OSSEVA FOR APACHE KAFKA
Kafka support for real Apache Kafka. Patched. Operated. Priced per cluster.
OSSeva provides Apache Kafka support for Kafka 2.8.x through 4.x, including patched builds for 2.8.x to 3.9.x after upstream stops fixing them. Reference architectures for high-throughput clusters and 24/7 managed operations come with it, priced per cluster, not per GB of throughput.
Reply within 1 business day · No commitment · or book a 15-minute call
Which vendors provide patched Apache Kafka after end of life? Kafka End of Life Support: 3.x on ZooKeeper, then KRaft.
Last reviewed
Trusted globally by enterprises
Why now
Confluent Platform pricing scales with throughput, not with value
Confluent Platform is Apache Kafka plus components under three separate licences, and its enterprise features need a paid subscription. The cost therefore tracks Confluent's licensing rather than how much support you consume, and the components hardest to remove are the licensed ones. We do not publish Confluent's prices — compare your renewal quote against a per-cluster model directly.
Kafka 2.8.x: past community maintenance window
Kafka 2.8.x and earlier are outside the community support window. CVEs accumulate. OSSeva ships patches for versions your team is actually running.
Compliance requires a patched runtime
Financial Services, Healthcare, and Public Sector all require evidence that your event streaming runtime receives security patches. An unsupported Kafka version fails that evidence test.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| 2.8.x | Extended | Clean |
| 3.0.x | Extended | Clean |
| 3.3.x | Extended | Clean |
| 3.6.x | Extended | Clean |
| 3.7.x | Extended | Clean |
| 3.8.x(Archived upstream — OSSeva patched) | Extended | Clean |
| 3.9.x(Last ZooKeeper-capable line, final 3.9.2 — OSSeva patched) | Extended | Clean |
| 4.x(KRaft only) | Current | Clean |
Running a Apache Kafka version or build not listed here?
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
CVE remediation for the Kafka version you're actually running.
- Quarterly CVE patches for covered versions
- Signed artifacts via OSSeva registry
- Broker & client library patches
- Vulnerability disclosure notifications
- Architecture review
- 24/7 managed operations
OSSeva Assure
Patch plus architecture review and compliance documentation.
- Everything in Patch
- Cluster configuration audit
- Throughput & latency review
- Compliance attestation package
- Migration design from Confluent Platform
- 24/7 reactive support
OSSeva Operate
Full MSP: broker fleet monitoring, incident response, named SREs.
- Everything in Assure
- 24/7 broker & consumer-lag monitoring
- 15-minute P1 incident response SLA
- Capacity planning & scaling operations
- Kafka Streams / Connect operational support
- Quarterly architecture reviews
All tiers priced per cluster/application — not per core.
Want Apache Kafka run for you, end-of-life versions included? Read about managed Kafka from OSSeva Operate.
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
helm repo add osseva https://charts.osseva.io
helm install kafka osseva/kafka \
--version 3.6.2-osseva-1 \
--namespace streaming \
--set replicaCount=3 \
--set zookeeper.enabled=false \
--set kraft.enabled=trueMigrate from Confluent Platform / Confluent Cloud
Confluent adds a proprietary layer (Schema Registry, ksqlDB, Control Center) on top of Apache Kafka. If you're not using those Confluent-specific features, you're paying for them anyway. OSSeva migrates you back to upstream Apache Kafka with no data loss and full CVE coverage.
Pricing model
OSSeva for Kafka is priced per cluster, not per broker, partition, or throughput tier.
Do you support KRaft mode (no ZooKeeper)?
Yes. OSSeva covers both ZooKeeper-mode and KRaft-mode deployments. KRaft is the recommended path for all new deployments and all migrations from Confluent.
What about Kafka Connect and Kafka Streams?
OSSeva Patch covers the core Kafka broker and client libraries. Kafka Connect and Streams patches are included in Assure and Operate tiers, where we also validate connector compatibility with patched broker versions.
Who provides Kafka support besides Confluent?
Confluent sells Confluent Platform and Confluent Cloud, which add its own components on top of Apache Kafka. Cloud providers run managed Kafka services inside their own platforms, and third-party support companies cover the upstream Kafka you run yourself. OSSeva is a third-party provider and a Confluent alternative: one contract can cover Kafka and the rest of your open source stack, Kafka 2.8.x to 3.9.x are included after upstream stops patching them, and everything runs on your own clusters.
Does OSSeva support current Kafka versions or only end-of-life ones?
Both. Kafka 4.x, the current KRaft-only line, is covered alongside 2.8.x to 3.9.x on extended support, in ZooKeeper or KRaft mode. OSSeva Patch covers the broker and client libraries, Assure adds Kafka Connect and Streams patches and a cluster configuration audit, and Operate adds 24/7 broker and consumer-lag monitoring with a 15-minute P1 incident response SLA.
How is OSSeva Kafka support priced?
OSSeva for Kafka is priced per cluster, not per broker, partition or throughput tier. The tier you choose (Patch, Assure or Operate) sets what is included. Book a discovery call for a quote.
Get a quote
Ready to get Apache Kafka patched and supported?
Tell us your Apache Kafka versions and an engineer replies within 1 business day with coverage and a price. Prefer a call? It takes 15 minutes.
Prefer to talk or read more first?