build(deps): bump the k8s-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the k8s-dependencies group with 1 update in the / directory: k8s.io/apimachinery.

Updates k8s.io/apimachinery from 0.35.1 to 0.36.3

Commits

• 40bf4b2 Update dependencies to v0.36.3 tag
• 34d46be Merge pull request #140296 from jpbetz/cherry-pick-smd-306-revert
• 66a3724 Bump sigs.k8s.io/structured-merge-diff/v6 to v6.3.3
• 2ec982d Merge pull request #139508lalitc375/automated-cherry-pick-of-#139480
• 6a88102 Fix wrong marking of errors
• efb7f26 Merge remote-tracking branch 'origin/master' into release-1.36
• d966e56 Update github.com/moby/spdystream from v0.5.0 to v0.5.1
• 79b3632 Merge pull request #137864 from yongruilin/dv-dra-mismatch
• a8822f7 Add slice and map union member support with tests
• 7dba2d0 Use IsZero instead of IsNil for union ratcheting check
• Additional commits viewable in compare view

Updates k8s.io/klog/v2 from 2.130.1 to 2.140.0

Release notes

Sourced from k8s.io/klog/v2's releases.

Prepare klog release for Kubernetes v1.36

What's Changed

• Add dependabot by @​lucacome in kubernetes/klog#410
• Use strconv.AppendQuote instead of strconv.Quote for message formatting by @​astef in kubernetes/klog#413
• de-duplication of key/value pairs by @​pohly in kubernetes/klog#415
• Fix: Ensure constant format strings in fmt and printf calls by @​mikelolasagasti in kubernetes/klog#417
• Remove old note on Go version requirements by @​guettli in kubernetes/klog#425
• test with 1.24 and 1.25 by @​pohly in kubernetes/klog#428
• ktesting: fix vmodule support by @​pohly in kubernetes/klog#431
• ktesting: support multi-line result from AnyToStringHook by @​pohly in kubernetes/klog#433
• textlogger: optionally turn off header by @​pohly in kubernetes/klog#430
• feat: fix stderrthreshold not honored when logtostderr is set (#212) + two new flags by @​pierluigilenoci in kubernetes/klog#432

New Contributors

• @​lucacome made their first contribution in kubernetes/klog#410
• @​astef made their first contribution in kubernetes/klog#413
• @​mikelolasagasti made their first contribution in kubernetes/klog#417
• @​guettli made their first contribution in kubernetes/klog#425
• @​pierluigilenoci made their first contribution in kubernetes/klog#432

Full Changelog: kubernetes/klog@v2.130.1...v2.140.0

Commits

• ef4b370 Merge pull request #432 from pierluigilenoci/fix/stderr-threshold-issue-212
• 39c4c76 refactor: address code review feedback from @​pohly
• 764a9a3 Merge pull request #430 from pohly/textlogger-optional-header
• 015c613 Update stderr_threshold_test.go
• 2f517bd Update klog.go
• 36bc4ff textlogger: optionally turn off header
• 5f1f303 Merge pull request #433 from pohly/textlogger-hook-result
• c469d41 Merge pull request #431 from pohly/ktesting-vmodule-fix
• 8509d6a ktesting: support multi-line result from AnyToStringHook
• 08e6e8b Fix stderrthreshold not honored when logtostderr is set
• Additional commits viewable in compare view

Updates k8s.io/utils from 0.0.0-20260108192941-914a6e750570 to 0.0.0-20260210185600-b8788abfbbc2

Commits

• See full diff in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR updates the Go module dependencies for the HyperShift project. The Go toolchain requirement is bumped from 1.25.7 to 1.26.0. Kubernetes-related direct dependencies including k8s.io/apimachinery, k8s.io/klog/v2, and k8s.io/utils are refreshed with newer versions. Indirect dependencies are adjusted: the unused github.com/mxk/go-flowrate package is removed, google.golang.org/protobuf is bumped to a newer pseudo-version, and several Kubernetes indirect module versions including k8s.io/kube-openapi and k8s.io/streaming are updated.

Suggested reviewers

• jparrill

🚥 Pre-merge checks | ✅ 10 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Ipv6 And Disconnected Network Test Compatibility	⚠️ Warning	New Ginkgo e2e tests contain IPv4 assumptions (hardcoded 127.0.0.1 and 192.168.x.x) and external registry references incompatible with IPv6-only disconnected CI environments.	Update tests to use IPv6 addresses (::1) where applicable, avoid hardcoding localhost, and use internal/mirrored registries. See custom check for detailed guidance on using GetIPAddressFamily() and correctCIDRFamily() helpers.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only modifies go.mod/go.sum; no test files are changed, so check for stable Ginkgo test names is not applicable.
Test Structure And Quality	✅ Passed	PR contains only Go dependency updates (go.mod/go.sum changes); no Ginkgo test code modifications present, making the check not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PR only updates Go module dependencies (go.mod/go.sum) with no changes to deployment manifests, operator code, or controllers. No scheduling constraints introduced.
No-Weak-Crypto	✅ Passed	PR only updates k8s dependencies in go.mod; no new weak crypto code (MD5, SHA1, DES, RC4, etc.) introduced. Pre-existing weak crypto usage in codebase is unrelated to this PR.
Container-Privileges	✅ Passed	PR only updates Go module dependencies in go.mod; no container/K8s manifests or security-related configurations were modified, making this check inapplicable.
No-Sensitive-Data-In-Logs	✅ Passed	No sensitive data (passwords, tokens, API keys, PII, credentials) is exposed in logs. Logging statements reference secret metadata only, with actual data explicitly redacted via JSONPatchSecretNoEr...
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the primary change: three Kubernetes dependency updates in the repository.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/go_modules/k8s-dependencies-5db5cf7de5

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign jparrill for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

rebase

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Line 3: go.mod declares "go 1.26.0" while the workspace file declares 1.25.7,
causing a toolchain mismatch; open the workspace file and update its "go"
directive to 1.26.0 so the workspace toolchain matches go.mod (ensure the
workspace file's go directive exactly matches the module go directive).
- Line 105: go.mod currently mixes k8s.io versions (k8s.io/apimachinery at
v0.36.1 while k8s.io/api, k8s.io/client-go, k8s.io/apiserver,
k8s.io/apiextensions-apiserver, and indirect k8s.io/streaming are v0.35.1),
causing version skew; pick one consistent minor (preferably upgrade all k8s.io/*
entries to v0.36.1) or revert apimachinery to v0.35.1, then update the go.mod
entries for k8s.io/apimachinery, k8s.io/api, k8s.io/client-go, k8s.io/apiserver,
k8s.io/apiextensions-apiserver and any indirect k8s.io/streaming references
accordingly and run go get/<tooling> and go mod tidy to ensure the module graph
is consistent and builds cleanly; if you intentionally keep the skew, add a PR
justification and CI/build evidence proving compatibility.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 501d0806-dee5-4c95-83a9-b068d1207b84

📥 Commits

Reviewing files that changed from the base of the PR and between fe3a8aa and 91369a7.

⛔ Files ignored due to path filters (88)

