operator: v26.2.3

Added

• The operator chart can stamp a scrape-time label identifying which Kubernetes cluster a metrics series came from, via monitoring.clusterLabel (off by default). Enable it when operator metrics from more than one Kubernetes cluster land in the same Prometheus-compatible backend. In multicluster mode the value defaults to multicluster.name; otherwise set monitoring.clusterLabel.value.
• Rolling restarts now wait for each broker's Schema Registry store to catch up on _schemas before rolling the next broker, so overlapping replay windows can no longer leave a cluster without a consistent Schema Registry endpoint mid-upgrade. Applies to the V1 (Cluster), V2 (Redpanda), and multicluster (StretchCluster) controllers; skipped on clusters without a Schema Registry listener; disable with --wait-for-schema-registry-sync=false.
• Telemetry now reports id_hash for clusters licensed through their CR, not only for operators given their own license file. A new clusterLicenses field carries the distinct license checksums found across managed clusters and the count of validly licensed clusters.
• The single-cluster operator now supports --leader-election-lease-duration, --leader-election-renew-deadline, and --leader-election-retry-period for tuning leader election. The existing 15s, 10s, and 2s defaults remain unchanged.

Fixed

• The sidecar's user watcher now sets the superusers cluster property once per sync pass, with the union of every users file, instead of once per file with only that file's users. Operator-managed clusters were unaffected (the operator deploys the sidecar with --no-set-superusers); for them the visible change is log hygiene — malformed users-file lines, which can contain passwords, are no longer echoed into the sidecar log.
• The multicluster command now serves its metrics endpoint over HTTPS by default, so the operator chart's ServiceMonitor can actually scrape a multicluster deployment. If you worked around the failing scrape by overriding the ServiceMonitor to scheme: http, drop that override; to keep the plain-HTTP endpoint instead, pass --metrics-secure=false. rpk k8s multicluster bundle detects either scheme.
• The multicluster operator now reports telemetry instead of dropping every report. The collector no longer fails on the legacy vectorized.io/v1alpha1 Cluster API that multicluster mode does not register, and it tolerates any unregistered type by reporting that one field as zero instead of discarding the whole report.
• An unreadable broker list no longer aborts the whole reconcile pass — the maintenance-mode step defers instead. Previously a transient admin-API read failure against a broker whose pod was already gone (mid-roll, mid-decommission, or a BrokerPool being deleted) also aborted decommissioning and cluster-config sync, so the very broker that made the read fail was never removed.
• The StretchCluster admin, Kafka, and Schema Registry clients no longer offer brokers whose pod cannot be dialed (terminating, finished, or address-less pods are skipped). If no pod looks dialable, the full declared list is used as before.
• The monitoring.rulesEnabled PrometheusRule and the shipped Grafana dashboard now scope every expression to this operator install by job and namespace. controller_runtime_* and workqueue_* are exported by every controller-runtime operator, so unscoped rules fired the operator's alerts for foreign controllers (Karpenter, Flux, cert-manager) and merged same-named controllers across installs. The dashboard gains Namespace and Job pickers plus one for the opt-in monitoring.clusterLabel label.
• The monitoring.rulesEnabled alerts that read a recorded series (OperatorReconcileErrors, OperatorReconcileRunaway, OperatorReconcileStalled) now carry the same job/namespace matcher as the rest, so two operator installs sharing a Prometheus stop alerting on each other's controllers.
• Fixed false-positive OperatorReconcileRunaway and OperatorWorkerPoolSaturated alerts during healthy interval reconciliation. A new OperatorReconcileChurn alert tracks non-interval work, Runaway retains a higher-threshold total-rate backstop, and saturation now measures sustained workqueue delay instead of worker utilization.
• User, Role, and Group resources now reconcile on clusters with listeners.schemaRegistry.enabled=false. A disabled listener is treated as "Schema Registry not configured", matching v1 clusters, instead of failing a DNS SRV lookup that blocked all ACL syncs.