CNTRLPLANE-3895: Bump kubernetes dependencies to v1.36

[jubittajohn]

Bump kubernetes dependencies to v1.36.2

Summary by CodeRabbit

• Chores
  • Updated build and runtime container environments to align with the OpenShift 5.0 platform.
  • Upgraded the Go toolchain to version 1.26.
  • Refreshed Kubernetes/OpenShift and related Go dependencies (including telemetry and supporting libraries) for improved compatibility with the target platform.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign atiratree for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Walkthrough

The project updates its Go directive and dependencies to newer versions, then aligns CI and Docker images with Go 1.26 and OpenShift 5.0 while preserving the existing build commands and artifact wiring.

Changes

Toolchain and platform alignment

Layer / File(s)	Summary
Go toolchain and dependency refresh go.mod	The Go version changes to 1.26.0, direct OpenShift and Kubernetes dependencies are upgraded, and indirect modules are refreshed across OpenAPI, telemetry, protobuf, and auxiliary packages.
OpenShift 5.0 image alignment .ci-operator.yaml, Dockerfile	CI uses the Go 1.26/OpenShift 5.0 build root, while Docker switches builder and runtime images to OpenShift 5.0 and retains the existing build and artifact wiring.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: divyansh42, xueqzhan

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Container-Privileges	❌ Error	Dockerfile final stage still has no USER, so the image runs as root; manifests otherwise set non-root and drop privileges.	Add a non-root USER to the final image stage (and builder if needed), or document a justified exception.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only bumps deps/vendor files; no *_test.go changes and no Ginkgo DSL calls appear in modified files.
Test Structure And Quality	✅ Passed	No Ginkgo test files were changed; the PR only updates deps/vendor/build config, so the test-structure review is not applicable.
Microshift Test Compatibility	✅ Passed	PR changes only dependency/vendor files; no new Ginkgo e2e tests or test declarations were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only updates ci-operator, Dockerfile, and go.mod; no Ginkgo e2e tests or topology-sensitive test code were added.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR only bumps Go/Kubernetes deps and base images; no deployment manifests, controllers, or scheduling logic were added or modified.
Ote Binary Stdout Contract	✅ Passed	No repo-owned main/init/TestMain/BeforeSuite code writes to stdout; the OTE Ginkgo helper routes GinkgoWriter to stderr, and the PR only bumps deps/images.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the PR is dependency/vendor churn only and shows no IPv4 or external-network test code.
No-Weak-Crypto	✅ Passed	No weak-crypto APIs or secret comparisons were added; MD5/SHA1 only appear in generated OTel semconv comments and a denylist, not code.
No-Sensitive-Data-In-Logs	✅ Passed	PASS: the only new log call emits batch counts/dropped totals; no passwords, tokens, PII, hostnames, or customer data are logged.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: upgrading Kubernetes dependencies to v1.36.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Around line 91-97: Update the go.opentelemetry.io/otel/sdk dependency from
v1.40.0 to v1.43.0 or later to use the version containing the security fix. Keep
the related OpenTelemetry dependency versions consistent with the refreshed SDK
requirements and preserve the existing indirect dependency declarations.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

[coderabbitai]

Caution

Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted.

Error details

Validation Failed: {"resource":"IssueComment","code":"custom","field":"body","message":"body is too long (maximum is 65536 characters)"} - https://docs.github.com/rest/issues/comments#update-an-issue-comment

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Dockerfile`:
- Line 3: Replace the Dockerfile’s broad COPY . . instruction with explicit COPY
instructions for only the source, configuration, dependency, and build files
required by the image. Do not rely on .dockerignore as the primary fix; ensure
unrelated build-context files are never copied.
- Around line 1-7: Update both the builder and final stages of the Dockerfile to
declare a supported non-root USER. Create or select the non-root user before the
build in the builder stage and ensure
/go/src/github.com/openshift/cluster-openshift-controller-manager-operator
remains writable; configure the final stage with the same or an appropriate
non-root user so the resulting image does not run as root.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Run the image explicitly as non-root.

Neither stage declares USER, and Trivy reports that the resulting image runs as root. Add a supported non-root user to the builder and final stages, ensuring the build workspace remains writable. The deployment security context does not replace the image-level non-root requirement.

🧰 Tools

🪛 Trivy (0.72.0)

[error] 1-1: Image user should not be 'root'

Specify at least 1 USER command in Dockerfile with non-root user as argument

Rule: DS-0002

Learn more

(IaC/Dockerfile)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile` around lines 1 - 7, Update both the builder and final stages of
the Dockerfile to declare a supported non-root USER. Create or select the
non-root user before the build in the builder stage and ensure
/go/src/github.com/openshift/cluster-openshift-controller-manager-operator
remains writable; configure the final stage with the same or an appropriate
non-root user so the resulting image does not run as root.

Sources: Path instructions, Linters/SAST tools

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Avoid copying the entire build context.

Replace COPY . . with explicit copies of the required source and build files. A reviewed .dockerignore is useful as an additional safeguard, but does not satisfy the requirement to avoid copying the entire context.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile` at line 3, Replace the Dockerfile’s broad COPY . . instruction
with explicit COPY instructions for only the source, configuration, dependency,
and build files required by the image. Do not rely on .dockerignore as the
primary fix; ensure unrelated build-context files are never copied.

Source: Path instructions

[jubittajohn]

/retest

[openshift-ci]

@jubittajohn: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@jubittajohn: This pull request references CNTRLPLANE-3895 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Bump kubernetes dependencies to v1.36.2

Summary by CodeRabbit

• Chores
• Updated build and runtime container environments to align with the OpenShift 5.0 platform.
• Upgraded the Go toolchain to version 1.26.
• Refreshed Kubernetes/OpenShift and related Go dependencies (including telemetry and supporting libraries) for improved compatibility with the target platform.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.