Collapse navigation tree

Collapse

What’s New in Redpanda

This topic includes new content added in version 26.1. For a complete list of all product updates, see the Redpanda release notes. See also:

Cloud Topics

Cloud Topics are now available, making it possible to use durable cloud storage (S3, ADLS, GCS) as the primary backing store instead of local disk, eliminating over 90% of cross-AZ replication costs. This makes them ideal for latency-tolerant, high-throughput workloads such as observability streams, analytics pipelines, and AI/ML training data feeds, where cross-AZ networking charges are the dominant cost driver.

You can use Cloud Topics exclusively in Redpanda Streaming clusters, or in combination with traditional Tiered Storage and local storage topics on a shared cluster supporting low latency workloads.

Cloud Topics require Tiered Storage and an Enterprise license. For setup instructions and limitations, see Manage Cloud Topics.

Group-based access control (GBAC)

Redpanda 26.1 introduces group-based access control (GBAC), which extends OIDC authentication to support group-based permissions. In addition to assigning roles or ACLs to individual users, you can assign them to OIDC groups. Users inherit permissions from all groups reported by their identity provider (IdP) in the OIDC token claims.

GBAC supports two authorization patterns:

  • Assign a group as a member of an RBAC role so that all users in the group inherit the role’s ACLs.

  • Create ACLs directly with a Group:<name> principal.

Group membership is managed entirely by your IdP. Redpanda reads group information from the OIDC token at authentication time and works across the Kafka API, Schema Registry, and HTTP Proxy.

FIPS 140-3 validation and FIPS Docker image

Redpanda’s cryptographic module has been upgraded from FIPS 140-2 to FIPS 140-3 validation. Additionally, Redpanda now provides a FIPS-specific Docker image (docker.redpanda.com/redpandadata/redpanda:<version>-fips) for amd64 and arm64 architectures, with the required OpenSSL FIPS module pre-configured.

If you are upgrading with FIPS mode enabled, ensure all SASL/SCRAM user passwords are at least 14 characters before upgrading. FIPS 140-3 enforces stricter HMAC key size requirements.

See Configure Redpanda for FIPS for configuration details.

Iceberg: Expanded JSON Schema support

Redpanda now supports additional JSON Schema patterns when translating to Iceberg tables:

  • $ref support: Internal references using $ref (for example, "$ref": "#/definitions/myType") are resolved from schema resources declared in the same document. External references are not yet supported.

  • Map type from additionalProperties: additionalProperties objects that contain subschemas now translate to Iceberg map<string, T>.

  • oneOf nullable pattern: The oneOf keyword is now supported for the standard nullable pattern if exactly one branch is {"type":"null"} and the other is a non-null schema.

See Specify Iceberg Schema for JSON types mapping and updated requirements.

Ordered rack preference for Leader Pinning

Leader Pinning now supports the ordered_racks configuration value, which lets you specify preferred racks in priority order. Unlike racks, which distributes leaders uniformly across all listed racks, ordered_racks places leaders in the highest-priority available rack and fails over to subsequent racks only when higher-priority racks become unavailable.

User-based throughput quotas

Redpanda now supports throughput quotas based on authenticated user principals. Unlike client-based quotas (which rely on self-declared client-id values), user-based quotas enforce limits using verified identities from SASL, mTLS, or OIDC authentication.

You can set quotas for individual users, default users, or fine-grained user/client combinations. See About Client Throughput Quotas for conceptual details, and Set user-based quotas to get started.

Cross-region Remote Read Replicas

Remote Read Replica topics on AWS can be deployed in a different region from the origin cluster’s S3 bucket. This enables cross-region disaster recovery and data locality scenarios while maintaining the read-only replication model.

To create cross-region Remote Read Replica topics, configure dynamic upstreams that point to the origin cluster’s S3 bucket location. Redpanda manages the number of concurrent dynamic upstreams based on your cloud_storage_url_style setting (virtual_host or path style).

See Remote Read Replicas for setup instructions and configuration details.

Automatic broker decommissioning

When continuous partition balancing is enabled, Redpanda can automatically decommission brokers that remain unavailable for a configured duration. The partition_autobalancing_node_autodecommission_timeout_sec property triggers permanent broker removal, unlike partition_autobalancing_node_availability_timeout_sec which only moves partitions temporarily.

Key characteristics:

  • Disabled by default

  • Requires partition_autobalancing_mode set to continuous

  • Permanently removes the node from the cluster (the node cannot rejoin automatically)

  • Processes one decommission at a time to maintain cluster stability

  • Manual intervention required if decommission stalls

See Configure Continuous Data Balancing for configuration details.

New configuration properties

Storage mode:

  • default_redpanda_storage_mode: Set the default storage mode for new topics (local, tiered, cloud, or unset)

  • redpanda.storage.mode: Set the storage mode for an individual topic, superseding the legacy redpanda.remote.read and redpanda.remote.write properties

Cloud Topics:

Cloud Topics requires an Enterprise license. For more information, contact Redpanda sales.

Object storage:

Authentication:

Other:

Changes to default values

Removed properties

The following deprecated configuration properties have been removed in v26.1.1. If you have any of these in your configuration files, update them according to the guidance below.

RPC timeout properties:

Replace with internal_rpc_request_timeout_ms.

  • alter_topic_cfg_timeout_ms

  • create_topic_timeout_ms

  • metadata_status_wait_timeout_ms

  • node_management_operation_timeout_ms

  • recovery_append_timeout_ms

  • rm_sync_timeout_ms

  • tm_sync_timeout_ms

  • wait_for_leader_timeout_ms

Client throughput quota properties:

Use rpk cluster quotas to manage client throughput limits.

  • kafka_admin_topic_api_rate

  • kafka_client_group_byte_rate_quota

  • kafka_client_group_fetch_byte_rate_quota

  • target_fetch_quota_byte_rate

  • target_quota_byte_rate

Quota balancer properties:

Use broker-wide throughput limit properties.

  • kafka_quota_balancer_min_shard_throughput_bps

  • kafka_quota_balancer_min_shard_throughput_ratio

  • kafka_quota_balancer_node_period

  • kafka_quota_balancer_window

  • kafka_throughput_throttling_v2

Timestamp alert properties:

Other removed properties:

No replacement needed. These properties were deprecated placeholders that have been silently ignored and will continue to be ignored even after removal.

  • cloud_storage_disable_metadata_consistency_checks

  • cloud_storage_reconciliation_ms

  • coproc_max_batch_size

  • coproc_max_inflight_bytes

  • coproc_max_ingest_bytes

  • coproc_offset_flush_interval_ms

  • datalake_disk_space_monitor_interval

  • enable_admin_api

  • enable_coproc

  • find_coordinator_timeout_ms

  • full_raft_configuration_recovery_pattern

  • id_allocator_replication

  • kafka_memory_batch_size_estimate_for_fetch

  • log_compaction_adjacent_merge_self_compaction_count

  • max_version

  • min_version

  • raft_max_concurrent_append_requests_per_follower

  • raft_recovery_default_read_size

  • rm_violation_recovery_policy

  • schema_registry_protobuf_renderer_v2

  • seed_server_meta_topic_partitions

  • seq_table_min_size

  • tm_violation_recovery_policy

  • transaction_coordinator_replication

  • tx_registry_log_capacity

  • tx_registry_sync_timeout_ms

  • use_scheduling_groups