chore(release): prepare v1.26.0

README.md

@@ -206,18 +206,18 @@ When you install charts with Helm directly:
 | Chart | Version | App Version | Description |
 |:------|:--------|:------------|:------------|
 | [`apicurio-registry`](charts/apicurio-registry/) | 0.4.0 | 3.3.0 | Apicurio Registry, backed by the kafka-cluster chart (Strimzi) in this repository |
-| [`connect-cluster`](charts/connect-cluster/) | 2.1.6 | 4.3.1 | A Helm chart for deploying Strimzi Kafka Connect clusters |
+| [`connect-cluster`](charts/connect-cluster/) | 2.1.7 | 4.3.1 | A Helm chart for deploying Strimzi Kafka Connect clusters |
 | [`headlamp`](charts/headlamp/) | 0.2.0 | 0.40.1 | Headlamp — Kubernetes Dashboard for cluster visualization and management |
-| [`kafka-cluster`](charts/kafka-cluster/) | 1.0.8 | 4.3.1 | A Strimzi Kafka cluster in KRaft mode — node pools, topics, users, rebalancing, tiered storage, network policy and observability |
+| [`kafka-cluster`](charts/kafka-cluster/) | 1.0.9 | 4.3.1 | A Strimzi Kafka cluster in KRaft mode — node pools, topics, users, rebalancing, tiered storage, network policy and observability |
 | [`kafka-common`](charts/kafka-common/) | 0.1.0 |  | Library chart — the templates the Strimzi charts share (names and labels, rails, Kafka client authentication, the Connect worker spec, KafkaUser, secret sync, NetworkPolicy and monitoring fragments, the Grafana grid, the preflight probe) |
 | [`kafka-ui`](charts/kafka-ui/) | 0.3.0 | v1.5.0 | A Helm chart for deploying Kafka UI (Kafbat) with Strimzi SCRAM-SHA-512 authentication |
 | [`kates-chaos`](charts/kates-chaos/) | 2.2.1 | 3.28.0 | Kates Chaos Engineering — wraps the LitmusChaos execution plane (operator, exporter, CRDs) with Kafka-specific RBAC, experiment/engine templating, and monitoring |
 | [`kates-platform`](charts/kates-platform/) | 0.7.0 | 1.0.0 | Umbrella chart for the full Kates platform — Kafka, Kates, and supporting infrastructure |
-| [`kates`](charts/kates/) | 0.11.2 | 1.25.1 | Kates — Kafka Advanced Testing & Engineering Suite |
+| [`kates`](charts/kates/) | 0.11.3 | 1.26.0 | Kates — Kafka Advanced Testing & Engineering Suite |
 | [`legacy-kafka`](charts/legacy-kafka/) | 0.2.0 | 3.9.1 | A deliberately old Kafka (2.x on ZooKeeper, or 3.x on KRaft) to migrate FROM — the replication source that the pinned Strimzi release cannot deploy |
-| [`mirror-maker2`](charts/mirror-maker2/) | 0.11.4 | 4.3.1 | Strimzi KafkaMirrorMaker2 — cross-cluster replication, DR, and cross-version migration (2.x/3.x → 4.x) |
+| [`mirror-maker2`](charts/mirror-maker2/) | 0.11.5 | 4.3.1 | Strimzi KafkaMirrorMaker2 — cross-cluster replication, DR, and cross-version migration (2.x/3.x → 4.x) |
 | [`monitoring`](charts/monitoring/) | 1.6.0 | 82.4.3 | Kates Monitoring — wraps kube-prometheus-stack with Kates-specific dashboards and configuration |
-| [`strimzi-operator`](charts/strimzi-operator/) | 0.3.4 | 1.2.0 | The Strimzi Kafka Operator — wraps the upstream chart with pinned kates defaults, an owned CRD-upgrade hook, and a strict values schema |
+| [`strimzi-operator`](charts/strimzi-operator/) | 0.3.5 | 1.2.0 | The Strimzi Kafka Operator — wraps the upstream chart with pinned kates defaults, an owned CRD-upgrade hook, and a strict values schema |
 | [`velero`](charts/velero/) | 11.3.3 | 1.17.1 | A Helm chart for velero |
 <!-- chart-table:end -->
 

