chore: backport 20260205

.github/workflows/chart.yml

@@ -18,7 +18,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.1
+      - uses: actions/checkout@v6.0.2
         with:
           submodules: true
           fetch-depth: 0

.github/workflows/ci.yml

@@ -13,7 +13,7 @@ on:
     paths-ignore: [docs/**, "**.md", "**.mdx", "**.png", "**.jpg"]
 
 env:
-  GO_VERSION: '1.24.9'
+  GO_VERSION: '1.24.12'
   CERT_MANAGER_VERSION: 'v1.16.2'
 
 jobs:
@@ -41,7 +41,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6.0.1
+        uses: actions/checkout@v6.0.2
 
       - name: Set up Ginkgo CLI
         run: |
@@ -91,7 +91,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6.0.1
+        uses: actions/checkout@v6.0.2
 
       - name: Move Docker data directory to /mnt
         # The default storage device on GitHub-hosted runners is running low during e2e tests.

.github/workflows/code-lint.yml

@@ -14,7 +14,7 @@ on:
 
 env:
   # Common versions
-  GO_VERSION: '1.24.9'
+  GO_VERSION: '1.24.12'
 
 jobs:
 
@@ -43,7 +43,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout
-        uses: actions/checkout@v6.0.1
+        uses: actions/checkout@v6.0.2
         with:
           submodules: true
 
@@ -64,7 +64,7 @@ jobs:
         go-version: ${{ env.GO_VERSION }}
 
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v6.0.1
+      uses: actions/checkout@v6.0.2
 
     - name: golangci-lint
       run: make lint

.github/workflows/codeql-analysis.yml

@@ -38,7 +38,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6.0.1
+      uses: actions/checkout@v6.0.2
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/codespell.yml

@@ -16,7 +16,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4.1.7
+      - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v4.1.7
       - uses: codespell-project/actions-codespell@8f01853be192eb0f849a5c7d721450e7a467c579 # master
         with:
           check_filenames: true

.github/workflows/markdown-lint.yml

@@ -10,7 +10,7 @@ jobs:
   markdown-link-check:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6.0.1
+    - uses: actions/checkout@v6.0.2
     - uses: tcort/github-action-markdown-link-check@v1
       with:
         # this will only show errors in the output

.github/workflows/trivy.yml

@@ -18,7 +18,7 @@ env:
   MEMBER_AGENT_IMAGE_NAME: member-agent
   REFRESH_TOKEN_IMAGE_NAME: refresh-token
 
-  GO_VERSION: '1.24.9'
+  GO_VERSION: '1.24.12'
 
 jobs:
   export-registry:
@@ -44,7 +44,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout code
-        uses: actions/checkout@v6.0.1
+        uses: actions/checkout@v6.0.2
 
       - name: Login to ${{ env.REGISTRY }}
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef

.github/workflows/upgrade.yml

@@ -17,7 +17,7 @@ on:
     paths-ignore: [docs/**, "**.md", "**.mdx", "**.png", "**.jpg"]
 
 env:
-  GO_VERSION: '1.24.9'
+  GO_VERSION: '1.24.12'
 
 jobs:
   detect-noop:
@@ -44,7 +44,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6.0.1
+        uses: actions/checkout@v6.0.2
         with:
           # Fetch the history of all branches and tags.
           # This is needed for the test suite to switch between releases.
@@ -146,7 +146,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6.0.1
+        uses: actions/checkout@v6.0.2
         with:
           # Fetch the history of all branches and tags.
           # This is needed for the test suite to switch between releases.
@@ -248,7 +248,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6.0.1
+        uses: actions/checkout@v6.0.2
         with:
           # Fetch the history of all branches and tags.
           # This is needed for the test suite to switch between releases.

.golangci.yml

@@ -1,6 +1,6 @@
 run:
   timeout: 15m
-  go: '1.24.9'
+  go: '1.24.12'
 
 linters-settings:
   stylecheck:

