feat: bump CRD sources for the Kubernetes 1.35 platform component upgrades - abandoned

[hamzabouissi]

Match the component versions deployed by GlueOps/platform-helm-chart-platform#1498 (and the Argo CD 3.4 move in GlueOps/terraform-module-cloud-multy-prerequisites#741), following the README "bumping a source" recipe: only kustomization.yaml / profiles/kubeadm/kustomization.yaml are hand-edited, and the render-on-renovate job regenerates crds/, charts/kubeadm/crds/ and the Chart.yaml pins.

Source	Before	After
cert-manager	v1.18.2	v1.21.2
external-secrets	v0.19.2	v2.10.0 (adds 3 generator CRDs; v1beta1 stays defined and unserved)
traefik chart	v39.0.0	v41.6.0 (IngressRoute gains spec.ingressClassName, which chart 41 renders; 41.5.0 and 41.6.0 ship identical CRDs)
keda	v2.20.1	v2.20.2 (one enum value on ScaledJob scalingStrategy.strategy)
metacontroller	v4.12.5	v4.17.2 (additive webhook auth/TLS fields; the hook version field already existed)
external-dns chart	1.20.0	1.22.0 (adds the dnsrecords CRD; dnsendpoints unchanged)
argo-cd	v3.2.12	v3.4.9 (Application sourceHydrator restructure, AppProject clusterResourceWhitelist[].name, ApplicationSet status.health; additive only)
vpa (kubeadm profile)	1.6.0	1.7.1 (InPlace update mode, startupBoost, per-VPA OOM/aggregation settings, status.observedGeneration)

Bundle: 86 -> 90 CRD files (three external-secrets generators plus dnsrecords). No served or storage version changes on any source, so no storage migration is needed, and the bundle can be applied to clusters ahead of the platform release. kube-prometheus-stack and fluent-operator pins are unchanged (monitoring is handled separately upstream).

Follow-ups merged into this branch: #84 (traefik v41.6.0), #87 (VPA 1.7.1), #88 (argo-cd v3.4.9). Supersedes #82, which carried the same change with the rendered crds/ committed by hand, and Renovate's #53, #69, #73, #75, #78, #79, #80, #81.

Note on the release number: this repo's release-please sets bump-patch-for-minor-pre-major, so a feat: merge releases as v0.1.5 (v0.2.0 only if merged as feat!). The terraform module pins v0.1.5.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FSau4e6nS8Y7eM1nQHwq6k

[Copilot]

🟢 Approval recommended

The reviewed CRD and pin updates align with the requested upgrades, with no unresolved review comments.

Pull request overview

Updates bundled Kubernetes CRD sources and generated Helm pins for the Kubernetes 1.35 platform component upgrades.

Changes:

• Bumps cert-manager, External Secrets, Traefik, KEDA, metacontroller, and external-dns sources.
• Regenerates corresponding CRDs and Chart.yaml pins.
• Adds new generator and DNSRecord CRDs while preserving served/storage versions.

File summaries

File	Description
kustomization.yaml	Updated upstream CRD source pins.
crds/webhooks.generators.external-secrets.io.yaml	Regenerated External Secrets generator CRD.
crds/vaultdynamicsecrets.generators.external-secrets.io.yaml	Regenerated External Secrets generator CRD.
crds/uuids.generators.external-secrets.io.yaml	Regenerated External Secrets generator CRD.
crds/traefikservices.traefik.io.yaml	Regenerated Traefik CRD.
crds/tlsstores.traefik.io.yaml	Regenerated Traefik CRD.
crds/tlsoptions.traefik.io.yaml	Regenerated Traefik CRD.
crds/stssessiontokens.generators.external-secrets.io.yaml	Regenerated External Secrets generator CRD.
crds/sshkeys.generators.external-secrets.io.yaml	Regenerated External Secrets generator CRD.
crds/serverstransporttcps.traefik.io.yaml	Regenerated Traefik CRD.
crds/serverstransports.traefik.io.yaml	Regenerated Traefik CRD.
crds/scaledjobs.keda.sh.yaml	Regenerated KEDA CRD.
crds/quayaccesstokens.generators.external-secrets.io.yaml	Regenerated External Secrets generator CRD.
crds/pushsecrets.external-secrets.io.yaml	Regenerated External Secrets CRD.
crds/passwords.generators.external-secrets.io.yaml	Regenerated External Secrets generator CRD.
crds/orders.acme.cert-manager.io.yaml	Regenerated cert-manager CRD.
crds/middlewaretcps.traefik.io.yaml	Regenerated Traefik CRD.
crds/middlewares.traefik.io.yaml	Regenerated Traefik CRD.
crds/mfas.generators.external-secrets.io.yaml	Regenerated External Secrets generator CRD.
crds/ingressrouteudps.traefik.io.yaml	Regenerated Traefik CRD.
crds/ingressroutetcps.traefik.io.yaml	Regenerated Traefik CRD.
crds/ingressroutes.traefik.io.yaml	Adds Traefik ingress class support.
crds/grafanas.generators.external-secrets.io.yaml	Regenerated External Secrets generator CRD.
crds/gitlabdeploytokens.generators.external-secrets.io.yaml	Adds the External Secrets GitLab generator CRD.
crds/githubaccesstokens.generators.external-secrets.io.yaml	Regenerated External Secrets generator CRD.
crds/generatorstates.generators.external-secrets.io.yaml	Regenerated External Secrets generator CRD.
crds/gcraccesstokens.generators.external-secrets.io.yaml	Regenerated External Secrets generator CRD.
crds/fakes.generators.external-secrets.io.yaml	Regenerated External Secrets generator CRD.
crds/externalsecrets.external-secrets.io.yaml	Regenerated External Secrets CRD.
crds/ecrauthorizationtokens.generators.external-secrets.io.yaml	Regenerated External Secrets generator CRD.
crds/dnsrecords.externaldns.k8s.io.yaml	Adds the external-dns DNSRecord CRD.
crds/decoratorcontrollers.metacontroller.k8s.io.yaml	Adds metacontroller endpoint and auth/TLS fields.
crds/controllerrevisions.metacontroller.k8s.io.yaml	Regenerated metacontroller CRD.
crds/clusterpushsecrets.external-secrets.io.yaml	Regenerated External Secrets CRD.
crds/clusterexternalsecrets.external-secrets.io.yaml	Regenerated External Secrets CRD.
crds/cloudsmithaccesstokens.generators.external-secrets.io.yaml	Adds the External Secrets Cloudsmith generator CRD.
crds/challenges.acme.cert-manager.io.yaml	Regenerated cert-manager CRD.
crds/certificates.cert-manager.io.yaml	Regenerated cert-manager CRD.
crds/certificaterequests.cert-manager.io.yaml	Regenerated cert-manager CRD.
crds/beyondtrustworkloadcredentialsdynamicsecrets.generators.external-secrets.io.yaml	Adds the External Secrets BeyondTrust generator CRD.
crds/acraccesstokens.generators.external-secrets.io.yaml	Regenerated External Secrets generator CRD.
Chart.yaml	Updated generated component pin annotations.

Review details

• Files reviewed: 46/48 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[public-glueops-renovatebot]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

[Copilot]

🟡 Changes recommended

Restore the Argo CD source to v3.2.12 and regenerate dependent files.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (1)

Chart.yaml:19

• The generated annotation now advertises Argo CD v3.4.6, which follows the unintended source bump but contradicts the stated unchanged Argo CD pin. After restoring the source version, regenerate Chart.yaml so this annotation returns to v3.2.12.

  glueops.dev/pin.argo-cd: "v3.4.6"

• Files reviewed: 47/51 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

Argo CD is changed out of scope, and the Traefik source and generated pin use v41.6.0 instead of the stated v41.5.0 target.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (3)

Chart.yaml:19

• This generated pin contradicts the PR metadata's statement that Argo CD remains unchanged. If the source is restored to v3.2.12, regenerate this annotation so the packaged chart does not advertise an unrelated Argo CD upgrade.

  glueops.dev/pin.argo-cd: "v3.4.6"

Chart.yaml:23

• This generated annotation also records v41.6.0, so the packaged chart will continue to advertise a different Traefik version even if the source URLs are corrected to the v41.5.0 target from the PR metadata. Regenerate this pin after correcting the source.

  glueops.dev/pin.traefik: "v41.6.0"

kustomization.yaml:3

• This changes the Argo CD CRD source from v3.2.12 even though this PR says the Argo CD pin is unchanged. The linked platform upgrade (#1498) also lists Argo CD as a separate step, so this out-of-scope bump changes the rendered AppProject schema and Chart pin. Please keep this source at v3.2.12 unless the PR scope and description are intentionally revised.

• Files reviewed: 47/51 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

The Argo CD, Traefik, and VPA pins do not match the stated scope and versions.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (2)

kustomization.yaml:3

• The PR description says Argo CD remains at v3.2.12, and the referenced platform upgrade treats the Argo bump as a separate step, but this source now pulls v3.4.6 and regenerates the Argo CRDs. That broadens this bundle beyond the stated upgrade and changes its platform pin; restore v3.2.12 here and re-render, or explicitly revise the PR scope and dependency contract.
  kustomization.yaml:9
• All ten Traefik sources in this hunk use v41.6.0, while the PR description and the referenced platform upgrade require v41.5.0. The rendered CRDs and Chart.yaml pin therefore do not match the chart version this bundle is supposed to prepare for; use v41.5.0 consistently and re-render, or update the stated dependency.

• Files reviewed: 49/53 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

Reconcile the documented component matrix with the Argo CD, Traefik, and VPA updates, and correct the generated cert-manager descriptions.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (5)

crds/challenges.acme.cert-manager.io.yaml:1377

• This regenerated API description says the scheduler computes the anti-affinity score by subtracting matching weights, but the scheduler selects the node with the greatest sum and the adjacent item description says weights are added. Please correct the generated description so it says adding; otherwise this CRD publishes an incorrect description of Kubernetes behavior.

                                                compute a sum by iterating through the elements of this field and subtracting

crds/challenges.acme.cert-manager.io.yaml:2589

• The same regenerated schema typo appears here: anti-affinity weights are added to the score, not subtracted. Please correct this generated description to say adding so consumers are not misled about scheduler behavior.

                                                compute a sum by iterating through the elements of this field and subtracting

kustomization.yaml:5

• These sources and the generated pin use Traefik chart v41.6.0, but the PR description/table says the target is v41.5.0. The linked platform upgrade's current prerequisite also names v41.6.0, so please update the description and rollout expectations to match the actual CRDs; leaving the component matrix at v41.5.0 is misleading.
  kustomization.yaml:5
• These refs no longer match this PR's stated version matrix: Argo CD is bumped even though the description says it is unchanged, and Traefik is set to v41.6.0 rather than the documented v41.5.0. The linked platform upgrade now calls for Traefik 41.6.0, so please update this PR's description (and clarify whether the Argo CRD bump is intentional) or restore the documented refs; otherwise the generated CRDs and pins are not traceable to the stated acceptance criteria.
  profiles/kubeadm/kustomization.yaml:6
• The source now bumps the kubeadm-only VPA CRD from 1.6.0 to 1.7.1, while the PR description says VPA is unchanged. The linked platform upgrade currently requires VPA 1.7.1, so please reconcile the description and component matrix with this change (or revert it); otherwise consumers cannot tell that enabling kubeadm also changes its VPA CRDs.

• Files reviewed: 49/53 changed files
• Comments generated: 1
• Review effort level: Lite