[dependabot]

Bumps the gardener-dependencies group with 2 updates: github.com/gardener/gardener and github.com/gardener/gardener/hack/tools.

Updates github.com/gardener/gardener from 1.152.0 to 1.153.0

Release notes

Sourced from github.com/gardener/gardener's releases.

v1.153.0

[github.com/gardener/gardener:v1.153.0]

⚠️ Breaking Changes

• [OPERATOR] FluentBit will be scraped by prometheus-garden in all garden clusters. by @​TeodorDichev [#15659]

📰 Noteworthy

• [OPERATOR] Give virtual-garden-kube-apiserver more time to terminate watches gracefully (--shutdown-watch-termination-grace-period=10s [before: 0s]) and tighten envoy's stale connection detection by enabling HTTP/2 upstream pings (30s interval, 15s timeout) and shortening upstream tcp keepalive timeouts (2h -> 3.5min). by @​jan-meis [#15708]
• [OPERATOR] The memory footprint of the gardener-admission-controller is significantly improved when admission is requested for a large number of objects. by @​timuthy [#15837]
• [USER] The ShootValidator admission plugin now returns field validation errors as Invalid (HTTP 422) instead of Forbidden (HTTP 403), with a structured entry per invalid field in .status.details.causes. Automation matching on is forbidden: for certain validation errors should switch to is invalid:. by @​hown3d [#15586]
• [DEVELOPER] cloud-controller-manager-local now implements the node controller: nodes of provider-local shoots with managed infrastructure get their provider ID and the topology.kubernetes.io/{zone,region} and node.kubernetes.io/instance-type labels from the cloud-controller-manager, and kubelet runs with --cloud-provider=external. by @​timebertt [#15768]
• [DEVELOPER] e2e tests are now running with Kubernetes v1.37. by @​shafeeqes [#15821]

✨ New Features

• [OPERATOR] Support overriding generated NetworkPolicy pod selectors for HA VPN seed-server Services. by @​matthias-horne [#15661]

🐛 Bug Fixes

• [OPERATOR] A race condition has been fixed that could cause reconciliations of hibernated Shoots to fail repeatedly with managedresources.resources.gardener.cloud "kube-apiserver-sni" not found. by @​timebertt [#15909]
• [OPERATOR] PersistenVolumeSizeMismatch alert is now triggered after 15m, instead of 5m to accommodate for larger/slower pvc-autoscaler resizes. by @​RadaBDimitrova [#15846]
• [OPERATOR] Logs for OpenTelemetry collector emitted by the opentelemetry-collector-healthcheck.service on shoot nodes now contain only a single message instead of all metrics. by @​TeodorDichev [#15753]
• [OPERATOR] Annotations specified under loadBalancerServices are no longer applied to the internal Istio service. by @​Wieneo [#15918]
• [OPERATOR] The CA rotation for the garden cluster (with HA control-plane) has been fixed. Earlier, the reconciliation was stuck in the etcd rollout phase during the Preparing phase of a CA rotation. by @​timuthy [#15917]
• [OPERATOR] gardener-apiserver ETCD encryption key rotation no longer starts rewriting encrypted resources while old pods are still running, fixing a race condition that could leave objects encrypted with the old key after RotationCompleting. The old encryption key is now retained as a decryption-only fallback after RotationCompleting instead of being dropped immediately. by @​rfranzke [#15809]
• [OPERATOR] The gardenlet no longer deletes the pvc-autoscaler CRDs when the seed cluster is also the garden cluster; in this topology it is managed by gardener-operator. by @​shafeeqes [#15892]
• [USER] Requests with a wrong host header are no longer detected as HTTP/2 coalescing attempt and receive a 404 instead of a 421 by @​crigertg [#15331]
• [USER] Shoot API validation now rejects minAllowed/maxAllowed VPA resource values that would later be rejected by the vpa.k8s.io admission webhook in the seed (e.g. memory quantities that are not a whole number of bytes), surfacing the error immediately instead of during Shoot reconciliation.
  The spec of existing Shoots has to be updated for the reconciliation to finish successfully. by @​pujitha24 [#15675]
• [USER] The CA rotation for shoot clusters (with HA control-plane) has been fixed. Earlier, the reconciliation was stuck in the etcd rollout phase during the Preparing phase of a CA rotation. by @​timuthy [#15917]
• [DEVELOPER] An issue causing make check to fail with chained fixups, seg_count does not match number of segments on macOS 27+ when loading golangci-lint plugins is now fixed. by @​DobromirNPeev [#15762]
• [DEVELOPER] Fixed an issue with the node-agent getting stuck renewing its lease because of a stale cache. by @​jan-meis [#15716]

🏃 Others

• [OPERATOR] Promoted BackupEntryForGarden feature gate to GA. by @​rfranzke [#15869]
• [OPERATOR] The seed-restriction and shoot-restriction admission handlers now reject .spec modifications on UPDATE for all gardenlet-writable resource types. BackupBucket CREATE is validated against the gardenlet's own backup configuration. The webhook authorizer gains WithVerbsForSubresources to bind verbs to specific subresources. by @​rfranzke [#15764]
• [OPERATOR] Etcd DB size alerts now compare against the configured etcd quota (80%/95%) instead of fixed byte thresholds, keeping them accurate when the quota is resized. by @​adenitiu [#15742]
• [OPERATOR] The CustomDNSServerInNodeLocalDNS feature gate has graduated to GA and cannot be disabled anymore. The feature gate can be dropped from gardenlet configurations. by @​DockToFuture [#15904]
• [OPERATOR] Extend and restructure kube-apiserver health dashboard by @​voelzmo [#15813]
• [OPERATOR] Fixed some issues with the changed kube-apiserver health dashboard by @​voelzmo [#15828]
• [OPERATOR] Gardenlet now exposes shoot etcd peer and client endpoints cross-seed via Istio SNI routing, enabling live etcd migration between seeds. by @​acumino [#15576]
• [OPERATOR] Remove Equinix Metal related information due to discontinuation of the service by Equinix by @​RiRa12621 [#15799]
• [DEVELOPER] make kind-up should now tolerate already approved and garbage collected CSRs and thereby be more idempotent. by @​ScheererJ [#15840]
• [DEVELOPER] The local dev-setup registry is now served over HTTPS with a self-signed CA instead of plain HTTP; all insecure-registry workarounds have been removed. During setup you may be prompted for your password so the registry CA can be added to your system's trust store. Run make cleanup-local-registry-ca to remove the added CA from your system's trust store. by @​shafeeqes [#15642]
• [DEPENDENCY] The following dependencies have been updated:
  • fluent/fluent-bit from v5.1.1 to v5.1.2. Release Notes by @​gardener-ci-robot [#15770]
• [DEPENDENCY] The following dependencies have been updated:
  • quay.io/brancz/kube-rbac-proxy from v0.22.1 to v0.23.0. by @​gardener-ci-robot [#15820]
• [DEPENDENCY] The following dependencies have been updated:
  • gardener/pvc-autoscaler from v0.3.0 to v0.3.1. Release Notes
  • github.com/gardener/pvc-autoscaler from v0.3.0 to v0.3.1. by @​gardener-ci-robot [#15746]
• [DEPENDENCY] The following dependencies have been updated:

... (truncated)

Commits

• a52b16f release v1.153.0
• c87e85a Fix etcd CA rotation (#15917)
• 82aac3b Exclude .claude in some hack scripts (#15912)
• 0116a54 Don't copy SettingLoadBalancerServices.Annotations to internal istio servic...
• b32328b Hibernate control plane only after deploying kube-apiserver SNI (#15909)
• 3c94c38 Promote CustomDNSServerInNodeLocalDNS feature gate to GA (#15904)
• 439a9a9 Fix shoot OpenTelemetry collector healthcheck (#15753)
• 5fd8d5b Replace renovate postUpgradeTasks for adding distroless- prefix to envoy ...
• e01fc17 [GEP-28] Implement node controller in cloud-controller-manager-local (#15768)
• 3bc638e Skip local registry CA bundle injection for gardenlet in remote scenario (#15...
• Additional commits viewable in compare view

Updates github.com/gardener/gardener/hack/tools from 1.152.0 to 1.153.0

Release notes

Sourced from github.com/gardener/gardener/hack/tools's releases.

v1.153.0

[github.com/gardener/gardener:v1.153.0]

⚠️ Breaking Changes

• [OPERATOR] FluentBit will be scraped by prometheus-garden in all garden clusters. by @​TeodorDichev [#15659]

📰 Noteworthy

• [OPERATOR] Give virtual-garden-kube-apiserver more time to terminate watches gracefully (--shutdown-watch-termination-grace-period=10s [before: 0s]) and tighten envoy's stale connection detection by enabling HTTP/2 upstream pings (30s interval, 15s timeout) and shortening upstream tcp keepalive timeouts (2h -> 3.5min). by @​jan-meis [#15708]
• [OPERATOR] The memory footprint of the gardener-admission-controller is significantly improved when admission is requested for a large number of objects. by @​timuthy [#15837]
• [USER] The ShootValidator admission plugin now returns field validation errors as Invalid (HTTP 422) instead of Forbidden (HTTP 403), with a structured entry per invalid field in .status.details.causes. Automation matching on is forbidden: for certain validation errors should switch to is invalid:. by @​hown3d [#15586]
• [DEVELOPER] cloud-controller-manager-local now implements the node controller: nodes of provider-local shoots with managed infrastructure get their provider ID and the topology.kubernetes.io/{zone,region} and node.kubernetes.io/instance-type labels from the cloud-controller-manager, and kubelet runs with --cloud-provider=external. by @​timebertt [#15768]
• [DEVELOPER] e2e tests are now running with Kubernetes v1.37. by @​shafeeqes [#15821]

✨ New Features

• [OPERATOR] Support overriding generated NetworkPolicy pod selectors for HA VPN seed-server Services. by @​matthias-horne [#15661]

🐛 Bug Fixes

• [OPERATOR] A race condition has been fixed that could cause reconciliations of hibernated Shoots to fail repeatedly with managedresources.resources.gardener.cloud "kube-apiserver-sni" not found. by @​timebertt [#15909]
• [OPERATOR] PersistenVolumeSizeMismatch alert is now triggered after 15m, instead of 5m to accommodate for larger/slower pvc-autoscaler resizes. by @​RadaBDimitrova [#15846]
• [OPERATOR] Logs for OpenTelemetry collector emitted by the opentelemetry-collector-healthcheck.service on shoot nodes now contain only a single message instead of all metrics. by @​TeodorDichev [#15753]
• [OPERATOR] Annotations specified under loadBalancerServices are no longer applied to the internal Istio service. by @​Wieneo [#15918]
• [OPERATOR] The CA rotation for the garden cluster (with HA control-plane) has been fixed. Earlier, the reconciliation was stuck in the etcd rollout phase during the Preparing phase of a CA rotation. by @​timuthy [#15917]
• [OPERATOR] gardener-apiserver ETCD encryption key rotation no longer starts rewriting encrypted resources while old pods are still running, fixing a race condition that could leave objects encrypted with the old key after RotationCompleting. The old encryption key is now retained as a decryption-only fallback after RotationCompleting instead of being dropped immediately. by @​rfranzke [#15809]
• [OPERATOR] The gardenlet no longer deletes the pvc-autoscaler CRDs when the seed cluster is also the garden cluster; in this topology it is managed by gardener-operator. by @​shafeeqes [#15892]
• [USER] Requests with a wrong host header are no longer detected as HTTP/2 coalescing attempt and receive a 404 instead of a 421 by @​crigertg [#15331]
• [USER] Shoot API validation now rejects minAllowed/maxAllowed VPA resource values that would later be rejected by the vpa.k8s.io admission webhook in the seed (e.g. memory quantities that are not a whole number of bytes), surfacing the error immediately instead of during Shoot reconciliation.
  The spec of existing Shoots has to be updated for the reconciliation to finish successfully. by @​pujitha24 [#15675]
• [USER] The CA rotation for shoot clusters (with HA control-plane) has been fixed. Earlier, the reconciliation was stuck in the etcd rollout phase during the Preparing phase of a CA rotation. by @​timuthy [#15917]
• [DEVELOPER] An issue causing make check to fail with chained fixups, seg_count does not match number of segments on macOS 27+ when loading golangci-lint plugins is now fixed. by @​DobromirNPeev [#15762]
• [DEVELOPER] Fixed an issue with the node-agent getting stuck renewing its lease because of a stale cache. by @​jan-meis [#15716]

🏃 Others

• [OPERATOR] Promoted BackupEntryForGarden feature gate to GA. by @​rfranzke [#15869]
• [OPERATOR] The seed-restriction and shoot-restriction admission handlers now reject .spec modifications on UPDATE for all gardenlet-writable resource types. BackupBucket CREATE is validated against the gardenlet's own backup configuration. The webhook authorizer gains WithVerbsForSubresources to bind verbs to specific subresources. by @​rfranzke [#15764]
• [OPERATOR] Etcd DB size alerts now compare against the configured etcd quota (80%/95%) instead of fixed byte thresholds, keeping them accurate when the quota is resized. by @​adenitiu [#15742]
• [OPERATOR] The CustomDNSServerInNodeLocalDNS feature gate has graduated to GA and cannot be disabled anymore. The feature gate can be dropped from gardenlet configurations. by @​DockToFuture [#15904]
• [OPERATOR] Extend and restructure kube-apiserver health dashboard by @​voelzmo [#15813]
• [OPERATOR] Fixed some issues with the changed kube-apiserver health dashboard by @​voelzmo [#15828]
• [OPERATOR] Gardenlet now exposes shoot etcd peer and client endpoints cross-seed via Istio SNI routing, enabling live etcd migration between seeds. by @​acumino [#15576]
• [OPERATOR] Remove Equinix Metal related information due to discontinuation of the service by Equinix by @​RiRa12621 [#15799]
• [DEVELOPER] make kind-up should now tolerate already approved and garbage collected CSRs and thereby be more idempotent. by @​ScheererJ [#15840]
• [DEVELOPER] The local dev-setup registry is now served over HTTPS with a self-signed CA instead of plain HTTP; all insecure-registry workarounds have been removed. During setup you may be prompted for your password so the registry CA can be added to your system's trust store. Run make cleanup-local-registry-ca to remove the added CA from your system's trust store. by @​shafeeqes [#15642]
• [DEPENDENCY] The following dependencies have been updated:
  • fluent/fluent-bit from v5.1.1 to v5.1.2. Release Notes by @​gardener-ci-robot [#15770]
• [DEPENDENCY] The following dependencies have been updated:
  • quay.io/brancz/kube-rbac-proxy from v0.22.1 to v0.23.0. by @​gardener-ci-robot [#15820]
• [DEPENDENCY] The following dependencies have been updated:
  • gardener/pvc-autoscaler from v0.3.0 to v0.3.1. Release Notes
  • github.com/gardener/pvc-autoscaler from v0.3.0 to v0.3.1. by @​gardener-ci-robot [#15746]
• [DEPENDENCY] The following dependencies have been updated:

... (truncated)

Commits

• a52b16f release v1.153.0
• c87e85a Fix etcd CA rotation (#15917)
• 82aac3b Exclude .claude in some hack scripts (#15912)
• 0116a54 Don't copy SettingLoadBalancerServices.Annotations to internal istio servic...
• b32328b Hibernate control plane only after deploying kube-apiserver SNI (#15909)
• 3c94c38 Promote CustomDNSServerInNodeLocalDNS feature gate to GA (#15904)
• 439a9a9 Fix shoot OpenTelemetry collector healthcheck (#15753)
• 5fd8d5b Replace renovate postUpgradeTasks for adding distroless- prefix to envoy ...
• e01fc17 [GEP-28] Implement node controller in cloud-controller-manager-local (#15768)
• 3bc638e Skip local registry CA bundle injection for gardenlet in remote scenario (#15...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[gardener-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign wpross for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[federated-github-access]

The PR needs to be labeled with ok-to-test by a maintainer to trigger the automated validation of the change

[federated-github-access]

The PR needs to be labeled with ok-to-test by a maintainer to trigger the automated validation of the change

[federated-github-access]

The PR needs to be labeled with ok-to-test by a maintainer to trigger the automated validation of the change