Skip to content

Update module github.com/gardener/gardener to v1.123.0 - autoclosed #150

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conversation

gardener-ci-robot
Copy link
Contributor

@gardener-ci-robot gardener-ci-robot commented Jul 10, 2025

This PR contains the following updates:

Package Type Update Change
github.com/gardener/gardener require minor v1.118.2 -> v1.123.0

Release Notes

gardener/gardener (github.com/gardener/gardener)

v1.123.0

Compare Source

[gardener/gardener]

⚠️ Breaking Changes

  • [OPERATOR] There is a new validation for the Garden resource which ensures the API server domain of the virtual cluster which is derived from the primary (immutable) DNS name does not match any SNI domain pattern. by @​oliver-goetz [#​11996]
  • [OPERATOR] ⚠️ The Shoot API field spec.provider.workers[].controlPlane.backup.secretRef has been removed, please migrate your shoot manifests to spec.provider.workers[].controlPlane.backup.credentialsRef! by @​vpnachev [#​12347]
  • [OPERATOR] ⚠️ The Seed API field spec.backup.secretRef has been removed, please migrate your seed manifests to spec.backup.credentialsRef! Gardener API server already has defaulted this field. by @​vpnachev [#​12347]
  • [OPERATOR] ⚠️ The GardenletConfiguration configuration file field seedConfig.spec.backup.secretRef has been removed, please migrate your gardenlet configuration manifests to seedConfig.spec.backup.credentialsRef! Gardenlet already has defaulted this field . by @​vpnachev [#​12347]
  • [OPERATOR] ⚠️ The Gardenlet API field spec.config.seedConfig.spec.backup.secretRef has been removed, please migrate your gardenlet manifests to spec.config.seedConfig.spec.backup.credentialsRef! Gardener API server already has defaulted this field. by @​vpnachev [#​12347]
  • [OPERATOR] gardenlets cannot connect to Garden cluster with insecure-skip-tls-verify anymore. This setting still works in the bootstrap kubeconfig but is unset bootstrapping. by @​oliver-goetz [#​11996]
  • [OPERATOR] The deprecated field globallyEnabled has been removed from the ControllerRegistration and Extension APIs. Please make sure that globallyEnabled is not used anymore and all already applied ControllerRegistration and Extension resources switched to the new field autoEnable, before upgrading to this version. Read more about the extension registration and the autoEnable feature here. by @​timuthy [#​12465]
  • [OPERATOR] The DoNotCopyBackupCredentials feature gate has been promoted to beta and is now enabled by default. When the feature is enabled the Seed backup secret is no longer copied from the Shoot infrastructure credentials in case an operator does not provide an existing backup secret. If you configure seed.spec.backup.credentialsRef, make sure that the referred credential already exists. For production setups, it is advised that operators configure a separate set of credentials for Seed backup and Shoot infrastructure. by @​dimityrmirchev [#​12414]
  • [OPERATOR] The NodeAgentAuthorizer feature gate has been graduated to GA and is locked to true. by @​oliver-goetz [#​12405]
  • [OPERATOR] ⚠️ The ManagedSeed API field spec.gardenlet.config.seedConfig.spec.backup.secretRef has been removed, please migrate your managed seed manifests to spec.gardenlet.config.seedConfig.spec.backup.credentialsRef! Gardener API server already has defaulted this field. by @​vpnachev [#​12347]
  • [DEVELOPER] The .spec.purpose field in the ControlPlane resource has been removed after being deprecated since Gardener v1.120.0. It was previously used to distinguish between the normal and exposure purposes. The exposure purpose was used before SNI was introduced. Since SNI is now unconditionally enabled, the field is no longer needed. by @​theoddora [#​12340]
  • [DEVELOPER] The function github.com/gardener/gardener/extensions/pkg/controller/controlplane/genericactuator.NewActuator no longer accepts exposureSecretConfigs, exposureShootAccessSecrets functions as parameters, and controlPlaneExposureChart chart.
    The interface github.com/gardener/gardener/extensions/pkg/controller/controlplane/genericactuator.ValuesProvider no longer defines a method called GetControlPlaneExposureChartValues. Implementations of the interface can drop the said method. by @​theoddora [#​12340]
  • [USER] Setting resources with . suffix in the spec.kubernetes.kubeAPIServer.encryptionConfig.resources field is now forbidden. by @​AleksandarSavchev [#​12355]
  • [USER] The deprecated url annotation in <shoot-name>.monitoring secrets in the project namespace has been removed. Please use the plutono-url annotation instead. by @​oliver-goetz [#​12396]
  • [USER] The .spec.kubernetes.clusterAutoscaler.maxEmptyBulkDelete field in the Shoot API is forbidden to be set for Kubernetes versions >= 1.33 and will be removed after support for Kubernetes 1.32 is dropped. by @​Kostov6 [#​12413]

📰 Noteworthy

  • [OPERATOR] The graduated feature gate RemoveAPIServerProxyLegacyPort has been removed. by @​Wieneo [#​12406]
  • [USER] For worker pools with in-place update strategies, the maxSurge and maxUnavailable fields are now correctly defaulted to 0 and 1 respectively. by @​shafeeqes [#​12438]

✨ New Features

  • [OPERATOR] Introduced the OpenTelemetry Operator as a component to Seed & Garden Clusters. by @​rrhubenov [#​12165]
  • [OPERATOR] gardenlets are now able to update their garden cluster CA automatically from Garden cluster if gardenClusterCACert field in gardenlet resource is omitted. gardenClusterCACert field in gardenlet resource is deprecated now. by @​oliver-goetz [#​11996]
  • [OPERATOR] Operators do no longer have to specify a gardenClusterAddress in gardenlet resources. by @​oliver-goetz [#​11996]
  • [OPERATOR] Cluster internal L7 load balancing for control plane components of shoot and virtual garden kube-apiservers is supported now. by @​oliver-goetz [#​12260]
  • [DEVELOPER] The provider-local extension implements the Bastion resource now. With this, you can use gardenctl ssh in the local setup. by @​timebertt [#​12366]
  • [DEVELOPER] BackupBucket/BackupEntry controllers now support WorkloadIdentity type of credentials, provider extensions may need to adjust the respective controllers or to explicitly disallow BackupBuckets of their type to configure WorkloadIdentity. by @​vpnachev [#​12321]

🐛 Bug Fixes

  • [DEVELOPER] Fixed the local-setup for Cilium shoots. by @​axel7born [#​12410]
  • [USER] A bug causing the kube-apiserver to crash due to invalid resources in the spec.kubernetes.kubeAPIServer.encryptionConfig.resources was fixed. by @​AleksandarSavchev [#​12355]
  • [USER] A bug forbidding the update of spec.kubernetes.kubeAPIServer.encryptionConfig.resources due to use of . suffix in resources was fixed. by @​AleksandarSavchev [#​12355]
  • [OPERATOR] Fix istio creation on cloud regions with uppercase characters by @​modzilla99 [#​12466]

🏃 Others

Helm Charts

  • controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.123.0
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.123.0
  • operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.123.0
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.123.0

Container (OCI) Images

  • admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.123.0
  • apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.123.0
  • controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.123.0
  • gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.123.0
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.123.0
  • node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.123.0
  • operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.123.0
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.123.0
  • scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.123.0

v1.122.1

Compare Source

[gardener/gardener]

🐛 Bug Fixes

  • [USER] An issue causing gardenlet to panic during the migration from single-stack IPv4 to dual-stack IPv4, IPv6 when the Shoot is hibernated is now fixed. by @​DockToFuture [#​12435]
  • [USER] A bug causing the maxSurge and maxUnavailable fields for worker pools with update strategy ManualInPlaceUpdate always getting overwritten is now fixed. by @​shafeeqes [#​12454]
  • [DEVELOPER] An issue causing reporting data generated by the testframework to be incompatible with recent elasticsearch/opensearch versions is now fixed. by @​dguendisch [#​12462]
  • [OPERATOR] Fixed an error in BackupBucket reconciliation by replacing StrategicMergePatch with MergePatch to properly handle runtime.RawExtension fields. by @​shafeeqes [#​12461]

