Frawless · Nov 13, 2026 · Nov 13, 2026 · Nov 13, 2026 · Nov 13, 2026
diff --git a/.github/actions/dependencies/install-ascii-doctor/action.yml b/.github/actions/dependencies/install-ascii-doctor/action.yml
@@ -5,7 +5,7 @@ inputs:
   rubyVersion:
     description: "Ruby version to be installed"
     required: false
-    default: "3.2"
+    default: "3.4"
 
 runs:
   using: "composite"

diff --git a/.github/actions/dependencies/install-helm/action.yml b/.github/actions/dependencies/install-helm/action.yml
@@ -5,11 +5,11 @@ inputs:
   helmVersion:
     description: "Helm version used"
     required: false
-    default: "v3.20.0"
+    default: "v4.3.2"
   helmUnitTestVersion:
     description: "Helm UnitTest version used"
     required: false
-    default: "v1.0.3"
+    default: "v1.2.1"
 
 runs:
   using: "composite"
@@ -18,5 +18,5 @@ runs:
       shell: bash
       run: "${{ github.action_path }}/setup-helm.sh"
       env:
-        TEST_HELM3_VERSION: ${{ inputs.helmVersion }}
+        TEST_HELM_VERSION: ${{ inputs.helmVersion }}
         TEST_HELM_UNITTEST_VERSION: ${{ inputs.helmUnitTestVersion }}
diff --git a/.github/actions/dependencies/install-helm/setup-helm.sh b/.github/actions/dependencies/install-helm/setup-helm.sh
@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
 set -xe
 
-TEST_HELM3_VERSION=${TEST_HELM3_VERSION:-'v3.20.0'}
-TEST_HELM_UNITTEST_VERSION=${TEST_HELM_UNITTEST_VERSION:-'v1.0.3'}
+TEST_HELM_VERSION=${TEST_HELM_VERSION:-'v4.3.2'}
+TEST_HELM_UNITTEST_VERSION=${TEST_HELM_UNITTEST_VERSION:-'v1.2.1'}
 
-function install_helm3 {
+function install_helm {
     # Remove any pre-installed helm binary to avoid PATH conflicts
     # (e.g., GitHub runners have helm in /usr/local/bin which takes precedence over /usr/bin)
     if [ -f /usr/local/bin/helm ]; then
@@ -18,8 +18,8 @@ function install_helm3 {
     sed -i 's#/usr/local/bin#/usr/bin#g' get_helm.sh
     chmod 700 get_helm.sh
 
-    echo "Installing helm 3..."
-    sudo ./get_helm.sh --version "${TEST_HELM3_VERSION}"
+    echo "Installing helm ${TEST_HELM_VERSION}..."
+    sudo ./get_helm.sh --version "${TEST_HELM_VERSION}"
     rm -f get_helm.sh
 
     echo "Verifying the installation of helm binary..."
@@ -35,7 +35,12 @@ function install_helm3 {
 
 function install_helm_unittest {
     echo "Installing helm unittest plugin ..."
-    helm plugin install --version $TEST_HELM_UNITTEST_VERSION https://github.com/helm-unittest/helm-unittest.git
+    local verify_flag=()
+    # Helm 4 verifies plugin signatures by default, which a git source does not support; Helm 3 has no such flag
+    if [[ "$(helm version --template '{{.Version}}')" != v3.* ]]; then
+        verify_flag=(--verify=false)
+    fi
+    helm plugin install "${verify_flag[@]}" --version "$TEST_HELM_UNITTEST_VERSION" https://github.com/helm-unittest/helm-unittest.git
 
     echo "Verifying the installation of helm unittest plugin ..."
     # run a proper helm command instead of, for example, "which helm", to verify that we can call the binary
@@ -48,5 +53,5 @@ function install_helm_unittest {
     fi
 }
 
-install_helm3
+install_helm
 install_helm_unittest
diff --git a/.github/actions/dependencies/install-syft/action.yml b/.github/actions/dependencies/install-syft/action.yml
@@ -9,7 +9,7 @@ inputs:
   version:
     description: "Version"
     required: false
-    default: "1.20.0"
+    default: "1.57.1"
 
 runs:
   using: "composite"

diff --git a/.github/actions/dependencies/install-yq/action.yml b/.github/actions/dependencies/install-yq/action.yml
@@ -9,7 +9,7 @@ inputs:
   version:
     description: "Version"
     required: false
-    default: "v4.53.3"
+    default: "v4.54.3"
 
 runs:
   using: "composite"

diff --git a/.github/actions/dependencies/setup-java/action.yml b/.github/actions/dependencies/setup-java/action.yml
@@ -5,7 +5,7 @@ inputs:
   mavenVersion:
     description: "Maven version to be installed"
     required: false
-    default: "3.9.9"
+    default: "3.9.16"
   javaVersion:
     description: "Java version to be installed"
     required: false

diff --git a/.github/actions/dependencies/setup-kind/action.yml b/.github/actions/dependencies/setup-kind/action.yml
@@ -9,11 +9,11 @@ inputs:
   kindVersion:
     description: "Kind version"
     required: false
-    default: 0.32.0
+    default: 0.33.0
   registry:
     description: "Image used for Minikube Registry"
     required: false
-    default: mirror.gcr.io/registry:2.8.3
+    default: mirror.gcr.io/registry:3.1.2
   controlNodes:
     description: "Count of Control Plane nodes"
     required: false
@@ -25,7 +25,7 @@ inputs:
   cloudProviderVersion:
     description: "Version of kind cloud-provider image"
     required: false
-    default: 0.11.0
+    default: 0.12.0
 
 runs:
   using: "composite"

diff --git a/.github/actions/dependencies/setup-kind/setup-kind.sh b/.github/actions/dependencies/setup-kind/setup-kind.sh
@@ -4,7 +4,7 @@ set -xe
 rm -rf ~/.kube
 
 KIND_VERSION=${KIND_VERSION:-"v0.33.0"}
-KIND_CLOUD_PROVIDER_VERSION=${KIND_CLOUD_PROVIDER_VERSION:-"v0.11.1"}
+KIND_CLOUD_PROVIDER_VERSION=${KIND_CLOUD_PROVIDER_VERSION:-"v0.12.0"}
 # To properly upgrade Kind version check the releases in github https://github.com/kubernetes-sigs/kind/releases and use proper image based on Kind version
 KIND_LATEST_DEFAULT_IMAGE="kindest/node:v1.37.0@sha256:a1ed56cfb0e7b93589bdf97c8cd566405a265939e3620fc4f5de89adff580ae5"
 KIND_OLDEST_DEFAULT_IMAGE="kindest/node:v1.32.11@sha256:5fc52d52a7b9574015299724bd68f183702956aa4a2116ae75a63cb574b35af8"
@@ -18,7 +18,7 @@ if [[ "${KIND_NODE_IMAGE}" == "oldest" ]]; then
 fi
 COPY_DOCKER_LOGIN=${COPY_DOCKER_LOGIN:-"false"}
 DOCKER_CMD="${DOCKER_CMD:-docker}"
-REGISTRY_IMAGE=${REGISTRY_IMAGE:-"registry:2"}
+REGISTRY_IMAGE=${REGISTRY_IMAGE:-"registry:3"}
 CONTROL_NODES=${CONTROL_NODES:-3}
 WORKER_NODES=${WORKER_NODES:-3}
 

diff --git a/.github/actions/dependencies/setup-minikube/action.yml b/.github/actions/dependencies/setup-minikube/action.yml
@@ -5,19 +5,19 @@ inputs:
   kubeVersion:
     description: "Kubernetes CLI version to install"
     required: false
-    default: "v1.38.0"
+    default: "v1.37.2"
   minikubeVersion:
     description: "Minikube version to install"
     required: false
-    default: "v1.38.0"
+    default: "v1.37.2"
   architecture:
     description: "Architecture"
     required: false
     default: "amd64"
   registry:
     description: "Image used for Minikube Registry"
     required: false
-    default: mirror.gcr.io/registry:2.8.3
+    default: mirror.gcr.io/registry:3.1.2
 
 runs:
   using: "composite"

diff --git a/.github/actions/dependencies/setup-minikube/setup-minikube.sh b/.github/actions/dependencies/setup-minikube/setup-minikube.sh
@@ -75,7 +75,8 @@ if [ "$TEST_CLUSTER" = "minikube" ]; then
     # We can turn on network polices support by adding the following options --cni=calico
     # However, it seems not working properly with kube 1.25, we should revisit it once we drop it
     # Covered by https://github.com/strimzi/strimzi-kafka-operator/issues/11639
-    minikube start --driver=docker --kubernetes-version=${KUBE_VERSION} \
+    # minikube 1.39 defaults to containerd; load-containers needs the Docker runtime for `minikube docker-env`
+    minikube start --driver=docker --container-runtime=docker --kubernetes-version=${KUBE_VERSION} \
       --insecure-registry=localhost:5000 --extra-config=apiserver.authorization-mode=Node,RBAC \
       --cpus=${MINIKUBE_CPU} --memory=${MINIKUBE_MEMORY} --force
 

diff --git a/.github/workflows/reusable-test-integrations.yml b/.github/workflows/reusable-test-integrations.yml
@@ -66,6 +66,16 @@ on:
         required: false
         type: string
         default: ""
+      helmVersion:
+        description: "Helm version to install (e.g., 'v3.16.0'). Leave empty for the install-helm default."
+        required: false
+        type: string
+        default: ""
+      helmUnitTestVersion:
+        description: "helm-unittest version to install (e.g., 'v1.0.3' for Helm < 3.18). Leave empty for the install-helm default."
+        required: false
+        type: string
+        default: ""
 
 # Declare default permissions as read only
 permissions:
@@ -112,6 +122,9 @@ jobs:
 
       - name: Install Helm
         uses: ./.github/actions/dependencies/install-helm
+        with:
+          helmVersion: ${{ inputs.helmVersion }}
+          helmUnitTestVersion: ${{ inputs.helmUnitTestVersion }}
 
       # Strimzi Operator build pulls the Sova snapshot from GHCR
       - name: Install ORAS
@@ -441,6 +454,9 @@ jobs:
 
       - name: Install Helm
         uses: ./.github/actions/dependencies/install-helm
+        with:
+          helmVersion: ${{ inputs.helmVersion }}
+          helmUnitTestVersion: ${{ inputs.helmUnitTestVersion }}
 
       - name: Install AsciiDoctor
         uses: ./.github/actions/dependencies/install-ascii-doctor
@@ -534,6 +550,9 @@ jobs:
 
       - name: Install Helm
         uses: ./.github/actions/dependencies/install-helm
+        with:
+          helmVersion: ${{ inputs.helmVersion }}
+          helmUnitTestVersion: ${{ inputs.helmUnitTestVersion }}
 
       - name: Publish Helm charts using publish-helm action
         id: publish

diff --git a/.github/workflows/test-dependencies.yml b/.github/workflows/test-dependencies.yml
@@ -52,8 +52,8 @@ jobs:
     strategy:
       matrix:
         helmVersion:
-        - 'v3.20.0'
-        - 'v3.16.0'
+        - 'v4.3.2'
+        - 'v4.0.0'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -118,7 +118,7 @@ jobs:
           - 'amd64'
         version:
           - '1.0.0'
-          - '1.20.0'
+          - '1.57.1'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -169,7 +169,7 @@ jobs:
           - 'amd64'
         version:
           - 'v4.6.3'
-          - 'v4.52.2'
+          - 'v4.54.3'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -194,8 +194,8 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        javaVersion: ['17', '21']
-        mavenVersion: ['3.9.9', '3.8.8']
+        javaVersion: ['17', '21', '25']
+        mavenVersion: ['3.9.16', '3.8.8']
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -336,7 +336,7 @@ jobs:
     strategy:
       matrix:
         minikubeVersion:
-          - 'v1.38.0'
+          - 'v1.39.0'
           - 'latest'
         kubeVersion:
           - 'v1.32.0'

diff --git a/.github/workflows/test-integrations.yml b/.github/workflows/test-integrations.yml
@@ -39,6 +39,9 @@ jobs:
             nexusCheck: "strimzi"
             javaVersion: "21"
             helmChartName: "strimzi-kafka-operator-helm-3-chart"
+            # Generated files and Helm unit tests do not match Helm 4 output yet
+            helmVersion: "v3.16.0"
+            helmUnitTestVersion: "v1.0.3"
             releaseVersion: "6.6.6"
             imagesLocation: "./docker-images/container-archives"
             clusterOperatorBuild: true
@@ -62,14 +65,17 @@ jobs:
 
