// Kafka 3.x & ZooKeeper extended support
Your Kafka clusters still run on ZooKeeper.
Kafka 4.0 does not.
Kafka 4.0 runs only in KRaft mode, so every ZooKeeper-based cluster has to migrate its metadata on 3.x before it can upgrade. Until that happens you are running an unpatched broker line and an ensemble that is usually older still. OSSeva patches both and runs the migration.
Trusted globally by enterprises
Why ZooKeeper-based clusters are stuck
The ZooKeeper to KRaft migration is well documented and online. What stretches it out is everything around it.
No direct path from ZooKeeper to 4.x
A cluster must migrate to KRaft on a 3.x release, with 3.9 as the recommended bridge, and finalize that migration before it can take the 4.0 upgrade. The finalize step cannot be undone.
4.0 changes more than the metadata store
Kafka 4.0 also raises the Java baseline and removes old client protocol versions, so ancient clients and brokers pinned to old JVMs surface at the same time.
Confluent Platform 7.x is the last line with ZooKeeper
Clusters that run under Confluent Platform 7.x are tied to its support calendar as well as Kafka's, and extended ZooKeeper coverage sits on Confluent's higher support tiers.
The dates that matter
2024-11-06
Kafka 3.9 released: the final 3.x line and the last that can run with ZooKeeper.
2025-03-18
Kafka 4.0 released in KRaft-only mode. ZooKeeper support removed.
2026-12-02
Confluent Platform 7.8 end of support.
2027-02-19
Confluent Platform 7.9 end of support, the final ZooKeeper-capable Confluent line.
What OSSeva delivers
Patched Kafka 3.x brokers
Backported CVE fixes for the Kafka line you run, community Apache Kafka or the Apache core of a Confluent deployment, delivered through your own repository.
Patched ZooKeeper ensembles
Security fixes for the ZooKeeper versions your clusters depend on, the component most often forgotten in a Kafka inventory.
ZooKeeper to KRaft migration
Controller quorum sizing, migration mode, broker rolls, the finalize decision and the 4.x upgrade, run as a change programme across every cluster.
Your options, compared
| Option | What you get | Trade-off |
|---|---|---|
| Migrate to KRaft now | A supported 4.x path from the community | Every cluster needs its own migration window, and the finalize step has no rollback. |
| Confluent higher support tiers | Extended ZooKeeper coverage on Confluent Platform 7.x | Priced as a Confluent subscription tier, and limited to Confluent Platform deployments. |
| OSSeva extended support | Patched brokers and ZooKeeper, plus the migration | A subscription per cluster while you migrate. |
| Stay unpatched | Nothing | Broker and ZooKeeper advisories stay open on the system that carries your event data. |
Dates from the Apache Kafka release history and the Confluent Platform versions and interoperability documentation.
Frequently asked questions
Can I upgrade Kafka 3.x on ZooKeeper directly to 4.0?
No. Kafka 4.0 has no ZooKeeper support. Migrate to KRaft on 3.x first, ideally 3.9, finalize the migration, then upgrade to 4.x.
Who provides extended support for Kafka clusters still on ZooKeeper?
Confluent covers ZooKeeper on Confluent Platform 7.x through its support tiers. OSSeva patches community Kafka 3.x brokers and their ZooKeeper ensembles, whether or not they run under Confluent, and helps with the KRaft migration.
Do you patch ZooKeeper as well as Kafka?
Yes. The ensemble behind an old Kafka cluster is usually older than the brokers and carries its own advisories.
How long does a KRaft migration take?
For one healthy cluster, the technical steps take days. Across a fleet, with change windows and client clean-up, plan in quarters. Extended support covers the clusters that are waiting.
Patch the clusters that are waiting for KRaft.
Discovery call, cluster inventory, proposal within five working days.