[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps the kubernetes group with 1 update in the / directory: sigs.k8s.io/controller-runtime.

Updates sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.0

Release notes

Sourced from sigs.k8s.io/controller-runtime's releases.

v0.25.0

Highlights

This version of controller-runtime introduces a new experimental ReadYourWritesConsistency feature, which ensures that all writes are reflected in subsequent reads from the default cache-backed client. Stale client reads are arguably the biggest source of friction and sometimes bugs for controller authors, providing this functionality at the library level eliminates that class of problems entirely.

Try it out by setting Client.EnableReadYourWritesConsistency: new(true) in your manager and leave any feedback you may have on the tracking issue.

⚠️ Breaking Changes

• Dependencies: Bump to k8s.io/* v1.37 (#3579 #3575 #3567 #3561 #3547 #3529 #3524)
• Events: Add new EventRecorder interface (#3509)

✨ New Features

• Client: Add a read-your-own-writes client (#3472)
• Fakeclient: Add WithGlobalResourceVersionCounter (#3581)
• Fakeclient: Add scale subresource support for Apply (#3569)
• Metrics: Allow opt-in for client-go REST client metrics (#3510)
• Metrics: Allow overriding client-go REST client metrics latency histogram buckets (#3573)
• Source: Add TypedInformer source (#3520)
• Webhooks: Allow to disable the webhook server by setting the port to -1 (#3481)

🐛 Bug Fixes

• Cache: Fix goroutine leaks in cache Start() methods (#3565)
• Client: Fix regression in Apply typed error handling (#3515)
• Controller: Unlock when Controller.Start() returns with error (#3545)
• Envtest: Fix envtest process stop on Windows (#3519)
• Fakeclient: Allow updating managedFields through Update (#3585)
• Fakeclient: Fix AddIndex panic when wrapped with an interceptor (#3583)
• Fakeclient: Fix PartialObjectMeta handling (#3571)
• Fakeclient: Support scale subresource get/update for unstructured objects (#3546)
• Fakeclient: Update object on subresource apply (#3570)
• PriorityQueue: Fix PriorityQueue deadlock on shutdown (#3540)
• Testing/Process: Fix process Stop timeout error handling (#3523)

🌱 Others

• LeaderElection: Pass Managers Logger to Leader Elector via Context (#3576)

🌱 CI & linters

• Add copyright header validation & fix findings (#3544)
• Bump to golangci-lint v2.12.1 (#3514)
• Bump to golangci-lint v2.12.2 (#3532)
• Bump to golangci-lint v2.13.1 (#3580)

... (truncated)

Commits

• e8f9455 🐛 fakeclient: Allow updating managedFields through Update (#3585)
• 0cc1315 Merge pull request #3565 from dongjiang1989/fix-leak
• fa96780 🐛 Fix goroutine leaks in cache Start() methods
• 1f5514b ✨ Add a read-your-own-write client (#3472)
• df386c7 🌱 Bump to golangci-lint v2.13.1 (#3580)
• dc7618f Merge pull request #3583 from pujitha24/auto/issue-3582
• 37fe235 🐛 fake: fix AddIndex panic when client is wrapped with an interceptor
• 01c7782 ✨ Allow overriding REST client latency histogram buckets (#3573)
• 857be80 Merge pull request #3576 from demirdilek/fix-leaderelection-contextual-logging
• b1387be Merge pull request #3581 from alvaroaleman/fake-consistent
• Additional commits viewable in compare view

[github-actions]

✅MegaLinter analysis: Success

✅ Linters with no issues

actionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_GITLEAKS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

[devantler]

🤖 Generated by the Agentic Engineer

Parked on a named upstream blocker. This is not a flake and not something a rebase or an adaptation commit can fix.

At head 153db2c80d, 🏗️ Build (Linux) and 🏗️ Build + cask (macOS) fail at compile time, and the other failing jobs depend on them. controller-runtime 0.25.0 moves every k8s.io/* module to 0.37.0, and two things in the module graph do not build against that:

• github.com/loft-sh/apiserver (reached through vcluster): AllowCreateOnUpdate no longer matches k8s.io/apiserver 0.37's RESTUpdateStrategy interface.
• k8s.io/component-helpers stays at v0.36.4 because nothing requires a newer version, and it no longer compiles against k8s.io/api 0.37.

