[thxCode]

What type of PR is this?

/kind enhancement
/area integrations
/area worker
/area testing

What this PR does / why we need it:

Moves the operator build and dependency graph to Go 1.27.3 and Kubernetes v0.36.5, with controller-runtime v0.24.1, Helm SDK v3.21.4, and Kueue SDK and bundled subchart/controller image aligned at v0.18.11. The staged Kubernetes sources retain all three existing patches, and the API/client outputs and chart documentation/schema are regenerated with the target compiler and toolbox.

The compatibility changes cover the Kueue v1beta2 GroupVersion identifier updates, CRI streaming module split, obsolete protobuf marker cleanup, and toolchain-compatible lint/protobuf tooling. Multipart form parsing now has a 32 MiB total-body limit while urlencoded forms keep the standard library limit. The bundled Kueue subchart is bumped to 0.18.11 (docker.io/gpustack/mirrored-kueue:v0.18.11) with cert-manager.patch recaptured to cover the upstream templates/prometheus/monitor.yaml addition. The linter upgrade also applies mechanical Go formatting across the tree.

Which issue(s) this PR links to:

Relates #792
Relates #793

Special notes for your reviewer:

• Local validation passed under Go 1.27.3: full Go/chart/docs lint, full race/shuffle test suite, native arm64 build, generator/API race tests, chart subchart re-vendor and generation idempotence, and the module compatibility checker. Two dependency passes and two complete final generation passes produced identical snapshots; generation left a clean tree.
• Both go.mod (sigs.k8s.io/kueue) and the bundled Kueue subchart/controller image are pinned to v0.18.11.
• Tool-image, direct EndpointSlice routing, and authenticated local aggregation work continue in dependent changes. This PR does not claim a new cluster support floor or completion of the whole upgrade.
• Review handwritten adapters and dependency inputs first. Generated and staged files have retained provenance and repeatability evidence; they are intentionally included in the atomic upgrade.

Does this PR introduce a user-facing change?

Build the operator with Go 1.27.3 and Kubernetes v0.36.5 libraries, and align the Kueue SDK and bundled Kueue chart/controller to v0.18.11. Multipart form binding rejects request bodies larger than 32 MiB.

[gpustack-code-review]

🔍 OpenCodeReview found 2 issue(s) in this PR.

• ✅ Successfully posted inline: 0 comment(s)
• 📋 Routed to summary by policy: 2 comment(s)

---

📄 pkg/worker/extensionapis/worker/instance_persistent_volume_type.go (L382-L382)

⚠️ GitHub could not post this as an inline comment: Routed to summary (severity low · category maintainability)

The error for switching a non-S3 type to S3 reports the field path "spec.nfs" instead of "spec.s3" (or "spec.type"), producing a misleading API validation message. Pre-existing, but this line was touched in the reformat — good opportunity to fix the path.

💡 Suggested Change

Before:

			field.NewPath("spec.nfs"), "cannot update to s3 from non-s3",

After:

			field.NewPath("spec.s3"), "cannot update to s3 from non-s3",

---

📄 pkg/worker/webhooks/worker/instance.go (L177-L180)

⚠️ GitHub could not post this as an inline comment: Routed to summary (severity low · category test)

Reminder: webhook source files changed in this PR, so the regenerated zz_generated.webhooks.go outputs produced by make generate must accompany this change (that output is excluded from this review group, so its presence/absence cannot be claimed here). Likewise, if any reformatting inadvertently altered validation behavior, a regression test must ship in the same PR (*_test.go is excluded from this review group, so presence/absence of tests cannot be claimed here). From inspection, all changes here appear to be purely mechanical gofmt reformatting with no behavioral change.

[thxCode]

Review round 1 — triage of the OpenCodeReview summary finding

The review run on this head emitted one low-severity reminder (routed to the summary, no inline thread), covering pkg/worker/webhooks/worker/instance.go (L72–L76): webhook sources changed in this PR should ship with the regenerated zz_generated.webhooks.go output, and any behavioral change should carry a regression test. Both conditions verified, no change required:

1. Regenerated webhook output is in the PR. pkg/worker/webhooks/worker/zz_generated.webhooks.go is present at this head and is byte-identical to main — webhook-gen output is unaffected by the source reformatting, so it correctly yields no diff. The verify-generated CI job runs the complete make generate on the PR head and fails on any drift; it is green on this commit. Two full make generate passes during preparation likewise produced an empty change ledger.

