From 96f1dda74697ad808a378aec165b24397f710ab0 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Fri, 21 Mar 2025 17:00:14 +0100
Subject: [PATCH 1/5] chore(release): Update stackableRelease to 25.3

---
 stacks/stacks-v2.yaml | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/stacks/stacks-v2.yaml b/stacks/stacks-v2.yaml
index d013c95f..9e254c5c 100644
--- a/stacks/stacks-v2.yaml
+++ b/stacks/stacks-v2.yaml
@@ -2,7 +2,7 @@
 stacks:
   monitoring:
     description: Stack containing Prometheus and Grafana
-    stackableRelease: dev
+    stackableRelease: 25.3
     stackableOperators:
       - commons
       - listener
@@ -25,7 +25,7 @@ stacks:
         default: adminadmin
   logging:
     description: Stack containing OpenSearch, OpenSearch Dashboards (Kibana) and Vector aggregator
-    stackableRelease: dev
+    stackableRelease: 25.3
     stackableOperators:
       - commons
       - listener
@@ -60,7 +60,7 @@ stacks:
   observability:
     description: >-
       An observability stack with auto-injection of the opentelemetry-collector sidecar to receive traces/logs/metrics via OTLP, and send them to Jaeger/Tempo/Loki.
-    stackableRelease: dev
+    stackableRelease: 25.3
     stackableOperators:
       - commons
       - listener
@@ -85,7 +85,7 @@ stacks:
         default: adminadmin
   airflow:
     description: Stack containing Airflow scheduling platform
-    stackableRelease: dev
+    stackableRelease: 25.3
     stackableOperators:
       - commons
       - listener
@@ -112,7 +112,7 @@ stacks:
         default: airflowSecretKey
   data-lakehouse-iceberg-trino-spark:
     description: Data lakehouse using Iceberg lakehouse on S3, Trino as query engine, Spark for streaming ingest and Superset for data visualization
-    stackableRelease: dev
+    stackableRelease: 25.3
     stackableOperators:
       - commons
       - listener
@@ -169,7 +169,7 @@ stacks:
         default: supersetSecretKey
   hdfs-hbase:
     description: HBase cluster using HDFS as underlying storage
-    stackableRelease: dev
+    stackableRelease: 25.3
     stackableOperators:
       - commons
       - listener
@@ -192,7 +192,7 @@ stacks:
     parameters: []
   nifi-kafka-druid-superset-s3:
     description: Stack containing NiFi, Kafka, Druid, MinIO and Superset for data visualization
-    stackableRelease: dev
+    stackableRelease: 25.3
     stackableOperators:
       - commons
       - listener
@@ -238,7 +238,7 @@ stacks:
         default: adminadmin
   spark-trino-superset-s3:
     description: Stack containing MinIO, Trino and Superset for data visualization
-    stackableRelease: dev
+    stackableRelease: 25.3
     stackableOperators:
       - commons
       - listener
@@ -283,7 +283,7 @@ stacks:
         default: supersetSecretKey
   trino-superset-s3:
     description: Stack containing MinIO, Trino and Superset for data visualization
-    stackableRelease: dev
+    stackableRelease: 25.3
     stackableOperators:
       - commons
       - listener
@@ -325,7 +325,7 @@ stacks:
         default: supersetSecretKey
   trino-iceberg:
     description: Stack containing Trino using Apache Iceberg as a S3 data lakehouse
-    stackableRelease: dev
+    stackableRelease: 25.3
     stackableOperators:
       - commons
       - listener
@@ -359,7 +359,7 @@ stacks:
         default: adminadmin
   jupyterhub-pyspark-hdfs:
     description: Jupyterhub with PySpark and HDFS integration
-    stackableRelease: dev
+    stackableRelease: 25.3
     stackableOperators:
       - commons
       - listener
@@ -389,7 +389,7 @@ stacks:
         default: adminadmin
   dual-hive-hdfs-s3:
     description: Dual stack Hive on HDFS and S3 for Hadoop/Hive to Trino migration
-    stackableRelease: dev
+    stackableRelease: 25.3
     stackableOperators:
       - commons
       - listener
@@ -426,7 +426,7 @@ stacks:
       The bind user credentials are: ldapadmin:ldapadminpassword.
       No AuthenticationClass is configured, The AuthenticationClass is created manually in the tutorial.
       Use the 'openldap' Stack for an OpenLDAD with an AuthenticationClass already installed.
-    stackableRelease: dev
+    stackableRelease: 25.3
     stackableOperators:
       - commons
       - listener
@@ -449,7 +449,7 @@ stacks:
       The bind user credentials are: ldapadmin:ldapadminpassword.
       The LDAP AuthenticationClass is called 'ldap' and the SecretClass for the bind credentials is called 'ldap-bind-credentials'.
       The stack already creates an appropriate Secret, so referring to the 'ldap' AuthenticationClass in your ProductCluster should be enough.
-    stackableRelease: dev
+    stackableRelease: 25.3
     stackableOperators:
       - commons
       - listener
@@ -475,7 +475,7 @@ stacks:
       3 users are created in Keycloak: admin:adminadmin, alice:alicealice, bob:bobbob. admin and alice are admins with
       full authorization in Druid and Trino, bob is not authorized.
       This is a proof-of-concept and the mechanisms used here are subject to change.
-    stackableRelease: dev
+    stackableRelease: 25.3
     stackableOperators:
       - commons
       - listener
@@ -541,7 +541,7 @@ stacks:
 
       Note that this stack is tightly coupled with the demo.
       So if you install the stack you will get demo-specific parts (such as Keycloak users or regorules).
-    stackableRelease: dev
+    stackableRelease: 25.3
     stackableOperators:
       - commons
       - listener
@@ -613,7 +613,7 @@ stacks:
   signal-processing:
     description: >-
       A stack used for creating, streaming and processing in-flight data and persisting it to TimescaleDB before it is displayed in Grafana
-    stackableRelease: dev
+    stackableRelease: 25.3
     stackableOperators:
       - commons
       - listener
@@ -651,7 +651,7 @@ stacks:
   jupyterhub-keycloak:
     description: >-
       A stack used to demonstrate JupyterHub and Keycloak, using parts of the end-to-end security demo.
