Update module github.com/gardener/gardener to v1.116.4 [SECURITY] - #211
Open
23t-machine-user wants to merge 1 commit into
Open
Update module github.com/gardener/gardener to v1.116.4 [SECURITY]#21123t-machine-user wants to merge 1 commit into
23t-machine-user wants to merge 1 commit into
Conversation
Collaborator
Author
ℹ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
23t-machine-user
force-pushed
the
renovate/go-github.com-gardener-gardener-vulnerability
branch
3 times, most recently
from
June 3, 2025 10:04
c21ba9c to
c3f9a82
Compare
23t-machine-user
force-pushed
the
renovate/go-github.com-gardener-gardener-vulnerability
branch
2 times, most recently
from
June 5, 2025 19:03
c8c0f40 to
fe94fb1
Compare
23t-machine-user
force-pushed
the
renovate/go-github.com-gardener-gardener-vulnerability
branch
2 times, most recently
from
June 19, 2025 18:04
d97ef3b to
49bcce4
Compare
23t-machine-user
force-pushed
the
renovate/go-github.com-gardener-gardener-vulnerability
branch
from
June 27, 2025 15:36
49bcce4 to
689a4de
Compare
23t-machine-user
force-pushed
the
renovate/go-github.com-gardener-gardener-vulnerability
branch
2 times, most recently
from
July 11, 2025 09:49
1b04866 to
e7d4590
Compare
23t-machine-user
force-pushed
the
renovate/go-github.com-gardener-gardener-vulnerability
branch
3 times, most recently
from
July 22, 2025 19:48
543a14e to
68b7f57
Compare
23t-machine-user
force-pushed
the
renovate/go-github.com-gardener-gardener-vulnerability
branch
from
August 6, 2025 18:43
68b7f57 to
8872009
Compare
23t-machine-user
force-pushed
the
renovate/go-github.com-gardener-gardener-vulnerability
branch
5 times, most recently
from
August 20, 2025 19:48
722b198 to
866208f
Compare
23t-machine-user
force-pushed
the
renovate/go-github.com-gardener-gardener-vulnerability
branch
5 times, most recently
from
August 27, 2025 22:22
f7a6495 to
175dd84
Compare
23t-machine-user
force-pushed
the
renovate/go-github.com-gardener-gardener-vulnerability
branch
from
August 28, 2025 15:35
175dd84 to
88e056f
Compare
23t-machine-user
force-pushed
the
renovate/go-github.com-gardener-gardener-vulnerability
branch
3 times, most recently
from
October 7, 2025 08:50
862fe02 to
0b51b17
Compare
23t-machine-user
force-pushed
the
renovate/go-github.com-gardener-gardener-vulnerability
branch
4 times, most recently
from
October 27, 2025 19:48
d2d78ce to
3c4ccf8
Compare
23t-machine-user
force-pushed
the
renovate/go-github.com-gardener-gardener-vulnerability
branch
from
October 30, 2025 11:22
3c4ccf8 to
d7a8539
Compare
23t-machine-user
force-pushed
the
renovate/go-github.com-gardener-gardener-vulnerability
branch
2 times, most recently
from
November 12, 2025 17:04
fcd4c20 to
f1e665f
Compare
23t-machine-user
force-pushed
the
renovate/go-github.com-gardener-gardener-vulnerability
branch
from
November 18, 2025 12:06
f1e665f to
24561b8
Compare
23t-machine-user
force-pushed
the
renovate/go-github.com-gardener-gardener-vulnerability
branch
from
November 25, 2025 14:39
24561b8 to
b66e415
Compare
23t-machine-user
force-pushed
the
renovate/go-github.com-gardener-gardener-vulnerability
branch
from
December 4, 2025 01:10
b66e415 to
05f8bf5
Compare
Collaborator
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
23t-machine-user
force-pushed
the
renovate/go-github.com-gardener-gardener-vulnerability
branch
3 times, most recently
from
December 10, 2025 05:38
0953f3b to
89ffc4c
Compare
23t-machine-user
force-pushed
the
renovate/go-github.com-gardener-gardener-vulnerability
branch
6 times, most recently
from
December 23, 2025 00:42
dc4f6c8 to
34d1bb7
Compare
23t-machine-user
force-pushed
the
renovate/go-github.com-gardener-gardener-vulnerability
branch
6 times, most recently
from
January 12, 2026 22:37
d4e10c3 to
2f4f69c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.106.1→v1.116.4Gardener allows bypassing project secret validation which can lead to privilege escalation
CVE-2025-47283 / GHSA-3hw7-qj9h-r835
More information
Details
A security vulnerability was discovered in Gardener that could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed.
