Repository: elastic/cloud-on-k8s

Issue:
Kibana configuration could be incorrectly labeled with 'credentials=true'
```
❯ kc get secret  -l eck.k8s.elastic.co/credentials=true
NAME                                                     TYPE     DATA   AGE
investigate-es-elastic-user                              Opaque   1      13d
investigate-es-internal-users                            Opaque   5      13d
investigate-monitor-es-monitor-beat-es-mon-user          Opaque   1      13d
kibana-investigate-kb-config                             Opaque   2      13d
kibana-investigate-kibana-user                           Opaque   4      13d
kibana-investigate-monitor-es-monitor-beat-kb-mon-user   Opaque   1      13d
```

Note that `kb-config` is returned in this query. This contains encryption keys, and our [documentation](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/managed-credentials-eck#k8s-rotate-credentials) notes to rotate credentials you need to delete all secrets with `eck.k8s.elastic.co/credentials=true`. This seems dangerous.

Discussion:
@naemono: Fyi, it was initially added here: https://github.com/elastic/cloud-on-k8s/pull/2794/files#diff-f4d34e6c306c051ffb5e8ff436915bf439503e87e01a3a9415bf6fbeff1b41aa@barkbay: > Why is the kibana configuration labeled as 'credentials=true'?

Because it used to hold the password (now the access token) for ES.@naemono: After some testing, I'm unsure that this is an issue, as I deleted all of the secrets with this label in my test env, included kibana, and everything eventually recovered.@pebrc: @naemono did you have encrypted saved objects in your test installation? @naemono: @pebrc you're absolutely right. I didn't test that. thank you!@naemono: Was thinking about resolutions for this today and came up with some options:

1. We could simply remove the label from this Kibana secret, but the downside is that there are still credentials in this secret, so it wouldn't support rotation.
2. We could update our documentation to exclude this secret, but still there are credentials in the secret, so it wouldn't support rotation.
3. It feels like we should remove the ES credentials from this secret, and move it to a dedicated secret. Since Kibana supports both `ELASTICSEARCH_SERVICEACCOUNTTOKEN`, and `ELASTICSEARCH_USERNAME,ELASTICSEARCH_PASSWORD` as environmental variables, I thought we could just move them there instead. #8850 opened as a POC (not passing unit tests; not tested at all yet). I think I prefer this approach over any others here.
4. We could use an init container to pull in the token, or user/pass from a dedicated secret, and construct the `kibana.yml` programatically. 

Thoughts on these approaches appreciated.@pebrc: I think we should: 
* add a note to the rotating credentials documentation https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/managed-credentials-eck#k8s-rotate-credentials warning of the current behaviour
* remove the `credentials` label from the Kibana config secret for the upcoming release

Why is that sufficient?
1. if we have an Elasticsearch user or service account token generated by the association mechanism
    1.  the association mechanism creates a user secret `$KB_NAME-kibana-user` which also has the credentials label
    2.  rotating the credentials for that user can be achieve by deleting the user secret
    3. I do not see a benefit in the deleting the Kibana config file, only risk  

3. if we have a reference to an external ES cluster 
    1. then the credentials need to be rotated in the external system anyway and the secret containing them is managed by the user
    2. rotating the Kibana config would not have any benefit in this case either. 

Solution patch:
diff --git a/.buildkite/e2e/nightly-main-matrix.yaml b/.buildkite/e2e/nightly-main-matrix.yaml
index 62909b84e..e8d056ee1 100644
--- a/.buildkite/e2e/nightly-main-matrix.yaml
+++ b/.buildkite/e2e/nightly-main-matrix.yaml
@@ -21,14 +21,14 @@
   fixed:
     E2E_PROVIDER: kind
   mixed:
-    - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.29.14@sha256:8703bd94ee24e51b778d5556ae310c6c0fa67d761fae6379c8e0bb480e6fea29
     - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.30.13@sha256:397209b3d947d154f6641f2d0ce8d473732bd91c87d9575ade99049aa33cd648
-    - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.31.9@sha256:b94a3a6c06198d17f59cca8c6f486236fa05e2fb359cbd75dabbfc348a10b211
-    - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.32.5@sha256:e3b2327e3a5ab8c76f5ece68936e4cafaa82edf58486b769727ab0b3b97a5b0d
+    - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.31.12@sha256:0f5cc49c5e73c0c2bb6e2df56e7df189240d83cf94edfa30946482eb08ec57d2
+    - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.32.8@sha256:abd489f042d2b644e2d033f5c2d900bc707798d075e8186cb65e3f1367a9d5a1
+    - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.33.4@sha256:25a6018e48dfcaee478f4a59af81157a437f15e6e140bf103f85a2e7cd0cbbf2
     # The latest version of kind/k8s needs to be listed twice at the end of this list
     # as it's tested in both ipv4 and ipv6 mode.
-    - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.33.1@sha256:050072256b9a903bd914c0b2866828150cb229cea0efe5892e2b644d5dd3b34f
-    - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.33.1@sha256:050072256b9a903bd914c0b2866828150cb229cea0efe5892e2b644d5dd3b34f
+    - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a
+    - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a
       DEPLOYER_KIND_IP_FAMILY: ipv6
 
 - label: gke
diff --git a/.buildkite/e2e/release-branch-matrix.yaml b/.buildkite/e2e/release-branch-matrix.yaml
index 7c3982f84..3f6b8d5d2 100644
--- a/.buildkite/e2e/release-branch-matrix.yaml
+++ b/.buildkite/e2e/release-branch-matrix.yaml
@@ -32,14 +32,14 @@
   fixed:
     E2E_PROVIDER: kind
   mixed:
-    - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.29.14@sha256:8703bd94ee24e51b778d5556ae310c6c0fa67d761fae6379c8e0bb480e6fea29
     - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.30.13@sha256:397209b3d947d154f6641f2d0ce8d473732bd91c87d9575ade99049aa33cd648
-    - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.31.9@sha256:b94a3a6c06198d17f59cca8c6f486236fa05e2fb359cbd75dabbfc348a10b211
-    - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.32.5@sha256:e3b2327e3a5ab8c76f5ece68936e4cafaa82edf58486b769727ab0b3b97a5b0d
+    - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.31.12@sha256:0f5cc49c5e73c0c2bb6e2df56e7df189240d83cf94edfa30946482eb08ec57d2
+    - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.32.8@sha256:abd489f042d2b644e2d033f5c2d900bc707798d075e8186cb65e3f1367a9d5a1
+    - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.33.4@sha256:25a6018e48dfcaee478f4a59af81157a437f15e6e140bf103f85a2e7cd0cbbf2
     # The latest version of kind/k8s needs to be listed twice at the end of this list
     # as it's tested in both ipv4 and ipv6 mode.
-    - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.33.1@sha256:050072256b9a903bd914c0b2866828150cb229cea0efe5892e2b644d5dd3b34f
-    - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.33.1@sha256:050072256b9a903bd914c0b2866828150cb229cea0efe5892e2b644d5dd3b34f
+    - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a
+    - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a
       DEPLOYER_KIND_IP_FAMILY: ipv6
 
 - label: k3d
diff --git a/README.md b/README.md
index 855359035..22f472806 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,7 @@ Current features:
 
 Supported versions:
 
-*  Kubernetes 1.29-1.33
+*  Kubernetes 1.30-1.34
 *  OpenShift 4.15-4.19
 *  Elasticsearch, Kibana, APM Server: 7.17+, 8+, 9+
 *  Enterprise Search: 7.7+, 8+
diff --git a/VERSION b/VERSION
index e1f3bbde8..ae5ac2c2a 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-3.2.0-SNAPSHOT
+3.3.0-SNAPSHOT
diff --git a/deploy/eck-operator/Chart.yaml b/deploy/eck-operator/Chart.yaml
index a6785ee7c..32cd9ce63 100644
--- a/deploy/eck-operator/Chart.yaml
+++ b/deploy/eck-operator/Chart.yaml
@@ -10,9 +10,9 @@ home: https://github.com/elastic/cloud-on-k8s
 
 type: application
 
-version: 3.2.0-SNAPSHOT
+version: 3.3.0-SNAPSHOT
 
-appVersion: 3.2.0-SNAPSHOT
+appVersion: 3.3.0-SNAPSHOT
 
 kubeVersion: ">=1.21.0-0"
 
@@ -32,5 +32,5 @@ maintainers:
 
 dependencies:
   - name: eck-operator-crds
-    version: 3.2.0-SNAPSHOT
+    version: 3.3.0-SNAPSHOT
     condition: installCRDs
diff --git a/deploy/eck-operator/charts/eck-operator-crds/Chart.yaml b/deploy/eck-operator/charts/eck-operator-crds/Chart.yaml
index 9d6d7c411..59a45a8ca 100644
--- a/deploy/eck-operator/charts/eck-operator-crds/Chart.yaml
+++ b/deploy/eck-operator/charts/eck-operator-crds/Chart.yaml
@@ -8,9 +8,9 @@ description: ECK operator Custom Resource Definitions
 
 type: application
 
-version: 3.2.0-SNAPSHOT
+version: 3.3.0-SNAPSHOT
 
-appVersion: 3.2.0-SNAPSHOT
+appVersion: 3.3.0-SNAPSHOT
 
 home: https://github.com/elastic/cloud-on-k8s
 
diff --git a/deploy/eck-stack/Chart.yaml b/deploy/eck-stack/Chart.yaml
index 3399d02db..7b9d735f0 100644
--- a/deploy/eck-stack/Chart.yaml
+++ b/deploy/eck-stack/Chart.yaml
@@ -3,30 +3,30 @@ name: eck-stack
 description: Elastic Stack managed by the ECK Operator
 kubeVersion: ">= 1.21.0-0"
 type: application
-version: 0.17.0-SNAPSHOT
+version: 0.18.0-SNAPSHOT
 
 dependencies:
   - name: eck-elasticsearch
     condition: eck-elasticsearch.enabled
-    version: "0.17.0-SNAPSHOT"
+    version: "0.18.0-SNAPSHOT"
   - name: eck-kibana
     condition: eck-kibana.enabled
-    version: "0.17.0-SNAPSHOT"
+    version: "0.18.0-SNAPSHOT"
   - name: eck-agent
     condition: eck-agent.enabled
-    version: "0.17.0-SNAPSHOT"
+    version: "0.18.0-SNAPSHOT"
   - name: eck-fleet-server
     condition: eck-fleet-server.enabled
-    version: "0.17.0-SNAPSHOT"
+    version: "0.18.0-SNAPSHOT"
   - name: eck-beats
     condition: eck-beats.enabled
-    version: "0.17.0-SNAPSHOT"
+    version: "0.18.0-SNAPSHOT"
   - name: eck-logstash
     condition: eck-logstash.enabled
-    version: "0.17.0-SNAPSHOT"
+    version: "0.18.0-SNAPSHOT"
   - name: eck-apm-server
     condition: eck-apm-server.enabled
-    version: "0.17.0-SNAPSHOT"
+    version: "0.18.0-SNAPSHOT"
   - name: eck-enterprise-search
     condition: eck-enterprise-search.enabled
-    version: "0.17.0-SNAPSHOT"
+    version: "0.18.0-SNAPSHOT"
diff --git a/deploy/eck-stack/charts/eck-agent/Chart.yaml b/deploy/eck-stack/charts/eck-agent/Chart.yaml
index a0170ee3d..8fbeb45e5 100644
--- a/deploy/eck-stack/charts/eck-agent/Chart.yaml
+++ b/deploy/eck-stack/charts/eck-agent/Chart.yaml
@@ -3,7 +3,7 @@ name: eck-agent
 description: Elastic Agent managed by the ECK operator
 kubeVersion: ">= 1.21.0-0"
 type: application
-version: 0.17.0-SNAPSHOT
+version: 0.18.0-SNAPSHOT
 sources:
   - https://github.com/elastic/cloud-on-k8s
   - https://github.com/elastic/elastic-agent
diff --git a/deploy/eck-stack/charts/eck-agent/examples/fleet-agents.yaml b/deploy/eck-stack/charts/eck-agent/examples/fleet-agents.yaml
index a998e545d..9a42f85bf 100644
--- a/deploy/eck-stack/charts/eck-agent/examples/fleet-agents.yaml
+++ b/deploy/eck-stack/charts/eck-agent/examples/fleet-agents.yaml
@@ -1,7 +1,7 @@
 # The following example should only be used in conjunction with the 'eck-fleet-server' Helm Chart,
 # and shows how the Agents can be deployed as a daemonset, and controlled by Fleet Server.
 #
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 
 # This must match the name of an Agent policy.
 policyID: eck-agent
diff --git a/deploy/eck-stack/charts/eck-agent/examples/system-integration.yaml b/deploy/eck-stack/charts/eck-agent/examples/system-integration.yaml
index a2b3b7f1a..2e5ddb4a5 100644
--- a/deploy/eck-stack/charts/eck-agent/examples/system-integration.yaml
+++ b/deploy/eck-stack/charts/eck-agent/examples/system-integration.yaml
@@ -1,7 +1,7 @@
 # The following example should only be used in Agent "standalone" mode,
 # and should not be used when Agent is used with Fleet Server.
 #
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 elasticsearchRefs:
 - name: eck-elasticsearch
 daemonSet:
@@ -32,7 +32,7 @@ config:
     meta:
       package:
         name: system
-        version: 9.2.0-SNAPSHOT
+        version: 9.3.0-SNAPSHOT
     data_stream:
       namespace: default
     streams:
diff --git a/deploy/eck-stack/charts/eck-agent/values.yaml b/deploy/eck-stack/charts/eck-agent/values.yaml
index 8a84d00fd..693a380b7 100644
--- a/deploy/eck-stack/charts/eck-agent/values.yaml
+++ b/deploy/eck-stack/charts/eck-agent/values.yaml
@@ -18,7 +18,7 @@
 
 # Version of Elastic Agent.
 #
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 
 # Labels that will be applied to Elastic Agent.
 #
@@ -30,7 +30,7 @@ annotations: {}
 
 # Elastic Agent image to deploy.
 #
-# image: docker.elastic.co/beats/elastic-agent:9.2.0-SNAPSHOT
+# image: docker.elastic.co/beats/elastic-agent:9.3.0-SNAPSHOT
 
 # ** Deprecation Notice **
 # The previous versions of this Helm Chart simply used the `spec` field here
diff --git a/deploy/eck-stack/charts/eck-apm-server/Chart.yaml b/deploy/eck-stack/charts/eck-apm-server/Chart.yaml
index 8053e0dba..832770a94 100644
--- a/deploy/eck-stack/charts/eck-apm-server/Chart.yaml
+++ b/deploy/eck-stack/charts/eck-apm-server/Chart.yaml
@@ -3,7 +3,7 @@ name: eck-apm-server
 description: Elastic APM Server managed by the ECK operator
 kubeVersion: ">= 1.21.0-0"
 type: application
-version: 0.17.0-SNAPSHOT
+version: 0.18.0-SNAPSHOT
 sources:
   - https://github.com/elastic/cloud-on-k8s
   - https://github.com/elastic/apm-server
diff --git a/deploy/eck-stack/charts/eck-apm-server/examples/jaeger-with-http-configuration.yaml b/deploy/eck-stack/charts/eck-apm-server/examples/jaeger-with-http-configuration.yaml
index ac7749a35..5f2a940f7 100644
--- a/deploy/eck-stack/charts/eck-apm-server/examples/jaeger-with-http-configuration.yaml
+++ b/deploy/eck-stack/charts/eck-apm-server/examples/jaeger-with-http-configuration.yaml
@@ -1,7 +1,7 @@
 ---
 # Version of APM Server.
 #
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 
 # Count of APM Server replicas to create.
 #
diff --git a/deploy/eck-stack/charts/eck-apm-server/values.yaml b/deploy/eck-stack/charts/eck-apm-server/values.yaml
index 450b8c2c8..ffa812c90 100644
--- a/deploy/eck-stack/charts/eck-apm-server/values.yaml
+++ b/deploy/eck-stack/charts/eck-apm-server/values.yaml
@@ -18,7 +18,7 @@
 
 # Version of APM Server.
 #
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 
 # APM Server Docker image to deploy
 #
diff --git a/deploy/eck-stack/charts/eck-beats/Chart.yaml b/deploy/eck-stack/charts/eck-beats/Chart.yaml
index 8e923f7fe..cecccea82 100644
--- a/deploy/eck-stack/charts/eck-beats/Chart.yaml
+++ b/deploy/eck-stack/charts/eck-beats/Chart.yaml
@@ -4,7 +4,7 @@ description: Elastic Beats managed by the ECK operator
 # Requirement comes from minimum version supported for eck-operator (https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s_supported_versions.html)
 kubeVersion: ">= 1.20.0-0"
 type: application
-version: 0.17.0-SNAPSHOT
+version: 0.18.0-SNAPSHOT
 sources:
   - https://github.com/elastic/cloud-on-k8s
   - https://github.com/elastic/beats
diff --git a/deploy/eck-stack/charts/eck-beats/examples/auditbeat_hosts.yaml b/deploy/eck-stack/charts/eck-beats/examples/auditbeat_hosts.yaml
index ea67b49bf..459d51c6e 100644
--- a/deploy/eck-stack/charts/eck-beats/examples/auditbeat_hosts.yaml
+++ b/deploy/eck-stack/charts/eck-beats/examples/auditbeat_hosts.yaml
@@ -1,5 +1,5 @@
 name: auditbeat
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 type: auditbeat
 elasticsearchRef:
   name: eck-elasticsearch
diff --git a/deploy/eck-stack/charts/eck-beats/examples/filebeat_no_autodiscover.yaml b/deploy/eck-stack/charts/eck-beats/examples/filebeat_no_autodiscover.yaml
index 2f9af7f28..049a39d44 100644
--- a/deploy/eck-stack/charts/eck-beats/examples/filebeat_no_autodiscover.yaml
+++ b/deploy/eck-stack/charts/eck-beats/examples/filebeat_no_autodiscover.yaml
@@ -1,5 +1,5 @@
 name: filebeat
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 type: filebeat
 elasticsearchRef:
   name: eck-elasticsearch
diff --git a/deploy/eck-stack/charts/eck-beats/examples/heartbeat_es_kb_health.yaml b/deploy/eck-stack/charts/eck-beats/examples/heartbeat_es_kb_health.yaml
index 08eb6bbe1..553237e7a 100644
--- a/deploy/eck-stack/charts/eck-beats/examples/heartbeat_es_kb_health.yaml
+++ b/deploy/eck-stack/charts/eck-beats/examples/heartbeat_es_kb_health.yaml
@@ -1,5 +1,5 @@
 name: heartbeat
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 type: heartbeat
 elasticsearchRef:
   name: eck-elasticsearch
diff --git a/deploy/eck-stack/charts/eck-beats/examples/metricbeat_hosts.yaml b/deploy/eck-stack/charts/eck-beats/examples/metricbeat_hosts.yaml
index 7747ff1da..4a9ac4bdb 100644
--- a/deploy/eck-stack/charts/eck-beats/examples/metricbeat_hosts.yaml
+++ b/deploy/eck-stack/charts/eck-beats/examples/metricbeat_hosts.yaml
@@ -1,6 +1,6 @@
 name: metricbeat
 type: metricbeat
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 elasticsearchRef:
   name: eck-elasticsearch
 kibanaRef:
diff --git a/deploy/eck-stack/charts/eck-beats/examples/packetbeat_dns_http.yaml b/deploy/eck-stack/charts/eck-beats/examples/packetbeat_dns_http.yaml
index 8e5ed2369..8a6425bf9 100644
--- a/deploy/eck-stack/charts/eck-beats/examples/packetbeat_dns_http.yaml
+++ b/deploy/eck-stack/charts/eck-beats/examples/packetbeat_dns_http.yaml
@@ -1,6 +1,6 @@
 name: packetbeat
 type: packetbeat
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 elasticsearchRef:
   name: eck-elasticsearch
 kibanaRef:
diff --git a/deploy/eck-stack/charts/eck-beats/values.yaml b/deploy/eck-stack/charts/eck-beats/values.yaml
index 7a49b62a7..7789a5a11 100644
--- a/deploy/eck-stack/charts/eck-beats/values.yaml
+++ b/deploy/eck-stack/charts/eck-beats/values.yaml
@@ -18,7 +18,7 @@
 
 # Version of Elastic Beats.
 #
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 
 # Labels that will be applied to Elastic Beats.
 #
@@ -46,7 +46,7 @@ type: ""
 
 # Beats image to deploy.
 #
-# image: docker.elastic.co/beats/metricbeat:9.2.0-SNAPSHOT
+# image: docker.elastic.co/beats/metricbeat:9.3.0-SNAPSHOT
 
 # Referenced resources are below and depending on the setup, at least elasticsearchRef is required for a functional Beat.
 # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-beat-configuration.html#k8s-beat-connect-es
diff --git a/deploy/eck-stack/charts/eck-elasticsearch/Chart.yaml b/deploy/eck-stack/charts/eck-elasticsearch/Chart.yaml
index f5b484395..882b74d5c 100644
--- a/deploy/eck-stack/charts/eck-elasticsearch/Chart.yaml
+++ b/deploy/eck-stack/charts/eck-elasticsearch/Chart.yaml
@@ -3,7 +3,7 @@ name: eck-elasticsearch
 description: Elasticsearch managed by the ECK operator
 kubeVersion: ">= 1.21.0-0"
 type: application
-version: 0.17.0-SNAPSHOT
+version: 0.18.0-SNAPSHOT
 sources:
   - https://github.com/elastic/cloud-on-k8s
   - https://github.com/elastic/elasticsearch/
diff --git a/deploy/eck-stack/charts/eck-elasticsearch/values.yaml b/deploy/eck-stack/charts/eck-elasticsearch/values.yaml
index 79ab339bc..322dded4d 100644
--- a/deploy/eck-stack/charts/eck-elasticsearch/values.yaml
+++ b/deploy/eck-stack/charts/eck-elasticsearch/values.yaml
@@ -18,7 +18,7 @@
 
 # Version of Elasticsearch.
 #
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 
 # Elasticsearch Docker image to deploy
 #
diff --git a/deploy/eck-stack/charts/eck-enterprise-search/Chart.yaml b/deploy/eck-stack/charts/eck-enterprise-search/Chart.yaml
index abec97e3d..9b04f4b01 100644
--- a/deploy/eck-stack/charts/eck-enterprise-search/Chart.yaml
+++ b/deploy/eck-stack/charts/eck-enterprise-search/Chart.yaml
@@ -3,7 +3,7 @@ name: eck-enterprise-search
 description: Elastic Enterprise Search managed by the ECK operator
 kubeVersion: ">= 1.21.0-0"
 type: application
-version: 0.17.0-SNAPSHOT
+version: 0.18.0-SNAPSHOT
 sources:
   - https://github.com/elastic/cloud-on-k8s
 icon: https://github.com/elastic/ent-search/blob/main/public/app-search-favicon-196x196.png
diff --git a/deploy/eck-stack/charts/eck-fleet-server/Chart.yaml b/deploy/eck-stack/charts/eck-fleet-server/Chart.yaml
index 3f01b561b..24c1ce31f 100644
--- a/deploy/eck-stack/charts/eck-fleet-server/Chart.yaml
+++ b/deploy/eck-stack/charts/eck-fleet-server/Chart.yaml
@@ -3,7 +3,7 @@ name: eck-fleet-server
 description: Elastic Fleet Server as an Agent managed by the ECK operator
 kubeVersion: ">= 1.21.0-0"
 type: application
-version: 0.17.0-SNAPSHOT
+version: 0.18.0-SNAPSHOT
 sources:
   - https://github.com/elastic/cloud-on-k8s
   - https://github.com/elastic/elastic-agent
diff --git a/deploy/eck-stack/charts/eck-fleet-server/examples/fleet-server.yaml b/deploy/eck-stack/charts/eck-fleet-server/examples/fleet-server.yaml
index 04e9e7b12..2414d0a21 100644
--- a/deploy/eck-stack/charts/eck-fleet-server/examples/fleet-server.yaml
+++ b/deploy/eck-stack/charts/eck-fleet-server/examples/fleet-server.yaml
@@ -1,4 +1,4 @@
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 deployment:
   replicas: 1
   podTemplate:
diff --git a/deploy/eck-stack/charts/eck-fleet-server/values.yaml b/deploy/eck-stack/charts/eck-fleet-server/values.yaml
index 23c3ce09c..116b07d65 100644
--- a/deploy/eck-stack/charts/eck-fleet-server/values.yaml
+++ b/deploy/eck-stack/charts/eck-fleet-server/values.yaml
@@ -18,7 +18,7 @@
 
 # Version of Elastic Fleet Server.
 #
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 
 # Labels that will be applied to Elastic Fleet Server.
 #
@@ -30,7 +30,7 @@ annotations: {}
 
 # Elastic Fleet Server Agent image to deploy.
 #
-# image: docker.elastic.co/beats/elastic-agent:9.2.0-SNAPSHOT
+# image: docker.elastic.co/beats/elastic-agent:9.3.0-SNAPSHOT
 
 # ** Deprecation Notice **
 # The previous versions of this Helm Chart simply used the `spec` field here
diff --git a/deploy/eck-stack/charts/eck-kibana/Chart.yaml b/deploy/eck-stack/charts/eck-kibana/Chart.yaml
index b556b2fd6..5bb9001d2 100644
--- a/deploy/eck-stack/charts/eck-kibana/Chart.yaml
+++ b/deploy/eck-stack/charts/eck-kibana/Chart.yaml
@@ -3,7 +3,7 @@ name: eck-kibana
 description: Kibana managed by the ECK operator
 kubeVersion: ">= 1.21.0-0"
 type: application
-version: 0.17.0-SNAPSHOT
+version: 0.18.0-SNAPSHOT
 sources:
   - https://github.com/elastic/cloud-on-k8s
   - https://github.com/elastic/kibana
diff --git a/deploy/eck-stack/charts/eck-kibana/examples/http-configuration.yaml b/deploy/eck-stack/charts/eck-kibana/examples/http-configuration.yaml
index 7d0e1c243..32e02ef27 100644
--- a/deploy/eck-stack/charts/eck-kibana/examples/http-configuration.yaml
+++ b/deploy/eck-stack/charts/eck-kibana/examples/http-configuration.yaml
@@ -1,7 +1,7 @@
 ---
 # Version of Kibana.
 #
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 
 # Labels that will be applied to Kibana.
 #
diff --git a/deploy/eck-stack/charts/eck-kibana/values.yaml b/deploy/eck-stack/charts/eck-kibana/values.yaml
index 663d95b75..01fb7096e 100644
--- a/deploy/eck-stack/charts/eck-kibana/values.yaml
+++ b/deploy/eck-stack/charts/eck-kibana/values.yaml
@@ -18,11 +18,11 @@
 
 # Version of Kibana.
 #
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 
 # Kibana Docker image to deploy
 #
-# image: docker.elastic.co/kibana/kibana:9.2.0-SNAPSHOT
+# image: docker.elastic.co/kibana/kibana:9.3.0-SNAPSHOT
 
 # Labels that will be applied to Kibana.
 #
diff --git a/deploy/eck-stack/charts/eck-logstash/Chart.yaml b/deploy/eck-stack/charts/eck-logstash/Chart.yaml
index 53d4026f5..4222c0441 100644
--- a/deploy/eck-stack/charts/eck-logstash/Chart.yaml
+++ b/deploy/eck-stack/charts/eck-logstash/Chart.yaml
@@ -3,7 +3,7 @@ name: eck-logstash
 description: Logstash managed by the ECK operator
 kubeVersion: ">= 1.21.0-0"
 type: application
-version: 0.17.0-SNAPSHOT
+version: 0.18.0-SNAPSHOT
 sources:
   - https://github.com/elastic/cloud-on-k8s
   - https://github.com/elastic/logstash
diff --git a/deploy/eck-stack/charts/eck-logstash/examples/basic-eck.yaml b/deploy/eck-stack/charts/eck-logstash/examples/basic-eck.yaml
index 6b7e5c6d2..626058599 100644
--- a/deploy/eck-stack/charts/eck-logstash/examples/basic-eck.yaml
+++ b/deploy/eck-stack/charts/eck-logstash/examples/basic-eck.yaml
@@ -1,6 +1,6 @@
 ---
 # values corresponding to config/recipes/logstash/logstash-eck.yaml
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 
 elasticsearchRefs:
   - clusterName: eck
diff --git a/deploy/eck-stack/charts/eck-logstash/examples/es-role.yaml b/deploy/eck-stack/charts/eck-logstash/examples/es-role.yaml
index 7ae162e61..03539c105 100644
--- a/deploy/eck-stack/charts/eck-logstash/examples/es-role.yaml
+++ b/deploy/eck-stack/charts/eck-logstash/examples/es-role.yaml
@@ -1,6 +1,6 @@
 ---
 # values corresponding to config/recipes/logstash/logstash-es-role.yaml
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 
 elasticsearchRefs:
   - clusterName: eck
diff --git a/deploy/eck-stack/charts/eck-logstash/examples/monitored.yaml b/deploy/eck-stack/charts/eck-logstash/examples/monitored.yaml
index 389e76221..13fb54cd7 100644
--- a/deploy/eck-stack/charts/eck-logstash/examples/monitored.yaml
+++ b/deploy/eck-stack/charts/eck-logstash/examples/monitored.yaml
@@ -1,6 +1,6 @@
 ---
 # values corresponding to config/recipes/logstash/logstash-monitored.yaml
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 
 monitoring:
   metrics:
diff --git a/deploy/eck-stack/charts/eck-logstash/examples/multi.yaml b/deploy/eck-stack/charts/eck-logstash/examples/multi.yaml
index e47c72152..7b230630a 100644
--- a/deploy/eck-stack/charts/eck-logstash/examples/multi.yaml
+++ b/deploy/eck-stack/charts/eck-logstash/examples/multi.yaml
@@ -1,6 +1,6 @@
 ---
 # values corresponding to config/recipes/logstash/logstash-multi.yaml
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 
 pipelines:
   - pipeline.id: main
diff --git a/deploy/eck-stack/charts/eck-logstash/examples/volumes.yaml b/deploy/eck-stack/charts/eck-logstash/examples/volumes.yaml
index 7342e2961..84cb1e409 100644
--- a/deploy/eck-stack/charts/eck-logstash/examples/volumes.yaml
+++ b/deploy/eck-stack/charts/eck-logstash/examples/volumes.yaml
@@ -1,6 +1,6 @@
 ---
 # values corresponding to config/recipes/logstash/logstash-volumes.yaml
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 
 config:
   log.level: info
diff --git a/deploy/eck-stack/charts/eck-logstash/values.yaml b/deploy/eck-stack/charts/eck-logstash/values.yaml
index 239e1d519..0bec27012 100644
--- a/deploy/eck-stack/charts/eck-logstash/values.yaml
+++ b/deploy/eck-stack/charts/eck-logstash/values.yaml
@@ -18,7 +18,7 @@
 
 # Version of Logstash.
 #
-version: 9.2.0-SNAPSHOT
+version: 9.3.0-SNAPSHOT
 
 # Logstash Docker image to deploy
 #
diff --git a/deploy/eck-stack/examples/beats/metricbeat_hosts.yaml b/deploy/eck-stack/examples/beats/metricbeat_hosts.yaml
index 426dd7b47..e7fd4a444 100644
--- a/deploy/eck-stack/examples/beats/metricbeat_hosts.yaml
+++ b/deploy/eck-stack/examples/beats/metricbeat_hosts.yaml
@@ -7,7 +7,7 @@ eck-elasticsearch:
 
   # Version of Elasticsearch.
   #
-  version: 9.2.0-SNAPSHOT
+  version: 9.3.0-SNAPSHOT
 
   nodeSets:
   - name: default
@@ -41,7 +41,7 @@ eck-kibana:
   
   # Version of Kibana.
   #
-  version: 9.2.0-SNAPSHOT
+  version: 9.3.0-SNAPSHOT
   
   spec:
     # Count of Kibana replicas to create.
@@ -57,7 +57,7 @@ eck-beats:
   enabled: true
   name: metricbeat
   type: metricbeat
-  version: 9.2.0-SNAPSHOT
+  version: 9.3.0-SNAPSHOT
   elasticsearchRef:
     name: quickstart
   kibanaRef:
diff --git a/deploy/eck-stack/examples/custom-elasticsearch-kibana.yaml b/deploy/eck-stack/examples/custom-elasticsearch-kibana.yaml
index 6cb7d2ab5..0c58c2bc2 100644
--- a/deploy/eck-stack/examples/custom-elasticsearch-kibana.yaml
+++ b/deploy/eck-stack/examples/custom-elasticsearch-kibana.yaml
@@ -6,7 +6,7 @@ eck-elasticsearch:
 
   # Version of Elasticsearch.
   #
-  version: 9.2.0-SNAPSHOT
+  version: 9.3.0-SNAPSHOT
 
   nodeSets:
   - name: default
@@ -38,7 +38,7 @@ eck-kibana:
   
   # Version of Kibana.
   #
-  version: 9.2.0-SNAPSHOT
+  version: 9.3.0-SNAPSHOT
   
   spec:
     # Count of Kibana replicas to create.
diff --git a/hack/deployer/config/plans.yml b/hack/deployer/config/plans.yml
index 0865f3ae2..c74eb7d64 100644
--- a/hack/deployer/config/plans.yml
+++ b/hack/deployer/config/plans.yml
@@ -3,7 +3,7 @@ plans:
   operation: create
   clusterName: ci
   provider: gke
-  kubernetesVersion: 1.33
+  kubernetesVersion: 1.34
   machineType: n1-standard-8
   serviceAccount: true
   enforceSecurityPolicies: true
@@ -18,7 +18,7 @@ plans:
   operation: create
   clusterName: ci-autopilot
   provider: gke
-  kubernetesVersion: 1.33
+  kubernetesVersion: 1.34
   serviceAccount: true
   enforceSecurityPolicies: true
   # this is disabled in autopilot: container provisioner is privileged; not allowed in Autopilot
@@ -31,7 +31,7 @@ plans:
   operation: create
   clusterName: dev
   provider: gke
-  kubernetesVersion: 1.33
+  kubernetesVersion: 1.34
   machineType: n1-standard-8
   serviceAccount: false
   enforceSecurityPolicies: true
@@ -58,7 +58,7 @@ plans:
   operation: create
   clusterName: dev-autopilot
   provider: gke
-  kubernetesVersion: 1.33
+  kubernetesVersion: 1.34
   serviceAccount: false
   enforceSecurityPolicies: true
   gke:
@@ -69,7 +69,7 @@ plans:
   operation: create
   clusterName: ci
   provider: aks
-  kubernetesVersion: 1.32.4
+  kubernetesVersion: 1.33.3
   machineType: Standard_D8s_v3
   serviceAccount: true
   enforceSecurityPolicies: true
@@ -82,7 +82,7 @@ plans:
   operation: create
   clusterName: dev
   provider: aks
-  kubernetesVersion: 1.32.4
+  kubernetesVersion: 1.33.3
   machineType: Standard_D8s_v3
   serviceAccount: false
   enforceSecurityPolicies: true
@@ -93,7 +93,7 @@ plans:
 - id: ocp-ci
   operation: create
   clusterName: ci
-  clientVersion: 4.19.2
+  clientVersion: 4.19.14
   provider: ocp
   machineType: n1-standard-8
   serviceAccount: true
@@ -103,7 +103,7 @@ plans:
 - id: ocp-dev
   operation: create
   clusterName: dev
-  clientVersion: 4.19.2
+  clientVersion: 4.19.14
   provider: ocp
   machineType: n1-standard-8
   serviceAccount: true
@@ -117,7 +117,7 @@ plans:
   machineType: c5d.2xlarge
   serviceAccount: false
   enforceSecurityPolicies: true
-  kubernetesVersion: 1.33
+  kubernetesVersion: 1.34
   diskSetup: kubectl apply -f hack/deployer/config/local-disks/ssd-provisioner.yaml
   eks:
     region: ap-northeast-3
@@ -130,7 +130,7 @@ plans:
   machineType: m6gd.2xlarge
   serviceAccount: false
   enforceSecurityPolicies: true
-  kubernetesVersion: 1.33
+  kubernetesVersion: 1.34
   diskSetup: kubectl apply -f hack/deployer/config/local-disks/ssd-provisioner.yaml
   eks:
     region: eu-west-1
@@ -142,7 +142,7 @@ plans:
   provider: eks
   machineType: c5d.2xlarge
   serviceAccount: false
-  kubernetesVersion: 1.33
+  kubernetesVersion: 1.34
   diskSetup: kubectl apply -f hack/deployer/config/local-disks/ssd-provisioner.yaml
   enforceSecurityPolicies: true
   eks:
@@ -152,38 +152,38 @@ plans:
 - id: kind-dev
   operation: create
   clusterName: eck
-  clientVersion: 0.29.0
+  clientVersion: 0.30.0
   provider: kind
-  kubernetesVersion: 1.31.1
+  kubernetesVersion: 1.34.0
   enforceSecurityPolicies: true
   kind:
     nodeCount: 3
-    nodeImage: kindest/node:v1.33.1@sha256:050072256b9a903bd914c0b2866828150cb229cea0efe5892e2b644d5dd3b34f
+    nodeImage: kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a
     ipFamily: ipv4
 - id: kind-ci
   operation: create
   clusterName: kind-ci
-  clientVersion: 0.29.0
+  clientVersion: 0.30.0
   provider: kind
-  kubernetesVersion: 1.33.1
+  kubernetesVersion: 1.34.0
   enforceSecurityPolicies: true
   kind:
     nodeCount: 3
-    nodeImage: kindest/node:v1.33.1@sha256:050072256b9a903bd914c0b2866828150cb229cea0efe5892e2b644d5dd3b34f
+    nodeImage: kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a
     ipFamily: ipv4
 - id: k3d-dev
   operation: create
   clusterName: eck
   provider: k3d
-  kubernetesVersion: 1.33.3
+  kubernetesVersion: 1.34.1
   k3d:
     clientImage: ghcr.io/k3d-io/k3d:5.8.3
-    nodeImage: rancher/k3s:v1.33.3-k3s1
+    nodeImage: rancher/k3s:v1.34.1+k3s1
 - id: k3d-ci
   operation: create
   clusterName: k3d-ci
   provider: k3d
-  kubernetesVersion: 1.33.3
+  kubernetesVersion: 1.34.1
   k3d:
     clientImage: ghcr.io/k3d-io/k3d:5.8.3
-    nodeImage: rancher/k3s:v1.33.3-k3s1
+    nodeImage: rancher/k3s:v1.34.1+k3s1
diff --git a/hack/operatorhub/config.yaml b/hack/operatorhub/config.yaml
index 41d34a1ce..267747860 100644
--- a/hack/operatorhub/config.yaml
+++ b/hack/operatorhub/config.yaml
@@ -1,6 +1,6 @@
-newVersion: 3.2.0-SNAPSHOT
-prevVersion: 3.1.0
-stackVersion: 9.2.0-SNAPSHOT
+newVersion: 3.3.0-SNAPSHOT
+prevVersion: 3.2.0
+stackVersion: 9.3.0-SNAPSHOT
 crds:
   - name: elasticsearches.elasticsearch.k8s.elastic.co
     displayName: Elasticsearch Cluster
diff --git a/hack/operatorhub/templates/csv.tpl b/hack/operatorhub/templates/csv.tpl
index 9286c97da..321d06b5c 100644
--- a/hack/operatorhub/templates/csv.tpl
+++ b/hack/operatorhub/templates/csv.tpl
@@ -284,7 +284,7 @@ spec:
     Supported versions:
 
