Supported releases

• Conduktor Exchange:
  • Breaking changes - Partner Zone PENDING status
• Conduktor Scale:
  • SSO login
  • Enhanced login and onboarding experience
  • Added size information for Confluent Cloud topics
• Quality of life improvements
• Fixes

​

Breaking changes - Partner Zone PENDING status

• PENDING_CREATE on initial creation
• PENDING_UPDATE on subsequent updates

​

Conduktor Scale

​

SSO login

​

Enhanced login and onboarding experience

​

Topic size information for Confluent Cloud topics

​

Quality of life improvements v1.40.0

• Improved Insights dashboard user experience with enhanced usability and navigation.
• CSV export of Insights data now supports zip compression for easier file management.
• Labels filter dropdown now supports search functionality for easier label selection.
• Improved navigation in Topic Catalog with clickable links to the application, instance, and owner group.
• Added database.options and kafka_sql.database.options configuration to pass any valid JDBC or Hikari options, as an alternative to database.url and kafka_sql.database.url, respectively. Find out more about Console database properties.
• We have added the new metric console_license_remaining_days which can be used to monitor the remaining days on your console license.
  • Check out the metrics reference for a full list of available metrics.

​

Fixes v1.40.0

• The connector form didn’t update when switching connector type during creation. This has now been resolved.
• Duplicate operationId values in the OpenAPI specification prevented code generation with openapi-generator-cli. The specification has been corrected.
• The Group API returned an error when KsqlDB permission was added. This error has been resolved.
• After upgrading to 1.38, users with permissions on all clusters lost menu visibility of brokers and service accounts entries. This visibility issue has been resolved.
• Creating topics sometimes showed misleading error messages when redirecting before indexing completed. These messages are now accurate.
• Metrics didn’t display in large clusters due to timeout errors when fetching topic offsets. This timeout issue has been resolved.
• Database indexing failed after PostgreSQL restarts. Connection resilience has been improved with the new database.options configuration.
• Resolved migration issue that could affect customers using more than one subject naming strategy when upgrading from 1.38 to 1.39

• Breaking changes
  • Block admin operation APIs
  • Deprecating v1 APIs
  • The externalStorage option in encryption Interceptors is deprecated
• Fixes
• Quality of life improvements

​

Breaking changes v3.15.0

​

Block admin operation APIs

• Before upgrading, review your applications and scripts to identify any code using these APIs through Gateway.
• After upgrading:
  • Monitor your logs for errors related to: ALTER_REPLICA_LOG_DIRS, ELECT_LEADERS, ALTER_PARTITION_REASSIGNMENTS, LIST_PARTITION_REASSIGNMENTS, ALTER_PARTITION, ALLOCATE_PRODUCER_IDS, CREATE_DELEGATION_TOKEN, RENEW_DELEGATION_TOKEN, EXPIRE_DELEGATION_TOKEN, DESCRIBE_DELEGATION_TOKEN, DESCRIBE_USER_SCRAM_CREDENTIALS, ALTER_USER_SCRAM_CREDENTIALS, DESCRIBE_CLIENT_QUOTAS, ALTER_CLIENT_QUOTAS, UPDATE_FEATURES
  • Check Gateway error responses indicating blocked API calls

• Update your applications and workflows to perform admin operations with direct cluster access instead of through Gateway

​

Deprecating v1 APIs

​

The externalStorage option in encryption interceptors is deprecated

​

Fixes v3.15.0

• Fixed issue where multiple encryption interceptors could not be applied to the same topic, now allowing priority-based selection.
• Fixed NullPointerException during Gateway startup when interceptor version constraints specify only min or max values.
• Updated TopicRequiredSchemaIdPolicyPlugin to allow tombstone records (NULL values) in compacted topics, while still requiring schema IDs for non-null records.

​

Quality of life improvements v3.15.0

• When ACL is enabled in GATEWAY_MANAGED security mode, authorization failure will contain additional information in the message like these:

• Conduktor Scale:
  • Insights
  • Collection of product metrics
• Conduktor Exchange:
  • Partner Zone traffic analytics tab
• Conduktor Trust:
  • Data quality observability
• Fixes
• Known issues v1.39.0

​

Conduktor Scale

​

Insights

• proactively identify configuration issues,
• optimize storage costs,
• track governance metrics,
• monitor business-critical topics and more.

​

Collection of product metrics

​

Data quality observability

​

Conduktor Exchange

​

Partner Zone traffic analytics tab

​

Fixes v1.39.0

• Added support for SSL connections without authentication when configuring Kafka clusters
• Fixed http 500 error when forcing a consumer group rebalance
• Fixed an issue where application instance permissions were being created despite API request validation failures
• Fixed duplicate operation IDs in OpenAPI specification which caused errors when using OpenAPI code generation tooling
• Fixed error preventing the user from changing schema compatibility or deleting schemas with forward slashes in their names

​

Known issue v1.39.0

​

New feature v3.14.0

​

Fix v3.14.0

• Conduktor Scale:
  • Application instance access
  • Topic catalog access
  • Grant access to a topic
  • Remove or revoke access request
  • Confluent Cloud role binding support for Self-service
  • Migrate topic policies
  • Support for external monitoring solutions
• Conduktor Exchange:
  • Partner Zone enhancements
• Conduktor Trust:
  • Validate your Rule against sample messages
  • Custom data quality Rule violation messages
  • Edit attached Rules from the Policy details page
• Quality of life improvements
• Fixes

​

Conduktor Scale

​

Application instance access

• All topics this application instance has access to, with the ability to remove this access if you are a member of the owner group for the application.
• All topics this application instance has granted access to, with the ability to revoke this access if you are a member of the owner group for the application.

​

Topic catalog access

• You can remove access for your own applications.
• If you’re a member of the application owner group of this topic, you can revoke access for other applications.

​

Grant access to a topic

​

Remove or revoke access request

• Application owners: can revoke access using Revoke access in the request details drawer
• Access requesters: can remove their own access with Remove access in the request details drawer

​

Confluent Cloud role binding support for Self-service

​

Migrate topic policies

• If a topic policy is migrated and the new resource policy is then deleted, the topic policy can’t be migrated a second time.
• If a topic policy is migrated and then deleted, then a new topic policy is created with same name as the old one, but the ‘new’ policy can’t be migrated.
• If a topic policy is migrated and then updated, it can’t be migrated again.
• When you migrate topic policies, all the application instances referring to those policies will have both the newly migrated resource and the old topic policies. The topic policies will be removed automatically when this feature is deprecated in a future release.

