Repository navigation
chore(release): prepare v1.34.0 - #570
Merged
Merged
Conversation
Move every kates and kates-tester pin to 1.34.0, the tag the v1.34.0 release publishes, and bump the charts that carry them: kates 0.15.3, strimzi-operator 0.4.11, kafka-cluster 1.0.25, connect-cluster 2.1.20, mirror-maker2 0.11.18, kates-chaos 2.3.11 and kates-platform 0.8.16.
ci-release.yml runs on chore/release-* PRs only. It builds the kates JVM and native images, the Connect image and the tester image for amd64 from the PR's tree, without pushing, and applies the release's Trivy gate to each (CRITICAL, fixable, .trivyignore.yaml). ci.yml's dependency CVE scan (Trivy over Maven, govulncheck over the CLI) now runs on those PRs too. A CVE that would fail Verify Published Images after the push, as on v1.29.2 and v1.33.0, fails the pin PR before the tag.
The repo is its own custom Krew index, read from plugins/kates.yaml on main. A new krew job in release.yml, after the GitHub Release, rewrites the manifest's version, uris and sha256 lines from the tarballs the run built, then commits to main like the image workflows' update-charts jobs. Pre-release tags are skipped. Before this the manifest stayed on whatever release was last edited by hand (v1.30.1 until #572). check-versions.sh read the Kind floor from the install guide's prerequisites table, which #571 rewrote as prose; under pipefail the script exited 1 without printing why. The floor is back in the prose (Kind 0.33 or newer) and the script reads that sentence.
bmscomp
force-pushed
the
chore/release-v1.34.0
branch
from
October 31, 2026 22:29
c4935dd to
55d2da2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
v1.34.0 ships #560–#569: compliance checks kept as evidence with their report hash (#560, #562), a chained audit log (#561),
kates evidence export(#565), created topics described once the broker knows them (#564), a rising error rate flagged as the regression (#566), probeintervalSecunder 1 refused (#567), admin-less UNKNOWN reasons that say how to read the zones (#568), plus the drift IT (#563) and book (#569).What
Every kates and kates-tester pin moves to 1.34.0, the tag the release publishes: kates chart 0.15.3 (appVersion,
image.tag,-native),kates/k8s/deployment.yaml, the tester pins in strimzi-operator 0.4.11, kafka-cluster 1.0.25, connect-cluster 2.1.20, mirror-maker2 0.11.18, kates-chaos 2.3.11 and the Litmus experiments, kates-platform 0.8.16, the registry docs (1.34minor tag),server.json, the README and recipe action pins, and appendix D.Nothing under
tester/or any chart template moved since v1.33.0.Checked locally:
check-versions.sh,gen-version-matrix.sh --check,chart_bumps.py,helm linton kates, strimzi-operator, kates-chaos.CI: the release PR now scans what the tag ships
New
ci-release.yml("CI · Release scan") runs only onchore/release-*PRs. It builds the kates JVM and native images, the Connect image and the tester image for amd64 from the PR's tree, without pushing, and fails on any finding the release's Trivy gate would fail on (CRITICAL, fixable,.trivyignore.yaml).ci.yml's Dependency CVE scan (Trivy over Maven,govulncheck) now runs on these PRs too, instead of being path-filtered out. v1.29.2 and v1.33.0 both failed Verify Published Images after the push; this moves that failure onto the pin PR. Appendix C documents it.This PR is the first to run it.
Release: the Krew manifest follows the tag
The repo is its own custom Krew index since #572 (
plugins/kates.yaml, on v1.33.0). A newkrewjob inrelease.yml, after the GitHub Release, rewrites the manifest's version, uris and sha256 lines from the tarballs the run built and commits to main ([skip ci], rebased before the push), the same way the image workflows' update-charts jobs do. Pre-release tags are skipped. The pin PR can't do this itself, because the hashes only exist once the tag has been built. The rewrite was checked with GNU sed against the real manifest and stand-in tarballs. v1.34.0 is the first run.Fix:
check-versions.shafter #571#571 rewrote the install guide's prerequisites table as prose and dropped the
Kind 0.33+row thatcheck-versions.shreads; underpipefailthe script exited 1 without saying why. Main stayed green because the check is path-filtered off docs-only changes. The floor is back in the prose ("Use Kind 0.33 or newer") and the script reads that sentence, with|| trueso a future miss prints its ERROR line.After the merge
Tag the merge commit with an annotated
v1.34.0.