Update Python dependencies (major)

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
allure-pytest-collection-report	integration	major	v35.0.4 → v48.0.4
data-platform-helpers	dependencies	major	^0.1.3 → ^1.0.1
kubernetes	integration	major	^30.1.0 → ^35.0.0
ops (changelog)	integration	major	>=2.21 → >=3.7.0
ops (changelog)	dependencies	major	>=2.21 → >=3.7.0
pytest (changelog)	integration	major	^8.1.1 → ^9.0.2
pytest-github-secrets	integration	major	v35.0.4 → v48.0.4
pytest-operator-groups	integration	major	v35.0.4 → v48.0.4

---

Release Notes

canonical/data-platform-workflows (allure-pytest-collection-report)

v48.0.4

Compare Source

What's Changed

• patch: Update GitHub actions (major) by @​renovate[bot] in #​361

New Contributors

• @​renovate[bot] made their first contribution in #​361

Full Changelog: canonical/data-platform-workflows@v48.0.3...v48.0.4

v48.0.3

Compare Source

What's Changed

• patch: Fix renovate config by @​carlcsaposs-canonical in #​357

Full Changelog: canonical/data-platform-workflows@v48.0.2...v48.0.3

v48.0.2

Compare Source

What's Changed

• patch(release_snap_pr.yaml): Fix command arg by @​carlcsaposs-canonical in #​359

Full Changelog: canonical/data-platform-workflows@v48.0.1...v48.0.2

v48.0.1

Compare Source

What's Changed

• patch(build_charm.yaml): Fix empty command arg by @​carlcsaposs-canonical in #​358

Full Changelog: canonical/data-platform-workflows@v48.0.0...v48.0.1

v48.0.0

Compare Source

What's Changed

• breaking(release_snap_*.yaml): Remove candid auth by @​carlcsaposs-canonical in #​353

Full Changelog: canonical/data-platform-workflows@v47.0.2...v48.0.0

Migration instructions for v48

Remove Snap Store secret and follow usage docs for release_snap_edge.yaml or release_snap_pr.yaml to create new environment secret

Combined migration instructions for v43-v48 (i.e. for migrating from v42 to v48)

All workflows

For each reusable workflow, check the usage docs (https://github.com/canonical/data-platform-workflows?tab=readme-ov-file#usage) and, for each workflow call, update permissions to match the usage docs

integration_test_charm.yaml

https://github.com/canonical/data-platform-workflows/blob/v29.1.0/.github/workflows/integration_test_charm_deprecation_notice.md#migration-instructions

lint.yaml

• Replace lint.yaml with lint_workflows.yaml
• Add .github/zizmor.yaml file following usage docs
• Create a separate job (outside of reusable workflow call) to run tox run -e lint

release_snap.yaml

For releases to edge

• Replace release_snap.yaml with release_snap_edge.yaml
• Replace channel input with track input
  • Remove "/edge" from channel input value to get new track input value
• Remove SNAP_STORE_TOKEN secret and follow usage docs to create new environment secret. Update secret name in workflow call.
• Remove create-git-tags input

For releases of PR branches:

• Replace release_snap.yaml with release_snap_pr.yaml
• Replace channel input with track input
• Remove SNAP_STORE_TOKEN secret and follow usage docs to create new environment secret. Update secret name in workflow call.
• Remove create-git-tags input

release_rock.yaml

• Replace release_rock.yaml with release_rock_edge.yaml
• Remove create-git-tags input

_mirror_charm.yaml

• Remove MIRROR_REPOS_PAT secret and follow usage docs to create new environment secret

_update_bundle.yaml

• Remove CREATE_PR_APP_TOKEN secret and follow usage docs to create new environment secret

release_charm_pr.yaml

• Delete edge-pr deployments to reduce confusion
  • https://redirect.github.com/orgs/community/discussions/85000
  • e.g. https://github.com/canonical/postgresql-operator/deployments/edge-pr
  • contact @​carlcsaposs-canonical to run script on repo after updating dpw

release_charm_edge.yaml and release_charm_pr.yaml

No further action needed at this time. Once candid auth is removed (https://discourse.canonical.com/t/charmhub-teams-deprecation/7035), we will have a breaking change for release_charm_*.yaml and new secrets will need to be created. (We are waiting for charmcraft to add support for non-candid auth.)

v47.0.2

Compare Source

What's Changed

• patch: Add Renovate by @​carlcsaposs-canonical in #​352

Full Changelog: canonical/data-platform-workflows@v47.0.1...v47.0.2

v47.0.1

Compare Source

What's Changed

• patch(link_workflows.yaml): Verify actionlint attestation by @​carlcsaposs-canonical in #​350

Full Changelog: canonical/data-platform-workflows@v47.0.0...v47.0.1

v47.0.0

Compare Source

What's Changed

• breaking(lint_workflows.yaml): Add zizmor by @​carlcsaposs-canonical in #​349

Full Changelog: canonical/data-platform-workflows@v46.0.0...v47.0.0

[!TIP]
Combined migration instructions for v43-v48 (i.e. from v42 to v48) are available at https://github.com/canonical/data-platform-workflows/releases/tag/v48.0.0

v46.0.0

Compare Source

What's Changed

• breaking: Rename lint.yaml to lint_workflows.yaml by @​carlcsaposs-canonical in #​348

Full Changelog: canonical/data-platform-workflows@v45.0.0...v46.0.0

Migration instructions

[!TIP]
Combined migration instructions for v43-v48 (i.e. from v42 to v48) are available at https://github.com/canonical/data-platform-workflows/releases/tag/v48.0.0

• Replace lint.yaml with lint_workflows.yaml
• Add job to run tox run -e lint (or similar)

v45.0.0

Compare Source

What's Changed

• breaking(release_*.yaml): Use environment secrets by @​carlcsaposs-canonical in #​347

Full Changelog: canonical/data-platform-workflows@v44.0.2...v45.0.0

Migration instructions

[!TIP]
Combined migration instructions for v43-v48 (i.e. from v42 to v48) are available at https://github.com/canonical/data-platform-workflows/releases/tag/v48.0.0

release_snap.yaml

For releases to edge

• Replace release_snap.yaml with release_snap_edge.yaml
• Replace channel input with track input
  • Remove "/edge" from channel input value to get new track input value
• Remove SNAP_STORE_TOKEN secret and follow usage docs to create new environment secret. Update secret name in workflow call.
• Remove create-git-tags input

For releases of PR branches:

• Replace release_snap.yaml with release_snap_pr.yaml
• Replace channel input with track input
• Remove SNAP_STORE_TOKEN secret and follow usage docs to create new environment secret. Update secret name in workflow call.
• Remove create-git-tags input

release_rock.yaml

• Replace release_rock.yaml with release_rock_edge.yaml
• Remove create-git-tags input

_mirror_charm.yaml

• Remove MIRROR_REPOS_PAT secret and follow usage docs to create new environment secret

_update_bundle.yaml

• Remove CREATE_PR_APP_TOKEN secret and follow usage docs to create new environment secret

release_charm_pr.yaml

• Delete edge-pr deployments to reduce confusion
  • https://redirect.github.com/orgs/community/discussions/85000
  • e.g. https://github.com/canonical/postgresql-operator/deployments/edge-pr
  • contact @​carlcsaposs-canonical to run script on repo after updating dpw

v44.0.2

Compare Source

What's Changed

• patch: Prevent template injection by @​carlcsaposs-canonical in #​346

Full Changelog: canonical/data-platform-workflows@v44.0.1...v44.0.2

v44.0.1

Compare Source

What's Changed

• patch: Set persist-credentials for actions/checkout usage by @​carlcsaposs-canonical in #​345

Full Changelog: canonical/data-platform-workflows@v44.0.0...v44.0.1

v44.0.0

Compare Source

What's Changed

• breaking: Add explicit permissions to workflows by @​carlcsaposs-canonical in #​344

Full Changelog: canonical/data-platform-workflows@v43.0.0...v44.0.0

Migration instructions

[!TIP]
Combined migration instructions for v43-v48 (i.e. from v42 to v48) are available at https://github.com/canonical/data-platform-workflows/releases/tag/v48.0.0

For each reusable workflow, check the usage docs (https://github.com/canonical/data-platform-workflows?tab=readme-ov-file#usage) and, for each workflow call, update permissions to match the usage docs

v43.0.0

Compare Source

What's Changed

• breaking: Remove integration_test_charm.yaml by @​carlcsaposs-canonical in #​343

Full Changelog: canonical/data-platform-workflows@v42.1.0...v43.0.0

Migration instructions

[!TIP]
Combined migration instructions for v43-v48 (i.e. from v42 to v48) are available at https://github.com/canonical/data-platform-workflows/releases/tag/v48.0.0

https://github.com/canonical/data-platform-workflows/blob/v29.1.0/.github/workflows/integration_test_charm_deprecation_notice.md

v42.1.0

Compare Source

What's Changed

• compatible: Update upload-artifact by @​astrojuanlu in #​354

New Contributors

• @​astrojuanlu made their first contribution in #​354

Full Changelog: canonical/data-platform-workflows@v42.0.1...v42.1.0

v42.0.1

Compare Source

What's Changed

• patch: Move CODEOWNERS to .github/ directory by @​carlcsaposs-canonical in #​342

Full Changelog: canonical/data-platform-workflows@v42.0.0...v42.0.1

v42.0.0

Compare Source

What's Changed

• breaking(build_*.yaml): Replace *-snap-revision input with *-snap-revisions by @​carlcsaposs-canonical in #​340

Full Changelog: canonical/data-platform-workflows@v41.1.4...v42.0.0

v41.1.4

Compare Source

What's Changed

• patch(integration_test_charm.yaml): Remove LXD pre-download workaround by @​carlcsaposs-canonical in #​339

Full Changelog: canonical/data-platform-workflows@v41.1.3...v41.1.4

v41.1.3

Compare Source

What's Changed

• patch(release_snap.yaml): Increase timeout by @​carlcsaposs-canonical in #​341

Full Changelog: canonical/data-platform-workflows@v41.1.2...v41.1.3

v41.1.2

Compare Source

What's Changed

• patch: Use case function to simplify workflows by @​carlcsaposs-canonical in #​337

Full Changelog: canonical/data-platform-workflows@v41.1.1...v41.1.2

v41.1.1

Compare Source

What's Changed

• patch(_update_bundle.yaml): Update recommended schedule in docs by @​carlcsaposs-canonical in #​336

Full Changelog: canonical/data-platform-workflows@v41.1.0...v41.1.1

v41.1.0

Compare Source

What's Changed

• compatible(build_*.yaml): Add lxd snap input by @​carlcsaposs-canonical in #​335

Full Changelog: canonical/data-platform-workflows@v41.0.0...v41.1.0

v41.0.0

Compare Source

What's Changed

• breaking(build_snap.yaml): Add build manifest. by @​Gu1nness in #​334

New Contributors

• @​Gu1nness made their first contribution in #​334

Full Changelog: canonical/data-platform-workflows@v40.1.0...v41.0.0

v40.1.0

Compare Source

What's Changed

• compatible(build_*.yaml): Add lxc image list to logs by @​carlcsaposs-canonical in #​333

Full Changelog: canonical/data-platform-workflows@v40.0.2...v40.1.0

v40.0.2

Compare Source

What's Changed

• patch(build_*.yaml): Include .empty in artifact upload by @​carlcsaposs-canonical in #​331

Full Changelog: canonical/data-platform-workflows@v40.0.1...v40.0.2

v40.0.1

Compare Source

What's Changed

• patch(release_rock.yaml): Use absolute path with skopeo by @​carlcsaposs-canonical in #​332

Full Changelog: canonical/data-platform-workflows@v40.0.0...v40.0.1

v40.0.0

Compare Source

What's Changed

• breaking(build_*.yaml): Use PS7 runners for s390x by @​carlcsaposs-canonical in #​322

Full Changelog: canonical/data-platform-workflows@v39.1.0...v40.0.0

v39.1.0

Compare Source

What's Changed

• compatible(build_snap.yaml): Support core26 by @​carlcsaposs-canonical in #​327

Full Changelog: canonical/data-platform-workflows@v39.0.0...v39.1.0

v39.0.0

Compare Source

What's Changed

• breaking(release_python_package.yaml): Only mark GitHub release as latest on default branch by @​carlcsaposs-canonical in #​324

Full Changelog: canonical/data-platform-workflows@v38.0.0...v39.0.0

v38.0.0

Compare Source

What's Changed

• breaking: Update download-artifact and upload-artifact by @​carlcsaposs-canonical in #​321

Full Changelog: canonical/data-platform-workflows@v37.0.1...v38.0.0

v37.0.1

Compare Source

What's Changed

• patch: add CODEOWNERS and update README by @​reneradoi in #​325

New Contributors

• @​reneradoi made their first contribution in #​325

Full Changelog: canonical/data-platform-workflows@v37.0.0...v37.0.1

v37.0.0

Compare Source

What's Changed

• breaking(build_*.yaml): Skip unsupported architectures by @​carlcsaposs-canonical in #​323

Full Changelog: canonical/data-platform-workflows@v36.0.2...v37.0.0

v36.0.2

Compare Source

What's Changed

• patch(_promote_charm_legacy.yaml): Add check that refresh_versions.toml does not exist by @​carlcsaposs-canonical in #​320

Full Changelog: canonical/data-platform-workflows@v36.0.1...v36.0.2

v36.0.1

Compare Source

What's Changed

• patch: Add _promote_charm_legacy.yaml by @​carlcsaposs-canonical in #​317

Full Changelog: canonical/data-platform-workflows@v36.0.0...v36.0.1

v36.0.0

Compare Source

What's Changed

• breaking: Ensure track and channel inputs are not empty string by @​carlcsaposs-canonical in #​319

Full Changelog: canonical/data-platform-workflows@v35.0.4...v36.0.0

kubernetes-client/python (kubernetes)

v35.0.0

Compare Source

Kubernetes API Version: v1.35.0

API Change

• Added ObservedGeneration to CustomResourceDefinition conditions. (kubernetes/kubernetes#134984, @​michaelasp)

• Added WithOrigin within apis/core/validation with adjusted tests. (kubernetes/kubernetes#132825, @​PatrickLaabs)

• Added scoring for the prioritized list feature so nodes that best satisfy the highest-ranked subrequests were chosen. (kubernetes/kubernetes#134711, @​mortent) [SIG Node, Scheduling and Testing]

• Added the --min-compatibility-version flag to kube-apiserver, kube-controller-manager, and kube-scheduler. (kubernetes/kubernetes#133980, @​siyuanfoundation) [SIG API Machinery, Architecture, Cluster Lifecycle, Etcd, Scheduling and Testing]

• Added the StorageVersionMigration v1beta1 API and removed the v1alpha1 API.

  ACTION REQUIRED: The v1alpha1 API is no longer supported. Users must remove any v1alpha1 resources before upgrading. (kubernetes/kubernetes#134784, @​michaelasp) [SIG API Machinery, Apps, Auth, Etcd and Testing]

• Added validation to ensure log-flush-frequency is a positive value, returning an error instead of causing a panic. (kubernetes/kubernetes#133540, @​BenTheElder) [SIG Architecture, Instrumentation, Network and Node]

• All containers are restarted when a source container in a restart policy rule exits. This alpha feature is gated behind RestartAllContainersOnContainerExit. (kubernetes/kubernetes#134345, @​yuanwang04) [SIG Apps, Node and Testing]

• CSI drivers can now opt in to receive service account tokens via the secrets field instead of volume context by setting spec.serviceAccountTokenInSecrets: true in the CSIDriver object. This prevents tokens from being exposed in logs and other outputs. The feature is gated by the CSIServiceAccountTokenSecrets feature gate (beta in v1.35). (kubernetes/kubernetes#134826, @​aramase) [SIG API Machinery, Auth, Storage and Testing]

• Changed kuberc configuration schema. Two new optional fields added to kuberc configuration, credPluginPolicy and credPluginAllowlist. This is documented in KEP-3104 and documentation is added to the website by kubernetes/website#52877 (kubernetes/kubernetes#134870, @​pmengelbert) [SIG API Machinery, Architecture, Auth, CLI, Instrumentation and Testing]

• DRA device taints: DeviceTaintRule status provides information about the rule, including whether Pods still need to be evicted (EvictionInProgress condition). The newly added None effect can be used to preview what a DeviceTaintRule would do if it used the NoExecute effect and to taint devices (device health) without immediately affecting scheduling or running Pods. (kubernetes/kubernetes#134152, @​pohly) [SIG API Machinery, Apps, Auth, Node, Release, Scheduling and Testing]

• DRA: The DynamicResourceAllocation feature gate for the core functionality (GA in v1.34) has now been locked to enabled-by-default and cannot be disabled anymore. (kubernetes/kubernetes#134452, @​pohly) [SIG Auth, Node, Scheduling and Testing]

• Enabled kubectl get -o kyaml by default. To disable it, set KUBECTL_KYAML=false. (kubernetes/kubernetes#133327, @​thockin)

• Enabled in-place resizing of pod-level resources.

  • Added Resources in PodStatus to capture resources set in the pod-level cgroup.
  • Added AllocatedResources in PodStatus to capture resources requested in the PodSpec. (kubernetes/kubernetes#132919, @​ndixita) [SIG API Machinery, Apps, Architecture, Auth, CLI, Instrumentation, Node, Scheduling and Testing]

• Enabled the NominatedNodeNameForExpectation feature in kube-scheduler by default.

  • Enabled the ClearingNominatedNodeNameAfterBinding feature in kube-apiserver by default. (kubernetes/kubernetes#135103, @​ania-borowiec) [SIG API Machinery, Apps, Architecture, Auth, Autoscaling, CLI, Cloud Provider, Cluster Lifecycle, Etcd, Instrumentation, Network, Node, Scheduling, Storage and Testing]

• Enhanced discovery responses to merge API groups and resources from all peer apiservers when the UnknownVersionInteroperabilityProxy feature is enabled. (kubernetes/kubernetes#133648, @​richabanker) [SIG API Machinery, Auth, Cloud Provider, Node, Scheduling and Testing]

• Extended core/v1 Toleration to support numeric comparison operators (Gt,Lt). (kubernetes/kubernetes#134665, @​helayoty) [SIG API Machinery, Apps, Node, Scheduling, Testing and Windows]

• Feature gate dependencies are now explicit, and validated at startup. A feature can no longer be enabled if it depends on a disabled feature. In particular, this means that AllAlpha=true will no longer work without enabling disabled-by-default beta features that are depended on (either with AllBeta=true or explicitly enumerating the disabled dependencies). (kubernetes/kubernetes#133697, @​tallclair) [SIG API Machinery, Architecture, Cluster Lifecycle and Node]

• Generated OpenAPI model packages for API types into zz_generated.model_name.go files, accessible via the OpenAPIModelName() function. This allows API authors to declare desired OpenAPI model packages instead of relying on the Go package path of API types. (kubernetes/kubernetes#131755, @​jpbetz) [SIG API Machinery, Apps, Architecture, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Network, Node, Scheduling, Storage and Testing]

• Implemented constrained impersonation as described in KEP-5284. (kubernetes/kubernetes#134803, @​enj) [SIG API Machinery, Auth and Testing]

• Introduced a new declarative validation tag +k8s:customUnique to control listmap uniqueness. (kubernetes/kubernetes#134279, @​yongruilin) [SIG API Machinery and Auth]

• Introduced a structured and versioned v1alpha1 response for the statusz endpoint. (kubernetes/kubernetes#134313, @​richabanker) [SIG API Machinery, Architecture, Instrumentation, Network, Node, Scheduling and Testing]

• Introduced a structured and versioned v1alpha1 response format for the flagz endpoint. (kubernetes/kubernetes#134995, @​yongruilin) [SIG API Machinery, Architecture, Instrumentation, Network, Node, Scheduling and Testing]

• Introduced the GangScheduling kube-scheduler plugin to support "all-or-nothing" scheduling using the scheduling.k8s.io/v1alpha1 Workload API. (kubernetes/kubernetes#134722, @​macsko) [SIG API Machinery, Apps, Auth, CLI, Etcd, Scheduling and Testing]

• Introduced the Node Declared Features capability (alpha), which includes:

  • A new Node.Status.DeclaredFeatures field for publishing node-specific features.
  • A component-helpers library for feature registration and inference.
  • A NodeDeclaredFeatures scheduler plugin to match pods with nodes that provide required features.
  • A NodeDeclaredFeatureValidator admission plugin to validate pod updates against a node's declared features. (kubernetes/kubernetes#133389, @​pravk03) [SIG API Machinery, Apps, Node, Release, Scheduling and Testing]

• Introduced the scheduling.k8s.io/v1alpha1 Workload API to express workload-level scheduling requirements and allow the kube-scheduler to act on them. (kubernetes/kubernetes#134564, @​macsko) [SIG API Machinery, Apps, CLI, Etcd, Scheduling and Testing]

• Introduced the alpha MutableSchedulingDirectivesForSuspendedJobs feature gate (disabled by default), which allows mutating a Job's scheduling directives while the Job is suspended.
  It also updates the Job controller to clears the status.startTime field for suspended Jobs. (kubernetes/kubernetes#135104, @​mimowo) [SIG Apps and Testing]

• Kube-apiserver: Fixed a v1.34 regression in CustomResourceDefinition handling that incorrectly warned about unrecognized formats on number and integer properties. (kubernetes/kubernetes#133896, @​yongruilin) [SIG API Machinery, Apps, Architecture, Auth, CLI, Cloud Provider, Contributor Experience, Network, Node and Scheduling]

• Kube-apiserver: Fixed a possible panic validating a custom resource whose CustomResourceDefinition indicates a status subresource exists, but which does not define a status property in the openAPIV3Schema. (kubernetes/kubernetes#133721, @​fusida) [SIG API Machinery, Apps, Architecture, Auth, Autoscaling, CLI, Cloud Provider, Cluster Lifecycle, Etcd, Instrumentation, Network, Node, Release, Scheduling, Storage and Testing]

• Kubernetes API Go types removed runtime use of the github.com/gogo/protobuf library, and are no longer registered into the global gogo type registry. Kubernetes API Go types were not suitable for use with the google.golang.org/protobuf library, and no longer implement ProtoMessage() by default to avoid accidental incompatible use. If removal of these marker methods impacts your use, it can be re-enabled for one more release with a kubernetes_protomessage_one_more_release build tag, but will be removed in v1.36. (kubernetes/kubernetes#134256, @​liggitt) [SIG API Machinery, Apps, Architecture, Auth, CLI, Cluster Lifecycle, Instrumentation, Network, Node, Scheduling and Storage]

• Made node affinity in Persistent Volume mutable. (kubernetes/kubernetes#134339, @​huww98) [SIG API Machinery, Apps and Node]

• Moved the ImagePullIntent and ImagePulledRecord objects used by the kubelet to track image pulls to the v1beta1 API version. (kubernetes/kubernetes#132579, @​stlaz) [SIG Auth and Node]

• Pod resize now only allows CPU and memory resources; other resource types are forbidden. (kubernetes/kubernetes#135084, @​tallclair) [SIG Apps, Node and Testing]

• Prevented Pods from being scheduled onto nodes that lack the required CSI driver. (kubernetes/kubernetes#135012, @​gnufied) [SIG API Machinery, Scheduling, Storage and Testing]

• Promoted HPA configurable tolerance to beta. The HPAConfigurableTolerance feature gate has now been enabled by default. (kubernetes/kubernetes#133128, @​jm-franc) [SIG API Machinery and Autoscaling]

• Promoted ReplicaSet and Deployment .status.terminatingReplicas tracking to beta. The DeploymentReplicaSetTerminatingReplicas feature gate is now enabled by default. (kubernetes/kubernetes#133087, @​atiratree) [SIG API Machinery, Apps and Testing]

• Promoted PodObservedGenerationTracking to GA. (kubernetes/kubernetes#134948, @​natasha41575) [SIG API Machinery, Apps, Node, Scheduling and Testing]

• Promoted the JobManagedBy feature to general availability. The JobManagedBy feature gate was locked to true and will be removed in a future Kubernetes release. (kubernetes/kubernetes#135080, @​dejanzele) [SIG API Machinery, Apps and Testing]

• Promoted the MaxUnavailableStatefulSet feature to beta and enabling it by default. (kubernetes/kubernetes#133153, @​helayoty) [SIG API Machinery and Apps]

• Removed the StrictCostEnforcementForVAP and StrictCostEnforcementForWebhooks feature gates, which were locked since v1.32. (kubernetes/kubernetes#134994, @​liggitt) [SIG API Machinery, Auth, Node and Testing]

• Scheduler: Added the bindingTimeout argument to the DynamicResources plugin configuration, allowing customization of the wait duration in PreBind for device binding conditions.
  Defaults to 10 minutes when DRADeviceBindingConditions and DRAResourceClaimDeviceStatus are both enabled. (kubernetes/kubernetes#134905, @​fj-naji) [SIG Node and Scheduling]

• The DRA device taints and toleration feature received a separate feature gate, DRADeviceTaintRules, which controlled support for DeviceTaintRules. This allowed disabling it while keeping DRADeviceTaints enabled so that tainting via ResourceSlices continued to work. (kubernetes/kubernetes#135068, @​pohly) [SIG API Machinery, Apps, Auth, Node, Scheduling and Testing]

• The Pod Certificates feature moved to beta. The PodCertificateRequest feature gate is set disabled by default. To use the feature, users must enable the certificates API groups in v1beta1 and enable the PodCertificateRequest feature gate. The UserAnnotations field was added to the PodCertificateProjection API and the corresponding UnverifiedUserAnnotations field was added to the PodCertificateRequest API. (kubernetes/kubernetes#134624, @​yt2985) [SIG API Machinery, Apps, Auth, Etcd, Instrumentation, Node and Testing]

• The KubeletEnsureSecretPulledImages feature was promoted to Beta and enabled by default. (kubernetes/kubernetes#135228, @​aramase) [SIG Auth, Node and Testing]

• The PreferSameZone and PreferSameNode values for the Service
  trafficDistribution field graduated to general availability. The
  PreferClose value is now deprecated in favor of the more explicit
  PreferSameZone. (kubernetes/kubernetes#134457, @​danwinship) [SIG API Machinery, Apps, Network and Testing]

• Updated ResourceQuota to count device class requests within a ResourceClaim as two additional quotas when the DRAExtendedResource feature is enabled:

  • requests.deviceclass.resource.k8s.io/<deviceclass> is charged based on the worst-case number of devices requested.
  • Device classes mapping to an extended resource now consume requests.<extended resource name>. (kubernetes/kubernetes#134210, @​yliaog) [SIG API Machinery, Apps, Node, Scheduling and Testing]

• Updated storage version for MutatingAdmissionPolicy to v1beta1. (kubernetes/kubernetes#133715, @​cici37) [SIG API Machinery, Etcd and Testing]

• Updated the Partitionable Devices feature to support referencing counter sets across ResourceSlices within the same resource pool. Devices from incomplete pools were no longer considered for allocation. This change introduced backwards-incompatible updates to the alpha feature, requiring any ResourceSlices using it to be removed before upgrading or downgrading between v1.34 and v1.35. (kubernetes/kubernetes#134189, @​mortent) [SIG API Machinery, Node, Scheduling and Testing]

• Upgraded the PodObservedGenerationTracking feature to beta in v1.34 and removed the alpha version description from the OpenAPI specification. (kubernetes/kubernetes#133883, @​yangjunmyfm192085)

• Add scoring for the prioritized list feature so that the node that can satisfy the best ranked subrequests are chosen. (kubernetes/kubernetes#134711, @​mortent) [SIG Node, Scheduling and Testing]

• Allows restart all containers when the source container exits with a matching restart policy rule. This is an alpha feature behind feature gate RestartAllContainersOnContainerExit. (kubernetes/kubernetes#134345, @​yuanwang04) [SIG Apps, Node and Testing]

• Changed kuberc configuration schema. Two new optional fields added to kuberc configuration, credPluginPolicy and credPluginAllowlist. This is documented in KEP-3104 and documentation is added to the website by kubernetes/website#52877 (kubernetes/kubernetes#134870, @​pmengelbert) [SIG API Machinery, Architecture, Auth, CLI, Instrumentation and Testing]

• Enhanced discovery response to support merged API groups/resources from all peer apiservers when UnknownVersionInteroperabilityProxy feature is enabled (kubernetes/kubernetes#133648, @​richabanker) [SIG API Machinery, Auth, Cloud Provider, Node, Scheduling and Testing]

• Extend core/v1 Toleration to support numeric comparison operators (Gt, Lt). (kubernetes/kubernetes#134665, @​helayoty) [SIG API Machinery, Apps, Node, Scheduling, Testing and Windows]

• Features: NominatedNodeNameForExpectation in kube-scheduler and CleaeringNominatedNodeNameAfterBinding in kube-apiserver are now enabled by default. (kubernetes/kubernetes#135103, @​ania-borowiec) [SIG API Machinery, Apps, Architecture, Auth, Autoscaling, CLI, Cloud Provider, Cluster Lifecycle, Etcd, Instrumentation, Network, Node, Scheduling, Storage and Testing]

• Implement changes to prevent pod scheduling to a node without CSI driver (kubernetes/kubernetes#135012, @​gnufied) [SIG API Machinery, Scheduling, Storage and Testing]

• Introduce scheduling.k8s.io/v1alpha1 Workload API to allow for expressing workload-level scheduling requirements and let kube-scheduler act on those. (kubernetes/kubernetes#134564, @​macsko) [SIG API Machinery, Apps, CLI, Etcd, Scheduling and Testing]

• Introduce the alpha MutableSchedulingDirectivesForSuspendedJobs feature gate (disabled by default) which:

  1. allows to mutate Job's scheduling directives for suspended Jobs
  2. makes the Job controller to clear the status.startTime field for suspended Jobs (kubernetes/kubernetes#135104, @​mimowo) [SIG Apps and Testing]

• Introduced GangScheduling kube-scheduler plugin to enable "all-or-nothing" scheduling. Workload API in scheduling.k8s.io/v1alpha1 is used to express the desired policy. (kubernetes/kubernetes#134722, @​macsko) [SIG API Machinery, Apps, Auth, CLI, Etcd, Scheduling and Testing]

• PV node affinity is now mutable. (kubernetes/kubernetes#134339, @​huww98) [SIG API Machinery, Apps and Node]

• ResourceQuota now counts device class requests within a ResourceClaim object as consuming two additional quotas when the DRAExtendedResource feature is enabled:

  • requests.deviceclass.resource.k8s.io/<deviceclass> with a quantity equal to the worst case count of devices requested
  • requests for device classes that map to an extended resource consume requests.<extended resource name> (kubernetes/kubernetes#134210, @​yliaog) [SIG API Machinery, Apps, Node, Scheduling and Testing]

• The DRA device taints and toleration feature now has a separate feature gate, DRADeviceTaintRules, which controls whether support for DeviceTaintRules is enabled. It is possible to disable that and keep DRADeviceTaints enabled, in which case tainting by DRA drivers through ResourceSlices continues to work. (kubernetes/kubernetes#135068, @​pohly) [SIG API Machinery, Apps, Auth, Node, Scheduling and Testing]

• The ImagePullIntent and ImagePulledRecord objects used by kubelet to store information about image pulls have been moved to the v1beta1 API version. (kubernetes/kubernetes#132579, @​stlaz) [SIG Auth and Node]

• The KubeletEnsureSecretPulledImages feature is now beta and enabled by default. (kubernetes/kubernetes#135228, @​aramase) [SIG Auth, Node and Testing]

• This change adds a new alpha feature Node Declared Features, which includes:

  • A new Node.Status.DeclaredFeatures field for Kubelet to publish node-specific features.
  • A library in component-helpers for feature registration and inference.
  • A scheduler plugin (NodeDeclaredFeatures) scheduler plugin to match pods with nodes that provide their required features.
  • An admission plugin (NodeDeclaredFeatureValidator) to validate pod updates against a node's declared features. (kubernetes/kubernetes#133389, [@​pravk03](https://r

---

Configuration

📅 Schedule: Branch creation - Between 01:00 AM and 07:59 AM, only on Tuesday ( * 1-7 * * 2 ) in timezone Etc/UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: poetry.lock

Updating dependencies
Resolving dependencies...


Source /home/ubuntu/.cache/pypoetry/virtualenvs/non-package-mode-6zD_bwme-py3.14/src/data-platform-workflows/python/pytest_plugins/pytest_operator_groups is not a directory