The second could be fixed in this PR. The first cannot: this is the same root cause ksail#6728 already tracks. Re-checked today through the Go module proxy:

• vcluster @latest is v0.37.1 (2026-09-14), and it still requires k8s.io/api and k8s.io/apiserver v0.36.0 with the same loft-sh/apiserver pin.
• So the open vcluster-pro 0.37.1 bump (chore(deps): bump loft-sh/vcluster-pro from 0.36.1 to 0.37.1 in /pkg/fsutil/configmanager/vcluster #7072) will not unblock this either.

Blocker: #6728 | upstream | last-verified 2026-09-15: not shipped (no k8s-0.37-compatible loft-sh/apiserver; vcluster v0.37.1 still on k8s 0.36)

Once that ships, this bump will need k8s.io/component-helpers raised to 0.37 in the same change.

[devantler]

🤖 Generated by the Agentic Engineer

Root-caused: this bump cannot go green on its own, and auto-merge being armed is hiding that

Picked this up as ordinary rung-one work — repository automation has had it since 2026-09-15T18:09Z
and it is not self-progressing: auto-merge is ARMED while 39 of the current head's checks are
FAILURE, so the armed state reads as "on its way to merge" when nothing can ever satisfy it.
Diagnosed before re-running anything, since a re-queue would just re-hit the same compile error.

Evidence: run 35001304984
(✅ Validate Go Project) at 153db2c80da3d5c3ef706b64c0d50036d1c9a527. Six jobs fail — Build, Test,
Lint, Code Coverage, Dead Code Analysis, Vulnerability Scan — and all of them fail for the same
reason: the tree does not compile. There are two independent causes, and they need different
owners.

1. Ours, and small — the fake clientset in pkg/k8s/readiness/apiserver_test.go

cannot use &stubClientset{…} (value of type *stubClientset) as kubernetes.Interface
value in return statement: *stubClientset does not implement kubernetes.Interface

Five sites: lines 84, 95, 148, 160, 172. The client-go that comes with controller-runtime 0.25.0
added to kubernetes.Interface, so the hand-rolled stub no longer satisfies it. This is a normal
adaptation and is the kind of commit that may be pushed to a dependency branch.

2. Not ours — transitive code that has not caught up with the new Kubernetes libraries

claimStatus.Resources undefined (type "k8s.io/api/core/v1".NodeAllocatableResourceClaimStatus
  has no field or method Resources)

cannot use &DefaultStorageStrategy{} as "k8s.io/apiserver/pkg/registry/rest".RESTUpdateStrategy:
  wrong type for method AllowCreateOnUpdate

Neither NodeAllocatableResourceClaimStatus, StorageBuilder nor DefaultStorageStrategy is KSail
code — these are inside a dependency that compiles against the older k8s.io/api and
k8s.io/apiserver. rest.RESTUpdateStrategy.AllowCreateOnUpdate changed signature, and that
dependency still implements the old one.

I have not attributed those two errors to a specific module. The build annotations report the
path as .github:<line>, which is an annotation artifact rather than a real source location, so
naming the module would be a guess. Resolving it needs a local go build ./... against the bumped
go.sum to get real paths — that is the first step for whoever picks this up.

What this means for the PR

Fixing (1) alone will not turn it green; (2) gates the bump regardless, and it is only fixable here
by waiting for that dependency to release against the new Kubernetes libraries, or by pinning it
back. So this is parked on a named blocker, not merely red.

Two things worth doing now, neither of which is a re-queue:

• Disarm auto-merge. While it stays armed on a permanently-red head it is a false positive in
  every sweep that reads armed-auto-merge as self-progressing.
• Resolve the module in (2) with a local build, so the blocker can carry a concrete upstream
  identifier and be re-verified cheaply each run instead of re-diagnosed.

Recording rather than acting further this run: the remaining work is a dependency-graph investigation
that wants a full local Go build, and I would rather leave an accurate diagnosis than a half-applied
adaptation on a bot branch.

[devantler]

🤖 Generated by the Agentic Engineer

Blocked on a transitive upstream incompatibility — not on anything in this repo, and not on a flaky test.

Every failing system test fails for the same compile error, not at runtime:

github.com/loft-sh/apiserver@v0.0.0-20260707184419-aef558a5ae8d/pkg/builders/default_storage_strategy.go:33:33:
  cannot use &DefaultStorageStrategy{} as "k8s.io/apiserver/pkg/registry/rest".RESTUpdateStrategy:
  *DefaultStorageStrategy does not implement RESTUpdateStrategy (wrong type for method AllowCreateOnUpdate)

This bump pulls a newer k8s.io/apiserver, whose RESTUpdateStrategy interface changed the signature of AllowCreateOnUpdate. The pinned loft-sh/apiserver (a July 2026 pseudo-version, reached transitively) still implements the old shape, so the build fails before any cluster is created — which is why the failures look broad but are a single cause.

So this cannot be fixed by rerunning, rebasing, or by a change to ksail's own code. It needs a loft-sh/apiserver release built against the newer k8s.io/apiserver, and this bump waits for it.

Leaving it open and parked on that named blocker rather than closing it, since the bump is still wanted once the dependency catches up. Re-verify against the module proxy rather than re-deriving this from CI each run.

[devantler]

🤖 Generated by the Agentic Engineer

Parked: the same pin conflict that gates #6728, reached from a different direction

This one is not the Talos accessor removal that is currently red on #6826 and #6845 — it is the other half of the same lane, and it also fails at compile, which is why ~39 checks go red together:

loft-sh/apiserver@.../default_storage_strategy.go:33: *DefaultStorageStrategy does not implement
  rest.RESTUpdateStrategy (wrong type for method AllowCreateOnUpdate)
k8s.io/component-helpers@v0.36.4/resource/helpers.go:284: claimStatus.Resources undefined
  (NodeAllocatableResourceClaimStatus has no field or method Resources)

Moving controller-runtime forward drags the k8s.io/* set with it, and loft-sh/apiserver has published nothing built against the newer apiserver — so the tree cannot be made self-consistent from inside this PR.

Blocker: #6728 | upstream | last-verified 2026-09-17: not shipped — loft-sh/apiserver@latest still resolves to v0.0.0-20260903125814-2353e4b52582 (2026-09-03) with a published go.mod requiring k8s.io/apiserver v0.36.0. Its own replace directive does not reach consumers.

Left open deliberately; it merges when the pin lane resolves, not before.

[devantler]

🤖 Generated by the Agentic Engineer

Conflicting with main, and the ksail-bot sync commit blocks a Dependabot rebase, so recreating from the current base.

@dependabot recreate

[devantler]

🤖 Generated by the Agentic Engineer

Parked on #6728. Recreated onto current main (no longer conflicting), and the build now fails at compile time for a known reason: controller-runtime 0.25 requires the Kubernetes 0.37 libraries, which loft-sh/apiserver (vcluster) and the pinned component-helpers v0.36 / Kyverno v1.19.1 do not compile against. That is the split #6728 tracks. A rebase cannot fix this. It lands when the named blocker clears.

[devantler]

🤖 Generated by the Agentic Engineer

Closing — this update cannot merge as proposed, and the condition that kept re-creating it is now fixed.

Why it cannot merge. sigs.k8s.io/controller-runtime minor lines are pinned to Kubernetes minor lines. Verified against the module proxy:

version	requires k8s.io/{api,apimachinery,apiserver,client-go}
v0.24.1 (current)	v0.36.0
v0.25.0 (this PR)	v0.37.0

This module pins k8s.io/kubernetes v1.36.0 with the staging set on the 0.36 line, so this bump moves the graph to 0.37 — which is exactly why all 39 checks fail, with a 1.37-shaped API error:

claimStatus.Resources undefined (type "k8s.io/api/core/v1".NodeAllocatableResourceClaimStatus has no field or method Resources)

Moving to 0.37 is blocked by #6728, whose blocker line was re-verified today: loft-sh/apiserver still publishes no tags and @latest has not moved since 2026-09-03. #6826, #6845 and #7127 are parked on the same 0.37 requirement — none of them can land independently.

Why closing is safe now. This exact bump was already closed once as #6997 and re-created as this PR, so closing alone never stopped it — a Dependabot ignore rule is what does. #7134 merged that rule (a30ff452), and it is live on main:

ignore:
  - k8s.io/*                            (semver-minor)
  - sigs.k8s.io/controller-runtime      (semver-minor)   ← new
  - github.com/rancher/k3k

Patch and security updates for controller-runtime still come through; only minors are held back, to be taken deliberately with the rest of the Kubernetes set once #6728 clears.

This also returns one of the five gomod version-update slots — see #7135 for the remaining slot-pressure question.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml