adobe · renovate · Apr 12, 2026 · Apr 13, 2026
diff --git a/Dockerfile b/Dockerfile
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.26@sha256:595c7847cff97c9a9e76f015083c481d26078f961c9c8dca3923132f51fe12f1 AS builder
+FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.26@sha256:fcdb3e42c5544e9682a635771eac76a698b66de79b1b50ec5b9ce5c5f14ad775 AS builder
 
 ARG BUILDPLATFORM
 ARG TARGETPLATFORM

diff --git a/api/v1beta1/kafkacluster_types.go b/api/v1beta1/kafkacluster_types.go
@@ -62,7 +62,7 @@ const (
 	DefaultMonitorImage = "ghcr.io/adobe/koperator/jmx-javaagent:1.4.0" // renovate: datasource=docker depName=ghcr.io/adobe/koperator/jmx-javaagent
 
 	// DefaultEnvoyImage is the default Envoy proxy image used when users don't specify it in EnvoyConfig.Image
-	DefaultEnvoyImage = "envoyproxy/envoy:v1.37.1" // renovate: datasource=docker depName=envoyproxy/envoy
+	DefaultEnvoyImage = "envoyproxy/envoy:v1.37.2" // renovate: datasource=docker depName=envoyproxy/envoy
 
 	// ControllerNodeProcessRole represents the node is a controller node
 	ControllerNodeProcessRole = "controller"

diff --git a/docker/jmx_exporter/Dockerfile b/docker/jmx_exporter/Dockerfile
@@ -1,6 +1,6 @@
 ARG JMX_EXPORTER_VERSION=1.5.0 # renovate: datasource=github-releases depName=prometheus/jmx_exporter
 
-FROM maven:3-amazoncorretto-21@sha256:2f0673980fed177b91d103d72a67850e61a657a051d068980ec5253dcdee474f AS build
+FROM maven:3-amazoncorretto-21@sha256:d3714a5bc06461ff50520a7ab9480a9e4d27f71941bb3cbdb615720379b89048 AS build
 ARG JMX_EXPORTER_VERSION
 
 # Install wget to download the release tarball

diff --git a/docker/kafka/Dockerfile b/docker/kafka/Dockerfile
@@ -28,7 +28,7 @@ RUN apk add --no-cache gnupg wget && \
 
 
 # backported from https://github.com/docker-library/openjdk/blob/master/18/jdk/slim-bullseye/Dockerfile
-FROM debian:bullseye-slim@sha256:95a3884fee36b8f33bf32a6bbffa8dffe6cab6089b841cec45fb47c581a2709d
+FROM debian:bullseye-slim@sha256:0083feb8da4f624e3a0245e7752af2517d4b81d8b8db50c725644672a132a31b
 
 ARG scala_version
 ARG kafka_version

diff --git a/docs/examples/springboot-kafka-avro/Dockerfile b/docs/examples/springboot-kafka-avro/Dockerfile
@@ -1,4 +1,4 @@
-FROM maven:3.9-eclipse-temurin-21-alpine@sha256:eb9561832b985fe1c341af2c147412810c3cad0ddb250e6de31e0f1300433bb1 as build
+FROM maven:3.9-eclipse-temurin-21-alpine@sha256:b9c89e0a0e292a8b8eb5e68c9cf24335f99bbf1483e8c7b56c2b9b96087ad56d as build
 
 # Set working directory
 WORKDIR /usr/src/myapp

diff --git a/hack/kafka-test-pod/Dockerfile b/hack/kafka-test-pod/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.26@sha256:595c7847cff97c9a9e76f015083c481d26078f961c9c8dca3923132f51fe12f1 as builder
+FROM golang:1.26@sha256:fcdb3e42c5544e9682a635771eac76a698b66de79b1b50ec5b9ce5c5f14ad775 as builder
 
 WORKDIR /workspace
 

diff --git a/pkg/resources/kafka/kafka.go b/pkg/resources/kafka/kafka.go
@@ -1327,7 +1327,7 @@ func handleDiskRemoval(ctx context.Context, pvcList *corev1.PersistentVolumeClai
 				log.Info("Graceful disk removal is in progress", "brokerId", brokerId, "mountPath", mountPathToRemove)
 				waitForDiskRemovalToFinish = true
 			case ccVolumeState.IsDiskRebalance():
-				log.Info("Graceful disk rebalance is in progress, waiting to mark disk for removal", "brokerId", brokerId, "mountPath", mountPathToRemove)
+				log.Info("Graceful disk rebalance is in progress, waiting for it to finish before marking disk for removal", "brokerId", brokerId, "mountPath", mountPathToRemove)
 				waitForDiskRemovalToFinish = true
 			default:
 				brokerVolumesState[mountPathToRemove] = banzaiv1beta1.VolumeState{CruiseControlVolumeState: banzaiv1beta1.GracefulDiskRemovalRequired}

diff --git a/pkg/resources/kafka/kafka_test.go b/pkg/resources/kafka/kafka_test.go
@@ -1022,7 +1022,7 @@ func TestReconcileKafkaPvcDiskRemoval(t *testing.T) {
 			},
 		},
 		{
-			testName: "If disk is rebalancing, wait for it to finish",
+			testName: "If disk is rebalancing, wait for it to finish before marking for removal",
 			brokersDesiredPvcs: map[string][]*corev1.PersistentVolumeClaim{
 				"0": {
 					createPvc("test-pvc-1", "0", "/path/to/mount1"),

diff --git a/tests/e2e/test_multidisk_removal.go b/tests/e2e/test_multidisk_removal.go
@@ -33,7 +33,7 @@ import (
 )
 
 const (
-	multidiskRemovalTimeout      = 1000 * time.Second // this test can take long
+	multidiskRemovalTimeout      = 1800 * time.Second // this test can take long: rebalance must finish before removal starts
 	multidiskRemovalPollInterval = 15 * time.Second
 	brokerConfigTemplateFormat   = "%s-config-%d"
 )

diff --git a/tests/e2e/versions.go b/tests/e2e/versions.go
@@ -25,7 +25,7 @@ const (
 	ContourVersion = "0.4.0" // renovate: datasource=helm depName=contour registryUrl=https://projectcontour.github.io/helm-charts
 
 	// PrometheusOperatorVersion is the version of kube-prometheus-stack Helm chart
-	PrometheusOperatorVersion = "81.4.3" // renovate: datasource=helm depName=kube-prometheus-stack registryUrl=https://prometheus-community.github.io/helm-charts
+	PrometheusOperatorVersion = "81.6.9" // renovate: datasource=helm depName=kube-prometheus-stack registryUrl=https://prometheus-community.github.io/helm-charts
 
 	// ZookeeperOperatorVersion is the version of zookeeper-operator
 	ZookeeperOperatorVersion = "0.2.15-adobe-20250923" // renovate: datasource=docker depName=ghcr.io/adobe/helm-charts/zookeeper-operator