• go.sum is excluded by !**/*.sum
• vendor/github.com/mxk/go-flowrate/LICENSE is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/mxk/go-flowrate/flowrate/flowrate.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/mxk/go-flowrate/flowrate/io.go is excluded by !vendor/**, !**/vendor/**
• vendor/github.com/mxk/go-flowrate/flowrate/util.go is excluded by !vendor/**, !**/vendor/**
• vendor/google.golang.org/protobuf/encoding/protodelim/protodelim.go is excluded by !vendor/**, !**/vendor/**
• vendor/google.golang.org/protobuf/encoding/protojson/decode.go is excluded by !vendor/**, !**/vendor/**
• vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go is excluded by !vendor/**, !**/vendor/**
• vendor/google.golang.org/protobuf/encoding/prototext/decode.go is excluded by !vendor/**, !**/vendor/**
• vendor/google.golang.org/protobuf/internal/descfmt/stringer.go is excluded by !vendor/**, !**/vendor/**
• vendor/google.golang.org/protobuf/internal/version/version.go is excluded by !vendor/**, !**/vendor/**
• vendor/google.golang.org/protobuf/reflect/protodesc/desc_init.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/api/equality/semantic.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/api/resource/generated.protomessage.pb.go is excluded by !**/*.pb.go, !vendor/**, !**/vendor/**, !**/*.pb.go
• vendor/k8s.io/apimachinery/pkg/api/validate/content/errors.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/api/validate/content/path.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/api/validate/discriminator.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/api/validate/limits.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/api/validate/strfmt.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/api/validate/union.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/api/validation/path/name.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/apis/meta/internalversion/conversion.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/apis/meta/internalversion/types.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/apis/meta/internalversion/zz_generated.conversion.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• vendor/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_byte.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_string.go is excluded by !vendor/**, !**/vendor/**, !**/*_string.go
• vendor/k8s.io/apimachinery/pkg/apis/meta/v1/generated.pb.go is excluded by !**/*.pb.go, !vendor/**, !**/vendor/**, !**/*.pb.go
• vendor/k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto is excluded by !vendor/**, !**/vendor/**, !**/generated.proto
• vendor/k8s.io/apimachinery/pkg/apis/meta/v1/generated.protomessage.pb.go is excluded by !**/*.pb.go, !vendor/**, !**/vendor/**, !**/*.pb.go
• vendor/k8s.io/apimachinery/pkg/apis/meta/v1/helpers.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/apis/meta/v1/meta.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_fuzz.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/apis/meta/v1/time_fuzz.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/apis/meta/v1/types.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/apis/meta/v1/types_swagger_doc_generated.go is excluded by !vendor/**, !**/vendor/**, !**/types_swagger_doc_generated.go
• vendor/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.conversion.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• vendor/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.deepcopy.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• vendor/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.model_name.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*.go, !**/zz_generated*
• vendor/k8s.io/apimachinery/pkg/apis/meta/v1beta1/generated.protomessage.pb.go is excluded by !**/*.pb.go, !vendor/**, !**/vendor/**, !**/*.pb.go
• vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/decode.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/raw.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/diff/cmp.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/diff/diff.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/diff/legacy_diff.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/dump/dump.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/httpstream/doc.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/httpstream/spdy/doc.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/httpstream/spdy/spdy.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/httpstream/wsstream/doc.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/httpstream/wsstream/wsstream.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/intstr/instr_fuzz.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/managedfields/extract.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/fields.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/mergepatch/util.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/net/http.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/net/interface.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/proxy/dial.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/proxy/transport.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/proxy/upgradeaware.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/runtime/runtime.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/strategicpatch/patch.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/validation/field/error_matcher.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/validation/field/errors.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/pkg/util/validation/ip.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/third_party/forked/golang/netutil/addr.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/apimachinery/third_party/forked/golang/reflect/deep_equal.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/klog/v2/README.md is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/klog/v2/internal/serialize/keyvalues.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/klog/v2/internal/serialize/keyvalues_no_slog.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/klog/v2/internal/serialize/keyvalues_slog.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/klog/v2/klog.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/klog/v2/klogr.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/klog/v2/klogr_slog.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/klog/v2/textlogger/options.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/klog/v2/textlogger/textlogger.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/streaming/LICENSE is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/streaming/pkg/httpstream/doc.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/streaming/pkg/httpstream/httpstream.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/streaming/pkg/httpstream/spdy/connection.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/streaming/pkg/httpstream/spdy/roundtripper.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/streaming/pkg/httpstream/spdy/upgrade.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/streaming/pkg/httpstream/wsstream/conn.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/streaming/pkg/httpstream/wsstream/doc.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/streaming/pkg/httpstream/wsstream/stream.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/streaming/pkg/runtime/runtime.go is excluded by !vendor/**, !**/vendor/**
• vendor/k8s.io/utils/dump/dump.go is excluded by !vendor/**, !**/vendor/**
• vendor/modules.txt is excluded by !vendor/**, !**/vendor/**

📒 Files selected for processing (1)

