chore(release): prepare v1.37.0

README.md

@@ -175,7 +175,7 @@ This repository is also a GitHub Action, **Kates Quality Gate**. It installs the
 ```yaml
 - name: Kafka performance gate
   id: gate
-  uses: bmscomp/kates@v1.36.0
+  uses: bmscomp/kates@v1.37.0
   with:
     api-url: ${{ vars.KATES_URL }}
     api-key: ${{ secrets.KATES_API_KEY }}
@@ -199,7 +199,7 @@ This repository is also a GitHub Action, **Kates Quality Gate**. It installs the
 
 Outputs: `run-id`, `grade`, and `passed` (`true` or `false`).
 
-The runner has to reach the Kates API. The default `http://localhost:8080` suits a self-hosted runner beside the cluster after `kates ports`; a GitHub-hosted runner needs the API exposed to it. The action runs on Linux and macOS runners, amd64 or arm64, and needs `curl`, `tar` and `python3`. Pin a release tag such as `v1.36.0`, or `v1` to follow the latest 1.x release: each stable release moves it.
+The runner has to reach the Kates API. The default `http://localhost:8080` suits a self-hosted runner beside the cluster after `kates ports`; a GitHub-hosted runner needs the API exposed to it. The action runs on Linux and macOS runners, amd64 or arm64, and needs `curl`, `tar` and `python3`. Pin a release tag such as `v1.37.0`, or `v1` to follow the latest 1.x release: each stable release moves it.
 
 ## Other clusters
 

charts/connect-cluster/Chart.yaml

@@ -2,10 +2,9 @@ apiVersion: v2
 name: connect-cluster
 description: A Helm chart for deploying Strimzi Kafka Connect clusters
 type: application
-# Patch: testImages.kubectl moves to kates-tester 1.36.0, the tag the v1.36.0
+# Patch: testImages.kubectl moves to kates-tester 1.37.0, the tag the v1.37.0
 # release publishes; every chart that runs it pins the same one.
-# Patch: the chart icon.
-version: 2.1.25
+version: 2.1.26
 # Tracks the Kafka line the workers run, as mirror-maker2's does. The plugin
 # set is in the image; its pin is the kates.io/connect-image annotation.
 appVersion: "4.3.1"
@@ -32,6 +31,8 @@ annotations:
   artifacthub.io/category: streaming-messaging
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: changed
+      description: "testImages.kubectl moves to kates-tester 1.37.0, the tag the v1.37.0 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.36.0 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: fixed
       description: "The chart icon pointed at a file the repository does not have; it is now a Kates icon. Packs kafka-common 0.1.3, whose only change is its own icon."
     - kind: changed

charts/connect-cluster/values.yaml

@@ -55,7 +55,7 @@ imagePullPolicy: ""
 
 # -- Images the chart's own pods use
 testImages:
-  kubectl: "ghcr.io/bmscomp/kates-tester:1.36.0"
+  kubectl: "ghcr.io/bmscomp/kates-tester:1.37.0"
 
 # ── Workers ─────────────────────────────────────────────────────────────────
 # -- Number of worker replicas (seeded from autoscaling.minReplicas under an HPA)

charts/kafka-cluster/Chart.yaml

@@ -2,11 +2,9 @@ apiVersion: v2
 name: kafka-cluster
 description: A Strimzi Kafka cluster in KRaft mode — node pools, topics, users, rebalancing, tiered storage, network policy and observability
 type: application
-# Patch: testImages.kubectl and testImages.kafka move to kates-tester 1.36.0,
-# the tag the v1.36.0 release publishes; every chart that runs it pins the
-# same one.
-# Patch: the chart icon.
-version: 1.0.30
+# Patch: testImages.kubectl and testImages.kafka move to kates-tester 1.37.0,
+# the tag the v1.37.0 release publishes; every chart that runs it pins the same one.
+version: 1.0.31
 appVersion: "4.3.1"
 icon: https://raw.githubusercontent.com/bmscomp/kates/main/docs/assets/charts/kafka-cluster.svg
 home: https://strimzi.io/
@@ -40,6 +38,8 @@ annotations:
   # newer; never lower it without removing the feature that set it.
   kates.io/kafka-floor: "4.2.0"
   artifacthub.io/changes: |
+    - kind: changed
+      description: "testImages.kubectl and testImages.kafka move to kates-tester 1.37.0, the tag the v1.37.0 release publishes; scripts/check-versions.sh holds them to the kates chart's appVersion. The image is unchanged since 1.36.0 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: changed
       description: "The chart icon is now a Kates icon, served from this repository. Packs kafka-common 0.1.3, whose only change is its own icon."
     - kind: changed

charts/kafka-cluster/values.yaml

@@ -71,8 +71,8 @@ global:
 # -- Images of the Helm-test pods (tests.imageRegistry mirrors them). Pinned:
 # scripts/check-versions.sh keeps them aligned with the other charts.
 testImages:
-  kafka: "ghcr.io/bmscomp/kates-tester:1.36.0"
-  kubectl: "ghcr.io/bmscomp/kates-tester:1.36.0"
+  kafka: "ghcr.io/bmscomp/kates-tester:1.37.0"
+  kubectl: "ghcr.io/bmscomp/kates-tester:1.37.0"
   # -- Pull policy for test pods (empty: Kubernetes' default)
   pullPolicy: IfNotPresent
 

charts/kates-chaos/Chart.yaml

@@ -4,10 +4,9 @@ name: kates-chaos
 # PSS restricted securityContext and resources by default, so an installer or
 # GameDay image that needs root stops starting; GameDay and the tests move to
 # kates-tester, which has the shell they need.
-# Patch: images.tester moves to kates-tester 1.36.0, the tag the v1.36.0
+# Patch: images.tester moves to kates-tester 1.37.0, the tag the v1.37.0
 # release publishes; every chart that runs it pins the same one.
-# Patch: the chart icon.
-version: 2.4.3
+version: 2.4.4
 # Tracks the LitmusChaos execution-plane version this chart deploys.
 appVersion: "3.28.0"
 description: Kates Chaos Engineering — wraps the LitmusChaos execution plane (operator, exporter, CRDs) with Kafka-specific RBAC, experiment/engine templating, and monitoring
@@ -32,6 +31,8 @@ annotations:
   artifacthub.io/category: skip-prediction
   artifacthub.io/prerelease: "false"
   artifacthub.io/changes: |
+    - kind: changed
+      description: "images.tester moves to kates-tester 1.37.0, the tag the v1.37.0 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.36.0 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: added
       description: "A Kates chart icon."
     - kind: changed

charts/kates-chaos/README.md

@@ -74,7 +74,7 @@ helm upgrade --install chaos ./kates-chaos \
 | `images.kubectl.repository` | Image for the installer Job | `registry.k8s.io/kubectl` |
 | `images.kubectl.tag` | kubectl image tag | `v1.33.0` |
 | `images.kubectl.digest` | Pin by digest (wins over tag) | `""` |
-| `images.tester` | Image for GameDay and the Helm tests, whose scripts need a shell; runs as uid 1000 | `ghcr.io/bmscomp/kates-tester:1.36.0` |
+| `images.tester` | Image for GameDay and the Helm tests, whose scripts need a shell; runs as uid 1000 | `ghcr.io/bmscomp/kates-tester:1.37.0` |
 | `images.goRunner.repository` | Default runtime for experiments | `litmuschaos/go-runner` |
 | `images.goRunner.tag` | go-runner image tag | `3.28.0` |
 

charts/kates-chaos/values.yaml

@@ -48,7 +48,7 @@ images:
   # tester — kates-tester, for GameDay and the Helm tests, whose scripts need
   # the shell the kubectl image lacks. Runs as uid 1000. Pinned to the kates
   # appVersion, like every chart's test image (scripts/check-versions.sh).
-  tester: "ghcr.io/bmscomp/kates-tester:1.36.0"
+  tester: "ghcr.io/bmscomp/kates-tester:1.37.0"
   # go-runner — default runtime for ChaosExperiment definitions
   goRunner:
     repository: litmuschaos/go-runner

charts/kates-platform/Chart.yaml

@@ -3,11 +3,9 @@ name: kates-platform
 description: Umbrella chart for the full Kates platform — Kafka, Kates, and supporting infrastructure
 icon: https://raw.githubusercontent.com/bmscomp/kates/main/docs/assets/charts/kates-platform.svg
 type: application
-# Patch: the umbrella packs the subcharts the v1.36.0 release pins: kates
-# 0.15.7, kafka-cluster 1.0.29, connect-cluster 2.1.24, mirror-maker2 0.11.24.
-# Patch: the chart icon; the subcharts it packs change only in theirs.
-# Patch: packs kates 0.15.9.
-version: 0.8.24
+# Patch: the umbrella packs the subcharts the v1.37.0 release pins: kates
+# 0.15.10, kafka-cluster 1.0.31, connect-cluster 2.1.26, mirror-maker2 0.11.26.
+version: 0.8.25
 appVersion: "1.0.0"
 keywords:
   - kafka
@@ -44,6 +42,8 @@ dependencies:
     condition: connect-cluster.enabled
 annotations:
   artifacthub.io/changes: |
+    - kind: changed
+      description: "The umbrella moves with the v1.37.0 release: it packs kates 0.15.10, kafka-cluster 1.0.31, connect-cluster 2.1.26 and mirror-maker2 0.11.26 as they are on disk. Templates are unchanged."
     - kind: fixed
       description: "Packs kates 0.15.9, whose Kafka-namespace Role carries its podmonitors rule only where the PodMonitor API exists."
     - kind: added

charts/kates/Chart.yaml

@@ -2,16 +2,14 @@ apiVersion: v2
 name: kates
 description: Kates — Kafka Advanced Testing & Engineering Suite
 type: application
-# Patch: appVersion and the image tag move to 1.36.0, the tag the v1.36.0
+# Patch: appVersion and the image tag move to 1.37.0, the tag the v1.37.0
 # release publishes.
-# Patch: the chart icon.
-# Patch: the Kafka-namespace Role's PodMonitor rule follows the cluster.
-version: 0.15.9
+version: 0.15.10
 # The non-blocking health endpoints this chart's probes now point at come from
 # a BUILD-TIME property (quarkus.messaging.health.enabled=false), so they only
 # exist in the image built from this branch. Keep appVersion and
 # image.tag in values.yaml pinned to that release.
-appVersion: "1.36.0"
+appVersion: "1.37.0"
 keywords:
   - kafka
   - testing
@@ -30,6 +28,8 @@ annotations:
   artifacthub.io/category: integration-delivery
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: changed
+      description: "appVersion 1.37.0 and the image tag move to 1.37.0. The image takes #595 (a PodMonitor CRD that is not there, answered with a 403, no longer counts as a refused read in compliance or topology) and the zstd-jni bump #592; the release also ships the CLI fixes #589, #591, #595 and #596."
     - kind: fixed
       description: "With rbac.scope=namespace the Kafka-namespace Role carries its podmonitors rule only where the PodMonitor API exists, so a namespace admin can create it on a cluster without the Prometheus operator. helm template asks no cluster: pass --api-versions monitoring.coreos.com/v1/PodMonitor to render the rule for one that has it"
     - kind: fixed

charts/kates/README.md

@@ -33,7 +33,7 @@ All configuration is in [values.yaml](values.yaml). Key sections:
 | Parameter | Default | Description |
 |-----------|---------|-------------|
 | `image.repository` | `ghcr.io/bmscomp/kates` | Container image name |
-| `image.tag` | `1.36.0` | Container image tag, pinned in `values.yaml` to match the chart's `appVersion`. Keep it at 1.22.0 or newer: the probes use health endpoints older images lack |
+| `image.tag` | `1.37.0` | Container image tag, pinned in `values.yaml` to match the chart's `appVersion`. Keep it at 1.22.0 or newer: the probes use health endpoints older images lack |
 | `image.pullPolicy` | `IfNotPresent` | Image pull policy |
 | `global.imageRegistry` | `""` | Prepended, with a slash, to every image the chart renders: the API, PostgreSQL, the init container, the jobs, the helm test pods and `chaos.stressImage` |
 | `imagePullSecrets`, `global.imagePullSecrets` | `[]` | Pull secrets, both lists, on every pod the chart renders. An entry is a Secret name (`regcred`) or `{name: regcred}` |

charts/kates/values-native.yaml

@@ -23,7 +23,7 @@
 
 image:
   # Published as <appVersion>-native alongside the JVM tag.
-  tag: "1.36.0-native"
+  tag: "1.37.0-native"
 
 # Not read by a native image — see above.
 jvm:

charts/kates/values.yaml

@@ -29,7 +29,7 @@ image:
   repository: ghcr.io/bmscomp/kates
   # -- Image tag. Must be the release that carries the non-blocking health
   # endpoints the probe defaults below depend on (>= 1.22.0).
-  tag: "1.36.0"
+  tag: "1.37.0"
   # -- Image pull policy
   pullPolicy: IfNotPresent
 

charts/mirror-maker2/Chart.yaml

@@ -13,10 +13,9 @@ type: application
 # REMOVED. 0.10.0 froze them into the generated board and documented them as
 # inert, which left two keys that accept a number and ignore it; a release
 # setting either is now refused with the constant to edit named.
-# Patch: testImages.kubectl moves to kates-tester 1.36.0, the tag the v1.36.0
+# Patch: testImages.kubectl moves to kates-tester 1.37.0, the tag the v1.37.0
 # release publishes; every chart that runs it pins the same one.
-# Patch: the chart icon.
-version: 0.11.25
+version: 0.11.26
 # Tracks the Kafka line the MM2 Connect workers run (STRIMZI_KAFKA_VERSION).
 appVersion: "4.3.1"
 kubeVersion: ">=1.27.0-0"
@@ -43,6 +42,8 @@ annotations:
   artifacthub.io/category: streaming-messaging
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: changed
+      description: "testImages.kubectl moves to kates-tester 1.37.0, the tag the v1.37.0 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.36.0 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: fixed
       description: "The chart icon pointed at a file the repository does not have; it is now a Kates icon. Packs kafka-common 0.1.3, whose only change is its own icon."
     - kind: changed

charts/mirror-maker2/values.yaml

@@ -35,7 +35,7 @@ global:
 
 # -- Images used by the Helm test pods
 testImages:
-  kubectl: "ghcr.io/bmscomp/kates-tester:1.36.0"
+  kubectl: "ghcr.io/bmscomp/kates-tester:1.37.0"
 
 # -- Number of MM2 (Connect) worker replicas
 replicas: 3

charts/strimzi-operator/Chart.yaml

@@ -3,10 +3,9 @@ name: strimzi-operator
 # Minor: the operator runs Strimzi's restricted pod security provider by
 # default, which rolls every Kafka pod it manages once and refuses a Kaniko
 # Connect build; the Helm tests get resources, and podLabels is new.
-# Patch: testImages.kubectl moves to kates-tester 1.36.0, the tag the v1.36.0
+# Patch: testImages.kubectl moves to kates-tester 1.37.0, the tag the v1.37.0
 # release publishes; every chart that runs it pins the same one.
-# Patch: the chart icon.
-version: 0.4.16
+version: 0.4.17
 # Tracks the Strimzi operator version this chart deploys. The CLI rewrites this
 # (and the dependency version) in a generated copy when another version is
 # selected; the repository copy is the pin.
@@ -34,6 +33,8 @@ annotations:
   artifacthub.io/category: streaming-messaging
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: changed
+      description: "testImages.kubectl moves to kates-tester 1.37.0, the tag the v1.37.0 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.36.0 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: added
       description: "A Kates chart icon."
     - kind: changed

charts/strimzi-operator/README.md

@@ -71,7 +71,7 @@ kubectl get deploy strimzi-cluster-operator -n strimzi-operator \
 | Key | Default | Description |
 |-----|---------|-------------|
 | `strimziVersion` | `1.2.0` | Builds the CRD bundle URL. Must equal `Chart.yaml` `appVersion` + dependency version. |
-| `testImages.kubectl` | `ghcr.io/bmscomp/kates-tester:1.36.0` | Image for the CRD hook Job and Helm tests |
+| `testImages.kubectl` | `ghcr.io/bmscomp/kates-tester:1.37.0` | Image for the CRD hook Job and Helm tests |
 | `crdUpgrade.enabled` | `true` | Apply CRDs via the pre-install/pre-upgrade hook |
 | `crdUpgrade.url` | `""` | Override the bundle URL (empty = derive from `strimziVersion`). Use an internal mirror when airgapped. |
 | `crdUpgrade.backoffLimit` | `3` | Job retries before the install/upgrade aborts |

charts/strimzi-operator/values.yaml

@@ -49,7 +49,7 @@ strimziVersion: "1.2.0"
 # tests). The operator's own image comes from the subchart.
 testImages:
   # -- kubectl image used by the CRD-upgrade hook Job and the Helm tests
-  kubectl: "ghcr.io/bmscomp/kates-tester:1.36.0"
+  kubectl: "ghcr.io/bmscomp/kates-tester:1.37.0"
 
 # ── Helm tests ───────────────────────────────────────────────────────────────
 tests:

config/litmus/experiments/consumer-latency-probe.yaml

@@ -83,7 +83,7 @@ spec:
                 criteria: contains
                 value: "PASS"
               source:
-                image: ghcr.io/bmscomp/kates-tester:1.36.0
+                image: ghcr.io/bmscomp/kates-tester:1.37.0
                 hostNetwork: false
 ---
 # Consumer latency monitoring ConfigMap

config/litmus/experiments/isr-health-probe.yaml

@@ -56,7 +56,7 @@ spec:
                 criteria: contains
                 value: "PASS"
               source:
-                image: ghcr.io/bmscomp/kates-tester:1.36.0
+                image: ghcr.io/bmscomp/kates-tester:1.37.0
                 hostNetwork: false
 
           # Min ISR check - ensure partitions can still accept writes
@@ -88,7 +88,7 @@ spec:
                 criteria: "<="
                 value: "5"  # Allow up to 5 unavailable during chaos
               source:
-                image: ghcr.io/bmscomp/kates-tester:1.36.0
+                image: ghcr.io/bmscomp/kates-tester:1.37.0
                 hostNetwork: false
 ---
 # ISR health monitoring ConfigMap

config/litmus/experiments/kafka-chaos-cronjob.yaml

@@ -58,7 +58,7 @@ spec:
       # Pre-flight check
       - name: preflight-check
         container:
-          image: ghcr.io/bmscomp/kates-tester:1.36.0
+          image: ghcr.io/bmscomp/kates-tester:1.37.0
           imagePullPolicy: IfNotPresent
           command: ["/bin/bash"]
           args:
@@ -96,7 +96,7 @@ spec:
             - name: experiment
             - name: duration
         container:
-          image: ghcr.io/bmscomp/kates-tester:1.36.0
+          image: ghcr.io/bmscomp/kates-tester:1.37.0
           imagePullPolicy: IfNotPresent
           command: ["/bin/bash"]
           args:
@@ -142,7 +142,7 @@ spec:
       # Verify cluster recovery
       - name: verify-cluster
         container:
-          image: ghcr.io/bmscomp/kates-tester:1.36.0
+          image: ghcr.io/bmscomp/kates-tester:1.37.0
           imagePullPolicy: IfNotPresent
           command: ["/bin/bash"]
           args:

config/litmus/experiments/kafka-gameday-workflow.yaml

@@ -192,7 +192,7 @@ spec:
           - name: experiment-type
           - name: extra-env
       container:
-        image: ghcr.io/bmscomp/kates-tester:1.36.0
+        image: ghcr.io/bmscomp/kates-tester:1.37.0
         imagePullPolicy: IfNotPresent
         command: ["/bin/bash"]
         args:
@@ -255,7 +255,7 @@ spec:
         parameters:
           - name: phase
       container:
-        image: ghcr.io/bmscomp/kates-tester:1.36.0
+        image: ghcr.io/bmscomp/kates-tester:1.37.0
         imagePullPolicy: IfNotPresent
         command: ["/bin/bash"]
         args:
@@ -300,7 +300,7 @@ spec:
         parameters:
           - name: phase
       container:
-        image: ghcr.io/bmscomp/kates-tester:1.36.0
+        image: ghcr.io/bmscomp/kates-tester:1.37.0
         imagePullPolicy: IfNotPresent
         command: ["/bin/bash"]
         args:
@@ -333,7 +333,7 @@ spec:
     # Final report
     - name: chaos-report
       container:
-        image: ghcr.io/bmscomp/kates-tester:1.36.0
+        image: ghcr.io/bmscomp/kates-tester:1.37.0
         imagePullPolicy: IfNotPresent
         command: ["/bin/bash"]
         args:

config/litmus/experiments/kates-chaos-integration-job.yaml

@@ -18,7 +18,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: chaos-runner
-          image: ghcr.io/bmscomp/kates-tester:1.36.0
+          image: ghcr.io/bmscomp/kates-tester:1.37.0
           imagePullPolicy: IfNotPresent
           env:
             - name: KATES_API_URL

config/litmus/experiments/producer-throughput-probe.yaml

@@ -45,7 +45,7 @@ spec:
                 criteria: ">="
                 value: "10.0"  # Minimum 10 records/sec
               source:
-                image: ghcr.io/bmscomp/kates-tester:1.36.0
+                image: ghcr.io/bmscomp/kates-tester:1.37.0
                 hostNetwork: false
 ---
 # Standalone producer throughput ConfigMap for reuse

docs/book/14-recipes.md

@@ -710,7 +710,7 @@ jobs:
   kafka-gates:
     runs-on: ubuntu-latest
     env:
-      KATES_VERSION: v1.36.0
+      KATES_VERSION: v1.37.0
       KATES_NAMESPACE: team
       KATES_URL: http://localhost:8080
       KATES_API_KEY: ${{ secrets.KATES_API_KEY }}