Secret manager integration with Confluent Cloud now extends to the following additional fully-managed connectors: Amazon DynamoDB CDC Source Amazon DynamoDB Sink AWS Lambda Sink Azure Blob Storage Sink Google BigQuery Sink V2 Redis Kafka Sink Redis Kafka Source For more information, see Create a secret manager integration in Confluent Cloud.
Tableflow now emits structured log events, such as sync failures and topic health changes, across the full lifecycle of a Tableflow-enabled topic. You can export these logs to third-party tools like Splunk and Datadog through Observability Integrations. For more information, see Tableflow log categories and events.
Single sign-on (SSO) configuration now has its own dedicated page in the Confluent Cloud Console at https://confluent.cloud/sso, separate from the Accounts & access page. Group mapping configuration remains on the Accounts & access page at https://confluent.cloud/settings/org/group-mappings. For more information, see Use Single Sign-on (SSO) for Authentication on Confluent Cloud and Group Mapping…
The fully-managed Amazon S3 Sink and Snowflake Sink connectors for Confluent Cloud now enable cross-region and cross-cloud connectivity. You no longer need to contact Confluent Support to connect to a destination in a different region or cloud provider than your Confluent Cloud cluster.
You can now view your Confluent Cloud notifications in one place. Click the bell icon in the Confluent Cloud Console to see a summary of recent notifications, and open the notifications dashboard to view and sort your notification history from the past 30 days. For more information, see Notifications for Confluent Cloud.
The Flink sqlv1 Statement and Materialized Table REST APIs now support auto pool mapping for OAuth identity pools, making the Confluent-Identity-Pool-Id header optional. When the header is omitted, Confluent Cloud automatically maps the OAuth token to all matching identity pools. You can also specify a comma-separated list of identity pool IDs in the header. For more information, see Use auto pool…
Snapshot queries in Confluent Cloud for Apache Flink® are now generally available on AWS, Azure, and Google Cloud. Run bounded, batch-mode Flink SQL queries to take a point-in-time snapshot of your streaming data, compute a result, and exit, using the same Flink SQL you already use for streaming. For more information, see Snapshot Queries and Run a Snapshot Query.
The Flink Table API for Java in Confluent Cloud for Apache Flink® is now generally available, with plugin version 2.3-3 on Flink 2.3.0. Build, test, and deploy stream-processing pipelines as regular Java applications, from your IDE or CI/CD pipeline, on the same serverless runtime that powers Flink SQL. This release adds global API keys as the recommended authentication method, OAuth 2.0 support w…
Confluent Cloud for Apache Flink is now available in four additional regions across Azure and Google Cloud: Azure: italynorth (Milan, Italy), mexicocentral (Mexico Central), southafricanorth (Johannesburg, South Africa) Google Cloud: europe-southwest1 (Madrid, Spain) All new regions support both public and private networking. For the complete list of supported regions, see Supported Cloud Regions…
The fully-managed Oracle XStream CDC Source connector now supports downstream capture topologies, in which the XStream capture process runs on a separate downstream Oracle database rather than the source. Two topologies are available: downstream capture (source ships redo directly to the downstream) and cascading downstream capture (redo travels through an Oracle Active Data Guard standby before r…
Confluent Cloud Gateway version 1.3.0 is now available. This release introduces the following features and enhancements: Centralized governance enforcement (Early Access): Confluent Gateway now validates messages and enforces data governance centrally with Confluent Schema Registry, ensuring only compliant records reach your Kafka clusters. Enforcing policies at Confluent Gateway reduces the data-…
Cluster deletion protection is now available for Confluent Cloud. Deletion protection is an opt-in safeguard that prevents accidental deletion of a Kafka cluster. You can enable it through the Confluent Cloud Console, Confluent CLI, REST API, or Terraform. When enabled, any request to delete the cluster fails until an authorized user disables protection. You also cannot delete an environment that…
The fully-managed Google Cloud Spanner CDC Source (Debezium) connector is now available for Confluent Cloud. The connector monitors a Google Cloud Spanner change stream and streams row-level inserts, updates, and deletes from Spanner tables to Apache Kafka® topics in near-real time. For more information, see Google Cloud Spanner CDC Source (Debezium) Connector for Confluent Cloud.
The io.confluent.kafka.server/consumer_lag_offsets metric now reports lag for any group that has been in the EMPTY state for less than one day. If you currently query the metric, you might notice an increase in returned response size due to the new data points that the metric returns. As a best practice, to control response size, audit and delete old consumer groups, and if possible restart existi…
Release priority is now available for Dedicated Kafka clusters with Premier support or higher. When you enable release priority on a cluster, it receives updates before your non-test clusters. For more information, see Release priority.
Custom Single Message Transformations (SMTs) are now available for fully-managed connectors running on Basic, Standard, and public Dedicated clusters. This feature is available in all supported regions. For details, see Custom SMT for Confluent Cloud Limitations and Support. The fully-managed PostgreSQL Source, PostgreSQL Sink, MySQL Source, and MySQL Sink (JDBC) connectors now support mutual TLS…
Secret manager integration with Confluent Cloud now supports Google Cloud Secret Manager. This feature enables Confluent Cloud to fetch sensitive configuration values such as secrets for your connectors at runtime from Google Cloud Secret Manager, removing the need to persist secrets within Confluent’s boundary. To explore its full range of features and get started, see Google Cloud Secret Manager…
The fully-managed HTTP Source V2 connector now supports schema evolution through the EVOLVE schema enforcement mode. EVOLVE requires a Schema Registry-based output.data.format (AVRO or JSON_SR) and the default TopicNameStrategy. For more information, see Schema evolution for HTTP Source V2. Client-side field level encryption (CSFLE) for Tableflow is available as a Limited Availability feature. Wit…
External connectivity for user-defined functions (UDFs) in Confluent Cloud for Apache Flink® is now generally available. UDFs can call external systems and services, such as REST APIs, through Confluent Cloud Connection objects bound with the USING CONNECTIONS clause. Public endpoints are supported on AWS, Azure, and Google Cloud. Private endpoints are available on AWS only. For more information,…
User-defined functions (UDFs) in Confluent Cloud for Apache Flink® are now available on Google Cloud. Java UDFs and external connectivity for UDFs (Early Access, Java-only, public endpoints only) are supported in seven Google Cloud regions: us-east4, us-central1, us-east1, asia-south1, asia-southeast1, europe-west1, and europe-southwest1. For the region-by-region capability matrix across all cloud…
TLS 1.3 is now supported on all Kafka cluster types. Basic, Standard, Freight, and Enterprise clusters support TLS 1.3 and TLS 1.2, with both protocol versions enabled and not configurable. Dedicated clusters have TLS 1.3 enabled by default on all newly created clusters, and existing Dedicated clusters without TLS 1.3 can enable it manually. For more information, see Manage Data in Transit with TL…
The fully-managed Salesforce SObject Sink connector now supports configurable null field handling through the ignore.null.fields property. Set it to true to ignore null fields and retain existing Salesforce values, or keep the default false to clear fields by writing null. This applies to both batched and non-batched scenarios. For more information, see Salesforce SObject Sink Connector for Conflu…
The io.confluent.kafka.server/client_limit_milliseconds metric is now available in the Metrics API. This metric identifies clients reaching established throughput limits. Use this metric to diagnose performance issues and optimize client configurations within quota limits. This metric provides the time duration of the throttling, the affected principal, the limit that was breached, and the reason…
Java Client users running on AWS services can now use an AWS STS WebIdentityToken to authenticate into Confluent Cloud through the new AWS IAM plugin. For more information, see Configure AWS IAM OAuth for Java Client.
Share groups now support new configurable limits: share.delivery.count.limit and share.renew.acknowledge.enable. You can configure these limits using the Confluent CLI and Confluent REST API. For more information, see the share group limits. You can now monitor Confluent Platform producer and consumer client metrics in USM using the Confluent Cloud Console. Client monitoring uses the KIP-714 clien…
The new Cloud Console connector overview page shows each connector’s configuration, status, and metrics together in one place, so you can manage settings and track health and throughput directly from the page. For more information, see Connect to External Services in Confluent Cloud. Confluent Cloud audit logs now record auditable events for Unified Stream Manager (USM) control plane operations. T…
Certificate revocation list (CRL) enforcement for mTLS client authentication is now supported for Enterprise and Freight clusters on AWS, in addition to Dedicated clusters on all clouds. For more information, see Certificate revocation for mTLS authentication on Confluent Cloud. Confluent Cloud now enforces fail-close CRL checking for mTLS client authentication, aligned with the OpenSSL -crl_check…
The fully-managed Salesforce Source V2 connector for Confluent Cloud is now generally available for your Apache Kafka® clusters on AWS, Azure, and Google Cloud. The connector optionally performs an initial historical load from Salesforce using Bulk API 2.0, and then either streams real-time Change Data Capture (CDC) events using the Pub/Sub API or periodically polls Salesforce for changes using Bu…
The iam/v2/api-keys Confluent Cloud API endpoint now supports authentication using Confluent STS access tokens (confluent-sts-access-token). For more information, see the API Keys (iam/v2) API documentation.
Cost allocation is now available as an Early Access feature in Confluent Cloud. Cost allocation itemizes your Confluent Cloud bill by the service account, user, identity pool, or resource that drove each charge, so you can feed internal chargeback or showback processes, split a shared cluster across the teams that use it, and reconcile usage to internal cost centers. For more information, see Cost…