Skip to content

deps: update rust crate kube to v4 - #22

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/kube-4.x
Open

deps: update rust crate kube to v4#22
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/kube-4.x

Conversation

@renovate

@renovate renovate Bot commented Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
kube dependencies major 0.69 → 4.0

Release Notes

kube-rs/kube (kube)

v4.2.0

Compare Source

===================

v4.0.0

Compare Source

===================

New Major

As per the release schedule to match up with the latest Kubernetes ハル release.
Lots of fixes and improvements. Thanks to everyone who contributed!

Kubernetes v1_36 support via k8s-openapi 0.28

Please upgrade k8s-openapi along with kube to avoid conflicts.

CEL Validation

A new optional crate kube-cel is being re-exported through kube::core::cel via #​1954

Kubernetes CRDs support CEL validation rules via x-kubernetes-validations, and were supported from 3.0 via KubeSchema, but these rules could only be evaluated server-side by the API server.

The new crate allows evaluating these rules locally using rules matching the upstream Kubernetes CEL libraries.

While low-level, a higher-level CEL validator integrates with CustomResource via #[kube(cel)] from #​2011 and can be used as;

#[derive(CustomResource, Serialize, Deserialize, Clone, KubeSchema)]
#[kube(group = "example.com", version = "v1", kind = "Foo", namespaced)]

#[kube(cel, validation = "self.spec.replicas >= 0")] // cel trigger + validation rule
struct FooSpec { replicas: i32 }

let foo = Foo::new("test", FooSpec { replicas: -1 });
foo.validate_cel()?;                     // new impl; checks creation rules
new_foo.validate_cel_update(&old_foo)?;  // new impl; checks transition rules

See examples/crd_derive_cel.rs for more details.

This is available under the kube/cel feature, courtesy of @​doxxx93.

Config

A lot of improvements to config handling;

  • better error handling of malformed client certs in #​1966
  • add missing Kubeconfig fields in #​1965
  • Kubeconfig future key compatibility for new fields by adding catch-all other key via #​1964
  • deserialization changed from serde-yaml to serde-saphyr to get rid of the long-deprecated dependency. #​1975
Retry and Timeouts

Better timeout and retry handling to better deal with flaky network conditions, and busy or initializing apiservers.

  • default global read timeouts has been unset in favor of watcher level timeouts in #​1945 (see #​1798 for context)
  • regular (non-watch) queries now respect the RetryPolicy - now enabled by default in #​2007.
Client
  • properly handling rotating ca certs in cluster via #​1962
  • handle tls-server-name with openssl-tls via #​1993
  • auth exec: accept yaml output from exec plugins via #​2003
  • fix ws task leak and drop, and a deadlock on join() via #​1978
  • change: client tracing now opt-in due to issues. see #​1972
Runtime

What's Changed

Added
Changed
Fixed

Full Changelog: kube-rs/kube@3.1.0...4.0.0

v3.1.0

Compare Source

===================

New Major

As per the release schedule to match up with the latest Kubernetes ハル release.
Lots of fixes and improvements. Thanks to everyone who contributed!

Kubernetes v1_36 support via k8s-openapi 0.28

Please upgrade k8s-openapi along with kube to avoid conflicts.

CEL Validation

A new optional crate kube-cel is being re-exported through kube::core::cel via #​1954

Kubernetes CRDs support CEL validation rules via x-kubernetes-validations, and were supported from 3.0 via KubeSchema, but these rules could only be evaluated server-side by the API server.

The new crate allows evaluating these rules locally using rules matching the upstream Kubernetes CEL libraries.

While low-level, a higher-level CEL validator integrates with CustomResource via #[kube(cel)] from #​2011 and can be used as;

#[derive(CustomResource, Serialize, Deserialize, Clone, KubeSchema)]
#[kube(group = "example.com", version = "v1", kind = "Foo", namespaced)]

#[kube(cel, validation = "self.spec.replicas >= 0")] // cel trigger + validation rule
struct FooSpec { replicas: i32 }

let foo = Foo::new("test", FooSpec { replicas: -1 });
foo.validate_cel()?;                     // new impl; checks creation rules
new_foo.validate_cel_update(&old_foo)?;  // new impl; checks transition rules

See examples/crd_derive_cel.rs for more details.

This is available under the kube/cel feature, courtesy of @​doxxx93.

Config

A lot of improvements to config handling;

  • better error handling of malformed client certs in #​1966
  • add missing Kubeconfig fields in #​1965
  • Kubeconfig future key compatibility for new fields by adding catch-all other key via #​1964
  • deserialization changed from serde-yaml to serde-saphyr to get rid of the long-deprecated dependency. #​1975
Retry and Timeouts

Better timeout and retry handling to better deal with flaky network conditions, and busy or initializing apiservers.

  • default global read timeouts has been unset in favor of watcher level timeouts in #​1945 (see #​1798 for context)
  • regular (non-watch) queries now respect the RetryPolicy - now enabled by default in #​2007.
Client
  • properly handling rotating ca certs in cluster via #​1962
  • handle tls-server-name with openssl-tls via #​1993
  • auth exec: accept yaml output from exec plugins via #​2003
  • fix ws task leak and drop, and a deadlock on join() via #​1978
  • change: client tracing now opt-in due to issues. see #​1972
Runtime

What's Changed

Added
Changed
Fixed

Full Changelog: kube-rs/kube@3.1.0...4.0.0

v3.0.1

Compare Source

===================

What's Changed

Maintenance release with fixes for schemas/validation, client exec blocking and proxy handling, as well as some smaller new features listed below. Internal changes and documentation improvements listed in the milestone.

Added
Fixed

Full Changelog: kube-rs/kube@3.0.1...3.1.0

v3.0.0

Compare Source

===================

New Major

As per the new release schedule to match up with the new Kubernetes release.
Lots of additions, fixes and improvements. Thanks to everyone who contributed so heavily over the holidays! Happy new year.

Breaking Changes

Kubernetes v1_35 support via k8s-openapi 0.27

Please upgrade k8s-openapi along with kube to avoid conflicts.

jiff replaces chrono

Matching k8s-openapi's change, kube has also swapped out chrono. The biggest impact of this is for interacting with timestamps in metadata, but it also updates 2 smaller public interfaces in LogParams, Client::with_valid_until. See controller-rs#217 for an example change.

Changes: #​1868 + #​1870

ErrorResponse has been replaced with Status

ErrorResponse served as a partial metav1/Status replacement which ended up hiding error information to users. These structs have merged, more information is available on errors, and a type alias with a deprecation warning is in place for ErrorResponse which will be removed in a later version.

This creates a small breaking change for users matching on specific Error::Api codes;

     .map_err(|error| match error {
-        kube::Error::Api(kube::error::ErrorResponse { code: 403, .. }) => {
-            Error::UnauthorizedToPatch(obj)
-        }
+        kube::Error::Api(s) if s.is_forbidden() => Error::UnauthorizedToPatch(obj),
         other => Error::Other(other),
     })?;

#​1875 + #​1883 + #​1891.

Predicates now has a TTL Cache

This prevents unbounded memory for controllers, particularly affecting ones watching quickly rotating objects with generated names (e.g. pods). By default the TTL is 1h. It can be configured via new PredicateConfig parameter. To use the default;

-        .predicate_filter(predicates::resource_version);
+        .predicate_filter(predicates::resource_version, Default::default());

Change in #​1836. This helped expose and fix a bug in watches with streaming_lists now fixed in #​1882.

Subresource Api

Some subresource write methods were public with inconsistent signatures that required less ergonomic use than any other write methods. They took a Vec<u8> for the post body, now they take a &K: Serialize or the actual subresource.
There affect Api::create_subresource, Api::replace_subresource, Api::replace_status, Api::replace_scale. In essence this generally means you do not have to wrap raw objects in json! and serde_json::to_vec for these calls and lean more on rust's typed objects rather than json! blobs which has some footguns for subresources.

-    let o = foos.replace_status("qux", &pp, serde_json::to_vec(&object)?).await?;
+    let o = foos.replace_status("qux", &pp, &object).await?;

See some more shifts in examples in the implementation; #​1884

Improvements

Support Kubernetes 1.30 Aggregated Discovery

Speeds up api discovery significantly by using the newer api with much less round-tripping.
To opt-in change Discovery::run() to Discovery::run_aggregated()

Changes; #​1876 + #​1873 + #​1889

Rust 2024

While this is mostly for internal ergonomics, we would like to highlight this also simplifies the Condition implementors which had to deal with a lot of options;

    pub fn is_job_completed() -> impl Condition<Job> {
        |obj: Option<&Job>| {
-            if let Some(job) = &obj {
-                if let Some(s) = &job.status {
-                    if let Some(conds) = &s.conditions {
-                        if let Some(pcond) = conds.iter().find(|c| c.type_ == "Complete") {
-                            return pcond.status == "True";
-                        }
-                    }
-                }
+            if let Some(job) = &obj
+                && let Some(s) = &job.status
+                && let Some(conds) = &s.conditions
+                && let Some(pcond) = conds.iter().find(|c| c.type_ == "Complete")
+            {
+                return pcond.status == "True";

Change #​1856 + #​1792

New Client RetryPolicy opt-in

Allows custom clients (for now) to enable exponential backoff'd retries for retryable errors by exposing a tower::retry::Policy for a tower::retry::Layer. See the new custom_client_retry example for details.

Enabled by a cloneable body + the new RetryPolicy based on mirrord's solution*.

Fixes

  • streaming list bug fix - #​1882
  • watcher jitter bug fix - #​1897
  • schema fix for IntOrString - #​1867
  • schema fix for optional enums - #​1853
  • websocket keepalives for long running attaches - #​1889
More
  • Resize subresource impl for Pod - #​1851
  • add #[kube(attr="...") to allow custom attrs on derives - #​1850
  • example updates for admission w/axum - #​1859

What's Changed

Added
Changed
Fixed

v2.0.1

Compare Source

===================

What's Changed

Fixes an accidental inclusion of a constraint added to Api::log_stream introduced in the 2.0.0 Rust 2024 upgrade.

Fixed

v2.0.0

Compare Source

===================

New Major

As per the new release schedule to match up with the new Kubernetes release.
Lots of additions, fixes and improvements. Thanks to everyone who contributed so heavily over the holidays! Happy new year.

Breaking Changes

Kubernetes v1_35 support via k8s-openapi 0.27

Please upgrade k8s-openapi along with kube to avoid conflicts.

jiff replaces chrono

Matching k8s-openapi's change, kube has also swapped out chrono. The biggest impact of this is for interacting with timestamps in metadata, but it also updates 2 smaller public interfaces in LogParams, Client::with_valid_until. See controller-rs#217 for an example change.

Changes: #​1868 + #​1870

ErrorResponse has been replaced with Status

ErrorResponse served as a partial metav1/Status replacement which ended up hiding error information to users. These structs have merged, more information is available on errors, and a type alias with a deprecation warning is in place for ErrorResponse which will be removed in a later version.

This creates a small breaking change for users matching on specific Error::Api codes;

     .map_err(|error| match error {
-        kube::Error::Api(kube::error::ErrorResponse { code: 403, .. }) => {
-            Error::UnauthorizedToPatch(obj)
-        }
+        kube::Error::Api(s) if s.is_forbidden() => Error::UnauthorizedToPatch(obj),
         other => Error::Other(other),
     })?;

#​1875 + #​1883 + #​1891.

Predicates now has a TTL Cache

This prevents unbounded memory for controllers, particularly affecting ones watching quickly rotating objects with generated names (e.g. pods). By default the TTL is 1h. It can be configured via new PredicateConfig parameter. To use the default;

-        .predicate_filter(predicates::resource_version);
+        .predicate_filter(predicates::resource_version, Default::default());

Change in #​1836. This helped expose and fix a bug in watches with streaming_lists now fixed in #​1882.

Subresource Api

Some subresource write methods were public with inconsistent signatures that required less ergonomic use than any other write methods. They took a Vec<u8> for the post body, now they take a &K: Serialize or the actual subresource.
There affect Api::create_subresource, Api::replace_subresource, Api::replace_status, Api::replace_scale. In essence this generally means you do not have to wrap raw objects in json! and serde_json::to_vec for these calls and lean more on rust's typed objects rather than json! blobs which has some footguns for subresources.

-    let o = foos.replace_status("qux", &pp, serde_json::to_vec(&object)?).await?;
+    let o = foos.replace_status("qux", &pp, &object).await?;

See some more shifts in examples in the implementation; #​1884

Improvements

Support Kubernetes 1.30 Aggregated Discovery

Speeds up api discovery significantly by using the newer api with much less round-tripping.
To opt-in change Discovery::run() to Discovery::run_aggregated()

Changes; #​1876 + #​1873 + #​1889

Rust 2024

While this is mostly for internal ergonomics, we would like to highlight this also simplifies the Condition implementors which had to deal with a lot of options;

    pub fn is_job_completed() -> impl Condition<Job> {
        |obj: Option<&Job>| {
-            if let Some(job) = &obj {
-                if let Some(s) = &job.status {
-                    if let Some(conds) = &s.conditions {
-                        if let Some(pcond) = conds.iter().find(|c| c.type_ == "Complete") {
-                            return pcond.status == "True";
-                        }
-                    }
-                }
+            if let Some(job) = &obj
+                && let Some(s) = &job.status
+                && let Some(conds) = &s.conditions
+                && let Some(pcond) = conds.iter().find(|c| c.type_ == "Complete")
+            {
+                return pcond.status == "True";

Change #​1856 + #​1792

New Client RetryPolicy opt-in

Allows custom clients (for now) to enable exponential backoff'd retries for retryable errors by exposing a tower::retry::Policy for a tower::retry::Layer. See the new custom_client_retry example for details.

Enabled by a cloneable body + the new RetryPolicy based on mirrord's solution*.

Fixes

  • streaming list bug fix - #​1882
  • watcher jitter bug fix - #​1897
  • schema fix for IntOrString - #​1867
  • schema fix for optional enums - #​1853
  • websocket keepalives for long running attaches - #​1889
More
  • Resize subresource impl for Pod - #​1851
  • add #[kube(attr="...") to allow custom attrs on derives - #​1850
  • example updates for admission w/axum - #​1859

What's Changed

Added
Changed
Fixed

v1.1.0

Compare Source

===================

What's Changed

Missing attribute bugfix + extra standard derives on core::conversion structs.

Added
Fixed

v1.0.0

Compare Source

A Major Version

It's been a long time coming, but time has come to draw the line in the sand. No alphas, no betas. Hope it finds you all well. Thanks to everyone who has contributed over the years.

This is a somewhat symbolic gesture, because semver-breaking changes are still hard to avoid with a large set of sub-1.0 dependencies we need to bump, as well as managing the large api surface of Kubernetes.

Therefore, the plan is to align our breaking changes and major bumps with Kubernetes versions / k8s-openapi versions for now, and this should allow our other releases to stream in. See #​1688 for more information.

Kubernetes v1_33 support via k8s-openapi 0.25

Please upgrade k8s-openapi along with kube to avoid conflicts.

New minimum versions: MSRV 1.82.0, MK8SV: 1.30*

KubeSchema

The CELSchema alternate derive for JsonSchema has been renamed to KubeSchema to indicate the increased functionality.

In addition to being able to inject CEL rules for validations, it can now also inject x-kubernetes properties such as merge-strategy via #​1750, handle #[validate] attributes #​1749, and pass validation rules as string literals #​1754 :

#[derive(CustomResource, Serialize, Deserialize, Debug, PartialEq, Clone, KubeSchema)]
#[kube(...properties)
struct DocumentSpec {
    /// New merge strategy support
    #[x_kube(merge_strategy = ListMerge::Set)]
    x_kubernetes_set: Vec<String>,

    /// CEL Validation now lives on x_kube and supports literal Rules:
    #[x_kube(validation = "!has(self.variantOne) || self.variantOne.int > 22")]
   

> ✂ **Note**
> 
> PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/YoloDev/rust-fluxcd).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzUuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJhdXRvbWVyZ2UiLCJkZXBlbmRlbmNpZXMiXX0=-->

@renovate
renovate Bot force-pushed the renovate/kube-4.x branch from 294f635 to 3d8aebb Compare July 25, 2026 04:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

automerge dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants