operator: v26.1.9

Added

• Added an optional namespace field to clusterRef (used by ShadowLink, Topic, User, Role, Schema, and Group resources). When set, the referenced Redpanda/Cluster is resolved in that namespace instead of the referencing object's namespace, enabling cross-namespace references such as a ShadowLink whose source and shadow clusters live in separate namespaces on the same Kubernetes cluster. This same-cluster, cross-namespace topology is intended mainly for development and test clusters (cheaply rehearsing shadow-link replication and failover on a single Kubernetes cluster, optionally pinning the two clusters to non-overlapping availability zones); production disaster recovery should still place the source and shadow clusters in separate Kubernetes clusters and failure domains.
• ShadowLink resources now expose spec.clientOptions for tuning the Kafka client the shadow cluster uses to fetch from the source cluster: fetchMinBytes, fetchWaitMaxMs, fetchMaxBytes, fetchPartitionMaxBytes, metadataMaxAgeMs, connectionTimeoutMs, and retryBackoffMs. These primarily trade replication latency against fetch batching efficiency. Each field is left at the broker default when unset (or set to 0), so existing ShadowLinks are unaffected.

Fixed

• The User CRD now accepts spec.authentication.password.value on its own, as documented. The schema previously marked password.valueFrom as unconditionally required, so the structural check rejected value-only manifests before the either/or validation rule could run. Providing neither value nor valueFrom is still rejected, now with the rule's own message.