Am I Vulnerable?
This CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters.
Affected Components
gardener/gardenerAffected Versions
Fixed Versions
How do I mitigate this vulnerability?
Update to a fixed version.
Severity
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Gardener allows metadata injection for a project secret which can lead to privilege escalation
CVE-2025-47284 / GHSA-9x73-87fh-54w9
More information
Details
A security vulnerability was discovered in the
gardenletcomponent of Gardener. It could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed.Am I Vulnerable?
This CVE affects all Gardener installations where https://github.com/gardener/gardener-extension-provider-gcp is in use.
Affected Components
gardener/gardener(gardenlet)Affected Versions
Fixed Versions
How do I mitigate this vulnerability?
Update to a fixed version.
Severity
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
gardener/gardener (github.com/gardener/gardener)
v1.116.4Compare Source
[gardener/gardener]
🛡️ Important Security Information
This release contains changes that address the following vulnerabilities:
CVE-2025-47284: Metadata injection for a project secret can lead to privilege escalation
A security vulnerability was discovered in the gardenlet component of Gardener. It could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed.
Affected Versions:
Fixed Versions:
CVSS Rating: Critical (9.9) CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:F/RL:U/RC:C/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:L/MUI:N/MS:C/MC:H/MI:H/MA:H
CVE-2025-47283: Bypassing project secret validation can lead to privilege escalation
A security vulnerability was discovered in Gardener that could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed.
Affected Versions:
Fixed Versions:
CVSS Rating: Critical (9.9) CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/MA:H
🐛 Bug Fixes
[OPERATOR]A bug preventing thesystem:serviceaccount:kube-system:gardener-internalservice account, used bygardener-operator, to label restricted resources was fixed. by @dimityrmirchev [#12067]🏃 Others
[DEVELOPER]Theadmission-localdeployment was fixed to work with KinD based test setup. by @timuthy [#12108][OPERATOR]Set minAllowed CPU to150mfor prometheus-shoot to avoid frequent evictions by @voelzmo [#12080][OPERATOR]A new check ensures that only owners and project members with a UAM role are allowed to modify the project owner. by @timuthy [#12081][OPERATOR]Annotations and labels are now ignored when creating referenced resources in the shoot control plane namespaces in seed clusters. by @rfranzke [#12068][OPERATOR]It is now ensured that extension admission webhooks have validatedWorkloadIdentitys/Secrets referenced inShoots. by @rfranzke [#12077]Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.116.4europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.116.4europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.116.4europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.116.4Container (OCI) Images
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.116.4europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.116.4europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.116.4europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.116.4europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.116.4europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.116.4europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.116.4europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.116.4v1.116.3Compare Source
[gardener/gardener]
🏃 Others
[OPERATOR]Fix an issue where envoy filters to handle proxy-protocol are not deployed, even if configured for istio load-balancers. by @axel7born [#11920]Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.116.3europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.116.3europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.116.3europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.116.3Docker Images
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.116.3europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.116.3europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.116.3europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.116.3europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.116.3europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.116.3europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.116.3europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.116.3v1.116.2Compare Source
[gardener/gardener]
🐛 Bug Fixes
[OPERATOR]WhenIstioTLSTerminationfeature gate is enabled the apiserver-proxy related EnvoyFilter is not deployed for the virtual-garden anymore. by @oliver-goetz [#11896]🏃 Others
[OPERATOR]Shoots that are currently in deletion now get ignored by theRemoveAPIServerProxyLegacyPortfeature gate validation. by @Wieneo [#11887][OPERATOR]Deploy MCM with higherconcurrent-syncs,kube-api-qpsandkube-api-burst. by @hendrikKahl [#11880]Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.116.2europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.116.2europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.116.2europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.116.2Docker Images
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.116.2europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.116.2europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.116.2europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.116.2europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.116.2europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.116.2europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.116.2europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.116.2v1.116.1Compare Source
[gardener/gardener]
🐛 Bug Fixes
[USER]An issue causing thecloudproviderSecret to contain both static credentials and workload identity config, which are mutually exclusive, when migrating to workload identity is now fixed. by @dimityrmirchev [#11847][DEVELOPER]Fix malformed file path error ongo get github.com/gardener/gardener@v1.116.0by @MartinWeindel [#11820]Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.116.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.116.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.116.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.116.1Docker Images
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.116.1europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.116.1europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.116.1europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.116.1europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.116.1europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.116.1europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.116.1europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.116.1v1.116.0Compare Source
[gardener/gardener]
[DEVELOPER]/hack/generate-crds.shwill no longer generate any CRDs withgroup=druid.gardener.cloud. One must use etcd-druid API to get the CRDs that serve as a single source of truth for all etcd-druid CRDs. by @unmarshall [#11545][DEVELOPER]The extensionclassfield in the generic extension controller was removed. Please use the new fieldclassesinstead. by @timuthy [#11764][OPERATOR]The etcd-druid's GA-edUseEtcdWrapperfeature gate is removed. It is now unconditionally enabled. It should no longer be passed in gardenlet configuration. Before upgrading to this version of Gardener, check your gardenlet configuration and make sure that it does not specify the etcd-druid'sUseEtcdWrapperfeature gate. by @unmarshall [#11545][OPERATOR]The default etcd-main storage is increased from10Gito25Gi. The etcd-main storage capacity is mutated by provider extensions. Before upgrading to this version of Gardener, make sure the provider extensions which you use mutate the etcd-main capacity. Otherwise, the default storage capacity change in Gardener could be unexpected or breaking. by @unmarshall [#11545][OPERATOR]Please note, if you configurespec.extensionsin yourGardenresource:gardener-operatoradds agarden-prefix to all extension resources configured via theGarden. Existing extension resources (not prefixed) will be deleted automatically at the end of the reconciliation. Another, manually triggeredGardenreconciliation might be required to reach the desired state of the extension again. by @timuthy [#11764]📰 Noteworthy
[OPERATOR]NodeAgentAuthorizerfeature gate has been promoted to beta and is now enabled by default. by @oliver-goetz [#11757][OPERATOR]The feature gateNewVPNhas been graduated toGA. It was already enabled by default and can now no longer be turned off. The feature gate will be removed in a future release. by @domdom82 [#11714]✨ New Features
[OPERATOR]Extensions can be configured forSeeds viaspec.extensionsto deploy extensions for the seed cluster. Before activating this configuration, please first confirm that the corresponding extension is compatible with the seed use-case. by @timuthy [#11764]🐛 Bug Fixes
[OPERATOR]TheNetworkPolicycontroller part ofgardener-resource-managerdoes no longer attempt to create resources in terminating namespaces. by @rfranzke [#11808][OPERATOR]An issue causing Shoot reconciliation to fail withno relationship foundwhen the referenced SecretBinding/CredentialsBinding is forcefully deleted (its finalizer is removed by the end user) and then recreated with the same name is now fixed. gardener-admission-controller's authorisation graph is now updated for a Shoot after forceful deletion and recreation of the referenced Secretbinding/CredentialsBinding. by @MartinWeindel [#11461][OPERATOR]If the computed pod label selector contains keys exceeding 63 characters, theNetworkPolicycontroller part ofgardener-resource-managerdoes now shorten them to make sure they can actually get created. Previously, it failed trying to create them infinitely, resulting in high CPU load in large clusters. by @rfranzke [#11808][OPERATOR]Keepoperator.gardener.cloud.ExtensionconditionRequiredRuntime=trueuntil deletion ofextensions.gardener.cloud.Extensions has completed. by @MartinWeindel [#11696][OPERATOR]Fix a bug that appears when migrating aShootbetweenSeeds by introducing a new controller, which manages aShootStatefinalizer preventing early object deletions. by @vitanovs [#11491]🏃 Others
