🤖 Update module github.com/gardener/gardener to v1.105.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/gardener/gardener	v1.99.4 -> v1.105.0

---

Release Notes

gardener/gardener (github.com/gardener/gardener)

v1.105.0

Compare Source

[gardener/gardener]

📰 Noteworthy

• [OPERATOR] The VPAForETCD and VPAAndHPAForAPIServer feature gates have been promoted to GA and locked to true. by @​plkokanov [#​10599]
• [USER] The limitation of having at maximum ~80 worker pools in Shoots has been lifted. Much higher numbers should be possible now (concrete limit depends on the amount of configuration within the pools (e.g., labels, taints, annotations, etc.)). by @​rfranzke [#​10542]

✨ New Features

• [DEVELOPER] Add functionality for the determination of bastion VM parameters used by the extensions by @​hebelsan [#​10537]
• [OPERATOR] gardener-operator is now capable of deploying extension controllers to the garden runtime cluster via operator.gardener.cloud/v1alpha1.Extension resources. Please visit this document for more information. by @​timuthy [#​10518]
• [OPERATOR] gardenlet now performs garbage collection of stale Pods in all namespaces (except kube-system) in the seed cluster. by @​rfranzke [#​10548]

🐛 Bug Fixes

• [OPERATOR] When checking whether a Deployment rollout is complete, stale Pods are now ignored and no longer counted. by @​rfranzke [#​10548]

🏃 Others

• [DEPENDENCY] The quay.io/prometheus-operator/prometheus-config-reloader image has been updated to v0.77.0. by @​gardener-ci-robot [#​10547]
• [DEPENDENCY] The gardener/ingress-default-backend image has been updated to 0.20.0. Release Notes by @​gardener-ci-robot [#​10560]
• [DEPENDENCY] The gardener/etcd-druid image has been updated to v0.22.7. Release Notes by @​gardener-ci-robot [#​10570]
• [DEPENDENCY] The gardener/etcd-druid image has been updated to v0.22.6. Release Notes by @​gardener-ci-robot [#​10556]
• [DEPENDENCY] The gardener/gardener-discovery-server image has been updated to v0.2.0. Release Notes by @​gardener-ci-robot [#​10546]
• [DEPENDENCY] The quay.io/prometheus-operator/prometheus-config-reloader image has been updated to v0.77.1. by @​gardener-ci-robot [#​10573]
• [DEPENDENCY] The quay.io/kiwigrid/k8s-sidecar image has been updated to 1.28.0. by @​gardener-ci-robot [#​10591]
• [DEPENDENCY] The envoyproxy/envoy image has been updated to v1.31.2. Release Notes by @​gardener-ci-robot [#​10553]
• [DEPENDENCY] The gcr.io/istio-release/pilot image has been updated to 1.21.6. by @​gardener-ci-robot [#​10564]
• [DEVELOPER] provider-extensions setup: Seed VPA is disabled by default to avoid two VPA deployments to act on the same cluster causing endless eviction loops. by @​ialidzhikov [#​10593]
• [DEVELOPER] Correctly extract and install the go binaries in the remote local setup by @​vicwicker [#​10605]
• [OPERATOR] Allow overlapping network ranges in case of single stack IPv6. by @​axel7born [#​10584]
• [OPERATOR] Allow empty pod and service ranges in shoot spec for IPv6 single stack. by @​axel7born [#​10541]
• [OPERATOR] The TopologySpreadConstraint calculation was improved for workload spread across multiple zones. This especially leads to a more balanced distribution of kube-apiserver and istio replicas in seed clusters. by @​timuthy [#​10608]
• [OPERATOR] VPA resource settings are now adapted - memory limits are removed and initial resource requests are lowered. by @​voelzmo [#​10568]

Helm Charts

• controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.105.0
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.105.0
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.105.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.105.0

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.105.0
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.105.0
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.105.0
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.105.0
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.105.0
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.105.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.105.0
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.105.0

v1.104.1

Compare Source

[gardener/gardener]