           # Access Operator - Full pipeline with containers
           - repo: "strimzi/kafka-access-operator"
-            ref: "release-0.3.x"
+            ref: "main"
             artifactSuffix: "access-operator"
             architecture: "amd64"
             buildContainers: true
             modules: "./,api"
             nexusCheck: "kafka-access-operator"
             javaVersion: "21"
             helmChartName: "strimzi-access-operator-helm-3-chart"
+            # Generated files and Helm unit tests do not match Helm 4 output yet
+            helmVersion: "v3.16.0"
+            helmUnitTestVersion: "v1.0.3"
             releaseVersion: "6.6.6"
             imagesLocation: "access-operator-container-amd64.tar.gz"
             skipTests: false
@@ -241,6 +247,8 @@ jobs:
       clusterOperatorBuild: ${{ matrix.project.clusterOperatorBuild || false }}
       skipTests: ${{ matrix.project.skipTests }}
       checkTests: ${{ matrix.project.checkTests }}
+      helmVersion: ${{ matrix.project.helmVersion }}
+      helmUnitTestVersion: ${{ matrix.project.helmUnitTestVersion }}
 
   test-oci-artifact:
     name: Test push and pull OCI artifact

diff --git a/README.md b/README.md
@@ -22,15 +22,15 @@ Actions for installing tools and setting up Kubernetes clusters.
 | Action                              | Description                                                        | Key Inputs                                                                                    |
 |-------------------------------------|--------------------------------------------------------------------|-----------------------------------------------------------------------------------------------|
 | `dependencies/install-docker`       | Sets up Docker with QEMU and Buildx for multi-platform builds      | —                                                                                             |
-| `dependencies/setup-java`           | Installs Java and Maven                                            | `javaVersion` (21), `mavenVersion` (3.9.9), `javaDistro` (temurin)                            |
-| `dependencies/install-helm`         | Installs Helm and helm-unittest plugin                             | `helmVersion` (v3.20.0), `helmUnitTestVersion` (v1.0.3)                                       |
-| `dependencies/install-yq`           | Installs yq YAML processor                                         | `version` (v4.6.3), `architecture` (amd64)                                                    |
+| `dependencies/setup-java`           | Installs Java and Maven                                            | `javaVersion` (21), `mavenVersion` (3.9.16), `javaDistro` (temurin)                            |
+| `dependencies/install-helm`         | Installs Helm and helm-unittest plugin                             | `helmVersion` (v4.3.2), `helmUnitTestVersion` (v1.2.1)                                       |
+| `dependencies/install-yq`           | Installs yq YAML processor                                         | `version` (v4.54.3), `architecture` (amd64)                                                    |
 | `dependencies/install-shellcheck`   | Installs ShellCheck linter                                         | `version` (0.11.0, minimum 0.11.0), `architecture` (amd64)                                    |
-| `dependencies/install-syft`         | Installs Syft SBOM generation tool                                 | `version` (1.20.0), `architecture` (amd64)                                                    |
+| `dependencies/install-syft`         | Installs Syft SBOM generation tool                                 | `version` (1.57.1), `architecture` (amd64)                                                    |
 | `dependencies/install-oras`         | Installs ORAS CLI for OCI artifacts                                | `version` (1.3.6)                                                                             |
-| `dependencies/install-ascii-doctor` | Installs Ascii Doctor tool                                         | `rubyVersion` (3.2)                                                                           |
-| `dependencies/setup-kind`           | Creates a Kind cluster with local registry and cloud-provider-kind | `kindVersion` (0.31.0), `controlNodes` (1), `workerNodes` (1), `cloudProviderVersion` (0.6.0) |
-| `dependencies/setup-minikube`       | Creates a Minikube cluster with local registry                     | `minikubeVersion` (v1.38.0), `kubeVersion` (v1.38.0)                                          |
+| `dependencies/install-ascii-doctor` | Installs Ascii Doctor tool                                         | `rubyVersion` (3.4)                                                                           |
+| `dependencies/setup-kind`           | Creates a Kind cluster with local registry and cloud-provider-kind | `kindVersion` (0.33.0), `controlNodes` (1), `workerNodes` (1), `cloudProviderVersion` (0.12.0) |
+| `dependencies/setup-minikube`       | Creates a Minikube cluster with local registry                     | `minikubeVersion` (v1.39.0), `kubeVersion` (v1.37.2)                                          |
 
 ### Build Actions
 
@@ -159,7 +159,7 @@ Tests all dependency actions with version matrix combinations:
 - **ShellCheck** — version matrix, functional test
 - **Syft** — version matrix
 - **yq** — version matrix, functional test
-- **Java/Maven** — Java 17/21 + Maven 3.9.9/3.8.8 matrix
+- **Java/Maven** — Java 17/21/25 + Maven 3.9.16/3.8.8 matrix
 - **Kind** — single/multi-node clusters, K8s version verification, registry access from inside cluster, node labels, cloud-provider-kind
 - **Minikube** — version matrix with `latest`, K8s version verification, registry access