​

Support for external monitoring solutions

​

Conduktor Exchange

​

Partner Zone enhancements

• Partner Zones now support specifying a custom Virtual Cluster name with vclusterName when using the API or CLI. This provides better control over naming conventions and simplifies migration from existing Virtual Clusters.
• You can now download CA certificates associated with a Partner Zone from the Console UI. This makes sharing certificates with your partners much easier. Find out how to download certificates.

​

Conduktor Trust

​

Validate your Rule against sample messages

​

Custom data quality Rule violation messages

​

Edit attached Rules from the Policy details page

​

Quality of life improvements v1.38.0

• Added an option to pin clusters - your frequently used ones can now be pinned to the top of the list
• Improved keyboard navigation for faster cluster switching and enhanced accessibility
• For admins, added the ability to easily jump to the configuration page for any cluster

​

Fixes v1.38.0

• Fixed an issue where closing the templates drawer in the topic consume view would prevent the user from interacting with the rest of the page.
• Fixed searching within groups to allow filtering on “contains” instead of “starts with” for improved search experience.
• Fixed SSO configuration to support configurable email claims for special identity types.
• Fixed connector creation modal to show validation warnings instead of blocking creation, allowing you to proceed with caution (matching CLI behavior).
• Fixed access control vulnerabilities preventing low-privileged users from accessing and modifying data masking policies.
• Fixed ‘Last active’ sorting in group members list to properly handle users who have never been active.
• Fixed SQL indexed topics page to stay on the correct tab when refreshing instead of redirecting to a different URL.
• Fixed duplicate topic subscription requests for already approved subscriptions in the Self-service catalog.
• Fixed record view to show header keys in their original casing instead of uppercase.
• Fixed topic template duplication functionality that was failing silently.
• Fixed cluster creation validation to prevent duplicate technical IDs with better user experience.
• Fixed data policies display layout to properly wrap field badges and prevent overlap.
• Fixed CEL expression evaluation in resource policies to handle missing spec.configs correctly.

• New features
  • Enhanced audit logging for authorization failures
  • Block unsupported APIs with Gateway
  • New encryption error policy
• Quality of life improvement
• Fixes

​

New features v3.13.0

​

Enhanced audit logging for authorization failures

• An audit log event is now generated for authorization failures (when ACL permissions deny an operation on a resource). Find out more about the authorization failure events.
• Improved error message verbosity with enableDetailedErrorLogging property in GCP KMS exception handling. Find out more about the GCP KMS configuration.

​

Block unsupported APIs with Gateway

​

New encryption error policy

​

Quality of life improvement v3.13.0

​

Fixes v3.13.0

• Fixed the principal resolver failure to resolve the Confluent Cloud service account from an API Key.
• Added round-robin Gateway endpoint allocation to prevent all traffic from being directed to the same Gateway node. Find out more about Gateway internal load balancing.
• Improved customer experience for Vault KMS configuration by removing a confusing version field. The encryption Interceptor uses Vault Transit engine which only supports version 1 (hardcoded), but the configuration incorrectly exposed it as configurable. This change removes the misleading field from configuration examples while maintaining backward compatibility.
• Fixed the error when connecting with super user and Virtual Cluster(s) is mandatory.
• Fixed Fetch Policy Interceptor isolation level configuration to accept lowercase values, matching Kafka standards.
• Fixed Confluent Cloud principal resolver to handle API keys for both service accounts and user accounts.
• Fixed Azure OAuth authentication method priority to respect explicit configuration over environment variables.
• Relaxed name validation in service-account v2 API to support dots, equals signs, and commas.

​

New feature

​

Support restriction of TLS protocols and cipher suites

​

Fixes v1.37.1

• Fixed an issue where resource policies were not applied when editing application groups from the UI.
• Fixed an issue where members from external groups were not synchronized if an application group without permissions existed.

• Breaking changes
  • Gateway 3.12 dependency
  • Email address storage
  • Prometheus configuration overrides
• Conduktor Scale:
  • Application groups management
  • Application Instance resources
  • Subject strategies support
  • External group management improvements
• Conduktor Exchange:
  • Partner Zone out of preview
  • Partner Zone multi-cluster support
  • Partner Zone breaking changes
• Conduktor Trust:
  • Regex library
  • Mark action
  • JSON schema rule type
• Quality of life improvements
• Fixes

​

Breaking changes v1.37.0

​

Gateway 3.12 dependency

​

Email address storage

​

Prometheus configuration overrides

​

Conduktor Scale

​

Application groups management

​

Application Instance resources

​

Subject strategies support

​

External group management improvements

​

Conduktor Exchange

​

Partner Zone out of preview

​

Partner Zone multi-cluster support

​

Partner Zone breaking changes

​

Conduktor Trust

​

Regex library

​

Mark action

​

JSON schema rule type

​

Quality of life improvements v1.37.0

​

Fixes v1.37.0

• Fixed production rate metrics getting stuck at high values when producer rates drop instantly to zero, which was causing artificially inflated metrics in systems with bursty production patterns.
• Errors preventing users from logging in are now prominently displayed on the login page.
• To prevent disclosure of password length in configuration forms, password fields are now consistently obfuscated regardless of the length of the actual password.
• Secrets in AWS Glue and other cluster configuration forms are no longer shown in clear text.
• Fixed error logs appearing when SQL features are not enabled, reducing unnecessary log noise.
• Fixed onboarding page checkbox labels not being clickable, improving user experience during account setup.
• Schema registry naming strategies now include namespace in generated subject names.
• Fixed issue where topic navigation tab was missing from main menu for certain user roles despite having proper permissions.
• Self-service configuration now correctly handles multiple Kafka Connect clusters connected to a single application instance.
• Duplicate users can no longer be created using the same email username but in different casing.
• In the metadata of the records, the schema names are no longer truncated.
• Add error messages on Connector failure, helping troubleshooting.
• Fixed topic policies not being visible in application instances after upgrading from version 1.35 to 1.36.
• Fixed a ‘404 group does not exist’ error incorrectly showing up when upgrading from version 1.35 to 1.36.
• Deleting the Kafka Connect cluster now deletes the associated permissions, solving the permission errors on user and group GET operations.
• Improved groups API performance, preventing timeouts for big organizations with thousands of users and groups.
• Improved indexer performance, preventing timeouts for big organizations with thousands of consumer groups.
• JVM metrics renamed in the Console and the Grafana dashboard, based on Prometheus changes.

• Breaking changes
  • New APIs for health and versions
  • Rename of the Virtual Cluster Id
• New features
  • New GATEWAY_AUDIT_LOG_EVENT_TYPES environment variable
  • Enhanced crypto shredding behavior for decryption
  • Client throttling for encryption and decryption
• Fixes

​

Breaking changes v3.12.0

​

New APIs for health and versions

​

Rename of Virtual Cluster Id

​

New features v3.12.0

​

New environment variable

​

Enhanced crypto shredding behavior for decryption

​

Client throttling for encryption and decryption

• New throttleTimeMs configuration: Set throttleTimeMs to control how long clients will be throttled when encryption/decryption fails (in milliseconds, default: 0)
• Automatic system protection: When encryption or decryption fails, Gateway can automatically throttle the problematic client for the specified duration, preventing system overload
• Configurable behavior: You can enable and adjust throttling based on your system’s needs and error tolerance

​

Fixes v3.12.0

• KUBERNETES Vault authentication now gets the JWT from the default Vault location (/var/run/secrets/kubernetes.io/serviceaccount/token). You can configure this location using path (VAULT_KUBERNETES_PATH). The jwt configuration key is no longer needed. See Kubernetes authentication under Vault authentication types.
• Enriched the REST_API audit log events with the request body, which was previously not captured.
• Resolved GATEWAY_TOPIC_STORE_KCACHE_REPLICATION_FACTOR configuration to properly default to the Kafka cluster’s default replication factor settings.
• Supported Protobuf schemas for SchemaPayloadValidationPolicyPlugin.
• Updated the SSL handshake failure logging to include client IP addresses (which were previously missing from error logs), helping you identify applications that are affected by certificate issues.

​

Improvements v1.36.2

• Added support for SMTPS servers in email alerting to allow TLS-enabled SMTP servers, as well as the previously available option for StartTLS.

​

Fixes v1.36.2

• Fixed an issue where the Console UI would prevent Debezium connector creation when required metadata was missing, even though the CLI would allow creation successfully.
• Fixed a permissions bug where users who were members of multiple ApplicationGroups would only inherit permissions from one group instead of receiving the combined permissions from all their groups. This was causing users to have incomplete access rights.
• Updated the base image to include upstream patches for CVE-2025-30749, CVE-2025-50059, and CVE-2025-50106 affecting Oracle Java SE and GraalVM.

​

Fixes v1.36.1

• Fixed an issue where the default produce header used a problematic naming format (app.name) that could cause compatibility issues with certain connectors
• Resolved the known issue from 1.36.0 where Self-service resource policies attached to Self-service application instances would display validation errors on the details page in Console

• Use REST to set Virtual Cluster ACLs
• Auto-create topics

​

New features v3.11.0

​

Set Virtual Cluster ACLs directly using REST

1. create a Virtual Cluster with a Kafka super user defined, then
2. as the Kafka super user, individually create ACLs using the Kafka admin API.

​

Auto-create topics

• Kafka property integration: leverages the Kafka property auto.create.topics.enable when the feature is enabled.
• Concentrated topics limitation: when this feature is enabled, topics that would normally be concentrated will be created as physical topics instead.
• ACL authorization: implements proper access control for auto-create topics:
  • permission requirements: requires CREATE permission on either the topic or the cluster.
  • security: ensures access control while maintaining flexibility for different permission models.

• Conduktor Scale:
  • New alert destination: email
  • Configurable Webhook body
  • Redesigned Application Catalog and Application details pages
  • Labels for Consumer groups
  • More information on tasks with errors
• Conduktor Exchange:
  • Breaking changes - Partner Zones support for mTLS
• Quality of life improvements
• Fixes
• Known issue

​

Conduktor Scale

​

New alert destination: email

​

Configurable Webhook body

​

Redesigned Application Catalog and Application details pages in Console

• displays a list of the application instances with labels and stats.
• includes an editor for modifying the application description.
• shows the application groups list with the owner group pinned.

• header section displays stats and labels, with the ability to manage labels.
• contains multiple tabs: Details, External access, Alerts, and API keys.
• within the Details tab, information is divided into two sections: ownership and resource policies.

​

Labels for Consumer groups

• The consumer groups list now shows labels and allows filtering by them.
• Topic lists within both the consumer groups and member details pages now support label-based filtering.
• In the topic details view for consumer groups, labels are visible and can be added, edited, or deleted.

​

More information on tasks with errors

• a warning icon will be shown next to the item in the list view and
• an error returned from the Confluent Cloud API will be displayed.

​

Conduktor Exchange

​

Breaking changes - Partner Zones support for mTLS

​

Quality of life improvements v1.36.0

• Users will now be redirected to the page they were on when they logged in again after session expiry.
• Improved navigation between Partner Zones in the list view when using keyboard.
• Improved configurability of circuit breaker behavior for indexed tasks. Each indexed task now includes configurable sequentialFailureThreshold and blockingDuration parameters, giving administrators fine-grained control over when indexing operations pause due to failures and how long they remain paused before attempting recovery. This provides predictable recovery behavior and prevents extended indexing outages that previously required Console restarts to resolve. Learn more about circuit breaker configuration.

​

Fixes v1.36.0

• Partner Zones are now created instantly, instead of waiting for the next reconciliation loop to pass. Other updates will continue to sync in line with the reconciliation loop.
• Fixed an error that occurred when no partitions were selected in the topic consume view. You will now see a warning that no messages will be shown, if partitions filter is set to none.
• The JSON view of a message in a topic now correctly displays negative numbers and numbers in scientific notation.
• Kafka Connect clusters are no longer visible to users who don’t have the permission on any of their connectors.
• Error messages are now more informative when attempting to create a service account on a resource for which the caller lacks permission.
• Resolved a case sensitivity issue with email addresses in the application group payload that caused mismatch in the RBAC configuration.

​

Known issue v1.36.0

​

Fixes v1.35.2

• Improved performance of a database migration to ensure completion within the startup probe time limit
• Fixed a database deadlock issue caused by the indexer

​

Fixes v1.35.1

• Fixed an issue with creating Kafka Connect alerts through the UI
• Improved lag exporter performances

​

Fixes

• Fixed an issue introduced in v0.6.0, where intermittent failure on some apply runs where kind ordering would not be respected. In some scenarios the parent resource is not made before the child (e.g. ApplicationInstances being created before Applications) and the run would fail, this could be fixed by attempting a retry.
• Fixed an issue introduced in v0.6.0 where failed runs would not return an exit code, leading to silent failures in CI actions.