charts/connect-cluster/Chart.yaml

@@ -2,10 +2,10 @@ apiVersion: v2
 name: connect-cluster
 description: A Helm chart for deploying Strimzi Kafka Connect clusters
 type: application
-# Patch: the Helm-test image moves to kates-tester 1.25.0, the tag the
-# v1.25.0 release publishes; every Strimzi chart pins the same one.
+# Patch: the Helm-test image moves to kates-tester 1.26.0, the tag the
+# v1.26.0 release publishes; every Strimzi chart pins the same one.
 # Templates and defaults are otherwise unchanged.
-version: 2.1.6
+version: 2.1.7
 # Tracks the Kafka line the workers run, as mirror-maker2's does. The plugin
 # set is in the image; its pin is the kates.io/connect-image annotation.
 appVersion: "4.3.1"
@@ -32,6 +32,8 @@ annotations:
   artifacthub.io/category: streaming-messaging
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: changed
+      description: "testImages.kubectl (and testImages.kafka where present) move to kates-tester 1.26.0, the tag the v1.26.0 release publishes; every Strimzi chart in the repository pins the same one (scripts/check-versions.sh holds them to the kates chart's appVersion). The image is unchanged since 1.25.1 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: changed
       description: "testImages.kubectl (and testImages.kafka where present) move to kates-tester 1.25.1, the tag the v1.25.1 release publishes; every Strimzi chart in the repository pins the same one (scripts/check-versions.sh holds them to the kates chart's appVersion)."
     - kind: changed

charts/connect-cluster/values.yaml

@@ -41,7 +41,7 @@ imagePullPolicy: ""
 
 # -- Images the chart's own pods use
 testImages:
-  kubectl: "ghcr.io/bmscomp/kates-tester:1.25.1"
+  kubectl: "ghcr.io/bmscomp/kates-tester:1.26.0"
 
 # ── Workers ─────────────────────────────────────────────────────────────────
 # -- Number of worker replicas (seeded from autoscaling.minReplicas under an HPA)

charts/kafka-cluster/Chart.yaml

@@ -2,10 +2,10 @@ apiVersion: v2
 name: kafka-cluster
 description: A Strimzi Kafka cluster in KRaft mode — node pools, topics, users, rebalancing, tiered storage, network policy and observability
 type: application
-# Patch: the Helm-test images move to kates-tester 1.25.0, the tag the
-# v1.25.0 release publishes; every Strimzi chart pins the same one.
+# Patch: the Helm-test images move to kates-tester 1.26.0, the tag the
+# v1.26.0 release publishes; every Strimzi chart pins the same one.
 # Templates and defaults are otherwise unchanged.
-version: 1.0.8
+version: 1.0.9
 appVersion: "4.3.1"
 icon: https://strimzi.io/assets/images/strimzi_logo.png
 home: https://strimzi.io/
@@ -39,6 +39,8 @@ annotations:
   # newer; never lower it without removing the feature that set it.
   kates.io/kafka-floor: "4.2.0"
   artifacthub.io/changes: |
+    - kind: changed
+      description: "testImages.kubectl (and testImages.kafka where present) move to kates-tester 1.26.0, the tag the v1.26.0 release publishes; every Strimzi chart in the repository pins the same one (scripts/check-versions.sh holds them to the kates chart's appVersion). The image is unchanged since 1.25.1 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: changed
       description: "testImages.kubectl (and testImages.kafka where present) move to kates-tester 1.25.1, the tag the v1.25.1 release publishes; every Strimzi chart in the repository pins the same one (scripts/check-versions.sh holds them to the kates chart's appVersion)."
     - kind: changed

charts/kafka-cluster/values.yaml

@@ -71,8 +71,8 @@ global:
 # -- Images of the Helm-test pods. Pinned: scripts/check-versions.sh keeps
 # them aligned with the other charts.
 testImages:
-  kafka: "ghcr.io/bmscomp/kates-tester:1.25.1"
-  kubectl: "ghcr.io/bmscomp/kates-tester:1.25.1"
+  kafka: "ghcr.io/bmscomp/kates-tester:1.26.0"
+  kubectl: "ghcr.io/bmscomp/kates-tester:1.26.0"
   # -- Pull policy for test pods (empty: Kubernetes' default)
   pullPolicy: IfNotPresent
 