-    stackableRelease: dev
+    stackableRelease: 25.3
     stackableOperators:
       - commons
       - listener

From 352867c9673b01cd332faadf88371e21019bb0f9 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Fri, 21 Mar 2025 17:00:14 +0100
Subject: [PATCH 2/5] chore(release): Update image references with
 stackable25.3.0

---
 .../03-enable-and-run-spark-dag.yaml                      | 2 +-
 .../airflow-scheduled-job/04-enable-and-run-date-dag.yaml | 2 +-
 .../create-nifi-ingestion-job.yaml                        | 4 ++--
 .../create-spark-ingestion-job.yaml                       | 4 ++--
 .../create-trino-tables.yaml                              | 4 ++--
 .../setup-superset.yaml                                   | 2 +-
 demos/end-to-end-security/create-spark-report.yaml        | 4 ++--
 demos/end-to-end-security/create-trino-tables.yaml        | 2 +-
 .../create-hfile-and-import-to-hbase.yaml                 | 2 +-
 .../load-test-data.yaml                                   | 2 +-
 .../create-druid-ingestion-job.yaml                       | 4 ++--
 .../create-nifi-ingestion-job.yaml                        | 4 ++--
 .../nifi-kafka-druid-earthquake-data/setup-superset.yaml  | 4 ++--
 .../create-druid-ingestion-job.yaml                       | 4 ++--
 .../create-nifi-ingestion-job.yaml                        | 4 ++--
 .../nifi-kafka-druid-water-level-data/setup-superset.yaml | 4 ++--
 demos/signal-processing/Dockerfile-nifi                   | 2 +-
 demos/signal-processing/create-nifi-ingestion-job.yaml    | 4 ++--
 demos/signal-processing/create-timescale-tables.yaml      | 2 +-
 .../create-spark-anomaly-detection-job.yaml               | 4 ++--
 .../setup-superset.yaml                                   | 2 +-
 demos/trino-taxi-data/create-table-in-trino.yaml          | 2 +-
 demos/trino-taxi-data/setup-superset.yaml                 | 2 +-
 stacks/_templates/jupyterhub.yaml                         | 2 +-
 stacks/_templates/keycloak.yaml                           | 2 +-
 stacks/end-to-end-security/krb5.yaml                      | 8 ++++----
 stacks/end-to-end-security/setup-postgresql.yaml          | 2 +-
 stacks/end-to-end-security/superset.yaml                  | 2 +-
 stacks/jupyterhub-keycloak/jupyterhub.yaml                | 2 +-
 stacks/jupyterhub-keycloak/keycloak.yaml                  | 2 +-
 stacks/keycloak-opa-poc/keycloak.yaml                     | 2 +-
 stacks/keycloak-opa-poc/setup-keycloak.yaml               | 2 +-
 stacks/logging/setup-opensearch-dashboards.yaml           | 2 +-
 stacks/signal-processing/jupyterhub.yaml                  | 4 ++--
 stacks/signal-processing/nifi.yaml                        | 2 +-
 35 files changed, 51 insertions(+), 51 deletions(-)

diff --git a/demos/airflow-scheduled-job/03-enable-and-run-spark-dag.yaml b/demos/airflow-scheduled-job/03-enable-and-run-spark-dag.yaml
index f61a9aad..88dbc834 100644
--- a/demos/airflow-scheduled-job/03-enable-and-run-spark-dag.yaml
+++ b/demos/airflow-scheduled-job/03-enable-and-run-spark-dag.yaml
@@ -8,7 +8,7 @@ spec:
     spec:
       containers:
         - name: start-pyspark-job
-          image: oci.stackable.tech/sdp/tools:1.0.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/tools:1.0.0-stackable25.3.0
           # N.B. it is possible for the scheduler to report that a DAG exists, only for the worker task to fail if a pod is unexpectedly
           # restarted. Additionally, the db-init job takes a few minutes to complete before the cluster is deployed. The wait/watch steps
           # below are not "water-tight" but add a layer of stability by at least ensuring that the db is initialized and ready and that
diff --git a/demos/airflow-scheduled-job/04-enable-and-run-date-dag.yaml b/demos/airflow-scheduled-job/04-enable-and-run-date-dag.yaml
index d72fe62c..17329793 100644
--- a/demos/airflow-scheduled-job/04-enable-and-run-date-dag.yaml
+++ b/demos/airflow-scheduled-job/04-enable-and-run-date-dag.yaml
@@ -8,7 +8,7 @@ spec:
     spec:
       containers:
         - name: start-date-job
-          image: oci.stackable.tech/sdp/tools:1.0.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/tools:1.0.0-stackable25.3.0
           # N.B. it is possible for the scheduler to report that a DAG exists, only for the worker task to fail if a pod is unexpectedly
           # restarted. Additionally, the db-init job takes a few minutes to complete before the cluster is deployed. The wait/watch steps
           # below are not "water-tight" but add a layer of stability by at least ensuring that the db is initialized and ready and that
diff --git a/demos/data-lakehouse-iceberg-trino-spark/create-nifi-ingestion-job.yaml b/demos/data-lakehouse-iceberg-trino-spark/create-nifi-ingestion-job.yaml
index baea7957..224eff9c 100644
--- a/demos/data-lakehouse-iceberg-trino-spark/create-nifi-ingestion-job.yaml
+++ b/demos/data-lakehouse-iceberg-trino-spark/create-nifi-ingestion-job.yaml
@@ -9,11 +9,11 @@ spec:
       serviceAccountName: demo-serviceaccount
       initContainers:
         - name: wait-for-kafka
-          image: oci.stackable.tech/sdp/tools:1.0.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/tools:1.0.0-stackable25.3.0
           command: ["bash", "-c", "echo 'Waiting for all kafka brokers to be ready' && kubectl wait --for=condition=ready --timeout=30m pod -l app.kubernetes.io/instance=kafka -l app.kubernetes.io/name=kafka"]
       containers:
         - name: create-nifi-ingestion-job
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command:
             - bash
             - -euo
diff --git a/demos/data-lakehouse-iceberg-trino-spark/create-spark-ingestion-job.yaml b/demos/data-lakehouse-iceberg-trino-spark/create-spark-ingestion-job.yaml
index 50e1d820..14eea4e0 100644
--- a/demos/data-lakehouse-iceberg-trino-spark/create-spark-ingestion-job.yaml
+++ b/demos/data-lakehouse-iceberg-trino-spark/create-spark-ingestion-job.yaml
@@ -12,11 +12,11 @@ spec:
       serviceAccountName: demo-serviceaccount
       initContainers:
         - name: wait-for-kafka
-          image: oci.stackable.tech/sdp/tools:1.0.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/tools:1.0.0-stackable25.3.0
           command: ["bash", "-c", "echo 'Waiting for all kafka brokers to be ready' && kubectl wait --for=condition=ready --timeout=30m pod -l app.kubernetes.io/name=kafka -l app.kubernetes.io/instance=kafka"]
       containers:
         - name: create-spark-ingestion-job
-          image: oci.stackable.tech/sdp/tools:1.0.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/tools:1.0.0-stackable25.3.0
           command: ["bash", "-c", "echo 'Submitting Spark job' && kubectl apply -f /tmp/manifest/spark-ingestion-job.yaml"]
           volumeMounts:
             - name: manifest
diff --git a/demos/data-lakehouse-iceberg-trino-spark/create-trino-tables.yaml b/demos/data-lakehouse-iceberg-trino-spark/create-trino-tables.yaml
index 5a0f5ae9..a5dbec69 100644
--- a/demos/data-lakehouse-iceberg-trino-spark/create-trino-tables.yaml
+++ b/demos/data-lakehouse-iceberg-trino-spark/create-trino-tables.yaml
@@ -9,11 +9,11 @@ spec:
       serviceAccountName: demo-serviceaccount
       initContainers:
         - name: wait-for-testdata
-          image: oci.stackable.tech/sdp/tools:1.0.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/tools:1.0.0-stackable25.3.0
           command: ["bash", "-c", "echo 'Waiting for job load-test-data to finish' && kubectl wait --for=condition=complete --timeout=30m job/load-test-data"]
       containers:
         - name: create-tables-in-trino
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command: ["bash", "-c", "python -u /tmp/script/script.py"]
           volumeMounts:
             - name: script
diff --git a/demos/data-lakehouse-iceberg-trino-spark/setup-superset.yaml b/demos/data-lakehouse-iceberg-trino-spark/setup-superset.yaml
index 3275c927..b696541f 100644
--- a/demos/data-lakehouse-iceberg-trino-spark/setup-superset.yaml
+++ b/demos/data-lakehouse-iceberg-trino-spark/setup-superset.yaml
@@ -8,7 +8,7 @@ spec:
     spec:
       containers:
         - name: setup-superset
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command: ["bash", "-c", "curl -o superset-assets.zip https://raw.githubusercontent.com/stackabletech/demos/main/demos/data-lakehouse-iceberg-trino-spark/superset-assets.zip && python -u /tmp/script/script.py"]
           volumeMounts:
             - name: script
diff --git a/demos/end-to-end-security/create-spark-report.yaml b/demos/end-to-end-security/create-spark-report.yaml
index c3b1245f..bfccb3aa 100644
--- a/demos/end-to-end-security/create-spark-report.yaml
+++ b/demos/end-to-end-security/create-spark-report.yaml
@@ -12,7 +12,7 @@ spec:
       serviceAccountName: demo-serviceaccount
       initContainers:
         - name: wait-for-trino-tables
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command:
             - bash
             - -euo
@@ -23,7 +23,7 @@ spec:
               kubectl wait --timeout=30m --for=condition=complete job/create-tables-in-trino
       containers:
         - name: create-spark-report
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command:
             - bash
             - -euo
diff --git a/demos/end-to-end-security/create-trino-tables.yaml b/demos/end-to-end-security/create-trino-tables.yaml
index 8778acb5..0b10a66d 100644
--- a/demos/end-to-end-security/create-trino-tables.yaml
+++ b/demos/end-to-end-security/create-trino-tables.yaml
@@ -8,7 +8,7 @@ spec:
     spec:
       containers:
         - name: create-tables-in-trino
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command: ["bash", "-c", "python -u /tmp/script/script.py"]
           volumeMounts:
             - name: script
diff --git a/demos/hbase-hdfs-load-cycling-data/create-hfile-and-import-to-hbase.yaml b/demos/hbase-hdfs-load-cycling-data/create-hfile-and-import-to-hbase.yaml
index ddc7aa86..8757d7d4 100644
--- a/demos/hbase-hdfs-load-cycling-data/create-hfile-and-import-to-hbase.yaml
+++ b/demos/hbase-hdfs-load-cycling-data/create-hfile-and-import-to-hbase.yaml
@@ -9,7 +9,7 @@ spec:
     spec:
       containers:
         - name: create-hfile-and-import-to-hbase
-          image: oci.stackable.tech/sdp/hbase:2.6.1-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/hbase:2.6.1-stackable25.3.0
           env:
             - name: HADOOP_USER_NAME
               value: stackable
diff --git a/demos/jupyterhub-pyspark-hdfs-anomaly-detection-taxi-data/load-test-data.yaml b/demos/jupyterhub-pyspark-hdfs-anomaly-detection-taxi-data/load-test-data.yaml
index 800dd9c5..c7e3887e 100644
--- a/demos/jupyterhub-pyspark-hdfs-anomaly-detection-taxi-data/load-test-data.yaml
+++ b/demos/jupyterhub-pyspark-hdfs-anomaly-detection-taxi-data/load-test-data.yaml
@@ -8,7 +8,7 @@ spec:
     spec:
       containers:
         - name: load-ny-taxi-data
-          image: oci.stackable.tech/sdp/hadoop:3.4.1-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/hadoop:3.4.1-stackable25.3.0
           # yamllint disable rule:line-length
           command: ["bash", "-c", "/stackable/hadoop/bin/hdfs dfs -mkdir -p /ny-taxi-data/raw \
           && cd /tmp \
diff --git a/demos/nifi-kafka-druid-earthquake-data/create-druid-ingestion-job.yaml b/demos/nifi-kafka-druid-earthquake-data/create-druid-ingestion-job.yaml
index 2c25c32c..1c91aca1 100644
--- a/demos/nifi-kafka-druid-earthquake-data/create-druid-ingestion-job.yaml
+++ b/demos/nifi-kafka-druid-earthquake-data/create-druid-ingestion-job.yaml
@@ -9,7 +9,7 @@ spec:
       serviceAccountName: demo-serviceaccount
       initContainers:
         - name: wait-for-druid-coordinator
-          image: oci.stackable.tech/sdp/tools:1.0.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/tools:1.0.0-stackable25.3.0
           command:
             - bash
             - -euo
@@ -22,7 +22,7 @@ spec:
               kubectl wait --for=condition=Ready pod/druid-coordinator-default-0 --timeout=30m
       containers:
         - name: create-druid-ingestion-job
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command:
             - bash
             - -euo
diff --git a/demos/nifi-kafka-druid-earthquake-data/create-nifi-ingestion-job.yaml b/demos/nifi-kafka-druid-earthquake-data/create-nifi-ingestion-job.yaml
index 82005839..2c6eb0e6 100644
--- a/demos/nifi-kafka-druid-earthquake-data/create-nifi-ingestion-job.yaml
+++ b/demos/nifi-kafka-druid-earthquake-data/create-nifi-ingestion-job.yaml
@@ -9,7 +9,7 @@ spec:
       serviceAccountName: demo-serviceaccount
       initContainers:
         - name: wait-for-nifi
-          image: oci.stackable.tech/sdp/tools:1.0.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/tools:1.0.0-stackable25.3.0
           command:
             - bash
             - -euo
@@ -22,7 +22,7 @@ spec:
               kubectl wait --for=condition=Ready pod/nifi-node-default-0 --timeout=30m
       containers:
         - name: create-nifi-ingestion-job
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command:
             - bash
             - -euo
diff --git a/demos/nifi-kafka-druid-earthquake-data/setup-superset.yaml b/demos/nifi-kafka-druid-earthquake-data/setup-superset.yaml
index 9be84027..7f413c34 100644
--- a/demos/nifi-kafka-druid-earthquake-data/setup-superset.yaml
+++ b/demos/nifi-kafka-druid-earthquake-data/setup-superset.yaml
@@ -9,7 +9,7 @@ spec:
       serviceAccountName: demo-serviceaccount
       initContainers:
         - name: wait-for-superset
-          image: oci.stackable.tech/sdp/tools:1.0.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/tools:1.0.0-stackable25.3.0
           command:
             - bash
             - -euo
@@ -22,7 +22,7 @@ spec:
               kubectl wait --for=condition=Ready pod/superset-node-default-0 --timeout=30m
       containers:
         - name: setup-superset
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command:
             - bash
             - -euo
diff --git a/demos/nifi-kafka-druid-water-level-data/create-druid-ingestion-job.yaml b/demos/nifi-kafka-druid-water-level-data/create-druid-ingestion-job.yaml
index 3ce637dc..692ad2ed 100644
--- a/demos/nifi-kafka-druid-water-level-data/create-druid-ingestion-job.yaml
+++ b/demos/nifi-kafka-druid-water-level-data/create-druid-ingestion-job.yaml
@@ -9,7 +9,7 @@ spec:
       serviceAccountName: demo-serviceaccount
       initContainers:
         - name: wait-for-druid-coordinator
-          image: oci.stackable.tech/sdp/tools:1.0.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/tools:1.0.0-stackable25.3.0
           command:
             - bash
             - -euo
@@ -22,7 +22,7 @@ spec:
               kubectl wait --for=condition=Ready pod/druid-coordinator-default-0 --timeout=30m
       containers:
         - name: create-druid-ingestion-job
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command:
             - bash
             - -euo
diff --git a/demos/nifi-kafka-druid-water-level-data/create-nifi-ingestion-job.yaml b/demos/nifi-kafka-druid-water-level-data/create-nifi-ingestion-job.yaml
index ac5961f1..850e7751 100644
--- a/demos/nifi-kafka-druid-water-level-data/create-nifi-ingestion-job.yaml
+++ b/demos/nifi-kafka-druid-water-level-data/create-nifi-ingestion-job.yaml
@@ -9,7 +9,7 @@ spec:
       serviceAccountName: demo-serviceaccount
       initContainers:
         - name: wait-for-nifi
-          image: oci.stackable.tech/sdp/tools:1.0.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/tools:1.0.0-stackable25.3.0
           command:
             - bash
             - -euo
@@ -22,7 +22,7 @@ spec:
               kubectl wait --for=condition=Ready pod/nifi-node-default-0 --timeout=30m
       containers:
         - name: create-nifi-ingestion-job
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command:
             - bash
             - -euo
diff --git a/demos/nifi-kafka-druid-water-level-data/setup-superset.yaml b/demos/nifi-kafka-druid-water-level-data/setup-superset.yaml
index 0d85b0b0..0044ecff 100644
--- a/demos/nifi-kafka-druid-water-level-data/setup-superset.yaml
+++ b/demos/nifi-kafka-druid-water-level-data/setup-superset.yaml
@@ -9,7 +9,7 @@ spec:
       serviceAccountName: demo-serviceaccount
       initContainers:
         - name: wait-for-superset
-          image: oci.stackable.tech/sdp/tools:1.0.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/tools:1.0.0-stackable25.3.0
           command:
             - bash
             - -euo
@@ -22,7 +22,7 @@ spec:
               kubectl wait --for=condition=Ready pod/superset-node-default-0 --timeout=30m
       containers:
         - name: setup-superset
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command:
             - bash
             - -euo
diff --git a/demos/signal-processing/Dockerfile-nifi b/demos/signal-processing/Dockerfile-nifi
index f39a639a..e220d3a0 100644
--- a/demos/signal-processing/Dockerfile-nifi
+++ b/demos/signal-processing/Dockerfile-nifi
@@ -1,4 +1,4 @@
-FROM oci.stackable.tech/sdp/nifi:2.2.0-stackable0.0.0-dev
+FROM oci.stackable.tech/sdp/nifi:2.2.0-stackable25.3.0
 
 # This is the postgresql JDBC driver from https://jdbc.postgresql.org/download/
 # There appear to be no signatures to validate against 😬
diff --git a/demos/signal-processing/create-nifi-ingestion-job.yaml b/demos/signal-processing/create-nifi-ingestion-job.yaml
index 1a858678..7ad1ed81 100644
--- a/demos/signal-processing/create-nifi-ingestion-job.yaml
+++ b/demos/signal-processing/create-nifi-ingestion-job.yaml
@@ -9,7 +9,7 @@ spec:
       serviceAccountName: demo-serviceaccount
       initContainers:
         - name: wait-for-timescale-job-and-nifi
-          image: oci.stackable.tech/sdp/tools:1.0.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/tools:1.0.0-stackable25.3.0
           command:
             - bash
             - -euo
@@ -28,7 +28,7 @@ spec:
               kubectl wait --for=condition=Ready pod/nifi-node-default-0 --timeout=30m
       containers:
         - name: create-nifi-ingestion-job
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command:
             - bash
             - -euo
diff --git a/demos/signal-processing/create-timescale-tables.yaml b/demos/signal-processing/create-timescale-tables.yaml
index efa8c7d6..a0a8c0bc 100644
--- a/demos/signal-processing/create-timescale-tables.yaml
+++ b/demos/signal-processing/create-timescale-tables.yaml
@@ -9,7 +9,7 @@ spec:
       serviceAccountName: demo-serviceaccount
       initContainers:
         - name: wait-for-timescale
-          image: oci.stackable.tech/sdp/tools:1.0.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/tools:1.0.0-stackable25.3.0
           command:
             - bash
             - -euo
diff --git a/demos/spark-k8s-anomaly-detection-taxi-data/create-spark-anomaly-detection-job.yaml b/demos/spark-k8s-anomaly-detection-taxi-data/create-spark-anomaly-detection-job.yaml
index 3623b9e7..17f47500 100644
--- a/demos/spark-k8s-anomaly-detection-taxi-data/create-spark-anomaly-detection-job.yaml
+++ b/demos/spark-k8s-anomaly-detection-taxi-data/create-spark-anomaly-detection-job.yaml
@@ -8,11 +8,11 @@ spec:
     spec:
       initContainers:
         - name: wait-for-testdata
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command: ["bash", "-c", "echo 'Waiting for job load-ny-taxi-data to finish' && kubectl wait --for=condition=complete --timeout=30m job/load-ny-taxi-data"]
       containers:
         - name: create-spark-anomaly-detection-job
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command: ["bash", "-c", "echo 'Submitting Spark job' && kubectl apply -f /tmp/manifest/spark-ad-job.yaml"]
           volumeMounts:
             - name: manifest
diff --git a/demos/spark-k8s-anomaly-detection-taxi-data/setup-superset.yaml b/demos/spark-k8s-anomaly-detection-taxi-data/setup-superset.yaml
index 56f8d5a3..4843d00e 100644
--- a/demos/spark-k8s-anomaly-detection-taxi-data/setup-superset.yaml
+++ b/demos/spark-k8s-anomaly-detection-taxi-data/setup-superset.yaml
@@ -8,7 +8,7 @@ spec:
     spec:
       containers:
         - name: setup-superset
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command: ["bash", "-c", "curl -o superset-assets.zip https://raw.githubusercontent.com/stackabletech/demos/main/demos/spark-k8s-anomaly-detection-taxi-data/superset-assets.zip && python -u /tmp/script/script.py"]
           volumeMounts:
             - name: script
diff --git a/demos/trino-taxi-data/create-table-in-trino.yaml b/demos/trino-taxi-data/create-table-in-trino.yaml
index de3fc97e..0e79f7ba 100644
--- a/demos/trino-taxi-data/create-table-in-trino.yaml
+++ b/demos/trino-taxi-data/create-table-in-trino.yaml
@@ -8,7 +8,7 @@ spec:
     spec:
       containers:
         - name: create-ny-taxi-data-table-in-trino
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command: ["bash", "-c", "python -u /tmp/script/script.py"]
           volumeMounts:
             - name: script
diff --git a/demos/trino-taxi-data/setup-superset.yaml b/demos/trino-taxi-data/setup-superset.yaml
index cb613aec..82e2573b 100644
--- a/demos/trino-taxi-data/setup-superset.yaml
+++ b/demos/trino-taxi-data/setup-superset.yaml
@@ -8,7 +8,7 @@ spec:
     spec:
       containers:
         - name: setup-superset
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command: ["bash", "-c", "curl -o superset-assets.zip https://raw.githubusercontent.com/stackabletech/demos/main/demos/trino-taxi-data/superset-assets.zip && python -u /tmp/script/script.py"]
           volumeMounts:
             - name: script
diff --git a/stacks/_templates/jupyterhub.yaml b/stacks/_templates/jupyterhub.yaml
index d0ef489d..cb8f197f 100644
--- a/stacks/_templates/jupyterhub.yaml
+++ b/stacks/_templates/jupyterhub.yaml
@@ -50,7 +50,7 @@ options:
       HADOOP_CONF_DIR: "/home/jovyan/hdfs"
     initContainers:
       - name: download-notebook
-        image: oci.stackable.tech/sdp/tools:1.0.0-stackable0.0.0-dev
+        image: oci.stackable.tech/sdp/tools:1.0.0-stackable25.3.0
         command: ['sh', '-c', 'curl https://raw.githubusercontent.com/stackabletech/demos/main/stacks/jupyterhub-pyspark-hdfs/notebook.ipynb -o /notebook/notebook.ipynb']
         volumeMounts:
           - mountPath: /notebook
diff --git a/stacks/_templates/keycloak.yaml b/stacks/_templates/keycloak.yaml
index dee91706..58177993 100644
--- a/stacks/_templates/keycloak.yaml
+++ b/stacks/_templates/keycloak.yaml
@@ -48,7 +48,7 @@ spec:
             - name: tls
               mountPath: /tls/
         - name: create-auth-class
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command: ["/bin/bash", "-c"]
           args:
             - |
diff --git a/stacks/end-to-end-security/krb5.yaml b/stacks/end-to-end-security/krb5.yaml
index e92aa69f..353b8fe9 100644
--- a/stacks/end-to-end-security/krb5.yaml
+++ b/stacks/end-to-end-security/krb5.yaml
@@ -14,7 +14,7 @@ spec:
     spec:
       initContainers:
         - name: init
-          image: oci.stackable.tech/sdp/krb5:1.21.1-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/krb5:1.21.1-stackable25.3.0
           args:
             - sh
             - -euo
@@ -35,7 +35,7 @@ spec:
               name: data
       containers:
         - name: kdc
-          image: oci.stackable.tech/sdp/krb5:1.21.1-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/krb5:1.21.1-stackable25.3.0
           args:
             - krb5kdc
             - -n
@@ -48,7 +48,7 @@ spec:
             - mountPath: /var/kerberos/krb5kdc
               name: data
         - name: kadmind
-          image: oci.stackable.tech/sdp/krb5:1.21.1-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/krb5:1.21.1-stackable25.3.0
           args:
             - kadmind
             - -nofork
@@ -61,7 +61,7 @@ spec:
             - mountPath: /var/kerberos/krb5kdc
               name: data
         - name: client
-          image: oci.stackable.tech/sdp/krb5:1.21.1-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/krb5:1.21.1-stackable25.3.0
           tty: true
           stdin: true
           env:
diff --git a/stacks/end-to-end-security/setup-postgresql.yaml b/stacks/end-to-end-security/setup-postgresql.yaml
index 64e45ffb..f56532fe 100644
--- a/stacks/end-to-end-security/setup-postgresql.yaml
+++ b/stacks/end-to-end-security/setup-postgresql.yaml
@@ -9,7 +9,7 @@ spec:
       initContainers:
         # The postgres image does not contain curl or wget...
         - name: download-dump
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command:
             - bash
             - -c
diff --git a/stacks/end-to-end-security/superset.yaml b/stacks/end-to-end-security/superset.yaml
index a35afa19..4a7c9635 100644
--- a/stacks/end-to-end-security/superset.yaml
+++ b/stacks/end-to-end-security/superset.yaml
@@ -23,7 +23,7 @@ spec:
       spec:
         initContainers:
           - name: wait-for-setup-db-job
-            image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+            image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
             command:
               - bash
               - -c
diff --git a/stacks/jupyterhub-keycloak/jupyterhub.yaml b/stacks/jupyterhub-keycloak/jupyterhub.yaml
index 375763e1..7ed097e3 100644
--- a/stacks/jupyterhub-keycloak/jupyterhub.yaml
+++ b/stacks/jupyterhub-keycloak/jupyterhub.yaml
@@ -148,7 +148,7 @@ options:
       stackable.tech/vendor: Stackable
     initContainers:
       - name: download-notebook
-        image: oci.stackable.tech/sdp/tools:1.0.0-stackable0.0.0-dev
+        image: oci.stackable.tech/sdp/tools:1.0.0-stackable25.3.0
         command: ['sh', '-c', 'curl https://raw.githubusercontent.com/stackabletech/demos/main/stacks/jupyterhub-keycloak/process-s3.ipynb -o /notebook/process-s3.ipynb']
         volumeMounts:
           - mountPath: /notebook
diff --git a/stacks/jupyterhub-keycloak/keycloak.yaml b/stacks/jupyterhub-keycloak/keycloak.yaml
index eb625208..b18a4893 100644
--- a/stacks/jupyterhub-keycloak/keycloak.yaml
+++ b/stacks/jupyterhub-keycloak/keycloak.yaml
@@ -50,7 +50,7 @@ spec:
               mountPath: /tls/
         - name: create-configmap
           resources: {}
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           command: ["/bin/bash", "-c"]
           args:
             - |
diff --git a/stacks/keycloak-opa-poc/keycloak.yaml b/stacks/keycloak-opa-poc/keycloak.yaml
index a5d64637..4ad1b099 100644
--- a/stacks/keycloak-opa-poc/keycloak.yaml
+++ b/stacks/keycloak-opa-poc/keycloak.yaml
@@ -70,7 +70,7 @@ spec:
     spec:
       containers:
       - name: propagate-keycloak-address
-        image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+        image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
         command:
           - bash
           - -x
diff --git a/stacks/keycloak-opa-poc/setup-keycloak.yaml b/stacks/keycloak-opa-poc/setup-keycloak.yaml
index fca8cdd5..b81934aa 100644
--- a/stacks/keycloak-opa-poc/setup-keycloak.yaml
+++ b/stacks/keycloak-opa-poc/setup-keycloak.yaml
@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: setup-keycloak
-        image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+        image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
         env:
           - name: KEYCLOAK_ADMIN_PASSWORD
             valueFrom:
diff --git a/stacks/logging/setup-opensearch-dashboards.yaml b/stacks/logging/setup-opensearch-dashboards.yaml
index bf707449..43653fba 100644
--- a/stacks/logging/setup-opensearch-dashboards.yaml
+++ b/stacks/logging/setup-opensearch-dashboards.yaml
@@ -8,7 +8,7 @@ spec:
     spec:
       containers:
         - name: setup-opensearch-dashboards
-          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
           env:
             - name: OPEN_SEARCH_ADMIN_PASSWORD
               valueFrom:
diff --git a/stacks/signal-processing/jupyterhub.yaml b/stacks/signal-processing/jupyterhub.yaml
index 7bec554e..13f7c117 100644
--- a/stacks/signal-processing/jupyterhub.yaml
+++ b/stacks/signal-processing/jupyterhub.yaml
@@ -30,7 +30,7 @@ options:
   singleuser:
     cmd: null
     image:
-      # TODO (@NickLarsenNZ): Use a versioned image with stackable0.0.0-dev or stackableXX.X.X so that
+      # TODO (@NickLarsenNZ): Use a versioned image with stackable25.3.0 or stackableXX.X.X so that
       # the demo is reproducable for the release and it will be automatically replaced for the release branch.
       name: oci.stackable.tech/stackable/jupyter-pyspark-with-alibi-detect
       tag: python-3.9
@@ -41,7 +41,7 @@ options:
       stackable.tech/vendor: Stackable
     initContainers:
       - name: download-notebook
-        image: oci.stackable.tech/sdp/tools:1.0.0-stackable0.0.0-dev
+        image: oci.stackable.tech/sdp/tools:1.0.0-stackable25.3.0
         command: ['sh', '-c', 'curl https://raw.githubusercontent.com/stackabletech/demos/main/stacks/signal-processing/tsdb.ipynb -o /notebook/tsdb.ipynb']
         volumeMounts:
           - mountPath: /notebook
diff --git a/stacks/signal-processing/nifi.yaml b/stacks/signal-processing/nifi.yaml
index 62231374..22f4415f 100644
--- a/stacks/signal-processing/nifi.yaml
+++ b/stacks/signal-processing/nifi.yaml
@@ -6,7 +6,7 @@ metadata:
 spec:
   image:
     productVersion: 2.2.0
-    # TODO (@NickLarsenNZ): Use a versioned image with stackable0.0.0-dev or stackableXX.X.X so that
+    # TODO (@NickLarsenNZ): Use a versioned image with stackable25.3.0 or stackableXX.X.X so that
     # the demo is reproducable for the release and it will be automatically replaced for the release branch.
     custom: oci.stackable.tech/stackable/nifi:2.2.0-postgresql
     # pullPolicy: IfNotPresent

From c55be52ea39243ee6861788c4aa16c37d15a527d Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Fri, 21 Mar 2025 17:00:15 +0100
Subject: [PATCH 3/5] chore(release): Replace githubusercontent references
 main->release-25.3

---
 .../setup-superset.yaml                       |   2 +-
 demos/demos-v2.yaml                           |  72 +++---
 .../setup-superset.yaml                       |   2 +-
 .../setup-superset.yaml                       |   2 +-
 .../setup-superset.yaml                       |   2 +-
 demos/trino-taxi-data/setup-superset.yaml     |   2 +-
 stacks/_templates/jupyterhub.yaml             |   2 +-
 .../end-to-end-security/setup-postgresql.yaml |   2 +-
 stacks/jupyterhub-keycloak/jupyterhub.yaml    |   2 +-
 stacks/signal-processing/jupyterhub.yaml      |   2 +-
 stacks/stacks-v2.yaml                         | 244 +++++++++---------
 11 files changed, 167 insertions(+), 167 deletions(-)

diff --git a/demos/data-lakehouse-iceberg-trino-spark/setup-superset.yaml b/demos/data-lakehouse-iceberg-trino-spark/setup-superset.yaml
index b696541f..6483db6e 100644
--- a/demos/data-lakehouse-iceberg-trino-spark/setup-superset.yaml
+++ b/demos/data-lakehouse-iceberg-trino-spark/setup-superset.yaml
@@ -9,7 +9,7 @@ spec:
       containers:
         - name: setup-superset
           image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
-          command: ["bash", "-c", "curl -o superset-assets.zip https://raw.githubusercontent.com/stackabletech/demos/main/demos/data-lakehouse-iceberg-trino-spark/superset-assets.zip && python -u /tmp/script/script.py"]
+          command: ["bash", "-c", "curl -o superset-assets.zip https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/data-lakehouse-iceberg-trino-spark/superset-assets.zip && python -u /tmp/script/script.py"]
           volumeMounts:
             - name: script
               mountPath: /tmp/script
diff --git a/demos/demos-v2.yaml b/demos/demos-v2.yaml
index 44aa520a..da5076c7 100644
--- a/demos/demos-v2.yaml
+++ b/demos/demos-v2.yaml
@@ -7,10 +7,10 @@ demos:
       - airflow
       - job-scheduling
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/airflow-scheduled-job/01-airflow-spark-clusterrole.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/airflow-scheduled-job/02-airflow-spark-clusterrolebinding.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/airflow-scheduled-job/03-enable-and-run-spark-dag.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/airflow-scheduled-job/04-enable-and-run-date-dag.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/airflow-scheduled-job/01-airflow-spark-clusterrole.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/airflow-scheduled-job/02-airflow-spark-clusterrolebinding.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/airflow-scheduled-job/03-enable-and-run-spark-dag.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/airflow-scheduled-job/04-enable-and-run-date-dag.yaml
     supportedNamespaces: []
     resourceRequests:
       cpu: 2401m
@@ -24,8 +24,8 @@ demos:
       - hdfs
       - cycling-tripdata
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/hbase-hdfs-load-cycling-data/distcp-cycling-data.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/hbase-hdfs-load-cycling-data/create-hfile-and-import-to-hbase.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/hbase-hdfs-load-cycling-data/distcp-cycling-data.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/hbase-hdfs-load-cycling-data/create-hfile-and-import-to-hbase.yaml
     supportedNamespaces: []
     resourceRequests:
       cpu: "3"
@@ -43,9 +43,9 @@ demos:
       - opa
       - keycloak
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/end-to-end-security/create-trino-tables.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/end-to-end-security/serviceaccount.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/end-to-end-security/create-spark-report.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/end-to-end-security/create-trino-tables.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/end-to-end-security/serviceaccount.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/end-to-end-security/create-spark-report.yaml
     supportedNamespaces: []
     resourceRequests:
       cpu: 9000m
@@ -64,10 +64,10 @@ demos:
       - s3
       - earthquakes
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/nifi-kafka-druid-earthquake-data/serviceaccount.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/nifi-kafka-druid-earthquake-data/create-nifi-ingestion-job.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/nifi-kafka-druid-earthquake-data/create-druid-ingestion-job.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/nifi-kafka-druid-earthquake-data/setup-superset.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/nifi-kafka-druid-earthquake-data/serviceaccount.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/nifi-kafka-druid-earthquake-data/create-nifi-ingestion-job.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/nifi-kafka-druid-earthquake-data/create-druid-ingestion-job.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/nifi-kafka-druid-earthquake-data/setup-superset.yaml
     supportedNamespaces: ["default"]
     resourceRequests:
       cpu: 8700m
@@ -86,10 +86,10 @@ demos:
       - s3
       - water-levels
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/nifi-kafka-druid-water-level-data/serviceaccount.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/nifi-kafka-druid-water-level-data/create-nifi-ingestion-job.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/nifi-kafka-druid-water-level-data/create-druid-ingestion-job.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/nifi-kafka-druid-water-level-data/setup-superset.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/nifi-kafka-druid-water-level-data/serviceaccount.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/nifi-kafka-druid-water-level-data/create-nifi-ingestion-job.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/nifi-kafka-druid-water-level-data/create-druid-ingestion-job.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/nifi-kafka-druid-water-level-data/setup-superset.yaml
     supportedNamespaces: ["default"]
     resourceRequests:
       cpu: 8900m
@@ -106,10 +106,10 @@ demos:
       - s3
       - ny-taxi-data
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/spark-k8s-anomaly-detection-taxi-data/serviceaccount.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/spark-k8s-anomaly-detection-taxi-data/load-test-data.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/spark-k8s-anomaly-detection-taxi-data/create-spark-anomaly-detection-job.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/spark-k8s-anomaly-detection-taxi-data/setup-superset.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/spark-k8s-anomaly-detection-taxi-data/serviceaccount.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/spark-k8s-anomaly-detection-taxi-data/load-test-data.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/spark-k8s-anomaly-detection-taxi-data/create-spark-anomaly-detection-job.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/spark-k8s-anomaly-detection-taxi-data/setup-superset.yaml
     supportedNamespaces: []
     resourceRequests:
       cpu: 6400m
@@ -141,9 +141,9 @@ demos:
       - s3
       - ny-taxi-data
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/trino-taxi-data/load-test-data.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/trino-taxi-data/create-table-in-trino.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/trino-taxi-data/setup-superset.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/trino-taxi-data/load-test-data.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/trino-taxi-data/create-table-in-trino.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/trino-taxi-data/setup-superset.yaml
     supportedNamespaces: []
     resourceRequests:
       cpu: 6800m
@@ -166,12 +166,12 @@ demos:
       - water-levels
       - earthquakes
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/data-lakehouse-iceberg-trino-spark/serviceaccount.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/data-lakehouse-iceberg-trino-spark/load-test-data.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/data-lakehouse-iceberg-trino-spark/create-trino-tables.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/data-lakehouse-iceberg-trino-spark/create-nifi-ingestion-job.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/data-lakehouse-iceberg-trino-spark/create-spark-ingestion-job.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/data-lakehouse-iceberg-trino-spark/setup-superset.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/data-lakehouse-iceberg-trino-spark/serviceaccount.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/data-lakehouse-iceberg-trino-spark/load-test-data.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/data-lakehouse-iceberg-trino-spark/create-trino-tables.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/data-lakehouse-iceberg-trino-spark/create-nifi-ingestion-job.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/data-lakehouse-iceberg-trino-spark/create-spark-ingestion-job.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/data-lakehouse-iceberg-trino-spark/setup-superset.yaml
     supportedNamespaces: ["default"]
     resourceRequests:
       cpu: "80"
@@ -187,7 +187,7 @@ demos:
       - pyspark
       - ny-taxi-data
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/jupyterhub-pyspark-hdfs-anomaly-detection-taxi-data/load-test-data.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/jupyterhub-pyspark-hdfs-anomaly-detection-taxi-data/load-test-data.yaml
     supportedNamespaces: []
     resourceRequests:
       cpu: 3350m
@@ -204,7 +204,7 @@ demos:
       - vector
       - zookeeper
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/logging/zookeeper.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/logging/zookeeper.yaml
     supportedNamespaces: []
     resourceRequests:
       cpu: 6500m
@@ -220,9 +220,9 @@ demos:
       - grafana-dashboards
       - zookeeper
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/signal-processing/serviceaccount.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/signal-processing/create-timescale-tables.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/signal-processing/create-nifi-ingestion-job.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/signal-processing/serviceaccount.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/signal-processing/create-timescale-tables.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/signal-processing/create-nifi-ingestion-job.yaml
     supportedNamespaces: []
     resourceRequests:
       cpu: "3"
@@ -238,7 +238,7 @@ demos:
       - spark
       - S3
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/demos/jupyterhub-keycloak/load-gas-data.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/jupyterhub-keycloak/load-gas-data.yaml
     supportedNamespaces: []
     resourceRequests:
       cpu: 6400m
diff --git a/demos/nifi-kafka-druid-earthquake-data/setup-superset.yaml b/demos/nifi-kafka-druid-earthquake-data/setup-superset.yaml
index 7f413c34..02f7e37c 100644
--- a/demos/nifi-kafka-druid-earthquake-data/setup-superset.yaml
+++ b/demos/nifi-kafka-druid-earthquake-data/setup-superset.yaml
@@ -29,7 +29,7 @@ spec:
             - pipefail
             - -c
             - |
-              curl -o superset-assets.zip https://raw.githubusercontent.com/stackabletech/demos/main/demos/nifi-kafka-druid-earthquake-data/superset-assets.zip
+              curl -o superset-assets.zip https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/nifi-kafka-druid-earthquake-data/superset-assets.zip
               python -u /tmp/script/script.py
           volumeMounts:
             - name: script
diff --git a/demos/nifi-kafka-druid-water-level-data/setup-superset.yaml b/demos/nifi-kafka-druid-water-level-data/setup-superset.yaml
index 0044ecff..baab0639 100644
--- a/demos/nifi-kafka-druid-water-level-data/setup-superset.yaml
+++ b/demos/nifi-kafka-druid-water-level-data/setup-superset.yaml
@@ -29,7 +29,7 @@ spec:
             - pipefail
             - -c
             - |
-              curl -o superset-assets.zip https://raw.githubusercontent.com/stackabletech/demos/main/demos/nifi-kafka-druid-water-level-data/superset-assets.zip
+              curl -o superset-assets.zip https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/nifi-kafka-druid-water-level-data/superset-assets.zip
               python -u /tmp/script/script.py
           volumeMounts:
             - name: script
diff --git a/demos/spark-k8s-anomaly-detection-taxi-data/setup-superset.yaml b/demos/spark-k8s-anomaly-detection-taxi-data/setup-superset.yaml
index 4843d00e..c7d81cc0 100644
--- a/demos/spark-k8s-anomaly-detection-taxi-data/setup-superset.yaml
+++ b/demos/spark-k8s-anomaly-detection-taxi-data/setup-superset.yaml
@@ -9,7 +9,7 @@ spec:
       containers:
         - name: setup-superset
           image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
-          command: ["bash", "-c", "curl -o superset-assets.zip https://raw.githubusercontent.com/stackabletech/demos/main/demos/spark-k8s-anomaly-detection-taxi-data/superset-assets.zip && python -u /tmp/script/script.py"]
+          command: ["bash", "-c", "curl -o superset-assets.zip https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/spark-k8s-anomaly-detection-taxi-data/superset-assets.zip && python -u /tmp/script/script.py"]
           volumeMounts:
             - name: script
               mountPath: /tmp/script
diff --git a/demos/trino-taxi-data/setup-superset.yaml b/demos/trino-taxi-data/setup-superset.yaml
index 82e2573b..1de648ff 100644
--- a/demos/trino-taxi-data/setup-superset.yaml
+++ b/demos/trino-taxi-data/setup-superset.yaml
@@ -9,7 +9,7 @@ spec:
       containers:
         - name: setup-superset
           image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable25.3.0
-          command: ["bash", "-c", "curl -o superset-assets.zip https://raw.githubusercontent.com/stackabletech/demos/main/demos/trino-taxi-data/superset-assets.zip && python -u /tmp/script/script.py"]
+          command: ["bash", "-c", "curl -o superset-assets.zip https://raw.githubusercontent.com/stackabletech/demos/release-25.3/demos/trino-taxi-data/superset-assets.zip && python -u /tmp/script/script.py"]
           volumeMounts:
             - name: script
               mountPath: /tmp/script
diff --git a/stacks/_templates/jupyterhub.yaml b/stacks/_templates/jupyterhub.yaml
index cb8f197f..53e8d198 100644
--- a/stacks/_templates/jupyterhub.yaml
+++ b/stacks/_templates/jupyterhub.yaml
@@ -51,7 +51,7 @@ options:
     initContainers:
       - name: download-notebook
         image: oci.stackable.tech/sdp/tools:1.0.0-stackable25.3.0
-        command: ['sh', '-c', 'curl https://raw.githubusercontent.com/stackabletech/demos/main/stacks/jupyterhub-pyspark-hdfs/notebook.ipynb -o /notebook/notebook.ipynb']
+        command: ['sh', '-c', 'curl https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/jupyterhub-pyspark-hdfs/notebook.ipynb -o /notebook/notebook.ipynb']
         volumeMounts:
           - mountPath: /notebook
             name: notebook
diff --git a/stacks/end-to-end-security/setup-postgresql.yaml b/stacks/end-to-end-security/setup-postgresql.yaml
index f56532fe..9cc31af7 100644
--- a/stacks/end-to-end-security/setup-postgresql.yaml
+++ b/stacks/end-to-end-security/setup-postgresql.yaml
@@ -16,7 +16,7 @@ spec:
             - |
               kubectl rollout status --watch statefulset/postgresql-superset
               cd /tmp
-              curl --fail -O https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/postgres_superset_dump.sql.gz
+              curl --fail -O https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/end-to-end-security/postgres_superset_dump.sql.gz
               gunzip postgres_superset_dump.sql.gz
 
               # We need to omit changing the users password, as otherwise the content in the Secrets does not match
diff --git a/stacks/jupyterhub-keycloak/jupyterhub.yaml b/stacks/jupyterhub-keycloak/jupyterhub.yaml
index 7ed097e3..5489c1aa 100644
--- a/stacks/jupyterhub-keycloak/jupyterhub.yaml
+++ b/stacks/jupyterhub-keycloak/jupyterhub.yaml
@@ -149,7 +149,7 @@ options:
     initContainers:
       - name: download-notebook
         image: oci.stackable.tech/sdp/tools:1.0.0-stackable25.3.0
-        command: ['sh', '-c', 'curl https://raw.githubusercontent.com/stackabletech/demos/main/stacks/jupyterhub-keycloak/process-s3.ipynb -o /notebook/process-s3.ipynb']
+        command: ['sh', '-c', 'curl https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/jupyterhub-keycloak/process-s3.ipynb -o /notebook/process-s3.ipynb']
         volumeMounts:
           - mountPath: /notebook
             name: notebook
diff --git a/stacks/signal-processing/jupyterhub.yaml b/stacks/signal-processing/jupyterhub.yaml
index 13f7c117..6e28af01 100644
--- a/stacks/signal-processing/jupyterhub.yaml
+++ b/stacks/signal-processing/jupyterhub.yaml
@@ -42,7 +42,7 @@ options:
     initContainers:
       - name: download-notebook
         image: oci.stackable.tech/sdp/tools:1.0.0-stackable25.3.0
-        command: ['sh', '-c', 'curl https://raw.githubusercontent.com/stackabletech/demos/main/stacks/signal-processing/tsdb.ipynb -o /notebook/tsdb.ipynb']
+        command: ['sh', '-c', 'curl https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/signal-processing/tsdb.ipynb -o /notebook/tsdb.ipynb']
         volumeMounts:
           - mountPath: /notebook
             name: notebook
diff --git a/stacks/stacks-v2.yaml b/stacks/stacks-v2.yaml
index 9e254c5c..17c058ee 100644
--- a/stacks/stacks-v2.yaml
+++ b/stacks/stacks-v2.yaml
@@ -11,9 +11,9 @@ stacks:
       - prometheus
       - grafana
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/monitoring/grafana-dashboards.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/prometheus.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/prometheus-service-monitor.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/monitoring/grafana-dashboards.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/prometheus.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/prometheus-service-monitor.yaml
     supportedNamespaces: []
     resourceRequests:
       cpu: 1750m
@@ -37,11 +37,11 @@ stacks:
       - opensearch-dashboards
       - vector
     manifests:
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/opensearch.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/opensearch-dashboards.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/logging/setup-opensearch-dashboards.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/vector-aggregator.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/vector-aggregator-discovery.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/opensearch.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/opensearch-dashboards.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/logging/setup-opensearch-dashboards.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/vector-aggregator.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/vector-aggregator-discovery.yaml
     supportedNamespaces: []
     resourceRequests:
       cpu: 5150m
@@ -71,14 +71,14 @@ stacks:
       - observability
       - tracing
     manifests:
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/observability/jaeger.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/observability/opentelemetry-operator.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/observability/grafana-admin-credentials.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/observability/grafana.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/observability/grafana-tempo.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/observability/grafana-loki.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/observability/opentelemetry-collector-sidecar.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/observability/opentelemetry-collector-deployment.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/observability/jaeger.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/observability/opentelemetry-operator.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/observability/grafana-admin-credentials.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/observability/grafana.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/observability/grafana-tempo.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/observability/grafana-loki.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/observability/opentelemetry-collector-sidecar.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/observability/opentelemetry-collector-deployment.yaml
     parameters:
       - name: grafanaAdminPassword
         description: Password of the Grafana admin user
@@ -95,9 +95,9 @@ stacks:
     labels:
       - airflow
     manifests:
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/postgresql-airflow.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/redis-airflow.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/airflow/airflow.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/postgresql-airflow.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/redis-airflow.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/airflow/airflow.yaml
     supportedNamespaces: []
     resourceRequests:
       cpu: 3400m
@@ -135,17 +135,17 @@ stacks:
       - minio
       - s3
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/minio-distributed-tls/rendered-chart.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/postgresql-hive.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/postgresql-hive-iceberg.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/postgresql-superset.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/data-lakehouse-iceberg-trino-spark/s3-connection.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/data-lakehouse-iceberg-trino-spark/hive-metastores.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/data-lakehouse-iceberg-trino-spark/trino.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/data-lakehouse-iceberg-trino-spark/zookeeper.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/data-lakehouse-iceberg-trino-spark/kafka.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/data-lakehouse-iceberg-trino-spark/nifi.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/nifi-kafka-druid-superset-s3/superset.yaml # Reuse
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/minio-distributed-tls/rendered-chart.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/postgresql-hive.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/postgresql-hive-iceberg.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/postgresql-superset.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/data-lakehouse-iceberg-trino-spark/s3-connection.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/data-lakehouse-iceberg-trino-spark/hive-metastores.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/data-lakehouse-iceberg-trino-spark/trino.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/data-lakehouse-iceberg-trino-spark/zookeeper.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/data-lakehouse-iceberg-trino-spark/kafka.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/data-lakehouse-iceberg-trino-spark/nifi.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/nifi-kafka-druid-superset-s3/superset.yaml # Reuse
     supportedNamespaces: ["default"] # until namespace can be templates, the minio FQDN hard-codes the namespace
     resourceRequests:
       cpu: "71"
@@ -181,9 +181,9 @@ stacks:
       - hbase
       - hdfs
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/hdfs-hbase/zookeeper.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/hdfs-hbase/hdfs.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/hdfs-hbase/hbase.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/hdfs-hbase/zookeeper.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/hdfs-hbase/hdfs.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/hdfs-hbase/hbase.yaml
     supportedNamespaces: []
     resourceRequests:
       cpu: 4200m
@@ -210,14 +210,14 @@ stacks:
       - minio
       - s3
     manifests:
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/minio.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/postgresql-druid.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/postgresql-superset.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/nifi-kafka-druid-superset-s3/zookeeper.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/nifi-kafka-druid-superset-s3/kafka.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/nifi-kafka-druid-superset-s3/druid.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/nifi-kafka-druid-superset-s3/superset.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/nifi-kafka-druid-superset-s3/nifi.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/minio.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/postgresql-druid.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/postgresql-superset.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/nifi-kafka-druid-superset-s3/zookeeper.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/nifi-kafka-druid-superset-s3/kafka.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/nifi-kafka-druid-superset-s3/druid.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/nifi-kafka-druid-superset-s3/superset.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/nifi-kafka-druid-superset-s3/nifi.yaml
     supportedNamespaces: []
     resourceRequests:
       cpu: 8900m
@@ -254,15 +254,15 @@ stacks:
       - minio
       - s3
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/minio-tls/rendered-chart.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/postgresql-hive.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/postgresql-hive-iceberg.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/postgresql-superset.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/spark-trino-superset-s3/s3-connection.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/spark-trino-superset-s3/hive-metastore.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/trino-superset-s3/trino.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/spark-trino-superset-s3/trino-prediction-catalog.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/trino-superset-s3/superset.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/minio-tls/rendered-chart.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/postgresql-hive.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/postgresql-hive-iceberg.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/postgresql-superset.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/spark-trino-superset-s3/s3-connection.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/spark-trino-superset-s3/hive-metastore.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/trino-superset-s3/trino.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/spark-trino-superset-s3/trino-prediction-catalog.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/trino-superset-s3/superset.yaml
     supportedNamespaces: []
     resourceRequests:
       cpu: 7100m
@@ -298,13 +298,13 @@ stacks:
       - minio
       - s3
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/minio-tls/rendered-chart.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/postgresql-hive.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/postgresql-superset.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/trino-superset-s3/s3-connection.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/trino-superset-s3/hive-metastore.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/trino-superset-s3/trino.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/trino-superset-s3/superset.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/minio-tls/rendered-chart.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/postgresql-hive.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/postgresql-superset.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/trino-superset-s3/s3-connection.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/trino-superset-s3/hive-metastore.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/trino-superset-s3/trino.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/trino-superset-s3/superset.yaml
     supportedNamespaces: [default] # until namespace can be templates, the minio FQDN hard-codes the namespace
     resourceRequests:
       cpu: 6800m
@@ -340,11 +340,11 @@ stacks:
       - minio
       - s3
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/minio-distributed-small-tls/rendered-chart.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/postgresql-hive-iceberg.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/trino-iceberg/s3-connection.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/trino-iceberg/hive-metastores.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/trino-iceberg/trino.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/minio-distributed-small-tls/rendered-chart.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/postgresql-hive-iceberg.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/trino-iceberg/s3-connection.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/trino-iceberg/hive-metastores.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/trino-iceberg/trino.yaml
     supportedNamespaces: ["default"] # until namespace can be templates, the minio FQDN hard-codes the namespace
     resourceRequests:
       cpu: 6000m # Measured 5600m
@@ -372,12 +372,12 @@ stacks:
       - hdfs
       - pyspark
     manifests:
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/jupyterhub.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/jupyterhub-pyspark-hdfs/zookeeper.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/jupyterhub-pyspark-hdfs/hdfs.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/jupyterhub-pyspark-hdfs/serviceaccount.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/jupyterhub.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/jupyterhub-pyspark-hdfs/zookeeper.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/jupyterhub-pyspark-hdfs/hdfs.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/jupyterhub-pyspark-hdfs/serviceaccount.yaml
       # TODO Use patched JHub that created service for us from customer setup (ask Sebastian)
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/jupyterhub-pyspark-hdfs/spark_driver_service.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/jupyterhub-pyspark-hdfs/spark_driver_service.yaml
     supportedNamespaces: []
     resourceRequests:
       cpu: 3350m
@@ -405,12 +405,12 @@ stacks:
       - hdfs
       - s3
     manifests:
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/postgresql-hivehdfs.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/postgresql-hives3.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/minio.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/dual-hive-hdfs-s3/hdfs.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/dual-hive-hdfs-s3/hive.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/dual-hive-hdfs-s3/trino.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/postgresql-hivehdfs.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/postgresql-hives3.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/minio.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/dual-hive-hdfs-s3/hdfs.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/dual-hive-hdfs-s3/hive.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/dual-hive-hdfs-s3/trino.yaml
     supportedNamespaces: []
     resourceRequests:
       cpu: 7750m
@@ -435,7 +435,7 @@ stacks:
       - authentication
       - ldap
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/authentication/openldap-tls.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/authentication/openldap-tls.yaml
     supportedNamespaces: ["default"]
     resourceRequests:
       cpu: 1950m
@@ -458,8 +458,8 @@ stacks:
       - authentication
       - ldap
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/authentication/openldap-tls.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/authentication/openldap-tls-authenticationclass.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/authentication/openldap-tls.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/authentication/openldap-tls-authenticationclass.yaml
     supportedNamespaces: []
     resourceRequests:
       cpu: 1950m
@@ -490,18 +490,18 @@ stacks:
       - authentication
       - sso
     manifests:
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/postgresql-superset.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/postgresql-druid.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/keycloak-opa-poc/serviceaccount.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/keycloak-opa-poc/keycloak.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/keycloak-opa-poc/setup-keycloak.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/keycloak-opa-poc/opa.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/keycloak-opa-poc/policies.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/keycloak-opa-poc/zookeeper.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/keycloak-opa-poc/hdfs.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/keycloak-opa-poc/druid.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/keycloak-opa-poc/trino.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/keycloak-opa-poc/superset.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/postgresql-superset.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/postgresql-druid.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/keycloak-opa-poc/serviceaccount.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/keycloak-opa-poc/keycloak.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/keycloak-opa-poc/setup-keycloak.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/keycloak-opa-poc/opa.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/keycloak-opa-poc/policies.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/keycloak-opa-poc/zookeeper.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/keycloak-opa-poc/hdfs.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/keycloak-opa-poc/druid.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/keycloak-opa-poc/trino.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/keycloak-opa-poc/superset.yaml
     supportedNamespaces: ["default"] # ClusterRoleBinding needs explicit namespace
     resourceRequests:
       cpu: 7850m
@@ -567,24 +567,24 @@ stacks:
       memory: 19586Mi
       pvc: 40Gi
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/keycloak-serviceaccount.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/keycloak-realm-config.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/keycloak.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/postgresql-hive-iceberg.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/postgresql-superset.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/krb5.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/kerberos-secretclass.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/opa.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/zookeeper.yaml # TODO: Add authentication
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/hdfs.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/hdfs-regorules.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/hive-metastore.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/trino.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/trino-regorules.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/trino-policies.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/rbac.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/setup-postgresql.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/superset.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/keycloak-serviceaccount.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/end-to-end-security/keycloak-realm-config.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/keycloak.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/postgresql-hive-iceberg.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/postgresql-superset.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/end-to-end-security/krb5.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/end-to-end-security/kerberos-secretclass.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/end-to-end-security/opa.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/end-to-end-security/zookeeper.yaml # TODO: Add authentication
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/end-to-end-security/hdfs.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/end-to-end-security/hdfs-regorules.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/end-to-end-security/hive-metastore.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/end-to-end-security/trino.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/end-to-end-security/trino-regorules.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/end-to-end-security/trino-policies.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/end-to-end-security/rbac.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/end-to-end-security/setup-postgresql.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/end-to-end-security/superset.yaml
     parameters:
       - name: keycloakAdminPassword
         description: Password of the Keycloak admin user
@@ -626,15 +626,15 @@ stacks:
       - jupyterhub
       - grafana
     manifests:
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/signal-processing/secrets.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/signal-processing/grafana-dashboards.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/signal-processing/grafana.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/postgresql-timescaledb.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/nifi-kafka-druid-superset-s3/zookeeper.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/signal-processing/nifi.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/jupyterhub-pyspark-hdfs/serviceaccount.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/jupyterhub-pyspark-hdfs/spark_driver_service.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/signal-processing/jupyterhub.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/signal-processing/secrets.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/signal-processing/grafana-dashboards.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/signal-processing/grafana.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/postgresql-timescaledb.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/nifi-kafka-druid-superset-s3/zookeeper.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/signal-processing/nifi.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/jupyterhub-pyspark-hdfs/serviceaccount.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/jupyterhub-pyspark-hdfs/spark_driver_service.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/signal-processing/jupyterhub.yaml
     parameters:
       - name: nifiAdminPassword
         description: Password of the NiFI admin user
@@ -666,13 +666,13 @@ stacks:
       memory: 9010Mi
       pvc: 24Gi
     manifests:
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/minio.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/jupyterhub-keycloak/keycloak-serviceaccount.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/jupyterhub-keycloak/keycloak-realm-config.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/jupyterhub-keycloak/keycloak.yaml
-      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/jupyterhub-keycloak/jupyterhub.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/jupyterhub-keycloak/serviceaccount.yaml
-      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/jupyterhub-keycloak/s3-connection.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/_templates/minio.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/jupyterhub-keycloak/keycloak-serviceaccount.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/jupyterhub-keycloak/keycloak-realm-config.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/jupyterhub-keycloak/keycloak.yaml
+      - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/jupyterhub-keycloak/jupyterhub.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/jupyterhub-keycloak/serviceaccount.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.3/stacks/jupyterhub-keycloak/s3-connection.yaml
     parameters:
       - name: keycloakAdminPassword
         description: Password of the Keycloak admin user

From 6720aeb5bb32c3dec733ac648e81db073ba5e6d0 Mon Sep 17 00:00:00 2001
From: Malte Sander <malte.sander.it@gmail.com>
Date: Tue, 25 Mar 2025 16:04:07 +0100
Subject: [PATCH 4/5] fix(end-to-end-security): Downgrade Hive metastore to
 4.0.0 (#189)

use hive 4.0.0 instead of 4.0.1
---
 stacks/end-to-end-security/hive-metastore.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stacks/end-to-end-security/hive-metastore.yaml b/stacks/end-to-end-security/hive-metastore.yaml
index c64a5786..e1c08899 100644
--- a/stacks/end-to-end-security/hive-metastore.yaml
+++ b/stacks/end-to-end-security/hive-metastore.yaml
@@ -5,7 +5,7 @@ metadata:
   name: hive-iceberg
 spec:
   image:
-    productVersion: 4.0.1
+    productVersion: 4.0.0
   clusterConfig:
     database:
       connString: jdbc:postgresql://postgresql-hive-iceberg:5432/hive

From 8272ecf78a7029ca7301c824d76b8f5703cbfe4c Mon Sep 17 00:00:00 2001
From: Razvan-Daniel Mihai <84674+razvan@users.noreply.github.com>
Date: Wed, 26 Mar 2025 09:15:09 +0200
Subject: [PATCH 5/5] fix: add tls property to s3 conn

---
 stacks/spark-trino-superset-s3/s3-connection.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/stacks/spark-trino-superset-s3/s3-connection.yaml b/stacks/spark-trino-superset-s3/s3-connection.yaml
index 55ae8400..980a3626 100644
--- a/stacks/spark-trino-superset-s3/s3-connection.yaml
+++ b/stacks/spark-trino-superset-s3/s3-connection.yaml
@@ -10,6 +10,11 @@ spec:
   accessStyle: Path
   credentials:
     secretClass: minio-s3-credentials
+  tls:
+    verification:
+      server:
+        caCert:
+          secretClass: tls
 ---
 apiVersion: secrets.stackable.tech/v1alpha1
 kind: SecretClass