 
-    * Kubernetes 1.29-1.33
+    * Kubernetes 1.30-1.34
 
     * OpenShift 4.15-4.19
 
diff --git a/pkg/controller/agent/pod.go b/pkg/controller/agent/pod.go
index 81025f8b6..9ee674e73 100644
--- a/pkg/controller/agent/pod.go
+++ b/pkg/controller/agent/pod.go
@@ -148,6 +148,8 @@ func buildPodTemplate(params Params, fleetCerts *certificates.CertificatesSecret
 		if builder, err = amendBuilderForFleetMode(params, fleetCerts, fleetToken, builder, configHash); err != nil {
 			return corev1.PodTemplateSpec{}, err
 		}
+		// Point agent to static config file mounted from a secret to /etc/agent/elastic-agent.yml
+		builder = builder.WithArgs("-e", "-c", path.Join(ConfigMountPath, ConfigFileName))
 	} else if spec.StandaloneModeEnabled() {
 		// cleanup secret used in Fleet mode
 		if err := cleanupEnvVarsSecret(params); err != nil {
@@ -156,6 +158,8 @@ func buildPodTemplate(params Params, fleetCerts *certificates.CertificatesSecret
 
 		builder = builder.
 			WithResources(defaultResources).
+			WithEnv(corev1.EnvVar{Name: "STATE_PATH", Value: DataMountPath}).
+			// Point agent to static config file mounted from a secret to /etc/agent/elastic-agent.yml
 			WithArgs("-e", "-c", path.Join(ConfigMountPath, ConfigFileName))
 	}
 
@@ -193,15 +197,6 @@ func buildPodTemplate(params Params, fleetCerts *certificates.CertificatesSecret
 	return builder.PodTemplate, nil
 }
 
-func fleetConfigPath(v version.Version) string {
-	if v.LT(agentv1alpha1.FleetAdvancedConfigMinVersion) {
-		// default to the in-container config directory for older versions of Elastic Agent
-		// that still try to rewrite the config file in Fleet mode during enrollment.
-		return "/usr/share/elastic-agent"
-	}
-	return ConfigMountPath
-}
-
 func amendBuilderForFleetMode(params Params, fleetCerts *certificates.CertificatesSecret, fleetToken EnrollmentAPIKey, builder *defaults.PodTemplateBuilder, configHash hash.Hash) (*defaults.PodTemplateBuilder, error) {
 	esAssociation, err := getRelatedEsAssoc(params)
 	if err != nil {
@@ -241,7 +236,10 @@ func amendBuilderForFleetMode(params Params, fleetCerts *certificates.Certificat
 
 	builder = builder.
 		WithResources(defaultFleetResources).
-		WithEnv(corev1.EnvVar{Name: "CONFIG_PATH", Value: fleetConfigPath(params.AgentVersion)})
+		WithEnv(
+			corev1.EnvVar{Name: "STATE_PATH", Value: DataMountPath},
+			corev1.EnvVar{Name: "CONFIG_PATH", Value: DataMountPath},
+		)
 
 	return builder, nil
 }
@@ -452,7 +450,7 @@ if [[ -f %[1]s ]]; then
     %[5]s
   fi
 fi
-/usr/bin/tini -- /usr/local/bin/docker-entrypoint -e
+/usr/bin/tini -- /usr/local/bin/docker-entrypoint -e "$@"
 `, caPath, ubiSharedCAPath, ubiUpdateCmd, debianSharedCAPath, debianUpdateCmd)
 }
 
diff --git a/pkg/controller/agent/reconcile.go b/pkg/controller/agent/reconcile.go
index 2ac10bf8f..dee3162b2 100644
--- a/pkg/controller/agent/reconcile.go
+++ b/pkg/controller/agent/reconcile.go
@@ -98,7 +98,6 @@ func reconcilePodVehicle(params Params, podTemplate corev1.PodTemplateSpec) (*re
 		agent:       params.Agent,
 		podTemplate: podTemplate,
 	})
-
 	if err != nil {
 		return results.WithError(err), params.Status
 	}
diff --git a/pkg/controller/kibana/config_reconcile.go b/pkg/controller/kibana/config_reconcile.go
index 4e272b665..8a0f01853 100644
--- a/pkg/controller/kibana/config_reconcile.go
+++ b/pkg/controller/kibana/config_reconcile.go
@@ -16,7 +16,6 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 
 	kbv1 "github.com/elastic/cloud-on-k8s/v3/pkg/apis/kibana/v1"
-	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/labels"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/metadata"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/reconciler"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/tracing"
@@ -62,7 +61,7 @@ func ReconcileConfigSecret(
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace:   kb.Namespace,
 			Name:        kbv1.ConfigSecret(kb.Name),
-			Labels:      labels.AddCredentialsLabel(maps.Clone(meta.Labels)),
+			Labels:      maps.Clone(meta.Labels),
 			Annotations: meta.Annotations,
 		},
 		Data: data,



Test patch:
diff --git a/deploy/eck-operator/templates/tests/statefulset_test.yaml b/deploy/eck-operator/templates/tests/statefulset_test.yaml
index 3e42405b4..f414c48e9 100644
--- a/deploy/eck-operator/templates/tests/statefulset_test.yaml
+++ b/deploy/eck-operator/templates/tests/statefulset_test.yaml
@@ -77,8 +77,8 @@ tests:
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: elastic-operator
-            app.kubernetes.io/version: 3.2.0-SNAPSHOT
-            helm.sh/chart: eck-operator-3.2.0-SNAPSHOT
+            app.kubernetes.io/version: 3.3.0-SNAPSHOT
+            helm.sh/chart: eck-operator-3.3.0-SNAPSHOT
             key2: value2
       - template: statefulset.yaml
         equal:
@@ -87,8 +87,8 @@ tests:
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: elastic-operator
-            app.kubernetes.io/version: 3.2.0-SNAPSHOT
-            helm.sh/chart: eck-operator-3.2.0-SNAPSHOT
+            app.kubernetes.io/version: 3.3.0-SNAPSHOT
+            helm.sh/chart: eck-operator-3.3.0-SNAPSHOT
             key3: value3
   - it: should use the specified webhook secret name
     set:
diff --git a/deploy/eck-stack/charts/eck-agent/templates/tests/elastic-agent-cluster-role-binding_test.yaml b/deploy/eck-stack/charts/eck-agent/templates/tests/elastic-agent-cluster-role-binding_test.yaml
index 3313b4bc0..b7907aba2 100644
--- a/deploy/eck-stack/charts/eck-agent/templates/tests/elastic-agent-cluster-role-binding_test.yaml
+++ b/deploy/eck-stack/charts/eck-agent/templates/tests/elastic-agent-cluster-role-binding_test.yaml
@@ -79,7 +79,7 @@ tests:
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-agent
             clusterRoleBinding: label
-            helm.sh/chart: eck-agent-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-agent-0.18.0-SNAPSHOT
             test: label
       - equal:
           path: metadata.annotations
diff --git a/deploy/eck-stack/charts/eck-agent/templates/tests/elastic-agent-cluster-role_test.yaml b/deploy/eck-stack/charts/eck-agent/templates/tests/elastic-agent-cluster-role_test.yaml
index 1c703d445..57c83f06b 100644
--- a/deploy/eck-stack/charts/eck-agent/templates/tests/elastic-agent-cluster-role_test.yaml
+++ b/deploy/eck-stack/charts/eck-agent/templates/tests/elastic-agent-cluster-role_test.yaml
@@ -138,7 +138,7 @@ tests:
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-agent
             clusterRole: label
-            helm.sh/chart: eck-agent-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-agent-0.18.0-SNAPSHOT
             test: label
       - equal:
           path: metadata.annotations
diff --git a/deploy/eck-stack/charts/eck-agent/templates/tests/elastic-agent-service-account_test.yaml b/deploy/eck-stack/charts/eck-agent/templates/tests/elastic-agent-service-account_test.yaml
index 89c99ff7a..09506fb90 100644
--- a/deploy/eck-stack/charts/eck-agent/templates/tests/elastic-agent-service-account_test.yaml
+++ b/deploy/eck-stack/charts/eck-agent/templates/tests/elastic-agent-service-account_test.yaml
@@ -49,7 +49,7 @@ tests:
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-agent
             serviceAccount: label
-            helm.sh/chart: eck-agent-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-agent-0.18.0-SNAPSHOT
             test: label
       - equal:
           path: metadata.annotations
diff --git a/deploy/eck-stack/charts/eck-agent/templates/tests/elastic-agent_test.yaml b/deploy/eck-stack/charts/eck-agent/templates/tests/elastic-agent_test.yaml
index 9702361b4..6b5a9f8c5 100644
--- a/deploy/eck-stack/charts/eck-agent/templates/tests/elastic-agent_test.yaml
+++ b/deploy/eck-stack/charts/eck-agent/templates/tests/elastic-agent_test.yaml
@@ -22,7 +22,7 @@ tests:
           value: quickstart-eck-agent
       - equal:
           path: spec.version
-          value: 9.2.0-SNAPSHOT
+          value: 9.3.0-SNAPSHOT
       - equal:
           path: spec.config
           value: null
@@ -51,7 +51,7 @@ tests:
             app.kubernetes.io/instance: quickstart
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-agent
-            helm.sh/chart: eck-agent-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-agent-0.18.0-SNAPSHOT
             test: label
       - equal:
           path: metadata.annotations
@@ -98,11 +98,11 @@ tests:
             app.kubernetes.io/instance: quickstart
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-agent
-            helm.sh/chart: eck-agent-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-agent-0.18.0-SNAPSHOT
       - equal:
           path: spec
           value:
-            version: 9.2.0-SNAPSHOT
+            version: 9.3.0-SNAPSHOT
             daemonSet: {}
             elasticsearchRefs:
             - name: eck-elasticsearch
@@ -167,11 +167,11 @@ tests:
             app.kubernetes.io/instance: quickstart
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-agent
-            helm.sh/chart: eck-agent-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-agent-0.18.0-SNAPSHOT
       - equal:
           path: spec
           value:
-            version: 9.2.0-SNAPSHOT
+            version: 9.3.0-SNAPSHOT
             daemonSet: {}
             elasticsearchRefs:
             - name: eck-elasticsearch
diff --git a/deploy/eck-stack/charts/eck-apm-server/templates/tests/apmserver_test.yaml b/deploy/eck-stack/charts/eck-apm-server/templates/tests/apmserver_test.yaml
index 5a73e9b00..70adb0e98 100644
--- a/deploy/eck-stack/charts/eck-apm-server/templates/tests/apmserver_test.yaml
+++ b/deploy/eck-stack/charts/eck-apm-server/templates/tests/apmserver_test.yaml
@@ -16,7 +16,7 @@ tests:
           value: quickstart-eck-apm-server
       - equal:
           path: spec.version
-          value: 9.2.0-SNAPSHOT
+          value: 9.3.0-SNAPSHOT
   - it: name override should work properly
     set:
       nameOverride: override
@@ -62,7 +62,7 @@ tests:
             app.kubernetes.io/instance: quickstart
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-apm-server
-            helm.sh/chart: eck-apm-server-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-apm-server-0.18.0-SNAPSHOT
             test: label
       - equal:
           path: metadata.annotations
@@ -84,7 +84,7 @@ tests:
           value: quickstart-eck-apm-server
       - equal:
           path: spec.version
-          value: 9.2.0-SNAPSHOT
+          value: 9.3.0-SNAPSHOT
       - equal:
           path: spec.count
           value: 1
diff --git a/deploy/eck-stack/charts/eck-beats/templates/tests/beats-metricbeat-example_test.yaml b/deploy/eck-stack/charts/eck-beats/templates/tests/beats-metricbeat-example_test.yaml
index 263987368..bd958d328 100644
--- a/deploy/eck-stack/charts/eck-beats/templates/tests/beats-metricbeat-example_test.yaml
+++ b/deploy/eck-stack/charts/eck-beats/templates/tests/beats-metricbeat-example_test.yaml
@@ -233,7 +233,7 @@ tests:
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-beats
             serviceAccount: label
-            helm.sh/chart: eck-beats-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-beats-0.18.0-SNAPSHOT
             test: label
       - equal:
           path: metadata.annotations
diff --git a/deploy/eck-stack/charts/eck-beats/templates/tests/beats_test.yaml b/deploy/eck-stack/charts/eck-beats/templates/tests/beats_test.yaml
index 837e2a82b..71338da2f 100644
--- a/deploy/eck-stack/charts/eck-beats/templates/tests/beats_test.yaml
+++ b/deploy/eck-stack/charts/eck-beats/templates/tests/beats_test.yaml
@@ -17,7 +17,7 @@ tests:
           value: quickstart-eck-beats
       - equal:
           path: spec.version
-          value: 9.2.0-SNAPSHOT
+          value: 9.3.0-SNAPSHOT
       - equal:
           path: spec.type
           value: filebeat
@@ -63,11 +63,11 @@ tests:
             app.kubernetes.io/instance: quickstart
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-beats
-            helm.sh/chart: eck-beats-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-beats-0.18.0-SNAPSHOT
       - equal:
           path: spec
           value:
-            version: 9.2.0-SNAPSHOT
+            version: 9.3.0-SNAPSHOT
             daemonSet: {}
             elasticsearchRef:
               name: eck-elasticsearch
@@ -136,11 +136,11 @@ tests:
             app.kubernetes.io/instance: quickstart
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-beats
-            helm.sh/chart: eck-beats-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-beats-0.18.0-SNAPSHOT
       - equal:
           path: spec
           value:
-            version: 9.2.0-SNAPSHOT
+            version: 9.3.0-SNAPSHOT
             daemonSet: {}
             elasticsearchRef:
               name: eck-elasticsearch
diff --git a/deploy/eck-stack/charts/eck-elasticsearch/templates/tests/elasticsearch_test.yaml b/deploy/eck-stack/charts/eck-elasticsearch/templates/tests/elasticsearch_test.yaml
index 260c7d7cf..e82c4e25c 100644
--- a/deploy/eck-stack/charts/eck-elasticsearch/templates/tests/elasticsearch_test.yaml
+++ b/deploy/eck-stack/charts/eck-elasticsearch/templates/tests/elasticsearch_test.yaml
@@ -110,7 +110,7 @@ tests:
             app.kubernetes.io/instance: quickstart
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-elasticsearch
-            helm.sh/chart: eck-elasticsearch-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-elasticsearch-0.18.0-SNAPSHOT
             test: label
       - equal:
           path: metadata.annotations
@@ -214,11 +214,11 @@ tests:
           value: my.regis.try/es:8
   - it: should render image properly
     set:
-      image: my.registry.com/elastic/elasticsearch:9.2.0-SNAPSHOT
+      image: my.registry.com/elastic/elasticsearch:9.3.0-SNAPSHOT
     asserts:
       - equal:
           path: spec.image
-          value: my.registry.com/elastic/elasticsearch:9.2.0-SNAPSHOT
+          value: my.registry.com/elastic/elasticsearch:9.3.0-SNAPSHOT
   - it: should render no podDisruptionBudget by default
     set:
     asserts:
diff --git a/deploy/eck-stack/charts/eck-elasticsearch/templates/tests/ingress_test.yaml b/deploy/eck-stack/charts/eck-elasticsearch/templates/tests/ingress_test.yaml
index 85d72ae47..53b750517 100644
--- a/deploy/eck-stack/charts/eck-elasticsearch/templates/tests/ingress_test.yaml
+++ b/deploy/eck-stack/charts/eck-elasticsearch/templates/tests/ingress_test.yaml
@@ -56,7 +56,7 @@ tests:
             app.kubernetes.io/instance: quickstart
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-elasticsearch
-            helm.sh/chart: eck-elasticsearch-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-elasticsearch-0.18.0-SNAPSHOT
             test: label
       - equal:
           path: metadata.annotations
diff --git a/deploy/eck-stack/charts/eck-enterprise-search/templates/tests/entsearch_test.yaml b/deploy/eck-stack/charts/eck-enterprise-search/templates/tests/entsearch_test.yaml
index fc11ef47c..41a49460f 100644
--- a/deploy/eck-stack/charts/eck-enterprise-search/templates/tests/entsearch_test.yaml
+++ b/deploy/eck-stack/charts/eck-enterprise-search/templates/tests/entsearch_test.yaml
@@ -62,7 +62,7 @@ tests:
             app.kubernetes.io/instance: quickstart
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-enterprise-search
-            helm.sh/chart: eck-enterprise-search-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-enterprise-search-0.18.0-SNAPSHOT
             test: label
       - equal:
           path: metadata.annotations
diff --git a/deploy/eck-stack/charts/eck-fleet-server/templates/tests/fleet-server-cluster-role-binding_test.yaml b/deploy/eck-stack/charts/eck-fleet-server/templates/tests/fleet-server-cluster-role-binding_test.yaml
index efcf7f510..922103a18 100644
--- a/deploy/eck-stack/charts/eck-fleet-server/templates/tests/fleet-server-cluster-role-binding_test.yaml
+++ b/deploy/eck-stack/charts/eck-fleet-server/templates/tests/fleet-server-cluster-role-binding_test.yaml
@@ -49,7 +49,7 @@ tests:
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-fleet-server
             clusterRoleBinding: label
-            helm.sh/chart: eck-fleet-server-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-fleet-server-0.18.0-SNAPSHOT
             test: label
       - equal:
           path: metadata.annotations
