Kafka Connect 0.8.1 Changelog

Custom plugins volume: the base image loads a volume mounted at /mnt/custom-plugins with extraVolumes as one more plugin, for testing a connector that is not in the catalog. A writable mount on that path fails the render.

Base image verification (baseImageVerification): opt-in. A Kyverno NamespacedImageValidatingPolicy admits a worker pod only when its base image carries an Axual release signature. Needs Kyverno 1.19 or later.

Release base images move to registry.axual.io/axual/kafka-connect-base, next to the plugin images. Mirrors must add this repository.

extraVolumeMounts: a mountPath outside /mnt now fails the render. Strimzi refused it anyway and left the KafkaConnect NotReady.

The base image ships vault-config-provider 1.1.2. With 1.1.0, connectors that started at the same time on one worker revoked each other’s Vault tokens, so some failed with a Vault 403 or got no tasks.

Registry credentials (registryCredentials): registry, username and password for any number of registries, written into one kubernetes.io/dockerconfigjson Secret and added to the worker pods' pull secrets, next to imagePullSecrets. The same registry twice fails the render.

Egress NetworkPolicy (egress): opt-in. Limits where the workers may connect to: DNS, the other workers of the cluster, and the destinations in egress.rules. Turning it on without rules fails the render.

Managed plugins (managedPlugins), not supported yet: shipped so a later release is not needed. When on, a Kyverno Policy mounts the plugins listed in a provisioner-owned ConfigMap into each new worker pod, and refuses images outside managedPlugins.allowedRegistries or not pinned by digest. No provisioner implements this side so far.

Worker settings: jvmOptions, podLabels, serviceAccountAnnotations, extraVolumes and extraVolumeMounts, passed through to the Strimzi resource. Mounts are read-only unless set otherwise.

Plugin delivery in two modes: per-plugin OCI images mounted as image volumes (imageVolumes, default) or one prebuilt image per profile (prebuiltImage, with prebuiltImageRegistry for mirrors).

Plugin catalog: plugins entries are selected by name from plugin-catalog.yaml, shipped in the chart package, which pins every plugin image by tag and digest. An unknown name fails the render and lists the catalogued plugins. An entry with an explicit image mounts a connector the catalog does not list.

Plugins: 32 connector, converter and transform plugins, among them Debezium (MongoDB, MySQL, Oracle, PostgreSQL, SQL Server), Aiven JDBC, OpenSearch and S3, Camel SFTP, Stream Reactor (Cassandra, FTP, JMS, MQTT), Snowflake, Splunk, the Apicurio Registry 3.3.3 converter and kafka-topic-name-transforms.

Worker authentication with mTLS or SASL/SCRAM-SHA-512, and bootstrapServers per listener.

Cluster identity (tenant, instance, clusterName), required and validated as label values. They label the worker pods for the log viewer and derive the group id and internal topic names (_<tenant>-<instance>-<clusterName>-connect[-configs|-offsets|-status]), so two clusters on one Kafka never merge. An upgrade that would change these names fails before applying anything.

ACL bootstrap Job (aclBootstrap): a pre-install/pre-upgrade hook that creates the internal topics and grants the worker ACLs, as an mTLS or SCRAM superuser.

Vault integration (vault) for ${vault:...} placeholders in connector configs, with the AppRole credentials in a Secret (vault.credentialsSecret).

REST API route with basic auth (restApi): an Ingress or HTTPRoute, an htpasswd Secret, extraObjects for implementation-specific auth, and a NetworkPolicy that leaves the route as the only way to port 8083. Examples for ingress-nginx, F5 NIC and NGINX Gateway Fabric.

ECS JSON worker logs with logging.level, logging.loggers and logging.monitorInterval.

Pod hardening: restricted podSecurityContext/securityContext by default, plus runtimeClassName (via a Kyverno policy), affinity, tolerations and podAnnotations.

Strict values schema: unknown keys are rejected, except inside a plugins entry, where keys other than name and image are ignored.