charts/member-agent/README.md

@@ -42,8 +42,17 @@ helm upgrade member-agent member-agent/ --namespace fleet-system
 | logVerbosity            | Log level. Uses V logs (klog)                                                                                                                                                                                                                  | `3`                                                  |
 | propertyProvider        | The property provider to use with the member agent; if none is specified, the Fleet member agent will start with no property provider (i.e., the agent will expose no cluster properties, and collect only limited resource usage information) | ``                                                   |
 | region                  | The region where the member cluster resides                                                                                                                                                                                                    | ``                                                   |
+| workApplierRequeueRateLimiterAttemptsWithFixedDelay | This parameter is a set of values to control how frequent KubeFleet should reconcile (processed) manifests; it specifies then number of attempts to requeue with fixed delay before switching to exponential backoff | `1` |
+| workApplierRequeueRateLimiterFixedDelaySeconds | This parameter is a set of values to control how frequent KubeFleet should reconcile (process) manifests; it specifies the fixed delay in seconds for initial requeue attempts | `5` |
+| workApplierRequeueRateLimiterExponentialBaseForSlowBackoff | This parameter is a set of values to control how frequent KubeFleet should reconcile (process) manifests; it specifies the exponential base for the slow backoff stage | `1.2` |
+| workApplierRequeueRateLimiterInitialSlowBackoffDelaySeconds | This parameter is a set of values to control how frequent KubeFleet should reconcile (process) manifests; it specifies the initial delay in seconds for the slow backoff stage | `2` |
+| workApplierRequeueRateLimiterMaxSlowBackoffDelaySeconds | This parameter is a set of values to control how frequent KubeFleet should reconcile (process) manifests; it specifies the maximum delay in seconds for the slow backoff stage | `15` |
+| workApplierRequeueRateLimiterExponentialBaseForFastBackoff | This parameter is a set of values to control how frequent KubeFleet should reconcile (process) manifests; it specifies the exponential base for the fast backoff stage | `1.5` |
+| workApplierRequeueRateLimiterMaxFastBackoffDelaySeconds | This parameter is a set of values to control how frequent KubeFleet should reconcile (process) manifests; it specifies the maximum delay in seconds for the fast backoff stage | `900` |
+| workApplierRequeueRateLimiterSkipToFastBackoffForAvailableOrDiffReportedWorkObjs | This parameter is a set of values to control how frequent KubeFleet should reconcile (process) manifests; it specifies whether to skip the slow backoff stage and start fast backoff immediately for available or diff-reported work objects | `true` |
 | config.azureCloudConfig | The cloud provider configuration                                                                                                                                                                                                               | **required if property provider is set to azure**    |
 
+
 ## Override Azure cloud config
 
 **If PropertyProvider feature is set to azure, then a cloud configuration is required.**

charts/member-agent/templates/deployment.yaml

@@ -45,6 +45,30 @@ spec:
             - --enable-pprof={{ .Values.enablePprof }}
             - --pprof-port={{ .Values.pprofPort }}
             - --hub-pprof-port={{ .Values.hubPprofPort }}
+            {{- if .Values.workApplierRequeueRateLimiterAttemptsWithFixedDelay }}
+            - --work-applier-requeue-rate-limiter-attempts-with-fixed-delay={{ .Values.workApplierRequeueRateLimiterAttemptsWithFixedDelay }}
+            {{- end }}
+            {{- if .Values.workApplierRequeueRateLimiterFixedDelaySeconds }}
+            - --work-applier-requeue-rate-limiter-fixed-delay-seconds={{ .Values.workApplierRequeueRateLimiterFixedDelaySeconds }}
+            {{- end }}
+            {{- if .Values.workApplierRequeueRateLimiterExponentialBaseForSlowBackoff }}
+            - --work-applier-requeue-rate-limiter-exponential-base-for-slow-backoff={{ .Values.workApplierRequeueRateLimiterExponentialBaseForSlowBackoff }}
+            {{- end }}
+            {{- if .Values.workApplierRequeueRateLimiterInitialSlowBackoffDelaySeconds }}
+            - --work-applier-requeue-rate-limiter-initial-slow-backoff-delay-seconds={{ .Values.workApplierRequeueRateLimiterInitialSlowBackoffDelaySeconds }}
+            {{- end }}
+            {{- if .Values.workApplierRequeueRateLimiterMaxSlowBackoffDelaySeconds }}
+            - --work-applier-requeue-rate-limiter-max-slow-backoff-delay-seconds={{ .Values.workApplierRequeueRateLimiterMaxSlowBackoffDelaySeconds }}
+            {{- end }}
+            {{- if .Values.workApplierRequeueRateLimiterExponentialBaseForFastBackoff }}
+            - --work-applier-requeue-rate-limiter-exponential-base-for-fast-backoff={{ .Values.workApplierRequeueRateLimiterExponentialBaseForFastBackoff }}
+            {{- end }}
+            {{- if .Values.workApplierRequeueRateLimiterMaxFastBackoffDelaySeconds }}
+            - --work-applier-requeue-rate-limiter-max-fast-backoff-delay-seconds={{ .Values.workApplierRequeueRateLimiterMaxFastBackoffDelaySeconds }}
+            {{- end }}
+            {{- if .Values.workApplierRequeueRateLimiterSkipToFastBackoffForAvailableOrDiffReportedWorkObjs }}
+            - --work-applier-requeue-rate-limiter-skip-to-fast-backoff-for-available-or-diff-reported-work-objs={{ .Values.workApplierRequeueRateLimiterSkipToFastBackoffForAvailableOrDiffReportedWorkObjs }}
+            {{- end }}
             {{- if .Values.propertyProvider }}
             - --property-provider={{ .Values.propertyProvider }}
             {{- end }}

cmd/hubagent/workload/setup.go

@@ -161,18 +161,21 @@ func SetupControllers(ctx context.Context, wg *sync.WaitGroup, mgr ctrl.Manager,
 	validator.RestMapper = mgr.GetRESTMapper()          // webhook needs this to validate GVK of resource selector
 
 	// Set up  a custom controller to reconcile placement objects
+	resourceSelectorResolver := controller.ResourceSelectorResolver{
+		RestMapper:        mgr.GetRESTMapper(),
+		InformerManager:   dynamicInformerManager,
+		ResourceConfig:    resourceConfig,
+		SkippedNamespaces: skippedNamespaces,
+		EnableWorkload:    opts.EnableWorkload,
+	}
 	pc := &placement.Reconciler{
 		Client:                                  mgr.GetClient(),
 		Recorder:                                mgr.GetEventRecorderFor(placementControllerName),
-		RestMapper:                              mgr.GetRESTMapper(),
-		InformerManager:                         dynamicInformerManager,
-		ResourceConfig:                          resourceConfig,
-		SkippedNamespaces:                       skippedNamespaces,
 		Scheme:                                  mgr.GetScheme(),
 		UncachedReader:                          mgr.GetAPIReader(),
+		ResourceSelectorResolver:                resourceSelectorResolver,
 		ResourceSnapshotCreationMinimumInterval: opts.ResourceSnapshotCreationMinimumInterval,
 		ResourceChangesCollectionDuration:       opts.ResourceChangesCollectionDuration,
-		EnableWorkload:                          opts.EnableWorkload,
 	}
 
 	rateLimiter := options.DefaultControllerRateLimiter(opts.RateLimiterOpts)

docker/crd-installer.Dockerfile

@@ -1,5 +1,5 @@
 # Build the crdinstaller binary
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.24.9 AS builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.24.12 AS builder
 
 ARG GOOS=linux
 ARG GOARCH=amd64

docker/hub-agent.Dockerfile

@@ -1,5 +1,5 @@
 # Build the hubagent binary
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.24.9 AS builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.24.12 AS builder
 
 ARG GOOS=linux
 ARG GOARCH=amd64

docker/member-agent.Dockerfile

@@ -1,5 +1,5 @@
 # Build the memberagent binary
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.24.9 AS builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.24.12 AS builder
 
 ARG GOOS=linux
 ARG GOARCH=amd64

docker/refresh-token.Dockerfile

@@ -1,5 +1,5 @@
 # Build the refreshtoken binary
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.24.9 AS builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.24.12 AS builder
 
 ARG GOOS="linux"
 ARG GOARCH="amd64"

go.mod

@@ -1,6 +1,6 @@
 module go.goms.io/fleet
 
-go 1.24.9
+go 1.24.12
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0
@@ -42,6 +42,7 @@ require (
 	sigs.k8s.io/cloud-provider-azure/pkg/azclient v0.5.20
 	sigs.k8s.io/cluster-inventory-api v0.0.0-20251028164203-2e3fabb46733
 	sigs.k8s.io/controller-runtime v0.22.4
+	sigs.k8s.io/yaml v1.6.0
 )
 
 require (
@@ -134,7 +135,6 @@ require (
 	sigs.k8s.io/kustomize/kyaml v0.18.1 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
-	sigs.k8s.io/yaml v1.6.0 // indirect
 )
 
 replace (

pkg/controllers/clusterinventory/clusterprofile/controller.go

@@ -39,6 +39,7 @@ import (
 
 	clusterv1beta1 "go.goms.io/fleet/apis/cluster/v1beta1"
 	"go.goms.io/fleet/pkg/propertyprovider"
+	"go.goms.io/fleet/pkg/utils/condition"
 	"go.goms.io/fleet/pkg/utils/controller"
 )
 
@@ -110,6 +111,13 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 		return ctrl.Result{}, nil
 	}
 
+	// Check if the MemberCluster has joined.
+	joinedCondition := meta.FindStatusCondition(mc.Status.Conditions, string(clusterv1beta1.ConditionTypeMemberClusterJoined))
+	if !condition.IsConditionStatusTrue(joinedCondition, mc.Generation) {
+		klog.V(2).InfoS("Member cluster has not joined; skip cluster profile reconciliation", "memberCluster", mcRef)
+		return ctrl.Result{}, nil
+	}
+
 	// Check if the MemberCluster object has the cleanup finalizer; if not, add it.
 	if !controllerutil.ContainsFinalizer(mc, clusterProfileCleanupFinalizer) {
 		mc.Finalizers = append(mc.Finalizers, clusterProfileCleanupFinalizer)
@@ -175,6 +183,12 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 // fillInClusterStatus fills in the ClusterProfile status fields from the MemberCluster status.
 // Currently, it only fills in the Kubernetes version field.
 func (r *Reconciler) fillInClusterStatus(mc *clusterv1beta1.MemberCluster, cp *clusterinventory.ClusterProfile) {
+	clusterPropertyCondition := meta.FindStatusCondition(mc.Status.Conditions, string(clusterv1beta1.ConditionTypeClusterPropertyCollectionSucceeded))
+	if !condition.IsConditionStatusTrue(clusterPropertyCondition, mc.Generation) {
+		klog.V(3).InfoS("Cluster property collection has not succeeded; skip updating the cluster profile status", "memberCluster", klog.KObj(mc), "clusterProfile", klog.KObj(cp))
+		return
+	}
+
 	k8sversion, exists := mc.Status.Properties[propertyprovider.K8sVersionProperty]
 	if exists {
 		klog.V(3).InfoS("Get Kubernetes version from member cluster status", "kubernetesVersion", k8sversion.Value, "clusterProfile", klog.KObj(cp))