chore(release): prepare v1.29.2

README.md

@@ -206,18 +206,18 @@ When you install charts with Helm directly:
 | Chart | Version | App Version | Description |
 |:------|:--------|:------------|:------------|
 | [`apicurio-registry`](charts/apicurio-registry/) | 0.4.1 | 3.3.0 | Apicurio Registry, backed by the kafka-cluster chart (Strimzi) in this repository |
-| [`connect-cluster`](charts/connect-cluster/) | 2.1.12 | 4.3.1 | A Helm chart for deploying Strimzi Kafka Connect clusters |
+| [`connect-cluster`](charts/connect-cluster/) | 2.1.13 | 4.3.1 | A Helm chart for deploying Strimzi Kafka Connect clusters |
 | [`headlamp`](charts/headlamp/) | 0.2.1 | 0.40.1 | Headlamp — Kubernetes Dashboard for cluster visualization and management |
-| [`kafka-cluster`](charts/kafka-cluster/) | 1.0.14 | 4.3.1 | A Strimzi Kafka cluster in KRaft mode — node pools, topics, users, rebalancing, tiered storage, network policy and observability |
+| [`kafka-cluster`](charts/kafka-cluster/) | 1.0.15 | 4.3.1 | A Strimzi Kafka cluster in KRaft mode — node pools, topics, users, rebalancing, tiered storage, network policy and observability |
 | [`kafka-common`](charts/kafka-common/) | 0.1.1 |  | Library chart — the templates the Strimzi charts share (names and labels, rails, Kafka client authentication, the Connect worker spec, KafkaUser, secret sync, NetworkPolicy and monitoring fragments, the Grafana grid, the preflight probe) |
 | [`kafka-ui`](charts/kafka-ui/) | 0.3.1 | v1.5.0 | A Helm chart for deploying Kafka UI (Kafbat) with Strimzi SCRAM-SHA-512 authentication |
-| [`kates-chaos`](charts/kates-chaos/) | 2.3.2 | 3.28.0 | Kates Chaos Engineering — wraps the LitmusChaos execution plane (operator, exporter, CRDs) with Kafka-specific RBAC, experiment/engine templating, and monitoring |
+| [`kates-chaos`](charts/kates-chaos/) | 2.3.3 | 3.28.0 | Kates Chaos Engineering — wraps the LitmusChaos execution plane (operator, exporter, CRDs) with Kafka-specific RBAC, experiment/engine templating, and monitoring |
 | [`kates-platform`](charts/kates-platform/) | 0.8.3 | 1.0.0 | Umbrella chart for the full Kates platform — Kafka, Kates, and supporting infrastructure |
-| [`kates`](charts/kates/) | 0.13.3 | 1.29.1 | Kates — Kafka Advanced Testing & Engineering Suite |
+| [`kates`](charts/kates/) | 0.13.4 | 1.29.2 | Kates — Kafka Advanced Testing & Engineering Suite |
 | [`legacy-kafka`](charts/legacy-kafka/) | 0.2.1 | 3.9.1 | A deliberately old Kafka (2.x on ZooKeeper, or 3.x on KRaft) to migrate FROM — the replication source that the pinned Strimzi release cannot deploy |
-| [`mirror-maker2`](charts/mirror-maker2/) | 0.11.10 | 4.3.1 | Strimzi KafkaMirrorMaker2 — cross-cluster replication, DR, and cross-version migration (2.x/3.x → 4.x) |
+| [`mirror-maker2`](charts/mirror-maker2/) | 0.11.11 | 4.3.1 | Strimzi KafkaMirrorMaker2 — cross-cluster replication, DR, and cross-version migration (2.x/3.x → 4.x) |
 | [`monitoring`](charts/monitoring/) | 1.7.0 | 82.4.3 | Kates Monitoring — wraps kube-prometheus-stack with Kates-specific dashboards and configuration |
-| [`strimzi-operator`](charts/strimzi-operator/) | 0.4.2 | 1.2.0 | The Strimzi Kafka Operator — wraps the upstream chart with pinned kates defaults, an owned CRD-upgrade hook, and a strict values schema |
+| [`strimzi-operator`](charts/strimzi-operator/) | 0.4.3 | 1.2.0 | The Strimzi Kafka Operator — wraps the upstream chart with pinned kates defaults, an owned CRD-upgrade hook, and a strict values schema |
 | [`velero`](charts/velero/) | 11.3.4 | 1.17.1 | A Helm chart for velero |
 <!-- chart-table:end -->
 

charts/connect-cluster/Chart.yaml

@@ -6,9 +6,9 @@ type: application
 # (the Helm test pods get requests and limits, the rack init container the
 # restricted security context); podLabels reach every pod and
 # global.imageRegistry every image.
-# Patch: the Helm-test image moves to kates-tester 1.29.1, the tag the
-# v1.29.1 release publishes; every Strimzi chart pins the same one.
-version: 2.1.12
+# Patch: the Helm-test image moves to kates-tester 1.29.2, the tag the
+# v1.29.2 release publishes; every Strimzi chart pins the same one.
+version: 2.1.13
 # Tracks the Kafka line the workers run, as mirror-maker2's does. The plugin
 # set is in the image; its pin is the kates.io/connect-image annotation.
 appVersion: "4.3.1"
@@ -35,6 +35,8 @@ annotations:
   artifacthub.io/category: streaming-messaging
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: changed
+      description: "testImages.kubectl moves to kates-tester 1.29.2, the tag the v1.29.2 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.29.1 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: changed
       description: "testImages.kubectl moves to kates-tester 1.29.1, the tag the v1.29.1 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.29.0 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: changed

charts/connect-cluster/values.yaml

@@ -55,7 +55,7 @@ imagePullPolicy: ""
 
 # -- Images the chart's own pods use
 testImages:
-  kubectl: "ghcr.io/bmscomp/kates-tester:1.29.1"
+  kubectl: "ghcr.io/bmscomp/kates-tester:1.29.2"
 
 # ── Workers ─────────────────────────────────────────────────────────────────
 # -- Number of worker replicas (seeded from autoscaling.minReplicas under an HPA)

charts/kafka-cluster/Chart.yaml

@@ -7,9 +7,9 @@ type: application
 # restricted security contexts through their CR templates — podLabels reach
 # every pod, and global.imagePullSecrets also takes plain names. SeaweedFS
 # (off by default) is unchanged and cannot pass restricted.
-# Patch: the Helm-test images moves to kates-tester 1.29.1, the tag the
-# v1.29.1 release publishes; every Strimzi chart pins the same one.
-version: 1.0.14
+# Patch: the Helm-test images moves to kates-tester 1.29.2, the tag the
+# v1.29.2 release publishes; every Strimzi chart pins the same one.
+version: 1.0.15
 appVersion: "4.3.1"
 icon: https://strimzi.io/assets/images/strimzi_logo.png
 home: https://strimzi.io/
@@ -43,6 +43,10 @@ annotations:
   # newer; never lower it without removing the feature that set it.
   kates.io/kafka-floor: "4.2.0"
   artifacthub.io/changes: |
+    - kind: changed
+      description: "testImages.kubectl and testImages.kafka move to kates-tester 1.29.2, the tag the v1.29.2 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.29.1 — nothing under tester/ moved — so this is the pin, not the tooling."
+    - kind: fixed
+      description: "Strimzi 1.3.0 generates its own <cluster>-kafka-exporter NetworkPolicy, so helm refused to install this chart beside it (cannot be imported into the current release). Ours is now <cluster>-kafka-exporter-egress, as the entity operator's already is; its rules are unchanged (#456). The README lists the real policy names."
     - kind: changed
       description: "testImages.kubectl and testImages.kafka move to kates-tester 1.29.1, the tag the v1.29.1 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.29.0 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: changed

charts/kafka-cluster/values.yaml

@@ -71,8 +71,8 @@ global:
 # -- Images of the Helm-test pods (tests.imageRegistry mirrors them). Pinned:
 # scripts/check-versions.sh keeps them aligned with the other charts.
 testImages:
-  kafka: "ghcr.io/bmscomp/kates-tester:1.29.1"
-  kubectl: "ghcr.io/bmscomp/kates-tester:1.29.1"
+  kafka: "ghcr.io/bmscomp/kates-tester:1.29.2"
+  kubectl: "ghcr.io/bmscomp/kates-tester:1.29.2"
   # -- Pull policy for test pods (empty: Kubernetes' default)
   pullPolicy: IfNotPresent
 

charts/kates-chaos/Chart.yaml

@@ -4,9 +4,9 @@ name: kates-chaos
 # PSS restricted securityContext and resources by default, so an installer or
 # GameDay image that needs root stops starting; GameDay and the tests move to
 # kates-tester, which has the shell they need.
-# Patch: images.tester moves to kates-tester 1.29.1, the tag the v1.29.1
+# Patch: images.tester moves to kates-tester 1.29.2, the tag the v1.29.2
 # release publishes; check-versions.sh holds it to the kates appVersion.
-version: 2.3.2
+version: 2.3.3
 # Tracks the LitmusChaos execution-plane version this chart deploys.
 appVersion: "3.28.0"
 description: Kates Chaos Engineering — wraps the LitmusChaos execution plane (operator, exporter, CRDs) with Kafka-specific RBAC, experiment/engine templating, and monitoring
@@ -30,6 +30,8 @@ annotations:
   artifacthub.io/category: skip-prediction
   artifacthub.io/prerelease: "false"
   artifacthub.io/changes: |
+    - kind: changed
+      description: "images.tester moves to kates-tester 1.29.2, the tag the v1.29.2 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.29.1 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: changed
       description: "images.tester moves to kates-tester 1.29.1, the tag the v1.29.1 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.29.0 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: changed

charts/kates-chaos/README.md

@@ -74,7 +74,7 @@ helm upgrade --install chaos charts/kates-chaos \
 | `images.kubectl.repository` | Image for the installer Job | `registry.k8s.io/kubectl` |
 | `images.kubectl.tag` | kubectl image tag | `v1.33.0` |
 | `images.kubectl.digest` | Pin by digest (wins over tag) | `""` |
-| `images.tester` | Image for GameDay and the Helm tests, whose scripts need a shell; runs as uid 1000 | `ghcr.io/bmscomp/kates-tester:1.29.1` |
+| `images.tester` | Image for GameDay and the Helm tests, whose scripts need a shell; runs as uid 1000 | `ghcr.io/bmscomp/kates-tester:1.29.2` |
 | `images.goRunner.repository` | Default runtime for experiments | `litmuschaos/go-runner` |
 | `images.goRunner.tag` | go-runner image tag | `3.28.0` |
 

charts/kates-chaos/values.yaml

@@ -48,7 +48,7 @@ images:
   # tester — kates-tester, for GameDay and the Helm tests, whose scripts need
   # the shell the kubectl image lacks. Runs as uid 1000. Pinned to the kates
   # appVersion, like every chart's test image (scripts/check-versions.sh).
-  tester: "ghcr.io/bmscomp/kates-tester:1.29.1"
+  tester: "ghcr.io/bmscomp/kates-tester:1.29.2"
   # go-runner — default runtime for ChaosExperiment definitions
   goRunner:
     repository: litmuschaos/go-runner

charts/kates/Chart.yaml

@@ -4,14 +4,14 @@ description: Kates — Kafka Advanced Testing & Engineering Suite
 type: application
 # Minor: global.imageRegistry now reaches every image the chart renders, so an
 # image value that already names the mirror gets it twice.
-# Patch: values-generic.yaml, which kates deploy applies on every cluster that
-# is not kind and on every admin-less install, runs 512Mi/1Gi with -Xmx512m.
-version: 0.13.3
+# Patch: appVersion and the image tag move to 1.29.2, the tag the v1.29.2
+# release publishes; values-generic.yaml runs 512Mi/1Gi with -Xmx512m.
+version: 0.13.4
 # The non-blocking health endpoints this chart's probes now point at come from
 # a BUILD-TIME property (quarkus.messaging.health.enabled=false), so they only
 # exist in the image built from this branch. Keep appVersion and
 # image.tag in values.yaml pinned to that release.
-appVersion: "1.29.1"
+appVersion: "1.29.2"
 keywords:
   - kafka
   - testing
@@ -30,6 +30,8 @@ annotations:
   artifacthub.io/category: integration-delivery
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: changed
+      description: "appVersion 1.29.2 and the image tag move to 1.29.2. No Kates API change since 1.29.1: the release carries CLI changes (#454, #455, #457, #458) and a kafka-cluster NetworkPolicy fix (#456). The values-generic.yaml sizing fix below is this chart's only other change."
     - kind: fixed
       description: "values-generic.yaml, which kates deploy applies on every cluster that is not kind and on every admin-less install, gave the Kates API a 512Mi limit under -Xmx256m, and the pod was OOMKilled as Quarkus finished starting. It now requests 512Mi with a 1Gi limit and runs -Xms256m -Xmx512m, as values-staging.yaml does."
     - kind: changed

charts/kates/README.md

@@ -33,7 +33,7 @@ All configuration is in [values.yaml](values.yaml). Key sections:
 | Parameter | Default | Description |
 |-----------|---------|-------------|
 | `image.repository` | `ghcr.io/bmscomp/kates` | Container image name |
-| `image.tag` | `1.29.1` | Container image tag, pinned in `values.yaml` to match the chart's `appVersion`. Keep it at 1.22.0 or newer: the probes use health endpoints older images lack |
+| `image.tag` | `1.29.2` | Container image tag, pinned in `values.yaml` to match the chart's `appVersion`. Keep it at 1.22.0 or newer: the probes use health endpoints older images lack |
 | `image.pullPolicy` | `IfNotPresent` | Image pull policy |
 | `global.imageRegistry` | `""` | Prepended, with a slash, to every image the chart renders: the API, PostgreSQL, the init container, the jobs, the helm test pods and `chaos.stressImage` |
 | `imagePullSecrets`, `global.imagePullSecrets` | `[]` | Pull secrets, both lists, on every pod the chart renders. An entry is a Secret name (`regcred`) or `{name: regcred}` |

charts/kates/values-native.yaml

@@ -23,7 +23,7 @@
 
 image:
   # Published as <appVersion>-native alongside the JVM tag.
-  tag: "1.29.1-native"
+  tag: "1.29.2-native"
 
 # Not read by a native image — see above.
 jvm:

charts/kates/values.yaml

@@ -29,7 +29,7 @@ image:
   repository: ghcr.io/bmscomp/kates
   # -- Image tag. Must be the release that carries the non-blocking health
   # endpoints the probe defaults below depend on (>= 1.22.0).
-  tag: "1.29.1"
+  tag: "1.29.2"
   # -- Image pull policy
   pullPolicy: IfNotPresent
 

charts/mirror-maker2/Chart.yaml

@@ -16,9 +16,9 @@ type: application
 # Patch: test-mm2 and test-connectors get requests and limits, so every pod
 # passes Pod Security "restricted" with default values; podLabels reach every
 # pod and global.imageRegistry every image.
-# Patch: the pre-flight, data-test and secret-sync image moves to kates-tester 1.29.1, the tag the
-# v1.29.1 release publishes; every Strimzi chart pins the same one.
-version: 0.11.10
+# Patch: the pre-flight, data-test and secret-sync image moves to kates-tester 1.29.2, the tag the
+# v1.29.2 release publishes; every Strimzi chart pins the same one.
+version: 0.11.11
 # Tracks the Kafka line the MM2 Connect workers run (STRIMZI_KAFKA_VERSION).
 appVersion: "4.3.1"
 kubeVersion: ">=1.27.0-0"
@@ -45,6 +45,8 @@ annotations:
   artifacthub.io/category: streaming-messaging
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: changed
+      description: "testImages.kubectl moves to kates-tester 1.29.2, the tag the v1.29.2 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.29.1 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: changed
       description: "testImages.kubectl moves to kates-tester 1.29.1, the tag the v1.29.1 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.29.0 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: changed

charts/mirror-maker2/values.yaml

@@ -35,7 +35,7 @@ global:
 
 # -- Images used by the Helm test pods
 testImages:
-  kubectl: "ghcr.io/bmscomp/kates-tester:1.29.1"
+  kubectl: "ghcr.io/bmscomp/kates-tester:1.29.2"
 
 # -- Number of MM2 (Connect) worker replicas
 replicas: 3

charts/strimzi-operator/Chart.yaml

@@ -3,9 +3,9 @@ name: strimzi-operator
 # Minor: the operator runs Strimzi's restricted pod security provider by
 # default, which rolls every Kafka pod it manages once and refuses a Kaniko
 # Connect build; the Helm tests get resources, and podLabels is new.
-# Patch: the CRD-hook and Helm-test image moves to kates-tester 1.29.1, the tag the
-# v1.29.1 release publishes; every Strimzi chart pins the same one.
-version: 0.4.2
+# Patch: the CRD-hook and Helm-test image moves to kates-tester 1.29.2, the tag the
+# v1.29.2 release publishes; every Strimzi chart pins the same one.
+version: 0.4.3
 # Tracks the Strimzi operator version this chart deploys. The CLI rewrites this
 # (and the dependency version) in a generated copy when another version is
 # selected; the repository copy is the pin.
@@ -32,6 +32,8 @@ annotations:
   artifacthub.io/category: streaming-messaging
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: changed
+      description: "testImages.kubectl moves to kates-tester 1.29.2, the tag the v1.29.2 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.29.1 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: changed
       description: "testImages.kubectl moves to kates-tester 1.29.1, the tag the v1.29.1 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.29.0 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: changed

charts/strimzi-operator/README.md

@@ -75,7 +75,7 @@ kubectl get deploy strimzi-cluster-operator -n strimzi-operator \
 | Key | Default | Description |
 |-----|---------|-------------|
 | `strimziVersion` | `1.2.0` | Builds the CRD bundle URL. Must equal `Chart.yaml` `appVersion` + dependency version. |
-| `testImages.kubectl` | `ghcr.io/bmscomp/kates-tester:1.29.1` | Image for the CRD hook Job and Helm tests |
+| `testImages.kubectl` | `ghcr.io/bmscomp/kates-tester:1.29.2` | Image for the CRD hook Job and Helm tests |
 | `crdUpgrade.enabled` | `true` | Apply CRDs via the pre-install/pre-upgrade hook |
 | `crdUpgrade.url` | `""` | Override the bundle URL (empty = derive from `strimziVersion`). Use an internal mirror when airgapped. |
 | `crdUpgrade.backoffLimit` | `3` | Job retries before the install/upgrade aborts |

charts/strimzi-operator/values.yaml

@@ -49,7 +49,7 @@ strimziVersion: "1.2.0"
 # tests). The operator's own image comes from the subchart.
 testImages:
   # -- kubectl image used by the CRD-upgrade hook Job and the Helm tests
-  kubectl: "ghcr.io/bmscomp/kates-tester:1.29.1"
+  kubectl: "ghcr.io/bmscomp/kates-tester:1.29.2"
 
 # ── Helm tests ───────────────────────────────────────────────────────────────
 tests:

config/litmus/experiments/consumer-latency-probe.yaml

@@ -83,7 +83,7 @@ spec:
                 criteria: contains
                 value: "PASS"
               source:
-                image: ghcr.io/bmscomp/kates-tester:1.29.1
+                image: ghcr.io/bmscomp/kates-tester:1.29.2
                 hostNetwork: false
 ---
 # Consumer latency monitoring ConfigMap

config/litmus/experiments/isr-health-probe.yaml

@@ -56,7 +56,7 @@ spec:
                 criteria: contains
                 value: "PASS"
               source:
-                image: ghcr.io/bmscomp/kates-tester:1.29.1
+                image: ghcr.io/bmscomp/kates-tester:1.29.2
                 hostNetwork: false
 
           # Min ISR check - ensure partitions can still accept writes
@@ -88,7 +88,7 @@ spec:
                 criteria: "<="
                 value: "5"  # Allow up to 5 unavailable during chaos
               source:
-                image: ghcr.io/bmscomp/kates-tester:1.29.1
+                image: ghcr.io/bmscomp/kates-tester:1.29.2
                 hostNetwork: false
 ---
 # ISR health monitoring ConfigMap