chore: Bump golang dependencies in backend & controller by christian-heusel · Pull Request #1306 · kubeflow/notebooks

christian-heusel · 2026-08-05T15:08:52Z

Notable changes

workspaces/backend/internal/auth/authentication.go:

headerrequest.New() gained a new uidHeaders []string parameter upstream
in k8s.io/apiserver. Updated the call site to pass nil for it since it's
unused (auth is keyed on name/group headers only).

workspaces/controller/internal/webhook/workspace_webhook.go / workspacekind_webhook.go

controller-runtime v0.24 made the webhook builder generic:

ctrl.NewWebhookManagedBy(mgr).For(&T{}) → ctrl.NewWebhookManagedBy(mgr, &T{})
admission.Validator methods (ValidateCreate/Update/Delete) now take the concrete type (*Workspace, *WorkspaceKind) directly instead of runtime.Object, so the manual obj.(*T) type assertions + apierrors.NewBadRequest fallback were dropped — that check is now enforced by the compiler instead of at request time (type mismatches are caught by the compiler; runtime failures are now JSON-decode errors, not type-assertion errors — see sigs.k8s.io/controller-runtime/pkg/webhook/admission/validator_custom.go).

workspaces/controller/internal/helper/probe.go:

Switch import k8s.io/apimachinery/pkg/util/httpstream → k8s.io/streaming/pkg/httpstream

workspaces/controller/internal/controller/workspace_activity_test.go &

nolint the Result.Requeue deprecation (will open another task to refactor this deprecated type out)

christian-heusel · 2026-08-05T15:44:55Z

/cc @aojea
who also did a few dependency updates in #1301

google-oss-prow · 2026-08-05T15:44:58Z

@christian-heusel: GitHub didn't allow me to request PR reviews from the following users: aojea.

Note that only kubeflow members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

/cc @aojea
who also did a few dependency updates in #1301

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

aojea · 2026-08-05T15:49:43Z

/lgtm

google-oss-prow · 2026-08-05T15:49:48Z

@aojea: changing LGTM is restricted to collaborators

Details

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

andyatmiami

thanks @christian-heusel - I have one suggestion here from reviewing the various change logs across these version bumps...

controller-runtime v0.21: client-side rate limiter removed

Starting with controller-runtime v0.21, the default client-side rate limiter (QPS=20, Burst=30) was disabled by default — the rest config now ships with no client-side rate limiting.

Backend: Already mitigated. cmd/main.go explicitly sets kubeconfig.QPS and kubeconfig.Burst from env vars (defaults: QPS=50, Burst=100).

Controller: Uses ctrl.GetConfigOrDie() at cmd/main.go:123 without setting explicit QPS/Burst on the rest config. After this bump, the controller will have no client-side rate limiting on API calls. The API server's server-side priority & fairness provides some protection, but under heavy load (many workspaces reconciling simultaneously) the controller may generate more concurrent API requests than before.

Purely out of paranoia - seems like maybe we should configure the controller similarly to the backend - but note as I say this - I'm not fully appreciative of the ramifications here... feel free to push back

Note: The RateLimiter at cmd/main.go:176/191 is the workqueue rate limiter (controls reconcile requeue timing), not the Kubernetes API client rate limiter.

aojea · 2026-08-22T06:52:10Z

Purely out of paranoia - seems like maybe we should configure the controller similarly to the backend - but note as I say this - I'm not fully appreciative of the ramifications here... feel free to push back

good catch , I think the importance of this parameters is on the number of write requests the controller does, how many objects it updates and creates , so having client side enable always help to avoid storming the apiserver and being consistent across the project seems a good call

controller-runtime deprecates Result.Requeue in favor of RequeueAfter / returning an error (see the v0.24.1 field docs). The dependency bump in kubeflow#1306 moves the controller to a version where staticcheck flags every usage as SA1019, so this proactively removes them (the change is valid on the current controller-runtime v0.19.1 too). This replaces every usage in the controller reconcilers: - Conflict-retry sites now return the conflict error so the workqueue rate-limiter handles retry-on-error (its documented purpose), which preserves the same rate-limited backoff that Requeue: true provided. - Stale-cache sites (ServiceAccount not yet in the cache) rely on the Owns(ServiceAccount) watch to requeue, matching the existing comments. - mergeReconcileResult drops its .Requeue handling and now merges purely on RequeueAfter; its unit test is updated accordingly. Tradeoff for discussion: conflict errors are now surfaced by controller-runtime at error level rather than staying quiet at V(2). Assisted-by: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

Bump k8s.io libraries, controller-runtime, ginkgo/gomega, and their transitive deps. Fix `headerrequest.New` call in internal/auth for its new `uidHeaders` parameter, and regenerate the OpenAPI spec to pick up the resulting upstream API changes. Assisted-by: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

Bump k8s.io libraries, controller-runtime, istio.io/api and istio.io/client-go, and their transitive deps, to match the versions used in workspaces/backend. Also switch NewWebhookManagedBy/admission.Validator usage in workspace_webhook.go and workspacekind_webhook.go to the typed API instead of manually type-asserting runtime.Object. Regenerate the WorkspaceKind CRD for new upstream corev1 fields. Assisted-by: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

controller-runtime v0.21 removed the default client-side rate limiter (QPS=20, Burst=30), so the controller's Kubernetes API client no longer has any client-side rate limiting after the dependency bump. Mirror the backend by setting QPS/Burst explicitly on the rest.Config, configurable via --client-qps/CLIENT_QPS (default 50) and --client-burst/CLIENT_BURST (default 100). REFERENCE: kubernetes-sigs/controller-runtime#3119 Assisted-by: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

controller-runtime deprecates Result.Requeue in favor of RequeueAfter / returning an error (see the v0.24.1 field docs). The dependency bump in kubeflow#1306 moves the controller to a version where staticcheck flags every usage as SA1019, so this proactively removes them (the change is valid on the current controller-runtime v0.19.1 too). This replaces every usage in the controller reconcilers: - Conflict-retry sites now return the conflict error so the workqueue rate-limiter handles retry-on-error (its documented purpose), which preserves the same rate-limited backoff that Requeue: true provided. - Stale-cache sites (ServiceAccount not yet in the cache) rely on the Owns(ServiceAccount) watch to requeue, matching the existing comments. - mergeReconcileResult drops its .Requeue handling and now merges purely on RequeueAfter; its unit test is updated accordingly. Tradeoff for discussion: conflict errors are now surfaced by controller-runtime at error level rather than staying quiet at V(2). Assisted-by: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

`controller-runtime` deprecates `reconcile.Result.Requeue` in favor of `RequeueAfter` / returning an error. The dependency bump in kubeflow#1306 moves the controller to `controller-runtime v0.24.1`, where `staticcheck` flags **every** `Result{Requeue: true}` usage as `SA1019`: This setting is deprecated as it causes confusion and there is no good reason to use it. When waiting for an external event to happen, either the duration until it is supposed to happen or an appropriate poll interval should be used, rather than an interval emitted by a ratelimiter whose purpose it is to control retry on error. Deprecated: Use `RequeueAfter` instead. Therefore this change replaces every usage in the controller reconcilers: - Conflict-retry sites now return the conflict error so the workqueue rate-limiter handles retry-on-error (its documented purpose), which preserves the same rate-limited backoff that `Requeue: true` provided. - Stale-cache sites (`ServiceAccount` not yet in the cache) rely on the `Owns(ServiceAccount)` watch to requeue, matching the existing comments. - `mergeReconcileResult` drops its `.Requeue` handling and now merges purely on `RequeueAfter` its unit test is updated accordingly. Tradeoff for discussion: conflict errors are now surfaced by controller-runtime at error level rather than staying quiet at `V(2)`. Assisted-by: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

…pimachinery import Assisted-by: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

`controller-runtime` deprecates `reconcile.Result.Requeue` in favor of `RequeueAfter` / returning an error. The dependency bump in kubeflow#1306 moves the controller to `controller-runtime v0.24.1`, where `staticcheck` flags **every** `Result{Requeue: true}` usage as `SA1019`: This setting is deprecated as it causes confusion and there is no good reason to use it. When waiting for an external event to happen, either the duration until it is supposed to happen or an appropriate poll interval should be used, rather than an interval emitted by a ratelimiter whose purpose it is to control retry on error. Deprecated: Use `RequeueAfter` instead. Therefore this change replaces every usage in the controller reconcilers: - Conflict-retry sites now return the conflict error so the workqueue rate-limiter handles retry-on-error (its documented purpose), which preserves the same rate-limited backoff that `Requeue: true` provided. - Stale-cache sites (`ServiceAccount` not yet in the cache) rely on the `Owns(ServiceAccount)` watch to requeue, matching the existing comments. - `mergeReconcileResult` drops its `.Requeue` handling and now merges purely on `RequeueAfter` its unit test is updated accordingly. Tradeoff for discussion: conflict errors are now surfaced by controller-runtime at error level rather than staying quiet at `V(2)`. Assisted-by: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

Fixing it will involve more care and work than appropriate to this dependency bump PR, hence we'll defer this refactor to another task. Signed-off-by: Christian Heusel <christian@heusel.eu>

andyatmiami

/lgtm
/approve

thanks @christian-heusel - really appreciate you always pushing and staying on top of the little details like dependency versions to make Kubeflow Workspaces awesome and enterprise ready.

from reviewing the change logs for the dependencies being updated - and the minimal changes you delivered to account for these dep upgrades - I think this is looking good and ready to be merged...

timing wise - as we just shipping the beta - this is also the best time to do work like this.. in the event we missed some weird/subtle thing - we'll have plenty of time to find it (or let community find it) - and be better position for our GA near EOY!

testing methodology:

PR-1306-TEST-RESULTS.md
- agent driven, human reviewed/approved

google-oss-prow · 2026-08-23T20:16:39Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: andyatmiami

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~workspaces/backend/OWNERS~~ [andyatmiami]
~~workspaces/controller/OWNERS~~ [andyatmiami]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

`controller-runtime` deprecates `reconcile.Result.Requeue` in favor of `RequeueAfter` / returning an error. The dependency bump in kubeflow#1306 moves the controller to `controller-runtime v0.24.1`, where `staticcheck` flags **every** `Result{Requeue: true}` usage as `SA1019`: This setting is deprecated as it causes confusion and there is no good reason to use it. When waiting for an external event to happen, either the duration until it is supposed to happen or an appropriate poll interval should be used, rather than an interval emitted by a ratelimiter whose purpose it is to control retry on error. Deprecated: Use `RequeueAfter` instead. Therefore this change replaces every usage in the controller reconcilers: - Conflict-retry sites now return the conflict error so the workqueue rate-limiter handles retry-on-error (its documented purpose), which preserves the same rate-limited backoff that `Requeue: true` provided. - Stale-cache sites (`ServiceAccount` not yet in the cache) rely on the `Owns(ServiceAccount)` watch to requeue, matching the existing comments. - `mergeReconcileResult` drops its `.Requeue` handling and now merges purely on `RequeueAfter` its unit test is updated accordingly. Tradeoff for discussion: conflict errors are now surfaced by controller-runtime at error level rather than staying quiet at `V(2)`. Assisted-by: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

…#1348) * refactor: replace deprecated Result.Requeue in controller reconcilers `controller-runtime` deprecates `reconcile.Result.Requeue` in favor of `RequeueAfter` / returning an error. The dependency bump in #1306 moves the controller to `controller-runtime v0.24.1`, where `staticcheck` flags **every** `Result{Requeue: true}` usage as `SA1019`: This setting is deprecated as it causes confusion and there is no good reason to use it. When waiting for an external event to happen, either the duration until it is supposed to happen or an appropriate poll interval should be used, rather than an interval emitted by a ratelimiter whose purpose it is to control retry on error. Deprecated: Use `RequeueAfter` instead. Therefore this change replaces every usage in the controller reconcilers: - Conflict-retry sites now return the conflict error so the workqueue rate-limiter handles retry-on-error (its documented purpose), which preserves the same rate-limited backoff that `Requeue: true` provided. - Stale-cache sites (`ServiceAccount` not yet in the cache) rely on the `Owns(ServiceAccount)` watch to requeue, matching the existing comments. - `mergeReconcileResult` drops its `.Requeue` handling and now merges purely on `RequeueAfter` its unit test is updated accordingly. Tradeoff for discussion: conflict errors are now surfaced by controller-runtime at error level rather than staying quiet at `V(2)`. Assisted-by: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu> * fix: requeue with a fixed delay on stale ServiceAccount cache Addresses review feedback on the stale-cache handling: relying on the `Owns(ServiceAccount)` watch to requeue is not guaranteed, because a ServiceAccount with the deterministic name that is owned by another controller will never be mapped back to this Workspace. Requeue with a small fixed `RequeueAfter` instead: a stale cache is common and is not write contention, so no exponential backoff is needed. Assisted-by: Qwen3.8-27B Signed-off-by: Christian Heusel <christian@heusel.eu> --------- Signed-off-by: Christian Heusel <christian@heusel.eu>

github-project-automation Bot added this to Kubeflow Notebooks Aug 5, 2026

github-project-automation Bot moved this to Needs Triage in Kubeflow Notebooks Aug 5, 2026

google-oss-prow Bot added do-not-merge/work-in-progress area/backend area - related to backend components labels Aug 5, 2026

google-oss-prow Bot requested review from andyatmiami and thesuperzapper August 5, 2026 15:08

google-oss-prow Bot added area/controller area - related to controller components area/v2 area - version - kubeflow notebooks v2 size/XXL labels Aug 5, 2026

christian-heusel force-pushed the chore/bump-go-deps branch from b7ec83f to b9e25e7 Compare August 5, 2026 15:31

christian-heusel marked this pull request as ready for review August 5, 2026 15:43

google-oss-prow Bot removed the do-not-merge/work-in-progress label Aug 5, 2026

christian-heusel force-pushed the chore/bump-go-deps branch from b9e25e7 to f27a456 Compare August 6, 2026 23:56

andyatmiami requested changes Aug 22, 2026

View reviewed changes

google-oss-prow Bot assigned andyatmiami Aug 22, 2026

christian-heusel force-pushed the chore/bump-go-deps branch from f27a456 to f6fc70f Compare August 23, 2026 11:05

christian-heusel mentioned this pull request Aug 23, 2026

refactor: replace deprecated Result.Requeue in controller reconcilers #1346

Closed

christian-heusel force-pushed the chore/bump-go-deps branch from f6fc70f to 837bfbc Compare August 23, 2026 15:06

christian-heusel added 3 commits August 23, 2026 17:10

christian-heusel force-pushed the chore/bump-go-deps branch from 837bfbc to 17a3f8e Compare August 23, 2026 15:25

christian-heusel marked this pull request as draft August 23, 2026 15:55

google-oss-prow Bot added the do-not-merge/work-in-progress label Aug 23, 2026

christian-heusel force-pushed the chore/bump-go-deps branch from cef17ca to 9f20305 Compare August 23, 2026 16:10

refactor: use k8s.io/streaming/pkg/httpstream instead of deprecated a…

bec5bb4

…pimachinery import Assisted-by: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

chore: nolint the Result.Requeue deprecation

94c7ef4

Fixing it will involve more care and work than appropriate to this dependency bump PR, hence we'll defer this refactor to another task. Signed-off-by: Christian Heusel <christian@heusel.eu>

christian-heusel force-pushed the chore/bump-go-deps branch from 9f20305 to 94c7ef4 Compare August 23, 2026 16:47

christian-heusel marked this pull request as ready for review August 23, 2026 16:47

google-oss-prow Bot removed the do-not-merge/work-in-progress label Aug 23, 2026

google-oss-prow Bot requested a review from andyatmiami August 23, 2026 16:47

andyatmiami approved these changes Aug 23, 2026

View reviewed changes

google-oss-prow Bot added the lgtm label Aug 23, 2026

google-oss-prow Bot added the approved label Aug 23, 2026

google-oss-prow Bot merged commit 4802939 into kubeflow:notebooks-v2 Aug 23, 2026
15 of 16 checks passed

github-project-automation Bot moved this from Needs Triage to Done in Kubeflow Notebooks Aug 23, 2026

christian-heusel mentioned this pull request Aug 24, 2026

refactor: replace deprecated Result.Requeue in controller reconcilers #1348

Merged

Navigation Menu

Uh oh!

chore: Bump golang dependencies in backend & controller - #1306

chore: Bump golang dependencies in backend & controller#1306
google-oss-prow[bot] merged 5 commits into
kubeflow:notebooks-v2from
christian-heusel:chore/bump-go-deps

christian-heusel commented Aug 5, 2026 •

edited

Loading

Uh oh!

christian-heusel commented Aug 5, 2026

Uh oh!

google-oss-prow Bot commented Aug 5, 2026

Uh oh!

aojea commented Aug 5, 2026

Uh oh!

google-oss-prow Bot commented Aug 5, 2026

Uh oh!

andyatmiami left a comment

Uh oh!

aojea commented Aug 22, 2026

Uh oh!

andyatmiami left a comment

Uh oh!

google-oss-prow Bot commented Aug 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

christian-heusel commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Notable changes

Uh oh!

christian-heusel commented Aug 5, 2026

Uh oh!

google-oss-prow Bot commented Aug 5, 2026

Uh oh!

aojea commented Aug 5, 2026

Uh oh!

google-oss-prow Bot commented Aug 5, 2026

Uh oh!

andyatmiami left a comment

Choose a reason for hiding this comment

controller-runtime v0.21: client-side rate limiter removed

Uh oh!

aojea commented Aug 22, 2026

Uh oh!

andyatmiami left a comment

Choose a reason for hiding this comment

Uh oh!

google-oss-prow Bot commented Aug 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

christian-heusel commented Aug 5, 2026 •

edited

Loading