​

Changes

​

New feature v3.10.0

​

New GATEWAY_SECURITY_MODE environment variable

• deprecates the DELEGATED_SASL_PLAINTEXT and DELEGATED_SASL_SSL security protocols (though they remain supported for backward compatibility)
• enables ACLs by default when managing security on the Gateway, by changing the default behaviour of the GATEWAY_ACL_ENABLED environment variable. ACL behavior is now derived from the security mode
• is backwards compatible, supporting existing configurations while encouraging the new approach

• Conduktor Scale:
  • Resource policies now covers Subject and ApplicationGroup
  • Revamped Application Catalog
  • Topic-level consumer group lag alerts
• Quality of life improvements
• Fixes

​

Conduktor Scale

​

Resource policies now covers Subject and ApplicationGroup

• Restricting application teams to only using Avro or enforce a specific compatibility mode, such as FORWARD_TRANSITIVE.
• Preventing application teams from adding members to application groups directly, directing them to use the external group mapping instead.
• Limiting the actions that can be performed in the UI by locking certain permissions.

---
apiVersion: self-service/v1
kind: ResourcePolicy
metadata:
  name: 'applicationgroup-restrictions'
  labels:
    business-unit: delivery
spec:
  targetKind: ApplicationGroup
  description: Enfore External Group Mapping and prevent TopicDelete permission in ApplicationGroup
  rules:
    - condition: size(metadata.members) == 0
      errorMessage: spec.members not allowed. Use external group mapping instead
    - condition: '!spec.permissions.exists(p, p.permissions.exists(x, x == "TopicDelete"))'
      errorMessage: TopicDelete permission is not allowed. Topic must only be deleted via CLI

---
apiVersion: self-service/v1
kind: ResourcePolicy
metadata:
  name: 'subject-format-and-compatibility-policy'
  labels:
    business-unit: delivery
spec:
  targetKind: Subject
  description: Enforces allowed schema formats and compatibility level for subjects
  rules:
    - condition: spec.format in ["AVRO", "PROTOBUF"]
      errorMessage: Only AVRO or PROTOBUF formats are allowed
    - condition: spec.compatibility == "FORWARD_TRANSITIVE"
      errorMessage: compatibility mode must be FORWARD_TRANSITIVE

# Application
---
apiVersion: self-service/v1
kind: Application
metadata:
  name: 'clickstream-app'
spec:
  title: 'Clickstream App'
  description: 'FreeForm text, probably multiline markdown'
  owner: 'groupA' # technical-id of the Conduktor Console Group
  policyRef:
    - 'applicationgroup-restrictions'

​

Revamped Application Catalog

​

Topic-level consumer group lag alerts

​

Quality of life improvements v1.35.0

• Added new fields to the onboarding page.
• CRUD operations for the labels added in the consumer group details page.
• Leading and trailing white spaces will now be printed as ”⎵” for display purposes and to provide more clarity to user. A tooltip will additionally be added to let users know when this is happening and to give them the “raw” value if they need it. The actual value will not be changed, this is just a visual helper.
• Improve container security context configuration on Conduktor Console and Cortex containers that allow to :
  • run with different UID and GID than default 10001:0
  • run unprivileged with all linux capabilities dropped

​

Fixes v1.35.0

• Fixed an issue where changing the cluster did not clear the search filter in consumer groups and topic pages.
• Fixed an issue where navigating to a schema registry with a name containing non-escaped characters such as / would redirect to the home page.
• Fixed an issue where the equality filter on JSON number fields wasn’t working correctly against large numbers in the topic consume view.
• The JSON view of a message in a topic no longer coerces large number fields to a string.
• Fixed an issue where the full message was not displayed correctly in the tooltip when hovering over it in the topic consume view table.
• Fixed an issue where the UI didn’t redirect to the correct cluster when switching Console instances.
• Fixed the logo in the onboarding page dark mode.
• The screenshot showing users how to find the project name and service name in Aiven Cloud is displayed correctly again.
• Fixed an error that would occur when no partitions were selected in Topics page filters.
• Fixed a bug that would cause service accounts with white spaces to not be accessible correctly.
• Cleanup data volume on start to ensure that old data is not re-used when using persistent volume between restarts.

​

Fixes v3.9.2

​

Fixes v1.34.3

• Improved support of Kafka Connect from Confluent Cloud (more connector statuses supported, better error messages, fixed list of topics).
• Improved caching strategy of the RBAC model resulting in faster UI and API.
• Fixed dependencies vulnerable to CVE-2025-48734

​

Fixes v1.34.2

• Improved memory efficiency when consuming messages from Kafka
• Added support of audit log events related to the ApplicationInstancePermissionRequest and ResourcePolicy resources

​

Fixes v1.34.1

• Fixed an issue with selecting groups and Slack channels when creating alerts
• Fixed an issue with the license plan page for licenses containing the Trust product

• Breaking changes
  • Gateway service accounts are now always required when using PLAIN tokens
  • Local service account token signing key is now mandatory
• New features
  • Enhanced Confluent Cloud authentication with service account mapping
  • Dynamic header injection from record payloads
• Fix
  • HashiCorp Vault token refresh resilience

​

Breaking changes v3.9.0

​

1. Gateway service accounts are now always required, when using PLAIN tokens

​

You’re impacted if

• your Gateway was not previously configured with the environment variable GATEWAY_USER_POOL_SERVICE_ACCOUNT_REQUIRED=true
• and your clients are connecting using PLAIN tokens without having a corresponding local service account already created.

​

Do you have to do anything?

• You must create any missing local service accounts that your tokens rely on.
• You can do this using the following command, adjusting your admin API credentials, host and name as appropriate

curl -X PUT -u admin:conduktor http://localhost:8888/gateway/v2/service-account \
        -H 'accept: application/json' \
        -d '{"kind": "GatewayServiceAccount", "apiVersion": "gateway/v2", "metadata": { "name": "admin", "vCluster": "passthrough"  }, "spec": { "type": "LOCAL" }}' 

​

Why did we make this change?

​

2. Local service account token signing key is now mandatory

​

You’re impacted if:

• your Gateway security protocol (for the client connection to Gateway) is SASL_SSL or SASL_PLAINTEXT
• and GATEWAY_USER_POOL_SECRET_KEY wasn’t already set

​

Do you have to do anything?

• Yes. Set GATEWAY_USER_POOL_SECRET_KEY. We recommend using the following command line to generate the hash:

openssl rand -base64 32

​

Why did we make this change?

