chore(release): prepare v1.38.0

README.md

@@ -175,7 +175,7 @@ This repository is also a GitHub Action, **Kates Quality Gate**. It installs the
 ```yaml
 - name: Kafka performance gate
   id: gate
-  uses: bmscomp/kates@v1.37.0
+  uses: bmscomp/kates@v1.38.0
   with:
     api-url: ${{ vars.KATES_URL }}
     api-key: ${{ secrets.KATES_API_KEY }}
@@ -199,7 +199,7 @@ This repository is also a GitHub Action, **Kates Quality Gate**. It installs the
 
 Outputs: `run-id`, `grade`, and `passed` (`true` or `false`).
 
-The runner has to reach the Kates API. The default `http://localhost:8080` suits a self-hosted runner beside the cluster after `kates ports`; a GitHub-hosted runner needs the API exposed to it. The action runs on Linux and macOS runners, amd64 or arm64, and needs `curl`, `tar` and `python3`. Pin a release tag such as `v1.37.0`, or `v1` to follow the latest 1.x release: each stable release moves it.
+The runner has to reach the Kates API. The default `http://localhost:8080` suits a self-hosted runner beside the cluster after `kates ports`; a GitHub-hosted runner needs the API exposed to it. The action runs on Linux and macOS runners, amd64 or arm64, and needs `curl`, `tar` and `python3`. Pin a release tag such as `v1.38.0`, or `v1` to follow the latest 1.x release: each stable release moves it.
 
 ## Other clusters
 

charts/connect-cluster/Chart.yaml

@@ -2,9 +2,9 @@ apiVersion: v2
 name: connect-cluster
 description: A Helm chart for deploying Strimzi Kafka Connect clusters
 type: application
-# Patch: testImages.kubectl moves to kates-tester 1.37.0, the tag the v1.37.0
+# Patch: testImages.kubectl moves to kates-tester 1.38.0, the tag the v1.38.0
 # release publishes; every chart that runs it pins the same one.
-version: 2.1.26
+version: 2.1.27
 # Tracks the Kafka line the workers run, as mirror-maker2's does. The plugin
 # set is in the image; its pin is the kates.io/connect-image annotation.
 appVersion: "4.3.1"
@@ -31,6 +31,8 @@ annotations:
   artifacthub.io/category: streaming-messaging
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: changed
+      description: "testImages.kubectl moves to kates-tester 1.38.0, the tag the v1.38.0 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion, as it does for every chart that runs the image."
     - kind: changed
       description: "testImages.kubectl moves to kates-tester 1.37.0, the tag the v1.37.0 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.36.0 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: fixed

charts/connect-cluster/values.yaml

@@ -55,7 +55,7 @@ imagePullPolicy: ""
 
 # -- Images the chart's own pods use
 testImages:
-  kubectl: "ghcr.io/bmscomp/kates-tester:1.37.0"
+  kubectl: "ghcr.io/bmscomp/kates-tester:1.38.0"
 
 # ── Workers ─────────────────────────────────────────────────────────────────
 # -- Number of worker replicas (seeded from autoscaling.minReplicas under an HPA)

charts/kafka-cluster/Chart.yaml

@@ -2,9 +2,9 @@ apiVersion: v2
 name: kafka-cluster
 description: A Strimzi Kafka cluster in KRaft mode — node pools, topics, users, rebalancing, tiered storage, network policy and observability
 type: application
-# Patch: testImages.kubectl and testImages.kafka move to kates-tester 1.37.0,
-# the tag the v1.37.0 release publishes; every chart that runs it pins the same one.
-version: 1.0.31
+# Patch: testImages.kubectl and testImages.kafka move to kates-tester 1.38.0,
+# the tag the v1.38.0 release publishes; every chart that runs it pins the same one.
+version: 1.0.32
 appVersion: "4.3.1"
 icon: https://raw.githubusercontent.com/bmscomp/kates/main/docs/assets/charts/kafka-cluster.svg
 home: https://strimzi.io/
@@ -38,6 +38,8 @@ annotations:
   # newer; never lower it without removing the feature that set it.
   kates.io/kafka-floor: "4.2.0"
   artifacthub.io/changes: |
+    - kind: changed
+      description: "testImages.kubectl and testImages.kafka move to kates-tester 1.38.0, the tag the v1.38.0 release publishes; scripts/check-versions.sh holds them to the kates chart's appVersion, as it does for every chart that runs the image."
     - kind: changed
       description: "testImages.kubectl and testImages.kafka move to kates-tester 1.37.0, the tag the v1.37.0 release publishes; scripts/check-versions.sh holds them to the kates chart's appVersion. The image is unchanged since 1.36.0 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: changed

charts/kafka-cluster/values.yaml

@@ -71,8 +71,8 @@ global:
 # -- Images of the Helm-test pods (tests.imageRegistry mirrors them). Pinned:
 # scripts/check-versions.sh keeps them aligned with the other charts.
 testImages:
-  kafka: "ghcr.io/bmscomp/kates-tester:1.37.0"
-  kubectl: "ghcr.io/bmscomp/kates-tester:1.37.0"
+  kafka: "ghcr.io/bmscomp/kates-tester:1.38.0"
+  kubectl: "ghcr.io/bmscomp/kates-tester:1.38.0"
   # -- Pull policy for test pods (empty: Kubernetes' default)
   pullPolicy: IfNotPresent
 

charts/kates-chaos/Chart.yaml

@@ -4,9 +4,9 @@ name: kates-chaos
 # PSS restricted securityContext and resources by default, so an installer or
 # GameDay image that needs root stops starting; GameDay and the tests move to
 # kates-tester, which has the shell they need.
-# Patch: images.tester moves to kates-tester 1.37.0, the tag the v1.37.0
+# Patch: images.tester moves to kates-tester 1.38.0, the tag the v1.38.0
 # release publishes; every chart that runs it pins the same one.
-version: 2.4.4
+version: 2.4.5
 # Tracks the LitmusChaos execution-plane version this chart deploys.
 appVersion: "3.28.0"
 description: Kates Chaos Engineering — wraps the LitmusChaos execution plane (operator, exporter, CRDs) with Kafka-specific RBAC, experiment/engine templating, and monitoring
@@ -31,6 +31,8 @@ annotations:
   artifacthub.io/category: skip-prediction
   artifacthub.io/prerelease: "false"
   artifacthub.io/changes: |
+    - kind: changed
+      description: "images.tester moves to kates-tester 1.38.0, the tag the v1.38.0 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion, as it does for every chart that runs the image."
     - kind: changed
       description: "images.tester moves to kates-tester 1.37.0, the tag the v1.37.0 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.36.0 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: added

charts/kates-chaos/README.md

@@ -74,7 +74,7 @@ helm upgrade --install chaos ./kates-chaos \
 | `images.kubectl.repository` | Image for the installer Job | `registry.k8s.io/kubectl` |
 | `images.kubectl.tag` | kubectl image tag | `v1.33.0` |
 | `images.kubectl.digest` | Pin by digest (wins over tag) | `""` |
-| `images.tester` | Image for GameDay and the Helm tests, whose scripts need a shell; runs as uid 1000 | `ghcr.io/bmscomp/kates-tester:1.37.0` |
+| `images.tester` | Image for GameDay and the Helm tests, whose scripts need a shell; runs as uid 1000 | `ghcr.io/bmscomp/kates-tester:1.38.0` |
 | `images.goRunner.repository` | Default runtime for experiments | `litmuschaos/go-runner` |
 | `images.goRunner.tag` | go-runner image tag | `3.28.0` |
 

charts/kates-chaos/values.yaml

@@ -48,7 +48,7 @@ images:
   # tester — kates-tester, for GameDay and the Helm tests, whose scripts need
   # the shell the kubectl image lacks. Runs as uid 1000. Pinned to the kates
   # appVersion, like every chart's test image (scripts/check-versions.sh).
-  tester: "ghcr.io/bmscomp/kates-tester:1.37.0"
+  tester: "ghcr.io/bmscomp/kates-tester:1.38.0"
   # go-runner — default runtime for ChaosExperiment definitions
   goRunner:
     repository: litmuschaos/go-runner

charts/kates-platform/Chart.yaml

@@ -3,9 +3,9 @@ name: kates-platform
 description: Umbrella chart for the full Kates platform — Kafka, Kates, and supporting infrastructure
 icon: https://raw.githubusercontent.com/bmscomp/kates/main/docs/assets/charts/kates-platform.svg
 type: application
-# Patch: the umbrella packs kates 0.18.0, kafka-cluster 1.0.31,
-# connect-cluster 2.1.26, mirror-maker2 0.11.26.
-version: 0.8.28
+# Patch: the umbrella packs the subcharts the v1.38.0 release pins: kates
+# 0.18.1, kafka-cluster 1.0.32, connect-cluster 2.1.27, mirror-maker2 0.11.27.
+version: 0.8.29
 appVersion: "1.0.0"
 keywords:
   - kafka
@@ -42,6 +42,8 @@ dependencies:
     condition: connect-cluster.enabled
 annotations:
   artifacthub.io/changes: |
+    - kind: changed
+      description: "The umbrella moves with the v1.38.0 release: it packs kates 0.18.1, kafka-cluster 1.0.32, connect-cluster 2.1.27 and mirror-maker2 0.11.27 as they are at that tag."
     - kind: security
       description: "Packs kates 0.18.0, whose bundled PostgreSQL moves to 16.15-alpine. ACTION REQUIRED for a release that keeps the default image: see the kates changelog. Templates are unchanged."
     - kind: changed

charts/kates/Chart.yaml

@@ -2,13 +2,14 @@ apiVersion: v2
 name: kates
 description: Kates — Kafka Advanced Testing & Engineering Suite
 type: application
-# Minor: postgresql.allowLibcChange, a new value.
-version: 0.18.0
+# Patch: appVersion and the image tag move to 1.38.0, the tag the v1.38.0
+# release publishes.
+version: 0.18.1
 # The non-blocking health endpoints this chart's probes now point at come from
 # a BUILD-TIME property (quarkus.messaging.health.enabled=false), so they only
 # exist in the image built from this branch. Keep appVersion and
 # image.tag in values.yaml pinned to that release.
-appVersion: "1.37.0"
+appVersion: "1.38.0"
 keywords:
   - kafka
   - testing
@@ -27,6 +28,8 @@ annotations:
   artifacthub.io/category: integration-delivery
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: changed
+      description: "appVersion 1.38.0 and the image tag move to 1.38.0. The image takes #607: POST /api/tests honours an Idempotency-Key, a flat request carries an sla, and /api/health lists capabilities. It adds migration V29 (client_key on test runs), which runs on upgrade."
     - kind: security
       description: "ACTION REQUIRED for a release with bundled PostgreSQL that keeps the default image. postgresql.image.tag moves from the moving Debian tag 16 to 16.15-alpine, which has no OS findings under Trivy where Debian has 338, among them libxml2's CVE-2026-6653, which Debian does not plan to fix. Alpine and Debian sort text differently, so the upgrade refuses a release whose data was written on the other libc, and the new check-libc init container refuses it where lookup sees nothing (helm template, Argo CD, a retained volume). Stay on Debian with postgresql.image.tag=16.15, or follow Change the PostgreSQL libc in the upgrade playbook, which uses the new postgresql.allowLibcChange"
     - kind: added

charts/kates/README.md

@@ -33,7 +33,7 @@ All configuration is in [values.yaml](values.yaml). Key sections:
 | Parameter | Default | Description |
 |-----------|---------|-------------|
 | `image.repository` | `ghcr.io/bmscomp/kates` | Container image name |
-| `image.tag` | `1.37.0` | Container image tag, pinned in `values.yaml` to match the chart's `appVersion`. Keep it at 1.22.0 or newer: the probes use health endpoints older images lack |
+| `image.tag` | `1.38.0` | Container image tag, pinned in `values.yaml` to match the chart's `appVersion`. Keep it at 1.22.0 or newer: the probes use health endpoints older images lack |
 | `image.pullPolicy` | `IfNotPresent` | Image pull policy |
 | `global.imageRegistry` | `""` | Prepended, with a slash, to every image the chart renders: the API, PostgreSQL, the init container, the jobs, the helm test pods and `chaos.stressImage` |
 | `imagePullSecrets`, `global.imagePullSecrets` | `[]` | Pull secrets, both lists, on every pod the chart renders. An entry is a Secret name (`regcred`) or `{name: regcred}` |

charts/kates/values-native.yaml

@@ -23,7 +23,7 @@
 
 image:
   # Published as <appVersion>-native alongside the JVM tag.
-  tag: "1.37.0-native"
+  tag: "1.38.0-native"
 
 # Not read by a native image — see above.
 jvm:

charts/kates/values.yaml

@@ -29,7 +29,7 @@ image:
