At a glance
CMAK scores 26 out of 90 on this page's five weighted criteria: it takes its best score on Cost as teams grow (10 out of 10) and its lowest on Support and maintenance (1 out of 10). The rubric is weighted: Support and maintenance counts three times, Access control and audit counts three times, and Cost as teams grow, Deployment footprint and Multi-cluster reach count once. Cost a year, 3 clusters: $0 Apache 2.0, about $11,520 to run. The other options, in the order this page lists them: Kpow 82, Kafbat UI 60, AKHQ 57, Redpanda Console 55, Confluent Control Center 46, each out of 90. Listed first because it is our product. Every per-criterion score is unadjusted and the same rubric is applied to every option; the weights are this page's own stated view of what decides the question.
Key takeaways
- CMAK (Cluster Manager for Apache Kafka) is a free, Apache 2.0-licensed tool originally built by Yahoo that provides multi-cluster management, partition reassignment, preferred-replica election, and optional JMX polling from a browser-based interface.
- The project is functionally stalled: the last stable release (3.0.0.6) was tagged on 29 April 2022, and multiple pull requests and feature requests have gone unanswered since.
- CMAK has a hard ZooKeeper dependency with no KRaft support. Apache Kafka 4.0, released on 18 March 2025, operates entirely without ZooKeeper, making CMAK incompatible with all clusters running that version.
- Security is limited to LDAP basic auth and coarse feature flags: there is no SAML/OIDC, no per-topic RBAC, and no audit log.
- For teams running KRaft clusters, needing message browsing, or requiring enterprise-grade access control, alternatives such as AKHQ, Kafbat UI, Redpanda Console, or Kpow are worth evaluating. Kafdrop adds message browsing but, like CMAK, does not support KRaft.
Kpow live demo
Test the operational trade-offs in a live Kafka UI
A CMAK review is only the start of an evaluation. Open Kpow and try the shared workflows your platform team will need every day.
Explore data inspection, consumer operations, and governed access in one environment.
Try the Kpow demoWhat is CMAK?
CMAK (Cluster Manager for Apache Kafka), originally named Kafka Manager, is an open-source Kafka administration tool built at Yahoo and released under the Apache 2.0 licence. It provides a browser-based interface for managing one or more Kafka clusters from a single view.
The tool is built on Scala and the Play framework, and it requires a direct connection to a ZooKeeper ensemble to function. Its core feature set reflects the operational tasks Yahoo built it for: registering and monitoring clusters, creating and modifying topics, managing partitions, triggering preferred-replica elections, and polling JMX metrics from brokers.
CMAK is hosted at github.com/yahoo/CMAK. No commercial distribution, hosted offering, or paid support tier exists.
CMAK review
Functionalities
CMAK’s feature set is narrowly focused on cluster operations. Its official README enumerates the following capabilities: KMClusterManagerFeature, KMTopicManagerFeature, KMPreferredReplicaElectionFeature, and KMReassignPartitionsFeature. In practice, this covers multi-cluster registration, topic creation and configuration, partition reassignment, preferred-replica election, and optional JMX metric polling at the broker and topic level.
Practitioner reviews describe these features as effective for their intended purpose. A 2022 Towards Data Science overview states: “For the most part, CMAK is primarily an Ops tool. It is also really good at partition reassignment.” The same review notes that “multi-cluster management, dynamic topic configuration, partition creation, and replica change will cover most of your tasks.” User webodmin, writing on GitHub Issue #776 in 2023, described CMAK as “very useful and convenient”, this from someone who had run it in production until a KRaft migration made it unusable.
What CMAK does not cover is equally significant. The tool has no message-browsing UI, no schema registry integration, no Kafka Connect management, and no ksqlDB or Flink support. These absences reflect a scope deliberately limited to administrative operations rather than data-plane visibility.
One limitation that affects day-to-day operations is CMAK’s use of an internal caching layer rather than live data from broker APIs. Changes made to the cluster are not reflected in the UI immediately, because the interface polls for metadata on a fixed interval rather than subscribing to live state. This causes delays between an administrative action and its confirmation on-screen, which can mislead operators into believing a partition reassignment or offset reset has not taken effect. Tchiotludo, the author of AKHQ, cited this behaviour explicitly when describing why he built an alternative: “Kafka Manager have some kind of cache and you don’t see your change on real-time. During develop, it was confusing to don’t see your modifications” (r/apachekafka, 2019).
A related visibility gap appears during broker migrations. An operations specialist on r/devops noted that CMAK would report hours of catch-up replication completing in seconds, with no way to verify accuracy without querying the ZooKeeper shell directly: “CMAK would indicate hours of catch-up replication (by replicas) being completed in seconds whose correctness I could never figure out without going to the ZK shell” (Gathering opinions on Kafka management tools, 2021). For teams doing broker replacements or rebalances in production, this makes CMAK unreliable as a source of truth during the migration window.
One area where CMAK retains some value is as a learning tool. Its visual taxonomy of brokers, partitions, and replicas maps closely to Kafka’s internal model, and some practitioners recommend it specifically for building familiarity with core concepts. A systems engineer on r/apachekafka wrote: “Spend some time to understand CMAK, it is really good, and the functions on the page can help you check the knowledge points or keywords you missed when reading the document” (Suggestions for learning Kafka, 2025). This applies to ZooKeeper-era clusters; the tool provides no equivalent value on KRaft deployments where it cannot connect at all.
The most consequential functional gap as of 2025-2026 is the absence of KRaft support. CMAK connects to Kafka through a ZooKeeper endpoint. GitHub Issue #776 has accumulated requests from named users since 2022, including akamensky, webodmin, ceeeekay, meethigher, and azhurbilo, all of whom confirm CMAK is unusable on ZK-less deployments. Maintainer patelh acknowledged the problem in 2022: “Yep, we’ll phase it out but we’ll need some place to store metadata. Either directly in Kafka or RDBMS. Still to be designed.” As of May 2026, no implementation has shipped.
Practitioners hitting this wall in production confirm that the failure is hard and immediate. User dekanov on r/apachekafka wrote after standing up a test cluster: “I have just started my first Kraft test cluster. First problem is that it is not compatible with my Kafka Manager, which I can not get rid of entirely” (Running Kraft in production, 2023). The broader community has largely absorbed this as settled. Haarolean, a contributor to the Kafbat UI project, stated plainly on r/dataengineering: “CMAK is inactive for a couple years already” (Kafbat UI for Apache Kafka v1.0 is out, 2024).
Apache Kafka 4.0, released 18 March 2025, is the first major release to operate entirely without Apache ZooKeeper. CMAK is incompatible with any cluster running that version or later.
Deployment and operations
CMAK is distributed as source code requiring an sbt/Scala build. Docker images exist but are community-maintained (sheepkiller, TrivadisPF, intropro, hjben) rather than published by Yahoo. Kubernetes deployment is handled by the third-party eshepelyuk/cmak-operator Helm chart, not the upstream project.
Build friction is a recurring complaint. GitHub Issue #927 (December 2023, filed by zamek42) reports a compatibility problem on OpenJDK 17: “No JVMCI compiler found, but I use openjdk Java 17.” Issue #922 (July 2023, filed by SimonMikolajek) flags build dependency problems on current sbt/Scala toolchains.
For larger clusters with JMX enabled, the README requires manual thread-pool tuning: cmak.broker-view-thread-pool-size=<3 * number_of_brokers> and a corresponding update-interval formula. There is no documented autoscaling path.
Operational reliability has also been questioned. A widely-cited issue (#550, originally filed in 2018 by mimani) describes long-running instances hanging after 20-30 days with RejectedExecutionException errors caused by thread-pool exhaustion. This pattern has not been addressed in any subsequent release.
The last binary release is 3.0.0.6, tagged 29 April 2022 by contributor mcjyang. No stable release has followed in the three years since.
Access control and security
CMAK supports LDAP basic authentication and a coarse feature-flag model. The feature flags can be enabled or disabled globally but provide no per-user, per-cluster, or per-topic granularity.
The README warns explicitly: “Warning, you need to have SSL configured with CMAK (pka Kafka Manager) to ensure your credentials aren’t passed unencrypted… Note: LDAP is unencrypted and insecure.” SSL must be configured manually; the default setup transmits credentials in plaintext.
There is no SAML or OIDC integration. GitHub Issue #933 (September 2024, naganaidu-rezi) asks: “how to configure custom SAML for Kafka Manager?”, a direct signal that SSO is wanted and absent. In practice, teams that require SSO and MFA have had to place CMAK behind a reverse proxy wired to an identity provider. A DevOps engineer on r/devops described their setup: “We use it with OKTA to enable SSO and MFA for Spark UI, Kafka Manager, Kibana and Kubernetes dashboard” (How do you handle apps that do not have built-in SSO support?, 2021). This approach works but adds operational overhead, requires a correctly configured proxy, and still does not provide per-topic or per-cluster access controls. It secures the front door without addressing what happens inside. Issue #926 (October 2023, xiaobao623) reports that enabling ZooKeeper ACLs breaks CMAK’s connection entirely. Issue #932 (August 2024, qianghong000) covers TLS-to-ZK configuration complexity. There is no audit log.
For teams with compliance requirements, the access-control model is not enterprise-grade. It was designed for small, internally-trusted environments.
User interface
Practitioners describe the CMAK UI as functional and direct for operators already familiar with Kafka’s internal model. The 2022 Towards Data Science overview calls it “a good and fairly straightforward UI” that handles Ops tasks without unnecessary friction for experienced users.
The consistent criticism is that the UI is dated by comparison to modern single-page-application tools. Redpanda’s 2024 Kafka tools guide (vendor-authored, included here only for the descriptive claim it independently corroborates) describes it as “less intuitive and visually dated compared to newer tools… [lacking] advanced visualizations and interactive features.” The absence of a message-browsing view is the most frequently cited specific gap: almost every practitioner comparison uses Kafdrop’s topic-content screen as the counterexample.
There is no documented accessibility support.
Ecosystem
CMAK’s ecosystem coverage is minimal. It connects to Kafka through ZooKeeper; it has no native integration with Schema Registry, Kafka Connect, ksqlDB, Flink, or any cloud-managed Kafka service.
The ZooKeeper dependency is particularly limiting for cloud deployments. Users on GitHub Issue #776 confirm that managed services (MSK, Confluent Cloud, Aiven, Redpanda Cloud) either lock down or no longer expose ZooKeeper endpoints, making CMAK incompatible with the majority of managed Kafka offerings. GitHub Issue #934 (October 2024, stefannmih) specifically flags compatibility problems with Confluent distributions.
The eshepelyuk/cmak-operator maintainer, the author of the most widely used Kubernetes deployment path for CMAK, recommends AKHQ as the better-maintained alternative: “AKHQ project seems to be the most active open source tool for managing and monitoring Kafka clusters. It could be missing some functionality from CMAK, but their developers are open for feature requests and contributions.”
Customer support
CMAK has no commercial support offering. The only channel is GitHub Issues, and the maintainer response rate in 2023-2024 is low. Issues #925, #928, #929, #930, #931, and #933 all contain unanswered feature requests or release requests. A PR to add Kafka 3.3 compatibility (PR #924, submitted August 2023 by HenryCaiHaiying) remained unmerged as of the research date.
There is no documentation site, no community Slack or Discord, and no commercial-support option. The project has not been formally archived by Yahoo, but it has not received a stable release since April 2022.
Best for
CMAK suits small-to-medium teams running on-premises Kafka 2.x or ZooKeeper-era 3.x clusters, where the primary need is partition reassignment, preferred-replica election, and basic broker/topic visibility. It fits operators (SREs and platform engineers) who prefer a direct, Ops-oriented interface and have no compliance requirement for SSO, granular RBAC, or audit logging.
It is not a fit for any cluster running Kafka 3.3+ in KRaft mode, any Kafka 4.0 deployment, or any managed Kafka service where ZooKeeper is not user-accessible. It is also not appropriate for teams that need message inspection, schema management, Kafka Connect administration, or enterprise access controls.
CMAK pricing
CMAK is free and open-source software, released under the Apache 2.0 licence. There are no paid tiers, hosted offerings, or commercial distributions.
Pricing tiers
There is a single tier: free, self-hosted. You are responsible for all infrastructure, deployment, and operational costs.
Free trial
No trial is applicable. You can deploy CMAK directly from the GitHub repository or from a community-maintained Docker image.
CMAK competitors and alternatives
Most practitioners evaluating a new deployment now consider AKHQ, Kafdrop, Redpanda Console, or a commercial option before settling on CMAK.
| Rank | Best for | Tool | Type | Key functionalities | Deployment & ops | Access control | User interface | Pricing |
|---|---|---|---|---|---|---|---|---|
| 1 | Enterprise Kafka tooling with advanced RBAC at scale | Kpow (Factor House) | Commercial | Full Kafka management, monitoring at scale | Stateless; straightforward deployment options | Advanced RBAC | WCAG 2.1 AA compliant, with a published VPAT | Per-cluster pricing |
| 2 | OSS multi-cluster management with advanced SSO | Kafbat UI | OSS | Message browsing, schema registry, multi-cluster, Avro/Protobuf/JSON support | Docker, K8s; actively maintained community fork | OAuth 2.0, Okta, Active Directory | Modern SPA | Free |
| 3 | Full-featured OSS with schema registry and Connect | AKHQ | OSS | Message browsing, live tailing, schema registry, Kafka Connect, ACL management, multi-cluster | Docker, K8s Helm; actively maintained | OIDC, LDAP, per-topic RBAC | Modern SPA | Free |
| 4 | Developer-focused UI with KRaft support | Redpanda Console | Source-available (BSL) / Commercial | Message browsing, schema registry, Kafka Connect; one cluster per Console | Docker, K8s | SSO/RBAC (Enterprise tier only) | Modern React SPA | Free (Community); paid (Enterprise) |
| 5 | Lightweight message viewing on ZooKeeper-era clusters (no KRaft support) | Kafdrop | OSS | Topic browsing, consumer group monitoring, message inspection | Docker; lightweight footprint | None in the product; NGINX basic-auth workaround | Simple web UI | Free |
| 6 | ZK-era Kafka ops, partition reassignment | CMAK | OSS | Multi-cluster, partition reassignment, preferred-replica election, JMX polling | sbt build; community Docker and Helm only | LDAP; global feature flags | Functional, dated; cached state updates | Free |
| 7 | Confluent Platform users | Confluent Control Center | Commercial | Full Kafka management, ksqlDB, schema registry, monitoring | Bundled with Confluent Platform | RBAC | Feature-rich | Paid (bundled) |
For a broader comparison of Kafka management tools, see the Factor House Kafka tools guide.
What practitioners are moving to
Across r/apachekafka and r/devops, the migration path away from CMAK is well-trodden.
Every option here is scored against this page's own criteria, from the evidence and sources this page cites, and the reason for each score sits under it. This page weights them: Cost as teams grow counts once, Deployment footprint counts once, Support and maintenance counts three times, Access control and audit counts three times and Multi-cluster reach counts once, for a total out of 90. Access control and audit and Support and maintenance count three times here, because in a regulated environment the decisive questions are who may act on a cluster and who is accountable when a dependency advisory lands. Cost as teams grow, deployment footprint and multi-cluster reach are real, but they are one-off decisions rather than standing exposure, so they count once. Kpow is a Factor House product and is listed first for that reason; its per-criterion scores are set the same way as every other option's and are not adjusted, and the weights above apply to every option alike.
Rank 1 Kpow
82 out of 90 Total
Listed first because it is our product. Every score below is unadjusted, and the weights this page applies to them are published above the cards.
- Cost a year, 3 clusters
- About $16,380, licence and run time
- Free tier
- 3 clusters, 10 users
- Access control
- RBAC, SSO, audit log (Enterprise)
- Cost as teams grow
- 7 out of 10
- Deployment footprint
- 9 out of 10
- Support and maintenance ×3 weight, this criterion counts 3 times toward the total
- 9 out of 10
- Access control and audit ×3 weight, this criterion counts 3 times toward the total
- 10 out of 10
- Multi-cluster reach
- 9 out of 10
Why these scores for Kpow
- Cost as teams grow 7 out of 10
- The Kpow pricing page and the Kpow vs CMAK comparison have it licensed per cluster at a published price, Enterprise from $4,500 with 100 users included, and Community Edition free for 3 clusters and 10 users with RBAC, masking and audit held back on the Kpow Community Edition page. Our cost model at the three clusters this page prices: the published $13,500 licence plus 2 engineer-hours a month at $120 an engineer-hour to run one stateless container, which is $2,880, so about $16,380 a year. The run-time part is our estimate, not a vendor price.
- Deployment footprint 9 out of 10
- This page’s table and its prose both give a stateless deployment, the Kpow vs AKHQ and Kpow vs Lenses comparisons have one stateless container configured by environment variables with no database, sidecar or volume, and the Kpow vs Kadeck comparison has it running air-gapped. Kafdrop is named lighter on the best Kafka monitoring tools page.
- Support and maintenance 9 out of 10
- The Kpow features page gives email support and an Enterprise support SLA, and the Kpow vs CMAK comparison has it shipping continuously, with priority support on Enterprise and a community Slack on Community Edition.
- Access control and audit 10 out of 10
- This page’s table gives advanced RBAC and its prose adds per-topic RBAC and audit logging CMAK cannot reach. The Kpow vs Kafdrop comparison has RBAC, SSO, server-side masking and an audit log of user actions in the product, the Kpow vs AKHQ comparison has masking applied by role, and the Kpow features page adds SAML, LDAP and OpenID. All on Enterprise.
- Multi-cluster reach 9 out of 10
- The Kpow multi-cluster page gives up to 12 clusters per instance across MSK, Confluent, Redpanda, Aiven and others, and that per-instance cap of 12 keeps it at 9, level with the uncapped tools.
For teams with compliance requirements or operating Kafka at significant scale, the gap between CMAK’s feature set and commercial alternatives such as Kpow are substantial: per-topic RBAC, audit logging, and stateless deployment are not achievable in any configuration of CMAK.
What it costs. Enterprise is $4,500 per cluster a year with 100 users included, so the three clusters this page prices come to $13,500 however many engineers use them, and Community Edition is free for 3 clusters and 10 users. Add our modelled running cost of 2 engineer-hours a month at $120 an engineer-hour, about $2,880 a year, and the total is about $16,380. CMAK licences nothing at all and costs about $11,520 a year in engineer time on the same model, so the free tool is the cheaper line right up until the KRaft migration it cannot make.
What it adds over CMAK. Roles that span topics, ksqlDB, Kafka Connect and Schema Registry resources, data policies applied server-side so a masked field is masked before the payload reaches a browser, and an audit log of user actions you can read inside the product rather than a topic you query yourself. CMAK’s model is a login plus global feature flags, with no audit trail at all.
Multi-cluster reach. Up to 12 clusters from a single Kpow instance, across self-managed Apache Kafka, Amazon MSK, Confluent, Redpanda, Aiven and others, where CMAK reaches only clusters that still expose a ZooKeeper endpoint. The 12-cluster figure is a per-instance ceiling, not a licensing one.
Kpow runs as a single stateless container with no external database. It is licensed per cluster from 4,500 US dollars with 100 users included, and the free Community Edition covers up to 3 clusters and 10 users, with RBAC, data masking and the audit log on Enterprise.
Staying patched. Kpow’s release notes name the CVEs each release remediates, and the 96.4 image built on 5 August 2026 bundles 311 dependencies of which one carries a high or critical advisory, none of them published before that release. That is not a claim to patch faster than a community project: Kpow’s own dependency remediation has run from 14 to 128 days, and the current image still ships CVE-2026-75595 in netty, a 9.1 critical public since 19 August 2026, unpatched. What a licence buys here is not a different deployment model, because Kpow is self-hosted too. It is a company contracted to ship the fix. Every dependency figure on this page was read on 24 September 2026 from the published artefacts and from nvd.nist.gov.
Compare Kpow vs CMAK
Rank 2 Kafbat UI
60 out of 90 Total
- Cost a year, 3 clusters
- $0 Apache 2.0, about $8,640 to run
- Access control
- OAuth 2.0, Okta, Active Directory
- Latest release
- v1.5.0, 20 April 2026
- Cost as teams grow
- 10 out of 10
- Deployment footprint
- 8 out of 10
- Support and maintenance ×3 weight, this criterion counts 3 times toward the total
- 5 out of 10
- Access control and audit ×3 weight, this criterion counts 3 times toward the total
- 6 out of 10
- Multi-cluster reach
- 9 out of 10
Why these scores for Kafbat UI
- Cost as teams grow 10 out of 10
- The Kadeck vs Kafbat UI and Conduktor vs Kafbat UI comparisons both have it under Apache 2.0, with no seat or cluster cap and nothing held back. The card carries our run-cost estimate of about $8,640 a year, 6 engineer-hours a month at $120 an engineer-hour across three clusters.
- Deployment footprint 8 out of 10
- The Kadeck vs Kafbat UI and Kafbat UI vs Lenses comparisons give a stateless container with a published Helm chart, the Kpow vs Kafbat UI comparison adds a mounted volume if the configuration wizard is used, and the Kafbat UI review has dynamic config failing on Kubernetes.
- Support and maintenance 5 out of 10
- The AKHQ vs Kafbat UI comparison has v1.5.0 in April 2026 with commits landing in August 2026, and the Kpow vs Kafbat UI comparison gives support as GitHub issues or unpriced professional services, with no SLA.
- Access control and audit 6 out of 10
- This page’s table gives OAuth 2.0, Okta and Active Directory, and its prose adds that no reverse-proxy workaround is needed. The Kafbat UI vs Lenses comparison has roles per resource type, six identity provider types, server-side masking with three policies and audit to a Kafka topic, while the Kafbat UI review records no per-role masking override and no in-product audit view.
- Multi-cluster reach 9 out of 10
- This page’s table and prose both give it as multi-cluster, the Conduktor vs Kafbat UI comparison makes adding a cluster another config entry with no cap, and the Confluent Control Center vs Kafbat UI comparison has it reaching self-managed Kafka, MSK, Event Hubs and Google Cloud with cloud IAM.
Kafbat UI (a maintained community fork of the original Provectus UI) has gained ground for teams running multi-cluster environments that also need OAuth 2.0 or Active Directory integration without a reverse-proxy workaround.
