Monedula
monedula-gitops docs menu

Supported platforms and versions

Which Apache Kafka, Confluent Platform and Confluent Cloud features monedula-gitops supports, and the broker and registry versions tested in CI.

Concepts 5 of 6

3 min read

Updated 9 October 2026

Markdown

On this page

monedula-gitops talks to Kafka through the standard Kafka Admin API, to Schema Registry through the Confluent Schema Registry REST API, and to Confluent RBAC through the Confluent Platform Metadata Service (MDS). Which platforms support a feature follows from which of those APIs they expose.

Support matrix

Capability Apache Kafka Confluent Platform Confluent Cloud
Topics and ACLs Yes Yes Yes, validated 2026-07-09
Quotas and SCRAM users Yes Yes No, not exposed by Cloud
Schema Registry Yes Yes Yes, validated 2026-07-09
MDS/RBAC role bindings No, Apache Kafka has no MDS Yes No, Cloud uses a different API that is not implemented

Topics, ACLs, quotas and SCRAM users use standard Admin API calls such as CreateTopics, CreateAcls, AlterClientQuotas and AlterUserScramCredentials, so they behave the same on Apache Kafka and Confluent Platform.

Confluent Cloud

Topics, ACLs and Schema Registry were validated on 2026-07-09 against a live Confluent Cloud Basic cluster: topic create and alter, drift detection and reconciliation, ACLs, schema registration and evolution, and import. Confluent Cloud is not part of CI; its results come from manual validation runs, and the matrix changes only after a real run.

On Confluent Cloud:

  • ACL principals use the numeric service account id, for example User:9207877, never the sa-... resource id. Cloud acknowledges an ACL create for an sa- principal and then silently drops it, and ACL reads return the numeric id, so apply reports success while the ACL shows as missing on every run and verify keeps exiting 1.
  • Some topic configs are policy-restricted, and Cloud rejects them.
  • The quota and SCRAM APIs are not available, and Cloud rejects client-quota describes with CLUSTER_AUTHORIZATION_FAILED. Topic-only pipelines still work, because live state is read only for the kinds your manifests declare, and import cluster needs --skip-users and --skip-quotas.
  • KafkaRoleBinding does not work, because Cloud authorizes RBAC through its own API, which monedula-gitops does not implement.

Schema Registry

Schema registration and compatibility governance require only the Confluent Schema Registry REST API: self-hosted Confluent Schema Registry, the one bundled with Confluent Platform, Confluent Cloud’s managed Schema Registry and any other registry compatible with that API.

Versions tested in CI

The adapter integration tests run on each pull request; the end-to-end scenario suite runs nightly, on every push to the main branch and on demand. Every image below covers topics, ACLs, quotas and SCRAM users, and an image paired with a Schema Registry image also covers Schema Registry. confluentinc/cp-server:7.6.13 also covers MDS role bindings.

Image Schema Registry Suites
apache/kafka:3.9.2 none integration
apache/kafka:4.0.2 none integration
apache/kafka:4.3.1 confluentinc/cp-schema-registry:8.3.1 integration, scenarios
confluentinc/cp-kafka:7.6.13 confluentinc/cp-schema-registry:7.6.13 integration
confluentinc/cp-kafka:7.9.9 confluentinc/cp-schema-registry:7.9.9 integration, scenarios
confluentinc/cp-kafka:8.0.7 confluentinc/cp-schema-registry:8.0.7 integration
confluentinc/cp-kafka:8.3.1 confluentinc/cp-schema-registry:8.3.1 integration, scenarios
confluentinc/cp-server:7.6.13 none scenarios

Authentication

A KafkaCluster connects to the brokers with no authentication, SASL PLAIN, SCRAM-SHA-256, SCRAM-SHA-512, OAUTHBEARER with the OIDC client-credentials flow, or mutual TLS. The broker connection can use TLS with the system trust store or a private CA, and mutual TLS requires it. Schema Registry and MDS connections use HTTP basic auth or TLS client certificates, and MDS also accepts a bearer token. Connect to a secured Kafka cluster shows each configuration.

Kubernetes

The operator’s Helm chart requires Kubernetes 1.25 or newer. The optional admission webhook needs a serving certificate, from cert-manager or your own, as Configure the Kubernetes operator describes.