[bmscomp]

Built on #438 (kates-platform 0.8.0, now on main): this bumps it to 0.8.1.

Problem

kates-platform installs Kafka (krafter) in its release namespace, but the kates subchart kept its own defaults, and the platform profile has its own grant:

Where	Default	Effect in the umbrella
kates.kafka.bootstrapServers	krafter-kafka-bootstrap.kafka.svc:9092	wrong Service unless the release is in kafka
kates.trogdor.coordinatorUrl	…trogdor-coordinator.kafka.svc:8889	same
kates.networkPolicy.kafka.namespace	kafka	Kates egress to the brokers and 8889 only into kafka
kates.kafka.topicNamespace	"" (backend falls back to kafka)	CDC KafkaTopic CRs looked for in kafka
profile platform, client kates	namespace kates	brokers admit Kates only from kates

Installed with -n kates as the README does, Kates resolved …kafka.svc and its egress went to kafka. Installed with -n kafka, the brokers refused it. No namespace worked.

The kates-backend KafkaUser, and so the SCRAM Secret Strimzi writes, was already in the release namespace with Kates, so that part was fine.

Fix

• kates 0.11.7: kafka.bootstrapServers, kafka.topicNamespace, trogdor.coordinatorUrl and networkPolicy.kafka.namespace go through tpl. A value without {{ renders as before, so kates deploy (which --sets these) and every plain install are unchanged.
• kates-platform 0.8.1: sets those four from {{ .Release.Namespace }}, and overrides the profile's kates client to namespace: "" (the release namespace). Kates floor >=0.11.7.
• The umbrella's Helm test pod gets kates.io/test-pod: "true", the label kafka-cluster's broker policy admits test pods by. Without it, helm test couldn't reach Kafka.
• CI (helm-lint job) renders the umbrella in namespace platform and checks the bootstrap, the Kates egress and the broker grant.
• Two MCP caveat refs into charts/kates/values.yaml move by the two comment lines added there.

Proof

helm template p charts/kates-platform -n <ns> for kates, platform and kafka:

-n platform
  KATES_KAFKA_BOOTSTRAP_SERVERS: "krafter-kafka-bootstrap.platform.svc:9092"
  KATES_CDC_TOPIC_NAMESPACE: "platform"
  KATES_TROGDOR_COORDINATOR_URL: "http://trogdor-coordinator.platform.svc:8889"
kates egress ns: platform
broker ingress for kates: [{"podSelector":{"matchLabels":{"app.kubernetes.io/name":"kates"}}}]   # same namespace, no namespaceSelector
KafkaUser kates-backend ns: platform

Before (#438's head, -n kates): bootstrap …kafka.svc, egress "kafka".

The new CI step passes on this branch and fails on each of three regressions: dropping the client override (kafka-cluster.networkPolicy.clients=null), the old bootstrap, and egress to kafka.

Local checks

• Helm 4.3.0 locally (CI runs 3.17.0): every step of the helm-lint job passes (lint + template of every chart, the kates asserts, the stale-subchart guard, the new step) except kubeconform, which isn't installed here.
• gen-chart-table.sh --check, gen-version-matrix.sh --check, check-versions.sh
• actionlint, yamllint -c .yamllint.yaml .github config charts
• go vet ./cmd && go test ./cmd in cli/, including TestMCPCaveatRefAnchors

Not in this PR

• The backend's kates.chaos.kafka.namespace and kates.topology.kafka-namespace default to kafka, and neither the chart nor kates deploy sets them. So in the umbrella outside kafka, chaos targets, topology, cluster alerts and conformity still look in kafka.
• apicurio-registry and mirror-maker2 (both off in the umbrella) default to namespace kafka too.
• Nothing in the umbrella installs a Trogdor coordinator. The URL now points next to Kafka, where the egress rule allows 8889.