Repository navigation
Renovate: Update External dependencies - #31
renovate[bot] wants to merge 1 commit into
Conversation
df55eab to
cf26021
Compare
428c903 to
32a0504
Compare
renovate
Bot
changed the title
32a0504 to
b531492
Compare
renovate
Bot
changed the title
57314a6 to
a298ffe
Compare
renovate
Bot
changed the title
a298ffe to
4edc285
Compare
renovate
Bot
changed the title
4edc285 to
62ae76e
Compare
renovate
Bot
changed the title
da8d45c to
18d005d
Compare
18d005d to
fcc3330
Compare
renovate
Bot
changed the title
fcc3330 to
6f1f6c2
Compare
renovate
Bot
changed the title
3563756 to
223b330
Compare
ae29fb4 to
f9c7c18
Compare
f9c7c18 to
b115e9e
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.
Suppressed comments (1)
go.mod:22
- k8s.io module versions are skewed:
k8s.io/api,k8s.io/apimachinery, andk8s.io/client-gowere bumped tov0.37.0, butk8s.io/apiextensions-apiserveris pinned tov0.36.4. Kubernetes libraries are intended to be consumed at the same minor version; this kind of mismatch can lead to dependency/compilation issues (especially around sharedapimachinerytypes). Alignk8s.io/apiextensions-apiservertov0.37.0(or alternatively keep all k8s.io/* atv0.36.x) and re-rungo mod tidysogo.sumstays consistent.
k8s.io/api v0.37.0
k8s.io/apiextensions-apiserver v0.36.4
k8s.io/apimachinery v0.37.0
k8s.io/client-go v0.37.0
b115e9e to
da7719e
Compare
| github.com/gardener/gardener/pkg/apis v1.145.0 | ||
| github.com/go-logr/logr v1.4.3 | ||
| github.com/gophercloud/gophercloud/v2 v2.13.0 | ||
| github.com/gardener/gardener-extension-provider-openstack v1.57.0 |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.
Suppressed comments (1)
go.mod:22
k8s.io/apiextensions-apiserveris pinned tov0.36.4while the other Kubernetes modules were updated tov0.37.0(k8s.io/api,k8s.io/apimachinery,k8s.io/client-go). Since we import apiextensions packages (e.g.controllers/suite_test.go), keeping Kubernetes modules on mixed minor versions can lead to subtle incompatibilities (compiled against different expectations ofapimachinerytypes) and makes future upgrades harder.
Recommend aligning k8s.io/apiextensions-apiserver to the same minor (v0.37.0) and re-running go mod tidy to let the solver normalize the full k8s stack (and update go.sum).
k8s.io/api v0.37.0
k8s.io/apiextensions-apiserver v0.36.4
k8s.io/apimachinery v0.37.0
k8s.io/client-go v0.37.0
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.
Suppressed comments (2)
go.mod:20
- The PR description lists
k8s.io/apiextensions-apiserveras being updated tov0.37.0, butgo.modis updated tov0.36.4. Please either updatek8s.io/apiextensions-apiserverto match the stated target or adjust the PR description/dependency table to reflect the actual version being used.
k8s.io/apiextensions-apiserver v0.36.4
go.mod:22
- Kubernetes module versions are inconsistent:
k8s.io/api,k8s.io/apimachinery, andk8s.io/client-goare pinned tov0.37.0, butk8s.io/apiextensions-apiserveris pinned tov0.36.4. Mixing minor versions can lead to subtle type mismatches and dependency resolution issues (e.g., in tests importingk8s.io/apiextensions-apiserver/pkg/.../scheme). Align these Kubernetes module versions to the same minor release (either bumpapiextensions-apiservertov0.37.0or keep everything onv0.36.x) and regeneratego.sum(e.g.,go mod tidy).
k8s.io/api v0.37.0
k8s.io/apiextensions-apiserver v0.36.4
k8s.io/apimachinery v0.37.0
k8s.io/client-go v0.37.0
There was a problem hiding this comment.
🔵 Needs a closer look
It includes broad dependency upgrades (including major-version indirect bumps and core k8s/gardener-related libraries) that should be validated by a human with CI/runtime context.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
There was a problem hiding this comment.
🔵 Needs a closer look
The introduced Kubernetes dependency minor-version skew (k8s.io/apiextensions-apiserver at v0.36.4 vs other k8s modules at v0.37.0) should be resolved to avoid incompatibilities.
Review details
Suppressed comments (1)
go.mod:23
- Kubernetes module versions are skewed:
k8s.io/api,k8s.io/apimachinery, andk8s.io/client-goare pinned tov0.37.0, butk8s.io/apiextensions-apiserveris pinned tov0.36.4. Mixing Kubernetes minors can lead to subtle type incompatibilities or build breakages (especially around sharedapimachinerytypes). Align these to the same Kubernetes minor (either bump apiextensions-apiserver to the matchingv0.37.xseries, or keep the rest on thev0.36.xseries) and re-rungo mod tidyto ensure a consistent graph.
k8s.io/api v0.37.0
k8s.io/apiextensions-apiserver v0.36.4
k8s.io/apimachinery v0.37.0
k8s.io/client-go v0.37.0
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
There was a problem hiding this comment.
🔵 Needs a closer look
It upgrades multiple foundational dependency stacks (Gardener + Kubernetes client libraries + telemetry), which can have subtle compatibility impacts that should be validated by CI and/or targeted runtime testing.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
There was a problem hiding this comment.
🔵 Needs a closer look
It upgrades multiple core ecosystem dependencies (notably Gardener + Kubernetes libraries), which can introduce subtle compile/runtime behavior changes that should be validated via CI and any relevant integration testing before merging.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
There was a problem hiding this comment.
🔵 Needs a closer look
The PR upgrades multiple core platform dependencies (Gardener + Kubernetes module set), which can introduce breaking API/behavior changes that should be validated by CI and/or a maintainer familiar with compatibility expectations.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
There was a problem hiding this comment.
🔵 Needs a closer look
It upgrades multiple core Kubernetes/controller-runtime and Gardener dependencies, which can introduce subtle compatibility issues best validated via CI and human review.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
There was a problem hiding this comment.
🔵 Needs a closer look
The PR includes broad upgrades across Kubernetes/controller-runtime and Gardener dependencies, which can introduce compile-time or behavioral breakages that should be validated by CI and/or a human reviewer.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
There was a problem hiding this comment.
🔵 Needs a closer look
It upgrades a broad set of Kubernetes/Gardener-related dependencies, and compatibility should be confirmed via CI/test results and human validation.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 1
- Review effort level: Lite
| go.opentelemetry.io/otel/sdk v1.44.0 // indirect | ||
| go.opentelemetry.io/otel/sdk/log v0.19.0 // indirect | ||
| go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect |
There was a problem hiding this comment.
🔵 Needs a closer look
The PR includes broad dependency upgrades across Gardener and Kubernetes/controller-runtime that can introduce API/behavior changes requiring human validation and CI signal review.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
There was a problem hiding this comment.
🔵 Needs a closer look
The upgrade includes Kubernetes + controller-runtime minor bumps and large dependency graph churn that can introduce compile/runtime behavior changes best validated by CI and a final human review.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
There was a problem hiding this comment.
🟡 Changes recommended
The envtest configuration must be updated to Kubernetes 1.37 to match the dependency versions.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 1
- Review effort level: Lite
| k8s.io/api v0.37.0 | ||
| k8s.io/apiextensions-apiserver v0.37.0 | ||
| k8s.io/apimachinery v0.37.0 | ||
| k8s.io/client-go v0.37.0 |
There was a problem hiding this comment.
🔵 Needs a closer look
The updated OpenTelemetry dependency set in go.mod is internally inconsistent (SDK pinned older than core), which can lead to MVS/compile issues and should be reconciled via a tidy update.
Review details
Suppressed comments (1)
go.mod:113
- The OpenTelemetry module versions are inconsistent here (otel/metric/trace at v1.46.0, but otel/sdk and otel/sdk/metric still at v1.44.0). With Go's minimal version selection this can force building the older SDK against newer otel APIs, which is a common source of dependency/compile issues; align the OpenTelemetry module set to a single minor version (or rerun
go get go.opentelemetry.io/otel/...@<same-version>+go mod tidyto let the toolchain resolve a consistent set).
go.opentelemetry.io/otel/metric v1.46.0 // indirect
go.opentelemetry.io/otel/sdk v1.44.0 // indirect
go.opentelemetry.io/otel/sdk/log v0.19.0 // indirect
go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect
go.opentelemetry.io/otel/trace v1.46.0 // indirect
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
The PR includes broad Kubernetes/controller-runtime and provider ecosystem upgrades that warrant CI and runtime/integration verification beyond what can be confirmed from the diff alone.
Review effort: Lite
Findings: 3
Open (3)
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
It upgrades multiple core Gardener/Kubernetes dependencies (including a noted breaking change in the OpenStack extension) that can affect runtime compatibility and should be validated with CI/integration coverage.
Review effort: Lite
Findings: 3
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
v1.54.0→v1.59.1v1.150.0→v1.154.0v2.13.0→v2.15.0v0.1.1-0.20260624151759-9166baa81e86→v0.2.0v2.32.0→v2.33.1v1.42.1→v1.44.0v0.22.0→v0.24.0v0.36.4→v0.37.2v0.36.4→v0.37.2v0.36.4→v0.37.2v0.36.4→v0.37.2v0.24.1→v0.25.2Release Notes
gardener/gardener-extension-provider-openstack (github.com/gardener/gardener-extension-provider-openstack)
v1.59.1Compare Source
Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-application:v1.59.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-runtime:v1.59.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/provider-openstack:v1.59.1Container (OCI) Images
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack:v1.59.1europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack:v1.59.1v1.59.0Compare Source
[github.com/gardener/gardener-extension-provider-openstack:v1.59.0]
[OPERATOR]credential fields containing control characters (e.g. embedded newlines) are now rejected by@hebelsan[#1470]✨ New Features
[OPERATOR]The newCloudProfileConfigfieldrootDiskAvailabilityZoneallows to create root disk volumes of worker machines in an availability zone different from the one of the machine. This supports clouds with differing compute and Cinder availability zones. It requires a machine-controller-manager-provider-openstack version that supportsrootDiskAvailabilityZone. by@rhizoet[#1452][OPERATOR]SelfHostedShootExposureis now supported by this extension. by@tobschli[#1401][OPERATOR]Metrics for the Cinder CSI driver controller are now enabled by@hebelsan[#1438][OPERATOR]ThestorageClassesin the openstack CloudProfileproviderConfignow support an optionalregionslist to overrideparametersper region, or to mark a storageClass asunavailablein a region. by@lotharbach[#1428][USER]This extension now supports shoot clusters with Kubernetes version 1.37.You should consider the Kubernetes release notes before upgrading to 1.37. by
@shafeeqes[#1454]🐛 Bug Fixes
[OPERATOR]Fix DeleteRule calling groups.Delete instead of rules.Delete by@hebelsan[#1468][OPERATOR]Fixes incorrect reconciliation of wildcard DNS records by@hebelsan[#1436][OPERATOR]If the network overlay is disabled, the managed security group now allows incoming traffic from the pod CIDRs. Without this rule, pod traffic between nodes was dropped on Neutron backends like ML2/OVN. by@kubicgruenfeld[#1457][USER]Support disabling ssh access for openstack worker nodes by@MichaelEischer[#1453]🏃 Others
[OPERATOR]Harden validation of OpenStack credential and resource name fields by@hebelsan[#1470][OPERATOR]Retrieve caBundle in imagevector by@hebelsan[#1423][OPERATOR]Support bring your own subnet, security group and and share network by@hebelsan[#1422][OPERATOR]Allow adding networks.ipv6 to an existing single-stack IPv4 cluster to enable dual-stack migration. by@axel7born[#1459][OPERATOR]Escape special chars in machineclass generation by@hebelsan[#1469][OPERATOR]Fix calico mutating policy CEL type-check failure on K8s 1.36 by@DockToFuture[#1473][DEPENDENCY]The following container images have been updated:@federated-github-access[bot][#1433][DEPENDENCY]The following container images have been updated:@federated-github-access[bot][#1463][DEPENDENCY]The following container images have been updated:@federated-github-access[bot][#1462]📖 Documentation
[OPERATOR]Documented how to create Cinder volumes in a dedicated storage availability zone (availabilityStorageClass parameter together withignoreVolumeAZ: true) for OpenStack setups with multiple compute zones but a single storage zone. by@rhizoet[#1450]Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-application:v1.59.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-runtime:v1.59.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/provider-openstack:v1.59.0Container (OCI) Images
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack:v1.59.0europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack:v1.59.0v1.58.0Compare Source
[github.com/gardener/gardener-extension-provider-openstack:v1.58.0]
✨ New Features
[OPERATOR]Enable security group management for OVN load balancers so that Kubernetes loadBalancerSourceRanges are enforced out of the box. by @Lappihuan [#1398][USER]This extension now supports shoot clusters with Kubernetes version 1.36.You should consider the Kubernetes release notes before upgrading to 1.36. by @tobschli [#1390]
[USER]OpenStack Shoot clusters can now configurecloudControllerManager.internalLoadBalancerin theirControlPlaneConfig. When enabled, all Services of typeLoadBalancerare provisioned as internal load balancers without floating IPs. by @stblatzheim [#1417]🐛 Bug Fixes
[OPERATOR]fix gardenctl ssh floating ip attachment by @modzilla99 [#1411][OPERATOR]Don't read bastion floating IP from Nova server addresses by @hebelsan [#1419]🏃 Others
[OPERATOR]The update mode of the VerticalPodAutoscaler resource, deployed by gardener-extension-provider-openstack, is now explicitly set toInPlaceOrRecreate, reflecting the actual runtime behavior after the unconditional enablement of theVPAInPlaceUpdatesfeature gate. by @Velin-Todorov [#1397][OPERATOR]Add support for machine preservation by distributing the value ofworker[].machineControllerManager.autoPreserveFailedMachineMaxacross zones. by @thiyyakat [#1409][OPERATOR]Controller only registers for the extension classes it actually handles by @hebelsan [#1424]application/spdx+json
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:a9f8041567e5af18f1f1888bce0694b3e3ccd26ff14a56d842752a53a3b6eccfeurope-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:e7deff34119c2da230131aca3c73798f02313e03fdc11545e4cca61940b4afefeurope-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:9b73aedad0f49f4cba09ca45395614f9437bb20af3579f3a5a40cfc2de434598europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:f9a6f997717efce3437396454ac160f12ff5e9b8448020b931a4ae19c066abbeapplication/vnd.cyclonedx+json
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:42feb5be4811258a286670c35ee94cbdcc50453f7ffdd7af8a5a6b6197b36f66europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:9e531c16d0e56167067b4c69f46b17290f4eada8877901c35298519b75b7cf61europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:6a222fe02cbbab76c384eb53dd3903932f41f52c19d67f1506be06e309471c54europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:8bceb8a2249ee938f2ac404799bbe3bd0819f5968a380b6ce3561490bf130bc0Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-application:v1.58.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-runtime:v1.58.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/provider-openstack:v1.58.0Container (OCI) Images
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack:v1.58.0europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack:v1.58.0v1.57.0Compare Source
[github.com/gardener/gardener-extension-provider-openstack:v1.57.0]
🐛 Bug Fixes
[OPERATOR]Update image vector for machine-controller-manager-provider-openstack fromv0.27.0 → v0.27.1. by @aaronfern [#1384]🏃 Others
[DEPENDENCY]The following container images have been updated:application/spdx+json
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:5eb6b601cfe3252f878aeedba107f90414ef8281ca2ce229aea081f7c5ed84e7europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:75590a6c847ceca746c3b4352bc117b83a14956029965db1ca86f8721d53cb08europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:40243e84118e198a4ec07563dd3632c939802758242b16f72caa60b10e33f7bdeurope-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:458edea4ce9ea4e2b4ff9ee946d958d2f534727ea53572d9d5ea056db7beb929application/vnd.cyclonedx+json
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:53c0288e9b9a269a1c471811eba410decd3118e9f70a1c4c08c5c96bb551721deurope-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:6fd3c8d57ba6fc69dcf6ddf3fbbc64e8cfa72d8ce5375ffc3c559bb224a291bfeurope-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:2360411d87a33c7e4686e96e955133d90bdfc58743e20558e3353f011fb6a54beurope-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:d6e35e557b7e170bab65d62b116aac52bc9298e7d7d2d6935a40cd1d43e00f11Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-application:v1.57.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-runtime:v1.57.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/provider-openstack:v1.57.0Container (OCI) Images
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack:v1.57.0europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack:v1.57.0v1.56.1Compare Source
[github.com/gardener/gardener-extension-provider-openstack:v1.56.1]
🐛 Bug Fixes
[OPERATOR]Update image vector for machine-controller-manager-provider-openstack fromv0.27.0 → v0.27.1. by @aaronfern [#1385]application/spdx+json
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:8054f23268908f99a2ae922c8c7f289d7793c11af2291f9d08684f66e478893deurope-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:ecfac5bd111c31c37d7fd16f63693c55607c0124e78c1db09fab0b64999cb36beurope-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:45c4f9f7b48aff045e07a3bf5900e8c5628db0709df6da92bd77baa506dab198europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:6e2b13448742bc771c2c12bf56ad729830f67e3c9fbba1d811955acd20779a63application/vnd.cyclonedx+json
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:0f4e513b6eb15219c5f29feb9511daaa7227239fc46d6beea21e0745bc0bc72ceurope-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:67ac8325926e0ed80be8bb15171f87f5b804d42053dc316f74f41ff9836dcc9feurope-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:7f606bac0dd3be71a5df71c795c38ff26b3476dead0b32ae2f1fb66fe925cb33europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:ad8b60f1cdc4c3b17de0d3be06ecf2708a99d113a4cc49901ad83544ca941005Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-application:v1.56.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-runtime:v1.56.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/provider-openstack:v1.56.1Container (OCI) Images
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack:v1.56.1europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack:v1.56.1v1.56.0Compare Source
[github.com/gardener/gardener-extension-provider-openstack:v1.56.0]
🐛 Bug Fixes
[OPERATOR]Filter subnet DNS servers from CloudProfile by IP family in reconcile logic by @hebelsan [#1347][OPERATOR]VPA for the extension pod now also controls CPU requests in addition to memory. The VPA container policy also explicitly disables autoscaling for any non-main containers following Gardener best practices. by @voelzmo [#1341][OPERATOR]Add credentials validation to support InternalSecret type by @hebelsan [#1359][OPERATOR]Enables the use ofspec.dns.providers[].credentialsRefand thus enables to upgrade to k8s versionv1.135where spec.dns.providers[].secretName is not allowed anymore. by @wpross [#1357][OPERATOR]Fix CSI manila share client value race condition in control plane reconciliation by @hebelsan [#1351][OPERATOR]Fix a nil pointer dereference panic in the worker controller that could prevent reconciliation or deletion of workers whoseproviderStatus.machineImageswas empty and whose referenced machine image was missing from the CloudProfile. by @Roncossek [#1352]🏃 Others
[OPERATOR]Added securityContext attributes to comply with the Pod Security Standardsrestrictedlevel by @relusc [#1360][DEVELOPER]Migrate test mock clients to fakeclient following gardener/gardener#14799 by @wpross [#1367][DEPENDENCY]The following container images have been updated:[DEPENDENCY]The following container images have been updated:application/spdx+json
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:7c8fcd8b41dcfa82eaa3f7abeb809dcb91357ed03c7dbcfe00f3df8f8538e5aaeurope-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:811fa1d7fe9707b349a8a821e64167a626002012c8a375de931e17d8b7bd59e6europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:324bc3923c88a142cace00f6074269c4ef54d84b698b004e0acf72b47d1dede3europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:fdda8c7d3472ce2c6846f9000d98ee77551f32b0ca45933f53de3ea2c853caf6application/vnd.cyclonedx+json
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:98ae00aa636257297b16593216a311976edd1239371fb2fa19ca05509cd28682europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:a0d845fc9ab2c82f268d4d7243975d8cbbc5653da03b84ad93ef2f41fecd7d61europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:a05b9b65d4fa8a1bb4d8ecdc0506e3a92b35052094069409fc5855f454bd38e0europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:c0d17beabbc31f79eff6e5924bb32e3f02a8b1c7c178b2069d2afc2b45d3a9cbHelm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-application:v1.56.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-runtime:v1.56.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/provider-openstack:v1.56.0Container (OCI) Images
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack:v1.56.0europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack:v1.56.0v1.55.3Compare Source
[github.com/gardener/gardener-extension-provider-openstack:v1.55.3]
🐛 Bug Fixes
[OPERATOR]Add credentials validation to support InternalSecret type by @hebelsan [#1363]application/spdx+json
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:831a24051b800c6f62d6b76b4960099d1036574b2e230ac15f882a5062c067f4europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:8d54fe4439581d07ddc5b6a5de728e8b2654033001b5bf476afa5740610e995aeurope-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:17989f0d066321c1553076200ae75ec504ab7a115fbfc10a7c124a3eec07ab01europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:30eb97c4ce003dc3c490f137971974f949fd206ec0321be87158528cce5b3800Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-application:v1.55.3europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-runtime:v1.55.3europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/provider-openstack:v1.55.3Container (OCI) Images
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack:v1.55.3europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack:v1.55.3v1.55.2Compare Source
[github.com/gardener/gardener-extension-provider-openstack:v1.55.2]
🐛 Bug Fixes
[OPERATOR]Enables the use ofspec.dns.providers[].credentialsRefand thus enables to upgrade to k8s versionv1.35where spec.dns.providers[].secretName is not allowed anymore. by @wpross [#1358]application/spdx+json
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:05fb84fb36986455c9fa0b0526b655651d5540c65f5e5188479a344d4159846beurope-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:a63a1aaa9e65ab21c18650a74170aa8fa436dfe065d1b13821629068eef45006europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:1a4212e104eee563997a28d42ce8a2bdd060bb6ff7d539c54891385dde014039europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:e181da53c7d612d2634484722add21d79c5d49d05d92c9d9f062f1932f549d9bHelm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-application:v1.55.2europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-runtime:v1.55.2europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/provider-openstack:v1.55.2Container (OCI) Images
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack:v1.55.2europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack:v1.55.2v1.55.1Compare Source
[github.com/gardener/gardener-extension-provider-openstack:v1.55.1]
🐛 Bug Fixes
[OPERATOR]Fix CSI manila share client value race condition in control plane reconciliation by @hebelsan [#1353]application/spdx+json
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:2acb6e03a764184c3be7f85c4ec558948ab105aa90eb2d054a060faa39955f8beurope-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:99b900482b61be30bb7ebc904ff691603b31487937acf43ba4d254fcc890460aeurope-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:b39f98105ed2ef9897bf8c1b1aa5589ce88990c3d00e79c99268be71d58631c0europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:e10a79ca74b03f307074a02f2d5911f6eb78363c3dd7090d548d324778982490Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-application:v1.55.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-runtime:v1.55.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/provider-openstack:v1.55.1Container (OCI) Images
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack:v1.55.1europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack:v1.55.1v1.55.0Compare Source
[github.com/gardener/gardener-extension-provider-openstack:v1.55.0]
[OPERATOR]<= 1.31. Please make sure to upgrade all Garden, Seed and Shoot clusters to at least version 1.32 before deploying this extension version. by @timuthy [#1331]✨ New Features
[OPERATOR]Allow mixed format machine images in CloudProfiles: old format (regions with architecture) and new format (capabilityFlavors) can coexist per image version. by @Roncossek [#1333][OPERATOR]support for additional security groups in worker configuration by @hebelsan [#1327]🏃 Others
[OPERATOR]Enables the backupentry controller in the runtime cluster by @hebelsan [#1337][OPERATOR]support OpenStack subnet pools for automatic CIDR allocation by @hebelsan [#1326][OPERATOR]Add managed default VolumeSnapshotClass for Cinder by @hebelsan [#1319][OPERATOR]Add dual-stack (IPv4/IPv6) networking support for OpenStack shoots. ConfiguresubnetPoolIDin InfrastructureConfig to allocate IPv6 subnets for nodes, pods, and services. by @axel7born [#1257][OPERATOR]Update gardener/gardener to v1.142.0 by @hebelsan [#1336][DEVELOPER]Enhance Makefile to easily deploy to a remote cluster. by @matthias-horne [#1325][DEPENDENCY]The following container images have been updated:application/spdx+json
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:b2df346ab7b83f39757c34e409220b42e6c4bb09bca017f42b523aac8f870fcceurope-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack@sha256:d93e46f5ce36a7324b8cf29526882b625bb862c3e1cdb2159c0ca4489f11bd73europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:b78f40513df0349fba8a8093e005a57318f73d717774d449adc1efb90bd51e11europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack@sha256:c235822a89f3ed88c827a59623a0e16c67b41398545c06efb9cb86d495a68cb0Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-application:v1.55.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-runtime:v1.55.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/provider-openstack:v1.55.0Container (OCI) Images
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack:v1.55.0europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack:v1.55.0gardener/gardener (github.com/gardener/gardener/pkg/apis)
v1.154.0Compare Source
[github.com/gardener/gardener:v1.154.0]
[OPERATOR]1.32. Make sure to upgrade all existing clusters before upgrading to this Gardener version. by @ary1992 [#15860][USER].spec.kubernetes.clusterAutoscaler.maxEmptyBulkDeleteand.spec.kubernetes.kubeControllerManager.podEvictionTimeouthave been removed from theShootAPI. Setting them has been forbidden since Kubernetes1.33. Use.spec.kubernetes.clusterAutoscaler.maxScaleDownParallelisminstead ofmaxEmptyBulkDelete. by @ary1992 [#15860][USER]Gardener now forbids manual modification of thegardener.cloud/reference-protectionandgardenerfinalizers for regular users. by @jan-meis [#15822]📰 Noteworthy
[OPERATOR]A dedicatedDNSRecordis now created for an explicitly configureddashboard/discovery-serverdomain, even if it is a subdomain of a runtime ingress domain. This fixes ACME DNS-01 certificate renewal with some DNS providers and means the domain'sprovideris now honored instead of being ignored. by @cerealsnow [#16006][OPERATOR]TheDisableNginxIngressInShootfeature gate has been promoted to beta. by @ScheererJ [#15929][DEVELOPER]make gind-downnow preserves the shared local infrastructure (DNS, registry, backup bucket, kind docker network) while thegardener-localkind cluster still exists, allowing the DR/restore flow to reuse the kind cluster and its Gardener control plane across iterations.make kind-downremains responsible for tearing the shared infrastructure down. by @Kostov6 [#15841]✨ New Features
[OPERATOR]ETCD encryption key rotation/ config change for the garden cluster now re-encrypts data via the native KubernetesStorageVersionMigrationAPI (storagemigration.k8s.io/v1) instead of the previous label-based rewrite. This applies when the garden cluster runs Kubernetes >= 1.37, where theStorageVersionMigratorfeature is active by default;gardener-operatorfalls back to the label-based mechanism if the feature gate is explicitly disabled in thevirtual-garden-kube-apiserverorvirtual-garden-kube-controller-manager, or if thestoragemigration.k8s.io/v1API is disabled via runtime config. by @shafeeqes [#15771][OPERATOR]Addedfinalizerrestrictionwebhook which forbids manual modification of thegardener.cloud/reference-protectionandgardenerfinalizers for regular users. by @jan-meis [#15822][OPERATOR]Communication with VictoriaLogs is now TLS encrypted and it is on port 9429. by @TeodorDichev [#15725][USER]ETCD encryption key rotation/ config change for shoot clusters now re-encrypts data via the native KubernetesStorageVersionMigrationAPI (storagemigration.k8s.io/v1) instead of the previous label-based rewrite. This applies to shoots running Kubernetes >= 1.37, where theStorageVersionMigratorfeature is active by default;gardenletfalls back to the label-based mechanism if the feature gate is explicitly disabled in the shoot'skube-apiserverorkube-controller-manager, or if thestoragemigration.k8s.io/v1API is disabled via runtime config. by @shafeeqes [#15771][USER]When theVictoriaLogsBackendandRemoveValifeature gates are enabled, update all existing dashboards that use Vali as a data source and add a new dashboard dedicated to VictoriaLogs. by @Ilia Petrov [#15769]🐛 Bug Fixes
[OPERATOR]An issue has been fixed that caused a hibernated Shoot'sstatus.hibernatedfield to be incorrectly set tofalseat the end of a successful migrate phase of control plane migration. This would then cause the restore phase to get stuck until an operator manually intervened to set thestatus.hibernatedfield back totrue. by @plkokanov [#16011][OPERATOR]The ClusterRole of the opentelemetry-operator deployed by gardener-operator now grants read access tohttproutes.gateway.networking.k8s.io. Previously, on runtime clusters that have the Gateway API CRDs installed, the operator could not start its informers and never reconciled theOpenTelemetryCollector, leaving the garden logging pipeline down and fluent-bit in a permanent liveness-restart loop. by @anastazya [#15777][OPERATOR]A bug has been fixed that broke shoot creation in environments where the nodeCIDR is provisioned by the Infrastructure provider by @maboehm [#15966][OPERATOR]WithIstioTLSTerminationfeature gate, requests from established connections which use client certificate authentication are now rejected when their client certificate expires. by @oliver-goetz [#16055][OPERATOR]Clients connected to the previous Istio ingress gateway no longer receive errors for the whole kube-apiserver rollout when a shoot's kube-apiserver moves to another Istio ingress gateway, e.g., when updating the shoot to failure tolerance typezone. by @timebertt [#15942][OPERATOR]Theownerrole assignment to the owner as project member is moved toPrepareFor(Create|Update)strategy methods becauseCanonicalizeshould not add or remove data. by @vpnachev [#15994][OPERATOR]Relaxed shoot validation in theseed-restrictionandshoot-restrictionhandlers. Earlier, this could have led to failing shoot reconciliations. by @timuthy [#15974][USER]fix case sensitivity forConnection: Upgradeheaders triggering a wrong HTTP 403 response by @crigertg [#15797][USER]In-place update worker pools (AutoInPlaceUpdateandManualInPlaceUpdate) are no longer stuck as pending in the Shoot status when an unrelated worker pool fails to become available. by @shafeeqes [#15848][USER]The OCI Helm chart puller now appends the charts CA bundle from the image vector overwrite onto the system's default certificate pool instead of replacing it, fixing chart pulls from public registries (e.g.europe-docker.pkg.dev) when a self-signed registry CA is also configured. by @ialidzhikov [#15937][USER]kube-proxy is now restarted when it reports unhealthy for about one minute. This works around a bug in kube-proxy v1.34+ where a failed initial sync was not retried for up to one hour, leaving the pod unready. by @timebertt [#16007]🏃 Others
[OPERATOR]Removed theBackupEntryForGardenfeature gate which has been GA sincev1.153. by @rfranzke [#15920][OPERATOR]Resources managed by aManagedResource(labeledresources.gardener.cloud/managed-by=gardener) are no longer deleted during the Kubernetes resource cleanup phase of shoot deletion. by @Velin-Todorov [#15905][OPERATOR]Thegardener/autoscalerimage for Shoots with Kubernetes version 1.36 has been updated tov1.36.0. Release Notes by @r4mek [#15970][OPERATOR]The obsolete implicit internal-DNS configuration via a Secret labeledgardener.cloud/role=internal-domainhas been removed. Seeds must use the requiredSeed.spec.dns.internalfield, the only supported mechanism since v1.129. Theinternal-domain-secret.gardener.cloudadmission webhook has been removed accordingly. by @DobromirNPeev [#15913][OPERATOR]Remove fixed NodeCIDRMaskSizeIPv6=64 default for dual-stack shoots.The effective per-node IPv6 mask is now derived from the actual pod CIDR
(podCIDRMaskSize+16, capped at /124), fixing single-node clusters on
infrastructures that hand out a /64 pod range. by @axel7born [#15943]
[OPERATOR]Self-hosted shoot clusters now deploy their own istio when connected to aGardencluster. by @ScheererJ [#15874][OPERATOR]gardenadm restorenow cleans up the staleOperatingSystemConfigSecret and theshoot-gardener-node-agentManagedResourcerestored from the ETCD snapshot during the bootstrap flow, fixing an unrecoverable failure where the restored control plane ran with two etcds. by @dimitar-kostadinov [[#15949]Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.