[github.com/gardener/gardener:v1.152.0]

📰 Noteworthy

• [DEVELOPER] e2e tests are now running with Kubernetes v1.36. by @ary1992 [#15358]
• [DEVELOPER] The local gardenadm development setup for the managed infrastructure scenario now uses GinK (Gardener-in-KinD). Refer to the updated documentation for details. by @ScheererJ [#15625]
• [DEPENDENCY] Provider extensions now must define MachineDeployment.PoolName or Gardener will through an error. Before the fix this value was not checked causing issues during manual worker pool rollout. by @matthias-horne [#15668]

✨ New Features

• [OPERATOR] Gardener can now support clusters with Kubernetes version 1.37. To allow creation/update of 1.37 clusters, you will have to update the version of your provider extension(s) to a version that supports 1.37 as well. Please consult the respective releases and notes in the provider extension's repository. by @shafeeqes [#15678]
• [OPERATOR] OperatingSystemConfig resources for worker pools and shoot control plane namespaces are now labeled with configured container runtime extension labels (containerruntime.worker.gardener.cloud/<type>=true), allowing extension webhooks to scope their admission via NamespaceSelector and ObjectSelector. by @jastBytes [#15591]
• [OPERATOR] Gardenlets can now be configured with .spec.deployment.chartsImageVectorOverwrite (mirrors the existing .spec.deployment.imageVectorOverwrite) and can be used to overwrite the repositories used for pulling packaged helm charts. by @shafeeqes [#15791]
• [OPERATOR] Gardener now deploys Seed and Garden Perses instances. The dashboard migration will follow later. by @rickardsjp [#15563]
• [USER] Remove vali pipeline from OpenTelemetry Collector if RemoveFali featuregate is enabled. by @iypetrov [#15714]
• [DEVELOPER] Gardener can now support clusters with Kubernetes version 1.37. Extension developers have to prepare individual extensions as well to work with 1.37. by @shafeeqes [#15678]

🐛 Bug Fixes

• [OPERATOR] Plutono dashboard sources reload after a configuration change by @TeodorDichev [#15717]
• [OPERATOR] Fixed a bug in the Progressing health check for Deployments managed by gardener-resource-manager: Pods belonging to an unrelated Deployment in the same namespace that happen to share the same selector labels are no longer counted, so a ManagedResource no longer gets stuck in Progressing state because of such Pods. by @pujitha24 [#15692]
• [OPERATOR] Fix systemd journal logs being silently dropped when vali.enabled=false and VictoriaLogsBackend=true by aligning GetDefaultClusterOutput with the other ClusterOutputs. by @TeodorDichev [#15562]
• [OPERATOR] Ignore hibernated clusters when checking UsesUnifiedHTTPProxyPort constraint on Shoots belonging to a Seed where the RemoveHTTPProxyLegacyPort feature gate is turned on by @jamand [#15709]
• [OPERATOR] The shoot maintenance controller now properly re-enqueues for immediate retry when encountering an optimistic locking conflict during the dry-run update check instead of prematurely marking the maintenance as failed. by @juandcsoler [#15756]
• [USER] gardener-node-agent no longer drops node conditions managed by other components (e.g., NetworkUnavailable set by the CNI plugin) when it updates the SystemdUnitsReady condition based on a stale cache. by @timebertt [#15767]
• [DEVELOPER] Disable Calico-Typha in local setups and e2e tests to resolve test flakes. by @LucaBernstein [#15662]
• [DEVELOPER] Fix an issue where the runtime extension instance incorrectly overwrote shoot cluster webhook configurations that were part of the controlplane extension resource when the seed is also garden. by @shafeeqes [#15729]

🏃 Others

• [OPERATOR] Migration of the global observability ingress secret ownership from the gardener-controller-manager to the gardener-operator has been removed. by @vicwicker [#15672]
• [OPERATOR] Pass GOTOOLCHAIN env var to all sub-shells in Makefile and hack/tools.mk to ensure all Go commands are executed with the same version. by @LucaBernstein [#15736]
• [OPERATOR] The GardenletConfiguration now defaults the SeedConfig when being decoded during gardenlet startup. by @moritzfalke [#15646]
• [OPERATOR] gardenadm init/gardenadm restore now approve all pending gardener-node-agent certificate signing requests instead of only the first one, and the approval step is idempotent on retries. by @ialidzhikov [#15657]
• [OPERATOR] Update versions of fluent-operator, fluent-bit and custom fluent-bit plugin. by @iypetrov [#15587]
• [USER] Shoots in failed state are now reconciled during the maintenance window if all of its conditions are healthy. by @acumino [#15706]
• [DEVELOPER] A new gardenadm restore disaster-recovery e2e test (ci-e2e-kind-gardenadm-unmanaged-infra-restore) is added for the unmanaged-infrastructure single-node control-plane scenario. by @Kostov6 [#15665]
• [DEPENDENCY] The following dependencies have been updated:
• quay.io/prometheus/alertmanager from v0.34.0 to v0.34.1. by @gardener-ci-robot [#15750]
• [DEPENDENCY] The following dependencies have been updated:
• credativ/vali from v2.2.36 to v2.2.37. Release Notes by @gardener-ci-robot [#15713]
• [DEPENDENCY] The following dependencies have been updated:
• gardener/dashboard from 1.85.0 to 1.85.1. Release Notes by @gardener-ci-robot [#15765]
• [DEPENDENCY] The following dependencies have been updated:
• gcr.io/istio-release/pilot from 1.29.7 to 1.29.8.
• gcr.io/istio-release/proxyv2 from 1.29.7 to 1.29.8.
• istio.io/api from v1.29.7 to v1.29.8. by @gardener-ci-robot [#15775]
• [DEPENDENCY] The following dependencies have been updated:
• fluent/fluent-operator from v3.10.0 to v3.10.1. Release Notes by @gardener-ci-robot [#15773]
• [DEPENDENCY] The following dependencies have been updated:
• credativ/plutono from v7.5.50 to v7.5.51. Release Notes by @gardener-ci-robot [#15712]

Helm Charts

• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.152.0
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.152.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.152.0

Container (OCI) Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.152.0
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.152.0
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.152.0
• gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.152.0
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.152.0
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.152.0
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.152.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.152.0
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.152.0