CMAK vs Kafbat UI
ComparisonsCMAK vs Kafbat UI, compared
Key takeaway
CMAK and Kafbat UI are both free, self-hosted web interfaces over a Kafka cluster, and their feature lists overlap enough that connection method is what actually separates them. CMAK’s last stable release, 3.0.0.6, dates to April 2022 and needs a direct ZooKeeper connection, so it cannot reach a KRaft cluster at all. Kafbat UI, the maintained continuation of the Provectus kafka-ui project, reached v1.5.0 in April 2026 and connects through bootstrap servers, with role-based access control, server-side masking and an audit log. Kpow by Factor House is licensed per cluster at a published price.
What is CMAK?
CMAK is Cluster Manager for Apache Kafka, originally Kafka Manager, built at Yahoo and published under Apache 2.0. It is a Scala application on the Play framework, and its scope is administrative rather than data-plane. It requires a direct connection to a ZooKeeper ensemble to function at all.
- registering and monitoring clusters from one view
- creating and modifying topics, adding partitions, changing replication
- preferred-replica election and partition reassignment
- optional JMX polling at broker and topic level
The last stable release, 3.0.0.6, was tagged on 29 April 2022, and 3.0.0.5 before it in June 2020, so the silence since continues a cadence that had already stopped. The last push of any kind was 2 August 2023, and 499 issues stand open with nobody triaging them. The repository is public and it is not archived, and it carries 11,925 stars and 2,476 forks.
What is Kafbat UI?
Kafbat UI is a free, Apache 2.0 web dashboard for observing and administering Kafka clusters, deployed as a container. It is the maintained continuation of the Provectus kafka-ui project, carried forward by contributors who were on that project from its inception. A search for Kafka UI still lands most engineers on the Provectus repository, which has cut no release since v0.7.2 in April 2024 and taken no commit since that July, and which carries 12,200 stars against the live one’s 2,642.
- Access control: roles over cluster configuration, topics, consumer groups, schemas, Connect, connectors, ksqlDB and ACLs.
- Identity: OAuth, Google, GitHub, Cognito, LDAP and Active Directory.
- Masking: server-side removal, replacement or masking of fields by regular expression.
- Extensibility: custom serializer and deserializer plugins, and a Swagger UI over the product’s own API.
The release record reads the way an active project’s does: v1.0.0 in March 2024 through to v1.5.0 on 20 April 2026, with commits still landing in August 2026. The company behind it sells professional services rather than a paid edition.
What is the official 2026 pricing of CMAK and Kafbat UI?
Both are Apache 2.0 with no paid tier, no seat cap and no cluster cap. The question worth asking is what free costs, and the two answers are not the same shape.
On CMAK, free costs a build. It is distributed as source needing an sbt and Scala toolchain, and current toolchains fight it: there is a reported OpenJDK 17 compatibility problem and dependency trouble on recent sbt and Scala. The container and Kubernetes paths are community projects rather than Yahoo’s, and both have stopped. There is no documentation site, no community channel and no commercial support of any kind. On Kafbat UI, free costs operator time plus whatever services contract gets negotiated: standing it up is a container and a configuration block, and the money is in Kafka architecture review, custom UI work, performance and scaling, security and compliance, and 24/7 support.
Where does each one run out?
Partition reassignment and preferred-replica election are what CMAK is most consistently praised for, and they are exactly the operations lightweight viewers do not cover. The limits are structural.
- Data plane: no message browsing, no Schema Registry integration, no Kafka Connect management and no ksqlDB.
- Freshness: reads come from an internal cache rather than live broker APIs.
- Access control: LDAP basic auth and coarse global feature flags, with no SAML, no OIDC and no per-topic granularity, which is what RBAC for Kafka has to mean if it means anything.
- Longevity: long-running instances hang after 20 to 30 days from thread-pool exhaustion, reported in 2018 and never addressed.
Credentials also pass in plaintext unless SSL is configured by hand, which the README states and which is a hole in any Kafka security architecture. There is no audit log, enabling ZooKeeper ACLs breaks the connection outright, and managed services either lock down or no longer expose ZooKeeper endpoints.
Kafbat UI’s exposure is organisational rather than technical. Release cadence is the honest concern: five releases across 2025, and one since. Commits are still landing, so the project is alive, though the release list alone would not say so. It publishes no support commitment of its own, so response times come from a services engagement.
- Audit level: defaults to modifications only, so who looked at a payload is not captured until an operator raises it.
- Audit topic: must not be compacted, because records carry no key, and it defaults to one partition.
- Masking: protects what the Messages page displays, pattern-driven per cluster, so coverage depends on the patterns written.
- Dynamic config: anything set through the configuration wizard is lost on restart without a mounted volume.
Which should you pick?
Stay on CMAK if:
- the cluster is on ZooKeeper and staying there
- the tool is for a small group who already hold cluster access
- partition reassignment and preferred-replica election are most of its use
Move to Kafbat UI if:
- the cluster is on Kafka 4.x, or a KRaft migration is scheduled
- anybody needs to browse messages, a schema registry, Kafka Connect or ksqlDB
- more than a handful of people need access, and not all the same access
- an auditor is going to ask who did what
The move itself costs less than it looks, with one exception. CMAK holds no cluster state of its own, so removing it changes nothing on the brokers and there is nothing to export, and any single sign-on in front of it is a reverse proxy that gets re-pointed. What has to be replaced is the partition-reassignment workflow, and an operator who leaned on it should work that out before the cutover rather than during one. Running both while the migration runs is fine for as long as the ensemble is there. If the shortlist is still open, the wider field of best free Kafka UI tools is worth a pass.
Kpow: governance with a vendor behind it
Both of these are free because nobody is under contract to keep them running. CMAK has 522 open issues and nobody triaging them, and Kafbat UI publishes no support commitment of its own — what response time you get comes from a services contract negotiated separately, not from the licence. Kpow by Factor House is licensed per cluster at a published price, and that price buys role-based access control across topics, Connect, ksqlDB and schemas, in one stateless JVM container with no external database, from a vendor who answers for it.
Governance that nobody is on the hook for isn’t governance an auditor will accept. Kpow puts a vendor behind the number.