🐛 Bug Fixes

• [OPERATOR] Fix a regression that caused gardenlet to not be able to migrate deprecated failure-domain.beta.kubernetes.io labels to topology.kubernetes.io due to a removed RBAC rule required to patch PersistentVolumes. by @​plkokanov [#​10578]

🏃 Others

• [OPERATOR] The gardener/etcd-druid image has been updated to v0.22.7. Release Notes by @​ishan16696 [#​10592]

Helm Charts

• controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.104.1
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.104.1
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.104.1
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.104.1

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.104.1
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.104.1
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.104.1
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.104.1
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.104.1
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.104.1
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.104.1
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.104.1

v1.104.0

Compare Source

[gardener/gardener]

⚠️ Breaking Changes

• [USER] A bug has been fixed which was allowing users to set Shoot oidc configurations for the kube-apiserver without setting the clientID and issuerURL fields in spec.kubernetes.kubeAPIServer.oidcConfig, which would lead to the kube-apiserver stuck in a Error state. gardener-apiserver now requires both clientID and issuerURL fields to be set when the spec.kubernetes.kubeAPIServer.oidcConfig field is specified. by @​AleksandarSavchev [#​10461]
• [OPERATOR] credentialsBinding.credentialsRef is now an immutable field. by @​dimityrmirchev [#​10365]

📰 Noteworthy

• [USER] Users are allowed to change shoot.spec.credentialsBindingName and reference another CredentialsBinding only if they have the permissions to read both the old and newly referenced credential. by @​dimityrmirchev [#​10365]
• [USER] Users can migrate from shoot.spec.secretBindingName to shoot.spec.credentialsBindingName only if the referenced credential remains the same and is not changed during the process. by @​dimityrmirchev [#​10365]
• [OPERATOR] Allow project users to read NamespacedCloudProfiles and for project admins to make adjustments to machine types and volume types. by @​LucaBernstein [#​10485]
• [OPERATOR] Alerts based on the proposals_failed_total metric of the etcd cluster are not raised anymore. by @​renormalize [#​10524]
• [DEVELOPER] A new predicate extensions/pkg/predicate.GardenSecurityProviderType can be used to select resources from the security.gardener.cloud group that are related to the passed provider type. by @​dimityrmirchev [#​10499]

✨ New Features

• [OPERATOR] The gardener-operator metrics are now automatically scraped by the garden Prometheus. by @​maboehm [#​10464]
• [OPERATOR] Introduce custom RBAC verbs to allow for modification of .spec.{kubernetes,machineImages} in NamespacedCloudProfiles. by @​LucaBernstein [#​10485]
• [OPERATOR] The feature gate NewVPN is introduced for the gardenlet component. If enabled, the new VPN implementation (Golang rewrite) is used for all Shoots of the respective Seed. In this case, the old implementation can be disabled for a single Shoot by annotating the shoot resource with alpha.control-plane.shoot.gardener.cloud/disable-new-vpn=true. For Seeds with disabled feature gate, the new implementation can be enabled for a single shoot by annotating it with alpha.control-plane.shoot.gardener.cloud/disable-new-vpn=false. by @​MartinWeindel [#​9774]

🐛 Bug Fixes

• [USER] Fixed disk read/write panel in the shoot's etcd dashboards by @​rickardsjp [#​10493]
• [DEVELOPER] An issue was fixed that rejected the creation of workerless shoots in the local setup. by @​timuthy [#​10498]

🏃 Others

• [DEPENDENCY] The gardener/hvpa-controller image has been updated to v0.17.0. Release Notes by @​gardener-ci-robot [#​10508]
• [DEPENDENCY] The quay.io/prometheus-operator/prometheus-config-reloader image has been updated to v0.76.2. by @​gardener-ci-robot [#​10500]
• [DEPENDENCY] The gardener/machine-controller-manager image has been updated to v0.54.0. Release Notes by @​gardener-ci-robot [#​10528]
• [DEPENDENCY] The gardener/alpine-conntrack image has been updated to 3.20.3. Release Notes by @​gardener-ci-robot [#​10487]
• [DEPENDENCY] The envoyproxy/envoy image has been updated to v1.31.1. Release Notes by @​gardener-ci-robot [#​10531]
• [OPERATOR] Federate apiserver_total_request metric to the Prometheus longterm instance by @​jguipi [#​10457]
• [OPERATOR] Allow empty networking.nodes in case of IPv6 only shoots. by @​axel7born [#​10533]
• [OPERATOR] Improved node utilisation by reducing requests for etcd-druid managed pods. by @​unmarshall [#​10540]
• [DEVELOPER] Install go in the remote local setup from the go download site instead of using the apk package manager. by @​vicwicker [#​10502]