​

New features v3.9.0

​

Enhanced Confluent Cloud authentication with service account mapping

• Improved Interceptor targeting: Interceptors can now target service accounts directly
• Enhanced Chargeback capabilities: Usage tracking by service account instead of API key
• Elimination of manual mappings: Removes the need for administrators to maintain user mappings

​

Dynamic header Injection from record payloads

• the entire record key or value and inject it as a header
• specific fields from record keys or values and inject them as headers

{
  "config": {
    "topic": "topic.*",
    "headers": {
      "X-CLIENT_IP": "{{userIp}} testing",
      "X-USER-ID": "{{record.key.id}}",
      "X-USER-EMAIL": "{{record.value.email}}"
    },
    "overrideIfExists": true
  }
}

• Extracting values from JSON, AVRO, PROTOBUF serialized records
• Accessing record fields using dot notation
• Referencing the entire key or value payload
• Using mustache syntax for dynamic header values

​

Fix v3.9.0

​

HashiCorp Vault token refresh resilience

• continue scheduling token refreshes at the regular intervals
• automatically recover once Vault becomes available again

• Conduktor Scale:
  • Kafka Connect policies
• Subscribe to application topics
• Conduktor Exchange:
  • Extended authentication mechanisms for Partner Zones
• Quality of life improvements
• Fixes
• Known issue

​

Conduktor Scale

​

Kafka Connect policies

---
apiVersion: self-service/v1
kind: ResourcePolicy
metadata:
  name: "limit-max-tasks"
spec:
  targetKind: Connector
  description: "Limit max tasks to 1"
  rules:
    - condition: spec.configs["tasks.max"] == "1"
      errorMessage: Connector tasks.max must be set to 1

​

Subscribe to application topics

​

Conduktor Exchange

​

Extended authentication mechanisms for Partner Zones

kind: PartnerZone
metadata:
  name: external-partner-zone
spec:
  cluster: partner1
  displayName: External Partner Zone
  url: https://partner1.com
  # serviceAccount: johndoe # <-- Previously, spec.serviceAccount
  authenticationMode: # New schema. spec.authenticationMode.serviceAccount , and, spec.authenticationMode.type of PLAIN or OAUTHBEARER
        serviceAccount: partner-external-partner
        type: PLAIN
  topics:
    - name: topic-a
      backingTopic: kafka-topic-a
      permission: WRITE

​

Quality of life improvements v1.34.0

• Added selectors for key and value formats on the single Kafka message page, enabling the use of custom deserializers.
• You can now see clusters referenced by each alert in the Settings > Alerts page.

​

Fixes v1.34.0

• To avoid timeouts when indexing consumer groups, added a new configuration variable to limit the number of consumer groups requested per describe query.
• Fixed an issue where in Topic Consume page, JQ filters against big numbers loses precision in Safari.
• Fixed an issue where messages with big number fields lose precision when being copied over to be reprocessed in the Topic Produce page.
• Fixed an issue where only the first 1,000 schemas were indexed
• Fixed an issue where opening a message with more than 1MB of data would freeze the UI because of the table view. It now defaults to the JSON view.
• Fixed an issue impacting Kafka Connect sink connectors where providing consumer override values as configuration would lead to a validation failure.
• Fixed an issue where deleted clusters were still present in the RBAC system, causing issues on the CLI api.
• Kafka config on huge numbers is now displayed correctly in the UI.
• Fixed an issue with Partition on topic details was not sorted correctly.
• Fixed an issue where lag wasn’t correctly calculated after a topic was deleted and recreated with the same name.
• The list of consumer groups in the topic details page using RBAC is now correctly displayed.

​

Known issue v1.34.0

​

Change

• The -o flags are now visible at the get root command level, making output options more discoverable.

​

Fix

• Fixed an issue where alerts could not be deleted via the CLI when using the metadata group. Find out more.

​

Conduktor Shield: optional compression before encryption when using full payload encryption

​

Fixes v3.8.1

• When using the alter topic policy Interceptor, allow updating only a subset of the enforced configurations.
• Correctly camel case capitalize upsertResult properties in API v2 responses

• Breaking changes
  • New backing topic for Gateway
  • Deprecating v1 APIs
• Conduktor Shield
  • General availability: a cost-effective crypto shredding with Gateway KMS
• New features
  • Support for delegated authentication using OAUTHBEARER
  • Support for Confluent Cloud Identity Pool
  • Support for delegated authentication using AWS_MSK_IAM

​

Breaking changes v3.8.0

​

New backing topic required for Gateway

​

Deprecating v1 APIs

​

Conduktor Shield

​

General availability of cost-effective Crypto Shredding with Gateway KMS

• When multiple Gateway nodes are simultaneously processing data with the same secret Id for the first time, it’s now possible for multiple Gateway keys to be stored per secret Id. Crypto Shredding requires every one of these keys to be deleted. To do so, the key store topic needs to be fully consumed and all of the keys associated with the required secret Id determined. Each will have a separate UUID.
• To efficiently re-use Gateway KMS keys for secret Ids, a new configuration option maxKeys has been added to config/kmsConfig/gateway/. It should be set to a number larger than the expected number of secret Ids.
• The masterKeyId in config/kmsConfig/gateway/ is now validated and can’t use template variables.

​

New features v3.8.0

​

Support for delegated authentication using OAUTHBEARER

​

Support for Confluent Cloud Identity Pool

​

Support for delegated authentication using AWS_MSK_IAM

• Conduktor Scale:
  • Kafka Chargeback: group by labels
  • Self-service: improved cross-team access control
  • Support for Aiven service accounts
  • Service account labels
• Conduktor Exchange:
  • Improvements to Partner Zones
• Quality of life improvements
• Fixes
• Known issue

​

Conduktor Scale

​

Kafka Chargeback - group by labels

​

Self-service - improved cross-team access control

# Permission granted to other applications
---
apiVersion: self-service/v1
kind: ApplicationInstancePermission
metadata:
  application: "clickstream-app"
  appInstance: "clickstream-app-dev"
  name: "clickstream-app-dev-to-another"
spec:
  resource:
    type: TOPIC
    name: "click.event-stream.avro"
    patternType: LITERAL
  userPermission: NONE
  serviceAccountPermission: READ
  grantedTo: "another-appinstance-dev"

​

Support for Aiven service accounts

---
apiVersion: v1
kind: ServiceAccount
metadata:
  cluster: aiven
  name: clickstream-sa
spec:
  authorization:
    type: AIVEN_ACL
    acls:
      - resourceType: TOPIC
        name: 'click.event-stream.avro'
        permission: readwrite
      - type: SCHEMA
        name: 'Subject:click.event-stream.avro'
        permission: schema_registry_write

​

Service account labels

• Any Kafka cluster
• Conduktor Gateway
• Confluent Cloud
• Aiven Cloud (currently using API/CLI only)

​

Conduktor Exchange

​

Improvements to Partner Zones

​

Rename shared topics

​

Modify Partner Zone details

• name
• URL
• description
• contact information
• traffic control policy details
• topics (add new or rename existing)

​

Quality of life improvements v1.33.0

• Add selectors for key and value formats on the single Kafka message page, enabling the use of customer deserializers.
• Creating resources owned by an Application Instance using an Admin API Key now bypasses Self-service topic policies.

