{
 "slug": "kafka",
 "name": "Apache Kafka",
 "tagline": "Distributed event streaming platform in KRaft mode with a web UI",
 "category": "messaging",
 "use_cases": [
  "event-streaming",
  "pub-sub",
  "log-pipelines"
 ],
 "aliases": [
  "apache kafka"
 ],
 "status": "live",
 "upstream": {
  "vendor": "Apache Software Foundation",
  "url": "https://kafka.apache.org",
  "license": "Apache-2.0",
  "license_url": "https://www.apache.org/licenses/LICENSE-2.0"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   443,
   9093
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "4.4.0",
   "last_build": "2026-10-25",
   "entity_id": "prod-rts4w5362lpzi",
   "ami_alias": "/aws/service/marketplace/prod-rts4w5362lpzi/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-raohep6qmwpza",
   "recommended_instance_type": "t3.large",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "4.3.1",
   "last_build": "2026-08-31",
   "offer_id": "kafka",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:kafka:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.kafka?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/kafka/",
  "json": "https://lynxroute.com/products/kafka/product.json"
 },
 "release_notes": [
  {
   "version": "4.4.0",
   "title": "Apache Kafka 4.4.0",
   "notes": "* Apache Kafka updated 4.3.2 -> 4.4.0, a feature release. Apache-2.0 unchanged\n* New: dead-letter queues for share groups, CIDR host patterns in ACLs, controller unregistration (kafka-cluster.sh unregister-controller)\n* Security: protocol decoders now cap array and collection allocations; Jetty updated to 12.0.39\n* Security: snappy-java 1.1.10.11 and lz4-java 1.11.4 kept at the patched versions (upstream 4.4.0 bundles older, vulnerable builds)\n* Fix: snappy and zstd compression now work on the hardened image (JVM temp directory moved off the noexec /tmp)\n* Deprecated upstream: broker.id (use node.id, already used here) and kafka-broker-api-versions.sh (use kafka-cluster.sh api-versions)\n* Kafbat UI remains at 1.4.2\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-25"
   }
  },
  {
   "version": "4.3.2",
   "title": "Apache Kafka 4.3.2",
   "notes": "* Apache Kafka updated 4.3.1 -> 4.3.2, a bugfix release. Apache-2.0 unchanged\n* Fixes two data-loss bugs (KAFKA-20732, KAFKA-20979)\n* Security: jackson-databind updated for CVE-2026-54512, CVE-2026-54513, CVE-2026-54515 and CVE-2026-68497; log4j, Jetty and lz4 dependencies updated\n* Kafbat UI remains at 1.4.2\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23"
   }
  },
  {
   "version": "4.3.1",
   "title": "Apache Kafka v4.3.1",
   "notes": "* Same upstream version (AWS rejects a duplicate VersionTitle, hence the \"v\"). Log rotation no longer silently stops the Kafbat UI logging: the unit writes via StandardOutput=append:, so systemd owns the fd and the previous `create` rotation left the service writing into the old renamed file while the live log stayed empty. Now uses copytruncate. Kafbat UI stays at 1.4.2: 1.5.0 requires Java 25 and the image runs OpenJDK 21.\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base.\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-31",
    "azure": "2026-08-31"
   }
  },
  {
   "version": "4.3.0",
   "title": "Apache Kafka 4.3.0 - Initial release (June 2026)",
   "notes": "* Apache Kafka 4.3.0 on Ubuntu 24.04 LTS (KRaft mode, no ZooKeeper, OpenJDK 21)\n* Kafbat UI management console (Apache-2.0) bundled as a systemd service\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Internal broker listener bound to 127.0.0.1:9092; Kafbat UI behind nginx TLS on 443\n* External clients over a SASL_SSL listener on 9093 (SCRAM-SHA-256); user + keystore generated at first boot\n* Kafbat UI admin password generated at first boot; login-form authentication\n* Runs as non-root kafka user (UMask 0027); JVM heaps set explicitly\n* certbot pre-installed for CA-signed TLS certificates\n* UFW firewall pre-configured (ports 22, 443, 9093 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-06-18"
   }
  }
 ],
 "release_history": [
  {
   "version": "4.4.0",
   "aws": "2026-10-25"
  },
  {
   "version": "4.3.2",
   "aws": "2026-10-23"
  },
  {
   "version": "4.3.1",
   "aws": "2026-08-31",
   "azure": "2026-08-31"
  },
  {
   "version": "4.3.0",
   "aws": "2026-06-18"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-rts4w5362lpzi/latest \\\n  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer kafka --plan payg-gen2\naz vm create -g my-rg -n kafka --size Standard_D2s_v3 \\\n  --image lynxroute:kafka:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Apache Kafka is the world's most widely deployed distributed event streaming platform, maintained by the Apache Software Foundation. It powers high-throughput, low-latency data pipelines, messaging, event sourcing and stream processing. Kafka 4.x runs entirely in KRaft mode (the Kafka Raft metadata protocol) - ZooKeeper has been removed - so this image ships a single, self-contained combined controller+broker node. This build ships the official Apache binary distribution (verified against the upstream SHA-512 checksum) on OpenJDK 21, as a non-root service. It contains ONLY the Apache-2.0 licensed distribution - no proprietary add-ons - so it is fully auditable with no vendor lock-in.",
  "image_adds": "Management UI:\n* Kafbat UI (Apache-2.0) bundled as a systemd service - browse topics, consumer groups, messages and broker config from your browser\n* The UI is bound to loopback behind an nginx TLS perimeter on port 443 with login-form authentication; the admin password is generated at first boot\n\nSecurity hardening:\n* Internal broker listener bound to 127.0.0.1:9092 (PLAINTEXT, used only by the bundled UI) - never exposed off-box\n* External clients connect over a SASL_SSL listener on port 9093 (SCRAM-SHA-256 authentication + TLS); the client user, password and self-signed broker keystore are generated uniquely at first boot\n* All first-boot secrets written to /root/kafka-credentials.txt and /root/kafka-client.properties (mode 600) - nothing sensitive is baked into the image\n* Runs as a non-root kafka system user with UMask 0027; JVM heaps set explicitly\n* UFW firewall pre-configured (only ports 22, 443 and 9093 open)\n* certbot pre-installed - one command swaps the self-signed UI cert for a CA-signed one\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}