[DEVELOPER]Remove the double maintenance of CRDs defined in etcd-druid. Now, gardenlet is using the etcd-druid CRD APIs to get the CRDs ensuring one single source of truth. by @unmarshall [#11545][DEVELOPER]Remove the dependency on thegithub.com/gardener/etcd-druidmodule and instead introduce dependency ongithub.com/gardener/etcd-druid/apimodule. by @unmarshall [#11545][OPERATOR]Add optional argument--custom-package <group>=<package>togenerate-crds.shscript. by @MartinWeindel [#11702][OPERATOR]Remove unnecessary istio loadbalancer annotations from the ClusterIP kube-apiserver service. by @kon-angelo [#11728][OPERATOR]Increase VPA client-side rate limits to200qps and250burst. by @voelzmo [#11748][DEPENDENCY]The following dependencies have been updated:envoyproxy/envoyfromv1.33.1tov1.33.2. Release Notes by @gardener-ci-robot [#11751][DEPENDENCY]The following dependencies have been updated:quay.io/prometheus/node-exporterfromv1.9.0tov1.9.1. by @gardener-ci-robot [#11784][DEPENDENCY]The following dependencies have been updated:gardener/etcd-druidfromv0.27.0tov0.28.0. Release Notesgithub.com/gardener/etcd-druidfromv0.27.0tov0.28.0. by @unmarshall [#11545][DEPENDENCY]The following dependencies have been updated:quay.io/kiwigrid/k8s-sidecarfrom1.30.2to1.30.3. by @gardener-ci-robot [#11766][DEPENDENCY]The following dependencies have been updated:envoyproxy/envoyfromv1.33.0tov1.33.1. Release Notes by @gardener-ci-robot [#11720][DEPENDENCY]The following dependencies have been updated:quay.io/coreos/etcdfromv3.4.36tov3.5.20. by @gardener-ci-robot [#11756][DEPENDENCY]The following dependencies have been updated:quay.io/coreos/etcdfromv3.4.34tov3.4.36. by @gardener-ci-robot [#11755]Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.116.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.116.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.116.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.116.0Docker Images
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.116.0europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.116.0europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.116.0europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.116.0europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.116.0europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.116.0europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.116.0europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.116.0v1.115.4Compare Source
[gardener/gardener]
🏃 Others
[OPERATOR]Fix an issue where envoy filters to handle proxy-protocol are not deployed, even if configured for istio load-balancers. by @axel7born [#11921]Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.115.4europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.115.4europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.115.4europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.115.4Docker Images
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.115.4europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.115.4europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.115.4europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.115.4europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.115.4europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.115.4europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.115.4europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.115.4v1.115.3Compare Source
[gardener/gardener]
🐛 Bug Fixes
[OPERATOR]WhenIstioTLSTerminationfeature gate is enabled the apiserver-proxy related EnvoyFilter is not deployed for the virtual-garden anymore. by @oliver-goetz [#11895][USER]An issue causing thecloudproviderSecret to contain both static credentials and workload identity config, which are mutually exclusive, when migrating to workload identity is now fixed. by @dimityrmirchev [#11848]🏃 Others
[OPERATOR]Shoots that are currently in deletion now get ignored by theRemoveAPIServerProxyLegacyPortfeature gate validation. by @Wieneo [#11888][OPERATOR]Deploy MCM with higherconcurrent-syncs,kube-api-qpsandkube-api-burst. by @hendrikKahl [#11881]Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.115.3europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.115.3europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.115.3europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.115.3Docker Images