   repository: ghcr.io/bmscomp/kates
   # -- Image tag. Must be the release that carries the non-blocking health
   # endpoints the probe defaults below depend on (>= 1.22.0).
-  tag: "1.37.0"
+  tag: "1.38.0"
   # -- Image pull policy
   pullPolicy: IfNotPresent
 

charts/mirror-maker2/Chart.yaml

@@ -13,9 +13,9 @@ type: application
 # REMOVED. 0.10.0 froze them into the generated board and documented them as
 # inert, which left two keys that accept a number and ignore it; a release
 # setting either is now refused with the constant to edit named.
-# Patch: testImages.kubectl moves to kates-tester 1.37.0, the tag the v1.37.0
+# Patch: testImages.kubectl moves to kates-tester 1.38.0, the tag the v1.38.0
 # release publishes; every chart that runs it pins the same one.
-version: 0.11.26
+version: 0.11.27
 # Tracks the Kafka line the MM2 Connect workers run (STRIMZI_KAFKA_VERSION).
 appVersion: "4.3.1"
 kubeVersion: ">=1.27.0-0"
@@ -42,6 +42,8 @@ annotations:
   artifacthub.io/category: streaming-messaging
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: changed
+      description: "testImages.kubectl moves to kates-tester 1.38.0, the tag the v1.38.0 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion, as it does for every chart that runs the image."
     - kind: changed
       description: "testImages.kubectl moves to kates-tester 1.37.0, the tag the v1.37.0 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.36.0 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: fixed

charts/mirror-maker2/values.yaml

@@ -35,7 +35,7 @@ global:
 
 # -- Images used by the Helm test pods
 testImages:
-  kubectl: "ghcr.io/bmscomp/kates-tester:1.37.0"
+  kubectl: "ghcr.io/bmscomp/kates-tester:1.38.0"
 
 # -- Number of MM2 (Connect) worker replicas
 replicas: 3

charts/strimzi-operator/Chart.yaml

@@ -3,9 +3,9 @@ name: strimzi-operator
 # Minor: the operator runs Strimzi's restricted pod security provider by
 # default, which rolls every Kafka pod it manages once and refuses a Kaniko
 # Connect build; the Helm tests get resources, and podLabels is new.
-# Patch: testImages.kubectl moves to kates-tester 1.37.0, the tag the v1.37.0
+# Patch: testImages.kubectl moves to kates-tester 1.38.0, the tag the v1.38.0
 # release publishes; every chart that runs it pins the same one.
-version: 0.4.17
+version: 0.4.18
 # Tracks the Strimzi operator version this chart deploys. The CLI rewrites this
 # (and the dependency version) in a generated copy when another version is
 # selected; the repository copy is the pin.
@@ -33,6 +33,8 @@ annotations:
   artifacthub.io/category: streaming-messaging
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: changed
+      description: "testImages.kubectl moves to kates-tester 1.38.0, the tag the v1.38.0 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion, as it does for every chart that runs the image."
     - kind: changed
       description: "testImages.kubectl moves to kates-tester 1.37.0, the tag the v1.37.0 release publishes; scripts/check-versions.sh holds it to the kates chart's appVersion. The image is unchanged since 1.36.0 — nothing under tester/ moved — so this is the pin, not the tooling."
     - kind: added

charts/strimzi-operator/README.md

@@ -71,7 +71,7 @@ kubectl get deploy strimzi-cluster-operator -n strimzi-operator \
 | Key | Default | Description |
 |-----|---------|-------------|
 | `strimziVersion` | `1.2.0` | Builds the CRD bundle URL. Must equal `Chart.yaml` `appVersion` + dependency version. |
-| `testImages.kubectl` | `ghcr.io/bmscomp/kates-tester:1.37.0` | Image for the CRD hook Job and Helm tests |
+| `testImages.kubectl` | `ghcr.io/bmscomp/kates-tester:1.38.0` | Image for the CRD hook Job and Helm tests |
 | `crdUpgrade.enabled` | `true` | Apply CRDs via the pre-install/pre-upgrade hook |
 | `crdUpgrade.url` | `""` | Override the bundle URL (empty = derive from `strimziVersion`). Use an internal mirror when airgapped. |
 | `crdUpgrade.backoffLimit` | `3` | Job retries before the install/upgrade aborts |

charts/strimzi-operator/values.yaml

@@ -49,7 +49,7 @@ strimziVersion: "1.2.0"
 # tests). The operator's own image comes from the subchart.
 testImages:
   # -- kubectl image used by the CRD-upgrade hook Job and the Helm tests
-  kubectl: "ghcr.io/bmscomp/kates-tester:1.37.0"
+  kubectl: "ghcr.io/bmscomp/kates-tester:1.38.0"
 
 # ── Helm tests ───────────────────────────────────────────────────────────────
 tests:

config/litmus/experiments/consumer-latency-probe.yaml

@@ -83,7 +83,7 @@ spec:
                 criteria: contains
                 value: "PASS"
               source:
-                image: ghcr.io/bmscomp/kates-tester:1.37.0
+                image: ghcr.io/bmscomp/kates-tester:1.38.0
                 hostNetwork: false
 ---
 # Consumer latency monitoring ConfigMap

config/litmus/experiments/isr-health-probe.yaml

@@ -56,7 +56,7 @@ spec:
                 criteria: contains
                 value: "PASS"
               source:
-                image: ghcr.io/bmscomp/kates-tester:1.37.0
+                image: ghcr.io/bmscomp/kates-tester:1.38.0
                 hostNetwork: false
 
           # Min ISR check - ensure partitions can still accept writes
@@ -88,7 +88,7 @@ spec:
                 criteria: "<="
                 value: "5"  # Allow up to 5 unavailable during chaos
               source:
-                image: ghcr.io/bmscomp/kates-tester:1.37.0
+                image: ghcr.io/bmscomp/kates-tester:1.38.0
                 hostNetwork: false
 ---
 # ISR health monitoring ConfigMap

config/litmus/experiments/kafka-chaos-cronjob.yaml

@@ -58,7 +58,7 @@ spec:
       # Pre-flight check
       - name: preflight-check
         container:
-          image: ghcr.io/bmscomp/kates-tester:1.37.0
+          image: ghcr.io/bmscomp/kates-tester:1.38.0
           imagePullPolicy: IfNotPresent
           command: ["/bin/bash"]
           args:
@@ -96,7 +96,7 @@ spec:
             - name: experiment
             - name: duration
         container:
-          image: ghcr.io/bmscomp/kates-tester:1.37.0
+          image: ghcr.io/bmscomp/kates-tester:1.38.0
           imagePullPolicy: IfNotPresent
           command: ["/bin/bash"]
           args:
@@ -142,7 +142,7 @@ spec:
       # Verify cluster recovery
       - name: verify-cluster
         container:
-          image: ghcr.io/bmscomp/kates-tester:1.37.0
+          image: ghcr.io/bmscomp/kates-tester:1.38.0
           imagePullPolicy: IfNotPresent
           command: ["/bin/bash"]
           args:

config/litmus/experiments/kafka-gameday-workflow.yaml

@@ -192,7 +192,7 @@ spec:
           - name: experiment-type
           - name: extra-env
       container:
-        image: ghcr.io/bmscomp/kates-tester:1.37.0
+        image: ghcr.io/bmscomp/kates-tester:1.38.0
         imagePullPolicy: IfNotPresent
         command: ["/bin/bash"]
         args:
@@ -255,7 +255,7 @@ spec:
         parameters:
           - name: phase
       container:
-        image: ghcr.io/bmscomp/kates-tester:1.37.0
+        image: ghcr.io/bmscomp/kates-tester:1.38.0
         imagePullPolicy: IfNotPresent
         command: ["/bin/bash"]
         args:
@@ -300,7 +300,7 @@ spec:
         parameters:
           - name: phase
       container:
-        image: ghcr.io/bmscomp/kates-tester:1.37.0
+        image: ghcr.io/bmscomp/kates-tester:1.38.0
         imagePullPolicy: IfNotPresent
         command: ["/bin/bash"]
         args:
@@ -333,7 +333,7 @@ spec:
     # Final report
     - name: chaos-report
       container:
-        image: ghcr.io/bmscomp/kates-tester:1.37.0
+        image: ghcr.io/bmscomp/kates-tester:1.38.0
         imagePullPolicy: IfNotPresent
         command: ["/bin/bash"]
         args:

config/litmus/experiments/kates-chaos-integration-job.yaml

@@ -18,7 +18,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: chaos-runner
-          image: ghcr.io/bmscomp/kates-tester:1.37.0
+          image: ghcr.io/bmscomp/kates-tester:1.38.0
           imagePullPolicy: IfNotPresent
           env:
             - name: KATES_API_URL

config/litmus/experiments/producer-throughput-probe.yaml

@@ -45,7 +45,7 @@ spec:
                 criteria: ">="
                 value: "10.0"  # Minimum 10 records/sec
               source:
-                image: ghcr.io/bmscomp/kates-tester:1.37.0
+                image: ghcr.io/bmscomp/kates-tester:1.38.0
                 hostNetwork: false
 ---
 # Standalone producer throughput ConfigMap for reuse