Skip to main content
StreamNative Private Cloud is an enterprise product which brings specific controllers for Kubernetes by providing specific Custom Resource Definitions (CRDs) that extend the basic Kubernetes orchestration capabilities to support the setup and management of StreamNative components. Release Date: 2026-08-04

​
What’s changed

​
🚀 New features

​
Agent Engine resources

  • Agent sessions: Added the AgentSession resource for managing agent session bindings.
  • Agent memory stores: Added the AgentMemoryStore resource for managing external agent memory provider bindings.
  • Agent triggers: Added the AgentTrigger resource to start agent workloads from Pulsar or Kafka messages.
  • Trigger session modes: Added per-event, per-topic, and per-key session modes, with support for agent references, registry authentication, custom resources, secrets, volumes, and pause control.
  • Agent provider configuration: Added agentProviders configuration for Functions Worker workloads.

​
Managed Kafka

  • Kafka tiered storage: Added tiered storage configuration for managed Kafka clusters with Amazon S3, Google Cloud Storage (GCS), and Azure Blob Storage backends.
  • Kafka SDT configuration: Added sdtEnabled support for Kafka clusters and integrated the StreamNative Data Teleport (SDT) interceptor with the compaction scheduler.
  • Topology spread constraints: Added topologySpreadConstraints configuration for Kafka node pools.
  • Kafka rack awareness: Added provider-zone label support for Kafka rack configuration.
  • Kafka Connect authentication: Added authentication configuration for Confluent schema converters.

​
Broker and protocol support

  • KoP JWT and mTLS listeners: Added JWT and mTLS listener configuration for Kafka-on-Pulsar brokers.
  • Dedicated schema registry gateway: Added support for exposing the KoP schema registry through a dedicated Istio Gateway and VirtualService.
  • Functions Worker metrics: Added standard Prometheus metrics to Functions Worker workloads.

​
🔧 Enhancements

  • Configurable broker disruption budgets: Added maxUnavailable and minAvailable to the broker PodDisruptionBudget template. When both are specified, minAvailable takes precedence.
  • Kafka and NodePool lifecycle: Improved handling of paused Kafka and KafkaNodePool resources during creation.
  • Kafka Connect startup probes: Added support for customizing the Kafka Connect startup probe through pod configuration.
  • Functions Worker observability: Added default Prometheus scrape labels to Functions Worker resources.
  • Default resource settings: Updated BookKeeper entry-location compaction defaults, RocksDB block-cache defaults, and broker unload thresholds.
  • Agent Trigger security: Added Kafka security protocol configuration for Agent Trigger workloads.
  • Istio integration: Improved handling of native sidecar pods and shared ZooKeeper TLS configuration.

​
🐛 Bug fixes and security updates

  • Fixed missing pods/finalizers permissions required for per-pod Istio resources.
  • Fixed affinity reconciliation loops caused by empty placement configuration.
  • Fixed storage-specific configuration so GCS memory-pool settings are applied only to GCS backends.
  • Fixed over-long secret volume names that could violate DNS-1123 naming requirements.
  • Replaced namespace unique identifier (UID) lookups with sub-resource UID lookups to reduce unnecessary cluster-scoped operations.
  • Updated the SDT interceptor package and turned off default topic storage when SDT is enabled.
  • Updated golang.org/x/crypto and golang.org/x/net to address 20 reported CVEs.
  • Updated the PostgreSQL driver, Go build dependencies, Alpine packages, and container base images to address security vulnerabilities.

​
🚨 Compatibility notes

  • The release adds new Custom Resource Definitions (CRDs) and role-based access control (RBAC) resources for Agent sessions, Agent memory stores, and Agent triggers. Apply the updated CRDs and RBAC manifests before upgrading the Operator.
  • If you use custom Kafka SDT settings or override the interceptor class, update the configuration to use the new ursa.sdt interceptor package.
  • If you use Kafka-on-Pulsar schema registry exposure through a PASSTHROUGH gateway, review the dedicated Gateway and VirtualService configuration.
  • If you configure broker PodDisruptionBudgets, set only one of minAvailable or maxUnavailable; minAvailable takes precedence when both are present.

​
📚 Documentation

  • Added the AgentSession, AgentMemoryStore, and AgentTrigger CRDs.
  • Refreshed CRD and RBAC manifests for Agent Engine, Kafka, Pulsar, Istio, and broker disruption-budget configuration.
  • Added API configuration for managed Kafka tiered storage, topology spreading, SDT, KoP listeners, and schema registry exposure.