Helm Charts

• controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.104.0
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.104.0
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.104.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.104.0

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.104.0
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.104.0
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.104.0
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.104.0
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.104.0
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.104.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.104.0
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.104.0

v1.103.1

Compare Source

[gardener/gardener]

🐛 Bug Fixes

• [DEVELOPER] An issue was fixed that rejected the creation of workerless shoots in the local setup. by @​timuthy [#​10503]
• [OPERATOR] Fix a regression that caused gardenlet to not be able to migrate deprecated failure-domain.beta.kubernetes.io labels to topology.kubernetes.io due to a removed RBAC rule required to patch PersistentVolumes. by @​plkokanov [#​10581]

Helm Charts

• controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.103.1
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.103.1
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.103.1
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.103.1

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.103.1
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.103.1
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.103.1
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.103.1
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.103.1
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.103.1
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.103.1
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.103.1

v1.103.0

Compare Source

[gardener/gardener]

⚠️ Breaking Changes

• [OPERATOR] Component config change for gardener-operator: extensionVirtualClusterConfig was renamed to extension. by @​MartinWeindel [#​10277]

📰 Noteworthy

• [DEVELOPER] Enable apiserver feature gate UseNamespacedCloudProfile in local setup by default. Though, feature gate should not be enabled in production environments yet, until access control is implemented. by @​LucaBernstein [#​10266]
• [OPERATOR] kube-proxy now has a readiness probe so that a node will only become ready for workloads after kube-proxy was ready at least once. by @​ScheererJ [#​10407]
• [OPERATOR] Host spread for shoots with failure tolerance node (.spec.controlPlane.highAvailability.failureTolerance.type) is now accomplished via minDomains. Earlier, this happened at a best effort basis only. If a seed was having less than 3 nodes at the time the control-plane pods were scheduled, the desired pod distribution was not possible. by @​timuthy [#​10400]

✨ New Features

• [OPERATOR] Introduced metrics exposing the Garden resource's condition and last operation. by @​rickardsjp [#​10393]
• [OPERATOR] Add NamespacedCloudProfile controller to enable usage of NamespacedCloudProfile in Shoot spec. by @​LucaBernstein [#​10266]
• [OPERATOR] gardener-operator is now capable of deploying admission controllers for the virtual-garden via operator.gardener.cloud/v1alpha1.Extension resources. by @​MartinWeindel [#​10277]
• [DEVELOPER] Extension provider-local has a dummy admission controller now. by @​MartinWeindel [#​10277]

🐛 Bug Fixes

• [DEVELOPER] A bug was fixed that led to env-test setup errors when make test-integration was executed locally. by @​timuthy [#​10456]

🏃 Others

• [DEPENDENCY] The quay.io/prometheus/prometheus image has been updated to v2.54.1. by @​gardener-ci-robot [#​10395]
• [DEPENDENCY] The fluent-operator image has been updated to v3.10. Release Notes
  The fluent-bit image has been updated to v3.1.5. Release Notes
  The gardener/logging image has been updated to v0.61.0. Release Notes by @​nickytd [#​10429]
• [DEPENDENCY] The gardener/dashboard image has been updated to 1.77.0. Release Notes by @​gardener-ci-robot [#​10463]
• [DEPENDENCY] The registry.k8s.io/metrics-server/metrics-server image has been updated to v0.7.2. by @​gardener-ci-robot [#​10408]
• [DEPENDENCY] The gardener/dashboard image has been updated to 1.76.2. Release Notes by @​gardener-ci-robot [#​10446]
• [DEPENDENCY] The quay.io/brancz/kube-rbac-proxy image has been updated to v0.18.1. by @​gardener-ci-robot [#​10427]
• [DEPENDENCY] The quay.io/prometheus-operator/prometheus-config-reloader image has been updated to v0.76.1. by @​gardener-ci-robot [#​10448]
• [DEPENDENCY] The quay.io/cortexproject/cortex image has been updated to v1.18.0. by @​gardener-ci-robot [#​10458]
• [DEPENDENCY] The gardener/hvpa-controller image has been updated to v0.16.0. Release Notes by @​gardener-ci-robot [#​10397]
• [DEPENDENCY] The quay.io/kiwigrid/k8s-sidecar image has been updated to 1.27.6. by @​gardener-ci-robot [#​10424]
• [DEVELOPER] The guestbook container image used in the test machinery tests is now updated from an image in GCR to an image in Artifact Registry. by @​ialidzhikov [#​10409]
• [DEVELOPER] Introduce golang-test image for Go 1.23 and remove its Go 1.21 version. by @​oliver-goetz [#​10388]
• [OPERATOR] A stale VPA related to the old alertmanager deployment was not cleaned up by gardenlet. Now, gardenlet on startup cleans up the these stale alertmanager VPAs. by @​ialidzhikov [#​10462]

Helm Charts

• controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.103.0
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.103.0
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.103.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.103.0

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.103.0
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.103.0
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.103.0
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.103.0
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.103.0
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.103.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.103.0
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.103.0

v1.102.2

Compare Source

[gardener/gardener]

🐛 Bug Fixes

• [OPERATOR] Fix a regression that caused gardenlet to not be able to migrate deprecated failure-domain.beta.kubernetes.io labels to topology.kubernetes.io due to a removed RBAC rule required to patch PersistentVolumes. by @​plkokanov [#​10582]

🏃 Others

• [DEPENDENCY] The gardener/dashboard image has been updated to 1.76.2. Release Notes by @​gardener-ci-robot [#​10453]

Helm Charts

• controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.102.2
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.102.2
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.102.2
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.102.2

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.102.2
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.102.2
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.102.2
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.102.2
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.102.2
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.102.2
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.102.2
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.102.2

v1.102.1

Compare Source

[gardener/gardener]

🐛 Bug Fixes

• [OPERATOR] A bug has been fixed that prevented the deployment of gardenlets via gardener-operator and the Gardenlet resource when .spec.kubeconfigSecretRef was used. by @​rfranzke [#​10411]

🏃 Others

• [DEPENDENCY] The gardener/etcd-druid image has been updated to v0.22.5. Release Notes by @​gardener-ci-robot [#​10443]
• [OPERATOR] gardener-controller-manager: A corner case issue in the maintenance controller that prevented forceful minor K8s version update from K8s 1.29 to K8s 1.30 is now resolved. by @​ialidzhikov [#​10438]
• [OPERATOR] Kernel setting net.netfilter.nf_conntrack_max is only set on nodes by sysctl.d if kube-proxy is disabled. by @​ScheererJ [#​10434]

Helm Charts

• controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.102.1
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.102.1
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.102.1
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.102.1

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.102.1
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.102.1
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.102.1
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.102.1
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.102.1
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.102.1
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.102.1
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.102.1

v1.102.0

Compare Source

[gardener/gardener]

⚠️ Breaking Changes

• [OPERATOR] When the NewWorkerPoolHash feature gate is enabled, the calculation now also rolls worker nodes of Shoots when changing systemReserved in the kubelet configuration. Worker pools are not rolled if the sum of kubeReserved and systemReserved does not change. If the feature gate is already enabled, then the worker pools of Shoots with non-zero values in systemReserved will be rolled once. by @​MichaelEischer [#​10290]

📰 Noteworthy

• [USER] The spec.client field in the {Cluster}OpenIDConnectPreset APIs is deprecated and will be removed after support for Kubernetes 1.30 is dropped. by @​AleksandarSavchev [#​10253]
• [USER] The spec.kubernetes.kubeAPIServer.oidcConfig.clientAuthentication field in the Shoot API is deprecated and will be removed after support for Kubernetes 1.30 is dropped. by @​AleksandarSavchev [#​10253]
• [USER] The Shoot specification field .spec.kubernetes.kubeAPIServer.oidcConfig.signingAlgs for Kubernetes versions >= v1.30 is not supported anymore. by @​AleksandarSavchev [#​10244]
• [OPERATOR] The .spec.deployment.vpa field in the seedmanagement.gardener.cloud/v1alpha1.{Gardenlet,ManagedSeed} APIs is deprecated and has no effect anymore. It will be removed in a future version. Now, gardenlet deploys its own VPA as part of the Seed reconciliation (after it ensured the VPA CRD exists). by @​rfranzke [#​10299]

✨ New Features

• [USER] Structured authentication configuration can now be set by creating a ConfigMap in the project namespace with the AuthenticationConfiguration file set in the config.yaml data key and referencing the ConfigMap in the new Shoot specification field .spec.kubernetes.kubeAPIServer.structuredAuthentication.configMapName for Kubernetes versions >= v1.30. Only one authenticator can be set via the authentication configuration until k8s.io/* Golang dependencies are upgraded to version >= v0.30. by @​AleksandarSavchev [#​10244]
• [USER] The following vpa-recommender flags are now configurable via the Shoot specification:
  • --recommendation-lower-bound-cpu-percentile: .spec.kubernetes.verticalPodAutoscaler.recommendationLowerBoundCPUPercentile
  • --recommendation-upper-bound-cpu-percentile: .spec.kubernetes.verticalPodAutoscaler.recommendationUpperBoundCPUPercentile
  • --target-memory-percentile: .spec.kubernetes.verticalPodAutoscaler.targetMemoryPercentile
  • --recommendation-lower-bound-memory-percentile: .spec.kubernetes.verticalPodAutoscaler.recommendationLowerBoundMemoryPercentile
  • --recommendation-upper-bound-memory-percentile: .spec.kubernetes.verticalPodAutoscaler.recommendationUpperBoundMemoryPercentile by @​ialidzhikov [#​10221]
• [OPERATOR] Performing control plane migration across Seeds with different provider types is now possible. Before triggering the migration, make sure that pods in the Shoot's control plane, once it is moved to the Destination Seed, will have network connectivity to the storage provider of the Source Seed (so that ETCD backups can be copied automatically). Additionally, make sure that the Shoot's nodes will have network connectivity to the Shoot's control plane after it is moved to the Destination Seed. by @​plkokanov [#​10323]
• [OPERATOR] gardenlet now runs a new controller called TokenRequestorWorkloadIdentity which requests workload identity tokens and writes them into Secret resources in the seed cluster. These tokens can be then used by control plane components in order to present the said WorkloadIdentity before external systems. Please see here for more details. by @​dimityrmirchev [#​10298]
• [OPERATOR] Quotas can now have scope of type WorkloadIdentity. by @​dimityrmirchev [#​10346]

🐛 Bug Fixes

• [USER] Fixes a bug preventing shoot clusters with annotation shoot.gardener.cloud/skip-readiness: "true" to be created. by @​ScheererJ [#​10317]
• [OPERATOR] An issue causing the vpn-seed-server VPA's to be created with wrong targetRef for highly available Shoots is now fixed. by @​ialidzhikov [#​10366]

