chore(deps): update module k8s.io/kubernetes to v1.36.4

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
k8s.io/kubernetes	v1.31.0 → v1.36.4

---

Release Notes

kubernetes/kubernetes (k8s.io/kubernetes)

v1.36.4

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.36.3

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.36.2

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.36.1

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.36.0

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.35.8

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.35.7

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.35.6

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.35.5

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.35.4

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.35.3

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.35.2

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.35.1

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.35.0: Kubernetes v1.35.0

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.34.11

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.34.10

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.34.9

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.34.8

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.34.7

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.34.6

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.34.5

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.34.4

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.34.3: Kubernetes v1.34.3

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.34.2: Kubernetes v1.34.2

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.34.1: Kubernetes v1.34.1

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.34.0: Kubernetes v1.34.0

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.33.13

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.33.12

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.33.11

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.33.10

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.33.9

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.33.8

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.33.7: Kubernetes v1.33.7

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.33.6: Kubernetes v1.33.6

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.33.5: Kubernetes v1.33.5

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.33.4: Kubernetes v1.33.4

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.33.3: Kubernetes v1.33.3

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.33.2: Kubernetes v1.33.2

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.33.1: Kubernetes v1.33.1

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.33.0: Kubernetes v1.33.0

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.32.13

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.32.12

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.32.11: Kubernetes v1.32.11

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.32.10: Kubernetes v1.32.10

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.32.9: Kubernetes v1.32.9

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.32.8: Kubernetes v1.32.8

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.32.7: Kubernetes v1.32.7

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.32.6: Kubernetes v1.32.6

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.32.5: Kubernetes v1.32.5

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.32.4: Kubernetes v1.32.4

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.32.3: Kubernetes v1.32.3

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.32.2: Kubernetes v1.32.2

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.32.1: Kubernetes v1.32.1

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.32.0: Kubernetes v1.32.0

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.31.14: Kubernetes v1.31.14

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.31.13: Kubernetes v1.31.13

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.31.12: Kubernetes v1.31.12

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.31.11: Kubernetes v1.31.11

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.31.10: Kubernetes v1.31.10

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.31.9: Kubernetes v1.31.9

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.31.8: Kubernetes v1.31.8

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.31.7: Kubernetes v1.31.7

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.31.6: Kubernetes v1.31.6

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.31.5: Kubernetes v1.31.5

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.31.4: Kubernetes v1.31.4

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.31.3: Kubernetes v1.31.3

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.31.2: Kubernetes v1.31.2

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.31.1: Kubernetes v1.31.1

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[red-hat-konflux]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: downloading k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a
go: downloading github.com/spf13/cobra v1.10.2
go: downloading github.com/google/gnostic-models v0.7.0
go: downloading k8s.io/kubernetes v1.36.4
go: downloading google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af
go: downloading sigs.k8s.io/randfill v1.0.0
go: downloading github.com/fxamacker/cbor/v2 v2.9.0
go: downloading sigs.k8s.io/structured-merge-diff/v6 v6.3.3
go: downloading github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f
go: downloading github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee
go: downloading github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
go: downloading k8s.io/controller-manager v0.0.0
go: downloading github.com/moby/spdystream v0.5.1
go: downloading github.com/prometheus/client_golang v1.23.2
go: downloading github.com/prometheus/common v0.67.5
go: downloading k8s.io/api v0.36.4
go: downloading k8s.io/apimachinery v0.36.4
go: downloading k8s.io/component-base v0.36.4
go: downloading k8s.io/component-helpers v0.36.4
go: downloading k8s.io/client-go v0.36.4
go: downloading github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
go: downloading k8s.io/streaming v0.36.4
go: downloading go.opentelemetry.io/otel/trace v1.41.0
go: downloading go.opentelemetry.io/otel v1.41.0
go: github.com/redhat-appstudio/dora-metrics/apis/argocd imports
	github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1 imports
	github.com/argoproj/gitops-engine/pkg/health imports
	k8s.io/api/autoscaling/v2beta1: cannot find module providing package k8s.io/api/autoscaling/v2beta1
go: github.com/redhat-appstudio/dora-metrics/apis/argocd imports
	github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1 imports
	github.com/argoproj/gitops-engine/pkg/health imports
	k8s.io/api/autoscaling/v2beta2: cannot find module providing package k8s.io/api/autoscaling/v2beta2
go: github.com/redhat-appstudio/dora-metrics/apis/argocd imports
	github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1 imports
	github.com/argoproj/gitops-engine/pkg/utils/kube imports
	k8s.io/kubectl/pkg/scheme imports
	k8s.io/api/scheduling/v1alpha1: cannot find module providing package k8s.io/api/scheduling/v1alpha1
go: github.com/redhat-appstudio/dora-metrics/apis/argocd imports
	github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1 imports
	github.com/argoproj/gitops-engine/pkg/utils/kube imports
	github.com/argoproj/gitops-engine/pkg/utils/kube/scheme imports
	k8s.io/kubernetes/pkg/apis/apps/install imports
	k8s.io/kubernetes/pkg/apis/apps/v1 imports
	k8s.io/kubernetes/pkg/features imports
	k8s.io/controller-manager/pkg/features: reading k8s.io/controller-manager/go.mod at revision v0.0.0: unknown revision v0.0.0

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:26 AM UTC · Completed 2:31 AM UTC
Commit: 01f864b · View workflow run →

[fullsend-ai-review]

Review

Findings

Medium

• [dependency version skew] go.mod:167 — k8s.io/kubernetes is bumped to v1.36.3 while all other k8s.io/* dependencies remain pinned at v0.31.2 (Kubernetes 1.31 series). The k8s.io/kubernetes module at v1.36.3 declares dependencies on k8s.io/api, k8s.io/apimachinery, k8s.io/client-go, etc. at the v0.36.x level. Go's Minimum Version Selection (MVS) should resolve this by pulling in the higher versions required by k8s.io/kubernetes if any transitive import path reaches those packages, but the project's explicit pins at v0.31.2 may conflict. Since k8s.io/kubernetes is purely indirect (no Go source file in this project imports it) and is likely pulled in by argo-cd/v2, the practical runtime risk is limited. However, the five-major-version gap is a real dependency hygiene concern that could cause issues during future upgrades or if the transitive dependency graph changes.
  Remediation: Either bump all k8s.io/* dependencies together to the 1.36.x series, or keep k8s.io/kubernetes at v1.31.x to match the other k8s.io modules. Run go build ./... and go test ./... -race after any change to verify compatibility. Given this is a Renovate bot PR that only bumps one module, the safest action is to also verify whether go mod tidy would auto-bump the sibling modules.

Previous run

Review

Findings

Medium

• [dependency version skew] go.mod:167 — k8s.io/kubernetes is being bumped from v1.31.0 to v1.36.3, but all other k8s.io modules (k8s.io/api, k8s.io/apimachinery, k8s.io/client-go, k8s.io/apiserver, k8s.io/apiextensions-apiserver, k8s.io/cli-runtime, k8s.io/component-base, k8s.io/component-helpers, k8s.io/kube-aggregator, k8s.io/kubectl) remain pinned at v0.31.2 (corresponding to Kubernetes v1.31.2). The k8s.io/kubernetes module has internal dependencies on these sibling modules at matching versions — its replace directives are not honored when consumed as a transitive dependency, so Go's MVS will resolve siblings at v0.31.2, creating a type-compatibility risk. A 5-minor-version gap (1.31 → 1.36) is likely to cause compilation errors or subtle runtime type mismatches due to API type drift.
  Remediation: Either bump all k8s.io/* dependencies to their v1.36 / v0.36 counterparts together, or keep k8s.io/kubernetes at v1.31.x to match the rest of the k8s.io dependency set.

Previous run (2)

Review

Findings

High

• [error handling gap] go.mod:167 — go.sum is not updated in this PR. The current go.sum only contains checksums for k8s.io/kubernetes v1.31.0. After changing go.mod to reference v1.36.2, go mod tidy must be run to update go.sum with the correct checksums for the new version and any new transitive dependencies. Without this, builds will fail with checksum verification errors.
  Remediation: Run go mod tidy and include the resulting go.sum changes in the PR.

Medium

• [API contract violation] go.mod:167 — k8s.io/kubernetes is bumped to v1.36.2 while all other k8s.io staging packages (k8s.io/api, k8s.io/apimachinery, k8s.io/client-go, k8s.io/kubectl, k8s.io/kube-aggregator, etc.) remain at v0.31.2. In the k8s.io ecosystem, k8s.io/kubernetes v1.X.Y is designed to work with staging modules at v0.X.Y. While k8s.io/kubernetes is an indirect dependency and Go's MVS resolves transitive dependencies independently, this version skew could cause issues when running go mod tidy — it may pull in v0.36.x staging packages that break the current v0.31.2 pinning, or fail to resolve the dependency graph consistently.
  Remediation: Either bump all k8s.io staging dependencies to their v0.36.x counterparts to match k8s.io/kubernetes v1.36.2, or do not bump k8s.io/kubernetes independently. Run go mod tidy to verify the dependency graph is consistent.

Previous run (3)

Review — chore(deps): update module k8s.io/kubernetes to v1.36.2

PR: #181 | Author: red-hat-konflux[bot] | Base: main

Summary

Automated dependency update bumping the indirect dependency k8s.io/kubernetes from v1.31.0 to v1.36.2 in go.mod. The change is a single-line version bump in go.mod with no other file modifications.

Findings

🟡 [medium] Missing go.sum update — go.mod

Category: correctness

The PR modifies go.mod to require k8s.io/kubernetes v1.36.2 but does not include a corresponding go.sum update. The go.sum file still only contains checksums for v1.31.0:

k8s.io/kubernetes v1.31.0 h1:sYAB12TTWexXKp4RxqJMm/7EC+P0mNOgn4Xdj5eu7HM=
k8s.io/kubernetes v1.31.0/go.mod h1:UTpGn7nxrUrPWw5hNIYTAjodcWIvLakgHpLtfrr6GC8=

Since the Dockerfile runs go mod download (line 11), which verifies checksums against go.sum, the container build will fail with a checksum mismatch error.

Remediation: Run go mod tidy to regenerate go.sum with checksums for the new version, and include the updated file in the PR.

🟡 [medium] Kubernetes module version skew — go.mod

Category: correctness

The PR bumps only k8s.io/kubernetes to v1.36.2 while all other k8s.io/* modules remain pinned at v0.31.2 (corresponding to Kubernetes 1.31.x):

Module	Current	Expected for k8s v1.36
k8s.io/apimachinery (direct)	v0.31.2	v0.36.x
k8s.io/client-go (direct)	v0.31.2	v0.36.x
k8s.io/api	v0.31.2	v0.36.x
k8s.io/apiextensions-apiserver	v0.31.2	v0.36.x
k8s.io/apiserver	v0.31.2	v0.36.x
k8s.io/cli-runtime	v0.31.2	v0.36.x
k8s.io/component-base	v0.31.2	v0.36.x
k8s.io/component-helpers	v0.31.2	v0.36.x
k8s.io/kube-aggregator	v0.31.2	v0.36.x
k8s.io/kubectl	v0.31.2	v0.36.x

The k8s.io/kubernetes module internally depends on these sibling modules at matching minor versions. This 5-minor-version gap will very likely cause compilation errors due to API changes across Kubernetes 1.31 → 1.36.

Remediation: Either update all k8s.io/* modules together to their v0.36.x versions (which requires updating the direct dependencies k8s.io/apimachinery and k8s.io/client-go and may introduce breaking API changes in project code), or keep k8s.io/kubernetes at v1.31.0 until a coordinated upgrade is planned.

Verdict

🔴 Request Changes — Two medium-severity findings that together render this PR non-functional: (1) the build will fail due to the missing go.sum update, and (2) the version skew between k8s.io/kubernetes v1.36.2 and its sibling modules at v0.31.2 will likely cause compilation errors even if go.sum were fixed. This indirect dependency bump needs to be part of a coordinated upgrade of all k8s.io/* modules.

Previous run (4)

Review — request-changes

Summary

This automated dependency PR bumps k8s.io/kubernetes from v1.31.0 to v1.36.2 in go.mod, but the update is incomplete and build-breaking. CI confirms all checks fail (tests, lint, artifact generation).

Findings

1. 🔴 [high] k8s.io version skew — incompatible submodule versions

File: go.mod | Line: 167

The PR bumps k8s.io/kubernetes from v1.31.0 → v1.36.2 (an indirect dependency), but all other k8s.io/ packages remain pinned at v0.31.2 (corresponding to Kubernetes 1.31.x):

• k8s.io/apimachinery v0.31.2 (direct)
• k8s.io/client-go v0.31.2 (direct)
• k8s.io/api v0.31.2
• k8s.io/apiserver v0.31.2
• k8s.io/kubectl v0.31.2
• ...and 5 more k8s.io submodules at v0.31.2

The Kubernetes monorepo at v1.36.x internally requires matching v0.36.x submodules. Bumping only k8s.io/kubernetes without updating the entire k8s.io dependency family creates an irreconcilable version conflict. This is a known constraint of the Kubernetes Go module ecosystem — all k8s.io/* staging modules must be updated in lockstep.

Remediation: Either bump all k8s.io/* dependencies together to the v1.36.x / v0.36.x family, or do not bump k8s.io/kubernetes independently. This likely requires updating the direct dependencies k8s.io/apimachinery and k8s.io/client-go to v0.36.2 as well, along with verifying compatibility with github.com/argoproj/argo-cd/v2 which may pin its own k8s.io versions.

2. 🔴 [high] Missing go.sum update — build fails at module download

File: go.mod | Line: 167

The PR modifies go.mod to reference k8s.io/kubernetes v1.36.2, but go.sum is not updated — it still contains only v1.31.0 checksums. Without matching checksums in go.sum, go build, go test, and go mod verify all fail. The CI status renovate/artifacts: failure confirms the dependency bot was unable to generate the updated go.sum.

Remediation: Run go mod tidy to regenerate go.sum after resolving the version skew above. The artifact generation failure indicates the bot itself encountered the version conflict when attempting to resolve dependencies.

CI Status (confirming findings)

Check	Result
Run Tests	❌ failure
Lint Go Code	❌ failure
renovate/artifacts	❌ failure
Konflux build	❌ cancelled (downstream of failures)

Verdict

This PR cannot be merged in its current state. The k8s.io/kubernetes bump requires a coordinated update of the entire Kubernetes dependency family. The dependency bot (Mintmaker/Renovate) was unable to complete the artifact update, which is expected given the cross-module version constraints in the Kubernetes ecosystem. This PR should either be expanded to include all required k8s.io/* version bumps (with ArgoCD compatibility verification), or closed in favor of a holistic Kubernetes dependency update PR.

Previous run (5)

Review — ⚠ Changes Requested

PR #181 — chore(deps): update module k8s.io/kubernetes to v1.36.2
Author: red-hat-konflux[bot] (automated dependency update)
Changes: 1 file (go.mod), 1 line changed
CI Status: ❌ Both "Run Tests" and "Lint Go Code" are failing

---

Findings

🔴 [high] Missing go.sum update — build is broken

The PR modifies go.mod to bump k8s.io/kubernetes from v1.31.0 → v1.36.2 but does not include a corresponding go.sum update. The existing go.sum still contains checksums only for v1.31.0. This causes immediate build failures — CI annotations confirm multiple "missing go.sum entry" errors across both the test and lint jobs (e.g., google.golang.org/protobuf, github.com/fxamacker/cbor/v2, k8s.io/kubernetes/pkg/api/legacyscheme).

Remediation: Run go mod tidy to regenerate go.sum. However, see the next finding — even with a correct go.sum, this update is structurally unsound.

🔴 [high] k8s.io module version skew — isolated bump breaks dependency alignment

All other k8s.io/* modules remain pinned at v0.31.x (Kubernetes 1.31):

Module	Current version
k8s.io/apimachinery (direct)	v0.31.2
k8s.io/client-go (direct)	v0.31.2
k8s.io/api	v0.31.2
k8s.io/apiserver	v0.31.2
k8s.io/kubectl	v0.31.2
k8s.io/kube-aggregator	v0.31.2
... and 4 more	v0.31.2

Bumping only k8s.io/kubernetes to v1.36.2 (Kubernetes 1.36) creates a 5-minor-version mismatch. The Kubernetes Go modules are versioned in lockstep: k8s.io/kubernetes v1.36.x expects k8s.io/client-go v0.36.x, k8s.io/apimachinery v0.36.x, etc. Mixing versions across this gap will cause API incompatibilities, type mismatches, and unresolvable import paths. The CI lint failure (k8s.io/kubernetes/pkg/api/legacyscheme cannot be resolved) confirms the dependency graph is inconsistent.

Remediation: The k8s.io/kubernetes module cannot be updated in isolation. All k8s.io/* modules must be bumped together. Additionally, the ArgoCD dependency (github.com/argoproj/argo-cd/v2 v2.14.21) likely constrains which Kubernetes client version is compatible — verify ArgoCD supports Kubernetes 1.36 client libraries before attempting a coordinated upgrade.

Verdict

This PR cannot be merged. The dependency update is incomplete (missing go.sum) and structurally incorrect (isolated k8s.io/kubernetes bump without its sibling modules). CI is failing. A coordinated update of the entire k8s.io/* module family — potentially gated on an ArgoCD upgrade — is needed instead.

Previous run (6)

Looks good to me

Previous run (7)

Review

Findings

High

• [api-contract] go.mod:167 — The diff bumps k8s.io/kubernetes from v1.31.0 to v1.36.2 (a 5-minor-version jump) while all other k8s.io/* dependencies remain pinned at v0.31.2 (corresponding to Kubernetes v1.31.x). The k8s.io/kubernetes module requires its sibling staging modules (k8s.io/api, k8s.io/apimachinery, k8s.io/client-go, k8s.io/apiserver, k8s.io/component-base, etc.) to match the same release. Running v1.36.2 of k8s.io/kubernetes against v0.31.2 siblings will almost certainly fail to compile or produce runtime type mismatches. The direct dependencies k8s.io/apimachinery and k8s.io/client-go (lines 19–20) also need updating. The go.sum file was not regenerated.
  Remediation: Either (a) update all k8s.io/* dependencies to the v0.36.2 / v1.36.2 family in lockstep and run go mod tidy to regenerate go.sum, or (b) do not bump k8s.io/kubernetes alone. Kubernetes upstream documents that staging modules must be updated together.

Previous run (8)

Review

Findings

Critical

• [api-contract] go.mod:167 — k8s.io/kubernetes is bumped from v1.31.0 to v1.36.2, but all other k8s.io/* dependencies remain pinned at v0.31.2 (corresponding to Kubernetes 1.31). Specifically, k8s.io/api, k8s.io/apimachinery, k8s.io/client-go, k8s.io/apiextensions-apiserver, k8s.io/apiserver, k8s.io/cli-runtime, k8s.io/component-base, k8s.io/component-helpers, k8s.io/kube-aggregator, and k8s.io/kubectl are all at v0.31.2. The k8s.io/kubernetes module at v1.36.2 expects its sibling modules at v0.36.x, creating a 5-minor-version skew that will fail go mod tidy or produce an untested, incompatible module combination.
  Remediation: Either (a) update all k8s.io/* dependencies to their v0.36.2 counterparts in the same PR, or (b) revert this change and wait for a coordinated bump of the full k8s.io dependency set.

High

• [incomplete-change] go.mod:167 — go.sum is not updated in this PR. The go.sum file contains checksums only for k8s.io/kubernetes v1.31.0 and has no entries for v1.36.2. Changing the version in go.mod without running go mod tidy means the module cannot be fetched or verified, and any build or CI step will fail.
  Remediation: Run go mod tidy after updating go.mod and include the resulting go.sum changes in the PR.

Previous run (9)

Review

Findings

Critical

• [API contract violation] go.mod:167 — k8s.io/kubernetes is bumped to v1.36.2 while all other k8s.io/* dependencies (k8s.io/api, k8s.io/apimachinery, k8s.io/client-go, k8s.io/apiserver, k8s.io/cli-runtime, k8s.io/component-base, k8s.io/component-helpers, k8s.io/kube-aggregator, k8s.io/kubectl) remain pinned at v0.31.2 (Kubernetes 1.31). The k8s.io/kubernetes module has internal dependencies on the other k8s.io/* modules at matching versions. This five-major-version skew will cause build failures or runtime incompatibilities. The go.sum file also lacks checksums for v1.36.2, confirming go mod tidy was not run.
  Remediation: Either (a) update all k8s.io/* dependencies together to their 1.36-compatible versions (k8s.io/api v0.36.2, k8s.io/apimachinery v0.36.2, k8s.io/client-go v0.36.2, etc.) and run go mod tidy, or (b) do not bump k8s.io/kubernetes independently of the rest of the k8s.io dependency set.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:42 PM UTC · Completed 10:49 PM UTC
Commit: 01f864b · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:28 AM UTC · Completed 5:35 AM UTC
Commit: 01f864b · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:01 PM UTC · Completed 10:04 PM UTC
Commit: 01f864b · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:24 PM UTC · Completed 9:29 PM UTC
Commit: 58b0710 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:28 PM UTC · Completed 9:32 PM UTC
Commit: 58b0710 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:29 AM UTC · Completed 10:34 AM UTC
Commit: 58b0710 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:12 AM UTC · Completed 3:20 AM UTC
Commit: 58b0710 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:30 PM UTC · Completed 9:39 PM UTC
Commit: 58b0710 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:39 PM UTC · Completed 9:48 PM UTC
Commit: 58b0710 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[medium] dependency version skew

k8s.io/kubernetes is bumped to v1.36.3 while all other k8s.io/* dependencies remain pinned at v0.31.2 (Kubernetes 1.31 series). The k8s.io/kubernetes module at v1.36.3 declares dependencies on k8s.io/api, k8s.io/apimachinery, k8s.io/client-go, etc. at the v0.36.x level. Go MVS should resolve this by pulling in the higher versions required by k8s.io/kubernetes if any transitive import path reaches those packages, but the project explicit pins at v0.31.2 may conflict. Since k8s.io/kubernetes is purely indirect (no Go source file in this project imports it) and is likely pulled in by argo-cd/v2, the practical runtime risk is limited. However, the five-major-version gap is a real dependency hygiene concern that could cause issues during future upgrades or if the transitive dependency graph changes.

Suggested fix: Either bump all k8s.io/* dependencies together to the 1.36.x series, or keep k8s.io/kubernetes at v1.31.x to match the other k8s.io modules. Run go build ./... and go test ./... -race after any change to verify compatibility. Given this is a Renovate bot PR that only bumps one module, the safest action is to also verify whether go mod tidy would auto-bump the sibling modules.