🤖 Update gardener/gardener to v1.142.0 (minor)

[ske-renovate-ce]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/gardener/gardener	v1.141.2 → v1.142.0
github.com/gardener/gardener/pkg/apis	v1.141.2 → v1.142.0

---

Release Notes

gardener/gardener (github.com/gardener/gardener)

v1.142.0

Compare Source

[github.com/gardener/gardener:v1.142.0]

⚠️ Breaking Changes

• [OPERATOR] With the discontinued support of Kubernetes 1.31, the API group settings.gardener.cloud was completely removed from the Gardener API.
  Earlier, this API group contained the resources OpenIDConnectPreset and ClusterOpenIDConnectPreset which have been unsupported since Kubernetes 1.32.
  Please make sure to clean up all OpenIDConnectPreset and ClusterOpenIDConnectPreset objects and automations before upgrading to this version. by @​timuthy [#​14615]
• [OPERATOR] ⚠️ Gardener does no longer support Garden, Seed, or Shoot clusters with Kubernetes version 1.31. Make sure to upgrade all existing clusters before upgrading to this Gardener version. by @​timuthy [#​14615]
• [USER] The deprecated gardener/controlplane Helm chart has been removed. Use gardener-operator to deploy Gardener instead. by @​rfranzke [#​14614]
• [DEVELOPER] The make operator-seed-{up,dev,down} targets have been renamed to make gardener-{up,dev,down}. make kind-{up,down} is now an alias for make kind-single-node-{up,down}. All local development scenarios that were previously based on the legacy gardener/controlplane Helm chart are now based on gardener-operator. by @​rfranzke [#​14614]
• [DEVELOPER] In case you're using the remote development setup, the kubeconfig of the remote cluster you're using as seed is no longer expected in /dev-setup/remote/kubeconfigs/kubeconfig but in dev-setup/kubeconfigs/remote/kubeconfig. by @​rfranzke [#​14614]
• [DEVELOPER] ./hack/usage/generate-admin-kubeconfig.sh has been merged into ./hack/usage/generate-kubeconfig.sh. Use ./hack/usage/generate-kubeconfig.sh --help to learn about the usage. by @​rfranzke [#​14614]

📰 Noteworthy

• [OPERATOR] DisableNginxIngressInGarden allows to disable nginx-ingress in a Garden runtime cluster managed by gardener-operator. by @​ScheererJ [#​14636]
• [OPERATOR] DisableNginxIngressInSeed allows to disable nginx-ingress in Seed clusters. by @​ScheererJ [#​14636]
• [OPERATOR] DisableNginxIngressInShoot allows to disable nginx-ingress for Shoot clusters:
  • If set for gardener-apiserver, it disallows creation of new Shoot clusters with the nginx-ingress addon enabled and it prevents existing shoot clusters from enabling it. Shoot cluster, which already have the addon enabled, are left as is.
  • If set for gardener-controller-manager, it disables the nginx-ingress addon for all Shoot clusters during their next maintenance period. by @​ScheererJ [#​14636]
• [OPERATOR] The propagateCAFromKubeAPIServerSNI field was added to the GardenerDashboardConfig API. When the kube-apiserver SNI endpoint uses a private/custom CA, set this field to true to include the CA certificate in the dashboard's apiServerCaData. This makes the behavior introduced in #​14217 opt-in, preserving transparent CA rotation for publicly trusted certificates. by @​petersutter [#​14637]
• [OPERATOR] The gardener-operator now deploys an extensionsv1alpha1.BackupEntry alongside the BackupBucket when etcd backup is configured (when BackupEntryForGarden feature gate is enabled), aligning the garden controller with the same extension contract that shoot clusters use for backup credential management. by @​rfranzke [#​14628]
• [OPERATOR] When backup is configured in the Garden resource, the gardener-operator now requires a BackupEntry controller registration in the operator.gardener.cloud/v1alpha1.Extension resource of the backup provider when the new BackupEntryForGarden feature gate is enabled. If the Extension object for the provider does not yet include BackupEntry in .spec.resources, it must be added before upgrading gardener-operator. All provider extensions should also enable their BackupEntry controllers when running in the garden runtime cluster. by @​rfranzke [#​14628]
• [DEVELOPER] The local gardenadm development setup for the unmanaged infrastructure scenario now uses GinD (Gardener-in-Docker) instead of KinD. Refer to the updated documentation for details. by @​rfranzke [#​14700]

✨ New Features

• [USER] The Shoot API now supports configuring cluster-autoscaler's maxBinpackingTime flag for specifying a longer duration to be spent on binpacking for scale-up. by @​takoverflow [#​14698]
• [DEVELOPER] ManagedResources that use the resources.gardener.cloud/delete-on-invalid-update annotation can now also specify the deletion propagation with the annotation resources.gardener.cloud/deletion-propagation-on-invalid-update by @​maboehm [#​14642]

🐛 Bug Fixes

• [OPERATOR] An issue causing the guestbook TM test to fail against IPv6 Shoot clusters in now fixed. by @​plkokanov [#​14701]
• [OPERATOR] The secret used for the kube-rbac-proxy for the opentelemetry-collector is now deployed for all shoot clusters, independent of whether node logging is enabled or not. by @​iypetrov [#​14428]
• [OPERATOR] A bug has been fixed where the EveryNodeReadyCondition was showing and error for self-hosted shoots on unmanaged infrastructure. by @​tobschli [#​14665]
• [OPERATOR] The systemdunitcheck controller now correctly treats systemd units that are in a failed state but explicitly disabled as healthy. by @​cerealsnow [#​14733]
• [OPERATOR] Errors during resource deletion caused by missing CRDs are now ignored by @​matthias-horne [#​14645]
• [USER] Rotating the etcd encryption key tolerates unavailable APIServices. by @​robinschneider [#​14679]
• [DEPENDENCY] The reconcileSeedWebhookConfig function now correctly reconciles both MutatingWebhookConfiguration and ValidatingWebhookConfiguration for extensions that register both mutating and validating admission webhooks. Previously, only the first configuration was reconciled due to a premature return in the loop. by @​Roncossek [#​14664]

🏃 Others

• [OPERATOR] Add resourceId for image istio-basic-auth-server to fix overwrite image lookup by @​MartinWeindel [#​14716]
• [OPERATOR] Certain best-practice Envoy settings for HTTP2 protocol options have been applied to istio-ingressgateways. by @​oliver-goetz [#​14678]
• [OPERATOR] The images of the registry caches used in the dev setups are now updated to distribution/distribution@v3.1.0. by @​dimitar-kostadinov [#​14718]
• [OPERATOR] The Prometheus health check rule evaluation interval has been reduced from 60s to 5s for faster detection of health check state changes. by @​vicwicker [#​14662]
• [OPERATOR] The garden Prometheus maximum metric retention has been increased to 30 days. by @​vicwicker [#​14657]
• [DEVELOPER] The TM tests no longer rely on the nginx-ingress addon for any Kubernetes release. by @​ScheererJ [#​14643]
• [DEPENDENCY] The following dependencies have been updated:
  • gardener/ext-authz-server from v0.2.0 to v0.3.0. Release Notes by @​gardener-ci-robot [#​14725]
• [DEPENDENCY] The following dependencies have been updated:
  • registry.k8s.io/coredns/coredns from v1.14.2 to v1.14.3. by @​gardener-ci-robot [#​14724]
• [DEPENDENCY] The following dependencies have been updated:
  • envoyproxy/envoy from distroless-v1.37.2 to v1.38.0. Release Notes by @​gardener-ci-robot [#​14674]
• [DEPENDENCY] The following dependencies have been updated:
  • quay.io/cortexproject/cortex from v1.20.1 to v1.21.0. by @​gardener-ci-robot [#​14695]
• [DEPENDENCY] The following dependencies have been updated:
  • registry.k8s.io/dns/k8s-dns-node-cache from 1.26.7 to 1.26.8. by @​gardener-ci-robot [#​14659]
• [DEPENDENCY] The following dependencies have been updated:
  • quay.io/prometheus/alertmanager from v0.32.0 to v0.32.1. by @​gardener-ci-robot [#​14732]
• [DEPENDENCY] The following dependencies have been updated:
  • quay.io/kiwigrid/k8s-sidecar from 2.6.0 to 2.7.1. by @​gardener-ci-robot [#​14699]
• [DEPENDENCY] The following dependencies have been updated:
  • quay.io/brancz/kube-rbac-proxy from v0.21.2 to v0.22.0. by @​gardener-ci-robot [#​14703]
• [DEPENDENCY] The following dependencies have been updated:
  • gardener/dashboard from 1.83.11 to 1.84.1. Release Notes by @​marc1404 [#​14771]

application/spdx+json

• admission-controller-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:1eb5d65be651660ff2e4dd3012315ab4f8feac3b94af8e321f833e0848ab69c4
• admission-controller-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:f926858481411ed15cc1a31be14b214e764f882163c764e23def1c1fe1d9daf6
• apiserver-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:0e02ebedbe9ed6a34dc99736a6e41b45ad5b730f564b1eaa848d5f156e11e311
• apiserver-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:1815b4550cbd1f2c6c4b7d50ac6e092e3ad3e6f207de9666ad889243bb0988f8
• controller-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:7234f2705acad476e26c663eb8d589770e7f77108eeeb28fa33a38c07908c0f3
• controller-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:f5a956378f5fba34b51ca828e0f1c448b11a9e27f65633ec73874d695231689c
• gardenadm-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:3b7c03096e6f8de1fee49ec62a17849aeae261b67751871da0dc635764d689b5
• gardenadm-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:fc7085b785212951f63bfaa63bbea9d019cdc7f66735c2fc2dcec753f01bb70a
• gardenlet-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:34f283da125518e68415117b86c926ed5b103ec88a4c82c2602399172dc5d70a
• gardenlet-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:d7f1c555d75bc17c1a3c3fc6c6034fd9e934396a455d8e4df2c03021f4921438
• node-agent-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:5c26ac6437adcfcd20aeab1a233d29d774980fc4d8f1801ffde480fb4a893635
• node-agent-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:7b518fb710dc7cc187784d621fe5deb7e5d3032623233768232596b5a575db0f
• operator-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:13c624f9dfbf1b6b146f314b8da20b5edde93a4c4c14ddbb0d4424555e04f138
• operator-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:22549456a978c9ff74e6b79252abb655e3926b36c0bfdc8714c127f412c800f1
• resource-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:9769cc9338182588139cb6a6d3c39ad79f9a0a27a3bc447c3b1c0292b1968391
• resource-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:a8745e5d63dc898d042ccbad0947cc617e5624bf1165bb8bf90744dcbcd91471
• scheduler-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:0a6ec2623516f5c20d688b379c0ee075ed81deff5509abb600569182fd5c9add
• scheduler-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:57694de6715aae8751988b140957adff88db9b020f01cecac1f0cf42b5ad27c5

Helm Charts

• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.142.0
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.142.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.142.0

Container (OCI) Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.142.0
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.142.0
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.142.0
• gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.142.0
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.142.0
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.142.0
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.142.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.142.0
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.142.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[ske-renovate-ce]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 12 additional dependencies were updated

Details:

Package	Change
go.opentelemetry.io/contrib/otelconf	v0.22.0 -> v0.23.0
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc	v0.18.0 -> v0.19.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc	v1.42.0 -> v1.43.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	v1.42.0 -> v1.43.0
go.opentelemetry.io/otel/exporters/prometheus	v0.64.0 -> v0.65.0
go.opentelemetry.io/otel/exporters/stdout/stdoutlog	v0.18.0 -> v0.19.0
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric	v1.42.0 -> v1.43.0
go.opentelemetry.io/otel/exporters/stdout/stdouttrace	v1.42.0 -> v1.43.0
go.uber.org/zap	v1.27.1 -> v1.28.0
golang.org/x/exp	v0.0.0-20260218203240-3dfff04db8fa -> v0.0.0-20260312153236-7ab1446f8b90
google.golang.org/genproto/googleapis/api	v0.0.0-20260401024825-9d38bb4040a9 -> v0.0.0-20260406210006-6f92a3bedf2d
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260401024825-9d38bb4040a9 -> v0.0.0-20260406210006-6f92a3bedf2d

[ske-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign breuerfelix for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment