fix: honor klog -stderrthreshold even when -logtostderr is true

[pierluigilenoci]

What changed

klog v2 defaults -logtostderr to true, which silently ignores -stderrthreshold — all log levels go to stderr unconditionally. This has been an open issue since 2020.

klog v2.140.0 introduced a fix behind an opt-in flag (legacy_stderr_threshold_behavior). This PR bumps klog to v2.140.0 and enables the fix in cmd/root.go so that -stderrthreshold is honored, while preserving the current default behavior (stderrthreshold=INFO means all logs still go to stderr unless the user explicitly overrides it on the command line).

Why this matters

In production Kubernetes clusters, log-aggregation systems (Fluentd, Fluent Bit, Loki, Datadog, …) typically ingest from container stderr. When every severity goes there indiscriminately:

• Log storage costs increase — INFO noise stored alongside real errors
• Alerting becomes unreliable — stderr contains everything, so severity-based alerts don't work
• Signal-to-noise ratio degrades — finding real errors in a stream of INFO is a needle-in-a-haystack problem

What the fix does

klog.InitFlags(&allFlags)
_ = allFlags.Set("legacy_stderr_threshold_behavior", "false") // enable the klog fix
_ = allFlags.Set("stderrthreshold", "INFO")                   // preserve current default

References

• Upstream issue: stderrthreshold not honored when logtostderr is set kubernetes/klog#212
• Upstream fix: feat: fix stderrthreshold not honored when logtostderr is set (#212) + two new flags kubernetes/klog#432

[CLAassistant]

All committers have signed the CLA.