Bump the gardener group across 1 directory with 4 updates

[dependabot]

Bumps the gardener group with 4 updates in the /hack/runtime-migrator directory: github.com/gardener/gardener, github.com/gardener/gardener-extension-provider-aws, github.com/gardener/gardener-extension-provider-gcp and github.com/gardener/gardener-extension-provider-openstack.

Updates github.com/gardener/gardener from 1.110.4 to 1.111.0

Release notes

Sourced from github.com/gardener/gardener's releases.

v1.111.0

[gardener/gardener]

⚠️ Breaking Changes

• [OPERATOR] The OperatorConfiguration changed incompatibly: extensionRequired was renamed to extensionRequiredRuntime. by @​timuthy #11001

• [OPERATOR] The ShootManagedIssuer feature gate was removed. Enablement of the feature is now dependent on the existence of a secret in the garden namespace labeled with gardener.cloud/role: shoot-service-account-issuer. by @​dimityrmirchev #11078

• [OPERATOR] The ShootForceDeletion feature gate has been graduated to GA and is locked to true. by @​shafeeqes #11107

• [OPERATOR] This change applies to IPv4 clusters only.
  Gardener uses the CIDR range of 240.0.0.0/8 which is reserved as per IANA db to map the cluster ip of the kubernetes api-server in the seed to a different network range before exposing it to the shoot in the kubernetes service. This frees up address space in the shoot and removes potential clashes with shoot workload ips.

  Seed operators need to check if any of the following properties collide with the 240.0.0.0/8 range:

  spec:  
    networks:  
      pods: < check here >  
      nodes: < check here >  
      services: < check here >  
      shootDefaults:  
        pods: < check here >  
        nodes: < check here >  
        services: < check here >  
  

  by @​domdom82 #10949

• [OPERATOR] The wildcard TLS certificate for the runtime cluster must now be labelled with gardener.cloud/role=garden-cert instead of gardener.cloud/role=controlplane-cert to avoid duplicate role assignments for runtime and seed certificate secrets if Gardener runtime and seed run on the same cluster.
  The old role name is deprecated for the runtime cluster. It will not be accepted anymore with the next Gardener release. by @​MartinWeindel #11113

• [DEPENDENCY] Client-related functions have been adapted to use the external version of k8s.io/component-base/config.ClientConnectionConfiguration. If you need a helper function for transitioning to the external version, use pkg/client/kubernetes.ConvertClientConnectionConfigurationToExternal. by @​timebertt #11052

• [DEPENDENCY] The package github.com/gardener/gardener/extensions/pkg/apis/config has been dropped. Use the versioned variant of the package instead: github.com/gardener/gardener/extensions/pkg/apis/config/v1alpha1. by @​timebertt #11056

📰 Noteworthy

• [USER] Expired versions from the NamespacedCloudProfile are always dropped, except for already applied versions. by @​LucaBernstein #10910
• [OPERATOR] The vpa field (ineffective since v1.102) has been removed from the ManagedSeed API. by @​rfranzke #11047
• [OPERATOR] Now "vali" contains the managed control plane logs from the early stages of shoot reconcile. by @​nickytd #11082

✨ New Features

• [OPERATOR] Gardener-Operator handles generic Gardener extensions in the Garden-Runtime cluster (type: Extension). Such extensions can be configured via spec.extensions in the Garden resource. by @​timuthy #11192
• [OPERATOR] gardener-node-agent now persists its applied changes after each step when reconciling the OSC. This should avoid unnecessary work and systemd unit restarts. by @​maboehm #10969
• [OPERATOR] Add vpa histogram decay half-life parameters to the Shoot spec. by @​voelzmo #10959
• [OPERATOR] The Gardener Admission Controller now implements a handler that can prevent tampering with system Secrets and ConfigMaps if they are labeled with gardener.cloud/update-restriction=true. by @​dimityrmirchev #11108
• [OPERATOR] Add flow and flow task metrics for timing duration, delay and result count to gardenlet metrics. by @​LucaBernstein #10967
• [USER] Gardener now allows to omit or to only partially define the machine image version in shoot.Spec.Provider.Workers[].Machine.Image.Version. The version will automatically be defaulted to the latest minor/patch version found in the referenced CloudProfile. by @​LucaBernstein #10954
• [DEVELOPER] The extension library now supports adding watches via WatchBuilder for other resources in the generic extension controller. by @​domdom82 #11064
• [DEVELOPER] Add option to register flow metrics on monitoring registry. by @​LucaBernstein #10967
• [DEVELOPER] A local setup for trying out, developing, and testing the autonomous shoot cluster functionality of gardenadm has been introduced. You can find the documentation here. by @​rfranzke #10977