What it costs. Nothing to licence, under Apache 2.0 with no seat or cluster cap, and paid help is a professional services engagement quoted rather than listed. Running it is the cost: upgrades, the static cluster YAML the Kubernetes cluster-add failure forces, the masking policies, and the pipeline that reads its audit topic. We put that at 6 engineer-hours a month across three clusters, 72 hours, or about $8,640 a year at $120 an engineer-hour. That is our estimate, not a vendor price. The same three clusters on Kpow are about $16,380, made of $13,500 of published licence and $2,880 of run time.
What it adds over CMAK. Message browsing with Avro, Protobuf and JSON deserialization, schema registry and Kafka Connect views, and a governance layer CMAK has no equivalent for: access control scoped per resource type with regular-expression role subjects, six identity provider types, server-side masking with REMOVE, REPLACE and MASK policies, and an audit log written to a Kafka topic, all at no licence cost. Adding a cluster is another configuration entry, with no cap.
Where it falls short. The governance layer has edges. There is no per-role data masking override, no team namespacing and no approval workflow, and the audit log has a confirmed bug that denies access to users under RBAC. Dynamic cluster configuration through the UI fails on Kubernetes with 400 Bad Request errors, so clusters have to be declared in static YAML. Support is GitHub issues or a professional services engagement quoted rather than listed, with no SLA.
Staying patched. Kafbat UI released v1.5.0 in April 2026 and has not shipped since. In the 157 days since, at least 20 high or critical advisories have been published against libraries that release bundles, including the same netty critical CVE-2026-75595 that the current Kpow image carries. Only 150 of its 266 bundled jars resolved to a Maven coordinate, so that count is a floor and the state of the release itself is unmeasured. Kafbat does publish a security policy, which AKHQ and Kafdrop do not, and the one CVE filed against its own code, CVE-2025-49127, was already fixed in the release that preceded the advisory. Six releases in two years.
Rank 3 AKHQ
57 out of 90 Total
- Cost a year, 3 clusters
- $0 Apache 2.0, about $8,640 to run
- Access control
- OIDC, LDAP, per-topic RBAC
- Maintainership
- 441 commits from one maintainer
- Cost as teams grow
- 10 out of 10
- Deployment footprint
- 8 out of 10
- Support and maintenance ×3 weight, this criterion counts 3 times toward the total
- 5 out of 10
- Access control and audit ×3 weight, this criterion counts 3 times toward the total
- 5 out of 10
- Multi-cluster reach
- 9 out of 10
Why these scores for AKHQ
- Cost as teams grow 10 out of 10
- The Kpow vs AKHQ and AKHQ vs Redpanda Console comparisons have the whole product free under Apache 2.0, with no paid tier, so adding an engineer changes nothing. The card carries our run-cost estimate of about $8,640 a year, 6 engineer-hours a month at $120 an engineer-hour across three clusters.
- Deployment footprint 8 out of 10
- The AKHQ vs Kadeck and AKHQ vs Lenses comparisons give one JVM container, no database or sidecar and nothing phoning home, docked one for the open memory-growth reports the AKHQ review carries and the reported scale limit in the AKHQ vs Kafdrop comparison.
- Support and maintenance 5 out of 10
- This page’s table gives actively maintained, the AKHQ vs Kafbat UI comparison has three releases in eight months and 441 commits from one maintainer, and the Kpow vs AKHQ comparison has GitHub issues and the community, with no SLA.
- Access control and audit 5 out of 10
- This page’s table gives OIDC, LDAP and per-topic RBAC, the AKHQ vs CMAK comparison has LDAP, OIDC, basic auth and claim mapping, and the AKHQ vs Kafbat UI comparison has resource-level RBAC from Michelin. The Kpow vs AKHQ comparison has masking as one global YAML filter per topic and audit opt-in to a Kafka topic with no view.
- Multi-cluster reach 9 out of 10
- The AKHQ vs Kafdrop and Kpow vs AKHQ comparisons have one deployment reaching one cluster or many, and the AKHQ review adds MSK IAM support with multi-cluster documented at Michelin.
AKHQ is the most frequently recommended direct replacement for teams that need live topic inspection alongside cluster administration. User thebrobotic on the CMAK replacement thread (2022) noted: “Started using this and I like it better than CMAK. Has more features like view data in a topic / live tail of a topic which is very nice.”
What it costs. Nothing to licence. The Apache 2.0 release is the whole product, with no paid edition and nothing held back. The cost lands in the heap you size and watch against the open memory-growth reports, the one-filter-per-topic YAML masking, and the consumer you build to read the audit topic. We put that at 6 engineer-hours a month across three clusters, 72 hours, or about $8,640 a year at $120 an engineer-hour, our estimate rather than a vendor price. The same three clusters on Kpow are about $16,380, made of $13,500 of published licence and $2,880 of run time.
What it adds over CMAK. Message browsing and live tailing, schema registry views, Kafka Connect and ACL management, none of which CMAK has ever had. Access control is per topic with OIDC or LDAP behind it, where CMAK has global feature flags that cannot express who may touch which topic, and one deployment reaches one cluster or many.
Where it falls short. Maintainership is concentrated: 441 commits from the lead maintainer and 82 from the next human contributor, with GitHub issues and the community in place of a support contract. Masking is application configuration, a regex or JSON filter per topic in the AKHQ YAML that reads the same for everyone who logs in, and the audit trail is an opt-in Kafka topic with no view in the product, so answering a review question means reading that topic with something you built.
Staying patched. AKHQ has no CVE filed against its own code, and that is the wrong number to plan against. Release 0.28.0, cut on 6 August 2026, bundles 270 libraries and 18 of them carry a high or critical advisory. Sixteen were already public, with fixed versions already on Maven Central, on the day it shipped, and five are netty advisories Kpow had remediated three weeks earlier in 96.2: CVE-2026-44249, CVE-2026-45416, CVE-2026-45674, CVE-2026-47691 and CVE-2026-50010. The oldest has been open 108 days. That is exposure and remediation latency rather than a working attack, and every figure resolves against the published jar and nvd.nist.gov. Four releases in two years, and no security policy at any path GitHub reads.
Rank 4 Redpanda Console
redpanda.com
55 out of 90 Total
- Cost a year, 3 clusters
- About $8,640 to run, before any licence
- Clusters
- One per Console
- Behind the paid licence
- SSO, RBAC, Reassign Partitions
- Cost as teams grow
- 6 out of 10
- Deployment footprint
- 8 out of 10
- Support and maintenance ×3 weight, this criterion counts 3 times toward the total
- 7 out of 10
- Access control and audit ×3 weight, this criterion counts 3 times toward the total
- 6 out of 10
- Multi-cluster reach
- 2 out of 10
Why these scores for Redpanda Console
- Cost as teams grow 6 out of 10
- The Kadeck vs Redpanda Console comparison has it free under BSL with no seat count, and the Kpow vs Redpanda Console comparison has governance needing a Redpanda Enterprise licence that is not published and is tied to the broker vendor. The card carries our run-cost estimate of about $8,640 a year, 6 engineer-hours a month at $120 an engineer-hour across three clusters.
- Deployment footprint 8 out of 10
- The Kadeck vs Redpanda Console comparison gives a container or Helm chart holding no state, plus an external Schema Registry, and the Redpanda Console review adds a Helm upgrade bug and Kubernetes TLS friction.
- Support and maintenance 7 out of 10
- The Kafbat UI vs Redpanda Console comparison has v3.11.0 on 25 August 2026 after two more releases since July, and the AKHQ vs Redpanda Console comparison puts Redpanda under contract where a licence is held and the public tracker everywhere else.
- Access control and audit 6 out of 10
- This page’s table puts SSO and RBAC on the Enterprise tier only, the Kpow vs Redpanda Console comparison has RBAC, OIDC SSO and masking licence-gated and absent from the free tier, and the AKHQ vs Redpanda Console comparison has audit as a Redpanda Enterprise platform capability, not a Console one.
- Multi-cluster reach 2 out of 10
- This page’s table gives one cluster per Console, the Kafdrop vs Redpanda Console comparison has one broker cluster per deployment at any price, and the Kpow vs Redpanda Console comparison has several Kafka Connect clusters but one broker cluster.
A message browser with schema registry and Kafka Connect views, under the Business Source License rather than Apache 2.0. Two limits matter to a team leaving CMAK: Reassign Partitions, the operation CMAK is most praised for, sits behind the enterprise licence along with SSO and RBAC, and each Console reaches one cluster, where CMAK registers many in one instance.
What it costs. The community build carries no licence fee, but it ships under the Business Source License rather than Apache 2.0, so it is a licence review rather than a purchase, and three environments mean three Consoles because one reaches one broker cluster. We put that at 6 engineer-hours a month, 72 hours, or about $8,640 a year at $120 an engineer-hour, our estimate rather than a vendor price. Turning on single sign-on, RBAC or Reassign Partitions adds a Redpanda Enterprise licence at a price that is not published, so the real figure is higher than $8,640 and cannot be quoted. Kpow’s three clusters are about $16,380 with the access control already in them.
What it adds over CMAK. A message viewer in seven formats, schema registry browsing and Kafka Connect management, on KRaft clusters as well as ZooKeeper-era ones, and against a Redpanda cluster it reads the admin API for extra capability. It is also shipping, where CMAK is not: v3.11.0 landed on 25 August 2026, with three more releases in the two months before it and a 2.8.x maintenance line cut alongside.
Where it falls short. Four capabilities sit outside the free licence: Console authentication including OIDC and OAuth 2.0 single sign-on, authorization meaning RBAC, debug bundle generation, and Reassign Partitions. Lifting them takes a Redpanda Enterprise licence whose price is not published, so a team on vanilla Apache Kafka or Amazon MSK buys a platform licence from a broker vendor whose broker it does not run. Fifty people across development, staging and production is three Consoles, because there is no broker-tier multi-cluster at any price.
Compare Kpow vs Redpanda ConsoleCMAK vs Redpanda ConsoleRedpanda Console review
Confluent Control Center
confluent.io
46 out of 90 Total
- Cost a year, 3 clusters
- About $2,880 to run, plus that licence
- Reaches
- Confluent Platform clusters only
- Sizing
- Dedicated 4 cores, 8 GB, 200 GB
- Cost as teams grow
- 2 out of 10
- Deployment footprint
- 2 out of 10
- Support and maintenance ×3 weight, this criterion counts 3 times toward the total
- 6 out of 10
- Access control and audit ×3 weight, this criterion counts 3 times toward the total
- 7 out of 10
- Multi-cluster reach
- 3 out of 10
Why these scores for Confluent Control Center
- Cost as teams grow 2 out of 10
- This page’s table gives paid and bundled, and the Kpow vs Confluent Control Center comparison has it bundled into a Confluent Platform licence with no published price and no free tier beyond a time-limited evaluation, while Control Center, multi-tenancy and encryption each cost extra. The card carries our run-cost estimate of about $2,880 a year, 2 engineer-hours a month at $120 an engineer-hour across three clusters.
- Deployment footprint 2 out of 10
- The Confluent Control Center vs Kafdrop comparison gives dedicated nodes at 4 cores, 8 GB and 200 GB up to 100,000 replicas, and the Kpow vs Confluent Control Center comparison adds that it needs the Metrics Reporter JAR on the brokers.
- Support and maintenance 6 out of 10
- The AKHQ vs Confluent Control Center comparison has a vendor under enterprise contract, quarterly patches for the current version only, no Platinum tier and no public issue tracker, and the Kpow vs Confluent Control Center comparison makes legacy to next-gen a migration.
- Access control and audit 7 out of 10
- This page’s table gives RBAC, the CMAK vs Confluent Control Center comparison has RBAC with audit logging for authentication and authorisation events and 10,000 rules per cluster, and the AKHQ vs Confluent Control Center comparison has OIDC only on self-managed and no SAML. No masking is described.
- Multi-cluster reach 3 out of 10
- The Kpow vs Confluent Control Center comparison has it on Confluent Platform only, because the reporter JAR cannot go on MSK, Redpanda or Aiven.
Management and monitoring bundled into a Confluent Platform licence, with ksqlDB and schema registry views and role-based access control with audit logging. It needs the Confluent Metrics Reporter on the brokers, so it watches Confluent Platform clusters and cannot reach Amazon MSK, Redpanda or Aiven, and it has no price published on its own.
What it costs. There is no price to quote. It is not sold separately, it is bundled into a Confluent Platform licence with no published figure, and Control Center, multi-tenancy and encryption each cost more on top of that. What can be modelled is the running: dedicated nodes at 4 cores, 8 GB of RAM and 200 GB of storage, the Metrics Reporter JAR on every broker, and quarterly patches for the current version only. We put that at 2 engineer-hours a month across three clusters, 24 hours, or about $2,880 a year at $120 an engineer-hour, our estimate rather than a vendor price, with the unpublished platform licence sitting on top of it. Kpow publishes its side of the same comparison at about $16,380 for three clusters.
Where it falls short. It is the heaviest option here to run. It wants dedicated nodes, never shared with Confluent Platform itself: 4 cores, 8 GB of RAM and 200 GB of storage for clusters up to 100,000 replicas, and 8 cores with 16 GB above that, on storage guidance that assumes 15 days of metrics retention. Patches are quarterly and for the current version only, there is no public issue tracker, and moving from the legacy build to the next-generation one is a migration rather than an upgrade.
Compare Kpow vs Confluent Control CenterCMAK vs Confluent Control CenterConfluent Control Center review
Kafdrop
27 out of 90 Total
- Cost a year, 3 clusters
- $0 Apache 2.0, about $11,520 to run
- Kafka 4.0
- Not supported, KRaft closed
- Access control
- None in the product
- Cost as teams grow
- 10 out of 10
- Deployment footprint
- 10 out of 10
- Support and maintenance ×3 weight, this criterion counts 3 times toward the total
- 2 out of 10
- Access control and audit ×3 weight, this criterion counts 3 times toward the total
- 0 out of 10
- Multi-cluster reach
- 1 out of 10
Why these scores for Kafdrop
- Cost as teams grow 10 out of 10
- The Kpow vs Kafdrop and Kadeck vs Kafdrop comparisons have the whole product under Apache 2.0, with no seat or cluster cap. The card carries our run-cost estimate of about $11,520 a year, 8 engineer-hours a month at $120 an engineer-hour across three clusters.
- Deployment footprint 10 out of 10
- The best Kafka monitoring tools page calls it ‘the lightest tool on this list’ at a 64 MB heap, and the Kafdrop vs Lenses comparison gives one stateless Java process with no database, sidecar or volume.
- Support and maintenance 2 out of 10
- This page’s table gives no KRaft support, and the Kafbat UI vs Kafdrop comparison has the newest release at 4.2.0 in July 2025 with KRaft unsupported and three reports closed not planned, GitHub issues only and no support tier.
- Access control and audit 0 out of 10
- This page’s table gives none in the product, with an NGINX basic-auth workaround. The Confluent Control Center vs Kafdrop comparison has no authentication, no RBAC and no SSO, the same NGINX basic-auth workaround and write operations exposed, and the Conduktor vs Kafdrop comparison has no audit trail.
- Multi-cluster reach 1 out of 10
- The AKHQ vs Kafdrop and Kafdrop vs Redpanda Console comparisons both give one cluster per deployment, with no multi-cluster management.
A topic and message viewer rather than an administration console: it shows topic contents and consumer groups, which CMAK has never done, but it has no partition reassignment. It has no authentication in the product, and like CMAK it is not an option for a KRaft cluster, because three reports of its topic view failing under KRaft were closed as not planned.
What it costs. Nothing to licence, under Apache 2.0, with no paid tier to move up to. It is the most expensive free option on this page to run, because one deployment reaches one cluster and nothing in the product authenticates anyone: three deployments, an NGINX proxy in front of each, and the change records kept by hand. We put that at 8 engineer-hours a month, 96 hours, or about $11,520 a year at $120 an engineer-hour, our estimate rather than a vendor price. The same three clusters on Kpow are about $16,380, made of $13,500 of published licence and $2,880 of run time.
Where it falls short. It is the lightest tool here, one Java process on a 64 MB heap with no database or sidecar, and that is the whole argument for it. Its newest tag is 4.2.0 of 31 July 2025 while commits including a Spring Boot 4.1 upgrade have landed through August 2026, so this year’s work is in no published image. One deployment reaches one cluster, where CMAK registers many in one instance, and the documented way to put a login in front of it is an NGINX basic-auth proxy, which leaves its write operations exposed to anyone past that proxy.
Staying patched. Kafdrop released 4.3.0 on 31 August 2026 bundling Tomcat 11.0.22, which had carried three critical advisories since 25 August, six days earlier. One of them, CVE-2026-65905, scores 9.8 and is an authentication bypass, and all three are still in the current release. Only 66 of its 118 bundled jars resolved to a coordinate, so those counts are a floor rather than a total. Three releases in two years, 106 of its last 132 commits from a dependency bot, and no security policy at any path GitHub reads.
26 out of 90 Total
- Cost a year, 3 clusters
- $0 Apache 2.0, about $11,520 to run
- Last release
- 3.0.0.6, 29 April 2022
- Kafka 4.0
- Not supported, needs ZooKeeper
- Cost as teams grow
- 10 out of 10
- Deployment footprint
- 3 out of 10
- Support and maintenance ×3 weight, this criterion counts 3 times toward the total
- 1 out of 10
- Access control and audit ×3 weight, this criterion counts 3 times toward the total
- 2 out of 10
- Multi-cluster reach
- 4 out of 10
Why these scores for CMAK
- Cost as teams grow 10 out of 10
- This page gives it as free under Apache 2.0 in a single self-hosted tier, with no paid tier and no support, and the CMAK vs Redpanda Console and CMAK vs Conduktor comparisons agree on Apache 2.0, one free tier and nothing to buy. The card carries our run-cost estimate of about $11,520 a year, 8 engineer-hours a month at $120 an engineer-hour across three clusters.
- Deployment footprint 3 out of 10
- This page gives an sbt and Scala source build, community Docker images, a third-party Helm chart, manual thread-pool sizing and a hang after 20-30 days in issue #550. The AKHQ vs CMAK and Kpow vs CMAK comparisons add community images and the only Kubernetes chart archived, the CMAK vs Conduktor comparison adds a ZooKeeper ensemble, and the CMAK vs Confluent Control Center comparison adds the manual thread-pool sizing.
- Support and maintenance 1 out of 10
- This page has the last release at 3.0.0.6 in April 2022, GitHub Issues only with unanswered requests, no KRaft and no compatibility with Kafka 4.0. The CMAK vs Conduktor comparison repeats the April 2022 release with 522 untriaged issues and no connection to Kafka 4.0, and the Kpow vs CMAK comparison finds no support tier, docs site or community channel.
- Access control and audit 2 out of 10
- This page gives LDAP basic auth plus global feature flags, with no SAML or OIDC, no per-topic RBAC and no audit log, which is scored 2 rather than 0 because the basic auth is real. The Kpow vs CMAK comparison has LDAP basic auth and coarse global feature flags, no SAML, no OIDC, no per-topic granularity and no audit log.
- Multi-cluster reach 4 out of 10
- This page gives multi-cluster registration from one view, but ZooKeeper only, so no managed services and no Kafka 4.0. The CMAK vs Kafdrop comparison has many clusters from one view, and the Kpow vs CMAK comparison narrows that to ZooKeeper-based clusters only, nothing on Kafka 4.x and little that is managed.
CMAK occupies a specific niche: free, ZooKeeper-era Kafka operations tooling. The wider ecosystem’s move toward KRaft and richer feature sets has eroded that niche substantially.
What it costs. Nothing to licence, under Apache 2.0, and no release since 3.0.0.6 in April 2022 to pay for. What it costs is the time around it: a ZooKeeper ensemble kept alive, a build from source under sbt and Scala because the only Kubernetes chart is archived, the manual cmak.broker-view-thread-pool-size tuning the README requires, and a reverse proxy wired to an identity provider because there is no authentication, no per-topic access control and no audit log in the product. We put that at 8 engineer-hours a month across three clusters, 96 hours, or about $11,520 a year at $120 an engineer-hour, our estimate rather than a vendor price, and it does not include the migration a KRaft cutover forces. Kpow’s three clusters are about $16,380, made of $13,500 of published licence and $2,880 of run time.
Where it is blocked. The ZooKeeper dependency is not a gap that degrades slowly. Kafka 4.0 has no ZooKeeper ensemble at all, so a KRaft cutover ends CMAK on the day it happens rather than reducing what it can do, and the managed services had already locked down or stopped exposing their ZooKeeper endpoints before that.
Staying patched. CMAK’s last release is from April 2022 and nothing has been committed to it since August 2023. It bundles ZooKeeper 3.5.7, carrying an authorization bypass scoring 9.1 that has been public since October 2023, 1,079 days, alongside logback 1.2.3, jackson-databind 2.10.0 and netty 4.1.45. Only 109 of its 112 bundled jars resolved to a coordinate, so its counts are a floor. There is no release coming to carry a fix, so every advisory against its dependency tree is the operator’s to patch or to accept.
Compare Kpow vs CMAKAKHQ vs CMAKCMAK vs Kafbat UICMAK vs KafdropCMAK vs Redpanda ConsoleCMAK vs Confluent Control Center
Frequently asked questions about CMAK
How much does CMAK cost, and is there a free tier?
CMAK is free and open-source under the Apache 2.0 licence. There is no paid tier, hosted offering, or commercial support option. You self-host and bear all infrastructure costs.
When is CMAK a better choice than the alternatives?
CMAK suits operators managing on-premises Kafka 2.x or ZooKeeper-era 3.x clusters who need partition reassignment, preferred-replica election, and multi-cluster visibility, without budget for commercial tooling and without SSO or RBAC requirements.
When are the alternatives a better choice than CMAK?
If your cluster runs KRaft (Kafka 3.3+ or 4.0), uses a managed service, or requires message browsing, schema registry, SSO, per-topic RBAC, or an audit log, CMAK cannot meet those needs. AKHQ, Kafbat UI, or a commercial option are better fits. Kafdrop covers message browsing but, like CMAK, does not support KRaft.
Is CMAK still actively maintained?
The last stable release is 3.0.0.6, dated 29 April 2022. Multiple PRs and feature requests have received no maintainer response since then. The project has not been formally archived, but it is not receiving new releases.
Does CMAK support Kafka 4.0?
No. Kafka 4.0 (released 18 March 2025) operates entirely without ZooKeeper. CMAK requires a ZooKeeper endpoint and has no KRaft support, so it is incompatible with Kafka 4.0 clusters.
For the rest of the tooling landscape, see the complete guide to Kafka.