• go.mod

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Show relevant files and line numbers
echo "=== go.mod (lines 1-20) ==="
sed -n '1,20p' go.mod | cat -n

echo "=== hack/workspace/go.work (lines 1-40) ==="
sed -n '1,40p' hack/workspace/go.work | cat -n

# Find where go-version-file is used in CI configs (prow/GHA)
echo "=== Search for go-version-file usage ==="
rg -n --hidden --glob '!**/vendor/**' "go-version-file" . || true

echo "=== Search for 'go-version' / 'GoVersion' configs mentioning go.mod ==="
rg -n --hidden --glob '!**/vendor/**' "(go-version-file|go-version|GoVersion)" hack .github .prow . || true

Repository: openshift/hypershift

Length of output: 3176

---

Fix Go toolchain mismatch between go.mod and hack/workspace/go.work

go.mod sets go 1.26.0 (line 3) while hack/workspace/go.work sets go 1.25.7 (line 1). CI builds use go-version-file: go.mod, so CI will use 1.26.0, but local workspace-mode builds will use 1.25.7, creating inconsistent behavior.

Action: update hack/workspace/go.work to go 1.26.0 to match go.mod.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 3, go.mod declares "go 1.26.0" while the workspace file
declares 1.25.7, causing a toolchain mismatch; open the workspace file and
update its "go" directive to 1.26.0 so the workspace toolchain matches go.mod
(ensure the workspace file's go directive exactly matches the module go
directive).

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== go.mod: locate k8s.io/apimachinery and k8s.io peer modules =="
rg -n "k8s\.io/(apimachinery|api|client-go|apiserver|apiextensions-apiserver|cli-runtime|component-base|klog|klog/v2|utils)" go.mod || true

echo
echo "== go.mod: show k8s.io entries around the asserted line =="
# Show a small window around the reported line 105
sed -n '90,130p' go.mod

echo
echo "== go.mod: any replace directives for k8s.io =="
rg -n "^replace\s+k8s\.io/" go.mod || true

echo
echo "== go.mod: list all direct dependencies matching k8s.io/* (including versions and indirect flags) =="
# Direct require lines only (not replace). This is best-effort: go.mod format varies.
awk '
/^\s*require\s*\(/ {inreq=1; next}
inreq && /^\s*\)/ {inreq=0}
inreq {print}
' go.mod | rg -n "k8s\.io/" || true

Repository: openshift/hypershift

Length of output: 3979

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== all k8s.io/* entries at v0.36.x in go.mod =="
rg -n "^\s*k8s\.io/[^ ]+\s+v0\.36\.[0-9]+" go.mod || true

echo
echo "== any k8s.io/* entries at v0.35.x in go.mod (direct) =="
rg -n "^\s*k8s\.io/[^ ]+\s+v0\.35\.[0-9]+" go.mod || true

echo
echo "== any replace directives at all in go.mod (context check) =="
rg -n "^replace\s" go.mod || true

Repository: openshift/hypershift

Length of output: 1366

---

Fix Kubernetes dependency version skew in go.mod

go.mod pins most k8s.io/* modules to v0.35.1, but bumps k8s.io/apimachinery to v0.36.1 (and k8s.io/streaming to v0.36.1):

• k8s.io/apimachinery: v0.36.1 (line 105)
• k8s.io/api, k8s.io/client-go, k8s.io/apiserver, k8s.io/apiextensions-apiserver, etc.: v0.35.1
• k8s.io/streaming: v0.36.1 (indirect, line 305)
• No replace k8s.io/* directives are present to explain this split

Kubernetes client/library packages are intended to be used together at compatible minor versions; mixing minors can lead to type/schema/serialization mismatches and resulting build/runtime issues.

Action: Either bump the full k8s.io/* dependency set to v0.36.1 consistently, or add explicit justification in the PR plus evidence (tests/build) that this skew is safe.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 105, go.mod currently mixes k8s.io versions
(k8s.io/apimachinery at v0.36.1 while k8s.io/api, k8s.io/client-go,
k8s.io/apiserver, k8s.io/apiextensions-apiserver, and indirect k8s.io/streaming
are v0.35.1), causing version skew; pick one consistent minor (preferably
upgrade all k8s.io/* entries to v0.36.1) or revert apimachinery to v0.35.1, then
update the go.mod entries for k8s.io/apimachinery, k8s.io/api, k8s.io/client-go,
k8s.io/apiserver, k8s.io/apiextensions-apiserver and any indirect
k8s.io/streaming references accordingly and run go get/<tooling> and go mod tidy
to ensure the module graph is consistent and builds cleanly; if you
intentionally keep the skew, add a PR justification and CI/build evidence
proving compatibility.

[openshift-ci]

rebase

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[hypershift-jira-solve-ci]

All three Konflux jobs failed at the build-images step — consistent with the same Go version / compilation failure. Now I have the complete picture across all 8 failed jobs. Let me produce the final report.

Test Failure Analysis Complete

Job Information

• PR: openshift/hypershift#8677 — build(deps): bump the k8s-dependencies group across 1 directory with 3 updates
• Author: dependabot[bot]
• Failed Jobs: 8 total (4 Prow, 1 GitHub Actions, 3 Red Hat Konflux)
• Root Cause Category: Go toolchain version mismatch + incomplete multi-module dependency update

Job	Build ID / Run	Failure Mode
ci/prow/verify-deps	2075385902841991168	go.mod requires go >= 1.26.0 (running go 1.25.8; GOTOOLCHAIN=local)
ci/prow/images	2075385900753227776	go.mod requires go >= 1.26.0 (running go 1.25.8; GOTOOLCHAIN=local)
ci/prow/okd-scos-images	2075385900782587904	go.mod requires go >= 1.26.0 (running go 1.25.8; GOTOOLCHAIN=local)
ci/prow/security	2075385901160075264	Pod scheduling timeout (CI infra issue, unrelated)
verify / Verify	GHA run 29061543883	inconsistent vendoring in api/ — submodule not updated
Konflux / hypershift-operator-main	check 86264281246	build-images failed (Go version / compilation)
Konflux / hypershift-release-mce-50	check 86264281251	build-images failed (Go version / compilation)
Konflux / hypershift-cli-mce-50	check 86264281238	build-images failed (Go version / compilation)

Test Failure Analysis

Error

go: go.mod requires go >= 1.26.0 (running go 1.25.8; GOTOOLCHAIN=local)

go: inconsistent vendoring in /home/runner/_work/hypershift/hypershift/api:
    k8s.io/apimachinery@v0.36.2: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
    k8s.io/apimachinery@v0.35.1: is marked as explicit in vendor/modules.txt, but not explicitly required in go.mod

Summary

This dependabot PR bumped k8s.io/apimachinery from v0.35.1 to v0.36.2, which pulled in a transitive requirement for Go 1.26.0. This caused two distinct failure modes across all CI systems: (1) The Go minimum version in go.mod was raised to go 1.26.0, but all CI builder images (Prow's rhel-9-release-golang-1.25-openshift-4.23, OKD's rhel-9-golang-1.25-openshift-5.0, and Konflux builders) only provide Go 1.25.8 with GOTOOLCHAIN=local set, causing immediate compilation refusal. (2) The api/ submodule (which has its own go.mod and vendor/ directory) was not updated by dependabot, creating an inconsistent vendoring state where the root module references v0.36.2 but api/vendor/modules.txt still references v0.35.1. The ci/prow/security failure is unrelated — it was a CI infrastructure pod scheduling timeout.

Root Cause

The root cause is a problematic dependency version skew introduced by dependabot's automated PR:

1. Go 1.26.0 requirement: k8s.io/apimachinery v0.36.2 requires go >= 1.26.0. When dependabot ran go mod tidy, this propagated into the root go.mod directive (go 1.25.8 → go 1.26.0). However, all CI builder images across Prow, OKD, and Konflux only ship Go 1.25.8. The GOTOOLCHAIN=local environment variable prevents Go from auto-downloading a newer toolchain, so every go build, go test, and go mod tidy command fails immediately.

