[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/cobaltcore-dev/openstack-hypervisor-operator	v1.2.3 → v1.3.0
github.com/godbus/dbus/v5	v5.2.2 → v5.2.4
github.com/onsi/ginkgo/v2	v2.32.2 → v2.33.1
github.com/onsi/gomega	v1.43.0 → v1.44.0
k8s.io/api	v0.37.0 → v0.37.1
k8s.io/apimachinery	v0.37.0 → v0.37.1
k8s.io/client-go	v0.37.0 → v0.37.1
sigs.k8s.io/controller-runtime	v0.25.0 → v0.25.2

---

Release Notes

cobaltcore-dev/openstack-hypervisor-operator (github.com/cobaltcore-dev/openstack-hypervisor-operator)

v1.3.0: better eviction

Compare Source

v1.3.0

Parallel VM migrations while draining hypervisors, safe eviction completion, and hardened offboarding.

⚠️ Upgrade notes

• --agent-namespaces is now required. The operator refuses to start without it. It controls the namespaces searched for agent pods (nova-compute, neutron) during offboarding. Helm users are not affected (chart default: monsoon3); anyone deploying the image directly or with customized values must set controllerManager.manager.env.agentNamespaces (comma-separated).
• New optional chart values controllerManager.manager.env.evictionConcurrency (default "1") and evictionTraitConcurrency (default empty).

New features

Parallel VM migrations while draining a hypervisor (#​365)

Drains previously migrated VMs strictly one at a time; you can now run multiple live migrations in flight with a configurable limit:

• --eviction-concurrency — default maximum number of concurrent migrations (default 1, i.e. the previous serial behavior)
• --eviction-trait-concurrency — per-trait overrides, e.g. CUSTOM_HANA_EXCLUSIVE_HOST=1,CUSTOM_FOO=2; the lowest matching trait limit wins
• Helm chart exposes both as evictionConcurrency / evictionTraitConcurrency values (rendered as EVICTION_CONCURRENCY / EVICTION_TRAIT_CONCURRENCY env vars)

Eviction completes only after incoming migrations settle

A host could previously be declared evicted while Nova still had migrations in flight targeting it (Nova keeps instances associated with the source host while a live migration runs). The operator now queries Nova's /os-migrations and, before declaring a hypervisor evicted:

• aborts abortable incoming live-migrations (queued / preparing / running) aimed at the host
• waits for non-abortable ones (evacuations, post-migrating state)
• adds an IncomingMigrationsSettled condition to the Hypervisor CR (reasons Settled, AbortingIncomingMigrations, WaitingForIncomingMigrations); a failed Nova check blocks eviction and is visible in status instead of being silently ignored

Hardened offboarding

• The kvm.cloud.sap/offboarding NoExecute taint is applied only after all VMs are evicted (Evicting=False), so agent pods are no longer pushed off a node mid-migration
• Compute-service (Nova service entry) deletion is gated on a new AgentPodsEvicted condition on the Hypervisor CR — a running nova-compute pod would otherwise re-register the service immediately after deletion
• HA protection is kept until successfully onboarded hosts are drained; a successful onboarding is no longer overwritten during maintenance

Node termination detection via deletionTimestamp

Gardener is moving away from setting the legacy Terminating node condition toward simply deleting the Node. The Hypervisor Terminating condition — and MaintenanceTermination seeding at CR creation — now trigger on the legacy condition or node.deletionTimestamp.

Reliability & performance

• GOMEMLIMIT is set from the container memory limit so the Go GC respects the cgroup limit (prevents OOM kills)
• OpenStack provider clients are cached per auth context — the Keystone service catalog is deserialized once instead of once per controller
• Deployment/PodDisruptionBudget informers scoped to the maintenance objects in kube-system only (smaller cache footprint)
• The Gardener node-lifecycle signal pod now exits promptly on SIGTERM

Internals

• HypervisorMaintenanceController migrated to server-side apply for status updates and Eviction creation (new SSA condition helpers in internal/utils)
• Eviction controller extracted into its own internal/controller/eviction package
• Onboarding controller made testable (injectable clients, requeue interval); --version now works without the other runtime flags
• CRDs regenerated with controller-gen v0.22.0 (doc fixes only; no schema changes beyond the new conditions)

Dependencies & tooling

• Go 1.26 → 1.27; k8s.io/* 0.36 → 0.37.1; controller-runtime 0.24 → 0.25.2
• gophercloud v2.12 → v2.15.0; cert-manager v1.20 → v1.21; sapcc/go-api-declarations 1.22 → 1.25
• Security: OpenTelemetry → v1.45.0; ginkgo v2.33.1; actions/checkout v7; actions/stale v11

Full Changelog: cobaltcore-dev/openstack-hypervisor-operator@v1.2.3...v1.3.0

godbus/dbus (github.com/godbus/dbus/v5)

v5.2.4

Compare Source

What's Changed

• conn: return the system bus error on every OS by @​SashaMIT in #​448

New Contributors

• @​SashaMIT made their first contribution in #​448

Full Changelog: godbus/dbus@v5.2.3...v5.2.4

v5.2.3

Compare Source

What's Changed

• README: update by @​kolyshkin in #​431
• Switch from reflect.Ptr to reflect.Pointer by @​kolyshkin in #​430
• mediakeys.go example: Fix error handling. by @​smu-ggl in #​433
• Test/fix CI issues by @​guelfey in #​439
• Misc CI bumps; replace cirrus freebsd with GHA; add all-done job by @​kolyshkin in #​420
• make GOOS=js GOARCH=wasm go build ./... work by @​eliasnaur in #​435
• Do not swallow non-error panics in Encode/Decode by @​kolyshkin in #​438
• Fix panic in DecodeMessageWithFDs on read error by @​kolyshkin in #​437
• Do not embed reflect.Value into exportedMethod by @​kolyshkin in #​436
• Add godbus_no_tcp build tag to disable tcp transports by @​kolyshkin in #​444
• CI: bump golangci-lint to 2.14 by @​guelfey in #​447
• Do not trust lengths from the input when allocating by @​kolyshkin in #​442
• conn: support /run and /var/run default addresses by @​twilly in #​424

