KafkaGuard
Get started
FeaturesDocsEnterprisePricingBlogToolsGet started

Changelog

Release notes and version history

Changelog

Release notes and version history for KafkaGuard. For the complete changelog with detailed release notes, see GitHub Releases.

Latest Release

KafkaGuard v2.3.0

Release Date: April 2026

Slack / Teams / Webhook Alerting

  • --alert-slack-webhook — Fire a Slack Block Kit message after every scan (or when score drops below --alert-threshold)
  • --alert-teams-webhook — Fire a Microsoft Teams MessageCard with score, failing controls, and dashboard link
  • --alert-webhook — POST the raw AlertPayload JSON to any HTTP endpoint (PagerDuty, Discord, custom)
  • --alert-threshold — Only alert when compliance score drops below N% (0 = always alert)
  • --dashboard-url — Embed a clickable dashboard link in Slack/Teams alert messages
  • Config file support — Persist webhook URLs in .kafkaguard.yaml under the alert: key

Multi-Cluster Trend Dashboard

  • /dashboard/trends — Compliance score timeline with Recharts, period selector (7d / 30d / 90d / 1y), regression highlighting in red
  • /dashboard/compare — Fleet-grid view: one card per cluster showing current score, delta badge, and inline sparkline
  • API — GET /api/v1/trends/:clusterId?period= and GET /api/v1/trends/compare?period= backed by the existing scans table

PDF Report Polish

  • Real version — PDF metadata now carries the actual scanner version, not hardcoded 1.0.0
  • Severity bar chart — Visual green/red horizontal bars per severity tier (HIGH / MEDIUM / LOW) in the executive summary
  • Sign-off page — --sign-off "Name, Title" appends a compliance sign-off page with prepared-by, date, and signature line
  • kafkaguard report generate — Regenerate PDF/HTML/JSON/CSV from any stored scan JSON (--input for local file, --scan-id + --api for on-prem API fetch)
  • GET /api/v1/scans/:id/raw — Stream the MinIO-stored scan JSON blob over the API (org-scoped, 404 for unknown/cross-org)

KafkaGuard v2.1.0

Release Date: April 2026

Kafka 3.9.x / 4.x (KRaft) + Confluent Platform Detection

  • KRaft cluster support — Detects and scans Kafka 3.9.x and 4.x clusters running without ZooKeeper (KRaft mode)
  • Cluster mode field — cluster_mode: kraft | zookeeper surfaced in all report formats
  • ZK controls auto-skip — ZooKeeper-specific controls (KG-040–KG-049) automatically skip on KRaft clusters instead of failing
  • 3 new KRaft controls — KG-052 (controller quorum health), KG-053 (ISR checks), KG-054 (quorum voter count)
  • Confluent Platform detection — Detects CP deployments, reports CP version and expected Kafka version
  • KG-055 — New control: Confluent Platform version consistency check
  • Test cluster — Added KRaft test cluster using Confluent Platform 8.3 (Kafka 4.2.x)

KafkaGuard v2.0.0

Release Date: April 2026

Enterprise On-Prem Platform

  • Air-Gapped Deployment - Full Docker Compose stack (API, Worker, Dashboard, PostgreSQL, MinIO, Redis)
  • Next.js 14 Dashboard - Web UI with cluster management, scan results, findings, and admin pages
  • Multi-Cluster Management - Monitor multiple Kafka clusters from a single dashboard
  • RESTful API (Fastify) - Comprehensive API with OpenAPI/Swagger documentation
  • Background Scan Worker - Redis-backed job queue for asynchronous scan processing

Licensing & Security

  • Offline License Validation - RSA-signed license keys with offline verification
  • Machine Fingerprint Binding - Licenses bound to specific machines
  • JWT + API Key Auth - Dual authentication with role-based access control
  • Row-Level Security (RLS) - PostgreSQL RLS for multi-tenant data isolation
  • Audit Logging - Full compliance trail for all operations

New Policy & Compliance

  • Finance ISO Policy - 50 security controls for regulated financial industries
  • Policy Tier System - Tiered compliance policies (baseline, standard, finance-iso)
  • Remediation Guidance - Actionable fix instructions embedded in findings

Operations & Deployment

  • Air-Gapped Installer - Preflight checks, secret generation, and service seeding
  • Upgrade Script - Image reload, DB migration, and rolling restart support
  • Backup/Restore - Automated backup before upgrades with restore capability
  • HTTPS via Nginx - Reverse proxy with TLS certificate setup
  • --upload Flag - Push CLI scan results directly to the On-Prem API

KafkaGuard v1.0.0

Release Date: November 2025

Core Features

  • Comprehensive Security Assessment - Scan entire Kafka clusters for security vulnerabilities
  • Multi-Format Reporting - HTML, JSON, PDF, and CSV report formats
  • Policy-Driven Analysis - 40+ security controls across multiple compliance frameworks
  • Enterprise Ready - Optimized for large-scale Kafka deployments

Security & Compliance

  • Cryptographic Signatures - All binaries signed with cosign
  • SHA256 Checksums - Integrity verification for all downloads
  • SBOM Generation - Software Bill of Materials for supply chain transparency
  • Compliance Frameworks - PCI-DSS, SOC2, and ISO 27001 mappings

Technical Highlights

  • Multi-Platform Support - Linux (x86_64, ARM64) and macOS (x86_64, ARM64)
  • Performance Optimized - Efficient scanning for large clusters (~10 seconds for 3-node cluster)
  • Lightweight - Single static binary under 50MB
  • Enterprise Authentication - Full support for SASL, TLS, mTLS, and Kerberos

Policy Tiers

  • baseline-dev (20 controls) - Development and testing environments
  • enterprise-default (40 controls) - Production environments
  • finance-iso (50 controls) - Regulated industries

View All Releases

For complete release notes, download links, and detailed changelog, visit:

GitHub Releases

GitHub Releases includes:

  • Release Notes - Detailed changelog for each version
  • Download Links - Binaries for all platforms
  • Checksums - SHA256 checksums for verification
  • Signatures - Cryptographic signatures for security
  • Breaking Changes - Migration guides for major versions

Release Schedule

KafkaGuard follows semantic versioning (MAJOR.MINOR.PATCH):

  • MAJOR - Breaking changes
  • MINOR - New features (backward compatible)
  • PATCH - Bug fixes and minor improvements

Releases are published on GitHub Releases when ready. Watch the repository to be notified of new releases.

Version History

v1.0.0 (November 2025)

Initial Release

  • 40+ production-ready security controls
  • 4 report formats (JSON, HTML, PDF, CSV)
  • 3 policy tiers (baseline-dev, enterprise-default, finance-iso)
  • Enterprise authentication support (SASL, TLS, mTLS, Kerberos)
  • PCI-DSS, SOC2, and ISO 27001 compliance mappings
  • Multi-platform support (Linux, macOS, Docker)
  • CI/CD integration ready

Stay Updated

To stay informed about new releases:

  • Check GitHub Releases regularly
  • Watch the releases repository for notifications
  • Visit this changelog page for release notes

Upgrade Guide

When upgrading KafkaGuard:

  1. Check Release Notes - Review breaking changes and new features
  2. Backup Configuration - Save your configuration files
  3. Download New Version - Get the latest binary from GitHub Releases
  4. Verify Installation - Run kafkaguard version to confirm
  5. Test in Staging - Test new version in non-production first

For detailed upgrade instructions, see the Installation Guide.

Reporting Issues

Found a bug or have a feature request?