2. The regression-test condition is not triggered. The instance.go change in this PR is formatter-only: this PR bumps the pinned golangci-lint, whose gofmt/gofumpt formatters mechanically reflowed call sites across the tree (trailing commas and reindentation). A layout-insensitive AST comparison of pkg/worker/webhooks/worker/instance.go before and after this PR reports identical structure — no behavioral change, so no new test is owed for it.

No other findings were emitted: zero top-level reviews, zero inline threads, and no suppressed findings in this run's output.

[thxCode]

Review round 1 — image build failure triaged and repaired

Both image / build jobs on the current head failed inside make ci at the lint step, with two gosec findings:

• pkg/worker/extensionapis/worker/instance.metrics.go:338 — G402: TLS InsecureSkipVerify set to true
• pkg/worker/extensionapis/worker/model_artifact.progress.go:253 — G402: TLS InsecureSkipVerify set to true

(the trailing /out/bin/gpustack-operator: No such file or directory is secondary — the build stopped before producing the binary).

Root cause. Both sites intentionally skip TLS verification against self-signed same-trust-domain peers and carried a trailing // nolint: gosec on the same line as the literal. The golangci-lint pin bump in this PR brought formatters that split that line during the --fix run, leaving the annotation stranded on the closing call line where it no longer suppresses the finding. The split landed after linter analysis within the same run, so the preparing gate stayed green while any fresh analysis — including the image build's — failed. Confirmed platform-independent: a fresh no-fix analysis on macOS reproduced both findings at the identical positions before the fix.

Fix. The annotation moves back onto the &tls.Config{InsecureSkipVerify: true}, literal's own line at both sites, matching the existing convention elsewhere in the tree (e.g. pkg/modelmanager/peer/auth.go, pkg/utils/netx/dial.go). No behavior change — the documented self-signed/no-proxy rationale and the narrow suppression stay exactly as they were; no lint rule is disabled.

Verification. Full make lint (exact Go 1.27.3): exit 0, zero issues, all sub-gates green. A fresh no-fix full-tree analysis with the image build's exact flags: zero issues. Two complete make generate passes on a pristine canonical tree at the fix commit: all twelve generators ran, change ledger empty both times. The image build rerun on the pushed head is the authoritative confirmation on Linux.

This, together with the earlier comment on the webhook-regeneration reminder (no change required), covers every finding emitted on this PR so far: one review-run reminder and the two CI gosec findings. No inline threads exist to resolve.

[thxCode]

Review round 2 — response to the two gpustack-code-review summary items on 2bc13723:

1. pkg/worker/option.go (L257–L259, MutatingAdmissionPolicy disabled):
   • Intentional and already covered by a unit regression test in this PR (pkg/worker/option_test.go). k8s.io/apiserver@v0.36.5 newly registers and enables the built-in MutatingAdmissionPolicy admission plugin by default inside the aggregated GenericAPIServer. Just like ValidatingAdmissionPolicy (which was already disabled on main), leaving it enabled causes the extension apiserver's loopback informer factory to require admissionregistration.k8s.io/v1beta1 MutatingAdmissionPolicy / MutatingAdmissionPolicyBinding APIs on the hosting cluster and fail closed when the hosting cluster (1.23–1.35 or clusters without those beta APIs enabled) does not serve them. Disabling MutatingAdmissionPolicy alongside ValidatingAdmissionPolicy preserves the existing hosting-cluster compatibility contract.
2. pkg/worker/extensionapis/worker/instance_persistent_volume_type.go (L382, field.NewPath("spec.nfs")):
   • Pre-existing code on main that was only touched by mechanical gofmt/gofumpt line reflow from the golangci-lint upgrade in this PR (no semantic change in this PR). Keeping this dependency-upgrade PR scoped strictly to upgrade compatibility and mechanical formatting; the pre-existing validation field path can be addressed separately.