charts/kates/Chart.yaml

@@ -2,15 +2,14 @@ apiVersion: v2
 name: kates
 description: Kates — Kafka Advanced Testing & Engineering Suite
 type: application
-# Patch: a new chaos.provider value renders KATES_CHAOS_PROVIDER in the
-# configmap; empty by default, so a release that leaves it out renders as
-# before. appVersion is unchanged.
-version: 0.11.2
+# Patch: appVersion and the image tag move to 1.26.0, the tag the v1.26.0
+# release publishes. Templates are otherwise unchanged.
+version: 0.11.3
 # The non-blocking health endpoints this chart's probes now point at come from
 # a BUILD-TIME property (quarkus.messaging.health.enabled=false), so they only
 # exist in the image built from this branch. Keep appVersion and
 # image.tag in values.yaml pinned to that release.
-appVersion: "1.25.1"
+appVersion: "1.26.0"
 keywords:
   - kafka
   - testing
@@ -29,6 +28,8 @@ annotations:
   artifacthub.io/category: integration-delivery
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: changed
+      description: "appVersion 1.26.0 and the image tag move to 1.26.0. The backend changes since 1.25.1: the cluster health check reports a KRaft quorum it cannot describe instead of dropping it (#403); the security audit and pentest read each listener's protocol (#379); the tuning report endpoint is gone (#386); run retention keeps the run a baseline names (#378); a status poll writes only over the status it read (#377); each INTEGRITY run reads in a consumer group of its own (#376); compound runs and resilience faults go through the safety guard and the disruption lease (#375); orphan recovery undoes faults left from before the API started (#374); and the native image starts with a named API keys file (#371). Templates are otherwise unchanged."
     - kind: added
       description: "chaos.provider (KATES_CHAOS_PROVIDER, default empty: the backend's litmus-crd) picks the chaos provider every fault goes through: litmus-crd, kubernetes, hybrid or noop. It used to be set only through extraEnv. `kates deploy --with-chaos=false` sets noop when no chaos release is installed, so a stack without Litmus skips its faults by design instead of logging an ERROR and falling back to noop. values.schema.json refuses any other name"
     - kind: fixed

charts/kates/README.md

@@ -33,7 +33,7 @@ All configuration is in [values.yaml](values.yaml). Key sections:
 | Parameter | Default | Description |
 |-----------|---------|-------------|
 | `image.repository` | `ghcr.io/bmscomp/kates` | Container image name |
-| `image.tag` | `1.25.1` | Container image tag, pinned in `values.yaml` to match the chart's `appVersion`. Keep it at 1.22.0 or newer: the probes use health endpoints older images lack |
+| `image.tag` | `1.26.0` | Container image tag, pinned in `values.yaml` to match the chart's `appVersion`. Keep it at 1.22.0 or newer: the probes use health endpoints older images lack |
 | `image.pullPolicy` | `IfNotPresent` | Image pull policy |
 | `replicaCount` | `1` | Number of Kates API pods. Must be 1; see [One replica](#one-replica) |
 | `kafka.bootstrapServers` | `krafter-kafka-bootstrap.kafka.svc:9092` | Kafka bootstrap address |

charts/kates/values-native.yaml

@@ -23,7 +23,7 @@
 
 image:
   # Published as <appVersion>-native alongside the JVM tag.
-  tag: "1.25.1-native"
+  tag: "1.26.0-native"
 
 # Not read by a native image — see above.
 jvm:

charts/kates/values.yaml

@@ -27,7 +27,7 @@ image:
   repository: ghcr.io/bmscomp/kates
   # -- Image tag. Must be the release that carries the non-blocking health
   # endpoints the probe defaults below depend on (>= 1.22.0).
-  tag: "1.25.1"
+  tag: "1.26.0"
   # -- Image pull policy
   pullPolicy: IfNotPresent
 

charts/mirror-maker2/Chart.yaml

@@ -14,9 +14,9 @@ type: application
 # inert, which left two keys that accept a number and ignore it; a release
 # setting either is now refused with the constant to edit named.
 # Patch: the pre-flight, data-test and secret-sync image moves to
-# kates-tester 1.25.0, the tag the v1.25.0 release publishes; every Strimzi
+# kates-tester 1.26.0, the tag the v1.26.0 release publishes; every Strimzi
 # chart pins the same one. Templates and defaults are otherwise unchanged.
-version: 0.11.4
+version: 0.11.5
 # Tracks the Kafka line the MM2 Connect workers run (STRIMZI_KAFKA_VERSION).
 appVersion: "4.3.1"
 kubeVersion: ">=1.27.0-0"
@@ -43,6 +43,8 @@ annotations:
   artifacthub.io/category: streaming-messaging
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: changed
+      description: "testImages.kubectl (and testImages.kafka where present) move to kates-tester 1.26.0, the tag the v1.26.0 release publishes; every Strimzi chart in the repository pins the same one (scripts/check-versions.sh holds them to the kates chart's appVersion). The image is unchanged since 1.25.1 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: changed
       description: "testImages.kubectl (and testImages.kafka where present) move to kates-tester 1.25.1, the tag the v1.25.1 release publishes; every Strimzi chart in the repository pins the same one (scripts/check-versions.sh holds them to the kates chart's appVersion)."
     - kind: changed