New Contributors

• @​smu-ggl made their first contribution in #​433
• @​eliasnaur made their first contribution in #​435
• @​twilly made their first contribution in #​424

Full Changelog: godbus/dbus@v5.2.2...v5.2.3

onsi/ginkgo (github.com/onsi/ginkgo/v2)

v2.33.1

Compare Source

Fixes

• Add several missing fields to spec report JSON output.

v2.33.0

Compare Source

Features

• The JUnit reporter now records each spec's ReportEntrys as <properties> on its <testcase> element, with the entry's name and its JSON-encoded value. Thanks @​pohly! [23db51a]

Maintenance

• Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. See RELEASING.md. [8616ecb]

onsi/gomega (github.com/onsi/gomega)

v1.44.0

Compare Source

Fixes

• BeNumerically compares signed and unsigned integers by value: -1 no longer equals uint64(math.MaxUint64) and uint(5) is now greater than -3 (#​925) [26e3c6b]
• BeNumerically("~") no longer overflows when computing the distance between extreme integers (#​928) [1955764]
• BeNumerically("==", x, threshold) now honors the threshold for floats, as it already did for integers (#​927) [10e2aca]
• HaveKeyWithValue succeeds if any key accepted by the key matcher has a matching value, rather than depending on map iteration order (#​929) [ffc577a]
• HaveKey and HaveKeyWithValue treat key and value matcher errors like ContainElement does: a match wins, and an error is only reported when nothing matches (#​926) [dc91598]
• MatchJSON no longer treats numbers too large for a float64 as equal to one another (#​930) [9d619a5]
• MatchJSON compares integers beyond ±2^53 exactly, so neighboring large integers (e.g. IDs) no longer match; all other numbers are still compared as float64s (#​931) [8ef1aa7, 630fe12]
• HaveExactElements reports missing or extra elements that start at index 0, and reports the first extra element's index rather than the last (#​934) [af1b777]
• MatchYAML compares every document in a multi-document stream rather than only the first; empty documents (e.g. a leading or trailing ---) are ignored (#​933) [2773796]
• MatchXML ignores namespace prefixes: elements and attributes are compared by namespace URI, and the URIs declared on each element must match whatever prefix they are bound to (#​932) [c0dbd89, 2565350]

v1.43.1

Compare Source

Maintenance

• Update go.yaml.in/yaml/v3 to v3.0.5 [d547015]
• Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. Releases still ship the stripped-down tree on master-lite - tests removed and Ginkgo dropped from go.mod - and the workflow now builds it and checks it on every push. See RELEASING.md. [e9dc84d]

kubernetes/api (k8s.io/api)

v0.37.1

Compare Source

kubernetes/apimachinery (k8s.io/apimachinery)

v0.37.1

Compare Source

kubernetes/client-go (k8s.io/client-go)

v0.37.1

Compare Source

kubernetes-sigs/controller-runtime (sigs.k8s.io/controller-runtime)

v0.25.2

Compare Source

What's Changed

• [release-0.25] 🐛 Fix SubResourceCreateOptions.ApplyToSubResourceCreate by @​k8s-infra-cherrypick-robot in #​3600
• [release-0.25] ✨ Add metrics handler options by @​k8s-infra-cherrypick-robot in #​3603
• [release-0.25] 📖 Document that ReadYourWrite doesn't work correctly with > 1 Namespace by @​k8s-infra-cherrypick-robot in #​3610
• [release-0.25] ✨ Add a metric for the readyourwite consistency wait duration by @​k8s-infra-cherrypick-robot in #​3613

Full Changelog: kubernetes-sigs/controller-runtime@v0.25.1...v0.25.2

v0.25.1

Compare Source

What's Changed

• 🐛 priorityqueue: fix data race on []*item in logState by @​k8s-infra-cherrypick-robot in #​3593
• 🐛 client: fix subresource create RV parse error under read-your-writes consistency by @​k8s-infra-cherrypick-robot in #​3596

Full Changelog: kubernetes-sigs/controller-runtime@v0.25.0...v0.25.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 8am on Friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 12 additional dependencies were updated

Details:

Package	Change
github.com/go-logr/logr	v1.4.3 -> v1.4.4
go.opentelemetry.io/otel	v1.44.0 -> v1.45.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace	v1.44.0 -> v1.45.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	v1.44.0 -> v1.45.0
go.opentelemetry.io/otel/metric	v1.44.0 -> v1.45.0
go.opentelemetry.io/otel/sdk	v1.44.0 -> v1.45.0
go.opentelemetry.io/otel/trace	v1.44.0 -> v1.45.0
go.opentelemetry.io/proto/otlp	v1.10.0 -> v1.11.0
google.golang.org/genproto/googleapis/api	v0.0.0-20260526163538-3dc84a4a5aaa -> v0.0.0-20260803160001-6ac0973c030d
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260610212136-7ab31c22f7ad -> v0.0.0-20260803160001-6ac0973c030d
k8s.io/streaming	v0.37.0 -> v0.37.1
k8s.io/utils	v0.0.0-20260626114624-be93311217bd -> v0.0.0-20260707023825-cf1189d6abe3