feat: bump CRDs for the Kubernetes 1.35 platform component upgrades

[hamzabouissi]

Match the component versions deployed by
GlueOps/platform-helm-chart-platform#1498:

• cert-manager v1.18.2 -> v1.21.2
• external-secrets v0.19.2 -> v2.10.0 (adds 3 generator CRDs: beyondtrustworkloadcredentialsdynamicsecrets, cloudsmithaccesstokens, gitlabdeploytokens; v1beta1 stays defined and unserved)
• traefik chart v39.0.0 -> v41.5.0 (traefik.io CRDs for proxy v3.7; IngressRoute gains spec.ingressClassName, which chart 41 renders)
• keda v2.20.1 -> v2.20.2
• metacontroller v4.12.5 -> v4.17.2 (additive hook version and webhook auth/TLS fields)
• external-dns chart 1.20.0 -> 1.22.0 (adds dnsrecords CRD; dnsendpoints unchanged)

No served or storage version changes; 83 -> 87 base CRDs (89 with kubeadm). Argo CD, VPA, kube-prometheus-stack and fluent-operator pins are unchanged.

[Copilot]

🔵 Needs a closer look

The broad generated-CRD upgrade warrants final human review, with six documented nit comments.

Pull request overview

Updates the CRD bundle for Kubernetes 1.35 component upgrades while preserving served and storage versions.

Changes:

• Bumps component CRD sources and chart annotations.
• Regenerates cert-manager, External Secrets, Traefik, KEDA, and metacontroller CRDs.
• Adds three External Secrets generator CRDs and the external-dns DNSRecord CRD.

Review notes: Six nit comments (1 vote each) request correcting the scheduler-affinity weight descriptions and regenerating the CRDs in the specified cert-manager files and lines.

File summaries

File	Reviewed change
kustomization.yaml	Updates CRD references and adds DNSRecord.
crds/webhooks.generators.external-secrets.io.yaml	Regenerated External Secrets webhook generator CRD.
crds/vaultdynamicsecrets.generators.external-secrets.io.yaml	Regenerated Vault generator CRD.
crds/uuids.generators.external-secrets.io.yaml	Regenerated UUID generator CRD.
crds/traefikservices.traefik.io.yaml	Regenerated Traefik service CRD.
crds/tlsstores.traefik.io.yaml	Regenerated Traefik TLS store CRD.
crds/tlsoptions.traefik.io.yaml	Regenerated Traefik TLS option CRD.
crds/stssessiontokens.generators.external-secrets.io.yaml	Regenerated STS session-token generator CRD.
crds/sshkeys.generators.external-secrets.io.yaml	Regenerated SSH key generator CRD.
crds/serverstransporttcps.traefik.io.yaml	Regenerated Traefik TCP transport CRD.
crds/serverstransports.traefik.io.yaml	Regenerated Traefik transport CRD.
crds/scaledjobs.keda.sh.yaml	Updates the KEDA scaled-jobs schema.
crds/quayaccesstokens.generators.external-secrets.io.yaml	Regenerated Quay token generator CRD.
crds/pushsecrets.external-secrets.io.yaml	Regenerated External Secrets push-secret CRD.
crds/passwords.generators.external-secrets.io.yaml	Regenerated password generator CRD.
crds/orders.acme.cert-manager.io.yaml	Regenerated cert-manager order CRD.
crds/middlewaretcps.traefik.io.yaml	Regenerated Traefik TCP middleware CRD.
crds/middlewares.traefik.io.yaml	Regenerated Traefik middleware CRD.
crds/mfas.generators.external-secrets.io.yaml	Regenerated MFA generator CRD.
crds/ingressrouteudps.traefik.io.yaml	Regenerated Traefik UDP route CRD.
crds/ingressroutetcps.traefik.io.yaml	Regenerated Traefik TCP route CRD.
crds/ingressroutes.traefik.io.yaml	Adds Traefik ingress-class support.
crds/grafanas.generators.external-secrets.io.yaml	Regenerated Grafana generator CRD.
crds/gitlabdeploytokens.generators.external-secrets.io.yaml	Adds the GitLab deploy-token generator CRD.
crds/githubaccesstokens.generators.external-secrets.io.yaml	Regenerated GitHub token generator CRD.
crds/generatorstates.generators.external-secrets.io.yaml	Regenerated generator-state CRD.
crds/gcraccesstokens.generators.external-secrets.io.yaml	Regenerated GCR token generator CRD.
crds/fakes.generators.external-secrets.io.yaml	Regenerated fake generator CRD.
crds/externalsecrets.external-secrets.io.yaml	Updates External Secrets fields and generator references.
crds/ecrauthorizationtokens.generators.external-secrets.io.yaml	Regenerated ECR authorization-token generator CRD.
crds/dnsrecords.externaldns.k8s.io.yaml	Adds the external-dns DNSRecord CRD.
crds/decoratorcontrollers.metacontroller.k8s.io.yaml	Adds metacontroller webhook authentication and TLS configuration.
crds/controllerrevisions.metacontroller.k8s.io.yaml	Regenerated metacontroller controller-revision CRD.
crds/clusterpushsecrets.external-secrets.io.yaml	Regenerated cluster push-secret CRD.
crds/clusterexternalsecrets.external-secrets.io.yaml	Regenerated cluster External Secrets CRD.
crds/cloudsmithaccesstokens.generators.external-secrets.io.yaml	Adds the Cloudsmith token generator CRD.
crds/challenges.acme.cert-manager.io.yaml	Regenerated cert-manager challenge CRD.
crds/certificates.cert-manager.io.yaml	Regenerated cert-manager certificate CRD.
crds/certificaterequests.cert-manager.io.yaml	Regenerated cert-manager certificate-request CRD.
crds/beyondtrustworkloadcredentialsdynamicsecrets.generators.external-secrets.io.yaml	Adds the BeyondTrust generator CRD.
crds/acraccesstokens.generators.external-secrets.io.yaml	Regenerated ACR token generator CRD.
Chart.yaml	Updates component version pin annotations.

