v1.6.2

Release date: 2026-10-16

Highlights

Faster partition recovery from S3 with bounded parallel restore, progress reporting, and atomic publication of restored state (#187).
Per-cluster broker image overrides and independent affinity overrides for brokers and managed etcd (#189, #192).
Operator-managed workloads now satisfy Kubernetes Pod Security Admission’s restricted policy (#191).
Release publishing now includes the unified proxy and MCP images (#186).

The main Helm chart is version 0.4.5; processor charts are version 0.1.2. All charts default to application images tagged v1.6.2.
Update the KafscaleCluster CRD before using the new broker image and affinity fields. Helm does not automatically upgrade existing CRDs; apply deploy/helm/kafscale/crds/kafscaleclusters.yaml from this release before upgrading the chart.
Broker and managed etcd affinity can be configured independently. Omit or remove an override to retain the default soft anti-affinity, supply {} to disable affinity, or supply a full affinity object to replace the default. External etcd endpoints are unaffected.
Operator-managed containers now run as UID/GID 10001 with a read-only root filesystem. Writable volumes use fsGroup: 10001; existing volumes require a storage driver that applies fsGroup permissions. For hostPath or drivers without that support, prepare volume ownership and permissions before upgrading. See the security guide.

Fixed ListOffsets to validate topics and partitions for every timestamp mode, return appropriate protocol errors, and avoid creating topics during offset lookups (#190).
Fixed concurrent cache access during partition restore and retained consistent state when restore fails (#187).
Fixed managed etcd maintenance shell compatibility and the defragmentation command (#188, #191).
Fixed per-cluster broker image selection, including explicit tags and digests (#189).
Fixed the operator’s default LFS proxy image and runtime configuration (#191).

Hardened broker, managed etcd, LFS proxy, initialization, backup, restore, and maintenance containers with non-root execution, dropped capabilities, disabled privilege escalation, and RuntimeDefault seccomp (#191).
No specific CVEs are addressed by this release.

Fixed the Scorecard action image pull and added proxy and MCP images to release builds (#185, #186).
Added real Kubernetes API validation for affinity overrides and a restricted-policy Kubernetes runtime test covering existing-volume upgrades, backup/restore, and proxy produce/consume (#191, #192).