[bmscomp]

Why

v1.30.0 is the CLI release that deploys the stack from the published charts, with no checkout (#469–#478). It's a minor bump because the CLI gains new commands and environment variables. The Kates API and the images are unchanged since v1.29.3.

What ships in the CLI:

• Published charts. kates deploy installs the charts of its own tag from oci://ghcr.io/bmscomp/charts, pulled fresh each run. It checks each chart's cosign signature (feat(cli): deploy checks the cosign signature of every chart it pulls #469) and its SLSA build provenance (feat(cli): deploy checks the build provenance of every chart it pulls #477).
• Kind clusters. It can create the kind cluster with the proxy and CA settings make cluster uses (feat(cli): a kind cluster deploy creates gets the proxy and CA of make cluster #470).
• Deploy files. Outside a checkout, its files go to the user state directory (feat(cli): deploy keeps its files out of a directory that is not a checkout #471).
• No GHCR access. A chart mirror, KATES_CHART_REGISTRY (feat(cli): deploy from a chart mirror, or offline from a bundle #472), or an offline bundle from kates charts pull. Bundles carry cert-manager, Kyverno and every image (feat(cli): a chart bundle carries cert-manager, Kyverno and the stack's images #476), plus the legacy Kafka images (feat(cli): pull every image from one mirror registry, and bundle the legacy Kafka images #478). kates charts push together with KATES_IMAGE_REGISTRY covers a non-kind cluster pulling from its own registry (feat(cli): pull every image from one mirror registry, and bundle the legacy Kafka images #478).
• Migrate. kates migrate runs without a checkout (feat(cli): kates migrate runs without a checkout #473).
• Connect's PostgreSQL comes from this repository's own chart, not Bitnami's (feat: Kafka Connect's PostgreSQL comes from this repository's chart, not Bitnami's #474).

This is also the first release run of #475's published-smoke job. It deploys the charts this run just published onto a kind cluster before the GitHub Release is created. v1.29.3's packages predate the overlay files that deploy passes with -f, so this is the first release a published kates can deploy from end to end.

The tag waits for your go-ahead once every check is green.

What changes

Image and kates-tester pins move to 1.30.0, as in #464:

Chart	Version	Entry
kates	0.14.1 → 0.14.2	appVersion and image tags 1.30.0 (values.yaml, -native in values-native.yaml, README)
strimzi-operator	0.4.5 → 0.4.6	testImages.kubectl
kafka-cluster	1.0.18 → 1.0.19	testImages.kubectl, testImages.kafka
connect-cluster	2.1.14 → 2.1.15	testImages.kubectl
mirror-maker2	0.11.12 → 0.11.13	testImages.kubectl
kates-chaos	2.3.4 → 2.3.5	images.tester
kates-platform	0.8.7 → 0.8.8	packs kates, kafka-cluster, connect-cluster and mirror-maker2 as they are on disk

Also moved:

• kates/k8s/deployment.yaml;
• the 12 Litmus experiment pins under config/litmus/experiments/;
• docs/registry/kates.md, with its 5 pins and the minor tag 1.29 → 1.30;
• docs/registry/kates-tester.md;
• docs/kafka-cluster-runbook.md;
• Recipe 7's KATES_VERSION;
• the README chart table and the book's version matrix.

Each bumped chart's # Patch: comment now describes this bump, and each gets a change entry.

Nothing under tester/, kates/src, kates/pom.xml or the Dockerfiles moved since v1.29.3, so the images rebuild unchanged, and the entries say so. The 1.29.3 strings left in cli/ are test fixtures, and the ones in the Chart.yaml files are older change entries.

The pins were scripted, with an assert on the expected count of every edit. The file set is #464's, unchanged.

After the tag

Nothing to do by hand. cdc-postgresql 0.2.0 (#480) was published ahead of the release from main (run 40138628389), and its package is public. It pulls anonymously and passes cosign verify and gh attestation verify (signer publish-charts.yml@refs/heads/main). The release run publishes this PR's new chart versions next to the existing public packages, so published-smoke should pull them anonymously.

Tests

• scripts/check-versions.sh: OK, with the kates-tester pins held to appVersion 1.30.0.
• scripts/chart_bumps.py origin/main: OK.
• gen-chart-table.sh --check and gen-version-matrix.sh --check: OK.
• helm lint on all seven bumped charts, with dependencies built in a scratch copy: 0 failures. That was Helm 4.3.1; CI runs 3.17.0.
• yamllint on the edited YAML: no new findings.
• check-book-style.sh, check-chart-test-paths.sh, make check-help: OK.
• Not done: a pre-tag Trivy scan. The images rebuild from the same sources as v1.29.3, whose release gate passed yesterday, but a CVE published since then would still fail the gate.