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.115.3europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.115.3europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.115.3europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.115.3europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.115.3europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.115.3europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.115.3europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.115.3v1.115.2Compare Source
[gardener/gardener]
🐛 Bug Fixes
[DEVELOPER]An issue causing the Shoot logging test-machinery integration tests to fail is now fixed. by @ialidzhikov [#11798][OPERATOR]The step which deploys the sourceBackupEntryduring therestorephase of control plane migration now depends on the successful deployment of theShoot's control plane namespace. This fixes a potential race condition which could cause thesource-etcd-backupSecret to not be deployed in theShoot's control plane namespace and the subsequent step which copies etcd backups to time out. by @plkokanov [#11812]🏃 Others
[DEVELOPER]An issue causing theshould copy data to podVPN tunnel test-machinery integration test to fail is now fixed. by @ialidzhikov [#11804]Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.115.2europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.115.2europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.115.2europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.115.2Docker Images
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.115.2europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.115.2europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.115.2europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.115.2europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.115.2europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.115.2europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.115.2europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.115.2v1.115.1Compare Source
[gardener/gardener]
🏃 Others
[DEPENDENCY]The following dependencies have been updated:registry.k8s.io/ingress-nginx/controller-chrootfromv1.12.0tov1.12.1. by @gardener-ci-robot [#11739][DEPENDENCY]The following dependencies have been updated:registry.k8s.io/ingress-nginx/controller-chrootfromv1.11.4tov1.11.5. by @gardener-ci-robot [#11737][DEPENDENCY]The following dependencies have been updated:gardener/machine-controller-managerfromv0.57.0tov0.57.1. Release Notesgithub.com/gardener/machine-controller-managerfromv0.57.0tov0.57.1. by @gardener-ci-robot [#11725]Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.115.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.115.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.115.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.115.1Docker Images
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.115.1europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.115.1europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.115.1europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.115.1europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.115.1europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.115.1europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.115.1europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.115.1v1.115.0Compare Source
[gardener/gardener]
[OPERATOR]PodTopologySpreadConstraintswebhook in thegardener-resource-manageris disabled for seeds unconditionally and for shoots which doesn't disable kubernetes feature gateMatchLabelKeysInPodTopologySpreadexplicitly. by @shafeeqes [#11497][OPERATOR]TokenInvalidatorcontroller and webhook in thegardener-resource-managerare removed. by @shafeeqes [#11497][DEVELOPER]Thegithub.com/gardener/gardener/pkg/utils/gardener.ReconcileTopologyAwareRoutingMetadatafunc in deperecated in favor ofgithub.com/gardener/gardener/pkg/utils/gardener.ReconcileTopologyAwareRoutingSettings. by @ialidzhikov [#11178]📰 Noteworthy
[OPERATOR]TheServiceTrafficDistributionfeature is being used on to make Services topology-aware when the runtime Kubernetes version is 1.31+. by @ialidzhikov [#11178][DEVELOPER]fluent-operatorAPIs and CRDs are updated from v2 to v3 by @nickytd [#11673][USER]TheupdateStrategyof existing machine images in aCloudProfilecan now be overridden in aNamespacedCloudProfile. by @LucaBernstein [#11550]✨ New Features
[OPERATOR]TheinjectGardenKubeconfigfield is defaulted totruefor extensions responsible forWorkerresources when registered via theoperator.gardener.cloud/v1alpha1.ExtensionAPI. by @rfranzke [#11658][OPERATOR]You can use.spec.virtualCluster.gardener.gardenerAPIServer.goAwayChancein theGardenAPI to specify the probability for randomly closing a connection (GOAWAY) in order to prevent HTTP/2 clients from getting stuck on a singlegardener-apiserver. by @rfranzke [#11551][USER]NamespacedCloudProfile.spec.limits.maxNodesTotalcan be used to override the limit of the maximum number of nodes a shoot can have during runtime, as defined in the parentCloudProfile. See the documentation for more details. by @LucaBernstein [#11647][USER]If the Gardener operator has defined a control plane wildcard certificate, the.status.advertisedAddressesof theShootcontain an entry with an endpoint secured by this certificate. Note that this endpoint is specific to the seed cluster theShootis scheduled to. Read all about it in this document. by @rfranzke [#11612][USER]The feature gateNewVPNhas been graduated toBetaand is now enabled by default. by @ScheererJ [#11693]🐛 Bug Fixes
[USER]A bug causing race condition in thekube-proxypod related to concurrent modifications of iptables rules was fixed. by @AleksandarSavchev [#11668][USER]Fix authentication panel in API server Plutono dashboard for Shoot clusters by @chrkl [#11667]🏃 Others
[DEPENDENCY]The following dependencies have been updated:quay.io/kiwigrid/k8s-sidecarfrom1.30.1to1.30.2. by @gardener-ci-robot [#11628][DEPENDENCY]The following dependencies have been updated:gardener/machine-controller-managerfromv0.56.1tov0.57.0. Release Notesgithub.com/gardener/machine-controller-managerfromv0.56.1tov0.57.0. by @gardener-ci-robot [#11620][DEPENDENCY]The following dependencies have been updated:credativ/valifromv2.2.21tov2.2.22. Release Notes by @gardener-ci-robot [#11664][DEPENDENCY]The following dependencies have been updated:gardener/gardener-metrics-exporterfrom0.36.0to0.37.0. Release Notes by @gardener-ci-robot [#11677][DEPENDENCY]The following dependencies have been updated:credativ/plutonofromv7.5.36tov7.5.37. Release Notes by @gardener-ci-robot [#11663][DEPENDENCY]The following dependencies have been updated:quay.io/prometheus/alertmanagerfromv0.28.0tov0.28.1. by @gardener-ci-robot [#11625][OPERATOR]Added fieldOCIRepository.PullSecretReffor pulling helm charts from repositories with access restrictions. by @MartinWeindel [#11324][OPERATOR]The ports used by provider-local can now be specified via helm values. by @ScheererJ [#11700][OPERATOR]CreateShoottestdefinition exposesminAllowedoptions for control plane by @hendrikKahl [#11637][OPERATOR]The gardener-node-agent is now able to deal with the new version v3 of containerd's configuration file/etc/containerd/config.toml. As this new version of the configuration file comes with a new structure of certain configuration options, gardener-node-agent must be able to write configuration changes to different locations within the file based on its version. If it detects this config file to be version 3, it will write all relevant configuration changes to the new config keys. In addition, for any plugins inserted through an OSCPluginConfiguration, it will check if its path matches a typical v2 compliant path prefix and will translate it to the equivalent v3 compliant path prefix. by @MrBatschner [#11623][OPERATOR]Upgrade Prometheus to v3.2 by @vicwicker [#11552][OPERATOR]Garden and Seed cluster component containers, which do not require privilege escalations, now forbid privilege escalation explicitly. by @georgibaltiev [#11519][OPERATOR]Thegardener/autoscalerimage has been updated tov1.31.0. Release Notes by @aaronfern [#11646][OPERATOR]Enable theVerticalPodAutoscalerCappedRecommendationalerts by @vicwicker [#11622][OPERATOR]gardener-apiserveris now deployed with a fixed number of replicas (HA configuration: 3, non-HA configuration: 2). It does not useHPAanymore. by @oliver-goetz [#11684][OPERATOR]gardener-operatorrejects deletion requests forExtensions deemed required for the landscape. by @timuthy [#11606][DEVELOPER]TheObjectNames()function ofgithub.com/gardener/gardener/test/utils/matcherscan be used to modifyobject.Objectlists to a[]stringwith their name. This is useful in tests to avoid usinggstructmatchers that bloat the test output. by @tobschli [#11616][DEVELOPER]The component checklist now recommends settingrevisionHistoryLimit=2forDaemonSets as well. by @rfranzke [#11659][DEVELOPER]Allow to configure bootstrapping control plane nodes with controller installations by settinghostNetwork,replicas,tolerationsand usable ports. by @ScheererJ [#11527][DEVELOPER]An issue causing the VPN tunnel test-machinery integration test to fail is now fixed. by @ialidzhikov [#11716]📖 Documentation
[USER]Add documentation on how to federate metrics from the shoot Prometheus into an external Prometheus instance by @vicwicker [#11609]Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.115.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.115.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.115.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.115.0Docker Images
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.115.0europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.115.0europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.115.0europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.115.0europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.115.0europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.115.0europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.115.0europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.115.0v1.114.3Compare Source
[gardener/gardener]
🐛 Bug Fixes
[OPERATOR]WhenIstioTLSTerminationfeature gate is enabled the apiserver-proxy related EnvoyFilter is not deployed for the virtual-garden anymore. by @oliver-goetz [#11894][USER]An issue causing thecloudproviderSecret to contain both static credentials and workload identity config, which are mutually exclusive, when migrating to workload identity is now fixed. by @dimityrmirchev [#11849]🏃 Others
[OPERATOR]Shoots that are currently in deletion now get ignored by theRemoveAPIServerProxyLegacyPortfeature gate validation. by @Wieneo [#11889][OPERATOR]Deploy MCM with higherconcurrent-syncs,kube-api-qpsandkube-api-burst. by @hendrikKahl [#11884]Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.114.3europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.114.3europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.114.3europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.114.3Docker Images
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.114.3europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.114.3europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.114.3europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.114.3europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.114.3europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.114.3europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.114.3europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.114.3v1.114.2Compare Source
[gardener/gardener]
🐛 Bug Fixes
[OPERATOR]The step which deploys the sourceBackupEntryduring therestorephase of control plane migration now depends on the successful deployment of theShoot's control plane namespace. This fixes a potential race condition which could cause thesource-etcd-backupSecret to not be deployed in theShoot's control plane namespace and the subsequent step which copies etcd backups to time out. by @plkokanov [#11813]🏃 Others
[DEVELOPER]An issue causing theshould copy data to podVPN tunnel test-machinery integration test to fail is now fixed. by @ialidzhikov [#11805][DEPENDENCY]The following dependencies have been updated:quay.io/kiwigrid/k8s-sidecarfrom1.30.1to1.30.2. by @gardener-ci-robot [#11752][DEPENDENCY]The following dependencies have been updated:registry.k8s.io/ingress-nginx/controller-chrootfromv1.12.0tov1.12.1. by @gardener-ci-robot [#11740][DEPENDENCY]The following dependencies have been updated:registry.k8s.io/ingress-nginx/controller-chrootfromv1.11.4tov1.11.5. by @gardener-ci-robot [#11738]Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.114.2europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.114.2europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.114.2europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.114.2Docker Images
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.114.2europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.114.2europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.114.2europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.114.2europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.114.2europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.114.2europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.114.2europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.114.2v1.114.1Compare Source
[gardener/gardener]
🐛 Bug Fixes
[DEPENDENCY]Thehack/check-generate.shscript was fixed to only execute thecheck-generatetarget if it exists in the corresponding Makefile. by @timuthy [#11641][USER]A bug which made the wildcard TLS certificate endpoint of non-HA-multizone shoot kube-apiservers inaccessible has been fixed. by @oliver-goetz [#11697][USER]A bug has been fixed which preventedShootdeletion because of an unavailablegardener-resource-managerdeployment. by @rfranzke [#11710][USER]A bug in gardener-operator which made the virtual-kube-apiserver serve the self-signed certificate on the wildcard TLS certificate endpoint when IstioTLSTermination feature gate is active has been fixed. by @oliver-goetz [#11697][OPERATOR]A bug which might break control-plane access to shoots until their next reconciliation when deactivating IstioTLSTermination feature gate on their seed has been fixed. by @oliver-goetz [#11694]🏃 Others
[OPERATOR]gardener-apiserver now returns a warning when the Shoot has thespec.kubernetes.enableStaticTokenKubeconfigfield set. by @shafeeqes [#11666]Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.114.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.114.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.114.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.114.1Docker Images
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.114.1europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.114.1europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.114.1europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.114.1europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.114.1Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.