2. k8s.io version skew: The PR bumped only k8s.io/apimachinery to v0.36.2 while all other k8s.io dependencies remain at v0.35.1 (k8s.io/api, k8s.io/client-go, k8s.io/apiserver, k8s.io/apiextensions-apiserver, etc.). Kubernetes client libraries are designed to be used at the same minor version. Mixing v0.36.x with v0.35.x is unsupported and will likely cause type incompatibilities even if compilation succeeded.

3. Incomplete multi-module update: The openshift/hypershift repository contains a separate Go module at api/go.mod which independently depends on k8s.io/apimachinery v0.35.1. Dependabot only updated the root module's go.mod and vendor/, leaving api/go.mod and api/vendor/ untouched. This creates an inconsistent vendoring state caught by the verify / Verify GitHub Action (controller-gen cannot load the api/ packages).

4. ci/prow/security failed due to an unrelated CI infrastructure issue — the pod could not be scheduled for 30 minutes due to insufficient cluster capacity (node affinity/selector, taints, anti-affinity). This is a transient infra problem.

Recommendations

1. Close this PR — This dependabot PR cannot merge as-is. Bumping k8s.io/apimachinery alone to v0.36.2 while keeping all other k8s.io/* at v0.35.1 is not a valid configuration. Kubernetes client modules must be updated together at the same minor version.

2. If upgrading to k8s v0.36.x is desired, it must be done as a coordinated manual effort:

   • Bump all k8s.io/* dependencies together to v0.36.2 (api, client-go, apiserver, apiextensions-apiserver, component-base, etc.)
   • Update both go.mod (root) and api/go.mod (submodule) simultaneously
   • Run go mod tidy and go mod vendor in both modules
   • Ensure CI builder images support Go 1.26.0, or coordinate with the CI/build team to update the builder images first
   • Also update k8s.io/klog/v2, k8s.io/kube-openapi, k8s.io/utils as needed for compatibility

3. If staying on k8s v0.35.x, configure dependabot to exclude k8s.io/apimachinery from the k8s-dependencies group, or pin the allowed version range to 0.35.x in .github/dependabot.yml.

4. For ci/prow/security: Simply re-trigger (/retest ci/prow/security) — this was a transient pod scheduling failure unrelated to the code change.

Evidence

Evidence	Detail
go.mod version change	go 1.25.8 → go 1.26.0 (forced by k8s.io/apimachinery v0.36.2)
CI Go version	Go 1.25.8 (rhel-9-release-golang-1.25-openshift-4.23) with GOTOOLCHAIN=local
Prow verify-deps error	go: go.mod requires go >= 1.26.0 (running go 1.25.8; GOTOOLCHAIN=local) on go mod tidy
Prow images error	Same Go version error on make control-plane-operator (Makefile:217), make reqserving-e2e (Makefile:487), make hypershift (Makefile:225)
Prow okd-scos-images error	Same Go version error using OKD builder rhel-9-golang-1.25-openshift-5.0
Prow security error	Pod scheduling timeout — 0/49 nodes available for 30 minutes (CI infra, not code)
GHA verify error	inconsistent vendoring in api/: k8s.io/apimachinery@v0.36.2 in go.mod but v0.35.1 in api/vendor/modules.txt
Konflux errors	All 3 Konflux pipelines failed at build-images step (same Go compilation failure)
k8s.io version skew	k8s.io/apimachinery bumped to v0.36.2; all other k8s.io deps remain at v0.35.1
api/ submodule not updated	api/go.mod still has k8s.io/apimachinery v0.35.1 — dependabot did not update the submodule
Dependency changes	k8s.io/apimachinery v0.35.1→v0.36.2, k8s.io/klog/v2 v2.130.1→v2.140.0, k8s.io/utils updated, k8s.io/streaming v0.36.2 added, google.golang.org/protobuf updated

---

[openshift-ci]

@dependabot[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/okd-scos-images	06133cd	link	true	/test okd-scos-images
ci/prow/verify-deps	06133cd	link	true	/test verify-deps
ci/prow/images	06133cd	link	true	/test images

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci]

rebase

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.