What's new in Cloudera Flow Management 4.12.0

Cloudera Flow Management 4.12.0.10001

Cloudera Flow Management 4.12.0.10001 (Service Pack 1) replaces version 4.12.0.10000. It fixes a packaging issue introduced in version 4.12.0.10000 that caused some NiFi library and NAR filenames to be truncated. For more information, see Fixed issues in Cloudera Flow Management 4.12.0.10001

Cloudera Flow Management 4.12.0.10000

Cloudera Flow Management 4.12.0.10000 (Service Pack 1) release includes enhancements and fixes for Cloudera Flow Management 4.12.0.1.

FIPS 140-3 support

Cloudera Flow Management now uses FIPS 140-3-compliant cryptographic modules and updated Java security settings. This release replaces the underlying FIPS 140-2 cryptographic provider with FIPS 140-3-validated modules, including an updated version of the Cloudera Cryptographic Java (CCJ) module.

Cloudera Manager has also been updated to support FIPS 140-3 configuration for NiFi.

FIPS 140-3 compliance is enforced at the operating system and environment level. When upgrading from a FIPS 140-2 environment, you do not need to modify existing NiFi dataflows or user-facing configurations.

For more information, see FIPS 140 compliance.

TLS 1.3-only communication for NiFi and NiFi Registry

NiFi and NiFi Registry now use only TLS 1.3 connections across all deployment types when TLS 1.3 is configured through Cloudera Manager.

When TLS 1.3-only mode is enabled, the following NiFi and NiFi Registry endpoints accept only TLS 1.3 connections:

• NiFi and NiFi Registry web interfaces
• REST APIs
• NiFi site-to-site ports

Connections that use TLS 1.2 or earlier are rejected.

The CSD template automatically configures the nifi.web.https.ciphersuites.include and nifi.registry.web.https.ciphersuites.include properties with the appropriate TLS 1.3 cipher suites. If you previously configured custom cipher suites, those settings are preserved and are not overwritten.

For existing clusters, the TLS 1.3 configuration is applied automatically during the upgrade. After upgrading, clients that support only TLS 1.2 or earlier will no longer be able to establish connections to endpoints configured for TLS 1.3-only communication.

Upgrade considerations

Before upgrading, verify that all clients and integrations connecting to NiFi or NiFi Registry support TLS 1.3. Update clients that rely exclusively on TLS 1.2 or earlier to maintain connectivity with endpoints configured for TLS 1.3.

For more information, see TLS 1.3 enforcement for NiFi and NiFi Registry.

Apache Iceberg V3 deletion vector support

NiFi Iceberg processors now support deletion vectors introduced in the Apache Iceberg V3 specification. Deletion vectors use a merge-on-read approach to track deleted or updated rows more efficiently. Compared with the positional delete files used by Iceberg V2, deletion vectors can improve query performance and storage efficiency. With this enhancement, NiFi can process Iceberg V3 tables that use deletion vectors for row-level deletes and updates.

Cloudera Flow Management 4.12.0.1

The sections below highlight the most important updates in the Cloudera Flow Management 4.12.0 release.

Cloudera Flow Management 4.12.0.0

Cloudera Flow Management version 4.12.0.0 release includes the following enhancements and fixes.

New NiFi components

For a full list of supported NiFi components, see the Support Matrix.

Improvements

Industrial Internet of Things (IIoT) support

ConsumeMQTTIIoT and MQTTIIoTReader allows flows to receive and parse Sparkplug messages, enabling IIoT/edge use cases as an industry standard format.

Kafka OAuth2 authentication support

Support for OAuth2 (OAUTHBEARER) authentication has been added for Kafka components. This enhancement enables secure access to Kafka brokers using an OAuth2 Token Provider controller service to obtain and manage access tokens.

The feature is available for the following Kafka component groups:

• Kafka_2_6 / Kafka2CDP
• Kafka3ConnectionService

New flow analysis rule

The RequireServerSSLContext flow analysis rule has been added to ensure that servers (using ListenHttp or ListenTCP) cannot be created without a secure communications layer.

Flow Migration Tool

Cloudera Flow Migration Tool 7.0.0 adds support for migrations to Cloudera Flow Management 4.12.0 and includes several bug fixes.

For more information, see the Migration Tool documentation.

Upgrade and migration options

Cloudera Flow Management 4.12.0 is supported on Cloudera platform 7.3.2.

You can upgrade to Cloudera Flow Management 4.12.0 from 4.10.0 and 4.11.0 using Cloudera Manager. However, because versions 4.10.0 and 4.11.0 are supported on Cloudera Base on premises 7.3.1 and its service packs, you must first upgrade the runtime to Cloudera platform 7.3.2, and then upgrade Cloudera Flow Management to 4.12.0. For instructions, see Upgrading from Cloudera Flow Management 4.10.0 or 4.11.0 to 4.12.0.

In-place upgrades from Cloudera Flow Management 2.1.7 and lower versions to Cloudera Flow Management 4.12.0 are not supported.

Flows created in NiFi 1 must be migrated to NiFi 2 before they can be used in Cloudera Flow Management 4.12.0 (which runs NiFi 2). After the NiFi 1 - NiFi 2 migration, you can import the flows into a 4.12.0 environment. For more information about the migration process and the Cloudera Flow Migration Tool, see the Migration documentation.

Installation

To perform a fresh installation of Cloudera Flow Management 4.12.0, follow the Cloudera Flow Management installation workflow.