Deploy production-grade Apache Kafka clusters in minutes. KRaft mode, declarative topic management, SASL & TLS security, and full Day-2 operations.
Deployment Modes
Open Source
Deploy Kafka in 3 steps
Install KubeBlocks
# Add Helm repo helm repo add kubeblocks https://apecloud.github.io/helm-charts helm repo update # Install KubeBlocks helm install kubeblocks kubeblocks/kubeblocks \ --namespace kb-system --create-namespace
Deploy a KRaft Combined Cluster
apiVersion: apps.kubeblocks.io/v1 kind: Cluster metadata: name: kafka-cluster namespace: demo spec: terminationPolicy: Delete clusterDef: kafka topology: combined_monitor # or separated_monitor componentSpecs: - name: kafka-combine replicas: 3
Cluster is Ready
$ kubectl get cluster kafka-cluster -n demo NAME CLUSTER-DEF TOPOLOGY STATUS AGE kafka-cluster kafka combined_monitor Running 3m
Trusted by Engineering Teams at Scale
BONC Cloud
China Mobile Cloud
China Telecom Cloud
Tencent
Xiaomi
Ping An
VIP.com
Kwai
Tiger Brokers
CITIC Securities
SealOS
FastGPT
KubeSphere
Momenta
360
Tilaa
Olares
Changan Automobile
State GridBONC CloudChina Mobile CloudChina Telecom CloudTencentXiaomiPing AnVIP.comKwaiTiger BrokersCITIC SecuritiesSealOSFastGPTKubeSphereMomenta360TilaaOlaresChangan AutomobileState GridChoose Combined mode for simplicity or Separated mode for independent scaling at large scale — both run on modern KRaft without ZooKeeper.
Each node acts as both a Kafka broker and a KRaft controller. The metadata quorum and message storage run on the same pods. Ideal for development, testing, and small-to-medium production clusters where operational simplicity matters.
Broker and controller roles on the same pods
No ZooKeeper dependency — pure KRaft consensus
Quorum of 3 nodes handles both metadata and data
Simpler architecture with fewer moving parts
SASL/TLS security can be enabled independently
kafka-cluster-kafka-combine-advertised-listener-0:9092,...kafka-{n}.kafka-cluster-kafka-combine-headless:9092A feature-by-feature breakdown based on publicly available documentation.
| Feature | KubeBlocks | Strimzi | Confluent for K8s |
|---|---|---|---|
| Open Source | ✓ | ✓ | ✗ |
| KRaft Mode | ✓ | ✓ | ✓ |
| ZooKeeper Mode (legacy) | ✓ | ✓ | ✓ |
| Combined Mode (broker+controller) | ✓ | ✓ | ✓ |
| Separated Mode | ✓ | ✓ | ✓ |
| TLS Encryption | ✓ | ✓ | ✓ |
| SASL (SCRAM-SHA-256/512) | ✓ | ✓ | ✓ |
| Topic management | ✓ | ✓ | ✓ |
| ACL management | ✓ | ✓ | ✓ |
| Quota management | ✓ | ✓ | ✓ |
| Dynamic config (no restart) | ~ | ~ | ~ |
| Horizontal scaling (broker) | ✓ | ✓ | ✓ |
| Minor version rolling upgrade | ✓ | ✓ | ✓ |
| Prometheus metrics | ✓ | ✓ | ✓ |
| Web management UI | Enterprise | ✗ | ✓ |
✓ = Supported · ~ = Partial / Limited · ✗ = Not supported
Enterpriseindicates a capability available in KubeBlocks Enterprise, not the open-source distribution. Contact us for licensing →
Based on publicly available documentation. Features may vary by version.
KubeBlocks automates the hardest parts of running Apache Kafka on Kubernetes — so your team doesn't have to.
No SSH into brokers, no direct kafka-topics.sh calls. Submit an OpsRequest and KubeBlocks handles the rest.
Kafka-Native Operations
Topic Management
Create, alter, and delete topics declaratively via OpsRequest — set partition count, replication factor, and per-topic config.
ACL Management
Grant and revoke fine-grained producer/consumer/admin permissions per user, host, and resource pattern via OpsRequest.
Quota Management
Set per-user and per-client bandwidth throttles (producerByteRate, consumerByteRate, requestPercentage) without direct broker config.
Horizontal Scaling
Add or remove broker nodes online. KubeBlocks handles pod lifecycle; use Kafka Cruise Control or kbcli for partition rebalancing.
Vertical Scaling
Resize CPU and memory requests/limits on running broker or controller pods with minimal disruption.
Volume Expansion
Expand PVC storage on broker nodes without pod restarts on supported storage classes.
Stop / Start
Suspend the cluster to save compute cost, then resume with full state preserved.
Security, Configuration & Observability
TLS Encryption
Enable in-flight TLS for client and inter-broker connections. Certificates auto-issued via cert-manager or the built-in KubeBlocks issuer.
SASL Authentication
SCRAM-SHA-256/512 authentication for client and broker connections. Credentials managed as Kubernetes Secrets.
Dynamic Configuration
Tune Kafka broker parameters via OpsRequest — changes applied without broker restart where the config supports it.
Minor Version Upgrade
Rolling broker-by-broker upgrades across Kafka 3.x minor versions with automated health checks.
Prometheus Metrics
Per-broker JMX Exporter sidecar (port 5556) for JVM metrics, plus a dedicated kafka-exporter pod (port 9308) for consumer group lag, partition offsets, and topic throughput. Grafana dashboards included.
Open source and production-ready. Enterprise customers get dedicated onboarding, migration support, and SLA guarantees.