Skip to content

build(deps): bump the sigs-k8s-dependencies group across 1 directory with 9 updates#8960

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/sigs-k8s-dependencies-8091a30236
Open

build(deps): bump the sigs-k8s-dependencies group across 1 directory with 9 updates#8960
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/sigs-k8s-dependencies-8091a30236

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 8, 2026

Copy link
Copy Markdown
Contributor

Bumps the sigs-k8s-dependencies group with 8 updates in the / directory:

Package From To
sigs.k8s.io/cluster-api 1.12.7 1.13.3
sigs.k8s.io/cluster-api-provider-aws/v2 2.10.0 2.12.1
sigs.k8s.io/cluster-api-provider-azure 1.22.0 1.26.0
sigs.k8s.io/cluster-api-provider-gcp 1.11.0 1.12.0
sigs.k8s.io/cluster-api-provider-kubevirt 0.11.1 0.11.2
sigs.k8s.io/cluster-api-provider-openstack 0.14.4 0.14.6
sigs.k8s.io/secrets-store-csi-driver 1.4.8 1.6.0
sigs.k8s.io/structured-merge-diff/v6 6.4.0 6.4.2

Updates sigs.k8s.io/cluster-api from 1.12.7 to 1.13.3

Release notes

Sourced from sigs.k8s.io/cluster-api's releases.

v1.13.3

👌 Kubernetes version support

  • Management Cluster: v1.32.x -> v1.36.x
  • Workload Cluster: v1.30.x -> v1.36.x

More information about version support can be found here

Changes since v1.13.2

📈 Overview

  • 14 new commits merged
  • 1 feature addition ✨
  • 3 bugs fixed 🐛

✨ New Features

  • ClusterCache: Expose DefaultTransform on CacheOptions (#13785)

🐛 Bug Fixes

  • clusterctl: Skip update check for clusterctl completion (#13697)
  • KCP: Fix failing TestKubeadmControlPlaneReconciler_reconcileEtcdMembers (#13728)
  • Security: Grant RBAC to support OwnerReferencesPermissionEnforcement admission controller (#13817)

🌱 Others

  • CI: Bump gcb-docker-gcloud image (#13794)
  • Dependency: Bump go to v1.25.11 (#13789)
  • Dependency: Bump golang/x/net to 0.55.0 (#13746)
  • e2e: Bump to kind main to fix e2e tests (#13769)
  • e2e: Bump to kind v0.32.0 (#13781)
  • e2e: Bump to kind v0.32.0 (#13787)
  • e2e: Make the clusterctl upgrade management cluster control plane count configurable (#13771)
  • KCP: Update RemoveEtcdMember to accept a *etcd.Member instead of a member name (#13786)
  • Misc: Add finalizer only after we got owner/cluster (#13748)

📖 Additionally, there has been 1 contribution to our documentation and book. (#13719)

Dependencies

Added

Nothing has changed.

Changed

  • golang.org/x/crypto: v0.50.0 → v0.51.0
  • golang.org/x/mod: v0.34.0 → v0.35.0
  • golang.org/x/net: v0.53.0 → v0.55.0
  • golang.org/x/sys: v0.43.0 → v0.45.0
  • golang.org/x/telemetry: 579e4da → be6f6cb
  • golang.org/x/term: v0.42.0 → v0.43.0
  • golang.org/x/text: v0.36.0 → v0.37.0
  • golang.org/x/tools: v0.43.0 → v0.44.0

... (truncated)

Commits
  • cf0f6c0 Merge pull request #13817 from erikgb/fix-owner-ref-rbac
  • 6782093 🐛 Grant RBAC to support OwnerReferencesPermissionEnforcement admission co...
  • 81c0a11 Merge pull request #13787 from sivchari/cherry-pick-15f3dc16af800e69d1258c05e...
  • 9829e18 Merge pull request #13794 from sbueringer/pr-fix-image-and-link-gcb
  • 61356cf Bump gcb-docker-gcloud image
  • 190a931 🌱 Bump to kind v0.32.0 (#13781)
  • ad1efe8 Merge pull request #13789 from Prajyot-Parab/release-1.13
  • fa8e5dd Bump go to v1.25.11
  • 88430af Merge pull request #13786 from k8s-infra-cherrypick-robot/cherry-pick-13784-t...
  • e1d10d6 Update RemoveEtcdMember to accept a *etcd.Member instead of a member name
  • Additional commits viewable in compare view

Updates sigs.k8s.io/cluster-api-provider-aws/v2 from 2.10.0 to 2.12.1

Release notes

Sourced from sigs.k8s.io/cluster-api-provider-aws/v2's releases.

v2.12.1

Release notes for Cluster API Provider AWS (CAPA) v2.12.1

Documentation

Changelog since v2.11.1

What's Changed

⚠ API Changes

🚀 Features

🐛 Bug Fixes

📖 Documentation

Dependencies

🌱 Others

... (truncated)

Commits
  • 13af066 Merge pull request #6119 from k8s-infra-cherrypick-robot/cherry-pick-6118-to-...
  • ac5ef6a Fix Go releaser Go version
  • 9a260b1 Update metadata for 2.12 series
  • a1c4dac Merge pull request #6099 from judexzhu/fix/acm-35916-external-auth-kubeconfig
  • 667a7ef Merge pull request #6055 from andclt/ocm-role-deps
  • 228b7dc fix: create CAPI-contract kubeconfig for external auth ROSA clusters
  • 80b8c4a Merge pull request #6080 from andclt/fix/cluster-scoped-identity-permissions
  • fc7af5e Merge pull request #5813 from giantswarm/eni-managed
  • cd679e3 Merge pull request #6089 from andclt/fix/rbac-rosanetwork
  • af101a6 feat: add support for OCM role creation
  • Additional commits viewable in compare view

Updates sigs.k8s.io/cluster-api-provider-azure from 1.22.0 to 1.26.0

Release notes

Sourced from sigs.k8s.io/cluster-api-provider-azure's releases.

v1.26.0

Upgrading

Please note that upgrading CAPZ should be done one minor release at a time. Skipping ahead by more than one minor (for example, from v1.24.x to v1.26.0) is not tested and may cause problems.

See Upgrading for more details.

Changes by Kind

Other (Cleanup or Flake)

  • Managed clusters using enablePreviewFeatures now use the containerservice.azure.com/v20251002preview ASO API version instead of the soon-to-be-retired v1api20240402preview. If you patch preview fields, note that the per-agent-pool enableCustomCATrust field is gone; use the cluster-level securityProfile.customCATrustCertificates instead. (#6427, @​mboersma)
  • Bump Azure Service Operator to v2.18.0 (#6390, @​mboersma)

Dependencies

Added

Nothing has changed.

Changed

Removed

Nothing has changed.

Details

kubernetes-sigs/cluster-api-provider-azure@v1.25.0...v1.26.0

v1.25.1

Upgrading

Please note that upgrading CAPZ should be done one minor release at a time. Skipping ahead by more than one minor (for example, from v1.23.x to v1.25.1) is not tested and may cause problems.

See Upgrading for more details.

Changes by Kind

... (truncated)

Commits
  • 19ff821 Merge pull request #6435 from mboersma/add-release-notes-v1.26.0
  • c01ea40 Add release notes for v1.26.0
  • 8b6cc62 Merge pull request #6430 from marek-veber/fix/CVE-2026-41567-main
  • 4f1985c fix: bump moby dependencies for CVE-2026-41567
  • 0717027 Merge pull request #6425 from kubernetes-sigs/dependabot/go_modules/github.co...
  • aa6af04 dependabot(deps): bump github.com/onsi/ginkgo/v2 from 2.31.0 to 2.32.0
  • 11ad6fd Merge pull request #6428 from mboersma/add-release-1.26-metadata
  • c137fe1 Merge pull request #6427 from mboersma/use-aso-v20251002preview-api
  • 52ab703 Merge pull request #6424 from kubernetes-sigs/dependabot/go_modules/github.co...
  • 9e551bb Update test metadata and versions for CAPZ v1.25.0 (#6420)
  • Additional commits viewable in compare view

Updates sigs.k8s.io/cluster-api-provider-gcp from 1.11.0 to 1.12.0

Release notes

Sourced from sigs.k8s.io/cluster-api-provider-gcp's releases.

v1.12.0

Urgent Upgrade Notes

(No, really, you MUST read this before you upgrade)

  • Action required If you are importing CAPG APIs and are using SetupWebhookWithManager you'll need to update your call sites. SetupWebhookWithManager methods have been removed from all api packages for all exported types. Callers importing CAPG as a Go library can no longer use these methods. (#1615, @​mdbooth)
  • Action required The short names for GCPManagedClusterTemplate, GCPManagedControlPlaneTemplate, and GCPManagedMachinePoolTemplate have changed from amct, amcpt, and ammpt to gcpmct, gcpmcpt, and gcpmmpt, respectively. If you have any automation that relies on the short names, they will need to be updated accordingly. (#1618, @​furkatgofurov7)

Changes by Kind

Feature

  • Add support for advanced firewall rule management in Network via the enhanced Firewall field. Users can now toggle default rule creation using DefaultRulesManagement or provide custom rules via FirewallRules (#1538, @​barbacbd)

Bug or Regression

  • Fix nil pointer dereference when creating GKE clusters with useIPAliases enabled and optional pod/service CIDR blocks omitted (#1624, @​pkieszcz)
  • Fix nil pointer dereferences when creating/reconciling private GKE clusters with PSC mode (#1591, @​pkieszcz)

Uncategorized

Dependencies

Added

  • cloud.google.com/go/pubsub/v2: v2.0.0
  • github.com/cenkalti/backoff/v5: v5.0.3
  • github.com/golang-jwt/jwt/v5: v5.2.2
  • github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus: v1.0.1
  • github.com/grpc-ecosystem/go-grpc-middleware/v2: v2.3.0
  • github.com/moby/moby/api: v1.54.1
  • github.com/moby/moby/client: v0.4.0
  • github.com/olekukonko/cat: 50322a0
  • github.com/olekukonko/errors: v1.1.0
  • github.com/olekukonko/ll: v0.1.1
  • github.com/olekukonko/ts: 78ecb04
  • github.com/russross/blackfriday: v1.6.0
  • github.com/santhosh-tekuri/jsonschema/v5: v5.3.1
  • go.etcd.io/raft/v3: v3.6.0
  • pgregory.net/rapid: v1.2.0
  • sigs.k8s.io/structured-merge-diff/v6: v6.3.2

Changed

... (truncated)

Commits
  • b9b055d Merge pull request #1668 from damdo/testing-investigation
  • 26cd1a5 ci: dynamically compute Ginkgo parallel nodes based on available CPUs
  • 4ded539 Merge pull request #1667 from damdo/e2e-ccm-version-templated
  • 6a81d9c e2e: template cloud-controller-manager version as a variable
  • 72b0f05 Merge pull request #1664 from damdo/fix-upgrades-template-ccm-label
  • f67bdb5 fix: add missing cloud.config to upgrades cluster template
  • cafca0a e2e: pin cloud-controller-manager image to v34.2.0
  • c90374b fix: add missing ccm label to upgrades cluster template
  • 8e41d44 Merge pull request #1665 from damdo/ssh-log-collection
  • 830e2df Merge pull request #1663 from damdo/bump-capi-1.12.8
  • Additional commits viewable in compare view

Updates sigs.k8s.io/cluster-api-provider-kubevirt from 0.11.1 to 0.11.2

Release notes

Sourced from sigs.k8s.io/cluster-api-provider-kubevirt's releases.

v0.11.2

What's Changed

Full Changelog: kubernetes-sigs/cluster-api-provider-kubevirt@v0.11.1...v0.11.2

Commits
  • 2c2bb5b Merge pull request #376 from nunnatsa/r0.11-fix-drain-guest-node-name
  • 9a5c58b don't hold the PR if Coverall is down, ad fails the coverage github action
  • 6162f65 e2e: verify guest node is cordoned during eviction test
  • 65f182e fix: use guest node name when draining node on VM eviction
  • cf0e93d Merge pull request #372 from nunnatsa/r011-cherrypick-366
  • 88ae097 Expose dual-stack addresses in KubevirtMachine status
  • See full diff in compare view

Updates sigs.k8s.io/cluster-api-provider-openstack from 0.14.4 to 0.14.6

Release notes

Sourced from sigs.k8s.io/cluster-api-provider-openstack's releases.

v0.14.6

Highlights

Changes since v0.14.4

📈 Overview

  • 13 new commits merged
  • 1 bug fixed 🐛

🐛 Bug Fixes

  • Add nil guard for LoadBalancerNetwork (#3193)

🌱 Others

  • Bump cloudbuild image to support go 1.26 (#3234)
  • Bump Go version to 1.25.10 (#3163)
  • Bump Go version to 1.25.11 (#3199)
  • Ignore two vulnerabilities in x/net (#3200)
  • Patch govulncheck to support ignoring findings (#3187)

Dependencies

Added

Nothing has changed.

Changed

  • github.com/coredns/corefile-migration: v1.0.31 → v1.0.32
  • github.com/moby/spdystream: v0.5.0 → v0.5.1
  • github.com/onsi/ginkgo/v2: v2.28.1 → v2.28.2
  • github.com/onsi/gomega: v1.39.1 → v1.42.0
  • go.opentelemetry.io/otel/metric: v1.40.0 → v1.41.0
  • go.opentelemetry.io/otel/trace: v1.40.0 → v1.41.0
  • go.opentelemetry.io/otel: v1.40.0 → v1.41.0
  • gopkg.in/ini.v1: v1.67.1 → v1.67.3
  • k8s.io/api: v0.34.6 → v0.34.9
  • k8s.io/apiextensions-apiserver: v0.34.6 → v0.34.9
  • k8s.io/apimachinery: v0.34.6 → v0.34.9
  • k8s.io/apiserver: v0.34.6 → v0.34.9
  • k8s.io/client-go: v0.34.6 → v0.34.9
  • k8s.io/code-generator: v0.34.6 → v0.34.9
  • k8s.io/component-base: v0.34.6 → v0.34.9
  • k8s.io/kms: v0.34.6 → v0.34.9
  • sigs.k8s.io/cluster-api/test: v1.12.7 → v1.12.8
  • sigs.k8s.io/cluster-api: v1.12.7 → v1.12.8
  • sigs.k8s.io/structured-merge-diff/v6: v6.3.2 → v6.4.0

... (truncated)

Commits
  • 2bfcd2a Merge pull request #3234 from k8s-infra-cherrypick-robot/cherry-pick-3207-to-...
  • 1e77bfb Bump cloudbuild image to support go 1.26
  • 7439c70 Merge pull request #3231 from kubernetes-sigs/dependabot/go_modules/release-0...
  • 2c8ff0c 🌱(deps): Bump the all-go-mod-patch-and-minor group across 1 director...
  • 545e6f7 Merge pull request #3218 from kubernetes-sigs/dependabot/github_actions/relea...
  • 93f1677 Merge pull request #3217 from kubernetes-sigs/dependabot/go_modules/release-0...
  • 5d720ee 🌱(deps): Bump actions/checkout in the all-github-actions group
  • 7fdc4af 🌱(deps): Bump the all-go-mod-patch-and-minor group across 1 director...
  • 1a01ba6 Merge pull request #3200 from Nordix/lentzi90/ignore-vulns
  • 2048414 Merge pull request #3199 from bnallapeta/bump-go-1.25.11
  • Additional commits viewable in compare view

Updates sigs.k8s.io/controller-runtime from 0.22.5 to 0.23.3

Release notes

Sourced from sigs.k8s.io/controller-runtime's releases.

v0.23.3

What's Changed

Full Changelog: kubernetes-sigs/controller-runtime@v0.23.2...v0.23.3

v0.23.2

What's Changed

Full Changelog: kubernetes-sigs/controller-runtime@v0.23.1...v0.23.2

v0.23.1

What's Changed

Full Changelog: kubernetes-sigs/controller-runtime@v0.23.0...v0.23.1

v0.23.0

🔆 Highlights

⚠️ Breaking changes

✨ Features

... (truncated)

Commits
  • f9589b9 Merge pull request #3469 from k8s-infra-cherrypick-robot/cherry-pick-3468-to-...
  • 25615ad Ensure DefaulterRemoveUnknownOrOmitableFields is still working even if object...
  • 8122a62 Merge pull request #3467 from k8s-infra-cherrypick-robot/cherry-pick-3463-to-...
  • 35093c6 Reduce memory usage of default webhooks
  • 4dbfa5c [release-0.23] 🐛 Fix fake client's SSA status patch resource version check (#...
  • f52bbb8 Merge pull request #3437 from k8s-infra-cherrypick-robot/cherry-pick-3430-to-...
  • 4f41337 Merge pull request #3438 from k8s-infra-cherrypick-robot/cherry-pick-3434-to-...
  • e29a1b9 seedling: Test cache reader waits for cache sync
  • 83c8dc3 bug: Fakeclient: Fix status apply if existing object has managedFields set
  • bf6bcd5 Merge pull request #3436 from k8s-infra-cherrypick-robot/cherry-pick-3431-to-...
  • Additional commits viewable in compare view

Updates sigs.k8s.io/secrets-store-csi-driver from 1.4.8 to 1.6.0

Release notes

Sourced from sigs.k8s.io/secrets-store-csi-driver's releases.

v1.6.0 - 2026-04-29

Secret Rotation via RequiresRepublish

The dedicated secret rotation controller has been replaced with the CSI RequiresRepublish mechanism. The CSIDriver now sets requiresRepublish: true, causing kubelet to periodically call NodePublishVolume, which re-fetches secrets from the provider when --enable-secret-rotation=true. The --rotation-poll-interval now acts as a minimum cache duration between rotations. This change removes the need for privileged RBAC permissions (listing pods, secrets, and creating service account tokens) that were previously required by the rotation controller. Rotation-specific RBAC resources (rbac-secretproviderrotation.yaml, rbac-secretprovidertokenrequest.yaml) have been removed and can be cleaned up from manual deployments.

Note: Please review the upgrade notes before upgrading.

Changelog

Bug Fixes 🐞

Build 🏭

Continuous Integration 💜

Documentation 📘

Features 🌈

Maintenance 🔧

... (truncated)

Commits
  • 4960f96 Merge pull request #2034aramase/automated-cherry-pick-of-#2033

@dependabot dependabot Bot added area/ci-tooling Indicates the PR includes changes for CI or tooling ok-to-test Indicates a non-member PR verified by an org member that is safe to test. labels Jul 8, 2026
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci

openshift-ci Bot commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci openshift-ci Bot requested review from csrwng and enxebre July 8, 2026 11:45
@openshift-ci

openshift-ci Bot commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign enxebre for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Jul 8, 2026

Copy link
Copy Markdown
Contributor
📝 Walkthrough

Walkthrough

This pull request updates go.mod by changing the Go toolchain from 1.25.8 to 1.25.9 and refreshing Kubernetes, Cluster API, controller-runtime, secrets-store, structured-merge-diff, grpc-gateway, Prometheus, OpenTelemetry, and golang.org/x/mod dependencies. Several indirect requirements were removed, including ocm-common, govalidator/v11, and the AWS SDK EKS service module. No exported or public entity declarations were altered.

Possibly related PRs

🚥 Pre-merge checks | ✅ 11
✅ Passed checks (11 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed No *_test.go files changed in the 447-path dependency/vendor diff, so no Ginkgo titles were introduced or modified.
Test Structure And Quality ✅ Passed Only go.mod/go.sum changed; no Ginkgo or test files were modified, so the test-quality criteria are not applicable.
Topology-Aware Scheduling Compatibility ✅ Passed PR only refreshes go.mod/go.sum/vendor deps; no repo-local manifests/controllers changed, and no new scheduling constraints were added.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed PR only changes go.mod/go.sum and vendored deps; no new Ginkgo e2e test code was added to review for IPv4 or external connectivity issues.
No-Weak-Crypto ✅ Passed No added weak-crypto code; the only new comparisons are object/JSON checks in controller-runtime fake client, not secret/token handling.
Container-Privileges ✅ Passed Only dependency/vendor files changed; no container/K8s manifests or privilege flags were found in the modified files.
No-Sensitive-Data-In-Logs ✅ Passed Diff is a dependency/vendor refresh; added logs are generic status/error messages, with no password/token/PII/internal-hostname strings.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes a Dependabot dependency bump for the sigs-k8s-dependencies group in the repository root.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch dependabot/go_modules/sigs-k8s-dependencies-8091a30236

Comment @coderabbitai help to get the list of available commands.

…with 9 updates

Bumps the sigs-k8s-dependencies group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [sigs.k8s.io/cluster-api](https://github.com/kubernetes-sigs/cluster-api) | `1.12.7` | `1.13.3` |
| [sigs.k8s.io/cluster-api-provider-aws/v2](https://github.com/kubernetes-sigs/cluster-api-provider-aws) | `2.10.0` | `2.12.1` |
| [sigs.k8s.io/cluster-api-provider-azure](https://github.com/kubernetes-sigs/cluster-api-provider-azure) | `1.22.0` | `1.26.0` |
| [sigs.k8s.io/cluster-api-provider-gcp](https://github.com/kubernetes-sigs/cluster-api-provider-gcp) | `1.11.0` | `1.12.0` |
| [sigs.k8s.io/cluster-api-provider-kubevirt](https://github.com/kubernetes-sigs/cluster-api-provider-kubevirt) | `0.11.1` | `0.11.2` |
| [sigs.k8s.io/cluster-api-provider-openstack](https://github.com/kubernetes-sigs/cluster-api-provider-openstack) | `0.14.4` | `0.14.6` |
| [sigs.k8s.io/secrets-store-csi-driver](https://github.com/kubernetes-sigs/secrets-store-csi-driver) | `1.4.8` | `1.6.0` |
| [sigs.k8s.io/structured-merge-diff/v6](https://github.com/kubernetes-sigs/structured-merge-diff) | `6.4.0` | `6.4.2` |



Updates `sigs.k8s.io/cluster-api` from 1.12.7 to 1.13.3
- [Release notes](https://github.com/kubernetes-sigs/cluster-api/releases)
- [Commits](kubernetes-sigs/cluster-api@v1.12.7...v1.13.3)

Updates `sigs.k8s.io/cluster-api-provider-aws/v2` from 2.10.0 to 2.12.1
- [Release notes](https://github.com/kubernetes-sigs/cluster-api-provider-aws/releases)
- [Commits](kubernetes-sigs/cluster-api-provider-aws@v2.10.0...v2.12.1)

Updates `sigs.k8s.io/cluster-api-provider-azure` from 1.22.0 to 1.26.0
- [Release notes](https://github.com/kubernetes-sigs/cluster-api-provider-azure/releases)
- [Commits](kubernetes-sigs/cluster-api-provider-azure@v1.22.0...v1.26.0)

Updates `sigs.k8s.io/cluster-api-provider-gcp` from 1.11.0 to 1.12.0
- [Release notes](https://github.com/kubernetes-sigs/cluster-api-provider-gcp/releases)
- [Commits](kubernetes-sigs/cluster-api-provider-gcp@v1.11.0...v1.12.0)

Updates `sigs.k8s.io/cluster-api-provider-kubevirt` from 0.11.1 to 0.11.2
- [Release notes](https://github.com/kubernetes-sigs/cluster-api-provider-kubevirt/releases)
- [Changelog](https://github.com/kubernetes-sigs/cluster-api-provider-kubevirt/blob/main/RELEASE.md)
- [Commits](kubernetes-sigs/cluster-api-provider-kubevirt@v0.11.1...v0.11.2)

Updates `sigs.k8s.io/cluster-api-provider-openstack` from 0.14.4 to 0.14.6
- [Release notes](https://github.com/kubernetes-sigs/cluster-api-provider-openstack/releases)
- [Changelog](https://github.com/kubernetes-sigs/cluster-api-provider-openstack/blob/main/RELEASE.md)
- [Commits](kubernetes-sigs/cluster-api-provider-openstack@v0.14.4...v0.14.6)

Updates `sigs.k8s.io/controller-runtime` from 0.22.5 to 0.23.3
- [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases)
- [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md)
- [Commits](kubernetes-sigs/controller-runtime@v0.22.5...v0.23.3)

Updates `sigs.k8s.io/secrets-store-csi-driver` from 1.4.8 to 1.6.0
- [Release notes](https://github.com/kubernetes-sigs/secrets-store-csi-driver/releases)
- [Changelog](https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/main/docs/RELEASE.md)
- [Commits](kubernetes-sigs/secrets-store-csi-driver@v1.4.8...v1.6.0)

Updates `sigs.k8s.io/structured-merge-diff/v6` from 6.4.0 to 6.4.2
- [Release notes](https://github.com/kubernetes-sigs/structured-merge-diff/releases)
- [Changelog](https://github.com/kubernetes-sigs/structured-merge-diff/blob/master/RELEASE.md)
- [Commits](kubernetes-sigs/structured-merge-diff@v6.4.0...v6.4.2)

---
updated-dependencies:
- dependency-name: sigs.k8s.io/cluster-api
  dependency-version: 1.13.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: sigs-k8s-dependencies
- dependency-name: sigs.k8s.io/cluster-api-provider-aws/v2
  dependency-version: 2.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: sigs-k8s-dependencies
- dependency-name: sigs.k8s.io/cluster-api-provider-azure
  dependency-version: 1.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: sigs-k8s-dependencies
- dependency-name: sigs.k8s.io/cluster-api-provider-gcp
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: sigs-k8s-dependencies
- dependency-name: sigs.k8s.io/cluster-api-provider-kubevirt
  dependency-version: 0.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: sigs-k8s-dependencies
- dependency-name: sigs.k8s.io/cluster-api-provider-openstack
  dependency-version: 0.14.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: sigs-k8s-dependencies
- dependency-name: sigs.k8s.io/controller-runtime
  dependency-version: 0.23.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: sigs-k8s-dependencies
- dependency-name: sigs.k8s.io/secrets-store-csi-driver
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: sigs-k8s-dependencies
- dependency-name: sigs.k8s.io/structured-merge-diff/v6
  dependency-version: 6.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: sigs-k8s-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/go_modules/sigs-k8s-dependencies-8091a30236 branch from 1cb7296 to 3437d37 Compare July 10, 2026 01:05
@openshift-ci

openshift-ci Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

@dependabot[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/images 3437d37 link true /test images
ci/prow/verify-deps 3437d37 link true /test verify-deps
ci/prow/okd-scos-images 3437d37 link true /test okd-scos-images

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@hypershift-jira-solve-ci

Copy link
Copy Markdown
Contributor

I now have all the evidence needed. Here is the complete analysis:

Test Failure Analysis Complete

Job Information

Test Failure Analysis

Error

Pod scheduling timeout.

0/48 nodes are available: 13 node(s) didn't match Pod's node affinity/selector,
27 node(s) had untolerated taint(s), 3 node(s) didn't match pod anti-affinity rules,
5 node(s) were unschedulable.
preemption: 0/48 nodes are available: 3 node(s) didn't match pod anti-affinity rules,
45 Preemption is not helpful for scheduling.

Summary

The security job did not execute at all — it failed before any test code ran. The ci-operator pod remained in Pending phase for the full 30-minute scheduling timeout and was then terminated by Prow. The Kubernetes scheduler could not place the pod on any of the 48 available nodes in the CI cluster due to a combination of node affinity/selector mismatches, untolerated taints, anti-affinity conflicts, and unschedulable nodes. This is a transient CI infrastructure capacity issue, not a product or test code defect.

Root Cause

The pod for job pull-ci-openshift-hypershift-main-security was created at 2026-07-10T01:06:13Z but never transitioned out of Pending phase. After 30 minutes, Prow's pod-pending timeout killed it and marked the job as error.

The scheduling failure breakdown across 48 cluster nodes:

Reason Node Count Explanation
Untolerated taints 27 The pod only tolerates node-role.kubernetes.io/ci-prowjobs-worker, not-ready, unreachable, and memory-pressure. 27 nodes had other taints the pod couldn't tolerate.
Node affinity/selector mismatch 13 The pod requires nodeSelector: ci-workload=prowjobs and node affinity for amd64 or arm64 arch, excluding hostname ip-10-0-152-65.ec2.internal. 13 nodes didn't satisfy these constraints.
Unschedulable 5 5 nodes were cordoned or otherwise marked unschedulable.
Anti-affinity conflict 3 The pod has a requiredDuringScheduling anti-affinity rule against pods with label pod-scaler.openshift.io/measured=false, preventing co-location on these 3 nodes.

Combined, all 48 nodes were excluded (27 + 13 + 5 + 3 = 48). Preemption could not help either — 45 nodes were not helped by preemption and 3 were blocked by anti-affinity (which preemption cannot resolve).

There is no build-log.txt and no artifacts directory because the ci-operator container never started. The pod phase was Pending from creation to deletion. This is purely a CI cluster resource contention / scheduling issue at the time the job ran.

Recommendations
  1. Retest the PR — This is a transient infrastructure issue. Re-triggering the job with /retest or /test security should succeed when cluster capacity is available.
  2. No code changes needed — The failure is unrelated to PR build(deps): bump the sigs-k8s-dependencies group across 1 directory with 9 updates #8960's dependency bump. No product code or test code was executed.
  3. If retests consistently fail — Escalate to the CI infrastructure team (Test Platform / DPTP) to investigate node availability for ci-workload=prowjobs labeled nodes, particularly around node taints and capacity at the time of failure.
Evidence
Evidence Detail
Pod phase Pending (never ran)
Status description Pod scheduling timeout.
Pod created 2026-07-10T01:06:13Z
Pod deleted 2026-07-10T01:36:13Z (30 min timeout)
Cluster nodes 0/48 schedulable for this pod
Node selector ci-workload: prowjobs
Arch affinity amd64, arm64 required
Tolerated taints ci-prowjobs-worker, not-ready, unreachable, memory-pressure only
Build log Not present (container never started)
Artifacts directory Not present (no execution occurred)
Job result error (infrastructure failure, not test failure)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/ci-tooling Indicates the PR includes changes for CI or tooling ok-to-test Indicates a non-member PR verified by an org member that is safe to test.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants