[github.com/gardener/gardener:v1.145.0]

⚠️ Breaking Changes

• [OPERATOR] The gardener-scheduler candidate determination strategy deployed by gardener-operator is now configurable via Garden.spec.virtualCluster.gardener.gardenerScheduler.candidateDeterminationStrategy (allowed values: SameRegion, MinimalDistance). The default is now SameRegion, matching the documented scheduler default; previously the strategy was hardcoded to MinimalDistance. Operators relying on the previous behavior must explicitly set the field to MinimalDistance. by @marc1404 [#14963]
• [OPERATOR] The GA-ed and always enabled UseUnifiedHTTPProxyPort feature gate is removed. If you have references to this feature gate, clean them up before upgrading to this version of Gardener. by @hammadzf [#14999]
• [USER] The GA-ed and unconditionally enabled InPlaceOrRecreate VPA feature gate is removed. It must be removed from Shoot/Seed/Garden manifests. by @gardener-ci-robot [#14936]
• [DEVELOPER] The local development setup on macOS contains changes which affect the order of DNS resolvers in /etc/resolver/local.gardener.cloud file. In order to regenerate the /etc/resolver/local.gardener.cloud file you can either remove it, or manually re-order the DNS resolvers. by @dnaeon [#14998]

📰 Noteworthy

• [OPERATOR] gardenlet migration code was removed that cleaned up ShootStates that were wrongfully created. by @tobschli [#14981]
• [OPERATOR] gardenlet migration code was removed that converted the secret data to a new format, which was introduced with #14268. by @tobschli [#14981]

✨ New Features

• [OPERATOR] Gardener can now support clusters with Kubernetes version 1.36. To allow creation/update of 1.36 clusters you will have to update the version of your provider extension(s) to a version that supports 1.36 as well. Please consult the respective releases and notes in the provider extension's repository. by @ary1992 [#14924]
• [OPERATOR] The pvc-autoscaler can be deployed as a Seed cluster component. Operators can configure it by setting the .spec.settings.persistentVolumeClaimAutoscaler.enabled field to true in the Seed spec. The field is defaulted to false until further integrations with the observability stack. by @RadaBDimitrova [#14991]
• [OPERATOR] Add logic to restart the OpenTelemetry Collector systemd service when it enters a degraded state due to resource leaks. by @iypetrov [#14928]
• [DEVELOPER] Gardener can now support clusters with Kubernetes version 1.36. Extension developers have to prepare individual extensions as well to work with 1.36. by @ary1992 [#14924]

🐛 Bug Fixes

• [OPERATOR] A bug has been fixed that prevented Gardenlet from reconciling shoots without an external cluster domain. by @Wieneo [#14521]
• [OPERATOR] Fix a recent regression and two long-standing bugs in the Prometheus recording rules related to metering: a load regression in garden Prometheus caused by an added metadata label, metering accumulation resets across short outages, and inflated averages for short-lived shoots. by @istvanballok [#14982]
• [DEVELOPER] The hack/usage/generate-kubeconfig.sh script is now fixed to no longer fail when invoked without arguments — it now correctly defaults to the shoot subcommand. by @DobromirNPeev [#14990]
• [DEVELOPER] Update hack/usage/wait-for.sh to handle empty arrays gracefully in older Bash versions, preventing an unbound variable error. by @iypetrov [#14973]

🏃 Others

• [OPERATOR] Align customverbauthorizer subject handling with RBAC subject types. by @vpnachev [#15081]
• [OPERATOR] The blackbox exporter in the runtime cluster is granted access to private networks. This is only relevant for the local setup, where the istio ingresses are deployed in a docker container listening on private IPs. by @vicwicker [#14962]
• [OPERATOR] A new helper script hack/rebootstrap-gardenlet.sh has been added to the Gardener repository that helps operators to manually re-bootstrap a gardenlet whose Kubeconfig (client certificate) has experired. More information can be found in here. by @timuthy [#14805]
• [OPERATOR] EXPERIMENTAL_DISABLE_KUBERNETES_VERSION_CHECK flag logs check results but ignores errors. It also disables version check in the seed reconciler. by @matthias-horne [#14989]
• [DEVELOPER] The vendored opentelemetry-operator API types under third_party/open-telemetry/opentelemetry-operator are now removed in favor of the newly introduced github.com/open-telemetry/opentelemetry-operator/apis sub-module. This decouples Gardener's sigs.k8s.io/controller-runtime version from the one used by opentelemetry-operator. by @iypetrov [#14944]
• [DEVELOPER] The local docker registry is configured as insecure in remote local setup. by @vicwicker [#15037]
• [DEPENDENCY] The following dependencies have been updated:
  • registry.k8s.io/autoscaling/vpa-admission-controller from 1.6.0 to 1.7.0.
  • registry.k8s.io/autoscaling/vpa-recommender from 1.6.0 to 1.7.0.
  • registry.k8s.io/autoscaling/vpa-updater from 1.6.0 to 1.7.0. by @gardener-ci-robot [#14936]
• [DEPENDENCY] The following dependencies have been updated:
  • gcr.io/istio-release/pilot from 1.29.3 to 1.29.4.
  • gcr.io/istio-release/proxyv2 from 1.29.3 to 1.29.4.
  • istio.io/api from v1.29.3 to v1.29.4. by @gardener-ci-robot [#14980]
• [DEPENDENCY] The following dependencies have been updated:
  • registry.k8s.io/kube-state-metrics/kube-state-metrics from v2.19.0 to v2.19.1. by @gardener-ci-robot [#15036]
• [DEPENDENCY] The following dependencies have been updated:
  • credativ/vali from v2.2.33 to v2.2.34. Release Notes by @gardener-ci-robot [#15034]
• [DEPENDENCY] The following dependencies have been updated:
  • gardener/gardener-discovery-server from v0.11.0 to v0.12.0. Release Notes by @gardener-ci-robot [#15055]
• [DEPENDENCY] The following dependencies have been updated:
  • gardener/autoscaler from v1.35.0 to v1.35.1. Release Notes by @gardener-ci-robot [#15057]
• [DEPENDENCY] The following dependencies have been updated:
  • envoyproxy/envoy from distroless-v1.38.0 to v1.38.1. Release Notes
  • envoyproxy/envoy from v1.38.0 to v1.38.1. by @gardener-ci-robot [#14978]
• [DEPENDENCY] The following dependencies have been updated:
  • gardener/coredns-config-adapter from v0.6.0 to v0.7.0. Release Notes by @gardener-ci-robot [#15001]
• [DEPENDENCY] The following dependencies have been updated:
  • gardener/autoscaler from v1.34.2 to v1.34.3. Release Notes by @gardener-ci-robot [#15056]
• [DEPENDENCY] The following dependencies have been updated:
  • envoyproxy/envoy from distroless-v1.38.1 to v1.38.2. Release Notes
  • envoyproxy/envoy from v1.38.1 to v1.38.2. by @gardener-ci-robot [#15019]
• [DEPENDENCY] The following dependencies have been updated:
  • gardener/dependency-watchdog from v1.7.0 to v1.8.0. Release Notes
  • github.com/gardener/dependency-watchdog from v1.7.0 to v1.8.0. by @gardener-ci-robot [#14965]
• [DEPENDENCY] The following dependencies have been updated:
  • credativ/plutono from v7.5.48 to v7.5.49. Release Notes by @gardener-ci-robot [#15035]
• [DEPENDENCY] The following dependencies have been updated:
  • quay.io/prometheus/alertmanager from v0.32.1 to v0.32.2. by @gardener-ci-robot [#14983]
• [DEPENDENCY] The following dependencies have been updated:
  • gardener/etcd-druid from v0.36.3 to v0.36.4. Release Notes
  • github.com/gardener/etcd-druid/api from v0.36.3 to v0.36.4. by @gardener-ci-robot [#15011]
• [DEPENDENCY] The following dependencies have been updated:
  • quay.io/cortexproject/cortex from v1.21.0 to v1.21.1. by @gardener-ci-robot [#14984]
• [DEPENDENCY] The following dependencies have been updated:
  • gardener/ingress-default-backend from 0.26.0 to 0.27.0. Release Notes by @gardener-ci-robot [#15048]

application/spdx+json

• admission-controller-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:5816a374cad4c109ee4b1cb693bfb2bf8e08313d2051750f35602fd0726e16eb
• admission-controller-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:de3962a5818ef92149ab14a482ac6c626b1caa959280fdd5397c8642d80b2425
• apiserver-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:24fb0ec649d71a08bd52e26c5894530693fdf68f3e15726e56dab6219d61b6ba
• apiserver-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:b9683229a4a53118d728cf5b3401b2e9c36fb7c13b45965e8aafd9f9065ea268
• controller-manager-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:0aa2aac88d4987aac3eaa4e598c50aeeef9e680721384833ba5a8e9dba79df05
• controller-manager-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:b92c7a5e6d516bbda630531a79ceef3b08a3f5cad9ee8e71be8911a37f226184
• gardenadm-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:7ccaa2662d73984e2ef9abf0fa583ef3c077e5528e3cdf51a071a741a28d5660
• gardenadm-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:d09aef919499b6aacd506bad0cc40c533f1cf7ee87d0c4ebeee240aaddc45b2a
• gardenlet-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:e1b009a2bd63437ca7d92780996bbb6326112523eb52cb6155ba14f2715ccda5
• gardenlet-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:fe6f8346b66f54c8935af1f94253d33c8f0836d33c946c12d9411efc6796d8a7
• node-agent-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:4906998133e5f2421eaf7da8e3da5ac22251b94bdd1be30d728227f1eb2fefbd
• node-agent-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:d09c3c3c5ed5307b2329ddf7de0900e7695a14aa9979e74c57f4005184feccaf
• operator-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:3ddb0510a5d5225f1945e656df8b4af904ec1b0b0556d5acf202508ba7472ccc
• operator-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:6038b5089ca5c1cc206755cd642dfaae74fc441872fb1e6a91097a15add687ec
• resource-manager-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:9c70a5b496729f0b5fcc575b8e9ff109af3165a11c50cfb28c718e55029ea582
• resource-manager-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:a62c2a89189f5a002eea06c46463589c99f07013f897613e9fc0ed674a000237
• scheduler-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:6e8c26d48d2c5782d98d7ddb65e510ccf7337eb6f8e9239cf3bae34a2185a377
• scheduler-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:afb323d85d2266343c3a882381f6e6c2021a8fb289fe5eb41000a98ce77eddaf

application/vnd.cyclonedx+json

• admission-controller-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:29d56e7ba2860b1dc7e07bf227a2cbb1de94296cc3a7ca9e73cb4a4a164b6ab7
• admission-controller-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:ef66b54c0670443dc664e2d5e3c2981c5d3c8215eeaa64de769e27fcaba29761
• apiserver-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:0813c86110e5d02eabca3f374fa38ff610883ff9d5141245776f4b9091aff0ab
• apiserver-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:fb0a67a0bb02f4fbcd3485da536d16b6406847b4dc236180ffb0fb52a5ffbf1a
• controller-manager-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:8904ece69d6e29f8b62f820722d53da4f337dfa7f820d95c9af4e39a944a7485
• controller-manager-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:c768c9e248d038538fb8f407df14cfda9da5e397b3665baf1b0c44e222709ffc
• gardenadm-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:30ee287bfed3098e3fd2b78c60567ca950f46d393663d71aa3fa5ab36ade930f
• gardenadm-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:5b83dbc763bdf1da7f23162dc5ab1591886a9572758cb5c812093f28fb823768
• gardenlet-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:7049ada0ba7e51c1aa3a6110b276f0d9f8d18d08c33a604dabb016c31f323805
• gardenlet-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:c2eae935888bcc1153c1494a6bed38a71c4285ad1a984ec74ead9607995b20ef
• node-agent-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:4d6f31c32123714262a8b9d6763354e3eddb4875cdf8acf0b722dd837f58b993
• node-agent-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:aa138343f670176f4a9a4ba2501a78d061450132dc5530795128330abf27208e
• operator-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:85083ea4d2f336913b5857d9e912b04faf107f98cb967308a59b73e4db60cbcc
• operator-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:fe0f61a755138494e0ad77fb3e348c4903a3ea4aa2d25cacff96caae23e153b1
• resource-manager-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:5e3a80f1f1c4323151781d489172dca28b4eb3420ce3553fa5a7ebc14e7daec5
• resource-manager-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:7e3647e74b2cc23c9fc39e8d96c44186377d3337b94b36a8bcf13fd1d11601d1
• scheduler-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:398ae948ecd6fe9689988fb2f6a88565124647b6206e7da005e27cc5e69a118b
• scheduler-sbom-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:fa2a546e14c6c1e8c4919fb6ce37c5a94126db518f3ba4f69b5021cc92cf6213

Helm Charts

• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.145.0
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.145.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.145.0

Container (OCI) Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.145.0
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.145.0
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.145.0
• gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.145.0
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.145.0
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.145.0
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.145.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.145.0
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.145.0