[dependabot]

Bumps kube from 3.1.0 to 4.0.0.

Release notes

Sourced from kube's releases.

4.0.0

New Major

As per the release schedule to match up with the latest Kubernetes ハル release. Lots of fixes and improvements. Thanks to everyone who contributed!

Kubernetes v1_36 support via k8s-openapi 0.28

Please upgrade k8s-openapi along with kube to avoid conflicts.

CEL Validation

A new optional crate kube-cel is being re-exported through kube::core::cel via kube-rs/kube#1954

Kubernetes CRDs support CEL validation rules via x-kubernetes-validations, and were supported from 3.0 via KubeSchema, but these rules could only be evaluated server-side by the API server.

The new crate allows evaluating these rules locally using rules matching the upstream Kubernetes CEL libraries.

While low-level, a higher-level CEL validator integrates with CustomResource via #[kube(cel)] from kube-rs/kube#2011 and can be used as;

#[derive(CustomResource, Serialize, Deserialize, Clone, KubeSchema)]
#[kube(group = "example.com", version = "v1", kind = "Foo", namespaced)]
#[kube(cel, validation = "self.spec.replicas >= 0")] // cel trigger + validation rule
struct FooSpec { replicas: i32 }
let foo = Foo::new("test", FooSpec { replicas: -1 });
foo.validate_cel()?;                     // new impl; checks creation rules
new_foo.validate_cel_update(&old_foo)?;  // new impl; checks transition rules

See examples/crd_derive_cel.rs for more details.

This is available under the kube/cel feature, courtesy of @​doxxx93.

Config

A lot of improvements to config handling;

• better error handling of malformed client certs in kube-rs/kube#1966
• add missing Kubeconfig fields in kube-rs/kube#1965
• Kubeconfig future key compatibility for new fields by adding catch-all other key via kube-rs/kube#1964
• deserialization changed from serde-yaml to serde-saphyr to get rid of the long-deprecated dependency. kube-rs/kube#1975

Retry and Timeouts

Better timeout and retry handling to better deal with flaky network conditions, and busy or initializing apiservers.

• default global read timeouts has been unset in favor of watcher level timeouts in kube-rs/kube#1945 (see kube-rs/kube#1798 for context)
• regular (non-watch) queries now respect the RetryPolicy - now enabled by default in kube-rs/kube#2007.

Client

... (truncated)

Changelog

Sourced from kube's changelog.

4.0.0 / 2026-06-16

New Major

As per the release schedule to match up with the latest Kubernetes ハル release. Lots of fixes and improvements. Thanks to everyone who contributed!

Kubernetes v1_36 support via k8s-openapi 0.28

Please upgrade k8s-openapi along with kube to avoid conflicts.

CEL Validation

A new optional crate kube-cel is being re-exported through kube::core::cel via kube-rs/kube#1954

Kubernetes CRDs support CEL validation rules via x-kubernetes-validations, and were supported from 3.0 via KubeSchema, but these rules could only be evaluated server-side by the API server.

The new crate allows evaluating these rules locally using rules matching the upstream Kubernetes CEL libraries.

While low-level, a higher-level CEL validator integrates with CustomResource via #[kube(cel)] from kube-rs/kube#2011 and can be used as;

#[derive(CustomResource, Serialize, Deserialize, Clone, KubeSchema)]
#[kube(group = "example.com", version = "v1", kind = "Foo", namespaced)]
#[kube(cel, validation = "self.spec.replicas >= 0")] // cel trigger + validation rule
struct FooSpec { replicas: i32 }
let foo = Foo::new("test", FooSpec { replicas: -1 });
foo.validate_cel()?;                     // new impl; checks creation rules
new_foo.validate_cel_update(&old_foo)?;  // new impl; checks transition rules

See examples/crd_derive_cel.rs for more details.

This is available under the kube/cel feature, courtesy of @​doxxx93.

Config

A lot of improvements to config handling;

• better error handling of malformed client certs in kube-rs/kube#1966
• add missing Kubeconfig fields in kube-rs/kube#1965
• Kubeconfig future key compatibility for new fields by adding catch-all other key via kube-rs/kube#1964
• deserialization changed from serde-yaml to serde-saphyr to get rid of the long-deprecated dependency. kube-rs/kube#1975

Retry and Timeouts

Better timeout and retry handling to better deal with flaky network conditions, and busy or initializing apiservers.

• default global read timeouts has been unset in favor of watcher level timeouts in kube-rs/kube#1945 (see kube-rs/kube#1798 for context)
• regular (non-watch) queries now respect the RetryPolicy - now enabled by default in kube-rs/kube#2007.

Client

... (truncated)

Commits

• b4f0cc4 re-hook cel feature and move dev-dep pin
• 163ade1 unhook dev-dep temporarily
• 2a14dec release 4.0.0
• 2310a06 feat(derive): client-side CEL validation via #[kube(cel)] / #[x_kube(cel)] (#...
• 8d61784 Enable RetryPolicy::server_retry by default for Client (#2007)
• a5b4f3f Box a large runtime error in ReconcilerErr (#1880)
• 3dd76bc bump k8s-openapi to 0.28 (#2009)
• 60ffe61 chore: group cel into the just hack feature-powerset (#2006)
• c261d78 deps: bump kube-cel to 0.6.1 (validation surface flattened) (#2005)
• 6c26657 refactor(runtime): rename Store::state_with/state_filtered per review feedbac...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[csixteen]

This update needs to be combined with #237 . kube 4 depends on k8s-openapi 0.28, so updating either dependency independently leaves an incompatible dependency graph. I verified locally that gateway-api compiles successfully when both dependencies are updated together. I was planning to open a PR that supersedes #237 and #238, but it seems like I'd need to be a collaborator to do so.

The verification command:

K8S_OPENAPI_ENABLED_VERSION=1.32 cargo check -p gateway-api --all-features

I also ran the unit and integration tests, according to DEVELOPMENT.md.

[aharbis]

replaced by #241

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.