charts/mirror-maker2/values.yaml

@@ -21,7 +21,7 @@ extraLabels: {}
 
 # -- Images used by the Helm test pods
 testImages:
-  kubectl: "ghcr.io/bmscomp/kates-tester:1.25.1"
+  kubectl: "ghcr.io/bmscomp/kates-tester:1.26.0"
 
 # -- Number of MM2 (Connect) worker replicas
 replicas: 3

charts/strimzi-operator/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
 name: strimzi-operator
-# Patch: the CRD-hook and Helm-test image moves to kates-tester 1.25.0, the
-# tag the v1.25.0 release publishes; every Strimzi chart pins the same one.
+# Patch: the CRD-hook and Helm-test image moves to kates-tester 1.26.0, the
+# tag the v1.26.0 release publishes; every Strimzi chart pins the same one.
 # Templates and defaults are otherwise unchanged.
-version: 0.3.4
+version: 0.3.5
 # Tracks the Strimzi operator version this chart deploys. The CLI rewrites this
 # (and the dependency version) in a generated copy when another version is
 # selected; the repository copy is the pin.
@@ -30,6 +30,8 @@ annotations:
   artifacthub.io/category: streaming-messaging
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: changed
+      description: "testImages.kubectl (and testImages.kafka where present) move to kates-tester 1.26.0, the tag the v1.26.0 release publishes; every Strimzi chart in the repository pins the same one (scripts/check-versions.sh holds them to the kates chart's appVersion). The image is unchanged since 1.25.1 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: changed
       description: "testImages.kubectl (and testImages.kafka where present) move to kates-tester 1.25.1, the tag the v1.25.1 release publishes; every Strimzi chart in the repository pins the same one (scripts/check-versions.sh holds them to the kates chart's appVersion). crdUpgrade.proxy.{http,https,noProxy,caBundle} lets the CRD-upgrade Job reach its source through a proxy and a private CA (#368)."
     - kind: changed

charts/strimzi-operator/README.md

@@ -75,7 +75,7 @@ kubectl get deploy strimzi-cluster-operator -n strimzi-operator \
 | Key | Default | Description |
 |-----|---------|-------------|
 | `strimziVersion` | `1.2.0` | Builds the CRD bundle URL. Must equal `Chart.yaml` `appVersion` + dependency version. |
-| `testImages.kubectl` | `ghcr.io/bmscomp/kates-tester:1.25.1` | Image for the CRD hook Job and Helm tests |
+| `testImages.kubectl` | `ghcr.io/bmscomp/kates-tester:1.26.0` | Image for the CRD hook Job and Helm tests |
 | `crdUpgrade.enabled` | `true` | Apply CRDs via the pre-install/pre-upgrade hook |
 | `crdUpgrade.url` | `""` | Override the bundle URL (empty = derive from `strimziVersion`). Use an internal mirror when airgapped. |
 | `crdUpgrade.backoffLimit` | `3` | Job retries before the install/upgrade aborts |

charts/strimzi-operator/values.yaml

@@ -44,7 +44,7 @@ strimziVersion: "1.2.0"
 # tests). The operator's own image comes from the subchart.
 testImages:
   # -- kubectl image used by the CRD-upgrade hook Job and the Helm tests
-  kubectl: "ghcr.io/bmscomp/kates-tester:1.25.1"
+  kubectl: "ghcr.io/bmscomp/kates-tester:1.26.0"
 
 # ── CRD lifecycle ────────────────────────────────────────────────────────────
 # Closes the gap Helm leaves: crds/ is applied on install and never on upgrade.

config/litmus/experiments/consumer-latency-probe.yaml

@@ -83,7 +83,7 @@ spec:
                 criteria: contains
                 value: "PASS"
               source:
-                image: ghcr.io/bmscomp/kates-tester:1.25.1
+                image: ghcr.io/bmscomp/kates-tester:1.26.0
                 hostNetwork: false
 ---
 # Consumer latency monitoring ConfigMap

config/litmus/experiments/isr-health-probe.yaml

@@ -56,7 +56,7 @@ spec:
                 criteria: contains
                 value: "PASS"
               source:
-                image: ghcr.io/bmscomp/kates-tester:1.25.1
+                image: ghcr.io/bmscomp/kates-tester:1.26.0
                 hostNetwork: false
 
           # Min ISR check - ensure partitions can still accept writes
@@ -88,7 +88,7 @@ spec:
                 criteria: "<="
                 value: "5"  # Allow up to 5 unavailable during chaos
               source:
-                image: ghcr.io/bmscomp/kates-tester:1.25.1
+                image: ghcr.io/bmscomp/kates-tester:1.26.0
                 hostNetwork: false
 ---
 # ISR health monitoring ConfigMap

config/litmus/experiments/kafka-chaos-cronjob.yaml

@@ -58,7 +58,7 @@ spec:
       # Pre-flight check
       - name: preflight-check
         container:
-          image: ghcr.io/bmscomp/kates-tester:1.25.1
+          image: ghcr.io/bmscomp/kates-tester:1.26.0
           imagePullPolicy: IfNotPresent
           command: ["/bin/bash"]
           args:
@@ -96,7 +96,7 @@ spec:
             - name: experiment
             - name: duration
         container:
-          image: ghcr.io/bmscomp/kates-tester:1.25.1
+          image: ghcr.io/bmscomp/kates-tester:1.26.0
           imagePullPolicy: IfNotPresent
           command: ["/bin/bash"]
           args:
@@ -142,7 +142,7 @@ spec:
       # Verify cluster recovery
       - name: verify-cluster
         container:
-          image: ghcr.io/bmscomp/kates-tester:1.25.1
+          image: ghcr.io/bmscomp/kates-tester:1.26.0
           imagePullPolicy: IfNotPresent
           command: ["/bin/bash"]
           args:

config/litmus/experiments/kafka-gameday-workflow.yaml

@@ -192,7 +192,7 @@ spec:
           - name: experiment-type
           - name: extra-env
       container:
-        image: ghcr.io/bmscomp/kates-tester:1.25.1
+        image: ghcr.io/bmscomp/kates-tester:1.26.0
         imagePullPolicy: IfNotPresent
         command: ["/bin/bash"]
         args:
@@ -255,7 +255,7 @@ spec:
         parameters:
           - name: phase
       container:
-        image: ghcr.io/bmscomp/kates-tester:1.25.1
+        image: ghcr.io/bmscomp/kates-tester:1.26.0
         imagePullPolicy: IfNotPresent
         command: ["/bin/bash"]
         args:
@@ -300,7 +300,7 @@ spec:
         parameters:
           - name: phase
       container:
-        image: ghcr.io/bmscomp/kates-tester:1.25.1
+        image: ghcr.io/bmscomp/kates-tester:1.26.0
         imagePullPolicy: IfNotPresent
         command: ["/bin/bash"]
         args:
@@ -333,7 +333,7 @@ spec:
     # Final report
     - name: chaos-report
       container:
-        image: ghcr.io/bmscomp/kates-tester:1.25.1
+        image: ghcr.io/bmscomp/kates-tester:1.26.0
         imagePullPolicy: IfNotPresent
         command: ["/bin/bash"]
         args:

config/litmus/experiments/kates-chaos-integration-job.yaml

@@ -18,7 +18,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: chaos-runner
-          image: ghcr.io/bmscomp/kates-tester:1.25.1
+          image: ghcr.io/bmscomp/kates-tester:1.26.0
           imagePullPolicy: IfNotPresent
           env:
             - name: KATES_API_URL

config/litmus/experiments/producer-throughput-probe.yaml

@@ -45,7 +45,7 @@ spec:
                 criteria: ">="
                 value: "10.0"  # Minimum 10 records/sec
               source:
-                image: ghcr.io/bmscomp/kates-tester:1.25.1
+                image: ghcr.io/bmscomp/kates-tester:1.26.0
                 hostNetwork: false
 ---
 # Standalone producer throughput ConfigMap for reuse