='https://github.com/strimzi/.*' \
    --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
    quay.io/strimzi/operator:latest

In case you want to verify containers of older version of Strimzi than 0.49.0, then use our public key:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAET3OleLR7h0JqatY2KkECXhA9ZAkC
TRnbE23Wb5AzJPnpevvQ1QUEQQ5h/I4GobB7/jkGfqYkt6Ct5WOU2cc6HQ==
-----END PUBLIC KEY-----

And use it to verify the signature:

cosign verify --key strimzi.pub quay.io/strimzi/operator:latest --insecure-ignore-tlog=true

Software Bill of Materials (SBOM)

From the 0.38.0 release, Strimzi publishes the software bill of materials (SBOM) of our containers. The SBOMs are published as an archive with SPDX-JSON and Syft-Table formats signed using cosign. For releases, they are also pushed into the container registry.

Strimzi uses keyless signing since 0.49.0 release. To verify the SBOM signatures, you can run the following command:

cosign verify-blob --bundle <SBOM-file>.bundle \
    --certificate-identity-regexp='https://github.com/strimzi/.*' \
    --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
    <SBOM-file>

In case you want to verify SBOM signatures of older version of Strimzi than 0.49.0, then use our public key:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAET3OleLR7h0JqatY2KkECXhA9ZAkC
TRnbE23Wb5AzJPnpevvQ1QUEQQ5h/I4GobB7/jkGfqYkt6Ct5WOU2cc6HQ==
-----END PUBLIC KEY-----

You can use it to verify the signature of the SBOM files with the following command:

cosign verify-blob --key cosign.pub --bundle <SBOM-file>.bundle --insecure-ignore-tlog=true <SBOM-file>

Strimzi is a <a href="http://cncf.io">Cloud Native Computing Foundation</a> incubating project.

CNCF ><

View the full README on GitHub

Part of Databases

Release history

1.2.0

1.1.0

1.0.1

1.0.0

0.45.2

0.51.0

README

Run Apache Kafka on Kubernetes and OpenShift

Quick Starts

Documentation

Roadmap

Getting help

Strimzi Community Meetings

Contributing

Developer Certificate of Origin

Getting help with your contributions

License

Community Testing

Linux on IBM Z (s390x)

Container signatures

Software Bill of Materials (SBOM)