Skip to content

Kafdeck v0.6 — Fleet Operations and Secure Remote UI

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Sep 13:39
v0.6
63670ec
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Kafdeck v0.6 — Fleet Operations and Secure Remote UI

Kafdeck v0.6 is the active release line for the project.

This release advances Kafdeck from the v0.5 governed administration baseline toward a capability-driven Kafka fleet control plane. It also completes two operator-facing deployment improvements: safe remote/multi-address web binding and a Tabler-based branded dashboard using the Kafdeck logo.

Highlights

Remote and multi-address deployment

Kafdeck now supports the preferred Kafdeck:Deployment:ListenUrls[] setting while retaining backward compatibility with the legacy single ListenUrl.

Examples:

{
  "Kafdeck": {
    "Deployment": {
      "ListenUrls": [
        "http://0.0.0.0:8080"
      ],
      "AccessMode": "Token",
      "AccessToken": "env:KAFDECK_DEPLOYMENT_TOKEN"
    }
  }
}

or multiple explicit endpoints:

{
  "Kafdeck": {
    "Deployment": {
      "ListenUrls": [
        "http://127.0.0.1:8080",
        "http://192.168.10.20:8080"
      ],
      "AccessMode": "Token",
      "AccessToken": "env:KAFDECK_DEPLOYMENT_TOKEN"
    }
  }
}

Local mode remains loopback-only. Remote or wildcard binding requires the existing Token or OIDC boundary. Non-loopback OIDC bindings require HTTPS. Host filtering is derived from the validated listen endpoints.

Tabler operator dashboard and Kafdeck branding

The React operator UI now uses locally pinned @tabler/core 1.5.1 assets with no runtime CDN dependency. The existing Kafdeck logo is used in the application header and browser icon.

The shell includes responsive navigation, cards, tables, forms, alerts and badges, system light/dark behavior, reduced-motion support, and the existing blue/orange Kafdeck brand treatment.

Fleet capability truth

v0.6 adds a read-only capability surface:

GET /api/v1/fleet/capabilities
GET /api/v1/openapi/v0.6.json

The UI also includes a Fleet Operations — v0.6 view. Capability states are explicit: Supported, Unsupported, Blocked, Unconfigured, or Unknown. Kafdeck does not convert an unavailable provider API into a CLI, REST, reflection, raw-protocol, or sidecar escape path.

Fleet work admitted in v0.6

The release contains the governed domain/provider foundations for:

  • closed compound fleet authorization and risk contracts;
  • durable fleet progress, conflict obligations, fencing and recovery primitives;
  • ACL provider/domain contracts;
  • SCRAM provider/domain contracts with write-only credential material boundaries;
  • allowlisted typed dynamic broker/default configuration;
  • finite cross-cluster transfer plans, physical-cluster conflict identity, exact destination-partition production, durable no-replay dispatch checkpoints, and bounded source-range reading;
  • shared Kafka Connect guards that prevent MirrorMaker activation from bypassing Kafdeck governance.

These foundations are not all public mutation surfaces. The capability catalog reports production activation truth separately.

Explicit v0.6 capability limitations

The following are intentionally not advertised as active mutation capabilities in v0.6:

Capability v0.6 state Reason
ACL administration Blocked typed provider/domain work is admitted, but the production v0.6 API/runtime does not register the W42 mutation handler surface
SCRAM administration Blocked typed provider/domain work is admitted, but the production v0.6 API/runtime does not register the W43 mutation handler surface
Allowlisted dynamic configuration Blocked typed provider/domain work is admitted, but the production v0.6 API/runtime does not register the W44 mutation handler surface
Client quotas Unsupported pinned Confluent.Kafka 2.15.1 exposes no typed ClientQuotas describe/alter API
Preferred leader election Blocked the provider primitive exists, but the complete W45 production safety/readback surface is not activated
Partition reassignment Unsupported pinned Confluent.Kafka 2.15.1 exposes no typed reassignment submit/list API
Replication-factor changes Unsupported the admitted path depends on typed reassignment
Reassignment throttles Blocked not exposed independently from the unavailable reassignment lifecycle
Broker maintenance Blocked required typed evacuation/reassignment/unregister lifecycle is incomplete
Log-directory maintenance Unsupported no complete admitted typed pinned-client lifecycle exists
Finite cluster transfer Blocked durable planning/dispatch/source-range foundations exist, but the long-running current-identity orchestration path is not activated
Managed MirrorMaker 2 activation Blocked standard MM2 cannot enforce Kafdeck lifetime byte/record/rate/revocation guarantees

Blocked and Unsupported are intentional release states, not hidden failures.

Kafka compatibility baseline

The release validation matrix retains:

  • Kafka 4.3.1 — Tier 1
  • Kafka 4.2.1 — Tier 1
  • Kafka 4.1.2 — Tier 1
  • Kafka 3.9.2 — Tier 2

Support remains capability-driven. A version appearing in the matrix does not imply every v0.6 fleet mutation is available on that version.

Upgrade from v0.5.1

  • Existing ListenUrl deployments remain accepted.
  • ListenUrls[] is the preferred form for new deployments.
  • The default application configuration remains loopback-only.
  • Existing v0.5 mutation and persistence identities are retained; v0.6 does not reinterpret an unresolved v0.5 mutation as safe to replay.
  • Existing operator authorization and antiforgery requirements remain in force.
  • Tabler assets are included in the built frontend; no Internet connection is required at runtime.

Review the deployment configuration before exposing Kafdeck on a management network. Do not expose development Kafka PLAINTEXT listeners to untrusted networks.

Supply-chain release

The governed publication workflow builds the release candidate from the exact protected-main SHA, validates backend/frontend tests and the Kafka compatibility matrix, generates an SPDX SBOM, scans the exact OCI candidate for High/Critical vulnerabilities, signs the approved digest, and publishes immutable release tags.

Immutable OCI image

ghcr.io/araditc/kafdeck@sha256:cc0913c8421552c84888911779f79a09f25614901430fd6e58be2e8cadfce818

SBOM and vulnerability-scan evidence are retained by the release workflow for source SHA 63670ec06d039e13c096b2d08828ebfe228f979c.

Assets 2
Loading