Skip to content

Commit bf03c84

Browse files
lexfreilexfrei
authored
chore(deps): move to the Kubernetes 1.37 libraries without the apimachinery fork (#4473)
## What this PR does This moves the root module's `k8s.io/*` from v0.35 to v0.37.1 and controller-runtime from v0.23 to v0.25.1, and drops the `k8s.io/apimachinery` fork on the way. Supersedes #3001, #4467 and #4472; those were a stack of the same commits. The four commits are meant to be read one by one, and each builds and passes the tests on its own: 1. **Plain watches stop getting the initial-events-end bookmark.** The apiserver defaults `sendInitialEvents=true` onto any watch with an empty or `0` resourceVersion and leaves bookmarks off, and our aggregated storages took that flag alone as a WatchList request. From `k8s.io/apiserver` v0.36 the watch handler compiled into cozystack-api panics on that bookmark, so `kubectl get -w` on any cozystack-api resource would die after the bump. The marker now needs both flags, the same condition the watch cache uses. There are tests per storage and one through the real handler chain. 2. **The apimachinery fork goes.** Every apps kind shares the `Application` Go type, and stock `Scheme.ConvertToVersion` picks the first kind registered for it. The fork patched that; the apps group now encodes through a serializer that keeps the kind the object carries. A handler-chain test covers create, get, list, update, watch, apply and table for two kinds and fails without it. 3. **MutatingAdmissionPolicy stays out of admission.** From v0.36 the plugin is on by default and refuses every write until it has synced `mutatingadmissionpolicies`, which cozystack-api has no RBAC to list and which clusters before 1.36 do not serve. Without this, every create, update and delete would fail after the bump. It is also re-applied in `Complete`, since `--disable-admission-plugins` replaces the list. 4. **The bump itself**, with the regenerated clients, openapi and strategy CRDs. Commits 2 and 4 are where the review effort goes; 1 and 3 are small. Known changes in behaviour: - Without the fork, the row objects of a Table requested with `includeObject=Object` carry the first registered app kind. kubectl asks for that only with `--sort-by`, and it sorts on fields, not on the kind. Nothing at this layer can fix it, because the handler converts through `APIGroupInfo.Scheme`, a concrete `*runtime.Scheme`. Admission webhooks and ValidatingAdmissionPolicy still see the right kind. - The alpha PodSpec field `workloadRef` became `schedulingGroup` upstream. Once the new strategy CRDs are applied, the apiserver prunes `workloadRef` from stored strategies it serves, and their next write erases it. It only ever worked behind an alpha feature gate. The branch is rebased onto the Renovate rollup (#4447), with `go mod tidy` and codegen rerun on top of it. ### Screenshots No UI changes. ### Downstream repositories - [x] No downstream repository is affected by this change - [ ] [cozystack/website](https://github.com/cozystack/website) - follow-up: - [ ] [cozystack/terraform-provider-cozystack](https://github.com/cozystack/terraform-provider-cozystack) - follow-up: - [ ] [cozystack/ansible-cozystack](https://github.com/cozystack/ansible-cozystack) - follow-up: - [ ] [cozystack/ccp](https://github.com/cozystack/ccp) - follow-up: - [ ] [cozystack/talm](https://github.com/cozystack/talm) - follow-up: - [ ] [cozystack/cozyhr](https://github.com/cozystack/cozyhr) - follow-up: - [ ] [cozystack/cozy-proxy](https://github.com/cozystack/cozy-proxy) - follow-up: - [ ] [cozystack/cozystack-telemetry-server](https://github.com/cozystack/cozystack-telemetry-server) - follow-up: - [ ] [cozystack/external-apps-example](https://github.com/cozystack/external-apps-example) - follow-up: - [ ] [cozystack/examples](https://github.com/cozystack/examples) - follow-up: - [ ] [cozystack/community](https://github.com/cozystack/community) - follow-up: ### Release note ```release-note chore(deps): cozystack-api and the controllers build against the Kubernetes 1.37 libraries without the apimachinery fork. Plain watches no longer receive the WatchList initial-events-end bookmark, and objects in Table rows requested with includeObject=Object may carry another app's kind. ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Application API responses now preserve the requested resource kind across operations, including lists and watches. * Backup strategy resources support additional Kubernetes pod settings, including probe protocols, volume ownership options, and scheduling groups. * Backup strategy schemas include updated Kubernetes pod fields and descriptions. * **Bug Fixes** * Initial-event watch bookmarks are sent only when requested; plain watches continue without an ending bookmark. * Mutating Admission Policy is disabled by default, including when admission plugin options are customized. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2 parents 9809b22 + e62f510 commit bf03c84

38 files changed

Lines changed: 2815 additions & 552 deletions

‎.github/renovate.json‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -84,12 +84,6 @@
8484
"matchManagers": ["gomod"],
8585
"matchPackageNames": ["kubevirt.io/csi-driver"],
8686
"enabled": false
87-
},
88-
{
89-
"description": "k8s.io/apimachinery is replaced by the cozystack/apimachinery fork at a pseudo-version cut from a rebased branch that carries the ConvertToVersion patch. The fork's release tags are stale upstream mirrors, so Renovate proposes one of them as an 'update' that is in fact a downgrade dropping the patch. Advance the replace by hand whenever the fork is rebased onto a new Kubernetes line.",
90-
"matchManagers": ["gomod"],
91-
"matchPackageNames": ["github.com/cozystack/apimachinery"],
92-
"enabled": false
9387
}
9488
]
9589
}

‎GOVERNANCE.md‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,9 @@ The Cozystack maintainers are maintainers of every sub-project by default (see [
2929

3030
**Project infrastructure** carries no shipped code: [website](https://github.com/cozystack/website), [community](https://github.com/cozystack/community) (design proposals and meeting notes), [external-apps-example](https://github.com/cozystack/external-apps-example) (the reference third-party application catalogues are built from), [ccp](https://github.com/cozystack/ccp), [.github](https://github.com/cozystack/.github) and [.project](https://github.com/cozystack/.project) (CNCF project metadata).
3131

32-
**Forks of upstream projects** are held for contributing changes back, or were held for that purpose and have since been archived. One is load-bearing and is called out below; the rest are not built into the distribution, which takes those components from their upstreams directly.
32+
**Forks of upstream projects** are held for contributing changes back, or were held for that purpose and have since been archived. None is built into the distribution, which takes those components from their upstreams directly.
3333

34-
Three things about this organisation are worth stating plainly rather than leaving to be discovered.
35-
36-
**One fork is compiled into the product.** [cozystack/apimachinery](https://github.com/cozystack/apimachinery) is a fork of `kubernetes/apimachinery` carrying a single 34-line patch to `pkg/runtime/scheme.go` on top of the released `v0.35.0` tree, applied through a `replace` directive in `go.mod`. The same fix is proposed upstream as [kubernetes/kubernetes#135537](https://github.com/kubernetes/kubernetes/pull/135537); the fork exists only until that merges, and is pinned to a branch tracking the upstream release rather than to the fork's own trunk.
34+
Two things about this organisation are worth stating plainly rather than leaving to be discovered.
3735

3836
**Four repositories are private**, and none of them contributes to the distribution: `security-scanner` (automated CVE monitoring, private because it holds pre-disclosure vulnerability state), `infrastructure` (the organisation's own CI infrastructure-as-code, private because it holds cloud credentials and account topology), one GitHub-created security-advisory workspace, and `talos-preboot-iso`, an archived prototype. Nothing an adopter installs is built from a repository they cannot read.
3937

‎go.mod‎

Lines changed: 16 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -21,23 +21,24 @@ require (
2121
github.com/prometheus/client_golang v1.24.1
2222
github.com/robfig/cron/v3 v3.0.1
2323
github.com/spf13/cobra v1.10.2
24+
github.com/spf13/pflag v1.0.10
2425
github.com/vmware-tanzu/velero v1.18.3
2526
go.uber.org/zap v1.28.0
2627
gomodules.xyz/jsonpatch/v2 v2.5.0
27-
k8s.io/api v0.35.0
28-
k8s.io/apiextensions-apiserver v0.35.0
29-
k8s.io/apimachinery v0.35.2
30-
k8s.io/apiserver v0.35.0
31-
k8s.io/client-go v0.35.0
32-
k8s.io/component-base v0.35.0
28+
k8s.io/api v0.37.1
29+
k8s.io/apiextensions-apiserver v0.37.1
30+
k8s.io/apimachinery v0.37.1
31+
k8s.io/apiserver v0.37.1
32+
k8s.io/client-go v0.37.1
33+
k8s.io/component-base v0.37.1
3334
k8s.io/klog/v2 v2.140.0
34-
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
35+
k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad
3536
k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3
3637
sigs.k8s.io/container-object-storage-interface-api v0.1.0
37-
sigs.k8s.io/controller-runtime v0.23.1
38+
sigs.k8s.io/controller-runtime v0.25.1
3839
sigs.k8s.io/gateway-api v1.4.1
3940
sigs.k8s.io/randfill v1.0.0
40-
sigs.k8s.io/structured-merge-diff/v6 v6.3.2-0.20260122202528-d9cc6641c482
41+
sigs.k8s.io/structured-merge-diff/v6 v6.4.2
4142
sigs.k8s.io/yaml v1.6.0
4243
)
4344

@@ -79,17 +80,15 @@ require (
7980
github.com/go-openapi/swag/yamlutils v0.29.2 // indirect
8081
github.com/go-openapi/testify/enable/yaml/v2 v2.8.0 // indirect
8182
github.com/go-openapi/testify/v2 v2.8.0 // indirect
82-
github.com/gogo/protobuf v1.3.2 // indirect
8383
github.com/golang/protobuf v1.5.4 // indirect
84-
github.com/google/btree v1.1.3 // indirect
8584
github.com/google/cel-go v0.29.2 // indirect
8685
github.com/google/gnostic-models v0.7.1 // indirect
8786
github.com/google/go-cmp v0.7.0 // indirect
8887
github.com/google/pprof v0.0.0-20260906184651-6331bc6350fe // indirect
8988
github.com/google/uuid v1.6.0 // indirect
9089
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
90+
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0 // indirect
9191
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.4 // indirect
92-
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
9392
github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
9493
github.com/inconshreveable/mousetrap v1.1.0 // indirect
9594
github.com/json-iterator/go v1.1.12 // indirect
@@ -99,21 +98,17 @@ require (
9998
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
10099
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
101100
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
102-
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
103101
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
104102
github.com/prometheus/client_model v0.6.3 // indirect
105103
github.com/prometheus/common v0.71.0 // indirect
106104
github.com/prometheus/procfs v0.22.0 // indirect
107105
github.com/rogpeppe/go-internal v1.16.0 // indirect
108106
github.com/sirupsen/logrus v1.10.2 // indirect
109-
github.com/spf13/pflag v1.0.10 // indirect
110-
github.com/stretchr/objx v0.5.3 // indirect
111107
github.com/tidwall/match v1.2.0 // indirect
112108
github.com/x448/float16 v0.8.4 // indirect
113-
go.etcd.io/etcd/api/v3 v3.6.15 // indirect
114-
go.etcd.io/etcd/client/pkg/v3 v3.6.15 // indirect
115-
go.etcd.io/etcd/client/v3 v3.6.15 // indirect
116-
go.etcd.io/etcd/server/v3 v3.6.15 // indirect
109+
go.etcd.io/etcd/api/v3 v3.7.0 // indirect
110+
go.etcd.io/etcd/client/pkg/v3 v3.7.0 // indirect
111+
go.etcd.io/etcd/client/v3 v3.7.0 // indirect
117112
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
118113
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.71.0 // indirect
119114
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 // indirect
@@ -145,10 +140,8 @@ require (
145140
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
146141
gopkg.in/inf.v0 v0.9.1 // indirect
147142
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
148-
k8s.io/kms v0.35.0 // indirect
143+
k8s.io/kms v0.37.1 // indirect
144+
k8s.io/streaming v0.37.1 // indirect
149145
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.36.0 // indirect
150146
sigs.k8s.io/json v0.0.0-20260909141634-11ed52e25bc5 // indirect
151147
)
152-
153-
// See: issues.k8s.io/135537
154-
replace k8s.io/apimachinery => github.com/cozystack/apimachinery v0.0.0-20260710062224-763e1451713b

0 commit comments

Comments
 (0)