​

Fixes v1.33.0

• Glue: improve deserialization of Avro schemas containing a nullable union
• Fixed an issue preventing the use of protobuf schemas with references
• Added a fallback mechanism to use the standard Kafka Connect API call when encountering an error on Confluent Cloud. If all attempts fail, the Confluent Cloud error message is now displayed to provide better clarity and troubleshooting information.
• Improved performance of API for applying users and groups with many permissions
• Errors thrown while producing to a topic are now properly displayed in the UI
• Fixed the computation of the controller of a KRaft cluster in the Brokers page
• Fixed an issue that prevented the storage of the NUL character in Kafka Connect error messages
• Failure to create the topic for audit log is now recorded in the logs
• Prevent Application Instance Token to be able to overwrite the Service Account permissions
• Update the database schema to not use ‘partition’ as a column name due to conflicts with SQL keywords on EnterpriseDB
• Align LDAP user retrieval behavior with binding/connection requests to resolve issues with federated Active Directory/LDAP where users aren’t found.

​

Known issue v1.33.0

​

Fixes v1.32.1

• Fixed dependencies vulnerable to the following CVEs:
  • CVE-2025-22228
  • CVE-2025-30204
• Fixed an issue where web browsers would try to autofill Kafka Connect configuration form fields with saved passwords

​

Breaking changes v3.7.0

• New backing topic required for Gateway
• Separator for super users
• Deprecating V1 APIs

​

New backing topic required for Gateway

​

Separator for super users

​

Deprecating v1 APIs

​

New features v3.7.0

• Preview feature: introducing cost-effective Crypto Shredding with Gateway KMS
• Support for AWS Glue schema registry

​

Preview feature - introducing cost-effective crypto shredding with Gateway KMS

1. Storing only a single master key in your external KMS
2. Securely managing thousands of individual encryption keys in Gateway’s internal key store
3. Deleting specific user keys when needed, rendering their data permanently inaccessible

​

Support for AWS Glue schema registry

​

Feature changes v3.7.0

• Added support for . in the name of the Virtual Cluster APIs
• More detailed errors unrelated to Interceptor validation added

​

Fixes v3.7.0

• Added aws-java-sdk-sts dependency to allow assume role profiles when using AWS KMS
• Added jcl-over-slf4j dependency to see logs from AWS SDK

• Breaking changes for Partner Zones
• Conduktor Scale:
  • Alert history
  • Audit logs
  • Service account labels
  • RBAC-aware menu
• Conduktor Exchange:
  • Introducing Partner Zones UI
• Quality of life improvements
• Fixes
• Known issue

​

Breaking changes for Partner Zones

​

Conduktor Scale

​

Alert history

​

Audit logs

​

Service account labels

​

RBAC-aware menu

​

Conduktor Exchange

​

Introducing Partner Zones UI

• an ability to edit Partner Zone configurations
• the option to rename shared topics, securing your data even further by ensuring that no internal information is shared

​

Quality of life improvements v1.32.0

• Enabled the confirmation of resource deletion using the Enter key.
• Updated the connector restart button labels and toast messages to accurately reflect their behavior for Confluent Cloud connectors.
• Removed a legacy option to disable monitoring.

​

Fixes v1.32.0

• Fixed an issue where editing a schema registry subject would overwrite its compatibility mode with the global compatibility setting.
• Fixed an issue where creating an ACL for a service account with a duplicate name could override the existing ACL.
• Fixed an issue where you could not remove the last ACL and Save in the Service Account UI.
• Fixed an issue where the Kafka Connect failed task heatmap didn’t display data for days in 2025.
• Fixed an issue where the CLI would report incorrect actions taken (although the correct actions were shown when the --dry-run flag was used).
• When Azure Active Directory is used as an LDAP server, the userPrincipalName field can now be set as the field containing the email address.
• Fixed an issue where very large numbers would show rounded in the details view of a topic message (e.g. 7777705807840271771 would display as 7777705807840271000).
• Fixed the UI issue where the option to reset a consumer group offset would disappear off the screen, if the partition count was too large.

​

Known issue v1.32.0

​

Changes

• Included Gateway resources in get all
• Added cause to ApiError responses
• Fixed apply template comment in YAML file
• Added option to edit and apply immediately to template command
• Standardized flag descriptions

​

Fix

• Fixed verbose mode in single client configuration

​

New features v3.6.1

• New metric gateway.apiKeys.throttle_ms : sets the throttling time in Kafka responses per apiKey in milliseconds
• Updated existing metric gateway.apiKeys.latency.request_response : sets the latency to process a request and generate a response for each API key
  • It now tracks latency for all verbs (eg CONNECTION) not just FETCH/PRODUCE

​

Feature changes v3.6.1

• Changes to Limit Commit Offset Plugin:
  • accuracy of rate limiting has been improved
  • action/throttleTimeInMs properties did not work correctly and are now ignored
• Changes to cluster ACLs:
  • when creating cluster ACLs using a programmatic API, only allow kafka-cluster for the name part of the resource. This makes Gateway consistent with Kafka.

​

Fixes v3.6.1

• Fixed a problem with the Create Topic Policy plugin which would not apply overrides to default configurations from the underlying Kafka setup.
• Fixed a problem with CreateTopics ACLs in Gateway which previously also required the Create cluster permission enabled.
• Addressed a problem with Non Delegated SASL/PLAIN token credentials, where Gateway would continue to work after service account has been deleted. To enable this feature set the environment variable GATEWAY_USER_POOL_SERVICE_ACCOUNT_REQUIRED to true (it currently defaults to false).
• Fixed a problem in AddPartitionsToTxnRequest where ACLs on transactionIds in new location were not being checked when Kafka API version was >= 4.
• An un-authorized idempotent producer will now throw a ClusterAuthorizationException instead of a TransactionalIdAuthorizationException, making Conduktor Gateway consistent with Kafka.

​

Fixes v1.31.2

• Fixed prefixed ACLs not displaying correctly in the Service Account UI
• Fixed an issue where Service Accounts with no ACL were incorrectly shown in the UI
• Fixed an issue allowing creation of Service Accounts without ACLs

​

Known issues v1.31.2

• When removing ACLs in the Service Account UI, you cannot remove the last ACL
• As a workaround, you can remove that last ACL, then create a new ACL against a resource name that does not exist.
• We will address this issue in the next release

​

Console metrics performance and configuration

CDK_MONITORING_ENABLENONAGGREGATEDMETRICS: false
CDK_MONITORING_USEAGGREGATEDMETRICS: true

​

Fixes v1.31.0

• Fixed dependencies vulnerable to the following CVEs:
  • CVE-2024-57699
  • CVE-2025-24970
  • CVE-2024-45337
  • CVE-2024-45338
• Resolved an issue related to SSL checks between the Console and Cortex where bad certificates caused communication issues
• Fixed an issue with user email addresses containing a ' character that blocked database migrations
• Reduced the memory consumption and improved the performance of metrics under heavy load that prevented them from displaying
• Partner Zones: configuration updates are now applied correctly
• Partner Zones: partners can now utilize consumer groups

​

Features v3.6.0

• Kafka cluster connection management
• Encryption improvements
  • Encryption secret Id Mustache templates
  • Decryption failure modes
• Schema registry access improvements
  • Read-only schema registry access
  • Plugin validation of schema registry access

​

Kafka cluster connection management

​

Encryption improvements

​

Encryption secret Id Mustache templates

​

Decryption failure modes

• errorPolicy: "return_encrypted" Previous - if there’s an error during decryption, then the encrypted data is returned.
• errorPolicy: "fail_fetch" New - if there’s an error during decryption, then the fetch that was reading the data is failed and the client will receive an error.

​

Schema registry access improvements

​

Read only schema registry access

​

Plugin validation of schema registry access

​

Quality of life improvement v3.6.0

​

Fixes v3.6.0

• Fix: CreateTopicPolicy and AlterTopicPolicy overrides. There were some edge cases where the desired overrides from the plugin config would not be applied. These plugins now behave consistently in all situations.
• Improvement: Removed some verbose logs and updated logging to be clearer. A general set of improvements has been made to Gateway logging, making some errors clearer and reducing repetition.

​

Changes

• Environment variable references can now be passed to Gateway or Console, allowing you to store references to secret variables used by the host within your configuration.
• Partner Zones are now available, allowing you to securely share your streaming Kafka data with external partners without the need to replicate the data.
• More informative error responses in certain situations
• Console API schema updated
• Added run
• Schema code reorg
• Ops 630 pass external environment variable reference
• Introduced dev mode for hidden command
• Panic replaced with graceful exit
• Included Partner Zones Gateway API changes

​

Fixes

• buildAlias duplication fixed
• Fixed ServiceAccount check when defining commands
• Release Action fixed
• Various doc fixes
• Fixed duplicate printout statements

• Breaking changes:
  • Removed v1 alerts
  • Changes to v2 alerts
  • Id of certificates
• Conduktor Scale:
  • Webhooks support for alerts
  • API and CLI support for service accounts
  • Labels support for service accounts
  • Self-service support for application managed service accounts
  • Application group permissions now available on user permissions page
• Conduktor Exchange:
  • Introducing Partner Zones for third-Party data sharing
• Quality of life improvements
• Fixes
• Known issues

​

Breaking changes

​

Removed v1 alerts

​

Changes to v2 alerts

• Alerts have been automatically configured with the previously globally configured channel (Teams or Slack).
• Alerts have been assigned to the individual who created them.

​

Id of certificates

​

Conduktor Scale

• Enhanced alerting with webhooks support
• API and CLI support for service accounts
• Labels support for service accounts
• Self-service support for application managed service accounts
• Application group permissions now available on user permissions page

​

Enhanced alerting with webhooks support

• Alerts are now owned by individuals, groups, or applications
• We added Webhook destination to alerts notifications
• Destinations are now configurable per-alert
• API / CLI support for Alerts is now available

apiVersion: console/v3
kind: Alert
metadata:
  name: messages-in-dead-letter-queue
  group: support-team
spec:
  cluster: my-dev-cluster
  type: TopicAlert
  topicName: wikipedia-parsed-DLQ
  metric: MessageCount
  operator: GreaterThan
  threshold: 0
  destination:
    type: Slack
    channel: "alerts-p1"

​

API and CLI support for service accounts

---
apiVersion: v1
kind: ServiceAccount
metadata:
  cluster: shadow-it
  name: clickstream-sa
spec:
  authorization:
    type: KAFKA_ACL
    acls:
      - type: TOPIC
        name: click.event-stream.avro
        patternType: PREFIXED
        operations:
          - Write
      - type: CLUSTER
        name: kafka-cluster
        patternType: LITERAL
        operations:
          - DescribeConfigs
      - type: CONSUMER_GROUP
        name: cg-name
        patternType: LITERAL
        operations:
          - Read

​

Labels support for service accounts

---
apiVersion: v1
kind: ServiceAccount
metadata:
  cluster: shadow-it
  name: clickstream-sa
  labels:
    domain: payment
    region: EMEA
    application: clickstream
spec:
  ...

​

Self-service support for application managed service accounts

---
apiVersion: v1
kind: ServiceAccount
metadata:
  appInstance: "clickstream-app-dev" # Mandatory to link the Service Account to the ApplicationInstance
  cluster: shadow-it
  name: clickstream-sa
spec:
  authorization:
    type: KAFKA_ACL
    acls:
...

​

Application group permissions now available on user permissions page

​

Conduktor Exchange

​

Introducing Partner Zones for third-party data sharing

• Dedicated pages that allows you to manage Partner Zones completely from the UI
• Support for Traffic Control Policies to limit the amount of data that can be consumed or produced by your partners
• Topic renaming capability to avoid leaking internal topic names to your partners

​

Quality of life improvements v1.31.0

• Added a “Groups” tab in the Application page which shows all of the Application Groups created via Self-service
• Improved the license plan page to show the start and end date of the license, as well as the packages included in the license
• Added the remaining days left in the sidebar when the license is expiring in less than 30 days
• Improved how a connector’s configuration is displayed in the raw JSON view by sorting the properties alphabetically

​

Fixes v1.31.0

• Fixed several issues Confluent Cloud Managed Connectors
  • Fixed Pause/Resume connector
  • Fixed Connector and Task Restart
  • Fixed Connector Status (Running, Paused, etc.), previously displayed as “Unknown”
• Fixed a permission check issue when adding partitions to a topic
• Improved the serialization of String and com.fasterxml.jackson.databind.JsonNode types returned by custom deserializers
• Fixed an issue parsing masked data when choosing the String format on data that cannot be parsed as JSON
• Added topics ending with -subscription-registration-topic and -subscription-response-topic to the Kafka Stream filter
• Fixed the edition of ownership mode of application instances
• Fixed the form for saving producer templates
• Fixed the navigation to go back to the home page of connectors when switching clusters

​

Known issues v1.31.0

• We are aware of more inconsistencies with Confluent Cloud Managed Connector support in Console. We are working on it.
  • Task status is not always correctly displayed
  • Various UI responsiveness issues

​

Feature v3.5.2

​

Fix v3.5.2

​

Changes

• Added support of query params for parent
• Added template

​

Fix

• Fixed the issue when deleting virtual clusters does nothing

​

Feature v3.5.1

​

Changes

• Updated default kind for 1.30
• Added basic auth for Gateway API support

​

Fix

• Fixed default vCluster set to null for delete interceptors

​

Features v1.30.0

• RBAC support for Conduktor SQL
• Add support for multi-hosts database configuration
• Delegating authentication to an identity provider
• More Audit Log CloudEvents into Kafka

​

RBAC support for Conduktor SQL

• Users & Groups can only see and query the tables for which they have an associated Topic permission in Console
• Data masking policies are applied (with limitations)

​

Add support for multi-hosts database configuration

CDK_DATABASE_URL: jdbc:postgresql://user:password@host1:5432,host2:5433/console_database
CDK_KAFKASQL_DATABASE_URL: jdbc:postgresql://user:password@host1:5432,host2:5433/kafka_sql_database

​

Delegating authentication to an identity provider

​

More Audit Log CloudEvents into Kafka

• Kafka.Subject.ChangeCompatibility
• Kafka.Topic.Browse
• Kafka.Topic.ProduceRecord
• Kafka.Topic.SqlQuery
• Kafka.Connector.Restart
• Kafka.Connector.Pause
• Kafka.Connector.Resume
• Kafka.Connector.RestartTask
• Kafka.Connector.AutoRestartActivate
• Kafka.Connector.AutoRestartStop

​

Quality of life improvements v1.30.0

• Alert lists in the resource pages have been updated to show the metric and condition, the alert state and a new column “Last Triggered”
• Chargeback data can now be exported into a CSV file to enable easier integration with existing organization cost management data.
• The User permission page provides a clearer distinction between inherited and user-specific permissions.
• Topic policy validation errors message are easier to read when using the CLI
• Added support for Array and Boolean types in Conduktor SQL
• Added Kafka Key column and other metadata in Conduktor SQL Topics

​

Fixes v1.30.0

• Fixed a pagination issue in the SQL Indexed Topics view
• Fixed several instances where the CLI would not report the expected state change (Updated vs. Not Changed) on apply

​

Breaking changes: local users

​

Breaking changes: default SNI Host Separator

 <host_prefix><cluster_id><broker_id>-<advertised_host>

​

Features v3.5.0

​

Use of In-memory KMS for encryption

​

License expiry

• We have added new metric gateway_license_remaining_days which you can monitor to track the time left on your license
• If the Gateway is currently running, do not automatically exit on license expiry. Rather, Gateway will now log a warning every hour that your license is expired:

License has expired! You need to add a valid license to continue using Conduktor Gateway. Checkout our documentation if unsure how to set the license

• These warnings will start 1 week before expiry occurs as a notification, in the format:

License will expire in less than {N} day(s)! You need to renew your license to continue using Conduktor Gateway

• Finally, we now check your license earlier in the bootstrap sequence for Gateway, so it will fail fast with a clear message when your license is expired.

​

Quality of life Improvements v3.5.0

• Support for Kafka Clients up to v3.9
• Improved compatibility and logging for dealing with kafka-client versions and version negotiations
• Added support for multiple authentication mechanisms against Vault (AppRole, LDAP, …)
• Introduced a new configuration enableAuditLogOnError (default: true) which enhances the errors which are logged when encryption/decryption fails
• Improved error logging for expired tokens on authentication, to replace large stack traces with concise information
• Performance improvements for TLS handshakes, in particular to prevent repeated failed attempts overloading the gateway
• Several improvements to data quality and encryption config validation to provide better error reporting and feedback in the case of problems

​

General fixes v3.5.0

• Fixed an issue in ACL handling which caused an error if no topics were passed for an offset fetch request (being the case where the caller wants to retrieve offsets for all topics).
• Fixed an issue in Virtual Clusters which in some cases meant the ACLs for the physical Kafka clusters where exposed in error.
• Fixed an issue in the regular expression application in the data quality and SQL plugins, where .* would not always match the entire value for a field
• Fix an issue when creating both a service account and a service account group through the cli to ensure the order of operations is always correct, preventing intermittent failures in this case.

​

Known issues v3.5.0

• We are aware of an issue with kcat when the new environment variable GATEWAY_MIN_BROKERID is not aligned with the first BrokerId of your Kafka cluster
  • As a workaround, you can either define GATEWAY_MIN_BROKERID to your first Kafka BrokerId or use kcat with the -E flag

​

Change

• Updated Console schema with latest version

​

Fix

• Changed ordering between groups and service accounts in Gateway entities

​

Changes

• Added handling of environment variables for YAML
• Added description for token CMD
• Updated README.md
• Added run sql
• Updated with latest Gateway API changes
• Added all

​

Fixes

• Fixed release version check
• Fixed version bump in Homebrew PRs
• Fixed releases prefix to prevent errors

​

Changes

• Added support for -o json and -o name on get
• Updated to latest Gateway API
• Added support for Gateway API v2
• Clarified version with a v

​

Fixes

• Fixed the release tag
• Fixed missing key retrieval from environment

​

Changes

• Made /api not mandatory when setting base URL
• Updated offline schema for future
• Added support for description from file in topic resources
• Added support for delete -f
• Improved client interface
• Improved CLI API for terraform provider POC
• Added a command to create token
• Added a login command

​

Fix

• Fixed auto login in client

​

Changes

• Started with v to solve issue with go package
• Use resource priority from default catalog if catalog doesn’t have any
• Added resource priority
• Keep order from API response
• Updated offline kind

​

Changes

• Expended Subject schemaFile on apply

​

Fixes

• Fixed an issue on apiVersion where apiVersion is put at the end

​

Breaking changes

• CDK_TOKEN is now CDK_API_KEY

• automation update brew formula

• improved docs

​

Features

• Added CA cert
• This release is only compatible with Console 1.23 or above

​

Fixes

• Fixed an issue with insecure

​

Features

• This release is only compatible with Console 1.23 or above
• Made CTL work with complex path
• Set CDK-CLIENT header to improve analytics

​

Fixes

• Fix for adding prefix X- to custom header

​

Features

• Add uniform CLI help commands/flags descriptions
• Use alpine as base Docker image with custom user
• Added support for multiple failing apply to get a detailed summary

​

Features

• Support for get, apply (upsert) and delete commands for the following Conduktor Console resources:
  • Application
  • ApplicationInstance
  • ApplicationInstancePermission
• Support for --dry-run on apply and delete
• Support completion that generates the autocompletion script for the specified shell
• Support for proxy auth using certificate and key
• Support ignore untrusted certificates environment variable
• Configurable environment variables