Release of new operator for support of kafka 3.4.0

[tommyJimmy87]

Hello everyone, I wanted to ask if there's a specific timeline for the release of the new operator that would support the newest version of Kafka 3.4.0 (I think this is the milestone https://github.com/strimzi/strimzi-kafka-operator/milestone/35). My customer doesn't allow to pull docker images with critical vulnerabilities which apparently the versions 3.3.1 and 3.3.2 have, here is the link to the vulnerability: https://avd.aquasec.com/nvd/2022/cve-2022-36944/

Thanks in advance for your reply!

[scholzj]

It would be good to keep all the discussions in one place and not if everyone starts a new one. That makes it a bit hard to judge the interest. Are you actually using the affected functionality? There is quite an easy workaround to disable the functionality which is actually affected.

[tommyJimmy87]

Hi thanks for the answer and sorry if I have duplicated the thread, and this caused duplication, if you want we can continue in the other thread and I can delete this one. Anyway, the main problem we have is that we are trying to use the quay.io/strimzi/kafka:latest-kafka-3.4.0 version and this is not allowed in the operator version of 0.33.1: This is the error I get while I try to use it :

	at io.strimzi.operator.cluster.ClusterOperatorConfig.parseKafkaVersions(ClusterOperatorConfig.java:479)
	at io.strimzi.operator.cluster.ClusterOperatorConfig.fromMap(ClusterOperatorConfig.java:293)
	at io.strimzi.operator.cluster.Main.main(Main.java:81)
Caused by: io.strimzi.operator.cluster.model.NoImageException: No image for version 3.4.0 in {3.2.3=quay.io/strimzi/kafka:latest-kafka-3.2.3, 3.3.2=quay.io/strimzi/kafka:latest-kafka-3.3.2, 3.2.0=quay.io/strimzi/kafka:latest-kafka-3.2.0, 3.2.1=quay.io/strimzi/kafka:latest-kafka-3.2.1, 3.3.1=quay.io/strimzi/kafka:latest-kafka-3.3.1}
	at io.strimzi.operator.cluster.model.KafkaVersion$Lookup.image(KafkaVersion.java:221)
	at io.strimzi.operator.cluster.model.KafkaVersion$Lookup.validateImages(KafkaVersion.java:257)
	at io.strimzi.operator.cluster.model.KafkaVersion$Lookup.validateKafkaImages(KafkaVersion.java:274)
	at io.strimzi.operator.cluster.ClusterOperatorConfig.parseKafkaVersions(ClusterOperatorConfig.java:465)
	... 2 more

If there's any workaround that would be great, cause at the moment we are blocked internally on it.

[scholzj]

You cannot do that. We will put together a patch release as there seems to be some demand. But it's new minor Kafka version, so it is a non-trivial change obviously which will take some time.

But in general, blindly blocking any CVE is stupid. This CVE is fairly simple. Are you using Kafka Connect? If yes, are you using the connector overrides? If yes, you are affected. If you don't use Connect, you are not affected. If you use Connect but not connector overrides, you can disable the overrides.

[scholzj]

FYI: We released 0.33.2 with Kafka 3.4.0.