diff --git a/deploy/eck-stack/charts/eck-fleet-server/templates/tests/fleet-server-cluster-role_test.yaml b/deploy/eck-stack/charts/eck-fleet-server/templates/tests/fleet-server-cluster-role_test.yaml
index 36f729a2f..8dc144474 100644
--- a/deploy/eck-stack/charts/eck-fleet-server/templates/tests/fleet-server-cluster-role_test.yaml
+++ b/deploy/eck-stack/charts/eck-fleet-server/templates/tests/fleet-server-cluster-role_test.yaml
@@ -88,7 +88,7 @@ tests:
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-fleet-server
             clusterRole: label
-            helm.sh/chart: eck-fleet-server-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-fleet-server-0.18.0-SNAPSHOT
             test: label
       - equal:
           path: metadata.annotations
diff --git a/deploy/eck-stack/charts/eck-fleet-server/templates/tests/fleet-server-service-account_test.yaml b/deploy/eck-stack/charts/eck-fleet-server/templates/tests/fleet-server-service-account_test.yaml
index 2eb935e24..b60bd33c5 100644
--- a/deploy/eck-stack/charts/eck-fleet-server/templates/tests/fleet-server-service-account_test.yaml
+++ b/deploy/eck-stack/charts/eck-fleet-server/templates/tests/fleet-server-service-account_test.yaml
@@ -34,7 +34,7 @@ tests:
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-fleet-server
             serviceAccount: label
-            helm.sh/chart: eck-fleet-server-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-fleet-server-0.18.0-SNAPSHOT
             test: label
       - equal:
           path: metadata.annotations
diff --git a/deploy/eck-stack/charts/eck-fleet-server/templates/tests/fleet-server_test.yaml b/deploy/eck-stack/charts/eck-fleet-server/templates/tests/fleet-server_test.yaml
index eed8270d1..2fa796321 100644
--- a/deploy/eck-stack/charts/eck-fleet-server/templates/tests/fleet-server_test.yaml
+++ b/deploy/eck-stack/charts/eck-fleet-server/templates/tests/fleet-server_test.yaml
@@ -22,7 +22,7 @@ tests:
           value: quickstart-eck-fleet-server
       - equal:
           path: spec.version
-          value: 9.2.0-SNAPSHOT
+          value: 9.3.0-SNAPSHOT
       - equal:
           path: spec.kibanaRef.name
           value: eck-kibana
@@ -52,7 +52,7 @@ tests:
             app.kubernetes.io/instance: quickstart
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-fleet-server
-            helm.sh/chart: eck-fleet-server-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-fleet-server-0.18.0-SNAPSHOT
             test: label
       - equal:
           path: metadata.annotations
@@ -87,14 +87,14 @@ tests:
             app.kubernetes.io/instance: quickstart
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-fleet-server
-            helm.sh/chart: eck-fleet-server-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-fleet-server-0.18.0-SNAPSHOT
       - equal:
           path: spec
           value:
             fleetServerEnabled: true
             mode: fleet
             policyID: eck-fleet-server
-            version: 9.2.0-SNAPSHOT
+            version: 9.3.0-SNAPSHOT
             deployment: {}
             elasticsearchRefs:
             - name: eck-elasticsearch
@@ -135,14 +135,14 @@ tests:
             app.kubernetes.io/instance: quickstart
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-fleet-server
-            helm.sh/chart: eck-fleet-server-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-fleet-server-0.18.0-SNAPSHOT
       - equal:
           path: spec
           value:
             fleetServerEnabled: true
             mode: fleet
             policyID: eck-fleet-server
-            version: 9.2.0-SNAPSHOT
+            version: 9.3.0-SNAPSHOT
             deployment: {}
             elasticsearchRefs:
             - name: eck-elasticsearch
diff --git a/deploy/eck-stack/charts/eck-kibana/templates/tests/ingress_test.yaml b/deploy/eck-stack/charts/eck-kibana/templates/tests/ingress_test.yaml
index 67bbe0ec8..71bd0c525 100644
--- a/deploy/eck-stack/charts/eck-kibana/templates/tests/ingress_test.yaml
+++ b/deploy/eck-stack/charts/eck-kibana/templates/tests/ingress_test.yaml
@@ -56,7 +56,7 @@ tests:
             app.kubernetes.io/instance: quickstart
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-kibana
-            helm.sh/chart: eck-kibana-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-kibana-0.18.0-SNAPSHOT
             test: label
       - equal:
           path: metadata.annotations
diff --git a/deploy/eck-stack/charts/eck-kibana/templates/tests/kibana_test.yaml b/deploy/eck-stack/charts/eck-kibana/templates/tests/kibana_test.yaml
index 17263337a..5e789d1b7 100644
--- a/deploy/eck-stack/charts/eck-kibana/templates/tests/kibana_test.yaml
+++ b/deploy/eck-stack/charts/eck-kibana/templates/tests/kibana_test.yaml
@@ -15,7 +15,7 @@ tests:
           value: quickstart-eck-kibana
       - equal:
           path: spec.version
-          value: 9.2.0-SNAPSHOT
+          value: 9.3.0-SNAPSHOT
       - equal:
           path: spec.count
           value: 1
@@ -61,7 +61,7 @@ tests:
             app.kubernetes.io/instance: quickstart
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-kibana
-            helm.sh/chart: eck-kibana-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-kibana-0.18.0-SNAPSHOT
             test: label
       - equal:
           path: metadata.annotations
@@ -84,7 +84,7 @@ tests:
           value: quickstart-eck-kibana
       - equal:
           path: spec.version
-          value: 9.2.0-SNAPSHOT
+          value: 9.3.0-SNAPSHOT
       - equal:
           path: spec.count
           value: 1
@@ -102,7 +102,7 @@ tests:
       spec:
         elasticsearchRef:
           name: eck-elasticsearch
-        image: quay.io/elastic/kibana:9.2.0-SNAPSHOT
+        image: quay.io/elastic/kibana:9.3.0-SNAPSHOT
     release:
       name: quickstart
     asserts:
@@ -110,13 +110,13 @@ tests:
           of: Kibana
       - equal:
           path: spec.image
-          value: quay.io/elastic/kibana:9.2.0-SNAPSHOT
+          value: quay.io/elastic/kibana:9.3.0-SNAPSHOT
   - it: values.image should work properly
     set:
       spec:
         elasticsearchRef:
           name: eck-elasticsearch
-      image: quay.io/elastic/kibana:9.2.0-SNAPSHOT
+      image: quay.io/elastic/kibana:9.3.0-SNAPSHOT
     release:
       name: quickstart
     asserts:
@@ -124,7 +124,7 @@ tests:
           of: Kibana
       - equal:
           path: spec.image
-          value: quay.io/elastic/kibana:9.2.0-SNAPSHOT
+          value: quay.io/elastic/kibana:9.3.0-SNAPSHOT
   - it: not setting elasticsearchRef should fail
     asserts:
       - failedTemplate:
diff --git a/deploy/eck-stack/charts/eck-logstash/templates/tests/logstash_test.yaml b/deploy/eck-stack/charts/eck-logstash/templates/tests/logstash_test.yaml
index e32daef40..70eecbe1c 100644
--- a/deploy/eck-stack/charts/eck-logstash/templates/tests/logstash_test.yaml
+++ b/deploy/eck-stack/charts/eck-logstash/templates/tests/logstash_test.yaml
@@ -101,7 +101,7 @@ tests:
             app.kubernetes.io/instance: quickstart
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: eck-logstash
-            helm.sh/chart: eck-logstash-0.17.0-SNAPSHOT
+            helm.sh/chart: eck-logstash-0.18.0-SNAPSHOT
             test: label
       - equal:
           path: metadata.annotations
@@ -165,7 +165,7 @@ tests:
       - equal:
           path: spec
           value:
-            version: 9.2.0-SNAPSHOT
+            version: 9.3.0-SNAPSHOT
             count: 1
             pipelinesRef:
               secretName: pipelineLogstashSecretName
diff --git a/deploy/eck-stack/templates/tests/beats_test.yaml b/deploy/eck-stack/templates/tests/beats_test.yaml
index b46949a22..b08aecb30 100644
--- a/deploy/eck-stack/templates/tests/beats_test.yaml
+++ b/deploy/eck-stack/templates/tests/beats_test.yaml
@@ -19,7 +19,7 @@ tests:
           value: quickstart-eck-beats
       - equal:
           path: spec.version
-          value: 9.2.0-SNAPSHOT
+          value: 9.3.0-SNAPSHOT
   - it: should render custom metricbeat example properly
     values:
       - ../../examples/beats/metricbeat_hosts.yaml
@@ -33,7 +33,7 @@ tests:
           value: quickstart-eck-beats
       - equal:
           path: spec.version
-          value: 9.2.0-SNAPSHOT
+          value: 9.3.0-SNAPSHOT
       - equal:
           path: spec.kibanaRef.name
           value: quickstart
diff --git a/deploy/eck-stack/templates/tests/elastic-agent_test.yaml b/deploy/eck-stack/templates/tests/elastic-agent_test.yaml
index 042124241..4a1b962fd 100644
--- a/deploy/eck-stack/templates/tests/elastic-agent_test.yaml
+++ b/deploy/eck-stack/templates/tests/elastic-agent_test.yaml
@@ -18,7 +18,7 @@ tests:
           value: quickstart-eck-agent
       - equal:
           path: spec.version
-          value: 9.2.0-SNAPSHOT
+          value: 9.3.0-SNAPSHOT
   - it: should render agent in custom fleet example properly
     values:
       - ../../examples/agent/fleet-agents.yaml
@@ -32,7 +32,7 @@ tests:
           value: quickstart-eck-agent
       - equal:
           path: spec.version
-          value: 9.2.0-SNAPSHOT
+          value: 9.3.0-SNAPSHOT
       - equal:
           path: spec.elasticsearchRefs
           value: null
diff --git a/deploy/eck-stack/templates/tests/elastic-fleet-agent_test.yaml b/deploy/eck-stack/templates/tests/elastic-fleet-agent_test.yaml
index 45f8ff5d6..547a06d8c 100644
--- a/deploy/eck-stack/templates/tests/elastic-fleet-agent_test.yaml
+++ b/deploy/eck-stack/templates/tests/elastic-fleet-agent_test.yaml
@@ -19,7 +19,7 @@ tests:
           value: quickstart-eck-fleet-server
       - equal:
           path: spec.version
-          value: 9.2.0-SNAPSHOT
+          value: 9.3.0-SNAPSHOT
   - it: should render fleet server in custom fleet example properly
     values:
       - ../../examples/agent/fleet-agents.yaml
@@ -34,7 +34,7 @@ tests:
       - equal:
           path: spec
           value: 
-            version: 9.2.0-SNAPSHOT
+            version: 9.3.0-SNAPSHOT
             kibanaRef:
               name: kibana
             elasticsearchRefs:
diff --git a/deploy/eck-stack/templates/tests/elasticsearch_test.yaml b/deploy/eck-stack/templates/tests/elasticsearch_test.yaml
index 57e82ba11..ee488e288 100644
--- a/deploy/eck-stack/templates/tests/elasticsearch_test.yaml
+++ b/deploy/eck-stack/templates/tests/elasticsearch_test.yaml
@@ -4,7 +4,7 @@ templates:
 tests:
   - it: should render quickstart properly
     set:
-      eck-elasticsearch.version: 9.2.0-SNAPSHOT
+      eck-elasticsearch.version: 9.3.0-SNAPSHOT
       eck-kibana.enabled: false
     release:
       name: quickstart
@@ -16,7 +16,7 @@ tests:
           value: elasticsearch
       - equal:
           path: spec.version
-          value: 9.2.0-SNAPSHOT
+          value: 9.3.0-SNAPSHOT
   - it: name override should work properly
     set:
       eck-elasticsearch.nameOverride: override
diff --git a/deploy/eck-stack/templates/tests/kibana_test.yaml b/deploy/eck-stack/templates/tests/kibana_test.yaml
index 9917a8f46..74dd288e1 100644
--- a/deploy/eck-stack/templates/tests/kibana_test.yaml
+++ b/deploy/eck-stack/templates/tests/kibana_test.yaml
@@ -13,7 +13,7 @@ tests:
           value: quickstart-eck-kibana
       - equal:
           path: spec.version
-          value: 9.2.0-SNAPSHOT
+          value: 9.3.0-SNAPSHOT
   - it: name override should work properly
     set:
       eck-kibana.nameOverride: override
@@ -51,7 +51,7 @@ tests:
           value: quickstart
       - equal:
           path: spec.version
-          value: 9.2.0-SNAPSHOT
+          value: 9.3.0-SNAPSHOT
       - equal:
           path: spec.count
           value: 1
diff --git a/pkg/controller/agent/pod_test.go b/pkg/controller/agent/pod_test.go
index 8a4338824..3dbdb1d23 100644
--- a/pkg/controller/agent/pod_test.go
+++ b/pkg/controller/agent/pod_test.go
@@ -81,9 +81,13 @@ func Test_amendBuilderForFleetMode(t *testing.T) {
 			fleetCerts: fleetCertsFixture,
 			wantPodSpec: generatePodSpec(func(ps corev1.PodSpec) corev1.PodSpec {
 				ps.Containers[0].Env = []corev1.EnvVar{
+					{
+						Name:  "STATE_PATH",
+						Value: "/usr/share/elastic-agent/state",
+					},
 					{
 						Name:  "CONFIG_PATH",
-						Value: "/usr/share/elastic-agent",
+						Value: "/usr/share/elastic-agent/state",
 					},
 				}
 
@@ -179,9 +183,13 @@ func Test_amendBuilderForFleetMode(t *testing.T) {
 						Name:  "FLEET_URL",
 						Value: "https://agent-agent-http.default.svc:8220",
 					},
+					{
+						Name:  "STATE_PATH",
+						Value: "/usr/share/elastic-agent/state",
+					},
 					{
 						Name:  "CONFIG_PATH",
-						Value: "/etc/agent",
+						Value: "/usr/share/elastic-agent/state",
 					},
 				}
 
@@ -274,9 +282,13 @@ func Test_amendBuilderForFleetMode(t *testing.T) {
 						Name:  "FLEET_URL",
 						Value: "https://agent-agent-http.default.svc:8220",
 					},
+					{
+						Name:  "STATE_PATH",
+						Value: "/usr/share/elastic-agent/state",
+					},
 					{
 						Name:  "CONFIG_PATH",
-						Value: "/etc/agent",
+						Value: "/usr/share/elastic-agent/state",
 					},
 				}
 
@@ -311,9 +323,13 @@ func Test_amendBuilderForFleetMode(t *testing.T) {
 			fleetCerts: fleetCertsFixture,
 			wantPodSpec: generatePodSpec(func(ps corev1.PodSpec) corev1.PodSpec {
 				ps.Containers[0].Env = []corev1.EnvVar{
+					{
+						Name:  "STATE_PATH",
+						Value: "/usr/share/elastic-agent/state",
+					},
 					{
 						Name:  "CONFIG_PATH",
-						Value: "/etc/agent",
+						Value: "/usr/share/elastic-agent/state",
 					},
 				}
 
@@ -401,9 +417,13 @@ func Test_amendBuilderForFleetMode(t *testing.T) {
 						Name:  "FLEET_URL",
 						Value: "http://agent-agent-http.default.svc:8220",
 					},
+					{
+						Name:  "STATE_PATH",
+						Value: "/usr/share/elastic-agent/state",
+					},
 					{
 						Name:  "CONFIG_PATH",
-						Value: "/etc/agent",
+						Value: "/usr/share/elastic-agent/state",
 					},
 				}
 
@@ -924,7 +944,7 @@ if [[ -f /mnt/elastic-internal/elasticsearch-association/%[1]s/elasticsearch/cer
     /usr/sbin/update-ca-certificates
   fi
 fi
-/usr/bin/tini -- /usr/local/bin/docker-entrypoint -e
+/usr/bin/tini -- /usr/local/bin/docker-entrypoint -e "$@"
 `, ns)}
 	}
 	for _, tt := range []struct {
diff --git a/pkg/controller/kibana/config_reconcile_test.go b/pkg/controller/kibana/config_reconcile_test.go
index 370459feb..a0aad83a6 100644
--- a/pkg/controller/kibana/config_reconcile_test.go
+++ b/pkg/controller/kibana/config_reconcile_test.go
@@ -53,6 +53,8 @@ func TestReconcileConfigSecret(t *testing.T) {
 			assertions: func(secrets corev1.SecretList) error {
 				require.Equal(t, 1, len(secrets.Items))
 				assert.NotNil(t, secrets.Items[0].Data[SettingsFilename])
+				// The Kibana config secret previously contained the 'credentials' label. It should now not exist.
+				assert.Empty(t, secrets.Items[0].ObjectMeta.Labels["eck.k8s.elastic.co/credentials"])
 				return nil
 			},
 		},
diff --git a/test/e2e/test/kibana/checks_k8s.go b/test/e2e/test/kibana/checks_k8s.go
index 4094d5ebf..674d8a023 100644
--- a/test/e2e/test/kibana/checks_k8s.go
+++ b/test/e2e/test/kibana/checks_k8s.go
@@ -38,8 +38,7 @@ func CheckSecrets(b Builder, k *test.K8sClient) test.Step {
 				Keys:         []string{"kibana.yml"},
 				OptionalKeys: []string{"telemetry.yml"},
 				Labels: map[string]string{
-					"eck.k8s.elastic.co/credentials": "true",
-					"kibana.k8s.elastic.co/name":     kbName,
+					"kibana.k8s.elastic.co/name": kbName,
 				},
 			},
 		}