Review details

Suppressed comments (6)

crds/challenges.acme.cert-manager.io.yaml:1377

• The Kubernetes scheduler adds each matching weight to the per-node score, but this generated description says it subtracts the weight. That reverses the documented affinity behavior and conflicts with the item description below; please correct the source description and regenerate the CRDs.

                                                compute a sum by iterating through the elements of this field and subtracting

crds/challenges.acme.cert-manager.io.yaml:2589

• The Kubernetes scheduler adds each matching weight to the per-node score, but this generated description says it subtracts the weight. That reverses the documented affinity behavior and conflicts with the item description below; please correct the source description and regenerate the CRDs.

                                                compute a sum by iterating through the elements of this field and subtracting

crds/clusterissuers.cert-manager.io.yaml:1490

• The Kubernetes scheduler adds each matching weight to the per-node score, but this generated description says it subtracts the weight. That reverses the documented affinity behavior and conflicts with the item description below; please correct the source description and regenerate the CRDs.

                                                      compute a sum by iterating through the elements of this field and subtracting

crds/clusterissuers.cert-manager.io.yaml:2702

• The Kubernetes scheduler adds each matching weight to the per-node score, but this generated description says it subtracts the weight. That reverses the documented affinity behavior and conflicts with the item description below; please correct the source description and regenerate the CRDs.

                                                      compute a sum by iterating through the elements of this field and subtracting

crds/issuers.cert-manager.io.yaml:1489

• The Kubernetes scheduler adds each matching weight to the per-node score, but this generated description says it subtracts the weight. That reverses the documented affinity behavior and conflicts with the item description below; please correct the source description and regenerate the CRDs.

                                                      compute a sum by iterating through the elements of this field and subtracting

crds/issuers.cert-manager.io.yaml:2701

• The Kubernetes scheduler adds each matching weight to the per-node score, but this generated description says it subtracts the weight. That reverses the documented affinity behavior and conflicts with the item description below; please correct the source description and regenerate the CRDs.

                                                      compute a sum by iterating through the elements of this field and subtracting

• Files reviewed: 46/48 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.