Helm Charts

  • controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.122.1
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.122.1
  • operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.122.1
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.122.1

Container (OCI) Images

  • admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.122.1
  • apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.122.1
  • controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.122.1
  • gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.122.1
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.122.1
  • node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.122.1
  • operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.122.1
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.122.1
  • scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.122.1

v1.122.0

Compare Source

[gardener/gardener]

⚠️ Breaking Changes

  • [DEPENDENCY] The Workload Identity secrets will no longer set the config data key (with value "null") when the workloadIdentity.spec.targetSystem.providerConfig is nil. by @​vpnachev [#​12372]
  • [OPERATOR] If an operator configures serviceAccountConfig.issuer for the virtual cluster in a Garden resource and that issuer matches a hostname of the virtual kube-apiserver then the --external-hostname flag of the virtual kube-apiserver will be set to that hostname instead of the first domain set in the virtualCluster.dns.domains[] field. by @​dimityrmirchev [#​12351]
  • [USER] The .spec.kubernetes.enableStaticTokenKubeconfig field in the Shoot API is removed. This field has been deprecated since Gardener v1.114.0. Adapt your manifests and machinery to no longer specify this field. Otherwise, CREATE/UPDATE requests for Shoot will be rejected due to unknown field. by @​shafeeqes [#​12284]

📰 Noteworthy

  • [OPERATOR] The RemoveAPIServerProxyLegacyPort feature gate has been promoted to GA and is now unconditionally enabled. by @​Wieneo [#​12341]

✨ New Features

  • [DEVELOPER] Gardener can now support clusters with Kubernetes version 1.33. Extension developers have to prepare individual extensions as well to work with 1.33. by @​RadaBDimitrova [#​12216]
  • [OPERATOR] Gardener can now support clusters with Kubernetes version 1.33. To allow creation/update of 1.33 clusters you will have to update the version of your provider extension(s) to a version that supports 1.33 as well. Please consult the respective releases and notes in the provider extension's repository. by @​RadaBDimitrova [#​12216]
  • [OPERATOR] The JWTs issued on behalf of WorkloadIdentity now have the jti claim set. Already issued tokens will get the jti claim next time when they are renewed. by @​vpnachev [#​12353]
  • [USER] Support defaulting machine image versions from version prefix on Shoot spec update. by @​LucaBernstein [#​12374]

🐛 Bug Fixes

  • [USER] A regression causing the gardenlet to fail to decode the referenced AuthenticationConfiguration while deploying the kube-apiserver when the API version is not apiserver.config.k8s.io/v1beta1 is now fixed. by @​AleksandarSavchev [#​12399]

🏃 Others

  • [DEPENDENCY] The following dependencies have been updated:
  • [DEPENDENCY] The following dependencies have been updated:
  • [DEPENDENCY] The following dependencies have been updated:
  • [DEPENDENCY] The following dependencies have been updated:
  • [DEPENDENCY] The following dependencies are updated:
    • k8s.io/*: v0.32.5 -> v0.33.1
    • sigs.k8s.io/controller-runtime: v0.20.4 -> v0.21.0
    • sigs.k8s.io/controller-tools: v0.17.3 -> v0.18.0 by @​plkokanov [#​12208]
  • [DEPENDENCY] The following dependencies have been updated:
  • [OPERATOR] The .spec.kubernetes.kubeControllerManager.podEvictionTimeout field in the Shoot API is forbidden to be set for Kubernetes versions >= 1.33 and will be removed after support for Kubernetes 1.32 is dropped. by @​plkokanov [#​12343]
  • [OPERATOR] Terraform container now forbids privilege escalation explicitly. by @​AleksandarSavchev [#​12325]
  • [USER] The redundant containerd-monitor systemd unit is now removed. It had already been replaced by the gardener-node-agent's health check controller which fully covers the functionality of the containerd-monitor unit. by @​theoddora [#​12297]

📖 Documentation

  • [OPERATOR] A documentation on how to configure and use immutable backup buckets for enhanced data protection is now added. by @​seshachalam-yv [#​12175]

Helm Charts

  • controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.122.0
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.122.0
  • operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.122.0
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.122.0

Container (OCI) Images

  • admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.122.0
  • apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.122.0
  • controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.122.0
  • gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.122.0
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.122.0
  • node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.122.0
  • operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.122.0
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.122.0
  • scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.122.0

v1.121.4

Compare Source

[gardener/gardener]

🐛 Bug Fixes

  • [USER] An issue causing gardenlet to panic during the migration from single-stack IPv4 to dual-stack IPv4, IPv6 when the Shoot is hibernated is now fixed. by @​DockToFuture [#​12435]
  • [USER] A bug causing the maxSurge and maxUnavailable fields for worker pools with update strategy ManualInPlaceUpdate always getting overwritten is now fixed. by @​shafeeqes [#​12455]
  • [DEVELOPER] An issue causing reporting data generated by the testframework to be incompatible with recent elasticsearch/opensearch versions is now fixed. by @​dguendisch [#​12463]
  • [OPERATOR] Fixed an error in BackupBucket reconciliation by replacing StrategicMergePatch with MergePatch to properly handle runtime.RawExtension fields. by @​shafeeqes [#​12459]

Helm Charts

  • controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.121.4
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.121.4
  • operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.121.4
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.121.4

Container (OCI) Images

  • admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.121.4
  • apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.121.4
  • controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.121.4
  • gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.121.4
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.121.4
  • node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.121.4
  • operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.121.4
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.121.4
  • scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.121.4

v1.121.3

Compare Source

[gardener/gardener]

🐛 Bug Fixes

  • [USER] A regression causing the gardenlet to fail to decode the referenced AuthenticationConfiguration while deploying the kube-apiserver when the API version is not apiserver.config.k8s.io/v1beta1 is now fixed. by @​AleksandarSavchev [#​12400]

Helm Charts

  • controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.121.3
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.121.3
  • operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.121.3
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.121.3

Container (OCI) Images

  • admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.121.3
  • apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.121.3
  • controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.121.3
  • gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.121.3
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.121.3
  • node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.121.3
  • operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.121.3
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.121.3
  • scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.121.3

v1.121.2

Compare Source

[gardener/gardener]

🐛 Bug Fixes

  • [DEVELOPER] Installing logcheck and typos as custom linters for gardener extensions has been fixed. by @​timuthy [#​12380]
  • [OPERATOR] An issue preventing the cluster-autoscaler to list volumeattachments in now fixed. by @​aaronfern [#​12376]
  • [OPERATOR] The Garden resource validation no longer forbids setting both bucketName and providerConfig in the ETCD backup configuration under the .spec.virtualCluster field. by @​seshachalam-yv [#​12367]

🏃 Others

  • [DEPENDENCY] Perses container images are switched from upstream quay.io images to Gardener AR images (mirror from upstream docker.io images). The upstream quay.io images are 200MB larger compared to the docker.io ones and include binary with Sleepycat license (Berkeley DB). by @​ialidzhikov [#​12383]

Helm Charts

  • controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.121.2
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.121.2
  • operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.121.2
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.121.2

Container (OCI) Images

  • admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.121.2
  • apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.121.2
  • controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.121.2
  • gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.121.2
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.121.2
  • node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.121.2
  • operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.121.2
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.121.2
  • scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.121.2

v1.121.1

Compare Source

[gardener/gardener]

🐛 Bug Fixes

  • [OPERATOR] A regression was fixed that previously prevented the creation or update of CloudProfiles without a specified machine image version classification. by @​timuthy [#​12334]

Helm Charts

  • controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.121.1
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.121.1
  • operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.121.1
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.121.1

Container (OCI) Images

  • admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.121.1
  • apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.121.1
  • controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.121.1
  • gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.121.1
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.121.1
  • node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.121.1
  • operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.121.1
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.121.1
  • scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.121.1

v1.121.0

Compare Source

[gardener/gardener]

⚠️ Breaking Changes

  • [DEVELOPER] Moved extensions/pkg/predicate to pkg/controllerutils/predicate. Please adjust imports accordingly. by @​Wieneo [#​12026]
  • [DEVELOPER] The MutatorWithShootClient has been removed from Gardener. If your mutator requires a shoot client, it should implement the new WantsShootClient interface instead. The corresponding client can be found in the passed context via the ShootClientContextKey. by @​timuthy [#​12289]
  • [DEVELOPER] Moved extensions/pkg/util/cloudprofile to pkg/utils/gardener/cloudprofile. Please adjust imports accordingly. by @​Wieneo [#​12026]
  • [USER] The .spec.kubernetes.clusterAutoscaler.maxEmptyBulkDelete field in the Shoot API is deprecated in favor of .spec.kubernetes.clusterAutoscaler.maxScaleDownParallelism and will be removed once gardener stops supporting kubernetes v1.32. Please adapt your Shoot manifests accordingly. by @​takoverflow [#​12115]
  • [OPERATOR] gardenlet no longer deploys ControlPlane resources with .spec.purpose=exposure for Shoots using unmanaged DNS provider. gardenlet will now cleanup any ControlPlane exposure resource as part of the reconciliation and deletion flows for such Shoots. by @​theoddora [#​12162]

📰 Noteworthy

  • [OPERATOR] The Seed backup secret is no longer copied from the Shoot infrastructure credentials in case an operator does not provide an existent backup secret and DoNotCopyBackupCredentials feature gate is enabled for gardenlet. If you configure seed.spec.backup.credentialsRef or seed.spec.backup.secretRef, make sure that the referred credential already exists. For production setups, it is advised that operators configure a separate set of credentials for Seed backup and Shoot infrastructure. by @​dimityrmirchev [#​12168]
  • [OPERATOR] The CredentialsRotationWithoutWorkersRollout feature gate has been promoted to beta and is now enabled by default. by @​rfranzke [#​12236]

✨ New Features

  • [DEVELOPER] Extension mutators or validators can now retrieve a corresponding Cluster object from the passed context.Context. The WantsClusterObject interface must be implemented for this functionality. by @​timuthy [#​12289]
  • [USER] Concurrent drain and deletion of nodes that require drain can now be configured for cluster-autoscaler via the field .spec.kubernetes.clusterAutoscaler.maxDrainParallelism in the Shoot API. by @​takoverflow [#​12115]
  • [OPERATOR] gardenlet now doesn't scale up deployments during Shoot reconciliation if they have dependency-watchdog.gardener.cloud/meltdown-protection-active annotation on them. by @​ashwani2k [#​12314]

🐛 Bug Fixes

  • [USER] A bug causing the kube-apiserver to crash when anonymous authentication is configured via StructuredAuthentication was fixed. by @​dimityrmirchev [#​12198]
  • [OPERATOR] An issue causing the Shoot credentials rotation status not to correctly get updated, after all the manual in-place pending workers are updated, is now fixed. by @​shafeeqes [#​12306]

🏃 Others

  • [OPERATOR] Enhance DualStack migration docs with knowledge about manual reconciliation. by @​adenitiu [#​12246]
  • [OPERATOR] gardenadm is now published as a container image in release and snapshot builds. by @​timebertt [#​12294]
  • [OPERATOR] Introduce the perses-operator to Garden and Seed clusters. by @​rickardsjp [#​12084]
  • [OPERATOR] Clarified and enforced policy in the Kubernetes version support process to retain only the latest 5 minor versions, improving security by dropping older, unpatched versions more consistently. by @​vlerenc [#​12201]
  • [DEVELOPER] Added the helper function CurrentLifecycleClassification(version) to evaluate the current classification of a given ExpirableVersion. by @​LucaBernstein [#​12298]
  • [DEVELOPER] Introduced new version classifications unavailable and expired. They are not meant to be set manually but should act as computed classification states. by @​LucaBernstein [#​12298]
  • [DEPENDENCY] The following dependencies have been updated:
  • [DEPENDENCY] The following dependencies have been updated:
  • [DEPENDENCY] The following dependencies have been updated:
    • registry.k8s.io/autoscaling/vpa-admission-controller from 1.4.0 to 1.4.1.
    • registry.k8s.io/autoscaling/vpa-recommender from 1.4.0 to 1.4.1.
    • registry.k8s.io/autoscaling/vpa-updater from 1.4.0 to 1.4.1. by @​gardener-ci-robot [#​12239]
  • [DEPENDENCY] The following dependencies have been updated:
  • [DEPENDENCY] The following dependencies have been updated:
    • registry.k8s.io/autoscaling/vpa-admission-controller from 1.3.1 to 1.4.0.
    • registry.k8s.io/autoscaling/vpa-recommender from 1.3.1 to 1.4.0.
    • registry.k8s.io/autoscaling/vpa-updater from 1.3.1 to 1.4.0. by @​gardener-ci-robot [#​12167]
  • [DEPENDENCY] The following dependencies have been updated:

Helm Charts

  • controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.121.0
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.121.0
  • operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.121.0
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.121.0

Container (OCI) Images

  • admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.121.0
  • apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.121.0
  • controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.121.0
  • gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.121.0
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.121.0
  • node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.121.0
  • operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.121.0
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.121.0
  • scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.121.0

v1.120.4

Compare Source

[gardener/gardener]

🐛 Bug Fixes

  • [USER] An issue causing gardenlet to panic during the migration from single-stack IPv4 to dual-stack IPv4, IPv6 when the Shoot is hibernated is now fixed. by @​DockToFuture [#​12435]
  • [DEVELOPER] An issue causing reporting data generated by the testframework to be incompatible with recent elasticsearch/opensearch versions is now fixed. by @​dguendisch [#​12464]
  • [OPERATOR] Fixed an error in BackupBucket reconciliation by replacing StrategicMergePatch with MergePatch to properly handle runtime.RawExtension fields. by @​shafeeqes [#​12460]

Helm Charts

  • controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.120.4
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.120.4
  • operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.120.4
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.120.4

Container (OCI) Images

  • admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.120.4
  • apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.120.4
  • controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.120.4
  • gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.120.4
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.120.4
  • node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.120.4
  • operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.120.4
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.120.4
  • scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.120.4

v1.120.3

Compare Source

[gardener/gardener]

🐛 Bug Fixes

  • [OPERATOR] An issue preventing the cluster-autoscaler to list volumeattachments in now fixed. by @​aaronfern [#​12378]
  • [DEVELOPER] Installing logcheck and typos as custom linters for gardener extensions has been fixed. by @​timuthy [#​12381]

Helm Charts

  • controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.120.3
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.120.3
  • operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.120.3
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.120.3

Container (OCI) Images

  • admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.120.3
  • apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.120.3
  • controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.120.3
  • gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.120.3
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.120.3
  • node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.120.3
  • operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.120.3
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.120.3
  • scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.120.3

v1.120.2

Compare Source

[gardener/gardener]

🐛 Bug Fixes

  • [OPERATOR] An issue causing the Shoot credentials rotation status not to correctly get updated, after all the manual in-place pending workers are updated, is now fixed. by @​shafeeqes [#​12303]

🏃 Others

  • [OPERATOR] gardenadm is now published as a container image in release and snapshot builds. by @​timebertt [#​12291]

Helm Charts

  • controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.120.2
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.120.2
  • operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.120.2
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.120.2

Container (OCI) Images

  • admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.120.2
  • apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.120.2
  • controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.120.2
  • gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.120.2
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.120.2
  • node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.120.2
  • operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.120.2
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.120.2
  • scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.120.2

v1.120.1

Compare Source

[gardener/gardener]

🐛 Bug Fixes

  • [USER] An issue causing the in-place update to fail during credentials rotation without workers rollout is now fixed. by @​shafeeqes [#​12249]

Helm Charts

  • controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.120.1
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.120.1
  • operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.120.1
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.120.1

Container (OCI) Images

  • admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.120.1
  • apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.120.1
  • controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.120.1
  • gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.120.1
  • node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.120.1
  • operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.120.1
  • resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.120.1
  • scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.120.1

v1.120.0

Compare Source

[gardener/gardener]

⚠️ Breaking Changes

  • [DEPENDENCY] The machinecontrollermanager.ProviderSidecarContainer now expects additional shoot and controlPlaneNamespace params. In controlplane webhooks, extensions can use GardenContext.GetCluster to retrieve the shoot from the Cluster object. by @​timebertt [#​12152]
  • [OPERATOR] The graduated and unconditionally enabled ShootForceDeletion feature gate has been removed. If you have references to the feature gate, clean them up before upgrading to this version of Gardener. by @​acumino [#​12078]
  • [OPERATOR] The field .seedConfig.spec.backup.credentialsRef/secretRef will no longer be defaulted in GardenletConfiguration when backup is configured but reference to credentials is not provided. Operators are responsible to provide a valid credentials reference when configuring backup for seeds. Please consult the deploy gardenlet documentation for more information. by @​dimityrmirchev [#​12087]
  • [OPERATOR] The BackupBucket API field spec.secretRef has been deprecated and will be removed in a future version of Gardener in favor of spec.credentialsRef, please adapt your BackupBucket manifests to use the new credentialsRef field. by @​vpnachev [#​12032]
  • [OPERATOR] A new field, clusterCompatibility, has been added to the Extension API. If your landscape is managed by gardener-operator and your garden specifies spec.extensions, please add the garden cluster type value to your corresponding Extension resources. by @​timuthy [#​11982]
  • [DEVELOPER] WorkerPoolHash now includes a new parameter additionalDataInPlace to support hash calculation for worker pools using the InPlace update strategy. by @​acumino [#​12178]
  • [DEVELOPER] The already deprecated github.com/gardener/gardener/pkg/utils/gardener.ReconcileTopologyAwareRoutingMetadata func is now removed. Instead, use github.com/gardener/gardener/pkg/utils/gardener.ReconcileTopologyAwareRoutingSettings. by @​ialidzhikov [#​12091]

📰 Noteworthy

  • [DEVELOPER] The Shoot Pod autoscaling best practices guide now recommends for a container under VPA to not set initial resource requests less than VPA's minAllowed or 10m and 10Mi. 10m and 10Mi are the minimum res

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@gardener-ci-robot
Copy link
Contributor Author

gardener-ci-robot commented Jul 10, 2025

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 38 additional dependencies were updated

Details:

Package Change
golang.org/x/tools v0.33.0 -> v0.34.0
k8s.io/api v0.32.5 -> v0.33.2
k8s.io/apimachinery v0.32.5 -> v0.33.2
k8s.io/client-go v0.32.5 -> v0.33.2
k8s.io/utils v0.0.0-20250502105355-0f33e8f1c979 -> v0.0.0-20250604170112-4c0f3b243397
sigs.k8s.io/controller-runtime v0.20.4 -> v0.21.0
sigs.k8s.io/kind v0.28.0 -> v0.29.0
sigs.k8s.io/yaml v1.4.0 -> v1.5.0
github.com/BurntSushi/toml v1.4.0 -> v1.5.0
github.com/Masterminds/semver/v3 v3.3.1 -> v3.4.0
github.com/cyphar/filepath-securejoin v0.3.6 -> v0.4.1
github.com/emicklei/go-restful/v3 v3.12.1 -> v3.12.2
github.com/fsnotify/fsnotify v1.8.0 -> v1.9.0
github.com/gardener/cert-management v0.17.5 -> v0.17.7
github.com/gardener/etcd-druid/api v0.29.1 -> v0.30.1
github.com/go-openapi/jsonpointer v0.21.0 -> v0.21.1
github.com/go-openapi/swag v0.23.0 -> v0.23.1
github.com/google/gnostic-models v0.6.9 -> v0.7.0
github.com/gorilla/websocket v1.5.3 -> v1.5.4-0.20250319132907-e064f32e3674
github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.82.0 -> v0.83.0
github.com/prometheus/client_model v0.6.1 -> v0.6.2
github.com/prometheus/common v0.63.0 -> v0.65.0
github.com/prometheus/procfs v0.15.1 -> v0.16.1
golang.org/x/crypto v0.38.0 -> v0.39.0
golang.org/x/mod v0.24.0 -> v0.25.0
golang.org/x/text v0.25.0 -> v0.27.0
golang.org/x/time v0.11.0 -> v0.12.0
google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 -> v0.0.0-20250324211829-b45e905df463
google.golang.org/protobuf v1.36.5 -> v1.36.6
helm.sh/helm/v3 v3.17.3 -> v3.18.4
istio.io/api v1.25.2 -> v1.25.3
k8s.io/apiextensions-apiserver v0.32.4 -> v0.33.2
k8s.io/autoscaler/vertical-pod-autoscaler v1.3.1 -> v1.4.1
k8s.io/component-base v0.32.4 -> v0.33.2
k8s.io/kube-aggregator v0.32.4 -> v0.33.2
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff -> v0.0.0-20250701173324-9bd5c66d9911
k8s.io/kubelet v0.32.4 -> v0.33.2
k8s.io/metrics v0.32.4 -> v0.33.2

@gardener-prow gardener-prow bot requested a review from ashwani2k July 10, 2025 11:04
Copy link

gardener-prow bot commented Jul 10, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign unmarshall for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@gardener-prow gardener-prow bot requested a review from unmarshall July 10, 2025 11:04
@gardener-prow gardener-prow bot added do-not-merge/needs-kind Indicates a PR lacks a `kind/foo` label and requires one. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jul 10, 2025
@gardener-prow gardener-prow bot added the cla: yes Indicates the PR's author has signed the cla-assistant.io CLA. label Jul 10, 2025
@gardener-ci-robot gardener-ci-robot changed the title Update module github.com/gardener/gardener to v1.122.1 Update module github.com/gardener/gardener to v1.123.0 Jul 11, 2025
@gardener-ci-robot gardener-ci-robot force-pushed the renovate/g.yxqyang.asia-gardener-gardener-1.x branch from bf225b3 to b539084 Compare July 11, 2025 10:38
@gardener-ci-robot gardener-ci-robot changed the title Update module github.com/gardener/gardener to v1.123.0 Update module github.com/gardener/gardener to v1.123.0 - autoclosed Jul 11, 2025
@gardener-ci-robot gardener-ci-robot deleted the renovate/g.yxqyang.asia-gardener-gardener-1.x branch July 11, 2025 16:01
@gardener-ci-robot gardener-ci-robot changed the title Update module github.com/gardener/gardener to v1.123.0 - autoclosed Update module github.com/gardener/gardener to v1.123.0 Jul 12, 2025
@gardener-ci-robot gardener-ci-robot force-pushed the renovate/g.yxqyang.asia-gardener-gardener-1.x branch from ff0f190 to b539084 Compare July 12, 2025 00:40
Copy link

gardener-prow bot commented Jul 12, 2025

@gardener-ci-robot: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-dependency-watchdog-unit b539084 link true /test pull-dependency-watchdog-unit

Full PR test history. Your PR dashboard. Command help for this repository.
Please help us cut down on flakes by linking this test failure to an open flake report or filing a new flake report if you can't find an existing one. Also see our testing guideline for how to avoid and hunt flakes.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@gardener-ci-robot gardener-ci-robot changed the title Update module github.com/gardener/gardener to v1.123.0 Update module github.com/gardener/gardener to v1.123.0 - autoclosed Jul 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
cla: yes Indicates the PR's author has signed the cla-assistant.io CLA. do-not-merge/needs-kind Indicates a PR lacks a `kind/foo` label and requires one. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants