live wire
▸AI · Red Hat documents usage-based admission fair sharing for Kueue 1.4 on OpenShiftRed Hat Developer▸AI: Red Hat maps governed firewall changes from ServiceNow through Ansible and two human approval gatesRed Hat Developer▸CLUSTER MGMT · ACM 2.17 makes Submariner 0.24 GA with Important-rated fixesRed Hat Errata▸PLATFORM · Red Hat makes on-premises Lightspeed recommendations GA for Satellite 6.18Red Hat Errata▸SECURITY · Red Hat Hardened Images updates Tomcat 10 for nine authentication, access-control and DoS flawsRed Hat Errata▸AI · Open Data Hub 3.6.0 EA1 bundles Trainer, MLflow and llm-d componentsOpen Data Hub▸AI · Speculators 0.6.0 adds P-EAGLE parallel drafting for vLLM speculative decodingRed Hat Developer▸SECURITY · OpenShift 4.17.57 fixes seven Go and TLS CVEs in an Important-rated updateRed Hat Errata▸AI · Red Hat benchmarks local LLM guardrails with EvalHub, exposing regex accuracy and latency trade-offsRed Hat Developer▸AI · Red Hat maps silent tool-call failures across agentic pipelinesRed Hat▸API · Kuadrant 1.5.3 adds GRPCRoute policies and developer-portal API-key workflowsKuadrant▸AI · (Aug 25) IBM releases Apache-2.0 Granite 4.2 reasoning models in 3B, 8B and 30B sizesIBM Research▸JAVA · Red Hat build of Quarkus 3.33.3.SP1 fixes 13 CVEs in an Important-rated updateRed Hat errata▸AI · vLLM moves Kimi K2 RL weight sync across 384 H100s in 7.53 seconds (Aug 22)vLLM▸AI · Red Hat documents usage-based admission fair sharing for Kueue 1.4 on OpenShiftRed Hat Developer▸AI: Red Hat maps governed firewall changes from ServiceNow through Ansible and two human approval gatesRed Hat Developer▸CLUSTER MGMT · ACM 2.17 makes Submariner 0.24 GA with Important-rated fixesRed Hat Errata▸PLATFORM · Red Hat makes on-premises Lightspeed recommendations GA for Satellite 6.18Red Hat Errata▸SECURITY · Red Hat Hardened Images updates Tomcat 10 for nine authentication, access-control and DoS flawsRed Hat Errata▸AI · Open Data Hub 3.6.0 EA1 bundles Trainer, MLflow and llm-d componentsOpen Data Hub▸AI · Speculators 0.6.0 adds P-EAGLE parallel drafting for vLLM speculative decodingRed Hat Developer▸SECURITY · OpenShift 4.17.57 fixes seven Go and TLS CVEs in an Important-rated updateRed Hat Errata▸AI · Red Hat benchmarks local LLM guardrails with EvalHub, exposing regex accuracy and latency trade-offsRed Hat Developer▸AI · Red Hat maps silent tool-call failures across agentic pipelinesRed Hat▸API · Kuadrant 1.5.3 adds GRPCRoute policies and developer-portal API-key workflowsKuadrant▸AI · (Aug 25) IBM releases Apache-2.0 Granite 4.2 reasoning models in 3B, 8B and 30B sizesIBM Research▸JAVA · Red Hat build of Quarkus 3.33.3.SP1 fixes 13 CVEs in an Important-rated updateRed Hat errata▸AI · vLLM moves Kimi K2 RL weight sync across 384 H100s in 7.53 seconds (Aug 22)vLLM
upstreambeat.ai
releaseDATA

Strimzi 1.2 tightens pod defaults while adding Kafka 4.3.1 support

The release makes server-side apply permanent, changes installation security contexts and gives operators new controls for volumes, builds and rebalancing.

Strimzi 1.1 versus 1.2 defaults and controls
AI-generated illustration
By The News Desk· Aug 22, 2026

Strimzi 1.2.0 is a substantial operator release rather than a maintenance update. Published Aug. 20, it adds Apache Kafka 4.3.1 support, makes the first phase of server-side apply permanently enabled and changes several pod and installation defaults that platform teams should review before upgrading.

What changed

The release adds templated additional volumes on a per-pod basis and lets Kafka Connect builds use configured Maven mirrors. Kafka connectors whose desired state is stopped or paused are now created directly in that state, instead of starting first and then being stopped or paused.

For Kafka 4.3 and later, Strimzi can cordon brokers during automatic rebalancing on scale-down. That gives the operator a clearer way to keep a broker out of the balancing path while capacity is being removed.

The installation artifacts also adopt a default container security context aligned with Kubernetes' Restricted Pod Security Standard. Cluster, Topic and User Operator YAML files, along with the Cluster Operator Helm chart, use the new default; users can override it through the relevant securityContext settings.

Strimzi also stops automatically mounting service-account tokens into pods and instead mounts them through a volume. Separately, the ServerSideApplyPhase1 feature gate has reached GA and can no longer be disabled.

Who should care

Teams operating Kafka on Kubernetes should pay attention if they customize pod security contexts, inject storage into individual brokers, build Kafka Connect images behind an internal Maven mirror or automate scale-down operations. The connector-state change also matters to controllers that create connectors in a deliberately inactive state.

The release supports Kafka 4.2.0, 4.2.1, 4.3.0 and 4.3.1 images. Its operator artifacts, Helm chart, CRDs, SBOM and in-toto provenance are attached to the release.

What to do

Before moving from Strimzi 1.1, compare any security-context overrides with the new Restricted defaults and test workloads that depend on service-account token mounting. Validate Kafka Connect build access to internal artifact repositories and exercise automated scale-down in a non-production cluster if broker cordoning will be used.

The project repeats an important migration boundary: Strimzi 1.x supports only the v1 CRD API. Clusters still carrying v1beta2, v1beta1 or v1alpha1 custom resources must convert those resources and update the CRDs before upgrading.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk