Skip to content

Update dependency kubernetes-sigs/kubebuilder to v4.16.0 - #256

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/kubernetes-sigs-kubebuilder-4.x
Open

Update dependency kubernetes-sigs/kubebuilder to v4.16.0#256
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/kubernetes-sigs-kubebuilder-4.x

Conversation

@renovate

@renovate renovate Bot commented Jan 21, 2026 •
edited
Loading

Copy link
Copy Markdown

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
kubernetes-sigs/kubebuilder minor v4.10.1 → v4.16.0

Release Notes

kubernetes-sigs/kubebuilder (kubernetes-sigs/kubebuilder)

v4.16.0

Compare Source

🚀 Automation to Upgrade your Project

The migration guide covers upgrading from any supported version to the latest release.

For the smoothest upgrade path, use the AutoUpdate Plugin or run kubebuilder alpha update. Both use the same update logic: they regenerate your project from scratch, reapply your changes, and bring in everything listed below. Your PROJECT file needs cliVersion for this to work.

Other upgrade options are mainly intended for older projects that do not yet have cliVersion in their PROJECT file. These are the paths in the migration guide: follow the AI instructions, or make the changes by hand, to re-scaffold your project with the latest version and put your own changes back on top. Use them as a one-time step to reach a supported version, then continue using these update workflows.

❗Recommended Scaffold Fixes to Apply

These are not breaking changes but are significant bug fixes. If you upgrade with alpha update or the AutoUpdate Plugin, you get them automatically. Apply them by hand only if you update your project manually.

Fix the default webhook names to align with the controller-runtime interfaces

Applies to projects with webhooks. The generated webhook structs were renamed. #​5877

<Kind>CustomDefaulter is now <Kind>Defaulter, and <Kind>CustomValidator is now <Kind>Validator.

To apply this by hand, open internal/webhook/<version>/<kind>_webhook.go and rename both types. Then update three more places: the method receivers, the WithDefaulter and WithValidator calls in Setup<Kind>WebhookWithManager, and <kind>_webhook_test.go.

For example, the sample: captain_webhook.go and captain_webhook_test.go.

If you skip it: nothing breaks. Your code still compiles and runs. But the next webhook you add with create webhook uses the new names, so one project ends up with both <Kind>CustomValidator and <Kind>Validator.

Fix the envtest suite teardown

Applies to every project with an API or a webhook. AfterSuite no longer retries testEnv.Stop(). #​5838

The teardown used to run inside Eventually, which kept retrying after a SIGKILL. That hid real shutdown failures. Kubebuilder now checks the result once.

To apply this by hand, replace the AfterSuite body in suite_test.go and webhook_suite_test.go with:

     err := testEnv.Stop()
     Expect(err).NotTo(HaveOccurred())

Suites that passed before may now fail. The failure was always there. The retry only hid it.

For example, the sample: suite_test.go and webhook_suite_test.go. To learn more, see Configuring envtest.

If you skip it: your tests keep passing, and that is the problem. A failing testEnv.Stop() is retried away instead of reported, so a control plane that did not shut down leaves kube-apiserver and etcd processes behind without telling you.

Fix the webhook NetworkPolicy

Applies to every project. It matters most if you uncommented - ../network-policy in config/default/kustomization.yaml. The webhook NetworkPolicy was fixed. #​5905

The old policy allowed traffic on port 443, and only from namespaces labeled webhook: enabled. Two things were wrong with that. Port 443 is the Service port, not the port the manager listens on. And the API server does not run in a labeled namespace. So turning the policy on blocked every webhook call.

To apply this by hand, replace the ingress block in config/network-policy/allow-webhook-traffic.yaml with:

   ingress:
     - ports:
         - port: 9443
           protocol: TCP

If you set --webhook-port, use your own port instead of 9443. You can also remove the webhook: enabled label from your namespaces, because nothing uses it now.

To limit which namespaces a webhook applies to, use namespaceSelector instead. This release ships controller-tools v0.22.0, which adds a patch option to the webhook marker, so you can set the selector in your code (controller-tools#1339):

// +kubebuilder:webhook:path=/mutate-v1-pod,mutating=true,...,patch=`{"namespaceSelector":{"matchLabels":{"webhook-enabled":"true"}}}`

Run make manifests to regenerate your MutatingWebhookConfiguration and ValidatingWebhookConfiguration.

For example, the sample: allow-webhook-traffic.yaml.

If you skip it: on a cluster whose CNI does not enforce NetworkPolicy, nothing changes. On one that does, such as Calico or Cilium, enabling the policy blocks webhook traffic: the rule allows pod port 443, but the manager listens on 9443. Either way, the webhook: enabled label gave a false sense of protection. NetworkPolicy cannot decide which namespaces a webhook applies to — only namespaceSelector in the webhook configuration can.

What's Changed

⚠️ Breaking Changes

Only for projects using the AutoUpdate plugin (autoupdate/v1-alpha)

GitHub Models support has been removed. #​5777

Update the plugin and review the changes:

kubebuilder edit --plugins=autoupdate/v1-alpha --force

For example, the sample: auto_update.yml.

Only for projects using the Helm plugin (helm/v2-alpha)

Two chart values are now required. Without them, your chart fails to render.

Upgrade your project using alpha update or alternatively, regenerate the chart with:

kubebuilder edit --plugins=helm/v2-alpha --force

New values are not added automatically. Add them manually by comparing your chart with the v4.16.0 sample values file.

Three changes need your attention:

  • manager.healthProbe.port is new, and the chart has no default for it. If you do not add it, the chart fails to render with nil pointer evaluating interface {}.port. Add it under manager: #​5866, #​5888
   manager:
     healthProbe:
       port: 8081
  • serviceAccount.name is now required when you set serviceAccount.enabled: false. Before, the chart rendered and pointed at a ServiceAccount that did not exist. Now it fails instead. Set a name, or use name: default to use the namespace default ServiceAccount. #​5833
  • Helm now runs the values in manager.args through the tpl function. If an argument contains {{ }}, Helm evaluates it as a template. Before, it passed the argument through as plain text. #​5927

For example, the sample: values.yaml, manager.yaml, and _helpers.tpl.

Only for projects with webhooks under api/<version>/

The deprecated --legacy flag has been removed. Projects already using internal/webhook/<version>/ are not affected. #​5837

Move your webhooks from api/<version>/ to internal/webhook/<version>/ and update them to use interfaces compatible with controller-runtime v0.20.0 and later. Follow the migration guide with AI instructions.

For example, the sample: internal/webhook/v1/. For more context, see the Kubebuilder v4.3.0 release notes, where the --legacy flag was introduced to help users migrate from controller-runtime deprecations.

✨ Upgrades

✨ New Features

  • (go/v4) Add alpha Server-Side Apply scaffolding with create api --ssa. See Server-Side Apply (#​5458, #​5829, #​5840, #​5939, #​6024)
  • (go/v4) Let you change the base image used to build the manager with the BASE_IMAGE build argument (#​5915)
  • (go/v4, API) Check the path of an external API sooner, reject a path that is only a domain, and show a clearer error when the path is wrong (#​5766, #​5903)
  • (go/v4) Set webhook configuration fields such as namespaceSelector and objectSelector directly from the +kubebuilder:webhook: marker, using the new patch option that comes with controller-tools v0.22.0 (controller-tools#1339)
  • (CLI) Show the plugin prefix in the CLI help only when it is needed, so the help is easier to read (#​5843)
  • (helm/v2-alpha) Let you set the manager health probe port with manager.healthProbe.port (#​5866, #​5888) — see Breaking Changes
  • (go/v4, helm/v2-alpha) Let you set a custom webhook port, and keep the manager and the Helm chart using the same value (#​5868, #​5884, #​5896)
  • (helm/v2-alpha) Let you use Helm templates in manager.args values (#​5927) — see Breaking Changes
  • (helm/v2-alpha) Let you add your own labels and annotations to the ServiceMonitor. See Metrics (#​5994)
  • (helm/v2-alpha, go/v4) add support for stop the webhook server when webhook.enabled=false (#​6031,6034)

🐛 Bug Fixes

  • (go/v4) Rename the generated webhook types from <Kind>CustomDefaulter and <Kind>CustomValidator to <Kind>Defaulter and <Kind>Validator, and correct the comments that name the interfaces they implement (#​5877) — see Recommended Scaffold Fixes
  • (go/v4) Use the Go 1.26 new(expr) syntax in generated code instead of k8s.io/utils/ptr, and stop turning off the newexpr check in the generated .golangci.yml (#​5775)
  • (go/v4) Report envtest shutdown failures instead of hiding them behind retries (#​5838) — see Recommended Scaffold Fixes
  • (go/v4) Find the right resource when you run create webhook for an external API. Kubebuilder now reuses the configuration already recorded in PROJECT, matches on Group, Version and Kind because the caller does not know the domain, and lets you pick with --external-api-domain when more than one recorded resource matches (#​5792, #​5917, #​5932)
  • (go/v4) Fix the generated webhook code and tests for external APIs, for projects with several APIs, and when you add webhooks one at a time (#​5839, #​5871)
  • (go/v4) Explain the Podman limitation in the generated .dockerignore, so you can find the workaround when a Podman build fails (#​5887, #​5914)
  • (go/v4, CLI) Replace the YEAR placeholder only when it stands alone, so words that contain YEAR are left alone (#​5809)
  • (go/v4, helm/v2-alpha) Fix the webhook NetworkPolicy, which stopped the API server from reaching your webhooks (#​5905) — see Recommended Scaffold Fixes
  • (helm/v2-alpha) Make make helm-deploy use the controller image you configured (#​5765)
  • (helm/v2-alpha) Find the right manager Deployment and container, even when the file holds several Deployments or the YAML fields are in a different order (#​5781, #​5784)
  • (helm/v2-alpha) Fix the ServiceAccount name, keep its labels and annotations, and require a name when you turn ServiceAccount creation off (#​5757, #​5833, #​5852) — see Breaking Changes
  • (helm/v2-alpha) Stop adding your custom volumes twice (#​5764)
  • (helm/v2-alpha) Stop the chart from failing to render when you do not set pod annotations (#​5795)
  • (helm/v2-alpha) Set prometheus.enabled from the generated kustomize output, instead of always setting it to false (#​5913)
  • (helm/v2-alpha) Pass the manager --metrics-secure argument through to the chart's metrics.secure value. See Metrics (#​5951)
  • (CLI) Delete the temporary files and Git branches that alpha update creates, including when it fails (#​5705, #​5830)
  • (CLI) Read the PROJECT file only for the commands that need it. version, help, and completion now work even when the current directory holds an invalid PROJECT file (#​5845, #​5942, #​6030)
  • (CLI) Delete the alpha generate output directory without calling the shell, which removes a shell injection risk (#​5920)
  • (CLI) Stop alpha generate from deleting the current directory when you use --input-dir without --output-dir. It now regenerates the project in place (#​5957)
  • (CLI) Keep your Grafana changes when alpha generate runs in place (#​5968)
  • (CLI) Update retired Go plugin keys in PROJECT to go.kubebuilder.io/v4. go/v3-alpha used to become go/v4-alpha, which does not exist, because go/v3 matched first. go/v4-alpha is now retired too (#​6023)
Full Changelog and New contributors

What Changed

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the renovate label Jan 21, 2026
@renovate
renovate Bot requested a review from walnuts1018 January 21, 2026 13:29
@renovate renovate Bot changed the title Update dependency kubernetes-sigs/kubebuilder to v4.11.0 Update dependency kubernetes-sigs/kubebuilder to v4.11.1 Jan 27, 2026
@renovate
renovate Bot force-pushed the renovate/kubernetes-sigs-kubebuilder-4.x branch from f3dd836 to ad0a4ae Compare January 27, 2026 18:06
@renovate
renovate Bot force-pushed the renovate/kubernetes-sigs-kubebuilder-4.x branch 2 times, most recently from 29cc823 to bf48df1 Compare February 16, 2026 15:06
@renovate renovate Bot changed the title Update dependency kubernetes-sigs/kubebuilder to v4.11.1 Update dependency kubernetes-sigs/kubebuilder to v4.12.0 Feb 16, 2026
@renovate
renovate Bot force-pushed the renovate/kubernetes-sigs-kubebuilder-4.x branch from bf48df1 to fb0abfb Compare February 27, 2026 14:40
@renovate renovate Bot changed the title Update dependency kubernetes-sigs/kubebuilder to v4.12.0 Update dependency kubernetes-sigs/kubebuilder to v4.13.0 Feb 27, 2026
@renovate
renovate Bot force-pushed the renovate/kubernetes-sigs-kubebuilder-4.x branch from fb0abfb to 09240c2 Compare February 27, 2026 17:05
@renovate
renovate Bot force-pushed the renovate/kubernetes-sigs-kubebuilder-4.x branch from 09240c2 to b131c30 Compare March 25, 2026 12:38
@renovate renovate Bot changed the title Update dependency kubernetes-sigs/kubebuilder to v4.13.0 Update dependency kubernetes-sigs/kubebuilder to v4.13.1 Mar 25, 2026
@renovate
renovate Bot force-pushed the renovate/kubernetes-sigs-kubebuilder-4.x branch from b131c30 to 9594c07 Compare April 30, 2026 09:46
@renovate renovate Bot changed the title Update dependency kubernetes-sigs/kubebuilder to v4.13.1 Update dependency kubernetes-sigs/kubebuilder to v4.14.0 Apr 30, 2026
@renovate
renovate Bot force-pushed the renovate/kubernetes-sigs-kubebuilder-4.x branch from 9594c07 to 84fe4be Compare May 14, 2026 17:00
@renovate
renovate Bot force-pushed the renovate/kubernetes-sigs-kubebuilder-4.x branch from 84fe4be to 807edf2 Compare June 15, 2026 10:48
@renovate renovate Bot changed the title Update dependency kubernetes-sigs/kubebuilder to v4.14.0 Update dependency kubernetes-sigs/kubebuilder to v4.15.0 Jun 15, 2026
@renovate
renovate Bot force-pushed the renovate/kubernetes-sigs-kubebuilder-4.x branch from 807edf2 to beeff04 Compare September 7, 2026 20:43
@renovate
renovate Bot force-pushed the renovate/kubernetes-sigs-kubebuilder-4.x branch from beeff04 to 8ec7771 Compare September 10, 2026 13:12
@renovate renovate Bot changed the title Update dependency kubernetes-sigs/kubebuilder to v4.15.0 Update dependency kubernetes-sigs/kubebuilder to v4.16.0 Sep 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@walnuts1018 walnuts1018 Awaiting requested review from walnuts1018

Assignees

@walnuts1018 walnuts1018

Labels

renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@walnuts1018