🐛 Bug Fixes

• [OPERATOR] Gardener can now delete and migrate shoots that use dynamic node network allocation, even if the infrastructure creation has never been successfully completed. by @​timebertt #11038
• [OPERATOR] An issue was fixed in gardener-operator that prevented configuring OIDC for gardener-dashboard while using Structured Authentication. by @​timuthy #11080
• [OPERATOR] gardener-node-agent does not restart containerd.service on every OSC reconciliation anymore. by @​oliver-goetz #11120
• [USER] Fix the NamespacedCloudProfile status mutation. by @​LucaBernstein #11036
• [DEVELOPER] Avoid calling GetCluster for non-shoot namespaces in shootNotFailedPredicate and dnsrecord controller. by @​MartinWeindel #11123

... (truncated)

Commits

• 37ae9bf Release v1.111.0
• 8fda81b chore(deps): update registry.k8s.io/ingress-nginx/controller-chroot docker ta...
• fa1658e Consider machine image name while calculating list of valid image (#11220)
• 822c574 Fix TM test Shoot container runtime testing (#11219)
• ceaced6 Allow generic-garbage-collector serviceaccount to delete update restricted re...
• bd43935 Drop internal version of resourcemanager.config.gardener.cloud API (#11099)
• 44b0ad7 Fixed broken links - 2025.01 (#11207)
• c2ce545 Separate apis/\<api>/[ver]/helper/helper.go into different `helper_<resource...
• 3a215a4 docs: Simplify second seed cluster guide (#11213)
• 58cd487 [operator] Manage Generic Gardener Extensions (#11192)
• Additional commits viewable in compare view

Updates github.com/gardener/gardener-extension-provider-aws from 1.58.3 to 1.60.0

Release notes

Sourced from github.com/gardener/gardener-extension-provider-aws's releases.

v1.60.0

[gardener/gardener-extension-provider-aws]

📰 Noteworthy

• [USER] The kube-system/csi-driver-node DaemonSet is no longer scaled by a VerticalPodAutoscaler as it does not really benefit from it. Removing VerticalPodAutoscaler for that component will reduce unnecessary evictions by VPA and will be a mitigation for https://issues.k8s.io/126921. by @​ialidzhikov #1179

✨ New Features

• [USER] Support for VolumeAttributesClasses can now be enabled via shoot annotation. by @​AndreasBurger #1152

🏃 Others

• [OPERATOR] In IPv6 and dual stack shoot cluster external load balancers will get the aws dual stack load balancer annotations in order to work properly. by @​DockToFuture #1160
• [OPERATOR] Add validation of internal-subnet CIDR for IPv6 shoots by @​AndreasBurger #1186
• [OPERATOR] Set primary-ip-family flag for aws-ipam-controller by @​DockToFuture #1168
• [USER] Shoots with NodeLocalDNS enabled will use UDP instead of TCP for upstream DNS queries by default to avoid performance issues on AWS. by @​domdom82 #1161
• [DEPENDENCY] Update gardener to v1.110.0 by @​hebelsan #1176

[gardener/machine-controller-manager-provider-aws]

🐛 Bug Fixes

• [OPERATOR] Fixed a panic that occurs while fetching the status of a VM backing a machine from the provider. by @​renormalizegardener/machine-controller-manager-provider-aws#180

🏃 Others

• [OPERATOR] Added gosec for Static Application Security Testing (SAST). by @​thiyyakatgardener/machine-controller-manager-provider-aws#179
• [DEVELOPER] Updated go lang version to 1.23.3 by @​thiyyakatgardener/machine-controller-manager-provider-aws#179
• [DEVELOPER] The gardener/machine-controller-manager dependency has been updated to v0.55.1. Release Notes by @​thiyyakatgardener/machine-controller-manager-provider-aws#179

[gardener/terraformer]

🐛 Bug Fixes

• [DEVELOPER] Provider azurerm was updated to version 3.47.0 and is now properly recognising the ARM_OIDC_TOKEN_FILE_PATH env variable. by @​dimityrmirchevgardener/terraformer#156

🏃 Others

• [OPERATOR] Update alpine to v3.21.2 by @​kon-angelogardener/terraformer#157
• [OPERATOR] Update golang to v1.23.5 by @​kon-angelogardener/terraformer#157

Helm Charts

• admission-aws-application: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-aws-application:v1.60.0
• admission-aws-runtime: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-aws-runtime:v1.60.0
• provider-aws: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/provider-aws:v1.60.0

Docker Images

• gardener-extension-admission-aws: europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-aws:v1.60.0
• gardener-extension-provider-aws: europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-aws:v1.60.0

v1.59.2

[gardener/gardener-extension-provider-aws]

🐛 Bug Fixes

• [USER] Fix the NamespacedCloudProfile status mutation. by @​LucaBernstein #1172

... (truncated)

Commits

• b18546c Release v1.60.0
• 5238eba add support for VolumeAttributesClasses (#1152)
• 6da0aa0 Bump github.com/gardener/etcd-druid from 0.25.0 to 0.26.1 (#1194)
• 3667f59 Bump github.com/gardener/gardener from 1.110.2 to 1.110.4 (#1195)
• ab68e95 Bump the non-gardener-dependencies group across 1 directory with 25 updates (...
• 51a6331 Bump golang from 1.23.4 to 1.23.5 (#1197)
• 42788c9 Upgrade terraformer (#1199)
• a1ed336 Address TODOs (#1192)
• 5386ee7 Bump github.com/gardener/gardener from 1.110.1 to 1.110.2 (#1188)
• 093d1d2 Rename to seedprovider webhook (#1190)
• Additional commits viewable in compare view

Updates github.com/gardener/gardener-extension-provider-gcp from 1.40.1 to 1.42.0

Release notes

Sourced from github.com/gardener/gardener-extension-provider-gcp's releases.

v1.42.0

[gardener/gardener-extension-provider-gcp]

📰 Noteworthy

• [USER] The kube-system/csi-driver-node DaemonSet is no longer scaled by a VerticalPodAutoscaler as it does not really benefit from it. Removing VerticalPodAutoscaler for that component will reduce unnecessary evictions by VPA and will be a mitigation for https://issues.k8s.io/126921. by @​ialidzhikov #929
• [OPERATOR] Added support for immutable backup buckets in the GCP provider extension. Operators can configure immutability settings to enhance backup data security by preventing data alteration or deletion before the specified retention period. by @​seshachalam-yv #906

✨ New Features

• [OPERATOR] Support specification of extended resources in provider config node template without re-specifying core resources. by @​elankath #889

🐛 Bug Fixes

• [USER] Fix the NamespacedCloudProfile status mutation. by @​LucaBernstein #942

🏃 Others

• [DEPENDENCY] Update gardener to v1.110.0 by @​hebelsan #927
• [OPERATOR] Validate that all images in cloudProfile map to a valid image in the cloudProfileConfig by @​hebelsan #932

[gardener/machine-controller-manager-provider-gcp]

🏃 Others

• [USER] MCM provider GCP is able to provide the values for a shieldedInstanceConfiguration from a machineClass to the GCP API. by @​MrBatschnergardener/machine-controller-manager-provider-gcp#135
• [DEVELOPER] The gardener/machine-controller-manager dependency has been updated to v0.55.1. Release Notes by @​thiyyakatgardener/machine-controller-manager-provider-gcp#134
• [DEVELOPER] Added gosec for Static Application Security Testing (SAST). by @​thiyyakatgardener/machine-controller-manager-provider-gcp#134
• [DEVELOPER] Updated go lang version to 1.23.3 by @​thiyyakatgardener/machine-controller-manager-provider-gcp#134

[gardener/terraformer]

🐛 Bug Fixes

• [DEVELOPER] Provider azurerm was updated to version 3.47.0 and is now properly recognising the ARM_OIDC_TOKEN_FILE_PATH env variable. by @​dimityrmirchevgardener/terraformer#156

🏃 Others

• [OPERATOR] Update golang to v1.23.5 by @​kon-angelogardener/terraformer#157
• [OPERATOR] Update alpine to v3.21.2 by @​kon-angelogardener/terraformer#157

Helm Charts

• admission-gcp-application: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-gcp-application:v1.42.0
• admission-gcp-runtime: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-gcp-runtime:v1.42.0
• provider-gcp: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/provider-gcp:v1.42.0

Docker Images

• gardener-extension-admission-gcp: europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-gcp:v1.42.0
• gardener-extension-provider-gcp: europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-gcp:v1.42.0

v1.41.1

[gardener/gardener-extension-provider-gcp]

🏃 Others

• [OPERATOR] Disable --allocate-node-cidrs in kube-controller-manager for kubernetes >= 1.31 as cloud-controller-manager takes over this responsibility. by @​hebelsan #937

... (truncated)

Commits

• f2c391a Release v1.42.0
• ea3b612 csi-driver-node: enable readOnlyRootFilesystem (#912)
• ec1572e Bump github.com/gardener/gardener from 1.110.1 to 1.110.4 (#945)
• 48133df Bump the all-dependencies group across 1 directory with 16 updates (#950)
• 5d6adcf Bump golang from 1.23.4 to 1.23.5 (#943)
• 8877ad6 Bump github.com/gardener/etcd-druid from 0.25.0 to 0.26.1 (#946)
• 7da21f1 Upgrade terraformer (#948)
• c455eef Support extended resources in providerConfig.nodeTemplate, inherit core resou...
• fc76ee1 Merge pull request #941 from LucaBernstein/10017-seedprovider-webhook-rename
• cfd7a7e Rename to seedprovider webhook
• Additional commits viewable in compare view

Updates github.com/gardener/gardener-extension-provider-openstack from 1.43.0 to 1.46.0

Release notes

Sourced from github.com/gardener/gardener-extension-provider-openstack's releases.

v1.45.0

[gardener/gardener-extension-provider-openstack]

📰 Noteworthy

• [USER] The kube-system/csi-driver-node and kube-system/csi-driver-manila-node DaemonSets are no longer scaled by a VerticalPodAutoscaler as they do not really benefit from it. Removing VerticalPodAutoscaler for these components will reduce unnecessary evictions by VPA and will be a mitigation for https://issues.k8s.io/126921. by @​ialidzhikov #938

🐛 Bug Fixes

• [USER] Fix the NamespacedCloudProfile status mutation. by @​LucaBernstein #930

🏃 Others

• [DEPENDENCY] Update gardener to v1.110.0 by @​hebelsan #933
• [OPERATOR] The EgressCIDRS are now properly calculated for IPv6 addresses of the router. by @​kon-angelo #958
• [OPERATOR] The EgressCIDRS are now properly calculated for multiple external fixed IPs of the router. by @​kon-angelo #958
• [OPERATOR] Ignore not found errors on resource deletion during infrastructure reconciliation. by @​kon-angelo #948

[gardener/machine-controller-manager-provider-openstack]

🏃 Others

• [DEVELOPER] The gardener/machine-controller-manager dependency has been updated to v0.55.1. Release Notes v0.55.0
  Release Notes v0.55.1 by @​gardener-robot-ci-3gardener/machine-controller-manager-provider-openstack#204
• [DEVELOPER] Add gosec as sast makefile target by @​hebelsangardener/machine-controller-manager-provider-openstack#199
• [DEPENDENCY] Update gardener/gardener to v1.108.1 by @​hebelsangardener/machine-controller-manager-provider-openstack#200
• [OPERATOR] Increase VM status check timeout to 1200 seconds. by @​kon-angelogardener/machine-controller-manager-provider-openstack#212

[gardener/terraformer]

🐛 Bug Fixes

• [DEVELOPER] Provider azurerm was updated to version 3.47.0 and is now properly recognising the ARM_OIDC_TOKEN_FILE_PATH env variable. by @​dimityrmirchevgardener/terraformer#156

🏃 Others

• [OPERATOR] Update golang to v1.23.5 by @​kon-angelogardener/terraformer#157
• [OPERATOR] Update alpine to v3.21.2 by @​kon-angelogardener/terraformer#157

Helm Charts

• admission-openstack-application: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-application:v1.45.0
• admission-openstack-runtime: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/admission-openstack-runtime:v1.45.0
• provider-openstack: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/extensions/provider-openstack:v1.45.0

Docker Images

• gardener-extension-admission-openstack: europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/admission-openstack:v1.45.0
• gardener-extension-provider-openstack: europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-openstack:v1.45.0

v1.44.1

[gardener/gardener-extension-provider-openstack]

🐛 Bug Fixes

• [USER] MCM update to v0.20.1: Increase VM status check timeout to 1200 seconds by @​hebelsan #939

Helm Charts

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.