Component versions
Every release pins its own versions, and the authoritative list is in the install kit you downloaded.
yq '.spec.images[] | [.image, .imageTag, .digest] | @tsv' $KIT/release-manifest.yaml
yq '.spec.charts[] | [.chart, .version, .digest] | @tsv' $KIT/release-manifest.yaml
This page describes what those versions mean and which of them have surprising requirements.
Third-party components
| Component | Version | Notes |
|---|---|---|
| Postgres operator | 2.0.1 | Zalando. 1.15.x cannot be used: its schema rejects PostgreSQL 18 |
| PostgreSQL | 18, with extensions | Includes AGE, TimescaleDB, pg_cron, pg_net, pglogical, pgsodium |
| Connection pooler | 2.0.1 | Operator-launched. Services connect through it, never directly |
| Logical backup | 2.0.1 | Only used when logical backups are enabled |
| Kafka operator | 1.0.0 | Strimzi. v1 CRD API only |
| Apache Kafka | 4.1.1 | KRaft, no ZooKeeper. Operator-launched |
| Object store | Chart 0.10.0 | S3-compatible. Its Service has a -svc suffix |
| Shared cache | 1.38.1 | Redis protocol. Application services degrade to in-process caching without it |
| Ingress cache | Valkey | Deployed by the ingress chart and used only by it. Kept separate on purpose, so a shared-cache outage cannot take the ingress data plane with it. One replica: a restart costs a cold start, not data |
| Ingress operator | Commit-tagged | ingressClassName: synapse. Built in a sibling repository, so the tag is a commit hash rather than a version |
| Platform services | The release version | Resolved from the registry host, namespace and image tag |
Mirror paths, for the offline bundle method
Every mirrored image lands under gen0sec/. Two paths look wrong and are not negotiable.
| Image | Must be at |
|---|---|
| Kafka broker | <registry>/gen0sec/strimzi/kafka:1.0.0-kafka-4.1.1 |
| Kafka entity operator | <registry>/gen0sec/strimzi/operator:1.0.0 |
Why Kafka keeps an extra path segment. The Kafka operator's image-registry setting replaces only
the registry host and preserves the repository path. So the chart points it at
<host>/gen0sec rather than <host>, and the upstream strimzi/ segment survives inside our
namespace.
With the namespace omitted, the chart asked for <host>/strimzi/operator while the release mirrored
<host>/gen0sec/strimzi/operator. One path segment apart, and the entire Kafka stack failed to pull on
a cluster with no fallback.
Every chart is now rendered in CI and the build fails on any image reference not backed by the release manifest, so the two cannot drift again. That gate is also why the table above is trustworthy: it catches a chart asking for a tag nobody publishes, which is how the ingress operator once requested a version that was never released.
bundler.sh mirror reproduces these paths exactly. You do not compute them.
Not everything a chart renders is mirrored
The vendored Kafka chart hardcodes an image map covering four Kafka versions plus Connect and Bridge build tooling. This edition ships one Kafka version and no Connect clusters, so the rest are deliberately absent from the bundle. That is roughly 1.5 GB of images nothing ever pulls.
If you enable Kafka Exporter, Cruise Control, Kafka Bridge or Connect builds, mirror their images first. The release does not carry them.
Kubernetes
| Supported | 1.23 or later |
See Requirements.
Support policy
| Supported releases | The latest two minor trains |
| Upgrade path | Sequential minors. Skipping a minor is not supported. Patches in place |
| Upgrade order | Always infra, then data, then platform |
| CRDs | Helm never upgrades them. Apply them before the chart. See Upgrade |
| Downgrade | Not supported across a minor that ran a schema migration. Within a train, use rollback. See Roll back |
| Kubernetes upgrades | Independent of ours. Stay within the supported range |
Verifying what you are actually running
The manifest says what a release pins. This says what your cluster pulled:
kubectl -n gen0sec-system get pods -o yaml | grep -E '^\s+image:' | sort -u
kubectl -n gen0sec get pods -o yaml | grep -E '^\s+image:' | sort -u
Reading the YAML rather than a container template also catches init containers, which is where the object store's init image is.
On the offline bundle method, every reference should be under your own registry. Anything else means a values file was not passed.