adobe · azun · Aug 13, 2026
diff --git a/.github/workflows/operator-release.yml b/.github/workflows/operator-release.yml
@@ -37,9 +37,9 @@ jobs:
       - name: Determine if this is a canonical dated release
         id: canonical
         run: |
-          # Only dated releases (e.g. 0.28.0-adobe-20260622) get their version
-          # references synced back into git; rc/topic/experimental tags don't.
-          if [[ "${{ steps.vars.outputs.tag }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+-adobe-[0-9]{8}$ ]]; then
+          # Only X.Y.Z versions get their version references synced back into git;
+          # all other combinations are treated as non-canonical.
+          if [[ "${{ steps.vars.outputs.tag }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             echo "is_canonical=true" >> $GITHUB_OUTPUT
           else
             echo "is_canonical=false" >> $GITHUB_OUTPUT

diff --git a/README.md b/README.md
@@ -3,7 +3,7 @@
 ![Koperator](https://img.shields.io/github/v/release/adobe/koperator?label=Koperator)
 ![Released](https://img.shields.io/github/release-date/adobe/koperator?label=Released)
 ![License](https://img.shields.io/github/license/adobe/koperator?label=License)
-![Go version (latest release)](https://img.shields.io/github/go-mod/go-version/adobe/koperator/0.28.0-adobe-20260731)
+![Go version (latest release)](https://img.shields.io/github/go-mod/go-version/adobe/koperator/0.29.1)
 
 </p>
 
@@ -42,7 +42,7 @@ Some of the main features of Koperator are:
 ## AI Code Wiki
 
 Google indexes this repo at:
-https://codewiki.google/github.com/adobe/koperator 
+https://codewiki.google/github.com/adobe/koperator
 
 ## Architecture
 
@@ -127,17 +127,17 @@ kubectl apply -f https://raw.githubusercontent.com/adobe/koperator/refs/heads/ma
 OCI registries have no floating "latest" tag, so `--version` is required (replace with your desired version, see available versions above):
 
 ```sh
-helm install kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator --version 0.28.0-adobe-20260731 --namespace=kafka --create-namespace --skip-crds
+helm install kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator --version 0.29.1 --namespace=kafka --create-namespace --skip-crds
 ```
 
 #### Pull and inspect the chart before installation
 
 ```sh
 # Pull the chart locally
-helm pull oci://ghcr.io/adobe/helm-charts/kafka-operator --version 0.28.0-adobe-20260731
+helm pull oci://ghcr.io/adobe/helm-charts/kafka-operator --version 0.29.1
 
 # Extract and inspect
-tar -xzf kafka-operator-0.28.0-adobe-20260731.tgz
+tar -xzf kafka-operator-0.29.1.tgz
 helm template kafka-operator ./kafka-operator/
 
 # Install from local chart

diff --git a/charts/kafka-operator/Chart.yaml b/charts/kafka-operator/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 name: kafka-operator
-version: "0.28.0-adobe-20260731"
+version: "0.29.1"
 description: kafka-operator manages Kafka deployments on Kubernetes
 sources:
   - https://github.com/adobe/koperator
-appVersion: "0.28.0-adobe-20260731"
+appVersion: "0.29.1"
diff --git a/charts/kafka-operator/README.md b/charts/kafka-operator/README.md
@@ -29,13 +29,13 @@ OCI registries have no floating "latest" tag, so `--version` is required (see av
 
 ```bash
 helm install kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator \
-  --version 0.28.0-adobe-20260731 --namespace=kafka --create-namespace --skip-crds
+  --version 0.29.1 --namespace=kafka --create-namespace --skip-crds
 ```
 
 To install the operator using an already installed cert-manager:
 ```bash
 helm install kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator \
-  --version 0.28.0-adobe-20260731 \
+  --version 0.29.1 \
   --set certManager.namespace=<your cert manager namespace> --namespace=kafka --create-namespace --skip-crds
 ```
 
@@ -46,7 +46,7 @@ If this value is not set your CRDs might be deleted. `--version` is required, sa
 
 ```bash
 helm upgrade kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator \
-  --version 0.28.0-adobe-20260731 --namespace=kafka
+  --version 0.29.1 --namespace=kafka
 ```
 
 ## Uninstalling the Chart
@@ -63,44 +63,46 @@ The command removes all the Kubernetes components associated with the chart and
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| replicaCount | int | `1` | Operator replica count can be set |
+| additionalEnv | list | `[]` | Additional Environment Variables |
+| additionalSidecars | list | `[]` | Additional Sidecars Configuration |
+| additionalVolumes | list | `[]` | Additional volumes required for sidecars |
+| affinity | object | `{}` | Operator pod affinity can be set |
+| alertManager.enable | bool | `true` | AlertManager can be enabled |
+| alertManager.permissivePeerAuthentication.create | bool | `false` | Permissive PeerAuthentication (Istio resource) for AlertManager can be created |
+| alertManager.port | int | `9001` | AlertManager port |
+| certManager.enabled | bool | `false` | Operator will integrate with the cert manager |
+| certManager.namespace | string | `"cert-manager"` | Operator will look for the cert manager in this namespace namespace field specifies the Cert-manager's Cluster Resource Namespace. https://cert-manager.io/docs/configuration/ |
+| certSigning.enabled | bool | `true` | Enable native certificate signing integration |
+| containerSecurityContext | object | `{}` | Container Security Context |
+| contour.enabled | bool | `false` | Enable Project Contour ingress integration. Only enable this when the Kafka cluster uses `ingressController: contour`. When enabled, Project Contour's HTTPProxy CRD (projectcontour.io/v1) must be installed in the cluster, otherwise the operator fails to start. https://projectcontour.io |
+| fullnameOverride | string | `""` | Release full name can be overwritten |
+| healthProbes | object | `{}` | Health probes configuration |
+| nameOverride | string | `""` | Release name can be overwritten |
+| nodeSelector | object | `{}` | Operator pod node selector can be set |
 | operator.annotations | object | `{}` | Operator pod annotations can be set |
-| operator.image.repository | string | `"ghcr.io/adobe/koperator"` | Operator container image repository |
-| operator.image.tag | string | `"0.28.0-adobe-20260731"` | Operator container image tag |
+| operator.developmentLogging | bool | `false` | Enable development logging |
 | operator.image.pullPolicy | string | `"IfNotPresent"` | Operator container image pull policy |
+| operator.image.repository | string | `"ghcr.io/adobe/koperator"` | Operator container image repository |
+| operator.image.tag | string | `"0.29.1"` | Operator container image tag |
 | operator.namespaces | string | `"kafka, cert-manager"` | List of namespaces where Operator watches for custom resources.<br><br>**Note** that the operator still requires to read the cluster-scoped `Node` labels to configure `rack awareness`. Make sure the operator ServiceAccount is granted `get` permissions on this `Node` resource when using limited RBACs. |
-| operator.verboseLogging | bool | `false` | Enable verbose logging |
-| operator.developmentLogging | bool | `false` | Enable development logging |
 | operator.resources.limits | object | `{"cpu":"200m","memory":"256Mi"}` | CPU/Memory limits |
 | operator.resources.requests | object | `{"cpu":"200m","memory":"256Mi"}` | CPU/Memory requests |
 | operator.serviceAccount.create | bool | `true` | If true, create the `operator.serviceAccount.name` service account |
 | operator.serviceAccount.name | string | `"kafka-operator"` | ServiceAccount used by the operator pod |
-| webhook.enabled | bool | `true` | Operator will activate the admission webhooks for custom resources |
-| webhook.certs.generate | bool | `true` | Helm chart will generate cert for the webhook |
-| webhook.certs.secret | string | `"kafka-operator-serving-cert"` | Helm chart will use the secret name applied here for the cert |
-| certManager.enabled | bool | `false` | Operator will integrate with the cert manager |
-| certManager.namespace | string | `"cert-manager"` | Operator will look for the cert manager in this namespace namespace field specifies the Cert-manager's Cluster Resource Namespace. https://cert-manager.io/docs/configuration/ |
-| contour.enabled | bool | `false` | Enable Project Contour ingress integration. Only enable this when the Kafka cluster uses `ingressController: contour`. When enabled, Project Contour's HTTPProxy CRD (projectcontour.io/v1) must be installed in the cluster, otherwise the operator fails to start. https://projectcontour.io |
-| certSigning.enabled | bool | `true` | Enable native certificate signing integration |
-| alertManager.enable | bool | `true` | AlertManager can be enabled |
-| alertManager.port | int | `9001` | AlertManager port |
-| alertManager.permissivePeerAuthentication.create | bool | `false` | Permissive PeerAuthentication (Istio resource) for AlertManager can be created |
-| prometheusMetrics.enabled | bool | `true` | If true, use direct access for Prometheus metrics |
+| operator.verboseLogging | bool | `false` | Enable verbose logging |
+| podSecurityContext | object | `{}` | Pod Security Context See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ |
 | prometheusMetrics.authProxy.enabled | bool | `true` | If true, use auth proxy for Prometheus metrics |
-| prometheusMetrics.authProxy.image.repository | string | `"quay.io/brancz/kube-rbac-proxy"` | Auth proxy container image repository |
-| prometheusMetrics.authProxy.image.tag | string | `"v0.20.0"` | Auth proxy container image tag |
 | prometheusMetrics.authProxy.image.pullPolicy | string | `"IfNotPresent"` | Auth proxy container image pull policy |
+| prometheusMetrics.authProxy.image.repository | string | `"quay.io/brancz/kube-rbac-proxy"` | Auth proxy container image repository |
+| prometheusMetrics.authProxy.image.tag | string | `"v0.22.1"` | Auth proxy container image tag |
 | prometheusMetrics.authProxy.serviceAccount.create | bool | `true` | If true, create the service account (see `prometheusMetrics.authProxy.serviceAccount.name`) used by prometheus auth proxy |
 | prometheusMetrics.authProxy.serviceAccount.name | string | `"kafka-operator-authproxy"` | ServiceAccount used by prometheus auth proxy |
-| healthProbes | object | `{}` | Health probes configuration |
-| nameOverride | string | `""` | Release name can be overwritten |
-| fullnameOverride | string | `""` | Release full name can be overwritten |
+| prometheusMetrics.enabled | bool | `true` | If true, use direct access for Prometheus metrics |
+| prometheusMetrics.podMonitor.enabled | bool | `false` | If true, create a PodMonitor for Prometheus metrics |
+| prometheusMetrics.podMonitor.interval | string | `"30s"` |  |
 | rbac.enabled | bool | `true` | Create rbac service account and roles |
-| nodeSelector | object | `{}` | Operator pod node selector can be set |
-| tolerances | list | `[]` | Operator pod tolerations can be set |
-| affinity | object | `{}` | Operator pod affinity can be set |
-| additionalSidecars | object | `{}` | Additional Sidecars Configuration |
-| additionalEnv | object | `{}` | Additional Environment Variables |
-| additionalVolumes | object | `{}` | Additional volumes required for sidecars |
-| podSecurityContext | object | `{}` | Pod Security Context See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ |
-| containerSecurityContext | object | `{}` | Container Security Context |
+| replicaCount | int | `1` | Operator replica count can be set |
+| tolerations | list | `[]` | Operator pod tolerations can be set |
+| webhook.certs.generate | bool | `true` | Helm chart will generate cert for the webhook |
+| webhook.certs.secret | string | `"kafka-operator-serving-cert"` | Helm chart will use the secret name applied here for the cert |
+| webhook.enabled | bool | `true` | Operator will activate the admission webhooks for custom resources |
diff --git a/charts/kafka-operator/README.md.gotmpl b/charts/kafka-operator/README.md.gotmpl
@@ -29,13 +29,13 @@ OCI registries have no floating "latest" tag, so `--version` is required (see av
 
 ```bash
 helm install kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator \
-  --version 0.28.0-adobe-20260731 --namespace=kafka --create-namespace --skip-crds
+  --version 0.29.1 --namespace=kafka --create-namespace --skip-crds
 ```
 
 To install the operator using an already installed cert-manager:
 ```bash
 helm install kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator \
-  --version 0.28.0-adobe-20260731 \
+  --version 0.29.1 \
   --set certManager.namespace=<your cert manager namespace> --namespace=kafka --create-namespace --skip-crds
 ```
 
@@ -46,7 +46,7 @@ If this value is not set your CRDs might be deleted. `--version` is required, sa
 
 ```bash
 helm upgrade kafka-operator oci://ghcr.io/adobe/helm-charts/kafka-operator \
-  --version 0.28.0-adobe-20260731 --namespace=kafka
+  --version 0.29.1 --namespace=kafka
 ```
 
 ## Uninstalling the Chart

diff --git a/charts/kafka-operator/values.schema.json b/charts/kafka-operator/values.schema.json
@@ -3,13 +3,13 @@
     "type": "object",
     "properties": {
         "additionalEnv": {
-            "type": "object"
+            "type": "array"
         },
         "additionalSidecars": {
-            "type": "object"
+            "type": "array"
         },
         "additionalVolumes": {
-            "type": "object"
+            "type": "array"
         },
         "affinity": {
             "type": "object"
@@ -55,6 +55,14 @@
         "containerSecurityContext": {
             "type": "object"
         },
+        "contour": {
+            "type": "object",
+            "properties": {
+                "enabled": {
+                    "type": "boolean"
+                }
+            }
+        },
         "fullnameOverride": {
             "type": "string"
         },
@@ -177,6 +185,17 @@
                 },
                 "enabled": {
                     "type": "boolean"
+                },
+                "podMonitor": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "interval": {
+                            "type": "string"
+                        }
+                    }
                 }
             }
         },

diff --git a/charts/kafka-operator/values.yaml b/charts/kafka-operator/values.yaml
@@ -18,7 +18,7 @@ operator:
     # -- Operator container image repository
     repository: ghcr.io/adobe/koperator
     # -- Operator container image tag
-    tag: "0.28.0-adobe-20260731"
+    tag: "0.29.1"
     # -- Operator container image pull policy
     pullPolicy: IfNotPresent
   # In constrained environments where operator cannot
@@ -136,21 +136,21 @@ rbac:
 nodeSelector: {}
 
 # -- Operator pod tolerations can be set
-tolerances: []
+tolerations: []
 
 # -- Operator pod affinity can be set
 affinity: {}
 
 # -- Additional Sidecars Configuration
-additionalSidecars: {}
+additionalSidecars: []
 # - name: nginx
 #   image: nginx:latest
 
 # -- Additional Environment Variables
-additionalEnv: {}
+additionalEnv: []
 
 # -- Additional volumes required for sidecars
-additionalVolumes: {}
+additionalVolumes: []
 # - name: volume1
 #   emptyDir: {}
 # - name: volume2

diff --git a/scripts/bump-release-version.sh b/scripts/bump-release-version.sh
@@ -20,7 +20,7 @@
 
 set -euo pipefail
 
-: ${1?"Usage: $0 <release-tag> e.g. 0.28.0-adobe-20260622"}
+: ${1?"Usage: $0 <release-tag> e.g. 0.29.0"}
 TAG="$1"
 
 CHART_DIR="charts/kafka-operator"
@@ -33,10 +33,10 @@ sed -i 's/\t/  /g' "${CHART_DIR}/values.yaml"
 sed -i "/# -- Operator container image tag/{n;s/^[[:space:]]*tag:.*/    tag: \"${TAG}\"/}" "${CHART_DIR}/values.yaml"
 
 for f in "${CHART_DIR}/README.md" "${CHART_DIR}/README.md.gotmpl"; do
-  sed -i "s/--version [0-9]\+\.[0-9]\+\.[0-9]\+-[a-zA-Z0-9-]\+/--version ${TAG}/g" "$f"
-  sed -i "s/\`\"\?[0-9]\+\.[0-9]\+\.[0-9]\+-[a-zA-Z0-9-]\+\"\?\`/\`\"${TAG}\"\`/g" "$f"
+  sed -i "s/--version [0-9]\+\.[0-9]\+\.[0-9]\+/--version ${TAG}/g" "$f"
+  sed -i "s/\`\"\?[0-9]\+\.[0-9]\+\.[0-9]\+\"\?\`/\`\"${TAG}\"\`/g" "$f"
 done
 
-sed -i "s/--version [0-9]\+\.[0-9]\+\.[0-9]\+-[a-zA-Z0-9-]\+/--version ${TAG}/g" README.md
-sed -i "s#img.shields.io/github/go-mod/go-version/adobe/koperator/[0-9]\+\.[0-9]\+\.[0-9]\+-[a-zA-Z0-9-]\+#img.shields.io/github/go-mod/go-version/adobe/koperator/${TAG}#" README.md
-sed -i "s/kafka-operator-[0-9]\+\.[0-9]\+\.[0-9]\+-[a-zA-Z0-9-]\+\.tgz/kafka-operator-${TAG}.tgz/g" README.md
+sed -i "s/--version [0-9]\+\.[0-9]\+\.[0-9]\+/--version ${TAG}/g" README.md
+sed -i "s#img.shields.io/github/go-mod/go-version/adobe/koperator/[0-9]\+\.[0-9]\+\.[0-9]\+#img.shields.io/github/go-mod/go-version/adobe/koperator/${TAG}#" README.md
+sed -i "s/kafka-operator-[0-9]\+\.[0-9]\+\.[0-9]\+\.tgz/kafka-operator-${TAG}.tgz/g" README.md