🏃 Others

• [OPERATOR] vpa-updater and vpa-recommender components do now run with leader election enabled (unconditionally) and support running in HA mode. by @​ialidzhikov [#​10302]
• [OPERATOR] Reduce kubelet http2 timeouts. by @​axel7born [#​10223]
• [OPERATOR] Gardener now temporarily uses a vpa-recommender built from a fork to add additional logging and metrics for debugging an issue where the vpa-recommender could recommend lower than minAllowed memory requests for pods that actually have high memory usage. by @​plkokanov [#​10342]
• [OPERATOR] The vertical pod autoscaler component is updated to v1.2.0. Release Notes by @​ialidzhikov [#​10275]
• [OPERATOR] Migrate VPA metrics to CustomResourceState metrics and upgrade kube-state-metrics to v2.13.0. by @​vicwicker [#​9941]
• [OPERATOR] An issue in gardener-node-agent causing registry hosts probe to fail when the spec.criConfig.containerd.registries.hosts.caCerts field of OperatingSystemConfig is set is now fixed. by @​dimitar-kostadinov [#​10375]
• [OPERATOR] Shoot clusters with Kubernetes version >= v1.30 will use cluster-autoscaler v1.30.0. Release Notes. by @​ashwani2k [#​10309]
• [DEPENDENCY] The credativ/plutono image has been updated to v7.5.33. Release Notes by @​gardener-ci-robot [#​10296]
• [DEPENDENCY] A wildcard option was added to the SwitchOptions to disable all webhooks at once via --disable-webhooks="*" by @​timuthy [#​10255]
• [DEPENDENCY] The following dependencies have been updated:
  • europe-docker.pkg.dev/gardener-project/releases/gardener/autoscaler/cluster-autoscaler: v1.25.3 -> v1.25.4 (for Kubernetes v1.25)
  • europe-docker.pkg.dev/gardener-project/releases/gardener/autoscaler/cluster-autoscaler: v1.26.2 -> v1.26.3 (for Kubernetes v1.26) by @​rishabh-11 [#​10362]
• [DEPENDENCY] The credativ/vali image has been updated to v2.2.18. Release Notes by @​gardener-ci-robot [#​10292]
• [DEPENDENCY] The registry.k8s.io/autoscaling/vpa-admission-controller image has been updated to 1.2.1. by @​gardener-ci-robot [#​10350]
• [DEPENDENCY] The registry.k8s.io/autoscaling/vpa-updater image has been updated to 1.2.1. by @​gardener-ci-robot [#​10351]
• [DEPENDENCY] The quay.io/prometheus/prometheus image has been updated to v2.54.0. by @​gardener-ci-robot [#​10297]
• [DEPENDENCY] The gardener/ext-authz-server image has been updated to 0.10.0. Release Notes by @​gardener-ci-robot [#​10321]
• [DEPENDENCY] The quay.io/prometheus-operator/prometheus-config-reloader image has been updated to v0.76.0. by @​gardener-ci-robot [#​10332]
• [USER] Grant get, list and watch permissions to the customresourcedefinitions resource in the virtual cluster for authenticated users. Shoot owners can now generate their own shoot metrics using custom resource state configurations by kube-state-metrics. by @​vicwicker [#​10293]

📖 Documentation

• [DEVELOPER] This document now contains a guide for developers how to handle deprecations and backwards-compatibility of changes. by @​rfranzke [#​10294]
• [OPERATOR] The version skew policy was updated to better reflect how to handle gardenlet upgrades. by @​rfranzke [#​10294]

Helm Charts

• controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.102.0
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.102.0
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.102.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.102.0

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.102.0
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.102.0
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.102.0
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.102.0
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.102.0
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.102.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.102.0
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.102.0

v1.101.3

Compare Source

[gardener/gardener]

🐛 Bug Fixes

• [OPERATOR] A bug has been fixed that prevented the deployment of gardenlets via gardener-operator and the Gardenlet resource when .spec.kubeconfigSecretRef was used. by @​rfranzke [#​10410]
• [OPERATOR] An issue causing the vpn-seed-server VPA's to be created with wrong targetRef for highly available Shoots is now fixed. by @​ialidzhikov [#​10372]

🏃 Others

• [OPERATOR] Kernel setting net.netfilter.nf_conntrack_max is only set on nodes by sysctl.d if kube-proxy is disabled. by @​oliver-goetz [#​10444]
• [OPERATOR] gardener-controller-manager: A corner case issue in the maintenance controller that prevented forceful minor K8s version update from K8s 1.29 to K8s 1.30 is now resolved. by @​ialidzhikov [#​10439]
• [OPERATOR] An issue in gardener-node-agent causing registry hosts probe to fail when the spec.criConfig.containerd.registries.hosts.caCerts field of OperatingSystemConfig is set is now fixed. by @​dimitar-kostadinov [#​10380]
• [DEPENDENCY] The gardener/dashboard image has been updated to 1.76.2. Release Notes by @​gardener-ci-robot [#​10454]

