Bump the kubernetes group across 1 directory with 5 updates

[dependabot]

Bumps the kubernetes group with 2 updates in the / directory: k8s.io/apiextensions-apiserver and sigs.k8s.io/controller-runtime.

Updates k8s.io/apiextensions-apiserver from 0.35.4 to 0.36.1

Commits

• 5b822b1 Update dependencies to v0.36.1 tag
• 4cd8c3d Merge remote-tracking branch 'origin/master' into release-1.36
• c2fd557 Merge pull request #138346 from dashpole/update_otel_prop
• 1daa309 Merge remote-tracking branch 'origin/master' into release-1.36
• 1551264 Update github.com/moby/spdystream from v0.5.0 to v0.5.1
• 6c97d2b update go.opentelemetry.io/otel to v1.41.0
• 862c52a update google.golang.org/grpc to v1.79.3
• abac065 Merge pull request #137849 from bryantbiggs/deps/update-kube-openapi
• 7acee75 Merge pull request #137843 from pacoxu/cobra-v1.10.2
• 612f1d8 dependencies: bump kube-openapi to drop ginkgo/gomega indirect deps
• Additional commits viewable in compare view

Updates k8s.io/apimachinery from 0.35.4 to 0.36.1

Commits

• 7af103a Update dependencies to v0.36.1 tag
• efb7f26 Merge remote-tracking branch 'origin/master' into release-1.36
• d966e56 Update github.com/moby/spdystream from v0.5.0 to v0.5.1
• 79b3632 Merge pull request #137864 from yongruilin/dv-dra-mismatch
• a8822f7 Add slice and map union member support with tests
• 7dba2d0 Use IsZero instead of IsNil for union ratcheting check
• d95710f Fix union validation ratcheting when oldObj is nil
• 729062d Merge pull request #137849 from bryantbiggs/deps/update-kube-openapi
• 13b12e6 dependencies: bump kube-openapi to drop ginkgo/gomega indirect deps
• 27f4670 Merge pull request #136657 from Jefftree/sharding-test
• Additional commits viewable in compare view

Updates k8s.io/client-go from 0.35.4 to 0.36.1

Commits

• 55ef15a Update dependencies to v0.36.1 tag
• f22a53e Merge remote-tracking branch 'origin/master' into release-1.36
• a948641 Update github.com/moby/spdystream from v0.5.0 to v0.5.1
• 7e44ffc Add Workload-Aware Preemption fields to Workload and PodGroup APIs
• df2d882 Merge pull request #136989 from nojnhuh/podgroup-resourceclaim
• 4eece52 Workload API: PodGroup ResourceClaims (KEP-5729)
• 3d35c51 Merge pull request #137190 from everpeace/KEP-5491-alpha
• 0434117 Merge pull request #137028 from nmn3m/feature/dra-resource-pool-status
• ba785be Drop CSR analogy, mark ObjectMeta +required,reduce limits (maxItems=500, maxL...
• 4a9c878 Add ResourcePoolStatusRequest API types and generated code
• Additional commits viewable in compare view

Updates k8s.io/utils from 0.0.0-20251002143259-bc988d571ff4 to 0.0.0-20260210185600-b8788abfbbc2

Commits

• See full diff in compare view

Updates sigs.k8s.io/controller-runtime from 0.23.3 to 0.24.1

Release notes

Sourced from sigs.k8s.io/controller-runtime's releases.

v0.24.1

What's Changed

• [release-0.24] 🐛 Fix regression in Apply typed error handling by @​k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3516

Full Changelog: kubernetes-sigs/controller-runtime@v0.24.0...v0.24.1

v0.24.0

⚠️ Breaking Changes

• Dependencies: Update to k8s.io/* v1.36 (#3506 #3462 #3486 #3450)

🐛 Bug Fixes

• Cache: Fix IndexField blocking until informer is synced (#3445)
• Cache: Wait for cache sync when ReaderFailOnMissingInformer is true (#3425)
• Client: Update typed ApplyConfigurations with server response (#3475)
• Fakeclient: Fix SSA status patch resource version check (#3443)
• Fakeclient: Fix panic when using CRs with embedded pointer structs (#3431)
• Fakeclient: Fix status apply if existing object has managedFields set (#3430)
• Fakeclient: Retry GenerateName on AlreadyExists collisions (#3498)
• HTTP servers: Wire up base context into http servers (#3452)

