Bump github.com/gardener/gardener from 1.136.2 to 1.137.1

[dependabot]

Bumps github.com/gardener/gardener from 1.136.2 to 1.137.1.

Release notes

Sourced from github.com/gardener/gardener's releases.

v1.137.1

[github.com/gardener/gardener:v1.137.1]

🏃 Others

• [OPERATOR] A regression in Gardener Node Agent that can occur on Debian based OS images and that prevents it to successfully reconcile nodes that run a containerd version that contains - according to semver - invalid characters in its version number was fixed. by @​MrBatschner [#14188]

Helm Charts

• controlplane: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.137.1
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.137.1
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.137.1
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.137.1

Container (OCI) Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.137.1
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.137.1
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.137.1
• gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.137.1
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.137.1
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.137.1
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.137.1
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.137.1
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.137.1

v1.137.0

[github.com/gardener/gardener:v1.137.0]

⚠️ Breaking Changes

• [OPERATOR] The garden_garden_last_operation metric structure has changed: the last_operation label has been renamed to type, and a new state label has been added to expose the operation state. Existing queries and dashboards using the last_operation label must be updated to use type instead. Additionally, two new alerts have been introduced: GardenLastOperationInErrorState and GardenLastOperationStuckProcessing. by @​rickardsjp [#13827]
• [DEVELOPER] The pkg/utils/secrets/manager.New function's signature has been reworked to accept config functions. Namespaces are now passed via WithNamespaces(...string), automatic CA secret rotation can be disabled via WithoutCASecretAutoRotation(), and the map of secret names to "last rotation initiation times" is passed via WithSecretNamesToTimes(map[string]time.Time). Accordingly, pkg/utils/secrets/manager.Config has been removed. by @​rfranzke [#14000]
• [DEVELOPER] All Gardener Enhancement Proposals (GEPs) have been moved out of gardener/gardener to the new gardener/enhancements repository. Read the Slack thread to learn more about it. by @​rfranzke [#14043]
• [DEVELOPER] When using ModeService in the extension webhook library, the specified service port is now properly propagated when constructing the admissionregistrationv1.WebhookClientConfig for {Validating,Mutating}WebhookConfigurations (previously, it was not specified at all and defaulted to 443 by Kubernetes). Make sure to specify --webhook-config-service-port to prevent falling back to the --webhook-config-server-port (if configured). by @​rfranzke [#14063]
• [DEVELOPER] The package github.com/gardener/gardener/pkg/apis has been made a Go submodule. Validations and helpers from ./pkg/apis have been moved to ./pkg/api. The package pkg/utils/timewindow has been moved to pkg/apis/utils/timewindow. The component configs ./pkg/{admissioncontroller,controllermanager,gardenlet,nodeagent,operator,resourcemanager,scheduler} have been moved to ./pkg/apis/config/... and their helper and validation packages to ./pkg/api/config/.... Extension developers can use the commands provided in this Gist to update the import paths programmatically. by @​LucaBernstein [#13536]

✨ New Features

• [OPERATOR] A default .machineControllerManager.machineCreationTimeout can be provided for a machine type in the CloudProfile. by @​LucaBernstein [#14032]
• [OPERATOR] Operators can configure workload identity token expiration duration via gardenlet's configuration by setting .controllers.tokenRequestorWorkloadIdentity.tokenExpirationDuration. by @​dimityrmirchev [#13752]
• [OPERATOR] Feature gate VictoriaLogsBackend has been introduced to the gardenlet and gardener-operator. When enabled, an instance of VictoriaLogs is deployed in the respective cluster. by @​rrhubenov [#13988]
• [OPERATOR] The "Reversed VPN OpenVPN Server (HA)" dashboard now shows packet loss statistics. by @​domdom82 [#14088]
• [DEVELOPER] Secrets Manager: The automatic renewal of Secrets about to expire can now be disabled with the config function WithoutAutomaticSecretRenewal() passed to New(). This is useful if you want to prevent your secrets manager instance from listing all existing Secrets in the cluster when instantiated. by @​rfranzke [#14000]
• [DEVELOPER] gardener-node-agent now supports node-specific configuration files, i.e. files which are only applied to a specified node. by @​ScheererJ [#13412]
• [DEVELOPER] The secrets manager now allows to load missing signing CA certificate secrets directly from the cluster in case they were not generated upfront. This is helpful when the secrets manager instance generating certificates is not the same managing the signing CA certificate lifecycle. by @​rfranzke [#14000]

🐛 Bug Fixes

• [OPERATOR] Fixed the shoot-care controller panic for clusters where .status.credentials.rotation exists but .status.credentials.encryptionAtRest is nil. by @​maboehm [#14147]
• [OPERATOR] Fixed an issue with the maximum batch size that the OpenTelemetry Collector instances can send. by @​rrhubenov [#14108]
• [OPERATOR] Systemd logs are now collected from seed clusters as expected. by @​nickytd [#14071]
• [OPERATOR] Additional finetuning to the Collector configuration has been applied for improved memory usage. by @​rrhubenov [#14127]
• [OPERATOR] A bug is fixed in the extension scrape configuration in the seed Prometheus, where the scrape address was not correctly configured on IPv4 setups. by @​vicwicker [#14111]
• [OPERATOR] An issue causing the control-plane migration to get stuck if the source backup entry deployment was retried is now fixed. by @​shafeeqes [#14091]
• [USER] An issue which lead to a nil pointer in gardenlet when a Shoot had an empty .spec.addons structure defined is now fixed. by @​voelzmo [#14112]
• [DEPENDENCY] extension library: Extension admission webhooks now return http.StatusForbidden when validation/mutation fails. With this, the failure reason is now properly displayed when updating the resource with kubectl edit. by @​dnaeon [#14026]

... (truncated)

Commits

• 6f3d743 release v1.137.1
• 4fa7664 [release-v1.137] fix: allow Debian version numbers when parsing containerd ve...
• bd46474 next version: v1.137.1-dev
• eef5209 release v1.137.0
• 208e1b4 fix(ci): Prevent trailing newline in additional release tags (#14171)
• daea1c4 Update dependency gardener/dependency-watchdog to v1.7.0 (#14154)
• d989786 Allow maximum worker pool nodes to exceed configured limit (#14139)
• 5d8468d [GEP-34] Fine-Tune Batch Size and Update Migration Script (#14127)
• 56221da Switch to OIDC Federation Service instead of GitHub App (#14122)
• bef1895 Update missing controller and webhooks details in docs (#14109)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[gardener-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign andreasburger for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

The changes in this pull request consist of dependency updates across the Go module ecosystem, primarily upgrading Kubernetes, Gardener, and various observability-related libraries. This appears to be a routine maintenance update to keep dependencies current with security patches and feature improvements.

Walkthrough

• Chore: Updated etcd-druid API from v0.35.0 to v0.35.1 providing latest etcd cluster management capabilities
• Chore: Upgraded Gardener core from v1.136.2 to v1.137.1 bringing enhanced Kubernetes cluster lifecycle management features
• Chore: Bumped Kubernetes dependencies from v0.34.3 to v0.35.1 including API server, client libraries, and controller runtime for improved cluster operations
• Chore: Updated controller-runtime from v0.22.5 to v0.23.1 and controller-tools from v0.19.0 to v0.20.1 enhancing operator development capabilities
• Chore: Refreshed OpenTelemetry libraries from v1.39.x to v1.40.x series improving observability and metrics collection
• Chore: Various minor version bumps across networking, compression, and utility libraries for bug fixes and performance improvements

_{Model: claude-sonnet-4-20250514 | Prompt Tokens: 50873 | Completion Tokens: 294}

[dependabot]

Superseded by #1728.