Axual 2026.3 Release Notes

Update default image version to Axual Connect 3.1.1

Update Chart.yaml to use platform-manager 16.0.0 dependency chart

Update Chart.yaml to use platform-ui 14.0.0 dependency chart

Update Chart.yaml to use topic-browse 0.9.0 dependency chart

Update Chart.yaml to use api-gateway 0.11.0 dependency chart

Update Chart.yaml to use metrics-exposer 1.7.0 dependency chart

Update Chart.yaml to use axual-kafka 0.2.1 dependency chart

Deliver plugins as per-plugin OCI image volumes (imageVolumes, default) or as one prebuilt image per profile (prebuiltImage)

Bundle plugin specs for the Apicurio converter, Axual HTTP sink, Axual Kafka sync, Camel SFTP sink and source, Stream Reactor FTP, Debezium (MongoDB, MySQL, Oracle, PostgreSQL, SQL Server), FileStream and kafka-topic-name-transforms

Authenticate workers with mTLS or SASL/SCRAM-SHA-512, with bootstrapServers per listener

Derive the group id and internal topic names from the required tenant, instance and clusterName values, and fail an upgrade that would change them

Create the internal topics and worker ACLs in a pre-install and pre-upgrade hook Job (aclBootstrap)

Resolve ${vault:…​} placeholders in connector configs through Vault AppRole credentials (vault)

Expose the REST API through an Ingress or HTTPRoute with basic auth and a NetworkPolicy that restricts port 8083 to the route (restApi)

Write worker logs as ECS JSON, with configurable levels per logger (logging)

Run pods with a restricted security context by default, with optional runtimeClassName, affinity, tolerations and podAnnotations

Reject unknown keys anywhere in the values file through a strict schema

ksml-provisioner is renamed to runtime-provisioner

The alert name, the service, job, container and app.kubernetes.io/name labels and the OpenTelemetry service.name and scope all follow the rename, so dashboards, alert routes and silences stop matching

Fix the OpenShift Route, which carried no traffic: it asked for a targetPort the Service does not have, and route.path defaulted to /api, which reaches no handler. route.path and the Ingress path now default to /

A working Route or Ingress publishes an unauthenticated service, so set BASIC_AUTH_ENABLED=true with a username and password before you enable either

Docker mode containers are labelled axual.io/managed-by=runtime-provisioner, and the bulk /status matches that label on its key, so containers left by 0.7.x stay listed and none has to be recreated

Add GET /kafkaconnect/logs/download, which streams every worker’s current log file as one plain-text attachment in labelled sections, capped by CONNECT_DOWNLOAD_CAP_BYTES, 64 MiB by default

Breaking for trace queries: the log download reports its spans under the shared scope axual.io/otel/runtime-provisioner instead of kafkaconnect-download, matching every other handler. The span name is unchanged

The connector filter matches a log entry on its connector.context field instead of searching the line text, ending false positives such as a filter for sink matching orders-sink

GET /kafkaconnect/logs accepts minLevel, keeping only lines at that severity or above in both modes, with stack trace lines kept alongside the line they belong to

The connector filter no longer matches a connector whose name is a hyphen-separated suffix of another, so sink stops matching connector-producer-orders-sink-0

A log stream reports when its history reached the start of what the workers still hold, so a short window is told apart from a log that has ended

A Kafka Connect log stream sends the history a batch request answers with and then follows the log, from one read per worker, so tailLines means the same in both modes

Breaking for API clients: GET /kafkaconnect/logs answers with entries, one time-ordered list carrying origin and timestamp per line, plus linesRead, linesReturned and degraded. The per-worker logs field is gone

A filtered request reads a wider raw window, so tailLines bounds the answer and not the read. Adds CONNECT_FILTER_WINDOW_PERCENT (default 2000) and CONNECT_FILTER_WINDOW_MAX_LINES (default 50000), and the matching chart values

Breaking for dashboards: the metric kafkaconnect.log.stream.errors is renamed to kafkaconnect.log.read.errors and gains a mode attribute of batch or stream

Log streaming sends Waiting for output from the application…​ after 2 seconds of silence, and KSML reports a not-started container as starting instead of failing with a 500

Add GET /kafkaconnect/logs, merging one Kafka Connect cluster’s worker pod logs into a single JSON or NDJSON answer, with the CONNECT_NAMESPACES, CONNECT_CONTAINER_NAME and MAX_CONCURRENT_LOG_STREAMS settings

Add /healthz and /readyz, serve the KSML endpoints under /ksml/ beside the flat paths, and add KSML_ENABLED to switch KSML support off

Breaking for the chart: liveness and readiness now use /healthz and /readyz instead of a port check, so do not pin image.tag below this chart version or the container restarts in a loop

KSML log streaming can answer 503 when MAX_CONCURRENT_LOG_STREAMS is reached, because the cap is shared with Kafka Connect log streaming

Add DOCKER_KSML_RUNNER_DEFAULTS_FILE to Docker mode, a ksml-runner.yaml-shaped defaults file deep-merged under every generated runner config, giving Docker Compose what CUSTOM_VALUES_FILE gives Kubernetes mode

Update dependencies (Helm 3.22.0, golang.org/x/crypto 0.57.0 with a security fix, OpenTelemetry OTLP gRPC exporter 1.46.0, and related modules)

Update default KSML CHART_VERSION to 1.3.2

Add self stall-detection for message distributor tasks: the task reports when it is RUNNING but not making progress while work is pending, through new config stall.detection.enabled / stall.detection.threshold.ms / stall.detection.check.interval.ms, new metrics message_distributor_batch_processor_stalled, message_distributor_batch_processor_no_progress_ms and message_distributor_batch_processor_assigned_partitions, and a new DistributorTaskStalled alert. Detection only reports (metric plus log line); it never fails or restarts the task.

Count every stop-progress failure per partition: a batch-level failure now increments message_distributor_batch_processor_partition_exception_count_total (previously only per-record produce failures were counted), so the exceptions view is trustworthy.

Dashboard: add stall, progress (copy rate vs arrival), per-partition lag and topic-partitioning panels to the Message Distributor dashboard.

Dashboard: add a "Time without progress (ms) per task" panel that plots message_distributor_batch_processor_no_progress_ms against the stall threshold, so the gauge now has a consumer.

Dashboard: empty-result health stats (Running/Failed Tasks, exception counts, "Distributing?") now fall back to 0/OK instead of showing an ambiguous "No data" when nothing has happened yet. The "Distributing?" panel also groups by connector so it matches the DistributorTaskStalled alert.

Integration tests: run out of the box on macOS Docker Desktop (Docker Engine 29+, API >= 1.40) with no manual ~/.docker-java.properties / ~/.testcontainers.properties. A macOS-only Maven profile in distributor-integrationtest points Testcontainers at the real engine socket, sets a supported Docker API version, and fixes Ryuk startup so it cleans up the test containers. Linux CI is unaffected (the profile activates only on macOS).

Unit tests: pass on newer JDKs (JDK 25 / latest LTS) with mvn test, no JDK switch and no extra flags. Byte Buddy is pinned to 1.17.8 (overriding the 1.17.5 that Mockito 5.18.0 bundles), which could not instrument mocks under JDK 25 ("Could not modify all classes", e.g. RemoteProducerTest). Still builds and tests on JDK 17/21.

Dependency updates: Kafka connect-api/connect-runtime to 4.3.1, Avro to 1.12.2, Lombok to 1.18.48, slf4j to 2.0.19, Guava to 33.7.1-jre, Commons Lang3 to 3.20.0, Commons Text to 1.15.0, Dropwizard Metrics JMX to 4.2.40, Jackson Databind to 2.22.2, and several Maven plugin/CI tooling versions. JUnit is upgraded to the JUnit 6 major line (6.1.3). CI: gitlab-pipeline-tools to 2.22.1, which runs the Helm lint jobs on GitLab-hosted arm64 runners and fixes the alpine/helm entrypoint for them.

Fix two tests that broke under the newer Kafka connect-api (it now requires bootstrap.servers with no default): OffsetDistributorTest.metrics and OffsetDistributorTaskTest.cacheTimeoutIsConfigurable now set local.bootstrap.servers / target.bootstrap.servers in their test configs.

Pin jackson-annotations to 2.22 alongside jackson-databind in distributor-common, so it matches everywhere. Without this, distributor-integrationtest’s test-scope connect-runtime pulled in an older jackson-annotations that did not match the newer jackson-databind, and Kafka Connect’s plugin scanner failed to load JsonConverter with a NoClassDefFoundError.

Update kafka-synchronisation-connectors to 2.0.0. Fixes a data race in the upstream KafkaSinkRunner (an unsynchronized offsets map shared between the runner thread and the Kafka Connect commit thread, which could throw ConcurrentModificationException or lose an offset commit) and a thread leak in KafkaSinkTask.stop(). Both apply to schema-distributor, which uses this library’s sink runner. No config or code changes needed here: schema-distributor never used the removed deprecated topic.selector string config, and its connector class does not go through the library’s own connector-level validation where the new default-on remote-connectivity check lives.

Fix MessageDistributionChaosIT flaking on a loaded machine: its initial pre-chaos sanity check used a fixed 20s window expecting an exact record count, the same pattern that used to make the post-chaos check flaky. It now waits until every produced record is seen remotely, with early exit, like the post-chaos check already did.

Run the CI coverage-gitlab job on the arm64 image jacoco2cobertura:1.0.11-arm64, so it works on the arm64 runners. The amd64-only tags (1.0.10 / 1.0.11) hang during the runner’s shell detection (detect_shell_script: applet not found) and only fail after the 1-hour job timeout. Also added a short job timeout as a safety net so any future hang fails fast; the job stays allow_failure.

Update Chart.yaml to use rest-proxy 1.18.0 dependency chart

Update Chart.yaml to use apicurio-registry-v3 0.2.0 dependency chart

Enable apicurio-registry-v3 by default (global.apicurio-registry-v3.enabled)

Remove the apicurio-registry (v2) dependency chart and its global.apicurio.enabled toggle, apicurio-registry-v3 is now the only Schema Registry