🌱 Others

• Builder/Webhooks: Remove deprecated custom path function (#3465)
• Cache: Test cache reader waits for cache sync (#3434)
• Certwatcher: Deflake certwatcher tests (#3457)
• Dependencies: Use forked version of btree (#3449)
• Envtest: Ensure envtest stops the whole process group (#3447)
• Logging: Add missing space in zap-log-level flag description (#3492)
• Misc: Adopt new(x) over ptr.To(x) and re-enable newexpr lint (#3489)
• Owners: Cleanup (#3453)
• Recorder: Add logger into context for structured logging (#3454)
• Recorder: Switch to StartLogging for event debug logs (#3451)
• Scheme: Deprecate the scheme builder (#3461)
• Source/Kind: Improve logging for dynamic type kind source (#3494)
• Webhooks: Reduce memory usage of default webhooks (#3463 #3468)

🌱 CI & linters

• Chore: Update golangci-lint version to v2.8.0 (#3448)
• Chore: Update golangci-lint version to v2.10.1 (#3470)
• Chore: Update golangci-lint version to v2.11.3 (#3482)
• Migrate away from custom GitHub action approval workflow (#3491)
• Release: Auto-create git tags for the tools/setup-envtest submodule (#3476)

📖 Additionally, there has been 1 contribution to our documentation. (#3477)

Dependencies

... (truncated)

Commits

• 3be3f1b Merge pull request #3516 from k8s-infra-cherrypick-robot/cherry-pick-3515-to-...
• 0f7b33d Fix regression in Apply typed error handling
• d3eaef3 Merge pull request #3475 from alvaroaleman/fixfix
• 3296f32 🐛 Update typed Applyconfigurations with server response
• c8b4b9d Merge pull request #3506 from troy0820/troy0820/update-deps-k8s
• 557c314 update to k8s.io v1.36.0
• e4a998c Merge pull request #3499 from kubernetes-sigs/dependabot/github_actions/all-g...
• 1a31c56 Merge pull request #3498 from vieux/fix-fake-client-generatename-retry
• 80bc294 fakeclient: retry GenerateName on AlreadyExists collisions (match K8s 1.32 be...
• 77b730a 🌱 Bump the all-github-actions group with 2 updates
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by CodeRabbit

• Chores
  • Updated Go toolchain from 1.25.7 to 1.26.0
  • Upgraded Kubernetes core dependencies from v0.35.4 to v0.36.1, including API and client libraries
  • Updated supporting dependencies including Prometheus metrics library, timing utilities, and Protocol Buffer libraries

[coderabbitai]

Walkthrough

This PR updates the Go toolchain from 1.25.7 to 1.26.0 and upgrades core Kubernetes module dependencies from v0.35.4 to v0.36.1. Controller-runtime advances to v0.24.1, and supporting indirect dependencies including Prometheus, protobuf, and Kubernetes-related modules are updated to maintain compatibility.

Changes

Dependency updates: Go 1.26 and Kubernetes v0.36.1

Layer / File(s)	Summary
Go toolchain version upgrade go.mod	Go version directive updated from 1.25.7 to 1.26.0.
Core Kubernetes module upgrades go.mod	Direct dependencies on Kubernetes modules (k8s.io/api, k8s.io/apiextensions-apiserver, k8s.io/apimachinery, k8s.io/client-go) upgraded from v0.35.4 to v0.36.1; k8s.io/utils and sigs.k8s.io/controller-runtime (v0.24.1) also advanced.
Indirect dependency version updates go.mod	Indirect dependencies updated: github.com/prometheus/common to v0.67.5, golang.org/x/time to v0.14.0, google.golang.org/protobuf advanced, and Kubernetes-related indirect modules (k8s.io/component-base, k8s.io/kube-openapi, k8s.io/streaming) aligned to v0.36.1 versions; sigs.k8s.io/structured-merge-diff/v6 replaced with new pseudo-version.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• openshift/managed-cluster-validating-webhooks#489: Both PRs modify go.mod to bump Kubernetes k8s.io/* module versions and related indirect dependencies as part of dependency updates.
• openshift/managed-cluster-validating-webhooks#475: Both PRs are go.mod-only Kubernetes dependency bumps that advance the same module set along the upgrade path.

Suggested reviewers

• feichashao
• clcollins

🚥 Pre-merge checks | ✅ 11 | ❌ 4

❌ Failed checks (4 warnings)

Check name	Status	Explanation	Resolution
Test Structure And Quality	⚠️ Warning	test/e2e/validation_webhook_tests.go has 45/72 Expect calls missing assertion messages. Test "exists and is running" violates single responsibility with 5 unrelated assertions.	Add meaningful messages to all Expect calls. Split multi-assertion tests to check one behavior each per Ginkgo best practices.
Microshift Test Compatibility	⚠️ Warning	New Ginkgo e2e tests in test/e2e/validation_webhook_tests.go use multiple MicroShift-unavailable APIs (configv1, quotav1, PrometheusRules, managed.openshift.io) without protective skip/apigroup tags.	Add [apigroup:config.openshift.io], [apigroup:quota.openshift.io], or [Skipped:MicroShift] labels to tests. Alternatively, guard with exutil.IsMicroShiftCluster() checks and g.Skip().
Single Node Openshift (Sno) Test Compatibility	⚠️ Warning	New e2e tests assume multi-node clusters: 2 tests schedule pods onto master/infra nodes (won't exist on SNO), 1 test explicitly expects to find infra nodes (will fail on SNO).	Add [Skipped:SingleReplicaTopology] labels to these 3 tests or guard with infrastructure.Status.ControlPlaneTopology checks to skip on single-node clusters.
Ipv6 And Disconnected Network Test Compatibility	⚠️ Warning	New Ginkgo e2e tests added in test/e2e/validation_webhook_tests.go pull images from external registries (quay.io, registry.access.redhat.com) that will fail in disconnected IPv6-only environments.	Replace hardcoded external registry image references with cluster-internal images or image streams, or add [Skipped:Disconnected] to test names requiring external connectivity.

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: updating Kubernetes-related Go module dependencies across the repository.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	All Ginkgo test names in test/e2e/validation_webhook_tests.go are stable and deterministic. No dynamic values, generated identifiers, timestamps, or node/pod/namespace names appear in any test titles.
Topology-Aware Scheduling Compatibility	✅ Passed	PR only updates Go module dependencies (go.mod/go.sum). The check requires modifications to deployment manifests or operator code; neither are changed here.
Ote Binary Stdout Contract	✅ Passed	OTE Binary Stdout Contract check is not applicable—this repository is a production webhook service, not an OTE test binary that communicates with openshift-tests.
No-Weak-Crypto	✅ Passed	PR only updates go.mod dependencies without introducing any weak crypto (MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB mode), custom crypto implementations, or non-constant-time comparisons.
Container-Privileges	✅ Passed	PR contains no privileged containers or privilege escalation settings. Security contexts actually restrict privileges with allowPrivilegeEscalation: false, runAsNonRoot: true, and capability drops.
No-Sensitive-Data-In-Logs	✅ Passed	PR only updates Go module dependencies (go.mod/go.sum); no new logging code introducing sensitive data exposure detected.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/go_modules/kubernetes-c5c46e0eec

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign typeid for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@dependabot[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/pr-check	bfd8caf	link	true	/test pr-check
ci/prow/e2e-binary-build-success	bfd8caf	link	true	/test e2e-binary-build-success

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[coderabbitai]

🧹 Nitpick comments (1)

go.mod (1)

1-96: Ensure SBOM generation and artifact signing are configured.

The coding guidelines require that builds produce provenance attestations (SBOM) and that artifacts are signed with Sigstore/cosign.

Verify that the CI/CD pipeline:

1. Generates Software Bill of Materials (SBOM) for these dependency updates
2. Signs build artifacts using Sigstore or cosign
3. Publishes provenance attestations alongside releases

This is particularly important for a dependency update of this scope, which includes major version bumps and multiple security-sensitive components.

As per coding guidelines: SBOM build should produce provenance attestations, and artifacts should be signed with Sigstore/cosign.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 1 - 96, The repository (module
github.com/openshift/managed-cluster-validating-webhooks) lacks CI steps to
produce SBOMs and Sigstore attestations for the updated dependencies; update
your CI "build" and "release" pipeline jobs to (1) generate an SBOM (e.g., run
syft or similar against the built binary and the Go module graph), (2) create
and attach a provenance attestation (e.g., using cosign/rekor attest or in-toto
predicate) and (3) sign the build artifacts with cosign and publish both the
signed artifacts and the attestation alongside releases; also add a verification
step in CI to validate signatures/attestations before publishing.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@go.mod`:
- Around line 1-96: The repository (module
github.com/openshift/managed-cluster-validating-webhooks) lacks CI steps to
produce SBOMs and Sigstore attestations for the updated dependencies; update
your CI "build" and "release" pipeline jobs to (1) generate an SBOM (e.g., run
syft or similar against the built binary and the Go module graph), (2) create
and attach a provenance attestation (e.g., using cosign/rekor attest or in-toto
predicate) and (3) sign the build artifacts with cosign and publish both the
signed artifacts and the attestation alongside releases; also add a verification
step in CI to validate signatures/attestations before publishing.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: cf902c36-b736-4a1e-b228-61c50697ff3a

📥 Commits

Reviewing files that changed from the base of the PR and between 647db14 and bfd8caf.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod