Strimzi vs Confluent for Kubernetes: Which Kafka Operator should you run in production?

What is Strimzi?

Strimzi runs Apache Kafka clusters on Kubernetes or OpenShift in a range of deployment configurations (Strimzi on GitHub). It is licensed under Apache 2.0, so there is no licence key, no per-broker fee and no trial clock.

Everything is declared as Kubernetes custom resources: Kafka, KafkaNodePool, KafkaTopic, KafkaUser, KafkaConnect, KafkaConnector, KafkaMirrorMaker2 and KafkaBridge. Since Strimzi 1.0.0, all of these use the stable v1 API (CHANGELOG). That makes Strimzi a natural fit for GitOps with Argo CD or Flux.

How the Strimzi operators work

Strimzi ships three operators:

• Cluster Operator: creates and configures Kafka clusters, Kafka Connect, MirrorMaker 2 and the HTTP Bridge.
• Topic Operator: creates, updates and deletes Kafka topics from KafkaTopic resources.
• User Operator: manages Kafka users, their credentials and their ACLs from KafkaUser resources.

Each operator runs a reconciliation loop. It compares the state you declared with what is running and closes the gap. Strimzi also handles rolling restarts for you, which is why Axual's documentation warns against killing Kafka pods directly with kubectl (Axual docs).

Strimzi is KRaft-only. Support for ZooKeeper-based clusters was removed in Strimzi 0.46.0.

Who maintains Strimzi?

Strimzi is a Cloud Native Computing Foundation incubating project. Its maintainers are listed in the project's governance repository, and the community meets every two weeks, alternating between two time slots. Help is available on the #strimzi channel in CNCF Slack, the users mailing list and GitHub Discussions.

The project is active. Strimzi 1.3.0 added Early Access support for configurable internal cluster security and for cert-manager, and the latest tagged release at the time of writing is 1.3.1. Axual is listed in Strimzi's ADOPTERS.md.

What is Confluent for Kubernetes?

Confluent for Kubernetes is a cloud-native control plane for deploying and managing Confluent Platform in your own Kubernetes environment (Confluent docs). It declaratively deploys Kafka, Connect workers, ksqlDB, Schema Registry, Control Center, REST Proxy and KRaft, plus topics and role bindings.

CFK itself is installed and upgraded with Helm. After that, you manage Confluent Platform through custom resources (How CFK works). Two scope limits matter: CFK deploys Confluent Platform only, and it does not manage Confluent Cloud.

What is included with the Confluent Platform licence?

CFK is listed as a component under the Confluent Enterprise licence (Confluent Platform licences). You can run Confluent Platform for 30 days without a key; after that, Confluent components require licence keys (CFK licence docs).

The enterprise subscription covers commercial features such as Confluent Server, Control Center, Replicator and commercial or premium connectors, some only when named in the purchase order. Confluent's older licence documentation states that an enterprise licence is an annual subscription and that the software stops functioning once it expires (Confluent docs 6.2). Check the current terms with Confluent before you sign.

Licence changes in CFK are not free operationally either. Updating the licence through the CFK API requires a rolling restart of Kafka and other affected components.

Strimzi vs Confluent for Kubernetes: side-by-side comparison

Both are mature, declarative Kubernetes operators. The differences sit in licensing, what Kafka you run and who stands behind it.

Where does Strimzi fall short in production?

Strimzi's gaps are not in the operator. They are in everything around it: support, governance and the day-2 work your team owns. Teams that run it well say the same thing in our “is Strimzi production ready” blog: it is stable at scale, but success depends on operational discipline.

No SLA-backed support from the project

The Strimzi project offers community help through Slack, a mailing list and GitHub Discussions. That help is often excellent, but nobody is contractually obliged to answer at 2am. If Kafka is business-critical, you need either deep in-house expertise or a commercial support contract.

Governance and self-service are not included

Strimzi manages topics and users as YAML. It does not give application teams a self-service portal, schema governance, topic ownership or audit trails. Those are platform concerns you build or buy on top. Strimzi itself also ships no schema registry.

Day-2 operations: upgrades, rebalancing, certificate rotation

Day-2 work is where Strimzi teams spend their time:

• Upgrades. Every release can change behaviour. Strimzi 1.0.0 removed the v1beta2 API, and 1.3.0 dropped support for Kubernetes 1.30 and 1.31.
• Node maintenance. Kubernetes node drains and rolling restarts need planning; Strimzi Drain Cleaner is the usual mitigation.
• Rebalancing. Cruise Control handles partition rebalancing, including auto-rebalancing on scale-down.
• Certificate rotation. Strimzi runs its own cluster and clients CAs. Strimzi 1.3.0 adds cert-manager integration, though the changelog says it is not yet recommended for production.

Certificate handling is also where we have been bitten. In Strimzi 0.49.0, Kafka nodes moved from PKCS12/JKS stores to PEM certificates. For Axual's multi-tenant setup, that changed the certificate chain the broker saw, and our chain-based superuser principal stopped matching.

"A format change two layers down invalidated the broker's own identity. Override the principal builder, and you own that fragility on every upgrade."

Daniel Mulder, Software Engineer, Axual (StrimziCon 2026)

Daniel walks through the full fix in enterprise-grade Strimzi deployments.

Where does Confluent for Kubernetes fall short?

CFK is a capable operator. Its weaknesses are commercial and strategic rather than technical.

• Licence cost. CFK and the Confluent Platform components it deploys need an enterprise licence after 30 days.
• Lock-in to Confluent Platform. CFK only deploys Confluent Platform. Your brokers, connectors and tooling become Confluent-specific, which raises the cost of leaving later.
• Operational coupling to the licence. Renewing or replacing a licence through the CFK API means a rolling restart of Kafka and affected components.
• IBM ownership. IBM completed its roughly $11 billion acquisition of Confluent on 17 March 2026 (Techzine), and is integrating Confluent with watsonx.data, IBM MQ, webMethods and IBM Z. IBM also owns Red Hat. Whatever the roadmap brings, both major commercial Kafka-on-Kubernetes vendors now share a parent.

To be fair to Confluent, its bundled platform removes the need to assemble extra tooling. If you rely heavily on Confluent's commercial connectors or Control Center, account for replacing them before you switch.

Axual offers two packages (Strimzi support):

• Level 1, from €1,500 per month per cluster: business-hours (9 to 5) support for severity 1 and 2 issues, web and phone, unlimited cases, one business hour response time, one Kafka Connect cluster included.
• Level 2, from €2,500 per month per cluster: 24/7 support for severity 1 and 2 issues, access to an enhanced team, unlimited cases, 15-minute response time, one Kafka Connect cluster included.

Axual's support covers diagnosis, mitigation and recovery for Strimzi-based clusters, including MirrorMaker 2. Kafka connectors in general are not covered. Red Hat's documentation describes Streams for Apache Kafka as built on the Strimzi and Apache Kafka projects for OpenShift (Red Hat).

Which operator should you choose?

For most platform teams already running Kubernetes, Strimzi is the better default. Choose CFK when a Confluent subscription is already a given.

Choose Strimzi if:

• You want upstream Apache Kafka with no licence key or renewal date.
• You need to run on any Kubernetes distribution or OpenShift and keep the option to move.
• Your team already manages infrastructure through GitOps.
• You are willing to assemble your own schema registry, governance and observability, or buy a platform that provides them.
• You want commercial support without committing to a single vendor's Kafka distribution.

Choose Confluent for Kubernetes if:

• You already hold a Confluent Platform enterprise subscription.
• You depend on Confluent-specific components such as commercial connectors, Control Center or Replicator.
• You prefer one vendor for the broker, the operator and the support contract, and accept the lock-in that comes with it.

Axual's perspective: We love Strimzi

We bet on Strimzi years ago and we still would today. The Axual Platform deploys Kafka with the Strimzi Cluster Operator, and our 2026.1 documentation confirms it works with Strimzi without modifications (Axual docs). Earlier platform versions used a fork; we no longer need one. Our self-service layer handles topics, applications, schemas and access on top. Read why Axual uses the Strimzi operator for the history.

Lessons from Enexis. Enexis, a Dutch grid operator managing electricity and gas for over 3 million households and businesses, started streaming smart-meter data on the Axual Platform, built on Strimzi. The platform has scaled internally to more than 70 streams, 60 applications and 150 developers (Enexis Strimzi maturity). The lesson: teams adopt Kafka faster when they get governance and self-service, not just a cluster.

Lessons from multi-tenancy. We run multi-tenant Kafka for energy, banking and government, where each tenant can bring its own certificate authority. Two trusted CAs can sign the same certificate DN, so we build principals from the full certificate chain. Strimzi's per-listener configuration and type: custom authentication let us do this cleanly. The lesson: Strimzi is flexible enough for regulated, multi-tenant use, but you must know which parts lean on Strimzi internals.

Why we are excited about Strimzi 1.3.0. Daniel Mulder highlighted three features in this release: configurable internal cluster security, cert-manager integration and graceful rolling restarts on CNIs such as Cilium.

"Personally, the cert-manager integration is the one I'm most excited about."

Daniel Mulder, Software Engineer, Axual

Handing certificate issuing and renewal to cert-manager fits how many platforms already manage certificates. Because it is Early Access, our first stop is a test cluster, which matches Strimzi's own guidance.

Strimzi vs Confluent: Final words

Choosing how to run Kafka on Kubernetes? Connect with our team to discuss your requirements, or visit our Get Started page to try the Axual Platform and see how governance and self-service work on top of Strimzi.