The Advanced Security add-on is now available on Confluent Cloud as a Limited Availability release. This organization-level add-on bundles advanced security capabilities, including System for Cross-domain Identity Management (SCIM), self-managed encryption keys (BYOK), and higher limits for select security-related resources such as group mappings, identity pools, and RBAC role bindings. The add-on…
The Flink Table API for Confluent Cloud for Apache Flink is updated to Java plugin version 2.3-6 and Python package version 2.3.3 on Flink 2.3.0, adding the following features: AI functions: The AI_SENTIMENT and AI_DETECT_PII scalar functions and the AI_FORECAST and AI_DETECT_ANOMALIES aggregate functions are now supported through ConfluentMLExpressions. Changelog functions: The FROM_CHANGELOG and…
The fully managed Oracle XStream CDC Source connector includes the following updates: Optional SELECT_CATALOG_ROLE: The connector no longer requires granting SELECT_CATALOG_ROLE to the connect user. You can instead grant SELECT on an explicit list of catalog views. For more information, see Configure database users. Active Data Guard standby support: For cascading downstream capture, the connector…
The logical cluster ID OAuth extension, for example, logicalCluster or extension_logicalCluster, is no longer required for Kafka clients connecting to the following cluster types, on any cloud provider or networking type: Dedicated clusters Freight clusters Enterprise clusters with an lkc-based bootstrap URL For more information, see OAuth Configuration Reference for Confluent Cloud Clients.
Custom SMTs on fully managed connectors in Confluent Cloud can now make external network calls (egress) as a Limited Availability feature. Enabling external egress allows your Custom SMT to connect to endpoints outside Confluent Cloud, such as key management services (KMS), secret stores, or data enrichment APIs. For more information, see Enable External Network Calls from Custom SMTs.
IP filtering now supports protecting public Kafka and ksqlDB access, expanding on previous support for resource management, schema management, and Flink. For more information, see IP Filtering on Confluent Cloud.
IBM MQ Source connector now supports STRING and BYTES output data formats on Confluent Cloud. For more information, see Message body formats. The output key format is now configurable for IBM MQ Source connectors on Confluent Cloud. The input key format is now configurable for IBM MQ Sink connectors on Confluent Cloud.
Unified Stream Manager now supports alerting for your registered Confluent Platform clusters. USM monitors conditions such as offline partitions, broker storage exhaustion, and stalled telemetry, and delivers alerts through Confluent Cloud notifications. You can route alerts to your Confluent Cloud Console dashboard, email, Slack, Microsoft Teams, or a generic webhook. For more information, see Mo…
Secret manager integration with Confluent Cloud now extends to the following additional fully-managed connectors: HTTP Sink V2 HTTP Source V2 Oracle XStream CDC Source For more information, see Create a secret manager integration in Confluent Cloud.
You can now query the same data the Real-Time Context Engine queries for AI agents directly through an API, without an agent, as an Early Access Program feature. To do this, you issue a lightning query — a read against the materialized table Confluent maintains for a topic. For more information, see Lightning Queries.
FROM_CHANGELOG and TO_CHANGELOG, built-in changelog conversion functions for Confluent Cloud for Apache Flink, are now generally available. Use FROM_CHANGELOG to read change data that arrives in a custom format, such as a non-Debezium change data capture (CDC) source, into a table you can query, join, and aggregate. Use TO_CHANGELOG to turn an updating table back into an append-only stream with an…
Advanced Message Search is available for Open Preview in the Confluent Cloud message browser. Use it to build a filter that refines your results by the fields that matter to you. For example, refine results by a customer ID or a zip code anywhere in a topic’s retained history. You don’t need to write a consumer application or a separate stream-processing job. For more information, see Advanced Mes…
Secret manager integration with Confluent Cloud now extends to the following additional fully-managed connectors: Amazon DynamoDB CDC Source Amazon DynamoDB Sink AWS Lambda Sink Azure Blob Storage Sink Google BigQuery Sink V2 Redis Kafka Sink Redis Kafka Source For more information, see Create a secret manager integration in Confluent Cloud.
Tableflow now emits structured log events, such as sync failures and topic health changes, across the full lifecycle of a Tableflow-enabled topic. You can export these logs to third-party tools like Splunk and Datadog through Observability Integrations. For more information, see Tableflow log categories and events.
Single sign-on (SSO) configuration now has its own dedicated page in the Confluent Cloud Console at https://confluent.cloud/sso, separate from the Accounts & access page. Group mapping configuration remains on the Accounts & access page at https://confluent.cloud/settings/org/group-mappings. For more information, see Use Single Sign-on (SSO) for Authentication on Confluent Cloud and Group Mapping…
The fully-managed Amazon S3 Sink and Snowflake Sink connectors for Confluent Cloud now enable cross-region and cross-cloud connectivity. You no longer need to contact Confluent Support to connect to a destination in a different region or cloud provider than your Confluent Cloud cluster.
You can now view your Confluent Cloud notifications in one place. Click the bell icon in the Confluent Cloud Console to see a summary of recent notifications, and open the notifications dashboard to view and sort your notification history from the past 30 days. For more information, see Notifications for Confluent Cloud.
The Flink sqlv1 Statement and Materialized Table REST APIs now support auto pool mapping for OAuth identity pools, making the Confluent-Identity-Pool-Id header optional. When the header is omitted, Confluent Cloud automatically maps the OAuth token to all matching identity pools. You can also specify a comma-separated list of identity pool IDs in the header. For more information, see Use auto pool…
Snapshot queries in Confluent Cloud for Apache Flink® are now generally available on AWS, Azure, and Google Cloud. Run bounded, batch-mode Flink SQL queries to take a point-in-time snapshot of your streaming data, compute a result, and exit, using the same Flink SQL you already use for streaming. For more information, see Snapshot Queries and Run a Snapshot Query.
The Flink Table API for Java in Confluent Cloud for Apache Flink® is now generally available, with plugin version 2.3-3 on Flink 2.3.0. Build, test, and deploy stream-processing pipelines as regular Java applications, from your IDE or CI/CD pipeline, on the same serverless runtime that powers Flink SQL. This release adds global API keys as the recommended authentication method, OAuth 2.0 support w…
Confluent Cloud for Apache Flink is now available in four additional regions across Azure and Google Cloud: Azure: italynorth (Milan, Italy), mexicocentral (Mexico Central), southafricanorth (Johannesburg, South Africa) Google Cloud: europe-southwest1 (Madrid, Spain) All new regions support both public and private networking. For the complete list of supported regions, see Supported Cloud Regions…
The fully-managed Oracle XStream CDC Source connector now supports downstream capture topologies, in which the XStream capture process runs on a separate downstream Oracle database rather than the source. Two topologies are available: downstream capture (source ships redo directly to the downstream) and cascading downstream capture (redo travels through an Oracle Active Data Guard standby before r…
Confluent Cloud Gateway version 1.3.0 is now available. This release introduces the following features and enhancements: Centralized governance enforcement (Early Access): Confluent Gateway now validates messages and enforces data governance centrally with Confluent Schema Registry, ensuring only compliant records reach your Kafka clusters. Enforcing policies at Confluent Gateway reduces the data-…
Cluster deletion protection is now available for Confluent Cloud. Deletion protection is an opt-in safeguard that prevents accidental deletion of a Kafka cluster. You can enable it through the Confluent Cloud Console, Confluent CLI, REST API, or Terraform. When enabled, any request to delete the cluster fails until an authorized user disables protection. You also cannot delete an environment that…
The fully-managed Google Cloud Spanner CDC Source (Debezium) connector is now available for Confluent Cloud. The connector monitors a Google Cloud Spanner change stream and streams row-level inserts, updates, and deletes from Spanner tables to Apache Kafka® topics in near-real time. For more information, see Google Cloud Spanner CDC Source (Debezium) Connector for Confluent Cloud.
The io.confluent.kafka.server/consumer_lag_offsets metric now reports lag for any group that has been in the EMPTY state for less than one day. If you currently query the metric, you might notice an increase in returned response size due to the new data points that the metric returns. As a best practice, to control response size, audit and delete old consumer groups, and if possible restart existi…
Release priority is now available for Dedicated Kafka clusters with Premier support or higher. When you enable release priority on a cluster, it receives updates before your non-test clusters. For more information, see Release priority.
Custom Single Message Transformations (SMTs) are now available for fully-managed connectors running on Basic, Standard, and public Dedicated clusters. This feature is available in all supported regions. For details, see Custom SMT for Confluent Cloud Limitations and Support. The fully-managed PostgreSQL Source, PostgreSQL Sink, MySQL Source, and MySQL Sink (JDBC) connectors now support mutual TLS…
Secret manager integration with Confluent Cloud now supports Google Cloud Secret Manager. This feature enables Confluent Cloud to fetch sensitive configuration values such as secrets for your connectors at runtime from Google Cloud Secret Manager, removing the need to persist secrets within Confluent’s boundary. To explore its full range of features and get started, see Google Cloud Secret Manager…
The fully-managed HTTP Source V2 connector now supports schema evolution through the EVOLVE schema enforcement mode. EVOLVE requires a Schema Registry-based output.data.format (AVRO or JSON_SR) and the default TopicNameStrategy. For more information, see Schema evolution for HTTP Source V2. Client-side field level encryption (CSFLE) for Tableflow is available as a Limited Availability feature. Wit…