Helm Charts

• controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.101.3
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.101.3
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.101.3
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.101.3

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.101.3
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.101.3
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.101.3
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.101.3
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.101.3
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.101.3
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.101.3
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.101.3

v1.101.2

Compare Source

[gardener/gardener]

🏃 Others

• [DEPENDENCY] The registry.k8s.io/ingress-nginx/controller-chroot image has been updated to v1.11.2. by @​gardener-ci-robot [#​10357]

Helm Charts

• controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.101.2
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.101.2
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.101.2
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.101.2

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.101.2
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.101.2
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.101.2
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.101.2
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.101.2
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.101.2
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.101.2
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.101.2

v1.101.1

Compare Source

[gardener/gardener]

🐛 Bug Fixes

• [OPERATOR] Disable cloud profile field sync if Shoot is being deleted. by @​LucaBernstein [#​10310]
• [OPERATOR] A bug has been fixed which prevented gardenlet from creating its own seedmanagement.gardener.cloud/v1alpha1.Gardenlet resource when selfUpgrade was set in its Helm chart values (more information). by @​rfranzke [#​10306]

Helm Charts

• controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.101.1
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.101.1
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.101.1
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.101.1

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.101.1
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.101.1
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.101.1
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.101.1
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.101.1
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.101.1
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.101.1
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.101.1

v1.101.0

Compare Source

[gardener/gardener]

⚠️ Breaking Changes

• [DEVELOPER] The legacy method of providing monitoring configuration via ConfigMaps labeled with extensions.gardener.cloud/configuration=monitoring has been removed. See this instead. by @​rfranzke [#​10220]
• [DEVELOPER] The IPv4 addresses for the local Gardener setup was changed from 127.0.0.x to 172.18.255.x (default kind subnet) to resolve an issue on developer machines which can't use additional IP addressed from the 127.0.0.0/8 space. Please consider updating your /etc/hosts file to adjust to the the newly added addresses. Please see Deploying Gardener Locally#Accessing the Shoot Cluster for more details. by @​MartinWeindel [#​10019]
• [DEVELOPER] github.com/gardener/gardener/plugin/pkg/utils.ProjectForNamespaceFromLister has been deprecated and will be removed in a future release, use github.com/gardener/gardener/pkg/utils/gardener.ProjectForNamespaceFromLister instead. by @​vpnachev [#​10042]

📰 Noteworthy

• [DEVELOPER] Evaluate shoot.Spec.CloudProfile and shoot.Spec.CloudProfileName fields together to determine the applicable cloud profile in order to prepare for namespaced cloud profiles. by @​LucaBernstein [#​10093]
• [DEPENDENCY] A new field class was added to resources of the extensions.gardener.cloud API group. Together with the newly introduced predicate HasClass, it serves as a mean to split responsibilities of extension controllers for extensions belonging to different type of targets, i.e. shoot (default) or garden. Handling is backwards compatible, so that extensions are still responsible for shoot extension resources without any adjustments. If you intend to already support the reconciliation of extensions belonging to the garden class (cluster), please consider adding the ExtensionClass parameter (see here for more information). by @​timuthy [#​10254]
• [OPERATOR] The VPAAndHPAForAPIServer feature gate has been promoted to beta and is now turned on by default. by @​ialidzhikov [#​10207]
• [OPERATOR] VPA MaxAllowed is no longer hard-coded to fixed values (4/7/8 cores and 25/28G) for kube-apiserver, etcd, and prometheus. Operators must ensure sufficiently large worker pools for control plane components. For details, see [this document](https://redirect.github.com/gardener/gardener/blob/m

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[maboehm]

should wait for gardener/gardener#10459 and then merge with v2.4.0