CMAK vs Conduktor
ComparisonsCMAK vs Conduktor, compared
Key takeaway
CMAK requires a direct ZooKeeper connection, and Kafka 4.0 runs KRaft only, so a KRaft cutover ends it the day it lands. Its last release is 3.0.0.6 from April 2022, with 522 open issues nobody is working through. Conduktor Console Community is free for up to 50 users and 3 clusters, Team Edition is 1,200 US dollars per seat per year, and Console requires PostgreSQL 13 or later. Kpow by Factor House is licensed per cluster at a published price.
What is CMAK?
CMAK is Cluster Manager for Apache Kafka, originally Kafka Manager, built at Yahoo and released under Apache 2.0. It is written in Scala on the Play framework, and its scope is administrative rather than data-plane. There is no commercial distribution, no hosted offering and no paid support tier. The repository is public and not archived, and it carries 11,925 stars and 2,476 forks.
- registering and monitoring clusters from a single multi-cluster view
- partition reassignment and preferred-replica election
- dynamic topic configuration, partition creation and replica change
- optional JMX polling at broker and topic level
It requires a direct connection to a ZooKeeper ensemble to function at all. The last stable release, 3.0.0.6, was tagged 29 April 2022, and the last commit on master is December 2022.
What is Conduktor?
Conduktor is a commercial Kafka management and governance platform, sold as separately licensed products. Console is a React web interface over topics, schemas, connectors, consumer groups and access control across clusters. Gateway is a proxy between clients and brokers that enforces encryption, data masking, quota policy and multi-tenancy at the wire level, so producers and consumers need no change to their code. A Schema Registry Proxy is licensed separately again. The company retired its JavaFX desktop product at the end of 2025.
Gateway is what makes this a different category of product rather than a newer CMAK, and it is also what changes the risk. CMAK touches cluster metadata and never sits in the data path. Gateway does sit in it, which is what allows field-level encryption without touching a client, server-side virtual topic filtering, and a backend cluster failover applications never notice. Conduktor has been SOC2 Type II certified since 2023.
What is the official 2026 pricing of CMAK and Conduktor?
CMAK costs nothing to license and there is no tier above it. The whole cost is operator time: somebody builds it from Scala source, keeps a ZooKeeper ensemble reachable for it, and answers for it when it stops. There is no SLA to escalate to, because 522 issues stand open with no maintainer triaging them.
Conduktor sells six tiers across three products and publishes a price for exactly one of the paid ones. Console Community is the free entry point, capped by user and cluster count, carrying SSO by OIDC or LDAP, full Kafka operations, the advanced data explorer, and API and CLI access. Gateway Community is free as well, restricted to network connectivity. Console Team Edition is the published price, and it is where group-level RBAC, topic policies, unlimited audit logs, unlimited clusters and data masking begin. Console Enterprise, Gateway Enterprise and the Schema Registry Proxy are contact-only, and Gateway Enterprise is licensed per cluster with a three-cluster minimum.
Read the unit rather than the amount. Five engineers sharing a Kafka management console sit inside Community and pay nothing. Opening the same tool to fifty crosses into a per-seat line that grows every time somebody new needs a topic browser, and Gateway is a second purchase priced on a different axis again.
Where does each one run out?
CMAK cannot connect to a Kafka 4.0 cluster at all. It needs a direct ZooKeeper connection and Kafka 4.0 runs KRaft only. The maintainer acknowledged this in 2022, said ZooKeeper would be phased out but that the replacement metadata store was still to be designed, and nothing has shipped since. MSK, Confluent Cloud, Aiven and Redpanda Cloud either lock down or no longer expose ZooKeeper endpoints, so most managed Kafka is out on the same rule.
- Data plane: no message browsing, no Schema Registry integration and no Kafka Connect management.
- Access control: LDAP basic auth and coarse global feature flags, with no per-user or per-topic granularity and no audit log.
- Transport: credentials pass in plaintext unless SSL is configured by hand, which the README states.
- Freshness: reads come from an internal cache rather than live broker APIs, so a reassignment may not appear immediately.
Enabling ZooKeeper ACLs breaks the connection entirely, and the one Kubernetes path, a third-party Helm chart, is archived and read-only. Both are limits on any Kafka security architecture that has to be evidenced.
Conduktor’s costs are architectural rather than functional. Console requires PostgreSQL 13 or later and it is not optional, so a monitoring stack acquires a database with its own backups and upgrade path.
- Resources: 2 CPU and 3 GB of RAM for Console, plus 2 CPU and 4 GB for Gateway.
- Latency: Gateway adds 2 to 10 milliseconds per message, and it is a single point of failure needing its own high-availability plan.
- Azure: Event Hubs is reachable over Kafka protocol compatibility, but Azure’s native Schema Registry is not integrated.
- Directory: Active Directory needs a specific LDAP search filter, or the default configuration returns an invalid user error.
Console also falls back to querying the cluster directly when its index is stale, which shows up as slow page loads, and there is no native distributed tracing, so it sits alongside the best Kafka monitoring tools rather than replacing them. Governance is priced rather than absent: group-level RBAC for Kafka, topic policies, masking and unlimited audit logs all begin at Team Edition.
Which should you pick?
Keep CMAK if:
- the cluster is still on ZooKeeper with no migration scheduled
- the people using it already hold cluster credentials
- the daily work is partition reassignment and preferred-replica election
Take Conduktor if:
- a regulator or a customer contract makes the audit trail non-negotiable
- encryption or masking has to be enforced below the application rather than in a UI
- handing topic creation to product teams inside policy guardrails is the actual project
CMAK’s case closes on the day the cluster moves to KRaft, and a look at the best Kafka management tools is better done before that day than after. Conduktor’s seat price buys a vendor under contract and a certification an auditor will accept, and on those three requirements no free Kafka UI substitutes for one.
Kpow: on KRaft, and out of the data path
CMAK cannot connect to a Kafka 4.0 cluster at all, since it needs a direct ZooKeeper connection and KRaft is the only mode left, and Conduktor’s Gateway, where deployed, sits in the data path itself, adding 2 to 10 milliseconds per message and becoming a single point of failure that needs its own high-availability plan. Neither gives a team governance that’s both current with KRaft and outside the data path it’s watching. Kpow by Factor House is licensed per cluster at a published price, runs against a KRaft cluster you already operate, needs no external database, and never sits in the data path. A new engineer is not a new invoice line.
The bill shouldn’t be attached to the seat count or the latency budget. Point Kpow at your own KRaft cluster and see what neither of these gives you.