[amuraru]

Description

Target Java 25 LTS in the repository's Java image builds while retaining Kafka 3.9.2 and ZooKeeper support.

• Build Kafka with Oracle JDK 25; update release metadata and rollout documentation.
• Build the JMX exporter with a digest-pinned Corretto 25 Maven image and Java 25 compiler settings. Install tar and gzip, which the new base image does not include.
• Align the Spring example's Maven builder, compiler release, and runtime on Java 25 instead of Java 21/27. Explicitly configure Lombok annotation processing, required with the newer JDK.
• Constrain Renovate to Java 25 image variants and Kafka 3.x.

Rollout prerequisite: GHCR currently has no Java 25 Kafka tags. Keep the published Java 21 image references in operator defaults, samples, benchmark manifests, and the vendored Cruise Control Compose configuration rather than introduce image-pull failures. Publish and validate a Java 25 Kafka image, then update those references and their digests together. The rebuilt JMX exporter requires Java 25 and needs a new image tag because the release workflow skips existing tags.

Validation

All image builds and runtime smoke checks below passed locally on Linux ARM64:

Command / check	Result
docker build --progress=plain -t koperator-java25-kafka:validation docker/kafka	Passed; Apache distribution signature verified, Oracle JDK 25.0.5.0.3 installed
docker build --progress=plain -t koperator-java25-jmx:validation docker/jmx_exporter	Passed, including upstream Maven tests
docker build --progress=plain -t koperator-java25-spring:validation docs/examples/springboot-kafka-avro	Passed; compiled with release 25, runtime Temurin 25
Kafka KRaft runtime smoke test with the freshly built images	Passed: broker startup, topic creation, produce/consume round-trip, and JMX metrics endpoint using the repository exporter configuration
Kafka authenticated runtime smoke test	Passed: SASL/PLAIN over TLS, topic creation, and produce/consume round-trip with certificate verification
Spring runtime smoke test	Passed: application started and HTTP endpoint responded with Kafka listener startup disabled
actionlint -shellcheck= .github/workflows/publish-kafka-docker.yml	Passed
docker run --rm -v "$PWD/renovate.json:/usr/src/app/renovate.json:ro" ghcr.io/renovatebot/renovate:latest renovate-config-validator --strict /usr/src/app/renovate.json	Passed
Renovate allowed/blocked version checks	Passed: Java 25 accepted, Java 21/26/27 and Kafka 4.x rejected
git diff --check	Passed

Unfiltered actionlint .github/workflows/publish-kafka-docker.yml reports eight existing SC2086 warnings; the same warnings reproduce on the base revision. No Go code or API types changed, so make check and code generation were not run. AMD64 builds, ZooKeeper-mode runtime integration, and full Kubernetes end-to-end tests were not run. Runtime smoke fixtures were local validation artifacts, not new repository test infrastructure.

Type of Change

• Bug Fix
• New Feature
• Breaking Change
• Refactor
• Documentation
• Other (please describe): Java 25 LTS build/runtime upgrade; deployment-image rollout remains a follow-up after publication.

Checklist

• I have read the contributing guidelines
• Existing issues have been referenced (where applicable)
• I have verified this change is not present in other open pull requests
• Functionality is documented
• All code style checks pass
• New code contribution is covered by automated tests
• All new and existing tests pass