Updates: container-hooks to v0.8.0

.github/actions/execute-assert-arc-e2e/action.yaml

@@ -0,0 +1,215 @@
+name: 'Execute and Assert ARC E2E Test Action'
+description: 'Queue E2E test workflow and assert workflow run result to be succeed'
+
+inputs:
+  auth-token:
+    description: 'GitHub access token to queue workflow run'
+    required: true
+  repo-owner:
+    description: "The repository owner name that has the test workflow file, ex: actions"
+    required: true
+  repo-name:
+    description: "The repository name that has the test workflow file, ex: test"
+    required: true
+  workflow-file:
+    description: 'The file name of the workflow yaml, ex: test.yml'
+    required: true
+  arc-name:
+    description: 'The name of the configured gha-runner-scale-set'
+    required: true
+  arc-namespace:
+    description: 'The namespace of the configured gha-runner-scale-set'
+    required: true
+  arc-controller-namespace:
+    description: 'The namespace of the configured gha-runner-scale-set-controller'
+    required: true
+  wait-to-finish:
+    description: 'Wait for the workflow run to finish'
+    required: true
+    default: "true"
+  wait-to-running:
+    description: 'Wait for the workflow run to start running'
+    required: true
+    default: "false"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Queue test workflow
+      shell: bash
+      id: queue_workflow
+      run: |
+        queue_time=`date +%FT%TZ`
+        echo "queue_time=$queue_time" >> $GITHUB_OUTPUT
+        curl -X POST https://api.github.com/repos/${{inputs.repo-owner}}/${{inputs.repo-name}}/actions/workflows/${{inputs.workflow-file}}/dispatches \
+        -H "Accept: application/vnd.github.v3+json" \
+        -H "Authorization: token ${{inputs.auth-token}}" \
+        -d '{"ref": "main", "inputs": { "arc_name": "${{inputs.arc-name}}" } }'
+
+    - name: Fetch workflow run & job ids
+      uses: actions/github-script@v7
+      id: query_workflow
+      with:
+        script: |
+          // Try to find the workflow run triggered by the previous step using the workflow_dispatch event.
+          // - Find recently create workflow runs in the test repository
+          // - For each workflow run, list its workflow job and see if the job's labels contain `inputs.arc-name`
+          // - Since the inputs.arc-name should be unique per e2e workflow run, once we find the job with the label, we find the workflow that we just triggered.
+          function sleep(ms) {
+            return new Promise(resolve => setTimeout(resolve, ms))
+          }
+          const owner = '${{inputs.repo-owner}}'
+          const repo = '${{inputs.repo-name}}'
+          const workflow_id = '${{inputs.workflow-file}}'
+          let workflow_run_id = 0
+          let workflow_job_id = 0
+          let workflow_run_html_url = ""
+          let count = 0
+          while (count++<12) {
+            await sleep(10 * 1000);
+            let listRunResponse = await github.rest.actions.listWorkflowRuns({
+              owner: owner,
+              repo: repo,
+              workflow_id: workflow_id,
+              created: '>${{steps.queue_workflow.outputs.queue_time}}'
+            })
+            if (listRunResponse.data.total_count > 0) {
+              console.log(`Found some new workflow runs for ${workflow_id}`)
+              for (let i = 0; i<listRunResponse.data.total_count; i++) {
+                let workflowRun = listRunResponse.data.workflow_runs[i]
+                console.log(`Check if workflow run ${workflowRun.id} is triggered by us.`)
+                let listJobResponse = await github.rest.actions.listJobsForWorkflowRun({
+                  owner: owner,
+                  repo: repo,
+                  run_id: workflowRun.id
+                })
+                console.log(`Workflow run ${workflowRun.id} has ${listJobResponse.data.total_count} jobs.`)
+                if (listJobResponse.data.total_count > 0) {
+                  for (let j = 0; j<listJobResponse.data.total_count; j++) {
+                    let workflowJob = listJobResponse.data.jobs[j]
+                    console.log(`Check if workflow job ${workflowJob.id} is triggered by us.`)
+                    console.log(JSON.stringify(workflowJob.labels));
+                    if (workflowJob.labels.includes('${{inputs.arc-name}}')) {
+                      console.log(`Workflow job ${workflowJob.id} (Run id: ${workflowJob.run_id}) is triggered by us.`)
+                      workflow_run_id = workflowJob.run_id
+                      workflow_job_id = workflowJob.id
+                      workflow_run_html_url = workflowRun.html_url
+                      break
+                    }
+                  }
+                }
+
+                if (workflow_job_id > 0) {
+                  break;
+                }
+              }
+            }
+
+            if (workflow_job_id > 0) {
+              break;
+            }
+          }
+          if (workflow_job_id == 0) {
+            core.setFailed(`Can't find workflow run and workflow job triggered to 'runs-on ${{inputs.arc-name}}'`)
+          } else {
+            core.setOutput('workflow_run', workflow_run_id);
+            core.setOutput('workflow_job', workflow_job_id);
+            core.setOutput('workflow_run_url', workflow_run_html_url);
+          }
+
+    - name: Generate summary about the triggered workflow run
+      shell: bash
+      run: |
+        cat <<-EOF > $GITHUB_STEP_SUMMARY
+        | **Triggered workflow run** |
+        |:--------------------------:|
+        | ${{steps.query_workflow.outputs.workflow_run_url}} |
+        EOF
+
+    - name: Wait for workflow to start running
+      if: inputs.wait-to-running == 'true' && inputs.wait-to-finish == 'false'
+      uses: actions/github-script@v7
+      with:
+        script: |
+          function sleep(ms) {
+            return new Promise(resolve => setTimeout(resolve, ms))
+          }
+          const owner = '${{inputs.repo-owner}}'
+          const repo = '${{inputs.repo-name}}'
+          const workflow_run_id = ${{steps.query_workflow.outputs.workflow_run}}
+          const workflow_job_id = ${{steps.query_workflow.outputs.workflow_job}}
+          let count = 0
+          while (count++<10) {
+            await sleep(30 * 1000);
+            let getRunResponse = await github.rest.actions.getWorkflowRun({
+              owner: owner,
+              repo: repo,
+              run_id: workflow_run_id
+            })
+            console.log(`${getRunResponse.data.html_url}: ${getRunResponse.data.status} (${getRunResponse.data.conclusion})`);
+            if (getRunResponse.data.status == 'in_progress') {
+              console.log(`Workflow run is in progress.`)
+              return
+            }
+          }
+          core.setFailed(`The triggered workflow run didn't start properly using ${{inputs.arc-name}}`)
+
+    - name: Wait for workflow to finish successfully
+      if: inputs.wait-to-finish == 'true'
+      uses: actions/github-script@v7
+      with:
+        script: |
+          // Wait 5 minutes and make sure the workflow run we triggered completed with result 'success'
+          function sleep(ms) {
+            return new Promise(resolve => setTimeout(resolve, ms))
+          }
+          const owner = '${{inputs.repo-owner}}'
+          const repo = '${{inputs.repo-name}}'
+          const workflow_run_id = ${{steps.query_workflow.outputs.workflow_run}}
+          const workflow_job_id = ${{steps.query_workflow.outputs.workflow_job}}
+          let count = 0
+          while (count++<10) {
+            await sleep(30 * 1000);
+            let getRunResponse = await github.rest.actions.getWorkflowRun({
+              owner: owner,
+              repo: repo,
+              run_id: workflow_run_id
+            })
+            console.log(`${getRunResponse.data.html_url}: ${getRunResponse.data.status} (${getRunResponse.data.conclusion})`);
+            if (getRunResponse.data.status == 'completed') {
+              if ( getRunResponse.data.conclusion == 'success') {
+                console.log(`Workflow run finished properly.`)
+                return
+              } else {
+                core.setFailed(`The triggered workflow run finish with result ${getRunResponse.data.conclusion}`)
+                return
+              }
+            }
+          }
+          core.setFailed(`The triggered workflow run didn't finish properly using ${{inputs.arc-name}}`)
+
+    - name: Gather listener logs
+      shell: bash
+      if: always()
+      run: |
+        LISTENER_POD="$(kubectl get autoscalinglisteners.actions.github.com -n arc-systems -o jsonpath='{.items[*].metadata.name}')"
+        kubectl logs $LISTENER_POD -n ${{inputs.arc-controller-namespace}}
+    
+    - name: Gather coredns logs
+      shell: bash
+      if: always()
+      run: |
+        kubectl logs deployments/coredns -n kube-system 
+
+    - name: cleanup
+      if: inputs.wait-to-finish == 'true'
+      shell: bash
+      run: |
+        helm uninstall ${{ inputs.arc-name }} --namespace ${{inputs.arc-namespace}} --debug
+        kubectl wait --timeout=30s --for=delete AutoScalingRunnerSet -n ${{inputs.arc-namespace}} -l app.kubernetes.io/instance=${{ inputs.arc-name }}
+
+    - name: Gather controller logs
+      shell: bash
+      if: always()
+      run: |
+        kubectl logs deployment/arc-gha-rs-controller -n ${{inputs.arc-controller-namespace}}

.github/actions/setup-arc-e2e/action.yaml

@@ -0,0 +1,65 @@
+name: "Setup ARC E2E Test Action"
+description: "Build controller image, create kind cluster, load the image, and exchange ARC configure token."
+
+inputs:
+  app-id:
+    description: "GitHub App Id for exchange access token"
+    required: true
+  app-pk:
+    description: "GitHub App private key for exchange access token"
+    required: true
+  image-name:
+    description: "Local docker image name for building"
+    required: true
+  image-tag:
+    description: "Tag of ARC Docker image for building"
+    required: true
+  target-org:
+    description: "The test organization for ARC e2e test"
+    required: true
+
+outputs:
+  token:
+    description: "Token to use for configure ARC"
+    value: ${{steps.config-token.outputs.token}}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2
+      with:
+        # Pinning v0.9.1 for Buildx and BuildKit v0.10.6
+        # BuildKit v0.11 which has a bug causing intermittent
+        # failures pushing images to GHCR
+        version: v0.9.1
+        driver-opts: image=moby/buildkit:v0.10.6
+
+    - name: Build controller image
+      # https://github.com/docker/build-push-action/releases/tag/v6.18.0
+      uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
+      with:
+        file: Dockerfile
+        platforms: linux/amd64
+        load: true
+        build-args: |
+          DOCKER_IMAGE_NAME=${{inputs.image-name}}
+          VERSION=${{inputs.image-tag}}
+        tags: |
+          ${{inputs.image-name}}:${{inputs.image-tag}}
+        no-cache: true
+
+    - name: Create minikube cluster and load image
+      shell: bash
+      run: |
+        minikube start
+        minikube image load ${{inputs.image-name}}:${{inputs.image-tag}}
+
+    - name: Get configure token
+      id: config-token
+      # https://github.com/peter-murray/workflow-application-token-action/releases/tag/v3.0.0
+      uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
+      with:
+        application_id: ${{ inputs.app-id }}
+        application_private_key: ${{ inputs.app-pk }}
+        organization: ${{ inputs.target-org}}

.github/actions/setup-docker-environment/action.yaml

@@ -0,0 +1,51 @@
+name: "Setup Docker"
+
+inputs:
+  username:
+    description: "Username"
+    required: true
+  password:
+    description: "Password"
+    required: true
+  ghcr_username:
+    description: "GHCR username. Usually set from the github.actor variable"
+    required: true
+  ghcr_password:
+    description: "GHCR password. Usually set from the secrets.GITHUB_TOKEN variable"
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Get Short SHA
+      id: vars
+      run: |
+        echo "sha_short=${GITHUB_SHA::7}" >> $GITHUB_ENV
+      shell: bash
+
+    - name: Set up QEMU
+      # https://github.com/docker/setup-qemu-action/releases/tag/v3.6.0
+      uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
+
+    - name: Set up Docker Buildx
+      # https://github.com/docker/setup-buildx-action/releases/tag/v3.10.0
+      uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2
+      with:
+        version: latest
+
+    - name: Login to DockerHub
+      if: ${{ github.event_name == 'release' || github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.password != ''  }}
+      # https://github.com/docker/login-action/releases/tag/v3.4.0
+      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
+      with:
+        username: ${{ inputs.username }}
+        password: ${{ inputs.password }}
+
+    - name: Login to GitHub Container Registry
+      if: ${{ github.event_name == 'release' || github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.ghcr_password != ''  }}
+      # https://github.com/docker/login-action/releases/tag/v3.4.0
+      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
+      with:
+        registry: ghcr.io
+        username: ${{ inputs.ghcr_username }}
+        password: ${{ inputs.ghcr_password }}

.github/workflows/arc-publish-chart.yaml

@@ -40,7 +40,7 @@ jobs:
       publish-chart: ${{ steps.publish-chart-step.outputs.publish }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -63,7 +63,7 @@ jobs:
           python-version: "3.11"
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f
+        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b
 
       - name: Run chart-testing (list-changed)
         id: list-changed
@@ -79,7 +79,7 @@ jobs:
 
       - name: Create kind cluster
         if: steps.list-changed.outputs.changed == 'true'
-        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc
+        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3
 
       # We need cert-manager already installed in the cluster because we assume the CRDs exist
       - name: Install cert-manager
@@ -134,7 +134,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -184,7 +184,7 @@ jobs:
       # this workaround is intended to move the index.yaml to the target repo
       # where the github pages are hosted
       - name: Checkout target repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
         with:
           repository: ${{ env.CHART_TARGET_ORG }}/${{ env.CHART_TARGET_REPO }}
           path: ${{ env.CHART_TARGET_REPO }}

.github/workflows/arc-publish.yaml

@@ -39,7 +39,7 @@ jobs:
     if: ${{ !startsWith(github.event.inputs.release_tag_name, 'gha-runner-scale-set-') }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
 
       - uses: actions/setup-go@v6
         with:
@@ -47,7 +47,9 @@ jobs:
 
       - name: Install tools
         run: |
-
+          curl -L -O https://github.com/kubernetes-sigs/kubebuilder/releases/download/v2.2.0/kubebuilder_2.2.0_linux_amd64.tar.gz
+          tar zxvf kubebuilder_2.2.0_linux_amd64.tar.gz
+          sudo mv kubebuilder_2.2.0_linux_amd64 /usr/local/kubebuilder
           curl -s https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh | bash
           sudo mv kustomize /usr/local/bin
           curl -L -O https://github.com/tcnksm/ghr/releases/download/v0.13.0/ghr_v0.13.0_linux_amd64.tar.gz

.github/workflows/arc-release-runners.yaml

@@ -1,6 +1,4 @@
 name: Release ARC Runner Images
-permissions:
-  contents: read
 
 # Revert to https://github.com/actions-runner-controller/releases#releases
 # for details on why we use this approach
@@ -19,7 +17,7 @@ env:
   PUSH_TO_REGISTRIES: true
   TARGET_ORG: actions-runner-controller
   TARGET_WORKFLOW: release-runners.yaml
-  DOCKER_VERSION: 28.0.4
+  DOCKER_VERSION: 24.0.7
 
 concurrency:
   group: ${{ github.workflow }}
@@ -30,7 +28,7 @@ jobs:
     name: Trigger Build and Push of Runner Images
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
       - name: Get runner version
         id: versions
         run: |

.github/workflows/arc-update-runners-scheduled.yaml

@@ -1,9 +1,6 @@
 # This workflows polls releases from actions/runner and in case of a new one it
 # updates files containing runner version and opens a pull request.
 name: Runner Updates Check (Scheduled Job)
-permissions:
-  pull-requests: write
-  contents: write
 
 on:
   schedule:
@@ -24,7 +21,7 @@ jobs:
       container_hooks_current_version: ${{ steps.container_hooks_versions.outputs.container_hooks_current_version }}
       container_hooks_latest_version: ${{ steps.container_hooks_versions.outputs.container_hooks_latest_version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
 
       - name: Get runner current and latest versions
         id: runner_versions
@@ -53,8 +50,6 @@ jobs:
   # it sets a PR name as output.
   check_pr:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     needs: check_versions
     if: needs.check_versions.outputs.runner_current_version != needs.check_versions.outputs.runner_latest_version || needs.check_versions.outputs.container_hooks_current_version != needs.check_versions.outputs.container_hooks_latest_version
     outputs:
@@ -69,7 +64,7 @@ jobs:
           echo "CONTAINER_HOOKS_CURRENT_VERSION=${{ needs.check_versions.outputs.container_hooks_current_version }}"
           echo "CONTAINER_HOOKS_LATEST_VERSION=${{ needs.check_versions.outputs.container_hooks_latest_version }}"
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
 
       - name: PR Name
         id: pr_name
@@ -124,7 +119,7 @@ jobs:
       PR_NAME: ${{ needs.check_pr.outputs.pr_name }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
 
       - name: New branch
         run: git checkout -b update-runner-"$(date +%Y-%m-%d)"

.github/workflows/arc-validate-chart.yaml

@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -55,7 +55,7 @@ jobs:
           python-version: "3.11"
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f
+        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b
 
       - name: Run chart-testing (list-changed)
         id: list-changed
@@ -70,7 +70,7 @@ jobs:
           ct lint --config charts/.ci/ct-config.yaml
 
       - name: Create kind cluster
-        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc
+        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3
         if: steps.list-changed.outputs.changed == 'true'
 
       # We need cert-manager already installed in the cluster because we assume the CRDs exist

.github/workflows/arc-validate-runners.yaml

@@ -24,7 +24,7 @@ jobs:
     name: runner / shellcheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
       - name: "Run shellcheck"
         run: make shellcheck
 
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
 
       - name: Run tests
         run: |

.github/workflows/gha-publish-chart.yaml

@@ -45,7 +45,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
         with:
           # If inputs.ref is empty, it'll resolve to the default branch
           ref: ${{ inputs.ref }}
@@ -72,10 +72,10 @@ jobs:
           echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
         with:
           # Pinning v0.9.1 for Buildx and BuildKit v0.10.6
           # BuildKit v0.11 which has a bug causing intermittent
@@ -84,14 +84,14 @@ jobs:
           driver-opts: image=moby/buildkit:v0.10.6
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build & push controller image
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
         with:
           file: Dockerfile
           platforms: linux/amd64,linux/arm64
@@ -119,7 +119,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
         with:
           # If inputs.ref is empty, it'll resolve to the default branch
           ref: ${{ inputs.ref }}
@@ -166,7 +166,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
         with:
           # If inputs.ref is empty, it'll resolve to the default branch
           ref: ${{ inputs.ref }}

.github/workflows/gha-validate-chart.yaml

@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -51,7 +51,7 @@ jobs:
           python-version: "3.11"
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f
+        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b
 
       - name: Run chart-testing (list-changed)
         id: list-changed
@@ -67,13 +67,13 @@ jobs:
           ct lint --config charts/.ci/ct-config-gha.yaml
 
       - name: Set up docker buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
         if: steps.list-changed.outputs.changed == 'true'
         with:
           version: latest
 
       - name: Build controller image
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
         if: steps.list-changed.outputs.changed == 'true'
         with:
           file: Dockerfile
@@ -88,7 +88,7 @@ jobs:
           cache-to: type=gha,mode=max
 
       - name: Create kind cluster
-        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc
+        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3
         if: steps.list-changed.outputs.changed == 'true'
         with:
           cluster_name: chart-testing
@@ -111,7 +111,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
       - uses: actions/setup-go@v6
         with:
           go-version-file: "go.mod"

.github/workflows/global-publish-canary.yaml

@@ -55,7 +55,7 @@ jobs:
       TARGET_REPO: actions-runner-controller
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
 
       - name: Get Token
         id: get_workflow_token
@@ -90,10 +90,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -110,16 +110,16 @@ jobs:
           echo "repository_owner=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
         with:
           version: latest
 
       # Unstable builds - run at your own risk
       - name: Build and Push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
         with:
           context: .
           file: ./Dockerfile

.github/workflows/global-run-codeql.yaml

@@ -25,7 +25,7 @@ jobs:
       security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
 
       - name: Install Go
         uses: actions/setup-go@v6
@@ -33,12 +33,12 @@ jobs:
           go-version-file: go.mod
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v3
         with:
           languages: go, actions
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@v3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v3

.github/workflows/global-run-first-interaction.yaml

@@ -1,10 +1,5 @@
 name: First Interaction
 
-permissions:
-  contents: read
-  issues: write
-  pull-requests: write
-
 on:
   issues:
     types: [opened]
@@ -16,19 +11,19 @@ jobs:
   check_for_first_interaction:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/first-interaction@v3
+      - uses: actions/checkout@v5
+      - uses: actions/first-interaction@main
         with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
-          issue_message: |
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          issue-message: |
             Hello! Thank you for filing an issue.
 
             The maintainers will triage your issue shortly.
 
             In the meantime, please take a look at the [troubleshooting guide](https://github.com/actions/actions-runner-controller/blob/master/TROUBLESHOOTING.md) for bug reports.
-
+            
             If this is a feature request, please review our [contribution guidelines](https://github.com/actions/actions-runner-controller/blob/master/CONTRIBUTING.md).
-          pr_message: |
+          pr-message: |
             Hello! Thank you for your contribution.
 
             Please review our [contribution guidelines](https://github.com/actions/actions-runner-controller/blob/master/CONTRIBUTING.md) to understand the project's testing and code conventions.

.github/workflows/go.yaml

@@ -29,7 +29,7 @@ jobs:
   fmt:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
       - uses: actions/setup-go@v6
         with:
           go-version-file: "go.mod"
@@ -42,21 +42,21 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
       - uses: actions/setup-go@v6
         with:
           go-version-file: "go.mod"
           cache: false
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9
         with:
           only-new-issues: true
-          version: v2.5.0
+          version: v2.1.2
 
   generate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
       - uses: actions/setup-go@v6
         with:
           go-version-file: "go.mod"
@@ -66,34 +66,23 @@ jobs:
       - name: Check diff
         run: git diff --exit-code
 
-  mocks:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version-file: "go.mod"
-          cache: false
-      - name: "Run mockery"
-        run: go tool github.com/vektra/mockery/v3
-      - name: Check diff
-        run: git diff --exit-code
-
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
       - uses: actions/setup-go@v6
         with:
           go-version-file: "go.mod"
       - run: make manifests
       - name: Check diff
         run: git diff --exit-code
-      - name: Setup envtest
+      - name: Install kubebuilder
         run: |
-          go install sigs.k8s.io/controller-runtime/tools/setup-envtest@$(go list -m -f '{{ .Version }}' sigs.k8s.io/controller-runtime | awk -F'[v.]' '{printf "release-%d.%d", $2, $3}')
-          ENVTEST_K8S_VERSION=$(go list -m -f '{{ .Version }}' k8s.io/api | awk -F'[v.]' '{printf "1.%d", $3}')
-          echo "KUBEBUILDER_ASSETS=$(setup-envtest use ${ENVTEST_K8S_VERSION} -p path)" >> $GITHUB_ENV
+          curl -D headers.txt -fsL "https://storage.googleapis.com/kubebuilder-tools/kubebuilder-tools-1.26.1-linux-amd64.tar.gz" -o kubebuilder-tools
+          echo "$(grep -i etag headers.txt -m 1 | cut -d'"' -f2) kubebuilder-tools" > sum
+          md5sum -c sum
+          tar -zvxf kubebuilder-tools
+          sudo mv kubebuilder /usr/local/
       - name: Run go tests
         run: |
           go test -short `go list ./... | grep -v ./test_e2e_arc`

.gitignore

@@ -34,5 +34,5 @@ bin
 # OS
 .DS_STORE
 
-
+/test-assets
 /.tools

.golangci.yaml

@@ -12,7 +12,3 @@ linters:
   exclusions:
     presets:
       - std-error-handling
-    rules:
-      - linters:
-          - staticcheck
-        text: "QF1008:"

.mockery.yaml

@@ -1,20 +0,0 @@
-packages:
-  github.com/actions/actions-runner-controller/github/actions:
-    config:
-      inpackage: true
-      dir: "{{.InterfaceDir}}"
-      filename: "mocks_test.go"
-      pkgname: "actions"
-    interfaces:
-      ActionsService:
-      SessionService:
-
-  github.com/actions/actions-runner-controller/cmd/ghalistener/metrics:
-    config:
-      inpackage: true
-      dir: "{{.InterfaceDir}}"
-      filename: "mocks_test.go"
-      pkgname: "metrics"
-    interfaces:
-      Recorder:
-      ServerExporter:

CONTRIBUTING.md

@@ -102,19 +102,22 @@ A set of example pipelines (./acceptance/pipelines) are provided in this reposit
 When raising a PR please run the relevant suites to prove your change hasn't broken anything.
 
 #### Running Ginkgo Tests
+
 You can run the integration test suite that is written in Ginkgo with:
 
 ```shell
 make test-with-deps
 ```
 
-This will install `setup-envtest`, download the required envtest binaries (etcd, kube-apiserver, kubectl), and then run `go test`.
+This will firstly install a few binaries required to setup the integration test environment and then runs `go test` to start the Ginkgo test.
 
-If you don't want to use `make`, install the envtest binaries using `setup-envtest`:
+If you don't want to use `make`, like when you're running tests from your IDE, install required binaries to `/usr/local/kubebuilder/bin`.
+That's the directory in which controller-runtime's `envtest` framework locates the binaries.
 
 ```shell
-go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
-export KUBEBUILDER_ASSETS=$(setup-envtest use -p path)
+sudo mkdir -p /usr/local/kubebuilder/bin
+make kube-apiserver etcd
+sudo mv test-assets/{etcd,kube-apiserver} /usr/local/kubebuilder/bin/
 go test -v -run TestAPIs github.com/actions/actions-runner-controller/controllers/actions.summerwind.net
 ```
 

Dockerfile

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM --platform=$BUILDPLATFORM golang:1.25.3 AS builder
+FROM --platform=$BUILDPLATFORM golang:1.24.3 AS builder
 
 WORKDIR /workspace
 

Makefile

@@ -6,7 +6,7 @@ endif
 DOCKER_USER ?= $(shell echo ${DOCKER_IMAGE_NAME} | cut -d / -f1)
 VERSION ?= dev
 COMMIT_SHA = $(shell git rev-parse HEAD)
-RUNNER_VERSION ?= 2.331.0
+RUNNER_VERSION ?= 2.328.0
 TARGETPLATFORM ?= $(shell arch)
 RUNNER_NAME ?= ${DOCKER_USER}/actions-runner
 RUNNER_TAG  ?= ${VERSION}
@@ -32,15 +32,21 @@ else
 GOBIN=$(shell go env GOBIN)
 endif
 
+TEST_ASSETS=$(PWD)/test-assets
 TOOLS_PATH=$(PWD)/.tools
 
 OS_NAME := $(shell uname -s | tr A-Z a-z)
 
-# ENVTEST_VERSION is the version of controller-runtime release branch to fetch the envtest setup script
-ENVTEST_VERSION ?= $(shell go list -m -f "{{ .Version }}" sigs.k8s.io/controller-runtime | awk -F'[v.]' '{printf "release-%d.%d", $$2, $$3}')
-# ENVTEST_K8S_VERSION is the version of Kubernetes to use for setting up ENVTEST binaries
-ENVTEST_K8S_VERSION ?= $(shell go list -m -f "{{ .Version }}" k8s.io/api | awk -F'[v.]' '{printf "1.%d", $$3}')
-ENVTEST ?= $(GOBIN)/setup-envtest
+# The etcd packages that coreos maintain use different extensions for each *nix OS on their github release page.
+# ETCD_EXTENSION: the storage format file extension listed on the release page.
+# EXTRACT_COMMAND: the  appropriate CLI command for extracting this file format.
+ifeq ($(OS_NAME), darwin)
+ETCD_EXTENSION:=zip
+EXTRACT_COMMAND:=unzip
+else
+ETCD_EXTENSION:=tar.gz
+EXTRACT_COMMAND:=tar -xzf
+endif
 
 # default list of platforms for which multiarch image is built
 ifeq (${PLATFORMS}, )
@@ -62,23 +68,22 @@ endif
 all: manager
 
 lint:
-	docker run --rm -v $(PWD):/app -w /app golangci/golangci-lint:v2.5.0 golangci-lint run
+	docker run --rm -v $(PWD):/app -w /app golangci/golangci-lint:v2.1.2 golangci-lint run
 
 GO_TEST_ARGS ?= -short
 
-
 # Run tests
-test: generate fmt vet manifests shellcheck setup-envtest
-	KUBEBUILDER_ASSETS="$$($(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(GOBIN) -p path)" \
-	  go test $(GO_TEST_ARGS) `go list ./... | grep -v ./test_e2e_arc` -coverprofile cover.out
-	KUBEBUILDER_ASSETS="$$($(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(GOBIN) -p path)" \
-	  go test -fuzz=Fuzz -fuzztime=10s -run=Fuzz* ./controllers/actions.summerwind.net
+test: generate fmt vet manifests shellcheck
+	go test $(GO_TEST_ARGS) `go list ./... | grep -v ./test_e2e_arc` -coverprofile cover.out
+	go test -fuzz=Fuzz -fuzztime=10s -run=Fuzz* ./controllers/actions.summerwind.net
 
-test-with-deps: setup-envtest
-	KUBEBUILDER_ASSETS="$$($(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(GOBIN) -p path)" \
+test-with-deps: kube-apiserver etcd kubectl
+	# See https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/envtest#pkg-constants
+	TEST_ASSET_KUBE_APISERVER=$(KUBE_APISERVER_BIN) \
+	TEST_ASSET_ETCD=$(ETCD_BIN) \
+	TEST_ASSET_KUBECTL=$(KUBECTL_BIN) \
 	  make test
 
-
 # Build manager binary
 manager: generate fmt vet
 	go build -o bin/manager main.go
@@ -205,6 +210,8 @@ docker-buildx:
 		docker buildx create --platform ${PLATFORMS} --name container-builder --use;\
 	fi
 	docker buildx build --platform ${PLATFORMS} \
+		--build-arg RUNNER_VERSION=${RUNNER_VERSION} \
+		--build-arg DOCKER_VERSION=${DOCKER_VERSION} \
 		--build-arg VERSION=${VERSION} \
 		--build-arg COMMIT_SHA=${COMMIT_SHA} \
 		-t "${DOCKER_IMAGE_NAME}:${VERSION}" \
@@ -290,10 +297,6 @@ acceptance/runner/startup:
 e2e:
 	go test -count=1 -v -timeout 600s -run '^TestE2E$$' ./test/e2e
 
-.PHONY: gha-e2e
-gha-e2e:
-	bash hack/e2e-test.sh
-
 # Upload release file to GitHub.
 github-release: release
 	ghr ${VERSION} release/
@@ -314,7 +317,7 @@ ifeq (, $(wildcard $(GOBIN)/controller-gen))
 	CONTROLLER_GEN_TMP_DIR=$$(mktemp -d) ;\
 	cd $$CONTROLLER_GEN_TMP_DIR ;\
 	go mod init tmp ;\
-	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.19.0 ;\
+	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.17.2 ;\
 	rm -rf $$CONTROLLER_GEN_TMP_DIR ;\
 	}
 endif
@@ -359,29 +362,68 @@ ifeq (, $(wildcard $(TOOLS_PATH)/shellcheck))
 endif
 SHELLCHECK=$(TOOLS_PATH)/shellcheck
 
-# find or download envtest
-envtest:
-ifeq (, $(shell which setup-envtest))
-ifeq (, $(wildcard $(GOBIN)/setup-envtest))
+# find or download etcd
+etcd:
+ifeq (, $(shell which etcd))
+ifeq (, $(wildcard $(TEST_ASSETS)/etcd))
 	@{ \
-	set -e ;\
-	ENVTEST_TMP_DIR=$$(mktemp -d) ;\
-	cd $$ENVTEST_TMP_DIR ;\
-	go mod init tmp ;\
-	go install sigs.k8s.io/controller-runtime/tools/setup-envtest@$(ENVTEST_VERSION) ;\
-	rm -rf $$ENVTEST_TMP_DIR ;\
+	set -xe ;\
+	INSTALL_TMP_DIR=$$(mktemp -d) ;\
+	cd $$INSTALL_TMP_DIR ;\
+	wget https://github.com/coreos/etcd/releases/download/v3.4.22/etcd-v3.4.22-$(OS_NAME)-amd64.$(ETCD_EXTENSION);\
+	mkdir -p $(TEST_ASSETS) ;\
+	$(EXTRACT_COMMAND) etcd-v3.4.22-$(OS_NAME)-amd64.$(ETCD_EXTENSION) ;\
+	mv etcd-v3.4.22-$(OS_NAME)-amd64/etcd $(TEST_ASSETS)/etcd ;\
+	rm -rf $$INSTALL_TMP_DIR ;\
 	}
-endif
-ENVTEST=$(GOBIN)/setup-envtest
+ETCD_BIN=$(TEST_ASSETS)/etcd
 else
-ENVTEST=$(shell which setup-envtest)
+ETCD_BIN=$(TEST_ASSETS)/etcd
+endif
+else
+ETCD_BIN=$(shell which etcd)
 endif
 
-.PHONY: setup-envtest
-setup-envtest: envtest
-	@echo "Setting up envtest binaries for Kubernetes version $(ENVTEST_K8S_VERSION)..."
-	@$(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(GOBIN) -p path || { \
-		echo "Error: Failed to set up envtest binaries for version $(ENVTEST_K8S_VERSION)."; \
-		exit 1; \
+# find or download kube-apiserver
+kube-apiserver:
+ifeq (, $(shell which kube-apiserver))
+ifeq (, $(wildcard $(TEST_ASSETS)/kube-apiserver))
+	@{ \
+	set -xe ;\
+	INSTALL_TMP_DIR=$$(mktemp -d) ;\
+	cd $$INSTALL_TMP_DIR ;\
+	wget https://github.com/kubernetes-sigs/kubebuilder/releases/download/v2.3.2/kubebuilder_2.3.2_$(OS_NAME)_amd64.tar.gz ;\
+	mkdir -p $(TEST_ASSETS) ;\
+	tar zxvf kubebuilder_2.3.2_$(OS_NAME)_amd64.tar.gz ;\
+	mv kubebuilder_2.3.2_$(OS_NAME)_amd64/bin/kube-apiserver $(TEST_ASSETS)/kube-apiserver ;\
+	rm -rf $$INSTALL_TMP_DIR ;\
 	}
+KUBE_APISERVER_BIN=$(TEST_ASSETS)/kube-apiserver
+else
+KUBE_APISERVER_BIN=$(TEST_ASSETS)/kube-apiserver
+endif
+else
+KUBE_APISERVER_BIN=$(shell which kube-apiserver)
+endif
 
+# find or download kubectl
+kubectl:
+ifeq (, $(shell which kubectl))
+ifeq (, $(wildcard $(TEST_ASSETS)/kubectl))
+	@{ \
+	set -xe ;\
+	INSTALL_TMP_DIR=$$(mktemp -d) ;\
+	cd $$INSTALL_TMP_DIR ;\
+	wget https://github.com/kubernetes-sigs/kubebuilder/releases/download/v2.3.2/kubebuilder_2.3.2_$(OS_NAME)_amd64.tar.gz ;\
+	mkdir -p $(TEST_ASSETS) ;\
+	tar zxvf kubebuilder_2.3.2_$(OS_NAME)_amd64.tar.gz ;\
+	mv kubebuilder_2.3.2_$(OS_NAME)_amd64/bin/kubectl $(TEST_ASSETS)/kubectl ;\
+	rm -rf $$INSTALL_TMP_DIR ;\
+	}
+KUBECTL_BIN=$(TEST_ASSETS)/kubectl
+else
+KUBECTL_BIN=$(TEST_ASSETS)/kubectl
+endif
+else
+KUBECTL_BIN=$(shell which kubectl)
+endif

charts/actions-runner-controller/crds/actions.summerwind.dev_horizontalrunnerautoscalers.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: horizontalrunnerautoscalers.actions.summerwind.dev
 spec:
   group: actions.summerwind.dev

charts/actions-runner-controller/crds/actions.summerwind.dev_runnersets.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: runnersets.actions.summerwind.dev
 spec:
   group: actions.summerwind.dev
@@ -554,6 +554,7 @@ spec:
                                               pod labels will be ignored. The default value is empty.
                                               The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                               Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                              This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                             items:
                                               type: string
                                             type: array
@@ -568,6 +569,7 @@ spec:
                                               pod labels will be ignored. The default value is empty.
                                               The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                               Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                              This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                             items:
                                               type: string
                                             type: array
@@ -728,6 +730,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                           Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -742,6 +745,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                           Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -830,8 +834,8 @@ spec:
                                     most preferred is the one with the greatest sum of weights, i.e.
                                     for each node that meets all of the scheduling requirements (resource
                                     request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                    compute a sum by iterating through the elements of this field and subtracting
-                                    "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                    compute a sum by iterating through the elements of this field and adding
+                                    "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                     node(s) with the highest sum are the most preferred.
                                   items:
                                     description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
@@ -895,6 +899,7 @@ spec:
                                               pod labels will be ignored. The default value is empty.
                                               The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                               Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                              This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                             items:
                                               type: string
                                             type: array
@@ -909,6 +914,7 @@ spec:
                                               pod labels will be ignored. The default value is empty.
                                               The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                               Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                              This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                             items:
                                               type: string
                                             type: array
@@ -1069,6 +1075,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                           Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -1083,6 +1090,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                           Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -1209,9 +1217,7 @@ spec:
                                   description: EnvVar represents an environment variable present in a Container.
                                   properties:
                                     name:
-                                      description: |-
-                                        Name of the environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: Name of the environment variable. Must be a C_IDENTIFIER.
                                       type: string
                                     value:
                                       description: |-
@@ -1265,42 +1271,6 @@ spec:
                                             - fieldPath
                                           type: object
                                           x-kubernetes-map-type: atomic
-                                        fileKeyRef:
-                                          description: |-
-                                            FileKeyRef selects a key of the env file.
-                                            Requires the EnvFiles feature gate to be enabled.
-                                          properties:
-                                            key:
-                                              description: |-
-                                                The key within the env file. An invalid key will prevent the pod from starting.
-                                                The keys defined within a source may consist of any printable ASCII characters except '='.
-                                                During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                              type: string
-                                            optional:
-                                              default: false
-                                              description: |-
-                                                Specify whether the file or its key must be defined. If the file or key
-                                                does not exist, then the env var is not published.
-                                                If optional is set to true and the specified key does not exist,
-                                                the environment variable will not be set in the Pod's containers.
-
-                                                If optional is set to false and the specified key does not exist,
-                                                an error will be returned during Pod creation.
-                                              type: boolean
-                                            path:
-                                              description: |-
-                                                The path within the volume from which to select the file.
-                                                Must be relative and may not contain the '..' path or start with '..'.
-                                              type: string
-                                            volumeName:
-                                              description: The name of the volume mount containing the env file.
-                                              type: string
-                                          required:
-                                            - key
-                                            - path
-                                            - volumeName
-                                          type: object
-                                          x-kubernetes-map-type: atomic
                                         resourceFieldRef:
                                           description: |-
                                             Selects a resource of the container: only resources limits and requests
@@ -1356,13 +1326,13 @@ spec:
                               envFrom:
                                 description: |-
                                   List of sources to populate environment variables in the container.
-                                  The keys defined within a source may consist of any printable ASCII characters except '='.
-                                  When a key exists in multiple
+                                  The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                  will be reported as an event when the container is starting. When a key exists in multiple
                                   sources, the value associated with the last source will take precedence.
                                   Values defined by an Env with a duplicate key will take precedence.
                                   Cannot be updated.
                                 items:
-                                  description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                                  description: EnvFromSource represents the source of a set of ConfigMaps
                                   properties:
                                     configMapRef:
                                       description: The ConfigMap to select from
@@ -1382,9 +1352,7 @@ spec:
                                       type: object
                                       x-kubernetes-map-type: atomic
                                     prefix:
-                                      description: |-
-                                        Optional text to prepend to the name of each environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                       type: string
                                     secretRef:
                                       description: The Secret to select from
@@ -1633,12 +1601,6 @@ spec:
                                           - port
                                         type: object
                                     type: object
-                                  stopSignal:
-                                    description: |-
-                                      StopSignal defines which signal will be sent to a container when it is being stopped.
-                                      If not specified, the default is defined by the container runtime in use.
-                                      StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                    type: string
                                 type: object
                               livenessProbe:
                                 description: |-
@@ -2029,7 +1991,7 @@ spec:
                                       Claims lists the names of resources, defined in spec.resourceClaims,
                                       that are used by this container.
 
-                                      This field depends on the
+                                      This is an alpha field and requires enabling the
                                       DynamicResourceAllocation feature gate.
 
                                       This field is immutable. It can only be set for containers.
@@ -2080,10 +2042,10 @@ spec:
                               restartPolicy:
                                 description: |-
                                   RestartPolicy defines the restart behavior of individual containers in a pod.
-                                  This overrides the pod-level restart policy. When this field is not specified,
+                                  This field may only be set for init containers, and the only allowed value is "Always".
+                                  For non-init containers or when this field is not specified,
                                   the restart behavior is defined by the Pod's restart policy and the container type.
-                                  Additionally, setting the RestartPolicy as "Always" for the init container will
-                                  have the following effect:
+                                  Setting the RestartPolicy as "Always" for the init container will have the following effect:
                                   this init container will be continually restarted on
                                   exit until all regular containers have terminated. Once all regular
                                   containers have completed, all init containers with restartPolicy "Always"
@@ -2095,57 +2057,6 @@ spec:
                                   init container is started, or after any startupProbe has successfully
                                   completed.
                                 type: string
-                              restartPolicyRules:
-                                description: |-
-                                  Represents a list of rules to be checked to determine if the
-                                  container should be restarted on exit. The rules are evaluated in
-                                  order. Once a rule matches a container exit condition, the remaining
-                                  rules are ignored. If no rule matches the container exit condition,
-                                  the Container-level restart policy determines the whether the container
-                                  is restarted or not. Constraints on the rules:
-                                  - At most 20 rules are allowed.
-                                  - Rules can have the same action.
-                                  - Identical rules are not forbidden in validations.
-                                  When rules are specified, container MUST set RestartPolicy explicitly
-                                  even it if matches the Pod's RestartPolicy.
-                                items:
-                                  description: ContainerRestartRule describes how a container exit is handled.
-                                  properties:
-                                    action:
-                                      description: |-
-                                        Specifies the action taken on a container exit if the requirements
-                                        are satisfied. The only possible value is "Restart" to restart the
-                                        container.
-                                      type: string
-                                    exitCodes:
-                                      description: Represents the exit codes to check on container exits.
-                                      properties:
-                                        operator:
-                                          description: |-
-                                            Represents the relationship between the container exit code(s) and the
-                                            specified values. Possible values are:
-                                            - In: the requirement is satisfied if the container exit code is in the
-                                              set of specified values.
-                                            - NotIn: the requirement is satisfied if the container exit code is
-                                              not in the set of specified values.
-                                          type: string
-                                        values:
-                                          description: |-
-                                            Specifies the set of values to check for container exit codes.
-                                            At most 255 elements are allowed.
-                                          items:
-                                            format: int32
-                                            type: integer
-                                          type: array
-                                          x-kubernetes-list-type: set
-                                      required:
-                                        - operator
-                                      type: object
-                                  required:
-                                    - action
-                                  type: object
-                                type: array
-                                x-kubernetes-list-type: atomic
                               securityContext:
                                 description: |-
                                   SecurityContext defines the security options the container should be run with.
@@ -2743,9 +2654,7 @@ spec:
                                   description: EnvVar represents an environment variable present in a Container.
                                   properties:
                                     name:
-                                      description: |-
-                                        Name of the environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: Name of the environment variable. Must be a C_IDENTIFIER.
                                       type: string
                                     value:
                                       description: |-
@@ -2799,42 +2708,6 @@ spec:
                                             - fieldPath
                                           type: object
                                           x-kubernetes-map-type: atomic
-                                        fileKeyRef:
-                                          description: |-
-                                            FileKeyRef selects a key of the env file.
-                                            Requires the EnvFiles feature gate to be enabled.
-                                          properties:
-                                            key:
-                                              description: |-
-                                                The key within the env file. An invalid key will prevent the pod from starting.
-                                                The keys defined within a source may consist of any printable ASCII characters except '='.
-                                                During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                              type: string
-                                            optional:
-                                              default: false
-                                              description: |-
-                                                Specify whether the file or its key must be defined. If the file or key
-                                                does not exist, then the env var is not published.
-                                                If optional is set to true and the specified key does not exist,
-                                                the environment variable will not be set in the Pod's containers.
-
-                                                If optional is set to false and the specified key does not exist,
-                                                an error will be returned during Pod creation.
-                                              type: boolean
-                                            path:
-                                              description: |-
-                                                The path within the volume from which to select the file.
-                                                Must be relative and may not contain the '..' path or start with '..'.
-                                              type: string
-                                            volumeName:
-                                              description: The name of the volume mount containing the env file.
-                                              type: string
-                                          required:
-                                            - key
-                                            - path
-                                            - volumeName
-                                          type: object
-                                          x-kubernetes-map-type: atomic
                                         resourceFieldRef:
                                           description: |-
                                             Selects a resource of the container: only resources limits and requests
@@ -2890,13 +2763,13 @@ spec:
                               envFrom:
                                 description: |-
                                   List of sources to populate environment variables in the container.
-                                  The keys defined within a source may consist of any printable ASCII characters except '='.
-                                  When a key exists in multiple
+                                  The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                  will be reported as an event when the container is starting. When a key exists in multiple
                                   sources, the value associated with the last source will take precedence.
                                   Values defined by an Env with a duplicate key will take precedence.
                                   Cannot be updated.
                                 items:
-                                  description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                                  description: EnvFromSource represents the source of a set of ConfigMaps
                                   properties:
                                     configMapRef:
                                       description: The ConfigMap to select from
@@ -2916,9 +2789,7 @@ spec:
                                       type: object
                                       x-kubernetes-map-type: atomic
                                     prefix:
-                                      description: |-
-                                        Optional text to prepend to the name of each environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                       type: string
                                     secretRef:
                                       description: The Secret to select from
@@ -3163,12 +3034,6 @@ spec:
                                           - port
                                         type: object
                                     type: object
-                                  stopSignal:
-                                    description: |-
-                                      StopSignal defines which signal will be sent to a container when it is being stopped.
-                                      If not specified, the default is defined by the container runtime in use.
-                                      StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                    type: string
                                 type: object
                               livenessProbe:
                                 description: Probes are not allowed for ephemeral containers.
@@ -3542,7 +3407,7 @@ spec:
                                       Claims lists the names of resources, defined in spec.resourceClaims,
                                       that are used by this container.
 
-                                      This field depends on the
+                                      This is an alpha field and requires enabling the
                                       DynamicResourceAllocation feature gate.
 
                                       This field is immutable. It can only be set for containers.
@@ -3594,51 +3459,9 @@ spec:
                                 description: |-
                                   Restart policy for the container to manage the restart behavior of each
                                   container within a pod.
-                                  You cannot set this field on ephemeral containers.
-                                type: string
-                              restartPolicyRules:
-                                description: |-
-                                  Represents a list of rules to be checked to determine if the
-                                  container should be restarted on exit. You cannot set this field on
+                                  This may only be set for init containers. You cannot set this field on
                                   ephemeral containers.
-                                items:
-                                  description: ContainerRestartRule describes how a container exit is handled.
-                                  properties:
-                                    action:
-                                      description: |-
-                                        Specifies the action taken on a container exit if the requirements
-                                        are satisfied. The only possible value is "Restart" to restart the
-                                        container.
-                                      type: string
-                                    exitCodes:
-                                      description: Represents the exit codes to check on container exits.
-                                      properties:
-                                        operator:
-                                          description: |-
-                                            Represents the relationship between the container exit code(s) and the
-                                            specified values. Possible values are:
-                                            - In: the requirement is satisfied if the container exit code is in the
-                                              set of specified values.
-                                            - NotIn: the requirement is satisfied if the container exit code is
-                                              not in the set of specified values.
-                                          type: string
-                                        values:
-                                          description: |-
-                                            Specifies the set of values to check for container exit codes.
-                                            At most 255 elements are allowed.
-                                          items:
-                                            format: int32
-                                            type: integer
-                                          type: array
-                                          x-kubernetes-list-type: set
-                                      required:
-                                        - operator
-                                      type: object
-                                  required:
-                                    - action
-                                  type: object
-                                type: array
-                                x-kubernetes-list-type: atomic
+                                type: string
                               securityContext:
                                 description: |-
                                   Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -4157,9 +3980,7 @@ spec:
                         hostNetwork:
                           description: |-
                             Host networking requested for this pod. Use the host's network namespace.
-                            When using HostNetwork you should specify ports so the scheduler is aware.
-                            When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
-                            and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
+                            If this option is set, the ports that will be used must be specified.
                             Default to false.
                           type: boolean
                         hostPID:
@@ -4184,19 +4005,6 @@ spec:
                             Specifies the hostname of the Pod
                             If not specified, the pod's hostname will be set to a system-defined value.
                           type: string
-                        hostnameOverride:
-                          description: |-
-                            HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
-                            This field only specifies the pod's hostname and does not affect its DNS records.
-                            When this field is set to a non-empty string:
-                            - It takes precedence over the values set in `hostname` and `subdomain`.
-                            - The Pod's hostname will be set to this value.
-                            - `setHostnameAsFQDN` must be nil or set to false.
-                            - `hostNetwork` must be set to false.
-
-                            This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
-                            Requires the HostnameOverride feature gate to be enabled.
-                          type: string
                         imagePullSecrets:
                           description: |-
                             ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -4232,7 +4040,7 @@ spec:
                             Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.
                             The resourceRequirements of an init container are taken into account during scheduling
                             by finding the highest request/limit for each resource type, and then using the max of
-                            that value or the sum of the normal containers. Limits are applied to init containers
+                            of that value or the sum of the normal containers. Limits are applied to init containers
                             in a similar fashion.
                             Init containers cannot currently be added or removed.
                             Cannot be updated.
@@ -4276,9 +4084,7 @@ spec:
                                   description: EnvVar represents an environment variable present in a Container.
                                   properties:
                                     name:
-                                      description: |-
-                                        Name of the environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: Name of the environment variable. Must be a C_IDENTIFIER.
                                       type: string
                                     value:
                                       description: |-
@@ -4332,42 +4138,6 @@ spec:
                                             - fieldPath
                                           type: object
                                           x-kubernetes-map-type: atomic
-                                        fileKeyRef:
-                                          description: |-
-                                            FileKeyRef selects a key of the env file.
-                                            Requires the EnvFiles feature gate to be enabled.
-                                          properties:
-                                            key:
-                                              description: |-
-                                                The key within the env file. An invalid key will prevent the pod from starting.
-                                                The keys defined within a source may consist of any printable ASCII characters except '='.
-                                                During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                              type: string
-                                            optional:
-                                              default: false
-                                              description: |-
-                                                Specify whether the file or its key must be defined. If the file or key
-                                                does not exist, then the env var is not published.
-                                                If optional is set to true and the specified key does not exist,
-                                                the environment variable will not be set in the Pod's containers.
-
-                                                If optional is set to false and the specified key does not exist,
-                                                an error will be returned during Pod creation.
-                                              type: boolean
-                                            path:
-                                              description: |-
-                                                The path within the volume from which to select the file.
-                                                Must be relative and may not contain the '..' path or start with '..'.
-                                              type: string
-                                            volumeName:
-                                              description: The name of the volume mount containing the env file.
-                                              type: string
-                                          required:
-                                            - key
-                                            - path
-                                            - volumeName
-                                          type: object
-                                          x-kubernetes-map-type: atomic
                                         resourceFieldRef:
                                           description: |-
                                             Selects a resource of the container: only resources limits and requests
@@ -4423,13 +4193,13 @@ spec:
                               envFrom:
                                 description: |-
                                   List of sources to populate environment variables in the container.
-                                  The keys defined within a source may consist of any printable ASCII characters except '='.
-                                  When a key exists in multiple
+                                  The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                  will be reported as an event when the container is starting. When a key exists in multiple
                                   sources, the value associated with the last source will take precedence.
                                   Values defined by an Env with a duplicate key will take precedence.
                                   Cannot be updated.
                                 items:
-                                  description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                                  description: EnvFromSource represents the source of a set of ConfigMaps
                                   properties:
                                     configMapRef:
                                       description: The ConfigMap to select from
@@ -4449,9 +4219,7 @@ spec:
                                       type: object
                                       x-kubernetes-map-type: atomic
                                     prefix:
-                                      description: |-
-                                        Optional text to prepend to the name of each environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                       type: string
                                     secretRef:
                                       description: The Secret to select from
@@ -4700,12 +4468,6 @@ spec:
                                           - port
                                         type: object
                                     type: object
-                                  stopSignal:
-                                    description: |-
-                                      StopSignal defines which signal will be sent to a container when it is being stopped.
-                                      If not specified, the default is defined by the container runtime in use.
-                                      StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                    type: string
                                 type: object
                               livenessProbe:
                                 description: |-
@@ -5096,7 +4858,7 @@ spec:
                                       Claims lists the names of resources, defined in spec.resourceClaims,
                                       that are used by this container.
 
-                                      This field depends on the
+                                      This is an alpha field and requires enabling the
                                       DynamicResourceAllocation feature gate.
 
                                       This field is immutable. It can only be set for containers.
@@ -5147,10 +4909,10 @@ spec:
                               restartPolicy:
                                 description: |-
                                   RestartPolicy defines the restart behavior of individual containers in a pod.
-                                  This overrides the pod-level restart policy. When this field is not specified,
+                                  This field may only be set for init containers, and the only allowed value is "Always".
+                                  For non-init containers or when this field is not specified,
                                   the restart behavior is defined by the Pod's restart policy and the container type.
-                                  Additionally, setting the RestartPolicy as "Always" for the init container will
-                                  have the following effect:
+                                  Setting the RestartPolicy as "Always" for the init container will have the following effect:
                                   this init container will be continually restarted on
                                   exit until all regular containers have terminated. Once all regular
                                   containers have completed, all init containers with restartPolicy "Always"
@@ -5162,57 +4924,6 @@ spec:
                                   init container is started, or after any startupProbe has successfully
                                   completed.
                                 type: string
-                              restartPolicyRules:
-                                description: |-
-                                  Represents a list of rules to be checked to determine if the
-                                  container should be restarted on exit. The rules are evaluated in
-                                  order. Once a rule matches a container exit condition, the remaining
-                                  rules are ignored. If no rule matches the container exit condition,
-                                  the Container-level restart policy determines the whether the container
-                                  is restarted or not. Constraints on the rules:
-                                  - At most 20 rules are allowed.
-                                  - Rules can have the same action.
-                                  - Identical rules are not forbidden in validations.
-                                  When rules are specified, container MUST set RestartPolicy explicitly
-                                  even it if matches the Pod's RestartPolicy.
-                                items:
-                                  description: ContainerRestartRule describes how a container exit is handled.
-                                  properties:
-                                    action:
-                                      description: |-
-                                        Specifies the action taken on a container exit if the requirements
-                                        are satisfied. The only possible value is "Restart" to restart the
-                                        container.
-                                      type: string
-                                    exitCodes:
-                                      description: Represents the exit codes to check on container exits.
-                                      properties:
-                                        operator:
-                                          description: |-
-                                            Represents the relationship between the container exit code(s) and the
-                                            specified values. Possible values are:
-                                            - In: the requirement is satisfied if the container exit code is in the
-                                              set of specified values.
-                                            - NotIn: the requirement is satisfied if the container exit code is
-                                              not in the set of specified values.
-                                          type: string
-                                        values:
-                                          description: |-
-                                            Specifies the set of values to check for container exit codes.
-                                            At most 255 elements are allowed.
-                                          items:
-                                            format: int32
-                                            type: integer
-                                          type: array
-                                          x-kubernetes-list-type: set
-                                      required:
-                                        - operator
-                                      type: object
-                                  required:
-                                    - action
-                                  type: object
-                                type: array
-                                x-kubernetes-list-type: atomic
                               securityContext:
                                 description: |-
                                   SecurityContext defines the security options the container should be run with.
@@ -5726,7 +5437,6 @@ spec:
                             - spec.hostPID
                             - spec.hostIPC
                             - spec.hostUsers
-                            - spec.resources
                             - spec.securityContext.appArmorProfile
                             - spec.securityContext.seLinuxOptions
                             - spec.securityContext.seccompProfile
@@ -5878,7 +5588,7 @@ spec:
                           description: |-
                             Resources is the total amount of CPU and Memory resources required by all
                             containers in the pod. It supports specifying Requests and Limits for
-                            "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
+                            "cpu" and "memory" resource names only. ResourceClaims are not supported.
 
                             This field enables fine-grained control over resource allocation for the
                             entire pod, allowing resource sharing among containers in a pod.
@@ -5891,7 +5601,7 @@ spec:
                                 Claims lists the names of resources, defined in spec.resourceClaims,
                                 that are used by this container.
 
-                                This field depends on the
+                                This is an alpha field and requires enabling the
                                 DynamicResourceAllocation feature gate.
 
                                 This field is immutable. It can only be set for containers.
@@ -6416,6 +6126,7 @@ spec:
                                   - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
 
                                   If this value is nil, the behavior is equivalent to the Honor policy.
+                                  This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                                 type: string
                               nodeTaintsPolicy:
                                 description: |-
@@ -6426,6 +6137,7 @@ spec:
                                   - Ignore: node taints are ignored. All nodes are included.
 
                                   If this value is nil, the behavior is equivalent to the Ignore policy.
+                                  This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                                 type: string
                               topologyKey:
                                 description: |-
@@ -7131,13 +6843,15 @@ spec:
                                               volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                               If specified, the CSI driver will create or update the volume with the attributes defined
                                               in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                              it can be changed after the claim is created. An empty string or nil value indicates that no
-                                              VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
-                                              this field can be reset to its previous value (including nil) to cancel the modification.
+                                              it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
+                                              will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
+                                              If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
+                                              will be set by the persistentvolume controller if it exists.
                                               If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                               set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                               exists.
                                               More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
+                                              (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                             type: string
                                           volumeMode:
                                             description: |-
@@ -7311,9 +7025,12 @@ spec:
                                 description: |-
                                   glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                   Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
+                                  More info: https://examples.k8s.io/volumes/glusterfs/README.md
                                 properties:
                                   endpoints:
-                                    description: endpoints is the endpoint name that details Glusterfs topology.
+                                    description: |-
+                                      endpoints is the endpoint name that details Glusterfs topology.
+                                      More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
                                     type: string
                                   path:
                                     description: |-
@@ -7367,7 +7084,7 @@ spec:
                                   The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
                                   The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
                                   The volume will be mounted read-only (ro) and non-executable files (noexec).
-                                  Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
+                                  Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
                                   The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
                                 properties:
                                   pullPolicy:
@@ -7392,7 +7109,7 @@ spec:
                                 description: |-
                                   iscsi represents an ISCSI Disk resource that is attached to a
                                   kubelet's host machine and then exposed to the pod.
-                                  More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
+                                  More info: https://examples.k8s.io/volumes/iscsi/README.md
                                 properties:
                                   chapAuthDiscovery:
                                     description: chapAuthDiscovery defines whether support iSCSI Discovery CHAP authentication
@@ -7782,110 +7499,6 @@ spec:
                                               type: array
                                               x-kubernetes-list-type: atomic
                                           type: object
-                                        podCertificate:
-                                          description: |-
-                                            Projects an auto-rotating credential bundle (private key and certificate
-                                            chain) that the pod can use either as a TLS client or server.
-
-                                            Kubelet generates a private key and uses it to send a
-                                            PodCertificateRequest to the named signer.  Once the signer approves the
-                                            request and issues a certificate chain, Kubelet writes the key and
-                                            certificate chain to the pod filesystem.  The pod does not start until
-                                            certificates have been issued for each podCertificate projected volume
-                                            source in its spec.
-
-                                            Kubelet will begin trying to rotate the certificate at the time indicated
-                                            by the signer using the PodCertificateRequest.Status.BeginRefreshAt
-                                            timestamp.
-
-                                            Kubelet can write a single file, indicated by the credentialBundlePath
-                                            field, or separate files, indicated by the keyPath and
-                                            certificateChainPath fields.
-
-                                            The credential bundle is a single file in PEM format.  The first PEM
-                                            entry is the private key (in PKCS#8 format), and the remaining PEM
-                                            entries are the certificate chain issued by the signer (typically,
-                                            signers will return their certificate chain in leaf-to-root order).
-
-                                            Prefer using the credential bundle format, since your application code
-                                            can read it atomically.  If you use keyPath and certificateChainPath,
-                                            your application must make two separate file reads. If these coincide
-                                            with a certificate rotation, it is possible that the private key and leaf
-                                            certificate you read may not correspond to each other.  Your application
-                                            will need to check for this condition, and re-read until they are
-                                            consistent.
-
-                                            The named signer controls chooses the format of the certificate it
-                                            issues; consult the signer implementation's documentation to learn how to
-                                            use the certificates it issues.
-                                          properties:
-                                            certificateChainPath:
-                                              description: |-
-                                                Write the certificate chain at this path in the projected volume.
-
-                                                Most applications should use credentialBundlePath.  When using keyPath
-                                                and certificateChainPath, your application needs to check that the key
-                                                and leaf certificate are consistent, because it is possible to read the
-                                                files mid-rotation.
-                                              type: string
-                                            credentialBundlePath:
-                                              description: |-
-                                                Write the credential bundle at this path in the projected volume.
-
-                                                The credential bundle is a single file that contains multiple PEM blocks.
-                                                The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
-                                                key.
-
-                                                The remaining blocks are CERTIFICATE blocks, containing the issued
-                                                certificate chain from the signer (leaf and any intermediates).
-
-                                                Using credentialBundlePath lets your Pod's application code make a single
-                                                atomic read that retrieves a consistent key and certificate chain.  If you
-                                                project them to separate files, your application code will need to
-                                                additionally check that the leaf certificate was issued to the key.
-                                              type: string
-                                            keyPath:
-                                              description: |-
-                                                Write the key at this path in the projected volume.
-
-                                                Most applications should use credentialBundlePath.  When using keyPath
-                                                and certificateChainPath, your application needs to check that the key
-                                                and leaf certificate are consistent, because it is possible to read the
-                                                files mid-rotation.
-                                              type: string
-                                            keyType:
-                                              description: |-
-                                                The type of keypair Kubelet will generate for the pod.
-
-                                                Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
-                                                "ECDSAP521", and "ED25519".
-                                              type: string
-                                            maxExpirationSeconds:
-                                              description: |-
-                                                maxExpirationSeconds is the maximum lifetime permitted for the
-                                                certificate.
-
-                                                Kubelet copies this value verbatim into the PodCertificateRequests it
-                                                generates for this projection.
-
-                                                If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
-                                                will reject values shorter than 3600 (1 hour).  The maximum allowable
-                                                value is 7862400 (91 days).
-
-                                                The signer implementation is then free to issue a certificate with any
-                                                lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
-                                                seconds (1 hour).  This constraint is enforced by kube-apiserver.
-                                                `kubernetes.io` signers will never issue certificates with a lifetime
-                                                longer than 24 hours.
-                                              format: int32
-                                              type: integer
-                                            signerName:
-                                              description: Kubelet's generated CSRs will be addressed to this signer.
-                                              type: string
-                                          required:
-                                            - keyType
-                                            - signerName
-                                          type: object
                                         secret:
                                           description: secret information about the secret data to project
                                           properties:
@@ -8015,6 +7628,7 @@ spec:
                                 description: |-
                                   rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                   Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
+                                  More info: https://examples.k8s.io/volumes/rbd/README.md
                                 properties:
                                   fsType:
                                     description: |-
@@ -8556,13 +8170,15 @@ spec:
                               volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                               If specified, the CSI driver will create or update the volume with the attributes defined
                               in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                              it can be changed after the claim is created. An empty string or nil value indicates that no
-                              VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
-                              this field can be reset to its previous value (including nil) to cancel the modification.
+                              it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
+                              will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
+                              If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
+                              will be set by the persistentvolume controller if it exists.
                               If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                               set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                               exists.
                               More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
+                              (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                             type: string
                           volumeMode:
                             description: |-
@@ -8662,11 +8278,13 @@ spec:
                             description: |-
                               currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
                               When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
+                              This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                             type: string
                           modifyVolumeStatus:
                             description: |-
                               ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
                               When this is unset, there is no ModifyVolume operation being attempted.
+                              This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                             properties:
                               status:
                                 description: "status is the status of the ControllerModifyVolume operation. It can be in any of following states:\n - Pending\n   Pending indicates that the PersistentVolumeClaim cannot be modified due to unmet requirements, such as\n   the specified VolumeAttributesClass not existing.\n - InProgress\n   InProgress indicates that the volume is being modified.\n - Infeasible\n  Infeasible indicates that the request has been rejected as invalid by the CSI driver. To\n\t  resolve the error, a valid VolumeAttributesClass needs to be specified.\nNote: New statuses can be added in the future. Consumers should check for unknown statuses and fail appropriately."
@@ -8737,6 +8355,7 @@ spec:
                   type: object
               required:
                 - selector
+                - serviceName
                 - template
               type: object
             status:

charts/gha-runner-scale-set-controller/Chart.yaml

@@ -15,13 +15,13 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.13.1
+version: 0.12.1
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "0.13.1"
+appVersion: "0.12.1"
 
 home: https://github.com/actions/actions-runner-controller
 

charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: autoscalinglisteners.actions.github.com
 spec:
   group: actions.github.com
@@ -525,6 +525,7 @@ spec:
                                             pod labels will be ignored. The default value is empty.
                                             The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                             Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                           items:
                                             type: string
                                           type: array
@@ -539,6 +540,7 @@ spec:
                                             pod labels will be ignored. The default value is empty.
                                             The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                             Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                           items:
                                             type: string
                                           type: array
@@ -706,6 +708,7 @@ spec:
                                         pod labels will be ignored. The default value is empty.
                                         The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                         Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                       items:
                                         type: string
                                       type: array
@@ -720,6 +723,7 @@ spec:
                                         pod labels will be ignored. The default value is empty.
                                         The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                         Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                       items:
                                         type: string
                                       type: array
@@ -813,8 +817,8 @@ spec:
                                   most preferred is the one with the greatest sum of weights, i.e.
                                   for each node that meets all of the scheduling requirements (resource
                                   request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                  compute a sum by iterating through the elements of this field and subtracting
-                                  "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  compute a sum by iterating through the elements of this field and adding
+                                  "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                   node(s) with the highest sum are the most preferred.
                                 items:
                                   description: The weights of all of the matched WeightedPodAffinityTerm
@@ -885,6 +889,7 @@ spec:
                                             pod labels will be ignored. The default value is empty.
                                             The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                             Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                           items:
                                             type: string
                                           type: array
@@ -899,6 +904,7 @@ spec:
                                             pod labels will be ignored. The default value is empty.
                                             The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                             Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                           items:
                                             type: string
                                           type: array
@@ -1066,6 +1072,7 @@ spec:
                                         pod labels will be ignored. The default value is empty.
                                         The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                         Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                       items:
                                         type: string
                                       type: array
@@ -1080,6 +1087,7 @@ spec:
                                         pod labels will be ignored. The default value is empty.
                                         The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                         Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                       items:
                                         type: string
                                       type: array
@@ -1212,9 +1220,8 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: |-
-                                      Name of the environment variable.
-                                      May consist of any printable ASCII characters except '='.
+                                    description: Name of the environment variable.
+                                      Must be a C_IDENTIFIER.
                                     type: string
                                   value:
                                     description: |-
@@ -1273,43 +1280,6 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
-                                      fileKeyRef:
-                                        description: |-
-                                          FileKeyRef selects a key of the env file.
-                                          Requires the EnvFiles feature gate to be enabled.
-                                        properties:
-                                          key:
-                                            description: |-
-                                              The key within the env file. An invalid key will prevent the pod from starting.
-                                              The keys defined within a source may consist of any printable ASCII characters except '='.
-                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                            type: string
-                                          optional:
-                                            default: false
-                                            description: |-
-                                              Specify whether the file or its key must be defined. If the file or key
-                                              does not exist, then the env var is not published.
-                                              If optional is set to true and the specified key does not exist,
-                                              the environment variable will not be set in the Pod's containers.
-
-                                              If optional is set to false and the specified key does not exist,
-                                              an error will be returned during Pod creation.
-                                            type: boolean
-                                          path:
-                                            description: |-
-                                              The path within the volume from which to select the file.
-                                              Must be relative and may not contain the '..' path or start with '..'.
-                                            type: string
-                                          volumeName:
-                                            description: The name of the volume mount
-                                              containing the env file.
-                                            type: string
-                                        required:
-                                        - key
-                                        - path
-                                        - volumeName
-                                        type: object
-                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -1372,14 +1342,14 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source may consist of any printable ASCII characters except '='.
-                                When a key exists in multiple
+                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                will be reported as an event when the container is starting. When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
                               items:
                                 description: EnvFromSource represents the source of
-                                  a set of ConfigMaps or Secrets
+                                  a set of ConfigMaps
                                 properties:
                                   configMapRef:
                                     description: The ConfigMap to select from
@@ -1400,9 +1370,8 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: |-
-                                      Optional text to prepend to the name of each environment variable.
-                                      May consist of any printable ASCII characters except '='.
+                                    description: An optional identifier to prepend
+                                      to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -1668,12 +1637,6 @@ spec:
                                       - port
                                       type: object
                                   type: object
-                                stopSignal:
-                                  description: |-
-                                    StopSignal defines which signal will be sent to a container when it is being stopped.
-                                    If not specified, the default is defined by the container runtime in use.
-                                    StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                  type: string
                               type: object
                             livenessProbe:
                               description: |-
@@ -2081,7 +2044,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This field depends on the
+                                    This is an alpha field and requires enabling the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -2136,10 +2099,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This overrides the pod-level restart policy. When this field is not specified,
+                                This field may only be set for init containers, and the only allowed value is "Always".
+                                For non-init containers or when this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Additionally, setting the RestartPolicy as "Always" for the init container will
-                                have the following effect:
+                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -2151,59 +2114,6 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
-                            restartPolicyRules:
-                              description: |-
-                                Represents a list of rules to be checked to determine if the
-                                container should be restarted on exit. The rules are evaluated in
-                                order. Once a rule matches a container exit condition, the remaining
-                                rules are ignored. If no rule matches the container exit condition,
-                                the Container-level restart policy determines the whether the container
-                                is restarted or not. Constraints on the rules:
-                                - At most 20 rules are allowed.
-                                - Rules can have the same action.
-                                - Identical rules are not forbidden in validations.
-                                When rules are specified, container MUST set RestartPolicy explicitly
-                                even it if matches the Pod's RestartPolicy.
-                              items:
-                                description: ContainerRestartRule describes how a
-                                  container exit is handled.
-                                properties:
-                                  action:
-                                    description: |-
-                                      Specifies the action taken on a container exit if the requirements
-                                      are satisfied. The only possible value is "Restart" to restart the
-                                      container.
-                                    type: string
-                                  exitCodes:
-                                    description: Represents the exit codes to check
-                                      on container exits.
-                                    properties:
-                                      operator:
-                                        description: |-
-                                          Represents the relationship between the container exit code(s) and the
-                                          specified values. Possible values are:
-                                          - In: the requirement is satisfied if the container exit code is in the
-                                            set of specified values.
-                                          - NotIn: the requirement is satisfied if the container exit code is
-                                            not in the set of specified values.
-                                        type: string
-                                      values:
-                                        description: |-
-                                          Specifies the set of values to check for container exit codes.
-                                          At most 255 elements are allowed.
-                                        items:
-                                          format: int32
-                                          type: integer
-                                        type: array
-                                        x-kubernetes-list-type: set
-                                    required:
-                                    - operator
-                                    type: object
-                                required:
-                                - action
-                                type: object
-                              type: array
-                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -2824,9 +2734,8 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: |-
-                                      Name of the environment variable.
-                                      May consist of any printable ASCII characters except '='.
+                                    description: Name of the environment variable.
+                                      Must be a C_IDENTIFIER.
                                     type: string
                                   value:
                                     description: |-
@@ -2885,43 +2794,6 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
-                                      fileKeyRef:
-                                        description: |-
-                                          FileKeyRef selects a key of the env file.
-                                          Requires the EnvFiles feature gate to be enabled.
-                                        properties:
-                                          key:
-                                            description: |-
-                                              The key within the env file. An invalid key will prevent the pod from starting.
-                                              The keys defined within a source may consist of any printable ASCII characters except '='.
-                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                            type: string
-                                          optional:
-                                            default: false
-                                            description: |-
-                                              Specify whether the file or its key must be defined. If the file or key
-                                              does not exist, then the env var is not published.
-                                              If optional is set to true and the specified key does not exist,
-                                              the environment variable will not be set in the Pod's containers.
-
-                                              If optional is set to false and the specified key does not exist,
-                                              an error will be returned during Pod creation.
-                                            type: boolean
-                                          path:
-                                            description: |-
-                                              The path within the volume from which to select the file.
-                                              Must be relative and may not contain the '..' path or start with '..'.
-                                            type: string
-                                          volumeName:
-                                            description: The name of the volume mount
-                                              containing the env file.
-                                            type: string
-                                        required:
-                                        - key
-                                        - path
-                                        - volumeName
-                                        type: object
-                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -2984,14 +2856,14 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source may consist of any printable ASCII characters except '='.
-                                When a key exists in multiple
+                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                will be reported as an event when the container is starting. When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
                               items:
                                 description: EnvFromSource represents the source of
-                                  a set of ConfigMaps or Secrets
+                                  a set of ConfigMaps
                                 properties:
                                   configMapRef:
                                     description: The ConfigMap to select from
@@ -3012,9 +2884,8 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: |-
-                                      Optional text to prepend to the name of each environment variable.
-                                      May consist of any printable ASCII characters except '='.
+                                    description: An optional identifier to prepend
+                                      to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -3277,12 +3148,6 @@ spec:
                                       - port
                                       type: object
                                   type: object
-                                stopSignal:
-                                  description: |-
-                                    StopSignal defines which signal will be sent to a container when it is being stopped.
-                                    If not specified, the default is defined by the container runtime in use.
-                                    StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                  type: string
                               type: object
                             livenessProbe:
                               description: Probes are not allowed for ephemeral containers.
@@ -3673,7 +3538,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This field depends on the
+                                    This is an alpha field and requires enabling the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -3729,53 +3594,9 @@ spec:
                               description: |-
                                 Restart policy for the container to manage the restart behavior of each
                                 container within a pod.
-                                You cannot set this field on ephemeral containers.
-                              type: string
-                            restartPolicyRules:
-                              description: |-
-                                Represents a list of rules to be checked to determine if the
-                                container should be restarted on exit. You cannot set this field on
+                                This may only be set for init containers. You cannot set this field on
                                 ephemeral containers.
-                              items:
-                                description: ContainerRestartRule describes how a
-                                  container exit is handled.
-                                properties:
-                                  action:
-                                    description: |-
-                                      Specifies the action taken on a container exit if the requirements
-                                      are satisfied. The only possible value is "Restart" to restart the
-                                      container.
-                                    type: string
-                                  exitCodes:
-                                    description: Represents the exit codes to check
-                                      on container exits.
-                                    properties:
-                                      operator:
-                                        description: |-
-                                          Represents the relationship between the container exit code(s) and the
-                                          specified values. Possible values are:
-                                          - In: the requirement is satisfied if the container exit code is in the
-                                            set of specified values.
-                                          - NotIn: the requirement is satisfied if the container exit code is
-                                            not in the set of specified values.
-                                        type: string
-                                      values:
-                                        description: |-
-                                          Specifies the set of values to check for container exit codes.
-                                          At most 255 elements are allowed.
-                                        items:
-                                          format: int32
-                                          type: integer
-                                        type: array
-                                        x-kubernetes-list-type: set
-                                    required:
-                                    - operator
-                                    type: object
-                                required:
-                                - action
-                                type: object
-                              type: array
-                              x-kubernetes-list-type: atomic
+                              type: string
                             securityContext:
                               description: |-
                                 Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -4314,9 +4135,7 @@ spec:
                       hostNetwork:
                         description: |-
                           Host networking requested for this pod. Use the host's network namespace.
-                          When using HostNetwork you should specify ports so the scheduler is aware.
-                          When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
-                          and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
+                          If this option is set, the ports that will be used must be specified.
                           Default to false.
                         type: boolean
                       hostPID:
@@ -4341,19 +4160,6 @@ spec:
                           Specifies the hostname of the Pod
                           If not specified, the pod's hostname will be set to a system-defined value.
                         type: string
-                      hostnameOverride:
-                        description: |-
-                          HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
-                          This field only specifies the pod's hostname and does not affect its DNS records.
-                          When this field is set to a non-empty string:
-                          - It takes precedence over the values set in `hostname` and `subdomain`.
-                          - The Pod's hostname will be set to this value.
-                          - `setHostnameAsFQDN` must be nil or set to false.
-                          - `hostNetwork` must be set to false.
-
-                          This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
-                          Requires the HostnameOverride feature gate to be enabled.
-                        type: string
                       imagePullSecrets:
                         description: |-
                           ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -4389,7 +4195,7 @@ spec:
                           Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.
                           The resourceRequirements of an init container are taken into account during scheduling
                           by finding the highest request/limit for each resource type, and then using the max of
-                          that value or the sum of the normal containers. Limits are applied to init containers
+                          of that value or the sum of the normal containers. Limits are applied to init containers
                           in a similar fashion.
                           Init containers cannot currently be added or removed.
                           Cannot be updated.
@@ -4435,9 +4241,8 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: |-
-                                      Name of the environment variable.
-                                      May consist of any printable ASCII characters except '='.
+                                    description: Name of the environment variable.
+                                      Must be a C_IDENTIFIER.
                                     type: string
                                   value:
                                     description: |-
@@ -4496,43 +4301,6 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
-                                      fileKeyRef:
-                                        description: |-
-                                          FileKeyRef selects a key of the env file.
-                                          Requires the EnvFiles feature gate to be enabled.
-                                        properties:
-                                          key:
-                                            description: |-
-                                              The key within the env file. An invalid key will prevent the pod from starting.
-                                              The keys defined within a source may consist of any printable ASCII characters except '='.
-                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                            type: string
-                                          optional:
-                                            default: false
-                                            description: |-
-                                              Specify whether the file or its key must be defined. If the file or key
-                                              does not exist, then the env var is not published.
-                                              If optional is set to true and the specified key does not exist,
-                                              the environment variable will not be set in the Pod's containers.
-
-                                              If optional is set to false and the specified key does not exist,
-                                              an error will be returned during Pod creation.
-                                            type: boolean
-                                          path:
-                                            description: |-
-                                              The path within the volume from which to select the file.
-                                              Must be relative and may not contain the '..' path or start with '..'.
-                                            type: string
-                                          volumeName:
-                                            description: The name of the volume mount
-                                              containing the env file.
-                                            type: string
-                                        required:
-                                        - key
-                                        - path
-                                        - volumeName
-                                        type: object
-                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -4595,14 +4363,14 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source may consist of any printable ASCII characters except '='.
-                                When a key exists in multiple
+                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                will be reported as an event when the container is starting. When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
                               items:
                                 description: EnvFromSource represents the source of
-                                  a set of ConfigMaps or Secrets
+                                  a set of ConfigMaps
                                 properties:
                                   configMapRef:
                                     description: The ConfigMap to select from
@@ -4623,9 +4391,8 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: |-
-                                      Optional text to prepend to the name of each environment variable.
-                                      May consist of any printable ASCII characters except '='.
+                                    description: An optional identifier to prepend
+                                      to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -4891,12 +4658,6 @@ spec:
                                       - port
                                       type: object
                                   type: object
-                                stopSignal:
-                                  description: |-
-                                    StopSignal defines which signal will be sent to a container when it is being stopped.
-                                    If not specified, the default is defined by the container runtime in use.
-                                    StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                  type: string
                               type: object
                             livenessProbe:
                               description: |-
@@ -5304,7 +5065,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This field depends on the
+                                    This is an alpha field and requires enabling the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -5359,10 +5120,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This overrides the pod-level restart policy. When this field is not specified,
+                                This field may only be set for init containers, and the only allowed value is "Always".
+                                For non-init containers or when this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Additionally, setting the RestartPolicy as "Always" for the init container will
-                                have the following effect:
+                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -5374,59 +5135,6 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
-                            restartPolicyRules:
-                              description: |-
-                                Represents a list of rules to be checked to determine if the
-                                container should be restarted on exit. The rules are evaluated in
-                                order. Once a rule matches a container exit condition, the remaining
-                                rules are ignored. If no rule matches the container exit condition,
-                                the Container-level restart policy determines the whether the container
-                                is restarted or not. Constraints on the rules:
-                                - At most 20 rules are allowed.
-                                - Rules can have the same action.
-                                - Identical rules are not forbidden in validations.
-                                When rules are specified, container MUST set RestartPolicy explicitly
-                                even it if matches the Pod's RestartPolicy.
-                              items:
-                                description: ContainerRestartRule describes how a
-                                  container exit is handled.
-                                properties:
-                                  action:
-                                    description: |-
-                                      Specifies the action taken on a container exit if the requirements
-                                      are satisfied. The only possible value is "Restart" to restart the
-                                      container.
-                                    type: string
-                                  exitCodes:
-                                    description: Represents the exit codes to check
-                                      on container exits.
-                                    properties:
-                                      operator:
-                                        description: |-
-                                          Represents the relationship between the container exit code(s) and the
-                                          specified values. Possible values are:
-                                          - In: the requirement is satisfied if the container exit code is in the
-                                            set of specified values.
-                                          - NotIn: the requirement is satisfied if the container exit code is
-                                            not in the set of specified values.
-                                        type: string
-                                      values:
-                                        description: |-
-                                          Specifies the set of values to check for container exit codes.
-                                          At most 255 elements are allowed.
-                                        items:
-                                          format: int32
-                                          type: integer
-                                        type: array
-                                        x-kubernetes-list-type: set
-                                    required:
-                                    - operator
-                                    type: object
-                                required:
-                                - action
-                                type: object
-                              type: array
-                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -5960,7 +5668,6 @@ spec:
                           - spec.hostPID
                           - spec.hostIPC
                           - spec.hostUsers
-                          - spec.resources
                           - spec.securityContext.appArmorProfile
                           - spec.securityContext.seLinuxOptions
                           - spec.securityContext.seccompProfile
@@ -6114,7 +5821,7 @@ spec:
                         description: |-
                           Resources is the total amount of CPU and Memory resources required by all
                           containers in the pod. It supports specifying Requests and Limits for
-                          "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
+                          "cpu" and "memory" resource names only. ResourceClaims are not supported.
 
                           This field enables fine-grained control over resource allocation for the
                           entire pod, allowing resource sharing among containers in a pod.
@@ -6127,7 +5834,7 @@ spec:
                               Claims lists the names of resources, defined in spec.resourceClaims,
                               that are used by this container.
 
-                              This field depends on the
+                              This is an alpha field and requires enabling the
                               DynamicResourceAllocation feature gate.
 
                               This field is immutable. It can only be set for containers.
@@ -6665,6 +6372,7 @@ spec:
                                 - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
 
                                 If this value is nil, the behavior is equivalent to the Honor policy.
+                                This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                               type: string
                             nodeTaintsPolicy:
                               description: |-
@@ -6675,6 +6383,7 @@ spec:
                                 - Ignore: node taints are ignored. All nodes are included.
 
                                 If this value is nil, the behavior is equivalent to the Ignore policy.
+                                This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                               type: string
                             topologyKey:
                               description: |-
@@ -7421,13 +7130,15 @@ spec:
                                             volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                             If specified, the CSI driver will create or update the volume with the attributes defined
                                             in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                            it can be changed after the claim is created. An empty string or nil value indicates that no
-                                            VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
-                                            this field can be reset to its previous value (including nil) to cancel the modification.
+                                            it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
+                                            will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
+                                            If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
+                                            will be set by the persistentvolume controller if it exists.
                                             If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                             set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                             exists.
                                             More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
+                                            (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                           type: string
                                         volumeMode:
                                           description: |-
@@ -7609,10 +7320,12 @@ spec:
                               description: |-
                                 glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                 Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
+                                More info: https://examples.k8s.io/volumes/glusterfs/README.md
                               properties:
                                 endpoints:
-                                  description: endpoints is the endpoint name that
-                                    details Glusterfs topology.
+                                  description: |-
+                                    endpoints is the endpoint name that details Glusterfs topology.
+                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
                                   type: string
                                 path:
                                   description: |-
@@ -7666,7 +7379,7 @@ spec:
                                 The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
                                 The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
                                 The volume will be mounted read-only (ro) and non-executable files (noexec).
-                                Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
+                                Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
                                 The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
                               properties:
                                 pullPolicy:
@@ -7691,7 +7404,7 @@ spec:
                               description: |-
                                 iscsi represents an ISCSI Disk resource that is attached to a
                                 kubelet's host machine and then exposed to the pod.
-                                More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
+                                More info: https://examples.k8s.io/volumes/iscsi/README.md
                               properties:
                                 chapAuthDiscovery:
                                   description: chapAuthDiscovery defines whether support
@@ -8117,111 +7830,6 @@ spec:
                                             type: array
                                             x-kubernetes-list-type: atomic
                                         type: object
-                                      podCertificate:
-                                        description: |-
-                                          Projects an auto-rotating credential bundle (private key and certificate
-                                          chain) that the pod can use either as a TLS client or server.
-
-                                          Kubelet generates a private key and uses it to send a
-                                          PodCertificateRequest to the named signer.  Once the signer approves the
-                                          request and issues a certificate chain, Kubelet writes the key and
-                                          certificate chain to the pod filesystem.  The pod does not start until
-                                          certificates have been issued for each podCertificate projected volume
-                                          source in its spec.
-
-                                          Kubelet will begin trying to rotate the certificate at the time indicated
-                                          by the signer using the PodCertificateRequest.Status.BeginRefreshAt
-                                          timestamp.
-
-                                          Kubelet can write a single file, indicated by the credentialBundlePath
-                                          field, or separate files, indicated by the keyPath and
-                                          certificateChainPath fields.
-
-                                          The credential bundle is a single file in PEM format.  The first PEM
-                                          entry is the private key (in PKCS#8 format), and the remaining PEM
-                                          entries are the certificate chain issued by the signer (typically,
-                                          signers will return their certificate chain in leaf-to-root order).
-
-                                          Prefer using the credential bundle format, since your application code
-                                          can read it atomically.  If you use keyPath and certificateChainPath,
-                                          your application must make two separate file reads. If these coincide
-                                          with a certificate rotation, it is possible that the private key and leaf
-                                          certificate you read may not correspond to each other.  Your application
-                                          will need to check for this condition, and re-read until they are
-                                          consistent.
-
-                                          The named signer controls chooses the format of the certificate it
-                                          issues; consult the signer implementation's documentation to learn how to
-                                          use the certificates it issues.
-                                        properties:
-                                          certificateChainPath:
-                                            description: |-
-                                              Write the certificate chain at this path in the projected volume.
-
-                                              Most applications should use credentialBundlePath.  When using keyPath
-                                              and certificateChainPath, your application needs to check that the key
-                                              and leaf certificate are consistent, because it is possible to read the
-                                              files mid-rotation.
-                                            type: string
-                                          credentialBundlePath:
-                                            description: |-
-                                              Write the credential bundle at this path in the projected volume.
-
-                                              The credential bundle is a single file that contains multiple PEM blocks.
-                                              The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
-                                              key.
-
-                                              The remaining blocks are CERTIFICATE blocks, containing the issued
-                                              certificate chain from the signer (leaf and any intermediates).
-
-                                              Using credentialBundlePath lets your Pod's application code make a single
-                                              atomic read that retrieves a consistent key and certificate chain.  If you
-                                              project them to separate files, your application code will need to
-                                              additionally check that the leaf certificate was issued to the key.
-                                            type: string
-                                          keyPath:
-                                            description: |-
-                                              Write the key at this path in the projected volume.
-
-                                              Most applications should use credentialBundlePath.  When using keyPath
-                                              and certificateChainPath, your application needs to check that the key
-                                              and leaf certificate are consistent, because it is possible to read the
-                                              files mid-rotation.
-                                            type: string
-                                          keyType:
-                                            description: |-
-                                              The type of keypair Kubelet will generate for the pod.
-
-                                              Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
-                                              "ECDSAP521", and "ED25519".
-                                            type: string
-                                          maxExpirationSeconds:
-                                            description: |-
-                                              maxExpirationSeconds is the maximum lifetime permitted for the
-                                              certificate.
-
-                                              Kubelet copies this value verbatim into the PodCertificateRequests it
-                                              generates for this projection.
-
-                                              If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
-                                              will reject values shorter than 3600 (1 hour).  The maximum allowable
-                                              value is 7862400 (91 days).
-
-                                              The signer implementation is then free to issue a certificate with any
-                                              lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
-                                              seconds (1 hour).  This constraint is enforced by kube-apiserver.
-                                              `kubernetes.io` signers will never issue certificates with a lifetime
-                                              longer than 24 hours.
-                                            format: int32
-                                            type: integer
-                                          signerName:
-                                            description: Kubelet's generated CSRs
-                                              will be addressed to this signer.
-                                            type: string
-                                        required:
-                                        - keyType
-                                        - signerName
-                                        type: object
                                       secret:
                                         description: secret information about the
                                           secret data to project
@@ -8356,6 +7964,7 @@ spec:
                               description: |-
                                 rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                 Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
+                                More info: https://examples.k8s.io/volumes/rbd/README.md
                               properties:
                                 fsType:
                                   description: |-

charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunners.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: ephemeralrunners.actions.github.com
 spec:
   group: actions.github.com
@@ -430,6 +430,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                           Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -444,6 +445,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                           Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -604,6 +606,7 @@ spec:
                                       pod labels will be ignored. The default value is empty.
                                       The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                       Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                     items:
                                       type: string
                                     type: array
@@ -618,6 +621,7 @@ spec:
                                       pod labels will be ignored. The default value is empty.
                                       The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                       Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                     items:
                                       type: string
                                     type: array
@@ -706,8 +710,8 @@ spec:
                                 most preferred is the one with the greatest sum of weights, i.e.
                                 for each node that meets all of the scheduling requirements (resource
                                 request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                compute a sum by iterating through the elements of this field and subtracting
-                                "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                compute a sum by iterating through the elements of this field and adding
+                                "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                 node(s) with the highest sum are the most preferred.
                               items:
                                 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
@@ -771,6 +775,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                           Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -785,6 +790,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                           Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -945,6 +951,7 @@ spec:
                                       pod labels will be ignored. The default value is empty.
                                       The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                       Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                     items:
                                       type: string
                                     type: array
@@ -959,6 +966,7 @@ spec:
                                       pod labels will be ignored. The default value is empty.
                                       The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                       Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                     items:
                                       type: string
                                     type: array
@@ -1085,9 +1093,7 @@ spec:
                               description: EnvVar represents an environment variable present in a Container.
                               properties:
                                 name:
-                                  description: |-
-                                    Name of the environment variable.
-                                    May consist of any printable ASCII characters except '='.
+                                  description: Name of the environment variable. Must be a C_IDENTIFIER.
                                   type: string
                                 value:
                                   description: |-
@@ -1141,42 +1147,6 @@ spec:
                                         - fieldPath
                                       type: object
                                       x-kubernetes-map-type: atomic
-                                    fileKeyRef:
-                                      description: |-
-                                        FileKeyRef selects a key of the env file.
-                                        Requires the EnvFiles feature gate to be enabled.
-                                      properties:
-                                        key:
-                                          description: |-
-                                            The key within the env file. An invalid key will prevent the pod from starting.
-                                            The keys defined within a source may consist of any printable ASCII characters except '='.
-                                            During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                          type: string
-                                        optional:
-                                          default: false
-                                          description: |-
-                                            Specify whether the file or its key must be defined. If the file or key
-                                            does not exist, then the env var is not published.
-                                            If optional is set to true and the specified key does not exist,
-                                            the environment variable will not be set in the Pod's containers.
-
-                                            If optional is set to false and the specified key does not exist,
-                                            an error will be returned during Pod creation.
-                                          type: boolean
-                                        path:
-                                          description: |-
-                                            The path within the volume from which to select the file.
-                                            Must be relative and may not contain the '..' path or start with '..'.
-                                          type: string
-                                        volumeName:
-                                          description: The name of the volume mount containing the env file.
-                                          type: string
-                                      required:
-                                        - key
-                                        - path
-                                        - volumeName
-                                      type: object
-                                      x-kubernetes-map-type: atomic
                                     resourceFieldRef:
                                       description: |-
                                         Selects a resource of the container: only resources limits and requests
@@ -1232,13 +1202,13 @@ spec:
                           envFrom:
                             description: |-
                               List of sources to populate environment variables in the container.
-                              The keys defined within a source may consist of any printable ASCII characters except '='.
-                              When a key exists in multiple
+                              The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                              will be reported as an event when the container is starting. When a key exists in multiple
                               sources, the value associated with the last source will take precedence.
                               Values defined by an Env with a duplicate key will take precedence.
                               Cannot be updated.
                             items:
-                              description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                              description: EnvFromSource represents the source of a set of ConfigMaps
                               properties:
                                 configMapRef:
                                   description: The ConfigMap to select from
@@ -1258,9 +1228,7 @@ spec:
                                   type: object
                                   x-kubernetes-map-type: atomic
                                 prefix:
-                                  description: |-
-                                    Optional text to prepend to the name of each environment variable.
-                                    May consist of any printable ASCII characters except '='.
+                                  description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                   type: string
                                 secretRef:
                                   description: The Secret to select from
@@ -1509,12 +1477,6 @@ spec:
                                       - port
                                     type: object
                                 type: object
-                              stopSignal:
-                                description: |-
-                                  StopSignal defines which signal will be sent to a container when it is being stopped.
-                                  If not specified, the default is defined by the container runtime in use.
-                                  StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                type: string
                             type: object
                           livenessProbe:
                             description: |-
@@ -1905,7 +1867,7 @@ spec:
                                   Claims lists the names of resources, defined in spec.resourceClaims,
                                   that are used by this container.
 
-                                  This field depends on the
+                                  This is an alpha field and requires enabling the
                                   DynamicResourceAllocation feature gate.
 
                                   This field is immutable. It can only be set for containers.
@@ -1956,10 +1918,10 @@ spec:
                           restartPolicy:
                             description: |-
                               RestartPolicy defines the restart behavior of individual containers in a pod.
-                              This overrides the pod-level restart policy. When this field is not specified,
+                              This field may only be set for init containers, and the only allowed value is "Always".
+                              For non-init containers or when this field is not specified,
                               the restart behavior is defined by the Pod's restart policy and the container type.
-                              Additionally, setting the RestartPolicy as "Always" for the init container will
-                              have the following effect:
+                              Setting the RestartPolicy as "Always" for the init container will have the following effect:
                               this init container will be continually restarted on
                               exit until all regular containers have terminated. Once all regular
                               containers have completed, all init containers with restartPolicy "Always"
@@ -1971,57 +1933,6 @@ spec:
                               init container is started, or after any startupProbe has successfully
                               completed.
                             type: string
-                          restartPolicyRules:
-                            description: |-
-                              Represents a list of rules to be checked to determine if the
-                              container should be restarted on exit. The rules are evaluated in
-                              order. Once a rule matches a container exit condition, the remaining
-                              rules are ignored. If no rule matches the container exit condition,
-                              the Container-level restart policy determines the whether the container
-                              is restarted or not. Constraints on the rules:
-                              - At most 20 rules are allowed.
-                              - Rules can have the same action.
-                              - Identical rules are not forbidden in validations.
-                              When rules are specified, container MUST set RestartPolicy explicitly
-                              even it if matches the Pod's RestartPolicy.
-                            items:
-                              description: ContainerRestartRule describes how a container exit is handled.
-                              properties:
-                                action:
-                                  description: |-
-                                    Specifies the action taken on a container exit if the requirements
-                                    are satisfied. The only possible value is "Restart" to restart the
-                                    container.
-                                  type: string
-                                exitCodes:
-                                  description: Represents the exit codes to check on container exits.
-                                  properties:
-                                    operator:
-                                      description: |-
-                                        Represents the relationship between the container exit code(s) and the
-                                        specified values. Possible values are:
-                                        - In: the requirement is satisfied if the container exit code is in the
-                                          set of specified values.
-                                        - NotIn: the requirement is satisfied if the container exit code is
-                                          not in the set of specified values.
-                                      type: string
-                                    values:
-                                      description: |-
-                                        Specifies the set of values to check for container exit codes.
-                                        At most 255 elements are allowed.
-                                      items:
-                                        format: int32
-                                        type: integer
-                                      type: array
-                                      x-kubernetes-list-type: set
-                                  required:
-                                    - operator
-                                  type: object
-                              required:
-                                - action
-                              type: object
-                            type: array
-                            x-kubernetes-list-type: atomic
                           securityContext:
                             description: |-
                               SecurityContext defines the security options the container should be run with.
@@ -2619,9 +2530,7 @@ spec:
                               description: EnvVar represents an environment variable present in a Container.
                               properties:
                                 name:
-                                  description: |-
-                                    Name of the environment variable.
-                                    May consist of any printable ASCII characters except '='.
+                                  description: Name of the environment variable. Must be a C_IDENTIFIER.
                                   type: string
                                 value:
                                   description: |-
@@ -2675,42 +2584,6 @@ spec:
                                         - fieldPath
                                       type: object
                                       x-kubernetes-map-type: atomic
-                                    fileKeyRef:
-                                      description: |-
-                                        FileKeyRef selects a key of the env file.
-                                        Requires the EnvFiles feature gate to be enabled.
-                                      properties:
-                                        key:
-                                          description: |-
-                                            The key within the env file. An invalid key will prevent the pod from starting.
-                                            The keys defined within a source may consist of any printable ASCII characters except '='.
-                                            During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                          type: string
-                                        optional:
-                                          default: false
-                                          description: |-
-                                            Specify whether the file or its key must be defined. If the file or key
-                                            does not exist, then the env var is not published.
-                                            If optional is set to true and the specified key does not exist,
-                                            the environment variable will not be set in the Pod's containers.
-
-                                            If optional is set to false and the specified key does not exist,
-                                            an error will be returned during Pod creation.
-                                          type: boolean
-                                        path:
-                                          description: |-
-                                            The path within the volume from which to select the file.
-                                            Must be relative and may not contain the '..' path or start with '..'.
-                                          type: string
-                                        volumeName:
-                                          description: The name of the volume mount containing the env file.
-                                          type: string
-                                      required:
-                                        - key
-                                        - path
-                                        - volumeName
-                                      type: object
-                                      x-kubernetes-map-type: atomic
                                     resourceFieldRef:
                                       description: |-
                                         Selects a resource of the container: only resources limits and requests
@@ -2766,13 +2639,13 @@ spec:
                           envFrom:
                             description: |-
                               List of sources to populate environment variables in the container.
-                              The keys defined within a source may consist of any printable ASCII characters except '='.
-                              When a key exists in multiple
+                              The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                              will be reported as an event when the container is starting. When a key exists in multiple
                               sources, the value associated with the last source will take precedence.
                               Values defined by an Env with a duplicate key will take precedence.
                               Cannot be updated.
                             items:
-                              description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                              description: EnvFromSource represents the source of a set of ConfigMaps
                               properties:
                                 configMapRef:
                                   description: The ConfigMap to select from
@@ -2792,9 +2665,7 @@ spec:
                                   type: object
                                   x-kubernetes-map-type: atomic
                                 prefix:
-                                  description: |-
-                                    Optional text to prepend to the name of each environment variable.
-                                    May consist of any printable ASCII characters except '='.
+                                  description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                   type: string
                                 secretRef:
                                   description: The Secret to select from
@@ -3039,12 +2910,6 @@ spec:
                                       - port
                                     type: object
                                 type: object
-                              stopSignal:
-                                description: |-
-                                  StopSignal defines which signal will be sent to a container when it is being stopped.
-                                  If not specified, the default is defined by the container runtime in use.
-                                  StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                type: string
                             type: object
                           livenessProbe:
                             description: Probes are not allowed for ephemeral containers.
@@ -3418,7 +3283,7 @@ spec:
                                   Claims lists the names of resources, defined in spec.resourceClaims,
                                   that are used by this container.
 
-                                  This field depends on the
+                                  This is an alpha field and requires enabling the
                                   DynamicResourceAllocation feature gate.
 
                                   This field is immutable. It can only be set for containers.
@@ -3470,51 +3335,9 @@ spec:
                             description: |-
                               Restart policy for the container to manage the restart behavior of each
                               container within a pod.
-                              You cannot set this field on ephemeral containers.
-                            type: string
-                          restartPolicyRules:
-                            description: |-
-                              Represents a list of rules to be checked to determine if the
-                              container should be restarted on exit. You cannot set this field on
+                              This may only be set for init containers. You cannot set this field on
                               ephemeral containers.
-                            items:
-                              description: ContainerRestartRule describes how a container exit is handled.
-                              properties:
-                                action:
-                                  description: |-
-                                    Specifies the action taken on a container exit if the requirements
-                                    are satisfied. The only possible value is "Restart" to restart the
-                                    container.
-                                  type: string
-                                exitCodes:
-                                  description: Represents the exit codes to check on container exits.
-                                  properties:
-                                    operator:
-                                      description: |-
-                                        Represents the relationship between the container exit code(s) and the
-                                        specified values. Possible values are:
-                                        - In: the requirement is satisfied if the container exit code is in the
-                                          set of specified values.
-                                        - NotIn: the requirement is satisfied if the container exit code is
-                                          not in the set of specified values.
-                                      type: string
-                                    values:
-                                      description: |-
-                                        Specifies the set of values to check for container exit codes.
-                                        At most 255 elements are allowed.
-                                      items:
-                                        format: int32
-                                        type: integer
-                                      type: array
-                                      x-kubernetes-list-type: set
-                                  required:
-                                    - operator
-                                  type: object
-                              required:
-                                - action
-                              type: object
-                            type: array
-                            x-kubernetes-list-type: atomic
+                            type: string
                           securityContext:
                             description: |-
                               Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -4033,9 +3856,7 @@ spec:
                     hostNetwork:
                       description: |-
                         Host networking requested for this pod. Use the host's network namespace.
-                        When using HostNetwork you should specify ports so the scheduler is aware.
-                        When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
-                        and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
+                        If this option is set, the ports that will be used must be specified.
                         Default to false.
                       type: boolean
                     hostPID:
@@ -4060,19 +3881,6 @@ spec:
                         Specifies the hostname of the Pod
                         If not specified, the pod's hostname will be set to a system-defined value.
                       type: string
-                    hostnameOverride:
-                      description: |-
-                        HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
-                        This field only specifies the pod's hostname and does not affect its DNS records.
-                        When this field is set to a non-empty string:
-                        - It takes precedence over the values set in `hostname` and `subdomain`.
-                        - The Pod's hostname will be set to this value.
-                        - `setHostnameAsFQDN` must be nil or set to false.
-                        - `hostNetwork` must be set to false.
-
-                        This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
-                        Requires the HostnameOverride feature gate to be enabled.
-                      type: string
                     imagePullSecrets:
                       description: |-
                         ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -4108,7 +3916,7 @@ spec:
                         Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.
                         The resourceRequirements of an init container are taken into account during scheduling
                         by finding the highest request/limit for each resource type, and then using the max of
-                        that value or the sum of the normal containers. Limits are applied to init containers
+                        of that value or the sum of the normal containers. Limits are applied to init containers
                         in a similar fashion.
                         Init containers cannot currently be added or removed.
                         Cannot be updated.
@@ -4152,9 +3960,7 @@ spec:
                               description: EnvVar represents an environment variable present in a Container.
                               properties:
                                 name:
-                                  description: |-
-                                    Name of the environment variable.
-                                    May consist of any printable ASCII characters except '='.
+                                  description: Name of the environment variable. Must be a C_IDENTIFIER.
                                   type: string
                                 value:
                                   description: |-
@@ -4208,42 +4014,6 @@ spec:
                                         - fieldPath
                                       type: object
                                       x-kubernetes-map-type: atomic
-                                    fileKeyRef:
-                                      description: |-
-                                        FileKeyRef selects a key of the env file.
-                                        Requires the EnvFiles feature gate to be enabled.
-                                      properties:
-                                        key:
-                                          description: |-
-                                            The key within the env file. An invalid key will prevent the pod from starting.
-                                            The keys defined within a source may consist of any printable ASCII characters except '='.
-                                            During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                          type: string
-                                        optional:
-                                          default: false
-                                          description: |-
-                                            Specify whether the file or its key must be defined. If the file or key
-                                            does not exist, then the env var is not published.
-                                            If optional is set to true and the specified key does not exist,
-                                            the environment variable will not be set in the Pod's containers.
-
-                                            If optional is set to false and the specified key does not exist,
-                                            an error will be returned during Pod creation.
-                                          type: boolean
-                                        path:
-                                          description: |-
-                                            The path within the volume from which to select the file.
-                                            Must be relative and may not contain the '..' path or start with '..'.
-                                          type: string
-                                        volumeName:
-                                          description: The name of the volume mount containing the env file.
-                                          type: string
-                                      required:
-                                        - key
-                                        - path
-                                        - volumeName
-                                      type: object
-                                      x-kubernetes-map-type: atomic
                                     resourceFieldRef:
                                       description: |-
                                         Selects a resource of the container: only resources limits and requests
@@ -4299,13 +4069,13 @@ spec:
                           envFrom:
                             description: |-
                               List of sources to populate environment variables in the container.
-                              The keys defined within a source may consist of any printable ASCII characters except '='.
-                              When a key exists in multiple
+                              The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                              will be reported as an event when the container is starting. When a key exists in multiple
                               sources, the value associated with the last source will take precedence.
                               Values defined by an Env with a duplicate key will take precedence.
                               Cannot be updated.
                             items:
-                              description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                              description: EnvFromSource represents the source of a set of ConfigMaps
                               properties:
                                 configMapRef:
                                   description: The ConfigMap to select from
@@ -4325,9 +4095,7 @@ spec:
                                   type: object
                                   x-kubernetes-map-type: atomic
                                 prefix:
-                                  description: |-
-                                    Optional text to prepend to the name of each environment variable.
-                                    May consist of any printable ASCII characters except '='.
+                                  description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                   type: string
                                 secretRef:
                                   description: The Secret to select from
@@ -4576,12 +4344,6 @@ spec:
                                       - port
                                     type: object
                                 type: object
-                              stopSignal:
-                                description: |-
-                                  StopSignal defines which signal will be sent to a container when it is being stopped.
-                                  If not specified, the default is defined by the container runtime in use.
-                                  StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                type: string
                             type: object
                           livenessProbe:
                             description: |-
@@ -4972,7 +4734,7 @@ spec:
                                   Claims lists the names of resources, defined in spec.resourceClaims,
                                   that are used by this container.
 
-                                  This field depends on the
+                                  This is an alpha field and requires enabling the
                                   DynamicResourceAllocation feature gate.
 
                                   This field is immutable. It can only be set for containers.
@@ -5023,10 +4785,10 @@ spec:
                           restartPolicy:
                             description: |-
                               RestartPolicy defines the restart behavior of individual containers in a pod.
-                              This overrides the pod-level restart policy. When this field is not specified,
+                              This field may only be set for init containers, and the only allowed value is "Always".
+                              For non-init containers or when this field is not specified,
                               the restart behavior is defined by the Pod's restart policy and the container type.
-                              Additionally, setting the RestartPolicy as "Always" for the init container will
-                              have the following effect:
+                              Setting the RestartPolicy as "Always" for the init container will have the following effect:
                               this init container will be continually restarted on
                               exit until all regular containers have terminated. Once all regular
                               containers have completed, all init containers with restartPolicy "Always"
@@ -5038,57 +4800,6 @@ spec:
                               init container is started, or after any startupProbe has successfully
                               completed.
                             type: string
-                          restartPolicyRules:
-                            description: |-
-                              Represents a list of rules to be checked to determine if the
-                              container should be restarted on exit. The rules are evaluated in
-                              order. Once a rule matches a container exit condition, the remaining
-                              rules are ignored. If no rule matches the container exit condition,
-                              the Container-level restart policy determines the whether the container
-                              is restarted or not. Constraints on the rules:
-                              - At most 20 rules are allowed.
-                              - Rules can have the same action.
-                              - Identical rules are not forbidden in validations.
-                              When rules are specified, container MUST set RestartPolicy explicitly
-                              even it if matches the Pod's RestartPolicy.
-                            items:
-                              description: ContainerRestartRule describes how a container exit is handled.
-                              properties:
-                                action:
-                                  description: |-
-                                    Specifies the action taken on a container exit if the requirements
-                                    are satisfied. The only possible value is "Restart" to restart the
-                                    container.
-                                  type: string
-                                exitCodes:
-                                  description: Represents the exit codes to check on container exits.
-                                  properties:
-                                    operator:
-                                      description: |-
-                                        Represents the relationship between the container exit code(s) and the
-                                        specified values. Possible values are:
-                                        - In: the requirement is satisfied if the container exit code is in the
-                                          set of specified values.
-                                        - NotIn: the requirement is satisfied if the container exit code is
-                                          not in the set of specified values.
-                                      type: string
-                                    values:
-                                      description: |-
-                                        Specifies the set of values to check for container exit codes.
-                                        At most 255 elements are allowed.
-                                      items:
-                                        format: int32
-                                        type: integer
-                                      type: array
-                                      x-kubernetes-list-type: set
-                                  required:
-                                    - operator
-                                  type: object
-                              required:
-                                - action
-                              type: object
-                            type: array
-                            x-kubernetes-list-type: atomic
                           securityContext:
                             description: |-
                               SecurityContext defines the security options the container should be run with.
@@ -5602,7 +5313,6 @@ spec:
                         - spec.hostPID
                         - spec.hostIPC
                         - spec.hostUsers
-                        - spec.resources
                         - spec.securityContext.appArmorProfile
                         - spec.securityContext.seLinuxOptions
                         - spec.securityContext.seccompProfile
@@ -5754,7 +5464,7 @@ spec:
                       description: |-
                         Resources is the total amount of CPU and Memory resources required by all
                         containers in the pod. It supports specifying Requests and Limits for
-                        "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
+                        "cpu" and "memory" resource names only. ResourceClaims are not supported.
 
                         This field enables fine-grained control over resource allocation for the
                         entire pod, allowing resource sharing among containers in a pod.
@@ -5767,7 +5477,7 @@ spec:
                             Claims lists the names of resources, defined in spec.resourceClaims,
                             that are used by this container.
 
-                            This field depends on the
+                            This is an alpha field and requires enabling the
                             DynamicResourceAllocation feature gate.
 
                             This field is immutable. It can only be set for containers.
@@ -6295,6 +6005,7 @@ spec:
                               - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
 
                               If this value is nil, the behavior is equivalent to the Honor policy.
+                              This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                             type: string
                           nodeTaintsPolicy:
                             description: |-
@@ -6305,6 +6016,7 @@ spec:
                               - Ignore: node taints are ignored. All nodes are included.
 
                               If this value is nil, the behavior is equivalent to the Ignore policy.
+                              This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                             type: string
                           topologyKey:
                             description: |-
@@ -7010,13 +6722,15 @@ spec:
                                           volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                           If specified, the CSI driver will create or update the volume with the attributes defined
                                           in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                          it can be changed after the claim is created. An empty string or nil value indicates that no
-                                          VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
-                                          this field can be reset to its previous value (including nil) to cancel the modification.
+                                          it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
+                                          will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
+                                          If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
+                                          will be set by the persistentvolume controller if it exists.
                                           If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                           set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                           exists.
                                           More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
+                                          (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                         type: string
                                       volumeMode:
                                         description: |-
@@ -7190,9 +6904,12 @@ spec:
                             description: |-
                               glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                               Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
+                              More info: https://examples.k8s.io/volumes/glusterfs/README.md
                             properties:
                               endpoints:
-                                description: endpoints is the endpoint name that details Glusterfs topology.
+                                description: |-
+                                  endpoints is the endpoint name that details Glusterfs topology.
+                                  More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
                                 type: string
                               path:
                                 description: |-
@@ -7246,7 +6963,7 @@ spec:
                               The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
                               The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
                               The volume will be mounted read-only (ro) and non-executable files (noexec).
-                              Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
+                              Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
                               The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
                             properties:
                               pullPolicy:
@@ -7271,7 +6988,7 @@ spec:
                             description: |-
                               iscsi represents an ISCSI Disk resource that is attached to a
                               kubelet's host machine and then exposed to the pod.
-                              More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
+                              More info: https://examples.k8s.io/volumes/iscsi/README.md
                             properties:
                               chapAuthDiscovery:
                                 description: chapAuthDiscovery defines whether support iSCSI Discovery CHAP authentication
@@ -7661,110 +7378,6 @@ spec:
                                           type: array
                                           x-kubernetes-list-type: atomic
                                       type: object
-                                    podCertificate:
-                                      description: |-
-                                        Projects an auto-rotating credential bundle (private key and certificate
-                                        chain) that the pod can use either as a TLS client or server.
-
-                                        Kubelet generates a private key and uses it to send a
-                                        PodCertificateRequest to the named signer.  Once the signer approves the
-                                        request and issues a certificate chain, Kubelet writes the key and
-                                        certificate chain to the pod filesystem.  The pod does not start until
-                                        certificates have been issued for each podCertificate projected volume
-                                        source in its spec.
-
-                                        Kubelet will begin trying to rotate the certificate at the time indicated
-                                        by the signer using the PodCertificateRequest.Status.BeginRefreshAt
-                                        timestamp.
-
-                                        Kubelet can write a single file, indicated by the credentialBundlePath
-                                        field, or separate files, indicated by the keyPath and
-                                        certificateChainPath fields.
-
-                                        The credential bundle is a single file in PEM format.  The first PEM
-                                        entry is the private key (in PKCS#8 format), and the remaining PEM
-                                        entries are the certificate chain issued by the signer (typically,
-                                        signers will return their certificate chain in leaf-to-root order).
-
-                                        Prefer using the credential bundle format, since your application code
-                                        can read it atomically.  If you use keyPath and certificateChainPath,
-                                        your application must make two separate file reads. If these coincide
-                                        with a certificate rotation, it is possible that the private key and leaf
-                                        certificate you read may not correspond to each other.  Your application
-                                        will need to check for this condition, and re-read until they are
-                                        consistent.
-
-                                        The named signer controls chooses the format of the certificate it
-                                        issues; consult the signer implementation's documentation to learn how to
-                                        use the certificates it issues.
-                                      properties:
-                                        certificateChainPath:
-                                          description: |-
-                                            Write the certificate chain at this path in the projected volume.
-
-                                            Most applications should use credentialBundlePath.  When using keyPath
-                                            and certificateChainPath, your application needs to check that the key
-                                            and leaf certificate are consistent, because it is possible to read the
-                                            files mid-rotation.
-                                          type: string
-                                        credentialBundlePath:
-                                          description: |-
-                                            Write the credential bundle at this path in the projected volume.
-
-                                            The credential bundle is a single file that contains multiple PEM blocks.
-                                            The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
-                                            key.
-
-                                            The remaining blocks are CERTIFICATE blocks, containing the issued
-                                            certificate chain from the signer (leaf and any intermediates).
-
-                                            Using credentialBundlePath lets your Pod's application code make a single
-                                            atomic read that retrieves a consistent key and certificate chain.  If you
-                                            project them to separate files, your application code will need to
-                                            additionally check that the leaf certificate was issued to the key.
-                                          type: string
-                                        keyPath:
-                                          description: |-
-                                            Write the key at this path in the projected volume.
-
-                                            Most applications should use credentialBundlePath.  When using keyPath
-                                            and certificateChainPath, your application needs to check that the key
-                                            and leaf certificate are consistent, because it is possible to read the
-                                            files mid-rotation.
-                                          type: string
-                                        keyType:
-                                          description: |-
-                                            The type of keypair Kubelet will generate for the pod.
-
-                                            Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
-                                            "ECDSAP521", and "ED25519".
-                                          type: string
-                                        maxExpirationSeconds:
-                                          description: |-
-                                            maxExpirationSeconds is the maximum lifetime permitted for the
-                                            certificate.
-
-                                            Kubelet copies this value verbatim into the PodCertificateRequests it
-                                            generates for this projection.
-
-                                            If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
-                                            will reject values shorter than 3600 (1 hour).  The maximum allowable
-                                            value is 7862400 (91 days).
-
-                                            The signer implementation is then free to issue a certificate with any
-                                            lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
-                                            seconds (1 hour).  This constraint is enforced by kube-apiserver.
-                                            `kubernetes.io` signers will never issue certificates with a lifetime
-                                            longer than 24 hours.
-                                          format: int32
-                                          type: integer
-                                        signerName:
-                                          description: Kubelet's generated CSRs will be addressed to this signer.
-                                          type: string
-                                      required:
-                                        - keyType
-                                        - signerName
-                                      type: object
                                     secret:
                                       description: secret information about the secret data to project
                                       properties:
@@ -7894,6 +7507,7 @@ spec:
                             description: |-
                               rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                               Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
+                              More info: https://examples.k8s.io/volumes/rbd/README.md
                             properties:
                               fsType:
                                 description: |-

charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: ephemeralrunnersets.actions.github.com
 spec:
   group: actions.github.com
@@ -421,6 +421,7 @@ spec:
                                               pod labels will be ignored. The default value is empty.
                                               The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                               Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                              This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                             items:
                                               type: string
                                             type: array
@@ -435,6 +436,7 @@ spec:
                                               pod labels will be ignored. The default value is empty.
                                               The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                               Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                              This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                             items:
                                               type: string
                                             type: array
@@ -595,6 +597,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                           Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -609,6 +612,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                           Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -697,8 +701,8 @@ spec:
                                     most preferred is the one with the greatest sum of weights, i.e.
                                     for each node that meets all of the scheduling requirements (resource
                                     request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                    compute a sum by iterating through the elements of this field and subtracting
-                                    "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                    compute a sum by iterating through the elements of this field and adding
+                                    "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                     node(s) with the highest sum are the most preferred.
                                   items:
                                     description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
@@ -762,6 +766,7 @@ spec:
                                               pod labels will be ignored. The default value is empty.
                                               The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                               Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                              This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                             items:
                                               type: string
                                             type: array
@@ -776,6 +781,7 @@ spec:
                                               pod labels will be ignored. The default value is empty.
                                               The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                               Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                              This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                             items:
                                               type: string
                                             type: array
@@ -936,6 +942,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                           Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -950,6 +957,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                           Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -1076,9 +1084,7 @@ spec:
                                   description: EnvVar represents an environment variable present in a Container.
                                   properties:
                                     name:
-                                      description: |-
-                                        Name of the environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: Name of the environment variable. Must be a C_IDENTIFIER.
                                       type: string
                                     value:
                                       description: |-
@@ -1132,42 +1138,6 @@ spec:
                                             - fieldPath
                                           type: object
                                           x-kubernetes-map-type: atomic
-                                        fileKeyRef:
-                                          description: |-
-                                            FileKeyRef selects a key of the env file.
-                                            Requires the EnvFiles feature gate to be enabled.
-                                          properties:
-                                            key:
-                                              description: |-
-                                                The key within the env file. An invalid key will prevent the pod from starting.
-                                                The keys defined within a source may consist of any printable ASCII characters except '='.
-                                                During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                              type: string
-                                            optional:
-                                              default: false
-                                              description: |-
-                                                Specify whether the file or its key must be defined. If the file or key
-                                                does not exist, then the env var is not published.
-                                                If optional is set to true and the specified key does not exist,
-                                                the environment variable will not be set in the Pod's containers.
-
-                                                If optional is set to false and the specified key does not exist,
-                                                an error will be returned during Pod creation.
-                                              type: boolean
-                                            path:
-                                              description: |-
-                                                The path within the volume from which to select the file.
-                                                Must be relative and may not contain the '..' path or start with '..'.
-                                              type: string
-                                            volumeName:
-                                              description: The name of the volume mount containing the env file.
-                                              type: string
-                                          required:
-                                            - key
-                                            - path
-                                            - volumeName
-                                          type: object
-                                          x-kubernetes-map-type: atomic
                                         resourceFieldRef:
                                           description: |-
                                             Selects a resource of the container: only resources limits and requests
@@ -1223,13 +1193,13 @@ spec:
                               envFrom:
                                 description: |-
                                   List of sources to populate environment variables in the container.
-                                  The keys defined within a source may consist of any printable ASCII characters except '='.
-                                  When a key exists in multiple
+                                  The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                  will be reported as an event when the container is starting. When a key exists in multiple
                                   sources, the value associated with the last source will take precedence.
                                   Values defined by an Env with a duplicate key will take precedence.
                                   Cannot be updated.
                                 items:
-                                  description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                                  description: EnvFromSource represents the source of a set of ConfigMaps
                                   properties:
                                     configMapRef:
                                       description: The ConfigMap to select from
@@ -1249,9 +1219,7 @@ spec:
                                       type: object
                                       x-kubernetes-map-type: atomic
                                     prefix:
-                                      description: |-
-                                        Optional text to prepend to the name of each environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                       type: string
                                     secretRef:
                                       description: The Secret to select from
@@ -1500,12 +1468,6 @@ spec:
                                           - port
                                         type: object
                                     type: object
-                                  stopSignal:
-                                    description: |-
-                                      StopSignal defines which signal will be sent to a container when it is being stopped.
-                                      If not specified, the default is defined by the container runtime in use.
-                                      StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                    type: string
                                 type: object
                               livenessProbe:
                                 description: |-
@@ -1896,7 +1858,7 @@ spec:
                                       Claims lists the names of resources, defined in spec.resourceClaims,
                                       that are used by this container.
 
-                                      This field depends on the
+                                      This is an alpha field and requires enabling the
                                       DynamicResourceAllocation feature gate.
 
                                       This field is immutable. It can only be set for containers.
@@ -1947,10 +1909,10 @@ spec:
                               restartPolicy:
                                 description: |-
                                   RestartPolicy defines the restart behavior of individual containers in a pod.
-                                  This overrides the pod-level restart policy. When this field is not specified,
+                                  This field may only be set for init containers, and the only allowed value is "Always".
+                                  For non-init containers or when this field is not specified,
                                   the restart behavior is defined by the Pod's restart policy and the container type.
-                                  Additionally, setting the RestartPolicy as "Always" for the init container will
-                                  have the following effect:
+                                  Setting the RestartPolicy as "Always" for the init container will have the following effect:
                                   this init container will be continually restarted on
                                   exit until all regular containers have terminated. Once all regular
                                   containers have completed, all init containers with restartPolicy "Always"
@@ -1962,57 +1924,6 @@ spec:
                                   init container is started, or after any startupProbe has successfully
                                   completed.
                                 type: string
-                              restartPolicyRules:
-                                description: |-
-                                  Represents a list of rules to be checked to determine if the
-                                  container should be restarted on exit. The rules are evaluated in
-                                  order. Once a rule matches a container exit condition, the remaining
-                                  rules are ignored. If no rule matches the container exit condition,
-                                  the Container-level restart policy determines the whether the container
-                                  is restarted or not. Constraints on the rules:
-                                  - At most 20 rules are allowed.
-                                  - Rules can have the same action.
-                                  - Identical rules are not forbidden in validations.
-                                  When rules are specified, container MUST set RestartPolicy explicitly
-                                  even it if matches the Pod's RestartPolicy.
-                                items:
-                                  description: ContainerRestartRule describes how a container exit is handled.
-                                  properties:
-                                    action:
-                                      description: |-
-                                        Specifies the action taken on a container exit if the requirements
-                                        are satisfied. The only possible value is "Restart" to restart the
-                                        container.
-                                      type: string
-                                    exitCodes:
-                                      description: Represents the exit codes to check on container exits.
-                                      properties:
-                                        operator:
-                                          description: |-
-                                            Represents the relationship between the container exit code(s) and the
-                                            specified values. Possible values are:
-                                            - In: the requirement is satisfied if the container exit code is in the
-                                              set of specified values.
-                                            - NotIn: the requirement is satisfied if the container exit code is
-                                              not in the set of specified values.
-                                          type: string
-                                        values:
-                                          description: |-
-                                            Specifies the set of values to check for container exit codes.
-                                            At most 255 elements are allowed.
-                                          items:
-                                            format: int32
-                                            type: integer
-                                          type: array
-                                          x-kubernetes-list-type: set
-                                      required:
-                                        - operator
-                                      type: object
-                                  required:
-                                    - action
-                                  type: object
-                                type: array
-                                x-kubernetes-list-type: atomic
                               securityContext:
                                 description: |-
                                   SecurityContext defines the security options the container should be run with.
@@ -2610,9 +2521,7 @@ spec:
                                   description: EnvVar represents an environment variable present in a Container.
                                   properties:
                                     name:
-                                      description: |-
-                                        Name of the environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: Name of the environment variable. Must be a C_IDENTIFIER.
                                       type: string
                                     value:
                                       description: |-
@@ -2666,42 +2575,6 @@ spec:
                                             - fieldPath
                                           type: object
                                           x-kubernetes-map-type: atomic
-                                        fileKeyRef:
-                                          description: |-
-                                            FileKeyRef selects a key of the env file.
-                                            Requires the EnvFiles feature gate to be enabled.
-                                          properties:
-                                            key:
-                                              description: |-
-                                                The key within the env file. An invalid key will prevent the pod from starting.
-                                                The keys defined within a source may consist of any printable ASCII characters except '='.
-                                                During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                              type: string
-                                            optional:
-                                              default: false
-                                              description: |-
-                                                Specify whether the file or its key must be defined. If the file or key
-                                                does not exist, then the env var is not published.
-                                                If optional is set to true and the specified key does not exist,
-                                                the environment variable will not be set in the Pod's containers.
-
-                                                If optional is set to false and the specified key does not exist,
-                                                an error will be returned during Pod creation.
-                                              type: boolean
-                                            path:
-                                              description: |-
-                                                The path within the volume from which to select the file.
-                                                Must be relative and may not contain the '..' path or start with '..'.
-                                              type: string
-                                            volumeName:
-                                              description: The name of the volume mount containing the env file.
-                                              type: string
-                                          required:
-                                            - key
-                                            - path
-                                            - volumeName
-                                          type: object
-                                          x-kubernetes-map-type: atomic
                                         resourceFieldRef:
                                           description: |-
                                             Selects a resource of the container: only resources limits and requests
@@ -2757,13 +2630,13 @@ spec:
                               envFrom:
                                 description: |-
                                   List of sources to populate environment variables in the container.
-                                  The keys defined within a source may consist of any printable ASCII characters except '='.
-                                  When a key exists in multiple
+                                  The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                  will be reported as an event when the container is starting. When a key exists in multiple
                                   sources, the value associated with the last source will take precedence.
                                   Values defined by an Env with a duplicate key will take precedence.
                                   Cannot be updated.
                                 items:
-                                  description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                                  description: EnvFromSource represents the source of a set of ConfigMaps
                                   properties:
                                     configMapRef:
                                       description: The ConfigMap to select from
@@ -2783,9 +2656,7 @@ spec:
                                       type: object
                                       x-kubernetes-map-type: atomic
                                     prefix:
-                                      description: |-
-                                        Optional text to prepend to the name of each environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                       type: string
                                     secretRef:
                                       description: The Secret to select from
@@ -3030,12 +2901,6 @@ spec:
                                           - port
                                         type: object
                                     type: object
-                                  stopSignal:
-                                    description: |-
-                                      StopSignal defines which signal will be sent to a container when it is being stopped.
-                                      If not specified, the default is defined by the container runtime in use.
-                                      StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                    type: string
                                 type: object
                               livenessProbe:
                                 description: Probes are not allowed for ephemeral containers.
@@ -3409,7 +3274,7 @@ spec:
                                       Claims lists the names of resources, defined in spec.resourceClaims,
                                       that are used by this container.
 
-                                      This field depends on the
+                                      This is an alpha field and requires enabling the
                                       DynamicResourceAllocation feature gate.
 
                                       This field is immutable. It can only be set for containers.
@@ -3461,51 +3326,9 @@ spec:
                                 description: |-
                                   Restart policy for the container to manage the restart behavior of each
                                   container within a pod.
-                                  You cannot set this field on ephemeral containers.
-                                type: string
-                              restartPolicyRules:
-                                description: |-
-                                  Represents a list of rules to be checked to determine if the
-                                  container should be restarted on exit. You cannot set this field on
+                                  This may only be set for init containers. You cannot set this field on
                                   ephemeral containers.
-                                items:
-                                  description: ContainerRestartRule describes how a container exit is handled.
-                                  properties:
-                                    action:
-                                      description: |-
-                                        Specifies the action taken on a container exit if the requirements
-                                        are satisfied. The only possible value is "Restart" to restart the
-                                        container.
-                                      type: string
-                                    exitCodes:
-                                      description: Represents the exit codes to check on container exits.
-                                      properties:
-                                        operator:
-                                          description: |-
-                                            Represents the relationship between the container exit code(s) and the
-                                            specified values. Possible values are:
-                                            - In: the requirement is satisfied if the container exit code is in the
-                                              set of specified values.
-                                            - NotIn: the requirement is satisfied if the container exit code is
-                                              not in the set of specified values.
-                                          type: string
-                                        values:
-                                          description: |-
-                                            Specifies the set of values to check for container exit codes.
-                                            At most 255 elements are allowed.
-                                          items:
-                                            format: int32
-                                            type: integer
-                                          type: array
-                                          x-kubernetes-list-type: set
-                                      required:
-                                        - operator
-                                      type: object
-                                  required:
-                                    - action
-                                  type: object
-                                type: array
-                                x-kubernetes-list-type: atomic
+                                type: string
                               securityContext:
                                 description: |-
                                   Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -4024,9 +3847,7 @@ spec:
                         hostNetwork:
                           description: |-
                             Host networking requested for this pod. Use the host's network namespace.
-                            When using HostNetwork you should specify ports so the scheduler is aware.
-                            When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
-                            and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
+                            If this option is set, the ports that will be used must be specified.
                             Default to false.
                           type: boolean
                         hostPID:
@@ -4051,19 +3872,6 @@ spec:
                             Specifies the hostname of the Pod
                             If not specified, the pod's hostname will be set to a system-defined value.
                           type: string
-                        hostnameOverride:
-                          description: |-
-                            HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
-                            This field only specifies the pod's hostname and does not affect its DNS records.
-                            When this field is set to a non-empty string:
-                            - It takes precedence over the values set in `hostname` and `subdomain`.
-                            - The Pod's hostname will be set to this value.
-                            - `setHostnameAsFQDN` must be nil or set to false.
-                            - `hostNetwork` must be set to false.
-
-                            This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
-                            Requires the HostnameOverride feature gate to be enabled.
-                          type: string
                         imagePullSecrets:
                           description: |-
                             ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -4099,7 +3907,7 @@ spec:
                             Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.
                             The resourceRequirements of an init container are taken into account during scheduling
                             by finding the highest request/limit for each resource type, and then using the max of
-                            that value or the sum of the normal containers. Limits are applied to init containers
+                            of that value or the sum of the normal containers. Limits are applied to init containers
                             in a similar fashion.
                             Init containers cannot currently be added or removed.
                             Cannot be updated.
@@ -4143,9 +3951,7 @@ spec:
                                   description: EnvVar represents an environment variable present in a Container.
                                   properties:
                                     name:
-                                      description: |-
-                                        Name of the environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: Name of the environment variable. Must be a C_IDENTIFIER.
                                       type: string
                                     value:
                                       description: |-
@@ -4199,42 +4005,6 @@ spec:
                                             - fieldPath
                                           type: object
                                           x-kubernetes-map-type: atomic
-                                        fileKeyRef:
-                                          description: |-
-                                            FileKeyRef selects a key of the env file.
-                                            Requires the EnvFiles feature gate to be enabled.
-                                          properties:
-                                            key:
-                                              description: |-
-                                                The key within the env file. An invalid key will prevent the pod from starting.
-                                                The keys defined within a source may consist of any printable ASCII characters except '='.
-                                                During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                              type: string
-                                            optional:
-                                              default: false
-                                              description: |-
-                                                Specify whether the file or its key must be defined. If the file or key
-                                                does not exist, then the env var is not published.
-                                                If optional is set to true and the specified key does not exist,
-                                                the environment variable will not be set in the Pod's containers.
-
-                                                If optional is set to false and the specified key does not exist,
-                                                an error will be returned during Pod creation.
-                                              type: boolean
-                                            path:
-                                              description: |-
-                                                The path within the volume from which to select the file.
-                                                Must be relative and may not contain the '..' path or start with '..'.
-                                              type: string
-                                            volumeName:
-                                              description: The name of the volume mount containing the env file.
-                                              type: string
-                                          required:
-                                            - key
-                                            - path
-                                            - volumeName
-                                          type: object
-                                          x-kubernetes-map-type: atomic
                                         resourceFieldRef:
                                           description: |-
                                             Selects a resource of the container: only resources limits and requests
@@ -4290,13 +4060,13 @@ spec:
                               envFrom:
                                 description: |-
                                   List of sources to populate environment variables in the container.
-                                  The keys defined within a source may consist of any printable ASCII characters except '='.
-                                  When a key exists in multiple
+                                  The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                  will be reported as an event when the container is starting. When a key exists in multiple
                                   sources, the value associated with the last source will take precedence.
                                   Values defined by an Env with a duplicate key will take precedence.
                                   Cannot be updated.
                                 items:
-                                  description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                                  description: EnvFromSource represents the source of a set of ConfigMaps
                                   properties:
                                     configMapRef:
                                       description: The ConfigMap to select from
@@ -4316,9 +4086,7 @@ spec:
                                       type: object
                                       x-kubernetes-map-type: atomic
                                     prefix:
-                                      description: |-
-                                        Optional text to prepend to the name of each environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                       type: string
                                     secretRef:
                                       description: The Secret to select from
@@ -4567,12 +4335,6 @@ spec:
                                           - port
                                         type: object
                                     type: object
-                                  stopSignal:
-                                    description: |-
-                                      StopSignal defines which signal will be sent to a container when it is being stopped.
-                                      If not specified, the default is defined by the container runtime in use.
-                                      StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                    type: string
                                 type: object
                               livenessProbe:
                                 description: |-
@@ -4963,7 +4725,7 @@ spec:
                                       Claims lists the names of resources, defined in spec.resourceClaims,
                                       that are used by this container.
 
-                                      This field depends on the
+                                      This is an alpha field and requires enabling the
                                       DynamicResourceAllocation feature gate.
 
                                       This field is immutable. It can only be set for containers.
@@ -5014,10 +4776,10 @@ spec:
                               restartPolicy:
                                 description: |-
                                   RestartPolicy defines the restart behavior of individual containers in a pod.
-                                  This overrides the pod-level restart policy. When this field is not specified,
+                                  This field may only be set for init containers, and the only allowed value is "Always".
+                                  For non-init containers or when this field is not specified,
                                   the restart behavior is defined by the Pod's restart policy and the container type.
-                                  Additionally, setting the RestartPolicy as "Always" for the init container will
-                                  have the following effect:
+                                  Setting the RestartPolicy as "Always" for the init container will have the following effect:
                                   this init container will be continually restarted on
                                   exit until all regular containers have terminated. Once all regular
                                   containers have completed, all init containers with restartPolicy "Always"
@@ -5029,57 +4791,6 @@ spec:
                                   init container is started, or after any startupProbe has successfully
                                   completed.
                                 type: string
-                              restartPolicyRules:
-                                description: |-
-                                  Represents a list of rules to be checked to determine if the
-                                  container should be restarted on exit. The rules are evaluated in
-                                  order. Once a rule matches a container exit condition, the remaining
-                                  rules are ignored. If no rule matches the container exit condition,
-                                  the Container-level restart policy determines the whether the container
-                                  is restarted or not. Constraints on the rules:
-                                  - At most 20 rules are allowed.
-                                  - Rules can have the same action.
-                                  - Identical rules are not forbidden in validations.
-                                  When rules are specified, container MUST set RestartPolicy explicitly
-                                  even it if matches the Pod's RestartPolicy.
-                                items:
-                                  description: ContainerRestartRule describes how a container exit is handled.
-                                  properties:
-                                    action:
-                                      description: |-
-                                        Specifies the action taken on a container exit if the requirements
-                                        are satisfied. The only possible value is "Restart" to restart the
-                                        container.
-                                      type: string
-                                    exitCodes:
-                                      description: Represents the exit codes to check on container exits.
-                                      properties:
-                                        operator:
-                                          description: |-
-                                            Represents the relationship between the container exit code(s) and the
-                                            specified values. Possible values are:
-                                            - In: the requirement is satisfied if the container exit code is in the
-                                              set of specified values.
-                                            - NotIn: the requirement is satisfied if the container exit code is
-                                              not in the set of specified values.
-                                          type: string
-                                        values:
-                                          description: |-
-                                            Specifies the set of values to check for container exit codes.
-                                            At most 255 elements are allowed.
-                                          items:
-                                            format: int32
-                                            type: integer
-                                          type: array
-                                          x-kubernetes-list-type: set
-                                      required:
-                                        - operator
-                                      type: object
-                                  required:
-                                    - action
-                                  type: object
-                                type: array
-                                x-kubernetes-list-type: atomic
                               securityContext:
                                 description: |-
                                   SecurityContext defines the security options the container should be run with.
@@ -5593,7 +5304,6 @@ spec:
                             - spec.hostPID
                             - spec.hostIPC
                             - spec.hostUsers
-                            - spec.resources
                             - spec.securityContext.appArmorProfile
                             - spec.securityContext.seLinuxOptions
                             - spec.securityContext.seccompProfile
@@ -5745,7 +5455,7 @@ spec:
                           description: |-
                             Resources is the total amount of CPU and Memory resources required by all
                             containers in the pod. It supports specifying Requests and Limits for
-                            "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
+                            "cpu" and "memory" resource names only. ResourceClaims are not supported.
 
                             This field enables fine-grained control over resource allocation for the
                             entire pod, allowing resource sharing among containers in a pod.
@@ -5758,7 +5468,7 @@ spec:
                                 Claims lists the names of resources, defined in spec.resourceClaims,
                                 that are used by this container.
 
-                                This field depends on the
+                                This is an alpha field and requires enabling the
                                 DynamicResourceAllocation feature gate.
 
                                 This field is immutable. It can only be set for containers.
@@ -6286,6 +5996,7 @@ spec:
                                   - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
 
                                   If this value is nil, the behavior is equivalent to the Honor policy.
+                                  This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                                 type: string
                               nodeTaintsPolicy:
                                 description: |-
@@ -6296,6 +6007,7 @@ spec:
                                   - Ignore: node taints are ignored. All nodes are included.
 
                                   If this value is nil, the behavior is equivalent to the Ignore policy.
+                                  This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                                 type: string
                               topologyKey:
                                 description: |-
@@ -7001,13 +6713,15 @@ spec:
                                               volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                               If specified, the CSI driver will create or update the volume with the attributes defined
                                               in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                              it can be changed after the claim is created. An empty string or nil value indicates that no
-                                              VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
-                                              this field can be reset to its previous value (including nil) to cancel the modification.
+                                              it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
+                                              will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
+                                              If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
+                                              will be set by the persistentvolume controller if it exists.
                                               If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                               set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                               exists.
                                               More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
+                                              (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                             type: string
                                           volumeMode:
                                             description: |-
@@ -7181,9 +6895,12 @@ spec:
                                 description: |-
                                   glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                   Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
+                                  More info: https://examples.k8s.io/volumes/glusterfs/README.md
                                 properties:
                                   endpoints:
-                                    description: endpoints is the endpoint name that details Glusterfs topology.
+                                    description: |-
+                                      endpoints is the endpoint name that details Glusterfs topology.
+                                      More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
                                     type: string
                                   path:
                                     description: |-
@@ -7237,7 +6954,7 @@ spec:
                                   The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
                                   The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
                                   The volume will be mounted read-only (ro) and non-executable files (noexec).
-                                  Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
+                                  Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
                                   The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
                                 properties:
                                   pullPolicy:
@@ -7262,7 +6979,7 @@ spec:
                                 description: |-
                                   iscsi represents an ISCSI Disk resource that is attached to a
                                   kubelet's host machine and then exposed to the pod.
-                                  More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
+                                  More info: https://examples.k8s.io/volumes/iscsi/README.md
                                 properties:
                                   chapAuthDiscovery:
                                     description: chapAuthDiscovery defines whether support iSCSI Discovery CHAP authentication
@@ -7652,110 +7369,6 @@ spec:
                                               type: array
                                               x-kubernetes-list-type: atomic
                                           type: object
-                                        podCertificate:
-                                          description: |-
-                                            Projects an auto-rotating credential bundle (private key and certificate
-                                            chain) that the pod can use either as a TLS client or server.
-
-                                            Kubelet generates a private key and uses it to send a
-                                            PodCertificateRequest to the named signer.  Once the signer approves the
-                                            request and issues a certificate chain, Kubelet writes the key and
-                                            certificate chain to the pod filesystem.  The pod does not start until
-                                            certificates have been issued for each podCertificate projected volume
-                                            source in its spec.
-
-                                            Kubelet will begin trying to rotate the certificate at the time indicated
-                                            by the signer using the PodCertificateRequest.Status.BeginRefreshAt
-                                            timestamp.
-
-                                            Kubelet can write a single file, indicated by the credentialBundlePath
-                                            field, or separate files, indicated by the keyPath and
-                                            certificateChainPath fields.
-
-                                            The credential bundle is a single file in PEM format.  The first PEM
-                                            entry is the private key (in PKCS#8 format), and the remaining PEM
-                                            entries are the certificate chain issued by the signer (typically,
-                                            signers will return their certificate chain in leaf-to-root order).
-
-                                            Prefer using the credential bundle format, since your application code
-                                            can read it atomically.  If you use keyPath and certificateChainPath,
-                                            your application must make two separate file reads. If these coincide
-                                            with a certificate rotation, it is possible that the private key and leaf
-                                            certificate you read may not correspond to each other.  Your application
-                                            will need to check for this condition, and re-read until they are
-                                            consistent.
-
-                                            The named signer controls chooses the format of the certificate it
-                                            issues; consult the signer implementation's documentation to learn how to
-                                            use the certificates it issues.
-                                          properties:
-                                            certificateChainPath:
-                                              description: |-
-                                                Write the certificate chain at this path in the projected volume.
-
-                                                Most applications should use credentialBundlePath.  When using keyPath
-                                                and certificateChainPath, your application needs to check that the key
-                                                and leaf certificate are consistent, because it is possible to read the
-                                                files mid-rotation.
-                                              type: string
-                                            credentialBundlePath:
-                                              description: |-
-                                                Write the credential bundle at this path in the projected volume.
-
-                                                The credential bundle is a single file that contains multiple PEM blocks.
-                                                The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
-                                                key.
-
-                                                The remaining blocks are CERTIFICATE blocks, containing the issued
-                                                certificate chain from the signer (leaf and any intermediates).
-
-                                                Using credentialBundlePath lets your Pod's application code make a single
-                                                atomic read that retrieves a consistent key and certificate chain.  If you
-                                                project them to separate files, your application code will need to
-                                                additionally check that the leaf certificate was issued to the key.
-                                              type: string
-                                            keyPath:
-                                              description: |-
-                                                Write the key at this path in the projected volume.
-
-                                                Most applications should use credentialBundlePath.  When using keyPath
-                                                and certificateChainPath, your application needs to check that the key
-                                                and leaf certificate are consistent, because it is possible to read the
-                                                files mid-rotation.
-                                              type: string
-                                            keyType:
-                                              description: |-
-                                                The type of keypair Kubelet will generate for the pod.
-
-                                                Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
-                                                "ECDSAP521", and "ED25519".
-                                              type: string
-                                            maxExpirationSeconds:
-                                              description: |-
-                                                maxExpirationSeconds is the maximum lifetime permitted for the
-                                                certificate.
-
-                                                Kubelet copies this value verbatim into the PodCertificateRequests it
-                                                generates for this projection.
-
-                                                If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
-                                                will reject values shorter than 3600 (1 hour).  The maximum allowable
-                                                value is 7862400 (91 days).
-
-                                                The signer implementation is then free to issue a certificate with any
-                                                lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
-                                                seconds (1 hour).  This constraint is enforced by kube-apiserver.
-                                                `kubernetes.io` signers will never issue certificates with a lifetime
-                                                longer than 24 hours.
-                                              format: int32
-                                              type: integer
-                                            signerName:
-                                              description: Kubelet's generated CSRs will be addressed to this signer.
-                                              type: string
-                                          required:
-                                            - keyType
-                                            - signerName
-                                          type: object
                                         secret:
                                           description: secret information about the secret data to project
                                           properties:
@@ -7885,6 +7498,7 @@ spec:
                                 description: |-
                                   rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                   Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
+                                  More info: https://examples.k8s.io/volumes/rbd/README.md
                                 properties:
                                   fsType:
                                     description: |-

charts/gha-runner-scale-set/Chart.yaml

@@ -15,13 +15,13 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.13.1
+version: 0.12.1
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "0.13.1"
+appVersion: "0.12.1"
 
 home: https://github.com/actions/actions-runner-controller
 

charts/gha-runner-scale-set/templates/autoscalingrunnerset.yaml

@@ -11,42 +11,23 @@ metadata:
   name: {{ include "gha-runner-scale-set.scale-set-name" . | replace "_" "-" }}
   namespace: {{ include "gha-runner-scale-set.namespace" . }}
   labels:
-    {{- $base := include "gha-runner-scale-set.labels" . | fromYaml }}
-    {{- $extra := dict "app.kubernetes.io/component" "" }}
-    {{- $reserved := merge $base $extra }}
     {{- with .Values.labels }}
-    {{- range $k, $v := . }}
-    {{- if not (or (hasKey $reserved $k) (hasPrefix "actions.github.com/" $k)) }}
-    {{ $k }}: {{ $v | quote }}
-    {{- end }}
-    {{- end }}
+    {{- toYaml . | nindent 4 }}
     {{- end }}
     {{- if $hasCustomResourceMeta }}
     {{- with .Values.resourceMeta.autoscalingRunnerSet.labels }}
-    {{- range $k, $v := . }}
-    {{- if not (or (hasKey $reserved $k) (hasPrefix "actions.github.com/" $k)) }}
-    {{ $k }}: {{ $v | quote }}
-    {{- end }}
-    {{- end }}
+    {{- toYaml . | nindent 4 }}
     {{- end }}
     {{- end }}
     app.kubernetes.io/component: "autoscaling-runner-set"
     {{- include "gha-runner-scale-set.labels" . | nindent 4 }}
   annotations:
     {{- with .Values.annotations }}
-    {{- range $k, $v := . }}
-    {{- if not (or (hasPrefix "actions.github.com/cleanup-" $k) (eq $k "actions.github.com/values-hash")) }}
-    {{ $k }}: {{ $v | quote }}
-    {{- end }}
-    {{- end }}
+    {{- toYaml . | nindent 4 }}
     {{- end }}
     {{- if $hasCustomResourceMeta }}
     {{- with .Values.resourceMeta.autoscalingRunnerSet.annotations }}
-    {{- range $k, $v := . }}
-    {{- if not (or (hasPrefix "actions.github.com/cleanup-" $k) (eq $k "actions.github.com/values-hash")) }}
-    {{ $k }}: {{ $v | quote }}
-    {{- end }}
-    {{- end }}
+    {{- toYaml . | nindent 4 }}
     {{- end }}
     {{- end }}
     actions.github.com/values-hash: {{ toJson .Values | sha256sum | trunc 63 }}

charts/gha-runner-scale-set/templates/githubsecret.yaml

@@ -6,15 +6,8 @@ metadata:
   name: {{ include "gha-runner-scale-set.githubsecret" . }}
   namespace: {{ include "gha-runner-scale-set.namespace" . }}
   labels:
-    {{- $base := include "gha-runner-scale-set.labels" . | fromYaml }}
-    {{- $extra := dict "app.kubernetes.io/component" "" }}
-    {{- $reserved := merge $base $extra }}
     {{- with .Values.labels }}
-    {{- range $k, $v := . }}
-    {{- if not (or (hasKey $reserved $k) (hasPrefix "actions.github.com/" $k)) }}
-    {{ $k }}: {{ $v | quote }}
-    {{- end }}
-    {{- end }}
+    {{- toYaml . | nindent 4 }}
     {{- end }}
     {{- if $hasCustomResourceMeta }}
     {{- with .Values.resourceMeta.githubConfigSecret.labels }}

charts/gha-runner-scale-set/templates/kube_mode_role.yaml

@@ -8,15 +8,8 @@ metadata:
   name: {{ include "gha-runner-scale-set.kubeModeRoleName" . }}
   namespace: {{ include "gha-runner-scale-set.namespace" . }}
   labels:
-    {{- $base := include "gha-runner-scale-set.labels" . | fromYaml }}
-    {{- $extra := dict "app.kubernetes.io/component" "" }}
-    {{- $reserved := merge $base $extra }}
     {{- with .Values.labels }}
-    {{- range $k, $v := . }}
-    {{- if not (or (hasKey $reserved $k) (hasPrefix "actions.github.com/" $k)) }}
-    {{ $k }}: {{ $v | quote }}
-    {{- end }}
-    {{- end }}
+    {{- toYaml . | nindent 4 }}
     {{- end }}
     {{- if $hasCustomResourceMeta }}
     {{- with .Values.resourceMeta.kubernetesModeRole.labels }}
@@ -36,24 +29,21 @@ metadata:
   finalizers:
     - actions.github.com/cleanup-protection
 rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list", "create", "delete"]
-  - apiGroups: [""]
-    resources: ["pods/exec"]
-    verbs: ["get", "create"]
-  - apiGroups: [""]
-    resources: ["pods/log"]
-    verbs: ["get", "list", "watch",]
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "list", "create", "delete"]
+- apiGroups: [""]
+  resources: ["pods/exec"]
+  verbs: ["get", "create"]
+- apiGroups: [""]
+  resources: ["pods/log"]
+  verbs: ["get", "list", "watch",]
 {{- if ne $containerMode.type "kubernetes-novolume" }}
-  - apiGroups: ["batch"]
-    resources: ["jobs"]
-    verbs: ["get", "list", "create", "delete"]
-{{- end }}
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "list", "create", "delete"]
-{{- with $containerMode.kubernetesModeAdditionalRoleRules}}
-{{- toYaml . | nindent 2}}
+- apiGroups: ["batch"]
+  resources: ["jobs"]
+  verbs: ["get", "list", "create", "delete"]
 {{- end }}
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "list", "create", "delete"]
 {{- end }}

charts/gha-runner-scale-set/templates/kube_mode_role_binding.yaml

@@ -7,15 +7,8 @@ metadata:
   name: {{ include "gha-runner-scale-set.kubeModeRoleBindingName" . }}
   namespace: {{ include "gha-runner-scale-set.namespace" . }}
   labels:
-    {{- $base := include "gha-runner-scale-set.labels" . | fromYaml }}
-    {{- $extra := dict "app.kubernetes.io/component" "" }}
-    {{- $reserved := merge $base $extra }}
     {{- with .Values.labels }}
-    {{- range $k, $v := . }}
-    {{- if not (or (hasKey $reserved $k) (hasPrefix "actions.github.com/" $k)) }}
-    {{ $k }}: {{ $v | quote }}
-    {{- end }}
-    {{- end }}
+    {{- toYaml . | nindent 4 }}
     {{- end }}
     {{- if $hasCustomResourceMeta }}
     {{- with .Values.resourceMeta.kubernetesModeRoleBinding.labels }}

charts/gha-runner-scale-set/templates/kube_mode_serviceaccount.yaml

@@ -18,15 +18,8 @@ metadata:
     {{- end }}
   {{- end }}
   labels:
-    {{- $base := include "gha-runner-scale-set.labels" . | fromYaml }}
-    {{- $extra := dict "app.kubernetes.io/component" "" }}
-    {{- $reserved := merge $base $extra }}
     {{- with .Values.labels }}
-    {{- range $k, $v := . }}
-    {{- if not (or (hasKey $reserved $k) (hasPrefix "actions.github.com/" $k)) }}
-    {{ $k }}: {{ $v | quote }}
-    {{- end }}
-    {{- end }}
+    {{- toYaml . | nindent 4 }}
     {{- end }}
     {{- if $hasCustomResourceMeta }}
     {{- with .Values.resourceMeta.kubernetesModeServiceAccount.labels }}

charts/gha-runner-scale-set/templates/manager_role.yaml

@@ -5,15 +5,8 @@ metadata:
   name: {{ include "gha-runner-scale-set.managerRoleName" . }}
   namespace: {{ include "gha-runner-scale-set.namespace" . }}
   labels:
-    {{- $base := include "gha-runner-scale-set.labels" . | fromYaml }}
-    {{- $extra := dict "app.kubernetes.io/component" "manager-role" }}
-    {{- $reserved := merge $base $extra }}
     {{- with .Values.labels }}
-    {{- range $k, $v := . }}
-    {{- if not (or (hasKey $reserved $k) (hasPrefix "actions.github.com/" $k)) }}
-    {{ $k }}: {{ $v | quote }}
-    {{- end }}
-    {{- end }}
+    {{- toYaml . | nindent 4 }}
     {{- end }}
     {{- if $hasCustomResourceMeta }}
     {{- with .Values.resourceMeta.managerRole.labels }}

charts/gha-runner-scale-set/templates/manager_role_binding.yaml

@@ -5,15 +5,8 @@ metadata:
   name: {{ include "gha-runner-scale-set.managerRoleBindingName" . }}
   namespace: {{ include "gha-runner-scale-set.namespace" . }}
   labels:
-    {{- $base := include "gha-runner-scale-set.labels" . | fromYaml }}
-    {{- $extra := dict "app.kubernetes.io/component" "manager-role-binding" }}
-    {{- $reserved := merge $base $extra }}
     {{- with .Values.labels }}
-    {{- range $k, $v := . }}
-    {{- if not (or (hasKey $reserved $k) (hasPrefix "actions.github.com/" $k)) }}
-    {{ $k }}: {{ $v | quote }}
-    {{- end }}
-    {{- end }}
+    {{- toYaml . | nindent 4 }}
     {{- end }}
     {{- if $hasCustomResourceMeta }}
     {{- with .Values.resourceMeta.managerRoleBinding.labels }}

charts/gha-runner-scale-set/templates/no_permission_serviceaccount.yaml

@@ -7,15 +7,8 @@ metadata:
   name: {{ include "gha-runner-scale-set.noPermissionServiceAccountName" . }}
   namespace: {{ include "gha-runner-scale-set.namespace" . }}
   labels:
-    {{- $base := include "gha-runner-scale-set.labels" . | fromYaml }}
-    {{- $extra := dict "app.kubernetes.io/component" "" }}
-    {{- $reserved := merge $base $extra }}
     {{- with .Values.labels }}
-    {{- range $k, $v := . }}
-    {{- if not (or (hasKey $reserved $k) (hasPrefix "actions.github.com/" $k)) }}
-    {{ $k }}: {{ $v | quote }}
-    {{- end }}
-    {{- end }}
+    {{- toYaml . | nindent 4 }}
     {{- end }}
     {{- if $hasCustomResourceMeta }}
     {{- with .Values.resourceMeta.noPermissionServiceAccount.labels }}

charts/gha-runner-scale-set/tests/values_k8s_extra_role_rules.yaml

@@ -1,30 +0,0 @@
-githubConfigUrl: https://github.com/actions/actions-runner-controller
-githubConfigSecret:
-  github_token: test
-template:
-  spec:
-    containers:
-      - name: other
-        image: other-image:latest
-    volumes:
-      - name: foo
-        emptyDir: {}
-      - name: bar
-        emptyDir: {}
-      - name: work
-        hostPath:
-          path: /data
-          type: Directory
-containerMode:
-  type: kubernetes
-  kubernetesModeAdditionalRoleRule:
-    - apiGroups:
-        - apps
-      resources:
-        - deployments
-      verbs:
-        - get
-        - list
-        - create
-        - delete
-

charts/gha-runner-scale-set/values.yaml

@@ -124,7 +124,6 @@ githubConfigSecret:
 #     resources:
 #       requests:
 #         storage: 1Gi
-#   kubernetesModeAdditionalRoleRules: []
 #
 
 ## listenerTemplate is the PodSpec for each listener Pod

cmd/ghalistener/app/app.go

@@ -0,0 +1,143 @@
+package app
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/actions/actions-runner-controller/cmd/ghalistener/config"
+	"github.com/actions/actions-runner-controller/cmd/ghalistener/listener"
+	"github.com/actions/actions-runner-controller/cmd/ghalistener/metrics"
+	"github.com/actions/actions-runner-controller/cmd/ghalistener/worker"
+	"github.com/actions/actions-runner-controller/github/actions"
+	"github.com/go-logr/logr"
+	"golang.org/x/sync/errgroup"
+)
+
+// App is responsible for initializing required components and running the app.
+type App struct {
+	// configured fields
+	config *config.Config
+	logger logr.Logger
+
+	// initialized fields
+	listener Listener
+	worker   Worker
+	metrics  metrics.ServerExporter
+}
+
+//go:generate mockery --name Listener --output ./mocks --outpkg mocks --case underscore
+type Listener interface {
+	Listen(ctx context.Context, handler listener.Handler) error
+}
+
+//go:generate mockery --name Worker --output ./mocks --outpkg mocks --case underscore
+type Worker interface {
+	HandleJobStarted(ctx context.Context, jobInfo *actions.JobStarted) error
+	HandleDesiredRunnerCount(ctx context.Context, count int, jobsCompleted int) (int, error)
+}
+
+func New(config config.Config) (*App, error) {
+	if err := config.Validate(); err != nil {
+		return nil, fmt.Errorf("failed to validate config: %w", err)
+	}
+
+	app := &App{
+		config: &config,
+	}
+
+	ghConfig, err := actions.ParseGitHubConfigFromURL(config.ConfigureUrl)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse GitHub config from URL: %w", err)
+	}
+
+	{
+		logger, err := config.Logger()
+		if err != nil {
+			return nil, fmt.Errorf("failed to create logger: %w", err)
+		}
+		app.logger = logger.WithName("listener-app")
+	}
+
+	actionsClient, err := config.ActionsClient(app.logger)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create actions client: %w", err)
+	}
+
+	if config.MetricsAddr != "" {
+		app.metrics = metrics.NewExporter(metrics.ExporterConfig{
+			ScaleSetName:      config.EphemeralRunnerSetName,
+			ScaleSetNamespace: config.EphemeralRunnerSetNamespace,
+			Enterprise:        ghConfig.Enterprise,
+			Organization:      ghConfig.Organization,
+			Repository:        ghConfig.Repository,
+			ServerAddr:        config.MetricsAddr,
+			ServerEndpoint:    config.MetricsEndpoint,
+			Metrics:           config.Metrics,
+			Logger:            app.logger.WithName("metrics exporter"),
+		})
+	}
+
+	worker, err := worker.New(
+		worker.Config{
+			EphemeralRunnerSetNamespace: config.EphemeralRunnerSetNamespace,
+			EphemeralRunnerSetName:      config.EphemeralRunnerSetName,
+			MaxRunners:                  config.MaxRunners,
+			MinRunners:                  config.MinRunners,
+		},
+		worker.WithLogger(app.logger.WithName("worker")),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create new kubernetes worker: %w", err)
+	}
+	app.worker = worker
+
+	listener, err := listener.New(listener.Config{
+		Client:     actionsClient,
+		ScaleSetID: app.config.RunnerScaleSetId,
+		MinRunners: app.config.MinRunners,
+		MaxRunners: app.config.MaxRunners,
+		Logger:     app.logger.WithName("listener"),
+		Metrics:    app.metrics,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to create new listener: %w", err)
+	}
+	app.listener = listener
+
+	app.logger.Info("app initialized")
+
+	return app, nil
+}
+
+func (app *App) Run(ctx context.Context) error {
+	var errs []error
+	if app.worker == nil {
+		errs = append(errs, fmt.Errorf("worker not initialized"))
+	}
+	if app.listener == nil {
+		errs = append(errs, fmt.Errorf("listener not initialized"))
+	}
+	if err := errors.Join(errs...); err != nil {
+		return fmt.Errorf("app not initialized: %w", err)
+	}
+
+	g, ctx := errgroup.WithContext(ctx)
+	metricsCtx, cancelMetrics := context.WithCancelCause(ctx)
+
+	g.Go(func() error {
+		app.logger.Info("Starting listener")
+		listnerErr := app.listener.Listen(ctx, app.worker)
+		cancelMetrics(fmt.Errorf("Listener exited: %w", listnerErr))
+		return listnerErr
+	})
+
+	if app.metrics != nil {
+		g.Go(func() error {
+			app.logger.Info("Starting metrics server")
+			return app.metrics.ListenAndServe(metricsCtx)
+		})
+	}
+
+	return g.Wait()
+}

cmd/ghalistener/app/app_test.go

@@ -0,0 +1,85 @@
+package app
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	appmocks "github.com/actions/actions-runner-controller/cmd/ghalistener/app/mocks"
+	"github.com/actions/actions-runner-controller/cmd/ghalistener/listener"
+	metricsMocks "github.com/actions/actions-runner-controller/cmd/ghalistener/metrics/mocks"
+	"github.com/actions/actions-runner-controller/cmd/ghalistener/worker"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+)
+
+func TestApp_Run(t *testing.T) {
+	t.Parallel()
+
+	t.Run("ListenerWorkerGuard", func(t *testing.T) {
+		invalidApps := []*App{
+			{},
+			{worker: &worker.Worker{}},
+			{listener: &listener.Listener{}},
+		}
+
+		for _, app := range invalidApps {
+			assert.Error(t, app.Run(context.Background()))
+		}
+	})
+
+	t.Run("ExitsOnListenerError", func(t *testing.T) {
+		listener := appmocks.NewListener(t)
+		worker := appmocks.NewWorker(t)
+
+		listener.On("Listen", mock.Anything, mock.Anything).Return(errors.New("listener error")).Once()
+
+		app := &App{
+			listener: listener,
+			worker:   worker,
+		}
+
+		err := app.Run(context.Background())
+		assert.Error(t, err)
+	})
+
+	t.Run("ExitsOnListenerNil", func(t *testing.T) {
+		listener := appmocks.NewListener(t)
+		worker := appmocks.NewWorker(t)
+
+		listener.On("Listen", mock.Anything, mock.Anything).Return(nil).Once()
+
+		app := &App{
+			listener: listener,
+			worker:   worker,
+		}
+
+		err := app.Run(context.Background())
+		assert.NoError(t, err)
+	})
+
+	t.Run("CancelListenerOnMetricsServerError", func(t *testing.T) {
+		listener := appmocks.NewListener(t)
+		worker := appmocks.NewWorker(t)
+		metrics := metricsMocks.NewServerPublisher(t)
+		ctx := context.Background()
+
+		listener.On("Listen", mock.Anything, mock.Anything).Run(func(args mock.Arguments) {
+			ctx := args.Get(0).(context.Context)
+			go func() {
+				<-ctx.Done()
+			}()
+		}).Return(nil).Once()
+
+		metrics.On("ListenAndServe", mock.Anything).Return(errors.New("metrics server error")).Once()
+
+		app := &App{
+			listener: listener,
+			worker:   worker,
+			metrics:  metrics,
+		}
+
+		err := app.Run(ctx)
+		assert.Error(t, err)
+	})
+}

cmd/ghalistener/app/mocks/listener.go

@@ -0,0 +1,43 @@
+// Code generated by mockery v2.36.1. DO NOT EDIT.
+
+package mocks
+
+import (
+	context "context"
+
+	listener "github.com/actions/actions-runner-controller/cmd/ghalistener/listener"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// Listener is an autogenerated mock type for the Listener type
+type Listener struct {
+	mock.Mock
+}
+
+// Listen provides a mock function with given fields: ctx, handler
+func (_m *Listener) Listen(ctx context.Context, handler listener.Handler) error {
+	ret := _m.Called(ctx, handler)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, listener.Handler) error); ok {
+		r0 = rf(ctx, handler)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// NewListener creates a new instance of Listener. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewListener(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *Listener {
+	mock := &Listener{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

cmd/ghalistener/app/mocks/worker.go

@@ -0,0 +1,68 @@
+// Code generated by mockery v2.36.1. DO NOT EDIT.
+
+package mocks
+
+import (
+	actions "github.com/actions/actions-runner-controller/github/actions"
+
+	context "context"
+
+	mock "github.com/stretchr/testify/mock"
+)
+
+// Worker is an autogenerated mock type for the Worker type
+type Worker struct {
+	mock.Mock
+}
+
+// HandleDesiredRunnerCount provides a mock function with given fields: ctx, count, acquireCount
+func (_m *Worker) HandleDesiredRunnerCount(ctx context.Context, count int, acquireCount int) (int, error) {
+	ret := _m.Called(ctx, count, acquireCount)
+
+	var r0 int
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, int, int) (int, error)); ok {
+		return rf(ctx, count, acquireCount)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, int, int) int); ok {
+		r0 = rf(ctx, count, acquireCount)
+	} else {
+		r0 = ret.Get(0).(int)
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, int, int) error); ok {
+		r1 = rf(ctx, count, acquireCount)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// HandleJobStarted provides a mock function with given fields: ctx, jobInfo
+func (_m *Worker) HandleJobStarted(ctx context.Context, jobInfo *actions.JobStarted) error {
+	ret := _m.Called(ctx, jobInfo)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, *actions.JobStarted) error); ok {
+		r0 = rf(ctx, jobInfo)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// NewWorker creates a new instance of Worker. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewWorker(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *Worker {
+	mock := &Worker{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

cmd/ghalistener/config/config.go

@@ -5,23 +5,21 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"fmt"
-	"log/slog"
 	"net/http"
 	"net/url"
 	"os"
-	"strings"
 
 	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1"
 	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1/appconfig"
 	"github.com/actions/actions-runner-controller/build"
+	"github.com/actions/actions-runner-controller/github/actions"
+	"github.com/actions/actions-runner-controller/logging"
 	"github.com/actions/actions-runner-controller/vault"
 	"github.com/actions/actions-runner-controller/vault/azurekeyvault"
-	"github.com/actions/scaleset"
+	"github.com/go-logr/logr"
 	"golang.org/x/net/http/httpproxy"
 )
 
-const appName = "ghalistener"
-
 type Config struct {
 	ConfigureUrl   string          `json:"configure_url"`
 	VaultType      vault.VaultType `json:"vault_type"`
@@ -36,7 +34,7 @@ type Config struct {
 	EphemeralRunnerSetName      string                  `json:"ephemeral_runner_set_name"`
 	MaxRunners                  int                     `json:"max_runners"`
 	MinRunners                  int                     `json:"min_runners"`
-	RunnerScaleSetID            int                     `json:"runner_scale_set_id"`
+	RunnerScaleSetId            int                     `json:"runner_scale_set_id"`
 	RunnerScaleSetName          string                  `json:"runner_scale_set_name"`
 	ServerRootCA                string                  `json:"server_root_ca"`
 	LogLevel                    string                  `json:"log_level"`
@@ -110,8 +108,8 @@ func (c *Config) Validate() error {
 		return fmt.Errorf("EphemeralRunnerSetNamespace %q or EphemeralRunnerSetName %q is missing", c.EphemeralRunnerSetNamespace, c.EphemeralRunnerSetName)
 	}
 
-	if c.RunnerScaleSetID == 0 {
-		return fmt.Errorf(`RunnerScaleSetId "%d" is missing`, c.RunnerScaleSetID)
+	if c.RunnerScaleSetId == 0 {
+		return fmt.Errorf(`RunnerScaleSetId "%d" is missing`, c.RunnerScaleSetId)
 	}
 
 	if c.MaxRunners < c.MinRunners {
@@ -136,51 +134,40 @@ func (c *Config) Validate() error {
 	return nil
 }
 
-func (c *Config) Logger() (*slog.Logger, error) {
-	var lvl slog.Level
-	switch strings.ToLower(c.LogLevel) {
-	case "debug":
-		lvl = slog.LevelDebug
-	case "info":
-		lvl = slog.LevelInfo
-	case "warn":
-		lvl = slog.LevelWarn
-	case "error":
-		lvl = slog.LevelError
-	default:
-		return nil, fmt.Errorf("invalid log level: %s", c.LogLevel)
+func (c *Config) Logger() (logr.Logger, error) {
+	logLevel := string(logging.LogLevelDebug)
+	if c.LogLevel != "" {
+		logLevel = c.LogLevel
 	}
 
-	var logger *slog.Logger
-	switch c.LogFormat {
-	case "json":
-		logger = slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{
-			AddSource: true,
-			Level:     lvl,
-		}))
-	case "text":
-		logger = slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{
-			AddSource: true,
-			Level:     lvl,
-		}))
-	default:
-		return nil, fmt.Errorf("invalid log format: %s", c.LogFormat)
+	logFormat := string(logging.LogFormatText)
+	if c.LogFormat != "" {
+		logFormat = c.LogFormat
 	}
 
-	return logger.With("app", appName), nil
+	logger, err := logging.NewLogger(logLevel, logFormat)
+	if err != nil {
+		return logr.Logger{}, fmt.Errorf("NewLogger failed: %w", err)
+	}
+
+	return logger, nil
 }
 
-func (c *Config) ActionsClient(logger *slog.Logger, clientOptions ...scaleset.HTTPOption) (*scaleset.Client, error) {
-	systemInfo := scaleset.SystemInfo{
-		System:     "actions-runner-controller",
-		Version:    build.Version,
-		CommitSHA:  build.CommitSHA,
-		ScaleSetID: c.RunnerScaleSetID,
-		Subsystem:  appName,
+func (c *Config) ActionsClient(logger logr.Logger, clientOptions ...actions.ClientOption) (*actions.Client, error) {
+	var creds actions.ActionsAuth
+	switch c.Token {
+	case "":
+		creds.AppCreds = &actions.GitHubAppAuth{
+			AppID:             c.AppID,
+			AppInstallationID: c.AppInstallationID,
+			AppPrivateKey:     c.AppPrivateKey,
+		}
+	default:
+		creds.Token = c.Token
 	}
 
-	options := append([]scaleset.HTTPOption{
-		scaleset.WithLogger(logger),
+	options := append([]actions.ClientOption{
+		actions.WithLogger(logger),
 	}, clientOptions...)
 
 	if c.ServerRootCA != "" {
@@ -194,47 +181,31 @@ func (c *Config) ActionsClient(logger *slog.Logger, clientOptions ...scaleset.HT
 			return nil, fmt.Errorf("failed to parse root certificate")
 		}
 
-		options = append(options, scaleset.WithRootCAs(pool))
+		options = append(options, actions.WithRootCAs(pool))
 	}
 
 	proxyFunc := httpproxy.FromEnvironment().ProxyFunc()
-	options = append(options, scaleset.WithProxy(func(req *http.Request) (*url.URL, error) {
+	options = append(options, actions.WithProxy(func(req *http.Request) (*url.URL, error) {
 		return proxyFunc(req.URL)
 	}))
 
-	var client *scaleset.Client
-	switch c.Token {
-	case "":
-		c, err := scaleset.NewClientWithGitHubApp(
-			scaleset.ClientWithGitHubAppConfig{
-				GitHubConfigURL: c.ConfigureUrl,
-				GitHubAppAuth: scaleset.GitHubAppAuth{
-					ClientID:       c.AppConfig.AppID,
-					InstallationID: c.AppConfig.AppInstallationID,
-					PrivateKey:     c.AppConfig.AppPrivateKey,
-				},
-				SystemInfo: systemInfo,
-			},
-			options...,
-		)
-		if err != nil {
-			return nil, fmt.Errorf("failed to instantiate client with GitHub App auth: %w", err)
-		}
-		client = c
-	default:
-		c, err := scaleset.NewClientWithPersonalAccessToken(
-			scaleset.NewClientWithPersonalAccessTokenConfig{
-				GitHubConfigURL:     c.ConfigureUrl,
-				PersonalAccessToken: c.Token,
-				SystemInfo:          systemInfo,
-			},
-			options...,
-		)
-		if err != nil {
-			return nil, fmt.Errorf("failed to instantiate client with PAT auth: %w", err)
-		}
-		client = c
+	client, err := actions.NewClient(c.ConfigureUrl, &creds, options...)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create actions client: %w", err)
 	}
 
+	client.SetUserAgent(actions.UserAgentInfo{
+		Version:    build.Version,
+		CommitSHA:  build.CommitSHA,
+		ScaleSetID: c.RunnerScaleSetId,
+		HasProxy:   hasProxy(),
+		Subsystem:  "ghalistener",
+	})
+
 	return client, nil
 }
+
+func hasProxy() bool {
+	proxyFunc := httpproxy.FromEnvironment().ProxyFunc()
+	return proxyFunc != nil
+}

cmd/ghalistener/config/config_client_test.go

@@ -3,23 +3,21 @@ package config_test
 import (
 	"context"
 	"crypto/tls"
-	"encoding/json"
-	"log/slog"
 	"net/http"
+	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"testing"
 
 	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1/appconfig"
 	"github.com/actions/actions-runner-controller/cmd/ghalistener/config"
+	"github.com/actions/actions-runner-controller/github/actions"
 	"github.com/actions/actions-runner-controller/github/actions/testserver"
-	"github.com/actions/scaleset"
+	"github.com/go-logr/logr"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
-var discardLogger = slog.New(slog.DiscardHandler)
-
 func TestCustomerServerRootCA(t *testing.T) {
 	ctx := context.Background()
 	certsFolder := filepath.Join(
@@ -61,7 +59,7 @@ func TestCustomerServerRootCA(t *testing.T) {
 		},
 	}
 
-	client, err := config.ActionsClient(discardLogger)
+	client, err := config.ActionsClient(logr.Discard())
 	require.NoError(t, err)
 	_, err = client.GetRunnerScaleSet(ctx, 1, "test")
 	require.NoError(t, err)
@@ -69,19 +67,18 @@ func TestCustomerServerRootCA(t *testing.T) {
 }
 
 func TestProxySettings(t *testing.T) {
-	assertHasProxy := func(t *testing.T, debugInfo string, want bool) {
-		type debugInfoContent struct {
-			HasProxy bool `json:"has_proxy"`
-		}
-		var got debugInfoContent
-		err := json.Unmarshal([]byte(debugInfo), &got)
-		require.NoError(t, err)
-		assert.Equal(t, want, got.HasProxy)
-	}
-
 	t.Run("http", func(t *testing.T) {
+		wentThroughProxy := false
+
+		proxy := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
+			wentThroughProxy = true
+		}))
+		t.Cleanup(func() {
+			proxy.Close()
+		})
+
 		prevProxy := os.Getenv("http_proxy")
-		os.Setenv("http_proxy", "http://proxy:8080")
+		os.Setenv("http_proxy", proxy.URL)
 		defer os.Setenv("http_proxy", prevProxy)
 
 		config := config.Config{
@@ -91,15 +88,29 @@ func TestProxySettings(t *testing.T) {
 			},
 		}
 
-		client, err := config.ActionsClient(discardLogger)
+		client, err := config.ActionsClient(logr.Discard())
 		require.NoError(t, err)
 
-		assertHasProxy(t, client.DebugInfo(), true)
+		req, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
+		require.NoError(t, err)
+		_, err = client.Do(req)
+		require.NoError(t, err)
+
+		assert.True(t, wentThroughProxy)
 	})
 
 	t.Run("https", func(t *testing.T) {
+		wentThroughProxy := false
+
+		proxy := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
+			wentThroughProxy = true
+		}))
+		t.Cleanup(func() {
+			proxy.Close()
+		})
+
 		prevProxy := os.Getenv("https_proxy")
-		os.Setenv("https_proxy", "https://proxy:443")
+		os.Setenv("https_proxy", proxy.URL)
 		defer os.Setenv("https_proxy", prevProxy)
 
 		config := config.Config{
@@ -109,16 +120,32 @@ func TestProxySettings(t *testing.T) {
 			},
 		}
 
-		client, err := config.ActionsClient(
-			discardLogger,
-			scaleset.WithRetryMax(0),
-		)
+		client, err := config.ActionsClient(logr.Discard(), actions.WithRetryMax(0))
 		require.NoError(t, err)
 
-		assertHasProxy(t, client.DebugInfo(), true)
+		req, err := http.NewRequest(http.MethodGet, "https://example.com", nil)
+		require.NoError(t, err)
+
+		_, err = client.Do(req)
+		// proxy doesn't support https
+		assert.Error(t, err)
+		assert.True(t, wentThroughProxy)
 	})
 
 	t.Run("no_proxy", func(t *testing.T) {
+		wentThroughProxy := false
+
+		proxy := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
+			wentThroughProxy = true
+		}))
+		t.Cleanup(func() {
+			proxy.Close()
+		})
+
+		prevProxy := os.Getenv("http_proxy")
+		os.Setenv("http_proxy", proxy.URL)
+		defer os.Setenv("http_proxy", prevProxy)
+
 		prevNoProxy := os.Getenv("no_proxy")
 		os.Setenv("no_proxy", "example.com")
 		defer os.Setenv("no_proxy", prevNoProxy)
@@ -130,9 +157,14 @@ func TestProxySettings(t *testing.T) {
 			},
 		}
 
-		client, err := config.ActionsClient(discardLogger)
+		client, err := config.ActionsClient(logr.Discard())
 		require.NoError(t, err)
 
-		assertHasProxy(t, client.DebugInfo(), true)
+		req, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
+		require.NoError(t, err)
+
+		_, err = client.Do(req)
+		require.NoError(t, err)
+		assert.False(t, wentThroughProxy)
 	})
 }

cmd/ghalistener/config/config_validation_test.go

@@ -13,7 +13,7 @@ func TestConfigValidationMinMax(t *testing.T) {
 		ConfigureUrl:                "github.com/some_org/some_repo",
 		EphemeralRunnerSetNamespace: "namespace",
 		EphemeralRunnerSetName:      "deployment",
-		RunnerScaleSetID:            1,
+		RunnerScaleSetId:            1,
 		MinRunners:                  5,
 		MaxRunners:                  2,
 		AppConfig: &appconfig.AppConfig{
@@ -29,7 +29,7 @@ func TestConfigValidationMissingToken(t *testing.T) {
 		ConfigureUrl:                "github.com/some_org/some_repo",
 		EphemeralRunnerSetNamespace: "namespace",
 		EphemeralRunnerSetName:      "deployment",
-		RunnerScaleSetID:            1,
+		RunnerScaleSetId:            1,
 	}
 	err := config.Validate()
 	expectedError := "AppConfig validation failed: missing app config"
@@ -49,7 +49,7 @@ func TestConfigValidationAppKey(t *testing.T) {
 			ConfigureUrl:                "github.com/some_org/some_repo",
 			EphemeralRunnerSetNamespace: "namespace",
 			EphemeralRunnerSetName:      "deployment",
-			RunnerScaleSetID:            1,
+			RunnerScaleSetId:            1,
 		}
 		err := config.Validate()
 		expectedError := "AppConfig validation failed: no credentials provided: either a PAT or GitHub App credentials should be provided"
@@ -66,7 +66,7 @@ func TestConfigValidationAppKey(t *testing.T) {
 			ConfigureUrl:                "github.com/some_org/some_repo",
 			EphemeralRunnerSetNamespace: "namespace",
 			EphemeralRunnerSetName:      "deployment",
-			RunnerScaleSetID:            1,
+			RunnerScaleSetId:            1,
 		}
 		err := config.Validate()
 		expectedError := "AppConfig validation failed: no credentials provided: either a PAT or GitHub App credentials should be provided"
@@ -85,7 +85,7 @@ func TestConfigValidationOnlyOneTypeOfCredentials(t *testing.T) {
 		ConfigureUrl:                "github.com/some_org/some_repo",
 		EphemeralRunnerSetNamespace: "namespace",
 		EphemeralRunnerSetName:      "deployment",
-		RunnerScaleSetID:            1,
+		RunnerScaleSetId:            1,
 	}
 	err := config.Validate()
 	expectedError := "AppConfig validation failed: both PAT and GitHub App credentials provided. should only provide one"
@@ -97,7 +97,7 @@ func TestConfigValidation(t *testing.T) {
 		ConfigureUrl:                "https://github.com/actions",
 		EphemeralRunnerSetNamespace: "namespace",
 		EphemeralRunnerSetName:      "deployment",
-		RunnerScaleSetID:            1,
+		RunnerScaleSetId:            1,
 		MinRunners:                  1,
 		MaxRunners:                  5,
 		AppConfig: &appconfig.AppConfig{
@@ -114,7 +114,7 @@ func TestConfigValidationConfigUrl(t *testing.T) {
 	config := &Config{
 		EphemeralRunnerSetNamespace: "namespace",
 		EphemeralRunnerSetName:      "deployment",
-		RunnerScaleSetID:            1,
+		RunnerScaleSetId:            1,
 	}
 
 	err := config.Validate()
@@ -128,7 +128,7 @@ func TestConfigValidationWithVaultConfig(t *testing.T) {
 			ConfigureUrl:                "https://github.com/actions",
 			EphemeralRunnerSetNamespace: "namespace",
 			EphemeralRunnerSetName:      "deployment",
-			RunnerScaleSetID:            1,
+			RunnerScaleSetId:            1,
 			MinRunners:                  1,
 			MaxRunners:                  5,
 			VaultType:                   vault.VaultTypeAzureKeyVault,
@@ -143,7 +143,7 @@ func TestConfigValidationWithVaultConfig(t *testing.T) {
 			ConfigureUrl:                "https://github.com/actions",
 			EphemeralRunnerSetNamespace: "namespace",
 			EphemeralRunnerSetName:      "deployment",
-			RunnerScaleSetID:            1,
+			RunnerScaleSetId:            1,
 			MinRunners:                  1,
 			MaxRunners:                  5,
 			VaultType:                   vault.VaultType("invalid_vault_type"),
@@ -158,7 +158,7 @@ func TestConfigValidationWithVaultConfig(t *testing.T) {
 			ConfigureUrl:                "https://github.com/actions",
 			EphemeralRunnerSetNamespace: "namespace",
 			EphemeralRunnerSetName:      "deployment",
-			RunnerScaleSetID:            1,
+			RunnerScaleSetId:            1,
 			MinRunners:                  1,
 			MaxRunners:                  5,
 			VaultType:                   vault.VaultTypeAzureKeyVault,

cmd/ghalistener/listener/listener.go

@@ -0,0 +1,458 @@
+package listener
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"time"
+
+	"github.com/actions/actions-runner-controller/cmd/ghalistener/metrics"
+	"github.com/actions/actions-runner-controller/github/actions"
+	"github.com/go-logr/logr"
+	"github.com/google/uuid"
+)
+
+const (
+	sessionCreationMaxRetries = 10
+)
+
+// message types
+const (
+	messageTypeJobAvailable = "JobAvailable"
+	messageTypeJobAssigned  = "JobAssigned"
+	messageTypeJobStarted   = "JobStarted"
+	messageTypeJobCompleted = "JobCompleted"
+)
+
+//go:generate mockery --name Client --output ./mocks --outpkg mocks --case underscore
+type Client interface {
+	GetAcquirableJobs(ctx context.Context, runnerScaleSetId int) (*actions.AcquirableJobList, error)
+	CreateMessageSession(ctx context.Context, runnerScaleSetId int, owner string) (*actions.RunnerScaleSetSession, error)
+	GetMessage(ctx context.Context, messageQueueUrl, messageQueueAccessToken string, lastMessageId int64, maxCapacity int) (*actions.RunnerScaleSetMessage, error)
+	DeleteMessage(ctx context.Context, messageQueueUrl, messageQueueAccessToken string, messageId int64) error
+	AcquireJobs(ctx context.Context, runnerScaleSetId int, messageQueueAccessToken string, requestIds []int64) ([]int64, error)
+	RefreshMessageSession(ctx context.Context, runnerScaleSetId int, sessionId *uuid.UUID) (*actions.RunnerScaleSetSession, error)
+	DeleteMessageSession(ctx context.Context, runnerScaleSetId int, sessionId *uuid.UUID) error
+}
+
+type Config struct {
+	Client     Client
+	ScaleSetID int
+	MinRunners int
+	MaxRunners int
+	Logger     logr.Logger
+	Metrics    metrics.Publisher
+}
+
+func (c *Config) Validate() error {
+	if c.Client == nil {
+		return errors.New("client is required")
+	}
+	if c.ScaleSetID == 0 {
+		return errors.New("scaleSetID is required")
+	}
+	if c.MinRunners < 0 {
+		return errors.New("minRunners must be greater than or equal to 0")
+	}
+	if c.MaxRunners < 0 {
+		return errors.New("maxRunners must be greater than or equal to 0")
+	}
+	if c.MaxRunners > 0 && c.MinRunners > c.MaxRunners {
+		return errors.New("minRunners must be less than or equal to maxRunners")
+	}
+	return nil
+}
+
+// The Listener's role is to manage all interactions with the actions service.
+// It receives messages and processes them using the given handler.
+type Listener struct {
+	// configured fields
+	scaleSetID int               // The ID of the scale set associated with the listener.
+	client     Client            // The client used to interact with the scale set.
+	metrics    metrics.Publisher // The publisher used to publish metrics.
+
+	// internal fields
+	logger   logr.Logger // The logger used for logging.
+	hostname string      // The hostname of the listener.
+
+	// updated fields
+	lastMessageID int64                          // The ID of the last processed message.
+	maxCapacity   int                            // The maximum number of runners that can be created.
+	session       *actions.RunnerScaleSetSession // The session for managing the runner scale set.
+}
+
+func New(config Config) (*Listener, error) {
+	if err := config.Validate(); err != nil {
+		return nil, fmt.Errorf("invalid config: %w", err)
+	}
+
+	listener := &Listener{
+		scaleSetID:  config.ScaleSetID,
+		client:      config.Client,
+		logger:      config.Logger,
+		metrics:     metrics.Discard,
+		maxCapacity: config.MaxRunners,
+	}
+
+	if config.Metrics != nil {
+		listener.metrics = config.Metrics
+	}
+
+	listener.metrics.PublishStatic(config.MinRunners, config.MaxRunners)
+
+	hostname, err := os.Hostname()
+	if err != nil {
+		hostname = uuid.NewString()
+		listener.logger.Info("Failed to get hostname, fallback to uuid", "uuid", hostname, "error", err)
+	}
+	listener.hostname = hostname
+
+	return listener, nil
+}
+
+//go:generate mockery --name Handler --output ./mocks --outpkg mocks --case underscore
+type Handler interface {
+	HandleJobStarted(ctx context.Context, jobInfo *actions.JobStarted) error
+	HandleDesiredRunnerCount(ctx context.Context, count, jobsCompleted int) (int, error)
+}
+
+// Listen listens for incoming messages and handles them using the provided handler.
+// It continuously listens for messages until the context is cancelled.
+// The initial message contains the current statistics and acquirable jobs, if any.
+// The handler is responsible for handling the initial message and subsequent messages.
+// If an error occurs during any step, Listen returns an error.
+func (l *Listener) Listen(ctx context.Context, handler Handler) error {
+	if err := l.createSession(ctx); err != nil {
+		return fmt.Errorf("createSession failed: %w", err)
+	}
+
+	defer func() {
+		if err := l.deleteMessageSession(); err != nil {
+			l.logger.Error(err, "failed to delete message session")
+		}
+	}()
+
+	initialMessage := &actions.RunnerScaleSetMessage{
+		MessageId:   0,
+		MessageType: "RunnerScaleSetJobMessages",
+		Statistics:  l.session.Statistics,
+		Body:        "",
+	}
+
+	if l.session.Statistics == nil {
+		return fmt.Errorf("session statistics is nil")
+	}
+	l.metrics.PublishStatistics(initialMessage.Statistics)
+
+	desiredRunners, err := handler.HandleDesiredRunnerCount(ctx, initialMessage.Statistics.TotalAssignedJobs, 0)
+	if err != nil {
+		return fmt.Errorf("handling initial message failed: %w", err)
+	}
+	l.metrics.PublishDesiredRunners(desiredRunners)
+
+	for {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+		}
+
+		msg, err := l.getMessage(ctx)
+		if err != nil {
+			return fmt.Errorf("failed to get message: %w", err)
+		}
+
+		if msg == nil {
+			_, err := handler.HandleDesiredRunnerCount(ctx, 0, 0)
+			if err != nil {
+				return fmt.Errorf("handling nil message failed: %w", err)
+			}
+
+			continue
+		}
+
+		// Remove cancellation from the context to avoid cancelling the message handling.
+		if err := l.handleMessage(context.WithoutCancel(ctx), handler, msg); err != nil {
+			return fmt.Errorf("failed to handle message: %w", err)
+		}
+	}
+}
+
+func (l *Listener) handleMessage(ctx context.Context, handler Handler, msg *actions.RunnerScaleSetMessage) error {
+	parsedMsg, err := l.parseMessage(ctx, msg)
+	if err != nil {
+		return fmt.Errorf("failed to parse message: %w", err)
+	}
+	l.metrics.PublishStatistics(parsedMsg.statistics)
+
+	if len(parsedMsg.jobsAvailable) > 0 {
+		acquiredJobIDs, err := l.acquireAvailableJobs(ctx, parsedMsg.jobsAvailable)
+		if err != nil {
+			return fmt.Errorf("failed to acquire jobs: %w", err)
+		}
+
+		l.logger.Info("Jobs are acquired", "count", len(acquiredJobIDs), "requestIds", fmt.Sprint(acquiredJobIDs))
+	}
+
+	for _, jobCompleted := range parsedMsg.jobsCompleted {
+		l.metrics.PublishJobCompleted(jobCompleted)
+	}
+
+	l.lastMessageID = msg.MessageId
+
+	if err := l.deleteLastMessage(ctx); err != nil {
+		return fmt.Errorf("failed to delete message: %w", err)
+	}
+
+	for _, jobStarted := range parsedMsg.jobsStarted {
+		if err := handler.HandleJobStarted(ctx, jobStarted); err != nil {
+			return fmt.Errorf("failed to handle job started: %w", err)
+		}
+		l.metrics.PublishJobStarted(jobStarted)
+	}
+
+	desiredRunners, err := handler.HandleDesiredRunnerCount(ctx, parsedMsg.statistics.TotalAssignedJobs, len(parsedMsg.jobsCompleted))
+	if err != nil {
+		return fmt.Errorf("failed to handle desired runner count: %w", err)
+	}
+	l.metrics.PublishDesiredRunners(desiredRunners)
+	return nil
+}
+
+func (l *Listener) createSession(ctx context.Context) error {
+	var session *actions.RunnerScaleSetSession
+	var retries int
+
+	for {
+		var err error
+		session, err = l.client.CreateMessageSession(ctx, l.scaleSetID, l.hostname)
+		if err == nil {
+			break
+		}
+
+		clientErr := &actions.HttpClientSideError{}
+		if !errors.As(err, &clientErr) {
+			return fmt.Errorf("failed to create session: %w", err)
+		}
+
+		if clientErr.Code != http.StatusConflict {
+			return fmt.Errorf("failed to create session: %w", err)
+		}
+
+		retries++
+		if retries >= sessionCreationMaxRetries {
+			return fmt.Errorf("failed to create session after %d retries: %w", retries, err)
+		}
+
+		l.logger.Info("Unable to create message session. Will try again in 30 seconds", "error", err.Error())
+
+		select {
+		case <-ctx.Done():
+			return fmt.Errorf("context cancelled: %w", ctx.Err())
+		case <-time.After(30 * time.Second):
+		}
+	}
+
+	statistics, err := json.Marshal(session.Statistics)
+	if err != nil {
+		return fmt.Errorf("failed to marshal statistics: %w", err)
+	}
+	l.logger.Info("Current runner scale set statistics.", "statistics", string(statistics))
+
+	l.session = session
+
+	return nil
+}
+
+func (l *Listener) getMessage(ctx context.Context) (*actions.RunnerScaleSetMessage, error) {
+	l.logger.Info("Getting next message", "lastMessageID", l.lastMessageID)
+	msg, err := l.client.GetMessage(ctx, l.session.MessageQueueUrl, l.session.MessageQueueAccessToken, l.lastMessageID, l.maxCapacity)
+	if err == nil { // if NO error
+		return msg, nil
+	}
+
+	expiredError := &actions.MessageQueueTokenExpiredError{}
+	if !errors.As(err, &expiredError) {
+		return nil, fmt.Errorf("failed to get next message: %w", err)
+	}
+
+	if err := l.refreshSession(ctx); err != nil {
+		return nil, err
+	}
+
+	l.logger.Info("Getting next message", "lastMessageID", l.lastMessageID)
+
+	msg, err = l.client.GetMessage(ctx, l.session.MessageQueueUrl, l.session.MessageQueueAccessToken, l.lastMessageID, l.maxCapacity)
+	if err != nil { // if NO error
+		return nil, fmt.Errorf("failed to get next message after message session refresh: %w", err)
+	}
+
+	return msg, nil
+}
+
+func (l *Listener) deleteLastMessage(ctx context.Context) error {
+	l.logger.Info("Deleting last message", "lastMessageID", l.lastMessageID)
+	err := l.client.DeleteMessage(ctx, l.session.MessageQueueUrl, l.session.MessageQueueAccessToken, l.lastMessageID)
+	if err == nil { // if NO error
+		return nil
+	}
+
+	expiredError := &actions.MessageQueueTokenExpiredError{}
+	if !errors.As(err, &expiredError) {
+		return fmt.Errorf("failed to delete last message: %w", err)
+	}
+
+	if err := l.refreshSession(ctx); err != nil {
+		return err
+	}
+
+	err = l.client.DeleteMessage(ctx, l.session.MessageQueueUrl, l.session.MessageQueueAccessToken, l.lastMessageID)
+	if err != nil {
+		return fmt.Errorf("failed to delete last message after message session refresh: %w", err)
+	}
+
+	return nil
+}
+
+type parsedMessage struct {
+	statistics    *actions.RunnerScaleSetStatistic
+	jobsStarted   []*actions.JobStarted
+	jobsAvailable []*actions.JobAvailable
+	jobsCompleted []*actions.JobCompleted
+}
+
+func (l *Listener) parseMessage(ctx context.Context, msg *actions.RunnerScaleSetMessage) (*parsedMessage, error) {
+	if msg.MessageType != "RunnerScaleSetJobMessages" {
+		l.logger.Info("Skipping message", "messageType", msg.MessageType)
+		return nil, fmt.Errorf("invalid message type: %s", msg.MessageType)
+	}
+
+	l.logger.Info("Processing message", "messageId", msg.MessageId, "messageType", msg.MessageType)
+	if msg.Statistics == nil {
+		return nil, fmt.Errorf("invalid message: statistics is nil")
+	}
+
+	l.logger.Info("New runner scale set statistics.", "statistics", msg.Statistics)
+
+	var batchedMessages []json.RawMessage
+	if len(msg.Body) > 0 {
+		if err := json.Unmarshal([]byte(msg.Body), &batchedMessages); err != nil {
+			return nil, fmt.Errorf("failed to unmarshal batched messages: %w", err)
+		}
+	}
+
+	parsedMsg := &parsedMessage{
+		statistics: msg.Statistics,
+	}
+
+	for _, msg := range batchedMessages {
+		var messageType actions.JobMessageType
+		if err := json.Unmarshal(msg, &messageType); err != nil {
+			return nil, fmt.Errorf("failed to decode job message type: %w", err)
+		}
+
+		switch messageType.MessageType {
+		case messageTypeJobAvailable:
+			var jobAvailable actions.JobAvailable
+			if err := json.Unmarshal(msg, &jobAvailable); err != nil {
+				return nil, fmt.Errorf("failed to decode job available: %w", err)
+			}
+
+			l.logger.Info("Job available message received", "jobId", jobAvailable.JobID)
+			parsedMsg.jobsAvailable = append(parsedMsg.jobsAvailable, &jobAvailable)
+
+		case messageTypeJobAssigned:
+			var jobAssigned actions.JobAssigned
+			if err := json.Unmarshal(msg, &jobAssigned); err != nil {
+				return nil, fmt.Errorf("failed to decode job assigned: %w", err)
+			}
+
+			l.logger.Info("Job assigned message received", "jobId", jobAssigned.JobID)
+
+		case messageTypeJobStarted:
+			var jobStarted actions.JobStarted
+			if err := json.Unmarshal(msg, &jobStarted); err != nil {
+				return nil, fmt.Errorf("could not decode job started message. %w", err)
+			}
+			l.logger.Info("Job started message received.", "JobID", jobStarted.JobID, "RunnerId", jobStarted.RunnerID)
+			parsedMsg.jobsStarted = append(parsedMsg.jobsStarted, &jobStarted)
+
+		case messageTypeJobCompleted:
+			var jobCompleted actions.JobCompleted
+			if err := json.Unmarshal(msg, &jobCompleted); err != nil {
+				return nil, fmt.Errorf("failed to decode job completed: %w", err)
+			}
+
+			l.logger.Info(
+				"Job completed message received.",
+				"JobID", jobCompleted.JobID,
+				"Result", jobCompleted.Result,
+				"RunnerId", jobCompleted.RunnerId,
+				"RunnerName", jobCompleted.RunnerName,
+			)
+			parsedMsg.jobsCompleted = append(parsedMsg.jobsCompleted, &jobCompleted)
+
+		default:
+			l.logger.Info("unknown job message type.", "messageType", messageType.MessageType)
+		}
+	}
+
+	return parsedMsg, nil
+}
+
+func (l *Listener) acquireAvailableJobs(ctx context.Context, jobsAvailable []*actions.JobAvailable) ([]int64, error) {
+	ids := make([]int64, 0, len(jobsAvailable))
+	for _, job := range jobsAvailable {
+		ids = append(ids, job.RunnerRequestID)
+	}
+
+	l.logger.Info("Acquiring jobs", "count", len(ids), "requestIds", fmt.Sprint(ids))
+
+	idsAcquired, err := l.client.AcquireJobs(ctx, l.scaleSetID, l.session.MessageQueueAccessToken, ids)
+	if err == nil { // if NO errors
+		return idsAcquired, nil
+	}
+
+	expiredError := &actions.MessageQueueTokenExpiredError{}
+	if !errors.As(err, &expiredError) {
+		return nil, fmt.Errorf("failed to acquire jobs: %w", err)
+	}
+
+	if err := l.refreshSession(ctx); err != nil {
+		return nil, err
+	}
+
+	idsAcquired, err = l.client.AcquireJobs(ctx, l.scaleSetID, l.session.MessageQueueAccessToken, ids)
+	if err != nil {
+		return nil, fmt.Errorf("failed to acquire jobs after session refresh: %w", err)
+	}
+
+	return idsAcquired, nil
+}
+
+func (l *Listener) refreshSession(ctx context.Context) error {
+	l.logger.Info("Message queue token is expired during GetNextMessage, refreshing...")
+	session, err := l.client.RefreshMessageSession(ctx, l.session.RunnerScaleSet.Id, l.session.SessionId)
+	if err != nil {
+		return fmt.Errorf("refresh message session failed. %w", err)
+	}
+
+	l.session = session
+	return nil
+}
+
+func (l *Listener) deleteMessageSession() error {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	l.logger.Info("Deleting message session")
+
+	if err := l.client.DeleteMessageSession(ctx, l.session.RunnerScaleSet.Id, l.session.SessionId); err != nil {
+		return fmt.Errorf("failed to delete message session: %w", err)
+	}
+
+	return nil
+}

cmd/ghalistener/listener/listener_test.go

@@ -0,0 +1,970 @@
+package listener
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"testing"
+	"time"
+
+	listenermocks "github.com/actions/actions-runner-controller/cmd/ghalistener/listener/mocks"
+	"github.com/actions/actions-runner-controller/cmd/ghalistener/metrics"
+	"github.com/actions/actions-runner-controller/github/actions"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNew(t *testing.T) {
+	t.Parallel()
+	t.Run("InvalidConfig", func(t *testing.T) {
+		t.Parallel()
+		var config Config
+		_, err := New(config)
+		assert.NotNil(t, err)
+	})
+
+	t.Run("ValidConfig", func(t *testing.T) {
+		t.Parallel()
+		config := Config{
+			Client:     listenermocks.NewClient(t),
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+		}
+		l, err := New(config)
+		assert.Nil(t, err)
+		assert.NotNil(t, l)
+	})
+}
+
+func TestListener_createSession(t *testing.T) {
+	t.Parallel()
+	t.Run("FailOnce", func(t *testing.T) {
+		t.Parallel()
+		ctx := context.Background()
+
+		config := Config{
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+		}
+
+		client := listenermocks.NewClient(t)
+		client.On("CreateMessageSession", ctx, mock.Anything, mock.Anything).Return(nil, assert.AnError).Once()
+		config.Client = client
+
+		l, err := New(config)
+		require.Nil(t, err)
+
+		err = l.createSession(ctx)
+		assert.NotNil(t, err)
+	})
+
+	t.Run("FailContext", func(t *testing.T) {
+		t.Parallel()
+		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+		defer cancel()
+
+		config := Config{
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+		}
+
+		client := listenermocks.NewClient(t)
+		client.On("CreateMessageSession", ctx, mock.Anything, mock.Anything).Return(nil,
+			&actions.HttpClientSideError{Code: http.StatusConflict}).Once()
+		config.Client = client
+
+		l, err := New(config)
+		require.Nil(t, err)
+
+		err = l.createSession(ctx)
+		assert.True(t, errors.Is(err, context.DeadlineExceeded))
+	})
+
+	t.Run("SetsSession", func(t *testing.T) {
+		t.Parallel()
+		config := Config{
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+		}
+
+		client := listenermocks.NewClient(t)
+
+		uuid := uuid.New()
+		session := &actions.RunnerScaleSetSession{
+			SessionId:               &uuid,
+			OwnerName:               "example",
+			RunnerScaleSet:          &actions.RunnerScaleSet{},
+			MessageQueueUrl:         "https://example.com",
+			MessageQueueAccessToken: "1234567890",
+			Statistics:              nil,
+		}
+		client.On("CreateMessageSession", mock.Anything, mock.Anything, mock.Anything).Return(session, nil).Once()
+		config.Client = client
+
+		l, err := New(config)
+		require.Nil(t, err)
+
+		err = l.createSession(context.Background())
+		assert.Nil(t, err)
+		assert.Equal(t, session, l.session)
+	})
+}
+
+func TestListener_getMessage(t *testing.T) {
+	t.Parallel()
+
+	t.Run("ReceivesMessage", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := context.Background()
+		config := Config{
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+			MaxRunners: 10,
+		}
+
+		client := listenermocks.NewClient(t)
+		want := &actions.RunnerScaleSetMessage{
+			MessageId: 1,
+		}
+		client.On("GetMessage", ctx, mock.Anything, mock.Anything, mock.Anything, 10).Return(want, nil).Once()
+		config.Client = client
+
+		l, err := New(config)
+		require.Nil(t, err)
+		l.session = &actions.RunnerScaleSetSession{}
+
+		got, err := l.getMessage(ctx)
+		assert.Nil(t, err)
+		assert.Equal(t, want, got)
+	})
+
+	t.Run("NotExpiredError", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := context.Background()
+		config := Config{
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+			MaxRunners: 10,
+		}
+
+		client := listenermocks.NewClient(t)
+		client.On("GetMessage", ctx, mock.Anything, mock.Anything, mock.Anything, 10).Return(nil, &actions.HttpClientSideError{Code: http.StatusNotFound}).Once()
+		config.Client = client
+
+		l, err := New(config)
+		require.Nil(t, err)
+
+		l.session = &actions.RunnerScaleSetSession{}
+
+		_, err = l.getMessage(ctx)
+		assert.NotNil(t, err)
+	})
+
+	t.Run("RefreshAndSucceeds", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := context.Background()
+		config := Config{
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+			MaxRunners: 10,
+		}
+
+		client := listenermocks.NewClient(t)
+
+		uuid := uuid.New()
+		session := &actions.RunnerScaleSetSession{
+			SessionId:               &uuid,
+			OwnerName:               "example",
+			RunnerScaleSet:          &actions.RunnerScaleSet{},
+			MessageQueueUrl:         "https://example.com",
+			MessageQueueAccessToken: "1234567890",
+			Statistics:              nil,
+		}
+		client.On("RefreshMessageSession", ctx, mock.Anything, mock.Anything).Return(session, nil).Once()
+
+		client.On("GetMessage", ctx, mock.Anything, mock.Anything, mock.Anything, 10).Return(nil, &actions.MessageQueueTokenExpiredError{}).Once()
+
+		want := &actions.RunnerScaleSetMessage{
+			MessageId: 1,
+		}
+		client.On("GetMessage", ctx, mock.Anything, mock.Anything, mock.Anything, 10).Return(want, nil).Once()
+
+		config.Client = client
+
+		l, err := New(config)
+		require.Nil(t, err)
+
+		l.session = &actions.RunnerScaleSetSession{
+			SessionId:      &uuid,
+			RunnerScaleSet: &actions.RunnerScaleSet{},
+		}
+
+		got, err := l.getMessage(ctx)
+		assert.Nil(t, err)
+		assert.Equal(t, want, got)
+	})
+
+	t.Run("RefreshAndFails", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := context.Background()
+		config := Config{
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+			MaxRunners: 10,
+		}
+
+		client := listenermocks.NewClient(t)
+
+		uuid := uuid.New()
+		session := &actions.RunnerScaleSetSession{
+			SessionId:               &uuid,
+			OwnerName:               "example",
+			RunnerScaleSet:          &actions.RunnerScaleSet{},
+			MessageQueueUrl:         "https://example.com",
+			MessageQueueAccessToken: "1234567890",
+			Statistics:              nil,
+		}
+		client.On("RefreshMessageSession", ctx, mock.Anything, mock.Anything).Return(session, nil).Once()
+
+		client.On("GetMessage", ctx, mock.Anything, mock.Anything, mock.Anything, 10).Return(nil, &actions.MessageQueueTokenExpiredError{}).Twice()
+
+		config.Client = client
+
+		l, err := New(config)
+		require.Nil(t, err)
+
+		l.session = &actions.RunnerScaleSetSession{
+			SessionId:      &uuid,
+			RunnerScaleSet: &actions.RunnerScaleSet{},
+		}
+
+		got, err := l.getMessage(ctx)
+		assert.NotNil(t, err)
+		assert.Nil(t, got)
+	})
+}
+
+func TestListener_refreshSession(t *testing.T) {
+	t.Parallel()
+
+	t.Run("SuccessfullyRefreshes", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := context.Background()
+		config := Config{
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+		}
+
+		client := listenermocks.NewClient(t)
+
+		newUUID := uuid.New()
+		session := &actions.RunnerScaleSetSession{
+			SessionId:               &newUUID,
+			OwnerName:               "example",
+			RunnerScaleSet:          &actions.RunnerScaleSet{},
+			MessageQueueUrl:         "https://example.com",
+			MessageQueueAccessToken: "1234567890",
+			Statistics:              nil,
+		}
+		client.On("RefreshMessageSession", ctx, mock.Anything, mock.Anything).Return(session, nil).Once()
+
+		config.Client = client
+
+		l, err := New(config)
+		require.Nil(t, err)
+
+		oldUUID := uuid.New()
+		l.session = &actions.RunnerScaleSetSession{
+			SessionId:      &oldUUID,
+			RunnerScaleSet: &actions.RunnerScaleSet{},
+		}
+
+		err = l.refreshSession(ctx)
+		assert.Nil(t, err)
+		assert.Equal(t, session, l.session)
+	})
+
+	t.Run("FailsToRefresh", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := context.Background()
+		config := Config{
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+		}
+
+		client := listenermocks.NewClient(t)
+
+		client.On("RefreshMessageSession", ctx, mock.Anything, mock.Anything).Return(nil, errors.New("error")).Once()
+
+		config.Client = client
+
+		l, err := New(config)
+		require.Nil(t, err)
+
+		oldUUID := uuid.New()
+		oldSession := &actions.RunnerScaleSetSession{
+			SessionId:      &oldUUID,
+			RunnerScaleSet: &actions.RunnerScaleSet{},
+		}
+		l.session = oldSession
+
+		err = l.refreshSession(ctx)
+		assert.NotNil(t, err)
+		assert.Equal(t, oldSession, l.session)
+	})
+}
+
+func TestListener_deleteLastMessage(t *testing.T) {
+	t.Parallel()
+
+	t.Run("SuccessfullyDeletes", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := context.Background()
+		config := Config{
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+		}
+
+		client := listenermocks.NewClient(t)
+
+		client.On("DeleteMessage", ctx, mock.Anything, mock.Anything, mock.MatchedBy(func(lastMessageID any) bool {
+			return lastMessageID.(int64) == int64(5)
+		})).Return(nil).Once()
+
+		config.Client = client
+
+		l, err := New(config)
+		require.Nil(t, err)
+
+		l.session = &actions.RunnerScaleSetSession{}
+		l.lastMessageID = 5
+
+		err = l.deleteLastMessage(ctx)
+		assert.Nil(t, err)
+	})
+
+	t.Run("FailsToDelete", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := context.Background()
+		config := Config{
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+		}
+
+		client := listenermocks.NewClient(t)
+
+		client.On("DeleteMessage", ctx, mock.Anything, mock.Anything, mock.Anything).Return(errors.New("error")).Once()
+
+		config.Client = client
+
+		l, err := New(config)
+		require.Nil(t, err)
+
+		l.session = &actions.RunnerScaleSetSession{}
+		l.lastMessageID = 5
+
+		err = l.deleteLastMessage(ctx)
+		assert.NotNil(t, err)
+	})
+
+	t.Run("RefreshAndSucceeds", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := context.Background()
+		config := Config{
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+		}
+
+		client := listenermocks.NewClient(t)
+
+		newUUID := uuid.New()
+		session := &actions.RunnerScaleSetSession{
+			SessionId:               &newUUID,
+			OwnerName:               "example",
+			RunnerScaleSet:          &actions.RunnerScaleSet{},
+			MessageQueueUrl:         "https://example.com",
+			MessageQueueAccessToken: "1234567890",
+			Statistics:              nil,
+		}
+		client.On("RefreshMessageSession", ctx, mock.Anything, mock.Anything).Return(session, nil).Once()
+
+		client.On("DeleteMessage", ctx, mock.Anything, mock.Anything, mock.Anything).Return(&actions.MessageQueueTokenExpiredError{}).Once()
+
+		client.On("DeleteMessage", ctx, mock.Anything, mock.Anything, mock.MatchedBy(func(lastMessageID any) bool {
+			return lastMessageID.(int64) == int64(5)
+		})).Return(nil).Once()
+		config.Client = client
+
+		l, err := New(config)
+		require.Nil(t, err)
+
+		oldUUID := uuid.New()
+		l.session = &actions.RunnerScaleSetSession{
+			SessionId:      &oldUUID,
+			RunnerScaleSet: &actions.RunnerScaleSet{},
+		}
+		l.lastMessageID = 5
+
+		config.Client = client
+
+		err = l.deleteLastMessage(ctx)
+		assert.NoError(t, err)
+	})
+
+	t.Run("RefreshAndFails", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := context.Background()
+		config := Config{
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+		}
+
+		client := listenermocks.NewClient(t)
+
+		newUUID := uuid.New()
+		session := &actions.RunnerScaleSetSession{
+			SessionId:               &newUUID,
+			OwnerName:               "example",
+			RunnerScaleSet:          &actions.RunnerScaleSet{},
+			MessageQueueUrl:         "https://example.com",
+			MessageQueueAccessToken: "1234567890",
+			Statistics:              nil,
+		}
+		client.On("RefreshMessageSession", ctx, mock.Anything, mock.Anything).Return(session, nil).Once()
+
+		client.On("DeleteMessage", ctx, mock.Anything, mock.Anything, mock.Anything).Return(&actions.MessageQueueTokenExpiredError{}).Twice()
+
+		config.Client = client
+
+		l, err := New(config)
+		require.Nil(t, err)
+
+		oldUUID := uuid.New()
+		l.session = &actions.RunnerScaleSetSession{
+			SessionId:      &oldUUID,
+			RunnerScaleSet: &actions.RunnerScaleSet{},
+		}
+		l.lastMessageID = 5
+
+		config.Client = client
+
+		err = l.deleteLastMessage(ctx)
+		assert.Error(t, err)
+	})
+}
+
+func TestListener_Listen(t *testing.T) {
+	t.Parallel()
+
+	t.Run("CreateSessionFails", func(t *testing.T) {
+		t.Parallel()
+		ctx := context.Background()
+		config := Config{
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+		}
+
+		client := listenermocks.NewClient(t)
+		client.On("CreateMessageSession", ctx, mock.Anything, mock.Anything).Return(nil, assert.AnError).Once()
+		config.Client = client
+
+		l, err := New(config)
+		require.Nil(t, err)
+
+		err = l.Listen(ctx, nil)
+		assert.NotNil(t, err)
+	})
+
+	t.Run("CallHandleRegardlessOfInitialMessage", func(t *testing.T) {
+		t.Parallel()
+		ctx, cancel := context.WithCancel(context.Background())
+
+		config := Config{
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+		}
+
+		client := listenermocks.NewClient(t)
+
+		uuid := uuid.New()
+		session := &actions.RunnerScaleSetSession{
+			SessionId:               &uuid,
+			OwnerName:               "example",
+			RunnerScaleSet:          &actions.RunnerScaleSet{},
+			MessageQueueUrl:         "https://example.com",
+			MessageQueueAccessToken: "1234567890",
+			Statistics:              &actions.RunnerScaleSetStatistic{},
+		}
+		client.On("CreateMessageSession", ctx, mock.Anything, mock.Anything).Return(session, nil).Once()
+		client.On("DeleteMessageSession", mock.Anything, session.RunnerScaleSet.Id, session.SessionId).Return(nil).Once()
+
+		config.Client = client
+
+		l, err := New(config)
+		require.Nil(t, err)
+
+		var called bool
+		handler := listenermocks.NewHandler(t)
+		handler.On("HandleDesiredRunnerCount", mock.Anything, mock.Anything, 0).
+			Return(0, nil).
+			Run(
+				func(mock.Arguments) {
+					called = true
+					cancel()
+				},
+			).
+			Once()
+
+		err = l.Listen(ctx, handler)
+		assert.True(t, errors.Is(err, context.Canceled))
+		assert.True(t, called)
+	})
+
+	t.Run("CancelContextAfterGetMessage", func(t *testing.T) {
+		t.Parallel()
+
+		ctx, cancel := context.WithCancel(context.Background())
+
+		config := Config{
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+			MaxRunners: 10,
+		}
+
+		client := listenermocks.NewClient(t)
+		uuid := uuid.New()
+		session := &actions.RunnerScaleSetSession{
+			SessionId:               &uuid,
+			OwnerName:               "example",
+			RunnerScaleSet:          &actions.RunnerScaleSet{},
+			MessageQueueUrl:         "https://example.com",
+			MessageQueueAccessToken: "1234567890",
+			Statistics:              &actions.RunnerScaleSetStatistic{},
+		}
+		client.On("CreateMessageSession", ctx, mock.Anything, mock.Anything).Return(session, nil).Once()
+		client.On("DeleteMessageSession", mock.Anything, session.RunnerScaleSet.Id, session.SessionId).Return(nil).Once()
+
+		msg := &actions.RunnerScaleSetMessage{
+			MessageId:   1,
+			MessageType: "RunnerScaleSetJobMessages",
+			Statistics:  &actions.RunnerScaleSetStatistic{},
+		}
+		client.On("GetMessage", ctx, mock.Anything, mock.Anything, mock.Anything, 10).
+			Return(msg, nil).
+			Run(
+				func(mock.Arguments) {
+					cancel()
+				},
+			).
+			Once()
+
+		// Ensure delete message is called without cancel
+		client.On("DeleteMessage", context.WithoutCancel(ctx), mock.Anything, mock.Anything, mock.Anything).Return(nil).Once()
+
+		config.Client = client
+
+		handler := listenermocks.NewHandler(t)
+		handler.On("HandleDesiredRunnerCount", mock.Anything, mock.Anything, 0).
+			Return(0, nil).
+			Once()
+
+		handler.On("HandleDesiredRunnerCount", mock.Anything, mock.Anything, 0).
+			Return(0, nil).
+			Once()
+
+		l, err := New(config)
+		require.Nil(t, err)
+
+		err = l.Listen(ctx, handler)
+		assert.ErrorIs(t, context.Canceled, err)
+	})
+}
+
+func TestListener_acquireAvailableJobs(t *testing.T) {
+	t.Parallel()
+
+	t.Run("FailingToAcquireJobs", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := context.Background()
+		config := Config{
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+		}
+
+		client := listenermocks.NewClient(t)
+
+		client.On("AcquireJobs", ctx, mock.Anything, mock.Anything, mock.Anything).Return(nil, assert.AnError).Once()
+
+		config.Client = client
+
+		l, err := New(config)
+		require.Nil(t, err)
+
+		uuid := uuid.New()
+		l.session = &actions.RunnerScaleSetSession{
+			SessionId:               &uuid,
+			OwnerName:               "example",
+			RunnerScaleSet:          &actions.RunnerScaleSet{},
+			MessageQueueUrl:         "https://example.com",
+			MessageQueueAccessToken: "1234567890",
+			Statistics:              &actions.RunnerScaleSetStatistic{},
+		}
+
+		availableJobs := []*actions.JobAvailable{
+			{
+				JobMessageBase: actions.JobMessageBase{
+					RunnerRequestID: 1,
+				},
+			},
+			{
+				JobMessageBase: actions.JobMessageBase{
+					RunnerRequestID: 2,
+				},
+			},
+			{
+				JobMessageBase: actions.JobMessageBase{
+					RunnerRequestID: 3,
+				},
+			},
+		}
+		_, err = l.acquireAvailableJobs(ctx, availableJobs)
+		assert.Error(t, err)
+	})
+
+	t.Run("SuccessfullyAcquiresJobsOnFirstRun", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := context.Background()
+		config := Config{
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+		}
+
+		client := listenermocks.NewClient(t)
+
+		jobIDs := []int64{1, 2, 3}
+
+		client.On("AcquireJobs", ctx, mock.Anything, mock.Anything, mock.Anything).Return(jobIDs, nil).Once()
+
+		config.Client = client
+
+		l, err := New(config)
+		require.Nil(t, err)
+
+		uuid := uuid.New()
+		l.session = &actions.RunnerScaleSetSession{
+			SessionId:               &uuid,
+			OwnerName:               "example",
+			RunnerScaleSet:          &actions.RunnerScaleSet{},
+			MessageQueueUrl:         "https://example.com",
+			MessageQueueAccessToken: "1234567890",
+			Statistics:              &actions.RunnerScaleSetStatistic{},
+		}
+
+		availableJobs := []*actions.JobAvailable{
+			{
+				JobMessageBase: actions.JobMessageBase{
+					RunnerRequestID: 1,
+				},
+			},
+			{
+				JobMessageBase: actions.JobMessageBase{
+					RunnerRequestID: 2,
+				},
+			},
+			{
+				JobMessageBase: actions.JobMessageBase{
+					RunnerRequestID: 3,
+				},
+			},
+		}
+		acquiredJobIDs, err := l.acquireAvailableJobs(ctx, availableJobs)
+		assert.NoError(t, err)
+		assert.Equal(t, []int64{1, 2, 3}, acquiredJobIDs)
+	})
+
+	t.Run("RefreshAndSucceeds", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := context.Background()
+		config := Config{
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+		}
+
+		client := listenermocks.NewClient(t)
+
+		uuid := uuid.New()
+		session := &actions.RunnerScaleSetSession{
+			SessionId:               &uuid,
+			OwnerName:               "example",
+			RunnerScaleSet:          &actions.RunnerScaleSet{},
+			MessageQueueUrl:         "https://example.com",
+			MessageQueueAccessToken: "1234567890",
+			Statistics:              nil,
+		}
+		client.On("RefreshMessageSession", ctx, mock.Anything, mock.Anything).Return(session, nil).Once()
+
+		// Second call to AcquireJobs will succeed
+		want := []int64{1, 2, 3}
+		availableJobs := []*actions.JobAvailable{
+			{
+				JobMessageBase: actions.JobMessageBase{
+					RunnerRequestID: 1,
+				},
+			},
+			{
+				JobMessageBase: actions.JobMessageBase{
+					RunnerRequestID: 2,
+				},
+			},
+			{
+				JobMessageBase: actions.JobMessageBase{
+					RunnerRequestID: 3,
+				},
+			},
+		}
+
+		// First call to AcquireJobs will fail with a token expired error
+		client.On("AcquireJobs", ctx, mock.Anything, mock.Anything, mock.Anything).
+			Run(func(args mock.Arguments) {
+				ids := args.Get(3).([]int64)
+				assert.Equal(t, want, ids)
+			}).
+			Return(nil, &actions.MessageQueueTokenExpiredError{}).
+			Once()
+
+		// Second call should succeed
+		client.On("AcquireJobs", ctx, mock.Anything, mock.Anything, mock.Anything).
+			Run(func(args mock.Arguments) {
+				ids := args.Get(3).([]int64)
+				assert.Equal(t, want, ids)
+			}).
+			Return(want, nil).
+			Once()
+
+		config.Client = client
+
+		l, err := New(config)
+		require.Nil(t, err)
+
+		l.session = &actions.RunnerScaleSetSession{
+			SessionId:      &uuid,
+			RunnerScaleSet: &actions.RunnerScaleSet{},
+		}
+
+		got, err := l.acquireAvailableJobs(ctx, availableJobs)
+		assert.Nil(t, err)
+		assert.Equal(t, want, got)
+	})
+
+	t.Run("RefreshAndFails", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := context.Background()
+		config := Config{
+			ScaleSetID: 1,
+			Metrics:    metrics.Discard,
+		}
+
+		client := listenermocks.NewClient(t)
+
+		uuid := uuid.New()
+		session := &actions.RunnerScaleSetSession{
+			SessionId:               &uuid,
+			OwnerName:               "example",
+			RunnerScaleSet:          &actions.RunnerScaleSet{},
+			MessageQueueUrl:         "https://example.com",
+			MessageQueueAccessToken: "1234567890",
+			Statistics:              nil,
+		}
+		client.On("RefreshMessageSession", ctx, mock.Anything, mock.Anything).Return(session, nil).Once()
+
+		client.On("AcquireJobs", ctx, mock.Anything, mock.Anything, mock.Anything).Return(nil, &actions.MessageQueueTokenExpiredError{}).Twice()
+
+		config.Client = client
+
+		l, err := New(config)
+		require.Nil(t, err)
+
+		l.session = &actions.RunnerScaleSetSession{
+			SessionId:      &uuid,
+			RunnerScaleSet: &actions.RunnerScaleSet{},
+		}
+
+		availableJobs := []*actions.JobAvailable{
+			{
+				JobMessageBase: actions.JobMessageBase{
+					RunnerRequestID: 1,
+				},
+			},
+			{
+				JobMessageBase: actions.JobMessageBase{
+					RunnerRequestID: 2,
+				},
+			},
+			{
+				JobMessageBase: actions.JobMessageBase{
+					RunnerRequestID: 3,
+				},
+			},
+		}
+
+		got, err := l.acquireAvailableJobs(ctx, availableJobs)
+		assert.NotNil(t, err)
+		assert.Nil(t, got)
+	})
+}
+
+func TestListener_parseMessage(t *testing.T) {
+	t.Run("FailOnEmptyStatistics", func(t *testing.T) {
+		msg := &actions.RunnerScaleSetMessage{
+			MessageId:   1,
+			MessageType: "RunnerScaleSetJobMessages",
+			Statistics:  nil,
+		}
+
+		l := &Listener{}
+		parsedMsg, err := l.parseMessage(context.Background(), msg)
+		assert.Error(t, err)
+		assert.Nil(t, parsedMsg)
+	})
+
+	t.Run("FailOnIncorrectMessageType", func(t *testing.T) {
+		msg := &actions.RunnerScaleSetMessage{
+			MessageId:   1,
+			MessageType: "RunnerMessages", // arbitrary message type
+			Statistics:  &actions.RunnerScaleSetStatistic{},
+		}
+
+		l := &Listener{}
+		parsedMsg, err := l.parseMessage(context.Background(), msg)
+		assert.Error(t, err)
+		assert.Nil(t, parsedMsg)
+	})
+
+	t.Run("ParseAll", func(t *testing.T) {
+		msg := &actions.RunnerScaleSetMessage{
+			MessageId:   1,
+			MessageType: "RunnerScaleSetJobMessages",
+			Body:        "",
+			Statistics: &actions.RunnerScaleSetStatistic{
+				TotalAvailableJobs:     1,
+				TotalAcquiredJobs:      2,
+				TotalAssignedJobs:      3,
+				TotalRunningJobs:       4,
+				TotalRegisteredRunners: 5,
+				TotalBusyRunners:       6,
+				TotalIdleRunners:       7,
+			},
+		}
+
+		var batchedMessages []any
+		jobsAvailable := []*actions.JobAvailable{
+			{
+				AcquireJobUrl: "https://github.com/example",
+				JobMessageBase: actions.JobMessageBase{
+					JobMessageType: actions.JobMessageType{
+						MessageType: messageTypeJobAvailable,
+					},
+					RunnerRequestID: 1,
+				},
+			},
+			{
+				AcquireJobUrl: "https://github.com/example",
+				JobMessageBase: actions.JobMessageBase{
+					JobMessageType: actions.JobMessageType{
+						MessageType: messageTypeJobAvailable,
+					},
+					RunnerRequestID: 2,
+				},
+			},
+		}
+		for _, msg := range jobsAvailable {
+			batchedMessages = append(batchedMessages, msg)
+		}
+
+		jobsAssigned := []*actions.JobAssigned{
+			{
+				JobMessageBase: actions.JobMessageBase{
+					JobMessageType: actions.JobMessageType{
+						MessageType: messageTypeJobAssigned,
+					},
+					RunnerRequestID: 3,
+				},
+			},
+			{
+				JobMessageBase: actions.JobMessageBase{
+					JobMessageType: actions.JobMessageType{
+						MessageType: messageTypeJobAssigned,
+					},
+					RunnerRequestID: 4,
+				},
+			},
+		}
+		for _, msg := range jobsAssigned {
+			batchedMessages = append(batchedMessages, msg)
+		}
+
+		jobsStarted := []*actions.JobStarted{
+			{
+				JobMessageBase: actions.JobMessageBase{
+					JobMessageType: actions.JobMessageType{
+						MessageType: messageTypeJobStarted,
+					},
+					RunnerRequestID: 5,
+				},
+				RunnerID:   2,
+				RunnerName: "runner2",
+			},
+		}
+		for _, msg := range jobsStarted {
+			batchedMessages = append(batchedMessages, msg)
+		}
+
+		jobsCompleted := []*actions.JobCompleted{
+			{
+				JobMessageBase: actions.JobMessageBase{
+					JobMessageType: actions.JobMessageType{
+						MessageType: messageTypeJobCompleted,
+					},
+					RunnerRequestID: 6,
+				},
+				Result:     "success",
+				RunnerId:   1,
+				RunnerName: "runner1",
+			},
+		}
+		for _, msg := range jobsCompleted {
+			batchedMessages = append(batchedMessages, msg)
+		}
+
+		b, err := json.Marshal(batchedMessages)
+		require.NoError(t, err)
+
+		msg.Body = string(b)
+
+		l := &Listener{}
+		parsedMsg, err := l.parseMessage(context.Background(), msg)
+		require.NoError(t, err)
+
+		assert.Equal(t, msg.Statistics, parsedMsg.statistics)
+		assert.Equal(t, jobsAvailable, parsedMsg.jobsAvailable)
+		assert.Equal(t, jobsStarted, parsedMsg.jobsStarted)
+		assert.Equal(t, jobsCompleted, parsedMsg.jobsCompleted)
+	})
+}

cmd/ghalistener/listener/metrics_test.go

@@ -0,0 +1,205 @@
+package listener
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	listenermocks "github.com/actions/actions-runner-controller/cmd/ghalistener/listener/mocks"
+	metricsmocks "github.com/actions/actions-runner-controller/cmd/ghalistener/metrics/mocks"
+	"github.com/actions/actions-runner-controller/github/actions"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+func TestInitialMetrics(t *testing.T) {
+	t.Parallel()
+
+	t.Run("SetStaticMetrics", func(t *testing.T) {
+		t.Parallel()
+
+		metrics := metricsmocks.NewPublisher(t)
+
+		minRunners := 5
+		maxRunners := 10
+		metrics.On("PublishStatic", minRunners, maxRunners).Once()
+
+		config := Config{
+			Client:     listenermocks.NewClient(t),
+			ScaleSetID: 1,
+			Metrics:    metrics,
+			MinRunners: minRunners,
+			MaxRunners: maxRunners,
+		}
+		l, err := New(config)
+
+		assert.Nil(t, err)
+		assert.NotNil(t, l)
+	})
+
+	t.Run("InitialMessageStatistics", func(t *testing.T) {
+		t.Parallel()
+
+		ctx, cancel := context.WithCancel(context.Background())
+
+		sessionStatistics := &actions.RunnerScaleSetStatistic{
+			TotalAvailableJobs:     1,
+			TotalAcquiredJobs:      2,
+			TotalAssignedJobs:      3,
+			TotalRunningJobs:       4,
+			TotalRegisteredRunners: 5,
+			TotalBusyRunners:       6,
+			TotalIdleRunners:       7,
+		}
+
+		uuid := uuid.New()
+		session := &actions.RunnerScaleSetSession{
+			SessionId:               &uuid,
+			OwnerName:               "example",
+			RunnerScaleSet:          &actions.RunnerScaleSet{},
+			MessageQueueUrl:         "https://example.com",
+			MessageQueueAccessToken: "1234567890",
+			Statistics:              sessionStatistics,
+		}
+
+		metrics := metricsmocks.NewPublisher(t)
+		metrics.On("PublishStatic", mock.Anything, mock.Anything).Once()
+		metrics.On("PublishStatistics", sessionStatistics).Once()
+		metrics.On("PublishDesiredRunners", sessionStatistics.TotalAssignedJobs).
+			Run(
+				func(mock.Arguments) {
+					cancel()
+				},
+			).Once()
+
+		config := Config{
+			Client:     listenermocks.NewClient(t),
+			ScaleSetID: 1,
+			Metrics:    metrics,
+		}
+
+		client := listenermocks.NewClient(t)
+		client.On("CreateMessageSession", mock.Anything, mock.Anything, mock.Anything).Return(session, nil).Once()
+		client.On("DeleteMessageSession", mock.Anything, session.RunnerScaleSet.Id, session.SessionId).Return(nil).Once()
+		config.Client = client
+
+		handler := listenermocks.NewHandler(t)
+		handler.On("HandleDesiredRunnerCount", mock.Anything, sessionStatistics.TotalAssignedJobs, 0).
+			Return(sessionStatistics.TotalAssignedJobs, nil).
+			Once()
+
+		l, err := New(config)
+		assert.Nil(t, err)
+		assert.NotNil(t, l)
+
+		assert.ErrorIs(t, context.Canceled, l.Listen(ctx, handler))
+	})
+}
+
+func TestHandleMessageMetrics(t *testing.T) {
+	t.Parallel()
+
+	msg := &actions.RunnerScaleSetMessage{
+		MessageId:   1,
+		MessageType: "RunnerScaleSetJobMessages",
+		Body:        "",
+		Statistics: &actions.RunnerScaleSetStatistic{
+			TotalAvailableJobs:     1,
+			TotalAcquiredJobs:      2,
+			TotalAssignedJobs:      3,
+			TotalRunningJobs:       4,
+			TotalRegisteredRunners: 5,
+			TotalBusyRunners:       6,
+			TotalIdleRunners:       7,
+		},
+	}
+
+	var batchedMessages []any
+	jobsStarted := []*actions.JobStarted{
+		{
+			JobMessageBase: actions.JobMessageBase{
+				JobMessageType: actions.JobMessageType{
+					MessageType: messageTypeJobStarted,
+				},
+				RunnerRequestID: 8,
+			},
+			RunnerID:   3,
+			RunnerName: "runner3",
+		},
+	}
+	for _, msg := range jobsStarted {
+		batchedMessages = append(batchedMessages, msg)
+	}
+
+	jobsCompleted := []*actions.JobCompleted{
+		{
+			JobMessageBase: actions.JobMessageBase{
+				JobMessageType: actions.JobMessageType{
+					MessageType: messageTypeJobCompleted,
+				},
+				RunnerRequestID: 6,
+			},
+			Result:     "success",
+			RunnerId:   1,
+			RunnerName: "runner1",
+		},
+		{
+			JobMessageBase: actions.JobMessageBase{
+				JobMessageType: actions.JobMessageType{
+					MessageType: messageTypeJobCompleted,
+				},
+				RunnerRequestID: 7,
+			},
+			Result:     "success",
+			RunnerId:   2,
+			RunnerName: "runner2",
+		},
+	}
+	for _, msg := range jobsCompleted {
+		batchedMessages = append(batchedMessages, msg)
+	}
+
+	b, err := json.Marshal(batchedMessages)
+	require.NoError(t, err)
+
+	msg.Body = string(b)
+
+	desiredResult := 4
+
+	metrics := metricsmocks.NewPublisher(t)
+	metrics.On("PublishStatic", 0, 0).Once()
+	metrics.On("PublishStatistics", msg.Statistics).Once()
+	metrics.On("PublishJobCompleted", jobsCompleted[0]).Once()
+	metrics.On("PublishJobCompleted", jobsCompleted[1]).Once()
+	metrics.On("PublishJobStarted", jobsStarted[0]).Once()
+	metrics.On("PublishDesiredRunners", desiredResult).Once()
+
+	handler := listenermocks.NewHandler(t)
+	handler.On("HandleJobStarted", mock.Anything, jobsStarted[0]).Return(nil).Once()
+	handler.On("HandleDesiredRunnerCount", mock.Anything, mock.Anything, 2).Return(desiredResult, nil).Once()
+
+	client := listenermocks.NewClient(t)
+	client.On("DeleteMessage", mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(nil).Once()
+
+	config := Config{
+		Client:     listenermocks.NewClient(t),
+		ScaleSetID: 1,
+		Metrics:    metrics,
+	}
+
+	l, err := New(config)
+	require.NoError(t, err)
+	l.client = client
+	l.session = &actions.RunnerScaleSetSession{
+		OwnerName:               "",
+		RunnerScaleSet:          &actions.RunnerScaleSet{},
+		MessageQueueUrl:         "",
+		MessageQueueAccessToken: "",
+		Statistics:              &actions.RunnerScaleSetStatistic{},
+	}
+
+	err = l.handleMessage(context.Background(), handler, msg)
+	require.NoError(t, err)
+}

cmd/ghalistener/listener/mocks/client.go

@@ -0,0 +1,190 @@
+// Code generated by mockery v2.36.1. DO NOT EDIT.
+
+package mocks
+
+import (
+	context "context"
+
+	actions "github.com/actions/actions-runner-controller/github/actions"
+
+	mock "github.com/stretchr/testify/mock"
+
+	uuid "github.com/google/uuid"
+)
+
+// Client is an autogenerated mock type for the Client type
+type Client struct {
+	mock.Mock
+}
+
+// AcquireJobs provides a mock function with given fields: ctx, runnerScaleSetId, messageQueueAccessToken, requestIds
+func (_m *Client) AcquireJobs(ctx context.Context, runnerScaleSetId int, messageQueueAccessToken string, requestIds []int64) ([]int64, error) {
+	ret := _m.Called(ctx, runnerScaleSetId, messageQueueAccessToken, requestIds)
+
+	var r0 []int64
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, int, string, []int64) ([]int64, error)); ok {
+		return rf(ctx, runnerScaleSetId, messageQueueAccessToken, requestIds)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, int, string, []int64) []int64); ok {
+		r0 = rf(ctx, runnerScaleSetId, messageQueueAccessToken, requestIds)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]int64)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, int, string, []int64) error); ok {
+		r1 = rf(ctx, runnerScaleSetId, messageQueueAccessToken, requestIds)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// CreateMessageSession provides a mock function with given fields: ctx, runnerScaleSetId, owner
+func (_m *Client) CreateMessageSession(ctx context.Context, runnerScaleSetId int, owner string) (*actions.RunnerScaleSetSession, error) {
+	ret := _m.Called(ctx, runnerScaleSetId, owner)
+
+	var r0 *actions.RunnerScaleSetSession
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, int, string) (*actions.RunnerScaleSetSession, error)); ok {
+		return rf(ctx, runnerScaleSetId, owner)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, int, string) *actions.RunnerScaleSetSession); ok {
+		r0 = rf(ctx, runnerScaleSetId, owner)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*actions.RunnerScaleSetSession)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, int, string) error); ok {
+		r1 = rf(ctx, runnerScaleSetId, owner)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// DeleteMessage provides a mock function with given fields: ctx, messageQueueUrl, messageQueueAccessToken, messageId
+func (_m *Client) DeleteMessage(ctx context.Context, messageQueueUrl string, messageQueueAccessToken string, messageId int64) error {
+	ret := _m.Called(ctx, messageQueueUrl, messageQueueAccessToken, messageId)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, string, string, int64) error); ok {
+		r0 = rf(ctx, messageQueueUrl, messageQueueAccessToken, messageId)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// DeleteMessageSession provides a mock function with given fields: ctx, runnerScaleSetId, sessionId
+func (_m *Client) DeleteMessageSession(ctx context.Context, runnerScaleSetId int, sessionId *uuid.UUID) error {
+	ret := _m.Called(ctx, runnerScaleSetId, sessionId)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, int, *uuid.UUID) error); ok {
+		r0 = rf(ctx, runnerScaleSetId, sessionId)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// GetAcquirableJobs provides a mock function with given fields: ctx, runnerScaleSetId
+func (_m *Client) GetAcquirableJobs(ctx context.Context, runnerScaleSetId int) (*actions.AcquirableJobList, error) {
+	ret := _m.Called(ctx, runnerScaleSetId)
+
+	var r0 *actions.AcquirableJobList
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, int) (*actions.AcquirableJobList, error)); ok {
+		return rf(ctx, runnerScaleSetId)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, int) *actions.AcquirableJobList); ok {
+		r0 = rf(ctx, runnerScaleSetId)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*actions.AcquirableJobList)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, int) error); ok {
+		r1 = rf(ctx, runnerScaleSetId)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetMessage provides a mock function with given fields: ctx, messageQueueUrl, messageQueueAccessToken, lastMessageId, maxCapacity
+func (_m *Client) GetMessage(ctx context.Context, messageQueueUrl string, messageQueueAccessToken string, lastMessageId int64, maxCapacity int) (*actions.RunnerScaleSetMessage, error) {
+	ret := _m.Called(ctx, messageQueueUrl, messageQueueAccessToken, lastMessageId, maxCapacity)
+
+	var r0 *actions.RunnerScaleSetMessage
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string, string, int64, int) (*actions.RunnerScaleSetMessage, error)); ok {
+		return rf(ctx, messageQueueUrl, messageQueueAccessToken, lastMessageId, maxCapacity)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, string, string, int64, int) *actions.RunnerScaleSetMessage); ok {
+		r0 = rf(ctx, messageQueueUrl, messageQueueAccessToken, lastMessageId, maxCapacity)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*actions.RunnerScaleSetMessage)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, string, string, int64, int) error); ok {
+		r1 = rf(ctx, messageQueueUrl, messageQueueAccessToken, lastMessageId, maxCapacity)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// RefreshMessageSession provides a mock function with given fields: ctx, runnerScaleSetId, sessionId
+func (_m *Client) RefreshMessageSession(ctx context.Context, runnerScaleSetId int, sessionId *uuid.UUID) (*actions.RunnerScaleSetSession, error) {
+	ret := _m.Called(ctx, runnerScaleSetId, sessionId)
+
+	var r0 *actions.RunnerScaleSetSession
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, int, *uuid.UUID) (*actions.RunnerScaleSetSession, error)); ok {
+		return rf(ctx, runnerScaleSetId, sessionId)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, int, *uuid.UUID) *actions.RunnerScaleSetSession); ok {
+		r0 = rf(ctx, runnerScaleSetId, sessionId)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*actions.RunnerScaleSetSession)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, int, *uuid.UUID) error); ok {
+		r1 = rf(ctx, runnerScaleSetId, sessionId)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// NewClient creates a new instance of Client. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewClient(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *Client {
+	mock := &Client{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

cmd/ghalistener/listener/mocks/handler.go

@@ -0,0 +1,68 @@
+// Code generated by mockery v2.36.1. DO NOT EDIT.
+
+package mocks
+
+import (
+	context "context"
+
+	actions "github.com/actions/actions-runner-controller/github/actions"
+
+	mock "github.com/stretchr/testify/mock"
+)
+
+// Handler is an autogenerated mock type for the Handler type
+type Handler struct {
+	mock.Mock
+}
+
+// HandleDesiredRunnerCount provides a mock function with given fields: ctx, count, jobsCompleted
+func (_m *Handler) HandleDesiredRunnerCount(ctx context.Context, count int, jobsCompleted int) (int, error) {
+	ret := _m.Called(ctx, count, jobsCompleted)
+
+	var r0 int
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, int, int) (int, error)); ok {
+		return rf(ctx, count, jobsCompleted)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, int, int) int); ok {
+		r0 = rf(ctx, count, jobsCompleted)
+	} else {
+		r0 = ret.Get(0).(int)
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, int, int) error); ok {
+		r1 = rf(ctx, count, jobsCompleted)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// HandleJobStarted provides a mock function with given fields: ctx, jobInfo
+func (_m *Handler) HandleJobStarted(ctx context.Context, jobInfo *actions.JobStarted) error {
+	ret := _m.Called(ctx, jobInfo)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, *actions.JobStarted) error); ok {
+		r0 = rf(ctx, jobInfo)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// NewHandler creates a new instance of Handler. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewHandler(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *Handler {
+	mock := &Handler{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

cmd/ghalistener/main.go

@@ -8,13 +8,8 @@ import (
 	"os/signal"
 	"syscall"
 
+	"github.com/actions/actions-runner-controller/cmd/ghalistener/app"
 	"github.com/actions/actions-runner-controller/cmd/ghalistener/config"
-	"github.com/actions/actions-runner-controller/cmd/ghalistener/metrics"
-	"github.com/actions/actions-runner-controller/cmd/ghalistener/scaler"
-	"github.com/actions/actions-runner-controller/github/actions"
-	"github.com/actions/scaleset/listener"
-	"github.com/google/uuid"
-	"golang.org/x/sync/errgroup"
 )
 
 func main() {
@@ -33,116 +28,14 @@ func main() {
 		os.Exit(1)
 	}
 
-	if err := run(ctx, config); err != nil {
+	app, err := app.New(*config)
+	if err != nil {
+		log.Printf("Failed to initialize app: %v", err)
+		os.Exit(1)
+	}
+
+	if err := app.Run(ctx); err != nil {
 		log.Printf("Application returned an error: %v", err)
 		os.Exit(1)
 	}
 }
-
-func run(ctx context.Context, config *config.Config) error {
-	ghConfig, err := actions.ParseGitHubConfigFromURL(config.ConfigureUrl)
-	if err != nil {
-		return fmt.Errorf("failed to parse GitHub config from URL: %w", err)
-	}
-
-	logger, err := config.Logger()
-	if err != nil {
-		return fmt.Errorf("failed to create logger: %w", err)
-	}
-
-	var metricsExporter metrics.ServerExporter
-	if config.MetricsAddr != "" {
-		metricsExporter = metrics.NewExporter(metrics.ExporterConfig{
-			ScaleSetName:      config.EphemeralRunnerSetName,
-			ScaleSetNamespace: config.EphemeralRunnerSetNamespace,
-			Enterprise:        ghConfig.Enterprise,
-			Organization:      ghConfig.Organization,
-			Repository:        ghConfig.Repository,
-			ServerAddr:        config.MetricsAddr,
-			ServerEndpoint:    config.MetricsEndpoint,
-			Metrics:           config.Metrics,
-			Logger:            logger.With("component", "metrics exporter"),
-		})
-	}
-
-	hostname, err := os.Hostname()
-	if err != nil {
-		hostname = uuid.NewString()
-		logger.Info("Failed to get hostname, fallback to uuid", "uuid", hostname, "error", err)
-	}
-
-	scalesetClient, err := config.ActionsClient(logger)
-	if err != nil {
-		return fmt.Errorf("failed to create actions client: %w", err)
-	}
-
-	sessionClient, err := scalesetClient.MessageSessionClient(
-		ctx,
-		config.RunnerScaleSetID,
-		hostname,
-	)
-	if err != nil {
-		return fmt.Errorf("failed to create actions message session client: %w", err)
-	}
-	defer func() {
-		if err := sessionClient.Close(context.Background()); err != nil {
-			logger.Error("Failed to close session client", "error", err)
-		}
-	}()
-
-	var listenerOptions []listener.Option
-	if metricsExporter != nil {
-		listenerOptions = append(
-			listenerOptions,
-			listener.WithMetricsRecorder(
-				metricsExporter,
-			),
-		)
-		metricsExporter.RecordStatic(config.MinRunners, config.MaxRunners)
-	}
-
-	listener, err := listener.New(
-		sessionClient,
-		listener.Config{
-			ScaleSetID: config.RunnerScaleSetID,
-			MaxRunners: config.MaxRunners,
-			Logger:     logger.With("component", "listener"),
-		},
-		listenerOptions...,
-	)
-	if err != nil {
-		return fmt.Errorf("failed to create new listener: %w", err)
-	}
-
-	scaler, err := scaler.New(
-		scaler.Config{
-			EphemeralRunnerSetNamespace: config.EphemeralRunnerSetNamespace,
-			EphemeralRunnerSetName:      config.EphemeralRunnerSetName,
-			MaxRunners:                  config.MaxRunners,
-			MinRunners:                  config.MinRunners,
-		},
-		scaler.WithLogger(logger.With("component", "worker")),
-	)
-	if err != nil {
-		return fmt.Errorf("failed to create new kubernetes worker: %w", err)
-	}
-
-	g, ctx := errgroup.WithContext(ctx)
-	metricsCtx, cancelMetrics := context.WithCancelCause(ctx)
-
-	g.Go(func() error {
-		logger.Info("Starting listener")
-		listnerErr := listener.Run(ctx, scaler)
-		cancelMetrics(fmt.Errorf("listener exited: %w", listnerErr))
-		return listnerErr
-	})
-
-	if metricsExporter != nil {
-		g.Go(func() error {
-			logger.Info("Starting metrics server")
-			return metricsExporter.ListenAndServe(metricsCtx)
-		})
-	}
-
-	return g.Wait()
-}

cmd/ghalistener/metrics/metrics.go

@@ -2,13 +2,14 @@ package metrics
 
 import (
 	"context"
-	"log/slog"
+	"errors"
 	"net/http"
 	"strings"
 	"time"
 
 	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1"
-	"github.com/actions/scaleset"
+	"github.com/actions/actions-runner-controller/github/actions"
+	"github.com/go-logr/logr"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 )
@@ -75,7 +76,7 @@ var metricsHelp = metricsHelpRegistry{
 	},
 }
 
-func (e *exporter) jobLabels(jobBase *scaleset.JobMessageBase) prometheus.Labels {
+func (e *exporter) jobLabels(jobBase *actions.JobMessageBase) prometheus.Labels {
 	workflowRefInfo := ParseWorkflowRef(jobBase.JobWorkflowRef)
 	return prometheus.Labels{
 		labelKeyEnterprise:        e.scaleSetLabels[labelKeyEnterprise],
@@ -89,38 +90,40 @@ func (e *exporter) jobLabels(jobBase *scaleset.JobMessageBase) prometheus.Labels
 	}
 }
 
-func (e *exporter) completedJobLabels(msg *scaleset.JobCompleted) prometheus.Labels {
+func (e *exporter) completedJobLabels(msg *actions.JobCompleted) prometheus.Labels {
 	l := e.jobLabels(&msg.JobMessageBase)
 	l[labelKeyJobResult] = msg.Result
 	return l
 }
 
-func (e *exporter) startedJobLabels(msg *scaleset.JobStarted) prometheus.Labels {
+func (e *exporter) startedJobLabels(msg *actions.JobStarted) prometheus.Labels {
 	return e.jobLabels(&msg.JobMessageBase)
 }
 
-type Recorder interface {
-	RecordStatic(min, max int)
-	RecordStatistics(stats *scaleset.RunnerScaleSetStatistic)
-	RecordJobStarted(msg *scaleset.JobStarted)
-	RecordJobCompleted(msg *scaleset.JobCompleted)
-	RecordDesiredRunners(count int)
+//go:generate mockery --name Publisher --output ./mocks --outpkg mocks --case underscore
+type Publisher interface {
+	PublishStatic(min, max int)
+	PublishStatistics(stats *actions.RunnerScaleSetStatistic)
+	PublishJobStarted(msg *actions.JobStarted)
+	PublishJobCompleted(msg *actions.JobCompleted)
+	PublishDesiredRunners(count int)
 }
 
+//go:generate mockery --name ServerPublisher --output ./mocks --outpkg mocks --case underscore
 type ServerExporter interface {
-	Recorder
+	Publisher
 	ListenAndServe(ctx context.Context) error
 }
 
 var (
-	_ Recorder       = &discard{}
+	_ Publisher      = &discard{}
 	_ ServerExporter = &exporter{}
 )
 
-var Discard Recorder = &discard{}
+var Discard Publisher = &discard{}
 
 type exporter struct {
-	logger         *slog.Logger
+	logger         logr.Logger
 	scaleSetLabels prometheus.Labels
 	*metrics
 	srv *http.Server
@@ -155,7 +158,7 @@ type ExporterConfig struct {
 	Repository        string
 	ServerAddr        string
 	ServerEndpoint    string
-	Logger            *slog.Logger
+	Logger            logr.Logger
 	Metrics           *v1alpha1.MetricsConfig
 }
 
@@ -306,7 +309,7 @@ func NewExporter(config ExporterConfig) ServerExporter {
 	)
 
 	return &exporter{
-		logger: config.Logger.With("component", "metrics exporter"),
+		logger: config.Logger.WithName("metrics"),
 		scaleSetLabels: prometheus.Labels{
 			labelKeyRunnerScaleSetName:      config.ScaleSetName,
 			labelKeyRunnerScaleSetNamespace: config.ScaleSetNamespace,
@@ -322,7 +325,9 @@ func NewExporter(config ExporterConfig) ServerExporter {
 	}
 }
 
-func installMetrics(config v1alpha1.MetricsConfig, reg *prometheus.Registry, logger *slog.Logger) *metrics {
+var errUnknownMetricName = errors.New("unknown metric name")
+
+func installMetrics(config v1alpha1.MetricsConfig, reg *prometheus.Registry, logger logr.Logger) *metrics {
 	logger.Info(
 		"Registering metrics",
 		"gauges",
@@ -340,11 +345,7 @@ func installMetrics(config v1alpha1.MetricsConfig, reg *prometheus.Registry, log
 	for name, cfg := range config.Gauges {
 		help, ok := metricsHelp.gauges[name]
 		if !ok {
-			logger.Error(
-				"unknown metric name",
-				slog.String("name", name),
-				slog.String("kind", "gauge"),
-			)
+			logger.Error(errUnknownMetricName, "name", name, "kind", "gauge")
 			continue
 		}
 
@@ -366,11 +367,7 @@ func installMetrics(config v1alpha1.MetricsConfig, reg *prometheus.Registry, log
 	for name, cfg := range config.Counters {
 		help, ok := metricsHelp.counters[name]
 		if !ok {
-			logger.Error(
-				"unknown metric name",
-				slog.String("name", name),
-				slog.String("kind", "counter"),
-			)
+			logger.Error(errUnknownMetricName, "name", name, "kind", "counter")
 			continue
 		}
 		c := prometheus.V2.NewCounterVec(prometheus.CounterVecOpts{
@@ -391,11 +388,7 @@ func installMetrics(config v1alpha1.MetricsConfig, reg *prometheus.Registry, log
 	for name, cfg := range config.Histograms {
 		help, ok := metricsHelp.histograms[name]
 		if !ok {
-			logger.Error(
-				"unknown metric name",
-				slog.String("name", name),
-				slog.String("kind", "histogram"),
-			)
+			logger.Error(errUnknownMetricName, "name", name, "kind", "histogram")
 			continue
 		}
 
@@ -471,12 +464,12 @@ func (e *exporter) observeHistogram(name string, allLabels prometheus.Labels, va
 	m.histogram.With(labels).Observe(val)
 }
 
-func (e *exporter) RecordStatic(min, max int) {
+func (e *exporter) PublishStatic(min, max int) {
 	e.setGauge(MetricMaxRunners, e.scaleSetLabels, float64(max))
 	e.setGauge(MetricMinRunners, e.scaleSetLabels, float64(min))
 }
 
-func (e *exporter) RecordStatistics(stats *scaleset.RunnerScaleSetStatistic) {
+func (e *exporter) PublishStatistics(stats *actions.RunnerScaleSetStatistic) {
 	e.setGauge(MetricAssignedJobs, e.scaleSetLabels, float64(stats.TotalAssignedJobs))
 	e.setGauge(MetricRunningJobs, e.scaleSetLabels, float64(stats.TotalRunningJobs))
 	e.setGauge(MetricRegisteredRunners, e.scaleSetLabels, float64(stats.TotalRegisteredRunners))
@@ -484,7 +477,7 @@ func (e *exporter) RecordStatistics(stats *scaleset.RunnerScaleSetStatistic) {
 	e.setGauge(MetricIdleRunners, e.scaleSetLabels, float64(stats.TotalIdleRunners))
 }
 
-func (e *exporter) RecordJobStarted(msg *scaleset.JobStarted) {
+func (e *exporter) PublishJobStarted(msg *actions.JobStarted) {
 	l := e.startedJobLabels(msg)
 	e.incCounter(MetricStartedJobsTotal, l)
 
@@ -492,7 +485,7 @@ func (e *exporter) RecordJobStarted(msg *scaleset.JobStarted) {
 	e.observeHistogram(MetricJobStartupDurationSeconds, l, float64(startupDuration))
 }
 
-func (e *exporter) RecordJobCompleted(msg *scaleset.JobCompleted) {
+func (e *exporter) PublishJobCompleted(msg *actions.JobCompleted) {
 	l := e.completedJobLabels(msg)
 	e.incCounter(MetricCompletedJobsTotal, l)
 
@@ -500,17 +493,17 @@ func (e *exporter) RecordJobCompleted(msg *scaleset.JobCompleted) {
 	e.observeHistogram(MetricJobExecutionDurationSeconds, l, float64(executionDuration))
 }
 
-func (e *exporter) RecordDesiredRunners(count int) {
+func (e *exporter) PublishDesiredRunners(count int) {
 	e.setGauge(MetricDesiredRunners, e.scaleSetLabels, float64(count))
 }
 
 type discard struct{}
 
-func (*discard) RecordStatic(int, int)                              {}
-func (*discard) RecordStatistics(*scaleset.RunnerScaleSetStatistic) {}
-func (*discard) RecordJobStarted(*scaleset.JobStarted)              {}
-func (*discard) RecordJobCompleted(*scaleset.JobCompleted)          {}
-func (*discard) RecordDesiredRunners(int)                           {}
+func (*discard) PublishStatic(int, int)                             {}
+func (*discard) PublishStatistics(*actions.RunnerScaleSetStatistic) {}
+func (*discard) PublishJobStarted(*actions.JobStarted)              {}
+func (*discard) PublishJobCompleted(*actions.JobCompleted)          {}
+func (*discard) PublishDesiredRunners(int)                          {}
 
 var defaultRuntimeBuckets []float64 = []float64{
 	0.01,

cmd/ghalistener/metrics/metrics_integration_test.go

@@ -3,7 +3,7 @@ package metrics
 import (
 	"testing"
 
-	"github.com/actions/scaleset"
+	"github.com/actions/actions-runner-controller/github/actions"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/stretchr/testify/assert"
 )
@@ -22,13 +22,13 @@ func TestMetricsWithWorkflowRefParsing(t *testing.T) {
 
 	tests := []struct {
 		name       string
-		jobBase    scaleset.JobMessageBase
+		jobBase    actions.JobMessageBase
 		wantName   string
 		wantTarget string
 	}{
 		{
 			name: "main branch workflow",
-			jobBase: scaleset.JobMessageBase{
+			jobBase: actions.JobMessageBase{
 				OwnerName:      "actions",
 				RepositoryName: "runner",
 				JobDisplayName: "Build and Test",
@@ -40,7 +40,7 @@ func TestMetricsWithWorkflowRefParsing(t *testing.T) {
 		},
 		{
 			name: "feature branch workflow",
-			jobBase: scaleset.JobMessageBase{
+			jobBase: actions.JobMessageBase{
 				OwnerName:      "myorg",
 				RepositoryName: "myrepo",
 				JobDisplayName: "CI/CD Pipeline",
@@ -52,7 +52,7 @@ func TestMetricsWithWorkflowRefParsing(t *testing.T) {
 		},
 		{
 			name: "pull request workflow",
-			jobBase: scaleset.JobMessageBase{
+			jobBase: actions.JobMessageBase{
 				OwnerName:      "actions",
 				RepositoryName: "runner",
 				JobDisplayName: "PR Checks",
@@ -64,7 +64,7 @@ func TestMetricsWithWorkflowRefParsing(t *testing.T) {
 		},
 		{
 			name: "tag workflow",
-			jobBase: scaleset.JobMessageBase{
+			jobBase: actions.JobMessageBase{
 				OwnerName:      "actions",
 				RepositoryName: "runner",
 				JobDisplayName: "Release",

cmd/ghalistener/metrics/metrics_test.go

@@ -1,17 +1,15 @@
 package metrics
 
 import (
-	"log/slog"
 	"testing"
 
 	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1"
+	"github.com/go-logr/logr"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
-var discardLogger = slog.New(slog.DiscardHandler)
-
 func TestInstallMetrics(t *testing.T) {
 	metricsConfig := v1alpha1.MetricsConfig{
 		Counters: map[string]*v1alpha1.CounterMetric{
@@ -76,7 +74,7 @@ func TestInstallMetrics(t *testing.T) {
 	}
 	reg := prometheus.NewRegistry()
 
-	got := installMetrics(metricsConfig, reg, discardLogger)
+	got := installMetrics(metricsConfig, reg, logr.Discard())
 	assert.Len(t, got.counters, 1)
 	assert.Len(t, got.gauges, 1)
 	assert.Len(t, got.histograms, 2)
@@ -100,7 +98,7 @@ func TestNewExporter(t *testing.T) {
 			Repository:        "repo",
 			ServerAddr:        ":6060",
 			ServerEndpoint:    "/metrics",
-			Logger:            discardLogger,
+			Logger:            logr.Discard(),
 			Metrics:           nil, // when metrics is nil, all default metrics should be registered
 		}
 
@@ -142,7 +140,7 @@ func TestNewExporter(t *testing.T) {
 			Repository:        "repo",
 			ServerAddr:        "", // empty ServerAddr should default to ":8080"
 			ServerEndpoint:    "",
-			Logger:            discardLogger,
+			Logger:            logr.Discard(),
 			Metrics:           nil, // when metrics is nil, all default metrics should be registered
 		}
 
@@ -203,7 +201,7 @@ func TestNewExporter(t *testing.T) {
 			Repository:        "repo",
 			ServerAddr:        ":6060",
 			ServerEndpoint:    "/metrics",
-			Logger:            discardLogger,
+			Logger:            logr.Discard(),
 			Metrics:           &metricsConfig,
 		}
 
@@ -246,7 +244,7 @@ func TestExporterConfigDefaults(t *testing.T) {
 		Repository:        "repo",
 		ServerAddr:        "",
 		ServerEndpoint:    "",
-		Logger:            discardLogger,
+		Logger:            logr.Discard(),
 		Metrics:           nil, // when metrics is nil, all default metrics should be registered
 	}
 
@@ -259,7 +257,7 @@ func TestExporterConfigDefaults(t *testing.T) {
 		Repository:        "repo",
 		ServerAddr:        ":8080",    // default server address
 		ServerEndpoint:    "/metrics", // default server endpoint
-		Logger:            discardLogger,
+		Logger:            logr.Discard(),
 		Metrics:           &defaultMetrics, // when metrics is nil, all default metrics should be registered
 	}
 

cmd/ghalistener/metrics/mocks/publisher.go

@@ -0,0 +1,53 @@
+// Code generated by mockery v2.36.1. DO NOT EDIT.
+
+package mocks
+
+import (
+	actions "github.com/actions/actions-runner-controller/github/actions"
+
+	mock "github.com/stretchr/testify/mock"
+)
+
+// Publisher is an autogenerated mock type for the Publisher type
+type Publisher struct {
+	mock.Mock
+}
+
+// PublishDesiredRunners provides a mock function with given fields: count
+func (_m *Publisher) PublishDesiredRunners(count int) {
+	_m.Called(count)
+}
+
+// PublishJobCompleted provides a mock function with given fields: msg
+func (_m *Publisher) PublishJobCompleted(msg *actions.JobCompleted) {
+	_m.Called(msg)
+}
+
+// PublishJobStarted provides a mock function with given fields: msg
+func (_m *Publisher) PublishJobStarted(msg *actions.JobStarted) {
+	_m.Called(msg)
+}
+
+// PublishStatic provides a mock function with given fields: min, max
+func (_m *Publisher) PublishStatic(min int, max int) {
+	_m.Called(min, max)
+}
+
+// PublishStatistics provides a mock function with given fields: stats
+func (_m *Publisher) PublishStatistics(stats *actions.RunnerScaleSetStatistic) {
+	_m.Called(stats)
+}
+
+// NewPublisher creates a new instance of Publisher. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewPublisher(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *Publisher {
+	mock := &Publisher{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

cmd/ghalistener/metrics/mocks/server_publisher.go

@@ -0,0 +1,69 @@
+// Code generated by mockery v2.36.1. DO NOT EDIT.
+
+package mocks
+
+import (
+	context "context"
+
+	actions "github.com/actions/actions-runner-controller/github/actions"
+
+	mock "github.com/stretchr/testify/mock"
+)
+
+// ServerPublisher is an autogenerated mock type for the ServerPublisher type
+type ServerPublisher struct {
+	mock.Mock
+}
+
+// ListenAndServe provides a mock function with given fields: ctx
+func (_m *ServerPublisher) ListenAndServe(ctx context.Context) error {
+	ret := _m.Called(ctx)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context) error); ok {
+		r0 = rf(ctx)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// PublishDesiredRunners provides a mock function with given fields: count
+func (_m *ServerPublisher) PublishDesiredRunners(count int) {
+	_m.Called(count)
+}
+
+// PublishJobCompleted provides a mock function with given fields: msg
+func (_m *ServerPublisher) PublishJobCompleted(msg *actions.JobCompleted) {
+	_m.Called(msg)
+}
+
+// PublishJobStarted provides a mock function with given fields: msg
+func (_m *ServerPublisher) PublishJobStarted(msg *actions.JobStarted) {
+	_m.Called(msg)
+}
+
+// PublishStatic provides a mock function with given fields: min, max
+func (_m *ServerPublisher) PublishStatic(min int, max int) {
+	_m.Called(min, max)
+}
+
+// PublishStatistics provides a mock function with given fields: stats
+func (_m *ServerPublisher) PublishStatistics(stats *actions.RunnerScaleSetStatistic) {
+	_m.Called(stats)
+}
+
+// NewServerPublisher creates a new instance of ServerPublisher. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewServerPublisher(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *ServerPublisher {
+	mock := &ServerPublisher{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

cmd/ghalistener/metrics/mocks_test.go

@@ -1,529 +0,0 @@
-// Code generated by mockery; DO NOT EDIT.
-// github.com/vektra/mockery
-// template: testify
-
-package metrics
-
-import (
-	"context"
-
-	"github.com/actions/scaleset"
-	mock "github.com/stretchr/testify/mock"
-)
-
-// NewMockRecorder creates a new instance of MockRecorder. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockRecorder(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockRecorder {
-	mock := &MockRecorder{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
-
-// MockRecorder is an autogenerated mock type for the Recorder type
-type MockRecorder struct {
-	mock.Mock
-}
-
-type MockRecorder_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockRecorder) EXPECT() *MockRecorder_Expecter {
-	return &MockRecorder_Expecter{mock: &_m.Mock}
-}
-
-// RecordDesiredRunners provides a mock function for the type MockRecorder
-func (_mock *MockRecorder) RecordDesiredRunners(count int) {
-	_mock.Called(count)
-	return
-}
-
-// MockRecorder_RecordDesiredRunners_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'RecordDesiredRunners'
-type MockRecorder_RecordDesiredRunners_Call struct {
-	*mock.Call
-}
-
-// RecordDesiredRunners is a helper method to define mock.On call
-//   - count int
-func (_e *MockRecorder_Expecter) RecordDesiredRunners(count interface{}) *MockRecorder_RecordDesiredRunners_Call {
-	return &MockRecorder_RecordDesiredRunners_Call{Call: _e.mock.On("RecordDesiredRunners", count)}
-}
-
-func (_c *MockRecorder_RecordDesiredRunners_Call) Run(run func(count int)) *MockRecorder_RecordDesiredRunners_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 int
-		if args[0] != nil {
-			arg0 = args[0].(int)
-		}
-		run(
-			arg0,
-		)
-	})
-	return _c
-}
-
-func (_c *MockRecorder_RecordDesiredRunners_Call) Return() *MockRecorder_RecordDesiredRunners_Call {
-	_c.Call.Return()
-	return _c
-}
-
-func (_c *MockRecorder_RecordDesiredRunners_Call) RunAndReturn(run func(count int)) *MockRecorder_RecordDesiredRunners_Call {
-	_c.Run(run)
-	return _c
-}
-
-// RecordJobCompleted provides a mock function for the type MockRecorder
-func (_mock *MockRecorder) RecordJobCompleted(msg *scaleset.JobCompleted) {
-	_mock.Called(msg)
-	return
-}
-
-// MockRecorder_RecordJobCompleted_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'RecordJobCompleted'
-type MockRecorder_RecordJobCompleted_Call struct {
-	*mock.Call
-}
-
-// RecordJobCompleted is a helper method to define mock.On call
-//   - msg *scaleset.JobCompleted
-func (_e *MockRecorder_Expecter) RecordJobCompleted(msg interface{}) *MockRecorder_RecordJobCompleted_Call {
-	return &MockRecorder_RecordJobCompleted_Call{Call: _e.mock.On("RecordJobCompleted", msg)}
-}
-
-func (_c *MockRecorder_RecordJobCompleted_Call) Run(run func(msg *scaleset.JobCompleted)) *MockRecorder_RecordJobCompleted_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 *scaleset.JobCompleted
-		if args[0] != nil {
-			arg0 = args[0].(*scaleset.JobCompleted)
-		}
-		run(
-			arg0,
-		)
-	})
-	return _c
-}
-
-func (_c *MockRecorder_RecordJobCompleted_Call) Return() *MockRecorder_RecordJobCompleted_Call {
-	_c.Call.Return()
-	return _c
-}
-
-func (_c *MockRecorder_RecordJobCompleted_Call) RunAndReturn(run func(msg *scaleset.JobCompleted)) *MockRecorder_RecordJobCompleted_Call {
-	_c.Run(run)
-	return _c
-}
-
-// RecordJobStarted provides a mock function for the type MockRecorder
-func (_mock *MockRecorder) RecordJobStarted(msg *scaleset.JobStarted) {
-	_mock.Called(msg)
-	return
-}
-
-// MockRecorder_RecordJobStarted_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'RecordJobStarted'
-type MockRecorder_RecordJobStarted_Call struct {
-	*mock.Call
-}
-
-// RecordJobStarted is a helper method to define mock.On call
-//   - msg *scaleset.JobStarted
-func (_e *MockRecorder_Expecter) RecordJobStarted(msg interface{}) *MockRecorder_RecordJobStarted_Call {
-	return &MockRecorder_RecordJobStarted_Call{Call: _e.mock.On("RecordJobStarted", msg)}
-}
-
-func (_c *MockRecorder_RecordJobStarted_Call) Run(run func(msg *scaleset.JobStarted)) *MockRecorder_RecordJobStarted_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 *scaleset.JobStarted
-		if args[0] != nil {
-			arg0 = args[0].(*scaleset.JobStarted)
-		}
-		run(
-			arg0,
-		)
-	})
-	return _c
-}
-
-func (_c *MockRecorder_RecordJobStarted_Call) Return() *MockRecorder_RecordJobStarted_Call {
-	_c.Call.Return()
-	return _c
-}
-
-func (_c *MockRecorder_RecordJobStarted_Call) RunAndReturn(run func(msg *scaleset.JobStarted)) *MockRecorder_RecordJobStarted_Call {
-	_c.Run(run)
-	return _c
-}
-
-// RecordStatic provides a mock function for the type MockRecorder
-func (_mock *MockRecorder) RecordStatic(min int, max int) {
-	_mock.Called(min, max)
-	return
-}
-
-// MockRecorder_RecordStatic_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'RecordStatic'
-type MockRecorder_RecordStatic_Call struct {
-	*mock.Call
-}
-
-// RecordStatic is a helper method to define mock.On call
-//   - min int
-//   - max int
-func (_e *MockRecorder_Expecter) RecordStatic(min interface{}, max interface{}) *MockRecorder_RecordStatic_Call {
-	return &MockRecorder_RecordStatic_Call{Call: _e.mock.On("RecordStatic", min, max)}
-}
-
-func (_c *MockRecorder_RecordStatic_Call) Run(run func(min int, max int)) *MockRecorder_RecordStatic_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 int
-		if args[0] != nil {
-			arg0 = args[0].(int)
-		}
-		var arg1 int
-		if args[1] != nil {
-			arg1 = args[1].(int)
-		}
-		run(
-			arg0,
-			arg1,
-		)
-	})
-	return _c
-}
-
-func (_c *MockRecorder_RecordStatic_Call) Return() *MockRecorder_RecordStatic_Call {
-	_c.Call.Return()
-	return _c
-}
-
-func (_c *MockRecorder_RecordStatic_Call) RunAndReturn(run func(min int, max int)) *MockRecorder_RecordStatic_Call {
-	_c.Run(run)
-	return _c
-}
-
-// RecordStatistics provides a mock function for the type MockRecorder
-func (_mock *MockRecorder) RecordStatistics(stats *scaleset.RunnerScaleSetStatistic) {
-	_mock.Called(stats)
-	return
-}
-
-// MockRecorder_RecordStatistics_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'RecordStatistics'
-type MockRecorder_RecordStatistics_Call struct {
-	*mock.Call
-}
-
-// RecordStatistics is a helper method to define mock.On call
-//   - stats *scaleset.RunnerScaleSetStatistic
-func (_e *MockRecorder_Expecter) RecordStatistics(stats interface{}) *MockRecorder_RecordStatistics_Call {
-	return &MockRecorder_RecordStatistics_Call{Call: _e.mock.On("RecordStatistics", stats)}
-}
-
-func (_c *MockRecorder_RecordStatistics_Call) Run(run func(stats *scaleset.RunnerScaleSetStatistic)) *MockRecorder_RecordStatistics_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 *scaleset.RunnerScaleSetStatistic
-		if args[0] != nil {
-			arg0 = args[0].(*scaleset.RunnerScaleSetStatistic)
-		}
-		run(
-			arg0,
-		)
-	})
-	return _c
-}
-
-func (_c *MockRecorder_RecordStatistics_Call) Return() *MockRecorder_RecordStatistics_Call {
-	_c.Call.Return()
-	return _c
-}
-
-func (_c *MockRecorder_RecordStatistics_Call) RunAndReturn(run func(stats *scaleset.RunnerScaleSetStatistic)) *MockRecorder_RecordStatistics_Call {
-	_c.Run(run)
-	return _c
-}
-
-// NewMockServerExporter creates a new instance of MockServerExporter. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-// The first argument is typically a *testing.T value.
-func NewMockServerExporter(t interface {
-	mock.TestingT
-	Cleanup(func())
-}) *MockServerExporter {
-	mock := &MockServerExporter{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
-
-// MockServerExporter is an autogenerated mock type for the ServerExporter type
-type MockServerExporter struct {
-	mock.Mock
-}
-
-type MockServerExporter_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *MockServerExporter) EXPECT() *MockServerExporter_Expecter {
-	return &MockServerExporter_Expecter{mock: &_m.Mock}
-}
-
-// ListenAndServe provides a mock function for the type MockServerExporter
-func (_mock *MockServerExporter) ListenAndServe(ctx context.Context) error {
-	ret := _mock.Called(ctx)
-
-	if len(ret) == 0 {
-		panic("no return value specified for ListenAndServe")
-	}
-
-	var r0 error
-	if returnFunc, ok := ret.Get(0).(func(context.Context) error); ok {
-		r0 = returnFunc(ctx)
-	} else {
-		r0 = ret.Error(0)
-	}
-	return r0
-}
-
-// MockServerExporter_ListenAndServe_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ListenAndServe'
-type MockServerExporter_ListenAndServe_Call struct {
-	*mock.Call
-}
-
-// ListenAndServe is a helper method to define mock.On call
-//   - ctx context.Context
-func (_e *MockServerExporter_Expecter) ListenAndServe(ctx interface{}) *MockServerExporter_ListenAndServe_Call {
-	return &MockServerExporter_ListenAndServe_Call{Call: _e.mock.On("ListenAndServe", ctx)}
-}
-
-func (_c *MockServerExporter_ListenAndServe_Call) Run(run func(ctx context.Context)) *MockServerExporter_ListenAndServe_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 context.Context
-		if args[0] != nil {
-			arg0 = args[0].(context.Context)
-		}
-		run(
-			arg0,
-		)
-	})
-	return _c
-}
-
-func (_c *MockServerExporter_ListenAndServe_Call) Return(err error) *MockServerExporter_ListenAndServe_Call {
-	_c.Call.Return(err)
-	return _c
-}
-
-func (_c *MockServerExporter_ListenAndServe_Call) RunAndReturn(run func(ctx context.Context) error) *MockServerExporter_ListenAndServe_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// RecordDesiredRunners provides a mock function for the type MockServerExporter
-func (_mock *MockServerExporter) RecordDesiredRunners(count int) {
-	_mock.Called(count)
-	return
-}
-
-// MockServerExporter_RecordDesiredRunners_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'RecordDesiredRunners'
-type MockServerExporter_RecordDesiredRunners_Call struct {
-	*mock.Call
-}
-
-// RecordDesiredRunners is a helper method to define mock.On call
-//   - count int
-func (_e *MockServerExporter_Expecter) RecordDesiredRunners(count interface{}) *MockServerExporter_RecordDesiredRunners_Call {
-	return &MockServerExporter_RecordDesiredRunners_Call{Call: _e.mock.On("RecordDesiredRunners", count)}
-}
-
-func (_c *MockServerExporter_RecordDesiredRunners_Call) Run(run func(count int)) *MockServerExporter_RecordDesiredRunners_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 int
-		if args[0] != nil {
-			arg0 = args[0].(int)
-		}
-		run(
-			arg0,
-		)
-	})
-	return _c
-}
-
-func (_c *MockServerExporter_RecordDesiredRunners_Call) Return() *MockServerExporter_RecordDesiredRunners_Call {
-	_c.Call.Return()
-	return _c
-}
-
-func (_c *MockServerExporter_RecordDesiredRunners_Call) RunAndReturn(run func(count int)) *MockServerExporter_RecordDesiredRunners_Call {
-	_c.Run(run)
-	return _c
-}
-
-// RecordJobCompleted provides a mock function for the type MockServerExporter
-func (_mock *MockServerExporter) RecordJobCompleted(msg *scaleset.JobCompleted) {
-	_mock.Called(msg)
-	return
-}
-
-// MockServerExporter_RecordJobCompleted_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'RecordJobCompleted'
-type MockServerExporter_RecordJobCompleted_Call struct {
-	*mock.Call
-}
-
-// RecordJobCompleted is a helper method to define mock.On call
-//   - msg *scaleset.JobCompleted
-func (_e *MockServerExporter_Expecter) RecordJobCompleted(msg interface{}) *MockServerExporter_RecordJobCompleted_Call {
-	return &MockServerExporter_RecordJobCompleted_Call{Call: _e.mock.On("RecordJobCompleted", msg)}
-}
-
-func (_c *MockServerExporter_RecordJobCompleted_Call) Run(run func(msg *scaleset.JobCompleted)) *MockServerExporter_RecordJobCompleted_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 *scaleset.JobCompleted
-		if args[0] != nil {
-			arg0 = args[0].(*scaleset.JobCompleted)
-		}
-		run(
-			arg0,
-		)
-	})
-	return _c
-}
-
-func (_c *MockServerExporter_RecordJobCompleted_Call) Return() *MockServerExporter_RecordJobCompleted_Call {
-	_c.Call.Return()
-	return _c
-}
-
-func (_c *MockServerExporter_RecordJobCompleted_Call) RunAndReturn(run func(msg *scaleset.JobCompleted)) *MockServerExporter_RecordJobCompleted_Call {
-	_c.Run(run)
-	return _c
-}
-
-// RecordJobStarted provides a mock function for the type MockServerExporter
-func (_mock *MockServerExporter) RecordJobStarted(msg *scaleset.JobStarted) {
-	_mock.Called(msg)
-	return
-}
-
-// MockServerExporter_RecordJobStarted_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'RecordJobStarted'
-type MockServerExporter_RecordJobStarted_Call struct {
-	*mock.Call
-}
-
-// RecordJobStarted is a helper method to define mock.On call
-//   - msg *scaleset.JobStarted
-func (_e *MockServerExporter_Expecter) RecordJobStarted(msg interface{}) *MockServerExporter_RecordJobStarted_Call {
-	return &MockServerExporter_RecordJobStarted_Call{Call: _e.mock.On("RecordJobStarted", msg)}
-}
-
-func (_c *MockServerExporter_RecordJobStarted_Call) Run(run func(msg *scaleset.JobStarted)) *MockServerExporter_RecordJobStarted_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 *scaleset.JobStarted
-		if args[0] != nil {
-			arg0 = args[0].(*scaleset.JobStarted)
-		}
-		run(
-			arg0,
-		)
-	})
-	return _c
-}
-
-func (_c *MockServerExporter_RecordJobStarted_Call) Return() *MockServerExporter_RecordJobStarted_Call {
-	_c.Call.Return()
-	return _c
-}
-
-func (_c *MockServerExporter_RecordJobStarted_Call) RunAndReturn(run func(msg *scaleset.JobStarted)) *MockServerExporter_RecordJobStarted_Call {
-	_c.Run(run)
-	return _c
-}
-
-// RecordStatic provides a mock function for the type MockServerExporter
-func (_mock *MockServerExporter) RecordStatic(min int, max int) {
-	_mock.Called(min, max)
-	return
-}
-
-// MockServerExporter_RecordStatic_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'RecordStatic'
-type MockServerExporter_RecordStatic_Call struct {
-	*mock.Call
-}
-
-// RecordStatic is a helper method to define mock.On call
-//   - min int
-//   - max int
-func (_e *MockServerExporter_Expecter) RecordStatic(min interface{}, max interface{}) *MockServerExporter_RecordStatic_Call {
-	return &MockServerExporter_RecordStatic_Call{Call: _e.mock.On("RecordStatic", min, max)}
-}
-
-func (_c *MockServerExporter_RecordStatic_Call) Run(run func(min int, max int)) *MockServerExporter_RecordStatic_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 int
-		if args[0] != nil {
-			arg0 = args[0].(int)
-		}
-		var arg1 int
-		if args[1] != nil {
-			arg1 = args[1].(int)
-		}
-		run(
-			arg0,
-			arg1,
-		)
-	})
-	return _c
-}
-
-func (_c *MockServerExporter_RecordStatic_Call) Return() *MockServerExporter_RecordStatic_Call {
-	_c.Call.Return()
-	return _c
-}
-
-func (_c *MockServerExporter_RecordStatic_Call) RunAndReturn(run func(min int, max int)) *MockServerExporter_RecordStatic_Call {
-	_c.Run(run)
-	return _c
-}
-
-// RecordStatistics provides a mock function for the type MockServerExporter
-func (_mock *MockServerExporter) RecordStatistics(stats *scaleset.RunnerScaleSetStatistic) {
-	_mock.Called(stats)
-	return
-}
-
-// MockServerExporter_RecordStatistics_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'RecordStatistics'
-type MockServerExporter_RecordStatistics_Call struct {
-	*mock.Call
-}
-
-// RecordStatistics is a helper method to define mock.On call
-//   - stats *scaleset.RunnerScaleSetStatistic
-func (_e *MockServerExporter_Expecter) RecordStatistics(stats interface{}) *MockServerExporter_RecordStatistics_Call {
-	return &MockServerExporter_RecordStatistics_Call{Call: _e.mock.On("RecordStatistics", stats)}
-}
-
-func (_c *MockServerExporter_RecordStatistics_Call) Run(run func(stats *scaleset.RunnerScaleSetStatistic)) *MockServerExporter_RecordStatistics_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 *scaleset.RunnerScaleSetStatistic
-		if args[0] != nil {
-			arg0 = args[0].(*scaleset.RunnerScaleSetStatistic)
-		}
-		run(
-			arg0,
-		)
-	})
-	return _c
-}
-
-func (_c *MockServerExporter_RecordStatistics_Call) Return() *MockServerExporter_RecordStatistics_Call {
-	_c.Call.Return()
-	return _c
-}
-
-func (_c *MockServerExporter_RecordStatistics_Call) RunAndReturn(run func(stats *scaleset.RunnerScaleSetStatistic)) *MockServerExporter_RecordStatistics_Call {
-	_c.Run(run)
-	return _c
-}

cmd/ghalistener/worker/worker.go

@@ -1,27 +1,30 @@
-package scaler
+package worker
 
 import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"log/slog"
-	"math"
 
 	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1"
-	"github.com/actions/scaleset"
-	"github.com/actions/scaleset/listener"
+	"github.com/actions/actions-runner-controller/cmd/ghalistener/listener"
+	"github.com/actions/actions-runner-controller/github/actions"
+	"github.com/actions/actions-runner-controller/logging"
 	jsonpatch "github.com/evanphx/json-patch"
+	"github.com/go-logr/logr"
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
 )
 
-type Option func(*Scaler)
+const workerName = "kubernetesworker"
 
-func WithLogger(logger *slog.Logger) Option {
-	return func(w *Scaler) {
-		w.logger = logger
+type Option func(*Worker)
+
+func WithLogger(logger logr.Logger) Option {
+	return func(w *Worker) {
+		logger = logger.WithName(workerName)
+		w.logger = &logger
 	}
 }
 
@@ -32,25 +35,23 @@ type Config struct {
 	MinRunners                  int
 }
 
-// The Scaler's role is to process the messages it receives from the listener.
+// The Worker's role is to process the messages it receives from the listener.
 // It then initiates Kubernetes API requests to carry out the necessary actions.
-type Scaler struct {
-	clientset     *kubernetes.Clientset
-	config        Config
-	targetRunners int
-	patchSeq      int
-	// dirty is set when there are any events handled before the desired count is called.
-	dirty  bool
-	logger *slog.Logger
+type Worker struct {
+	clientset *kubernetes.Clientset
+	config    Config
+	lastPatch int
+	patchSeq  int
+	logger    *logr.Logger
 }
 
-var _ listener.Scaler = (*Scaler)(nil)
+var _ listener.Handler = (*Worker)(nil)
 
-func New(config Config, options ...Option) (*Scaler, error) {
-	w := &Scaler{
-		config:        config,
-		targetRunners: -1,
-		patchSeq:      -1,
+func New(config Config, options ...Option) (*Worker, error) {
+	w := &Worker{
+		config:    config,
+		lastPatch: -1,
+		patchSeq:  -1,
 	}
 
 	conf, err := rest.InClusterConfig()
@@ -76,9 +77,14 @@ func New(config Config, options ...Option) (*Scaler, error) {
 	return w, nil
 }
 
-func (w *Scaler) applyDefaults() error {
+func (w *Worker) applyDefaults() error {
 	if w.logger == nil {
-		w.logger = slog.New(slog.DiscardHandler)
+		logger, err := logging.NewLogger(logging.LogLevelDebug, logging.LogFormatJSON)
+		if err != nil {
+			return fmt.Errorf("NewLogger failed: %w", err)
+		}
+		logger = logger.WithName(workerName)
+		w.logger = &logger
 	}
 
 	return nil
@@ -89,7 +95,7 @@ func (w *Scaler) applyDefaults() error {
 // This update marks the ephemeral runner so that the controller would have more context
 // about the ephemeral runner that should not be deleted when scaling down.
 // It returns an error if there is any issue with updating the job information.
-func (w *Scaler) HandleJobStarted(ctx context.Context, jobInfo *scaleset.JobStarted) error {
+func (w *Worker) HandleJobStarted(ctx context.Context, jobInfo *actions.JobStarted) error {
 	w.logger.Info("Updating job info for the runner",
 		"runnerName", jobInfo.RunnerName,
 		"ownerName", jobInfo.OwnerName,
@@ -100,8 +106,6 @@ func (w *Scaler) HandleJobStarted(ctx context.Context, jobInfo *scaleset.JobStar
 		"jobDisplayName", jobInfo.JobDisplayName,
 		"requestId", jobInfo.RunnerRequestID)
 
-	w.dirty = true
-
 	original, err := json.Marshal(&v1alpha1.EphemeralRunner{})
 	if err != nil {
 		return fmt.Errorf("failed to marshal empty ephemeral runner: %w", err)
@@ -154,11 +158,6 @@ func (w *Scaler) HandleJobStarted(ctx context.Context, jobInfo *scaleset.JobStar
 	return nil
 }
 
-func (w *Scaler) HandleJobCompleted(ctx context.Context, msg *scaleset.JobCompleted) error {
-	w.dirty = true
-	return nil
-}
-
 // HandleDesiredRunnerCount handles the desired runner count by scaling the ephemeral runner set.
 // The function calculates the target runner count based on the minimum and maximum runner count configuration.
 // If the target runner count is the same as the last patched count, it skips patching and returns nil.
@@ -166,8 +165,8 @@ func (w *Scaler) HandleJobCompleted(ctx context.Context, msg *scaleset.JobComple
 // The function then scales the ephemeral runner set by applying the merge patch.
 // Finally, it logs the scaled ephemeral runner set details and returns nil if successful.
 // If any error occurs during the process, it returns an error with a descriptive message.
-func (w *Scaler) HandleDesiredRunnerCount(ctx context.Context, count int) (int, error) {
-	patchID := w.setDesiredWorkerState(count)
+func (w *Worker) HandleDesiredRunnerCount(ctx context.Context, count, jobsCompleted int) (int, error) {
+	patchID := w.setDesiredWorkerState(count, jobsCompleted)
 
 	original, err := json.Marshal(
 		&v1alpha1.EphemeralRunnerSet{
@@ -184,13 +183,13 @@ func (w *Scaler) HandleDesiredRunnerCount(ctx context.Context, count int) (int,
 	patch, err := json.Marshal(
 		&v1alpha1.EphemeralRunnerSet{
 			Spec: v1alpha1.EphemeralRunnerSetSpec{
-				Replicas: w.targetRunners,
+				Replicas: w.lastPatch,
 				PatchID:  patchID,
 			},
 		},
 	)
 	if err != nil {
-		w.logger.Error("could not marshal patch ephemeral runner set", "error", err.Error())
+		w.logger.Error(err, "could not marshal patch ephemeral runner set")
 		return 0, err
 	}
 
@@ -221,39 +220,39 @@ func (w *Scaler) HandleDesiredRunnerCount(ctx context.Context, count int) (int,
 		"name", w.config.EphemeralRunnerSetName,
 		"replicas", patchedEphemeralRunnerSet.Spec.Replicas,
 	)
-	return w.targetRunners, nil
+	return w.lastPatch, nil
 }
 
 // calculateDesiredState calculates the desired state of the worker based on the desired count and the the number of jobs completed.
-func (w *Scaler) setDesiredWorkerState(count int) int {
-	dirty := w.dirty
-	w.dirty = false
-
-	if w.patchSeq == math.MaxInt32 {
-		w.patchSeq = 0
-	}
-	w.patchSeq++
-
+func (w *Worker) setDesiredWorkerState(count, jobsCompleted int) int {
+	// Max runners should always be set by the resource builder either to the configured value,
+	// or the maximum int32 (resourcebuilder.newAutoScalingListener()).
 	targetRunnerCount := min(w.config.MinRunners+count, w.config.MaxRunners)
-	oldTargetRunners := w.targetRunners
-	w.targetRunners = targetRunnerCount
-
+	w.patchSeq++
 	desiredPatchID := w.patchSeq
-	if !dirty && targetRunnerCount == oldTargetRunners && targetRunnerCount == w.config.MinRunners {
-		// If there were no events sent, and the target runner count
-		// is the same as the last patched count, we can force the state.
-		//
-		// TODO: see to remove w.config.MinRunenrs from the equation, as it is not relevant to the decision of whether to patch or not.
-		desiredPatchID = 0
+
+	if count == 0 && jobsCompleted == 0 { // empty batch
+		targetRunnerCount = max(w.lastPatch, targetRunnerCount)
+		if targetRunnerCount == w.config.MinRunners {
+			// We have an empty batch, and the last patch was the min runners.
+			// Since this is an empty batch, and we are at the min runners, they should all be idle.
+			// If controller created few more pods on accident (during scale down events),
+			// this situation allows the controller to scale down to the min runners.
+			// However, it is important to keep the patch sequence increasing so we don't ignore one batch.
+			desiredPatchID = 0
+		}
 	}
 
+	w.lastPatch = targetRunnerCount
+
 	w.logger.Info(
 		"Calculated target runner count",
 		"assigned job", count,
 		"decision", targetRunnerCount,
 		"min", w.config.MinRunners,
 		"max", w.config.MaxRunners,
-		"currentRunnerCount", w.targetRunners,
+		"currentRunnerCount", w.lastPatch,
+		"jobsCompleted", jobsCompleted,
 	)
 
 	return desiredPatchID

cmd/ghalistener/worker/worker_test.go

@@ -1,334 +1,326 @@
-package scaler
+package worker
 
 import (
-	"log/slog"
 	"math"
 	"testing"
 
+	"github.com/go-logr/logr"
 	"github.com/stretchr/testify/assert"
 )
 
-var discardLogger = slog.New(slog.DiscardHandler)
-
 func TestSetDesiredWorkerState_MinMaxDefaults(t *testing.T) {
-	newEmptyWorker := func() *Scaler {
-		return &Scaler{
+	logger := logr.Discard()
+	newEmptyWorker := func() *Worker {
+		return &Worker{
 			config: Config{
 				MinRunners: 0,
 				MaxRunners: math.MaxInt32,
 			},
-			targetRunners: -1,
-			patchSeq:      -1,
-			logger:        discardLogger,
+			lastPatch: -1,
+			patchSeq:  -1,
+			logger:    &logger,
 		}
 	}
 
 	t.Run("init calculate with acquired 0", func(t *testing.T) {
 		w := newEmptyWorker()
-		patchID := w.setDesiredWorkerState(0)
-		assert.False(t, w.dirty)
-		assert.Equal(t, 0, w.targetRunners)
+		patchID := w.setDesiredWorkerState(0, 0)
+		assert.Equal(t, 0, w.lastPatch)
 		assert.Equal(t, 0, w.patchSeq)
 		assert.Equal(t, 0, patchID)
 	})
 
 	t.Run("init calculate with acquired 1", func(t *testing.T) {
 		w := newEmptyWorker()
-		patchID := w.setDesiredWorkerState(1)
-		assert.False(t, w.dirty)
-		assert.Equal(t, 1, w.targetRunners)
+		patchID := w.setDesiredWorkerState(1, 0)
+		assert.Equal(t, 1, w.lastPatch)
 		assert.Equal(t, 0, w.patchSeq)
 		assert.Equal(t, 0, patchID)
 	})
 
 	t.Run("increment patch when job done", func(t *testing.T) {
 		w := newEmptyWorker()
-		patchID := w.setDesiredWorkerState(1)
-		assert.False(t, w.dirty)
+		patchID := w.setDesiredWorkerState(1, 0)
 		assert.Equal(t, 0, patchID)
-		w.dirty = true
-		patchID = w.setDesiredWorkerState(0)
-		assert.False(t, w.dirty)
+		patchID = w.setDesiredWorkerState(0, 1)
 		assert.Equal(t, 1, patchID)
-		assert.Equal(t, 0, w.targetRunners)
+		assert.Equal(t, 0, w.lastPatch)
 		assert.Equal(t, 1, w.patchSeq)
 	})
 
 	t.Run("increment patch when called with same parameters", func(t *testing.T) {
 		w := newEmptyWorker()
-		patchID := w.setDesiredWorkerState(1)
-		assert.False(t, w.dirty)
+		patchID := w.setDesiredWorkerState(1, 0)
 		assert.Equal(t, 0, patchID)
-		patchID = w.setDesiredWorkerState(1)
-		assert.False(t, w.dirty)
+		patchID = w.setDesiredWorkerState(1, 0)
 		assert.Equal(t, 1, patchID)
-		assert.Equal(t, 1, w.targetRunners)
+		assert.Equal(t, 1, w.lastPatch)
 		assert.Equal(t, 1, w.patchSeq)
 	})
 
 	t.Run("calculate desired scale when acquired > 0 and completed > 0", func(t *testing.T) {
 		w := newEmptyWorker()
-		w.dirty = true
-		patchID := w.setDesiredWorkerState(1)
-		assert.False(t, w.dirty)
+		patchID := w.setDesiredWorkerState(1, 1)
 		assert.Equal(t, 0, patchID)
-		assert.Equal(t, 1, w.targetRunners)
+		assert.Equal(t, 1, w.lastPatch)
 		assert.Equal(t, 0, w.patchSeq)
 	})
 
+	t.Run("re-use the last state when acquired == 0 and completed == 0", func(t *testing.T) {
+		w := newEmptyWorker()
+		patchID := w.setDesiredWorkerState(1, 0)
+		assert.Equal(t, 0, patchID)
+		patchID = w.setDesiredWorkerState(0, 0)
+		assert.Equal(t, 1, patchID)
+		assert.Equal(t, 1, w.lastPatch)
+		assert.Equal(t, 1, w.patchSeq)
+	})
+
 	t.Run("adjust when acquired == 0 and completed == 1", func(t *testing.T) {
 		w := newEmptyWorker()
-		w.dirty = true
-		patchID := w.setDesiredWorkerState(1)
-		assert.False(t, w.dirty)
+		patchID := w.setDesiredWorkerState(1, 1)
 		assert.Equal(t, 0, patchID)
-		assert.False(t, w.dirty)
-		w.dirty = true
-		patchID = w.setDesiredWorkerState(0)
-		assert.False(t, w.dirty)
+		patchID = w.setDesiredWorkerState(0, 1)
 		assert.Equal(t, 1, patchID)
-		assert.Equal(t, 0, w.targetRunners)
+		assert.Equal(t, 0, w.lastPatch)
 		assert.Equal(t, 1, w.patchSeq)
 	})
 }
 
 func TestSetDesiredWorkerState_MinSet(t *testing.T) {
-	newEmptyWorker := func() *Scaler {
-		return &Scaler{
+	logger := logr.Discard()
+	newEmptyWorker := func() *Worker {
+		return &Worker{
 			config: Config{
 				MinRunners: 1,
 				MaxRunners: math.MaxInt32,
 			},
-			targetRunners: -1,
-			patchSeq:      -1,
-			logger:        discardLogger,
+			lastPatch: -1,
+			patchSeq:  -1,
+			logger:    &logger,
 		}
 	}
 
 	t.Run("initial scale when acquired == 0 and completed == 0", func(t *testing.T) {
 		w := newEmptyWorker()
-		patchID := w.setDesiredWorkerState(0)
-		assert.False(t, w.dirty)
-		assert.False(t, w.dirty)
+		patchID := w.setDesiredWorkerState(0, 0)
 		assert.Equal(t, 0, patchID)
-		assert.Equal(t, 1, w.targetRunners)
+		assert.Equal(t, 1, w.lastPatch)
 		assert.Equal(t, 0, w.patchSeq)
 	})
 
+	t.Run("re-use the old state on count == 0 and completed == 0", func(t *testing.T) {
+		w := newEmptyWorker()
+		patchID := w.setDesiredWorkerState(2, 0)
+		assert.Equal(t, 0, patchID)
+		patchID = w.setDesiredWorkerState(0, 0)
+		assert.Equal(t, 1, patchID)
+		assert.Equal(t, 3, w.lastPatch)
+		assert.Equal(t, 1, w.patchSeq)
+	})
+
 	t.Run("request back to 0 on job done", func(t *testing.T) {
 		w := newEmptyWorker()
-		patchID := w.setDesiredWorkerState(2)
-		assert.False(t, w.dirty)
+		patchID := w.setDesiredWorkerState(2, 0)
 		assert.Equal(t, 0, patchID)
-
-		w.dirty = true
-		patchID = w.setDesiredWorkerState(0)
-		assert.False(t, w.dirty)
+		patchID = w.setDesiredWorkerState(0, 1)
 		assert.Equal(t, 1, patchID)
-		assert.Equal(t, 1, w.targetRunners)
+		assert.Equal(t, 1, w.lastPatch)
 		assert.Equal(t, 1, w.patchSeq)
 	})
 
 	t.Run("desired patch is 0 but sequence continues on empty batch and min runners", func(t *testing.T) {
 		w := newEmptyWorker()
-		patchID := w.setDesiredWorkerState(3)
-		assert.False(t, w.dirty)
+		patchID := w.setDesiredWorkerState(3, 0)
 		assert.Equal(t, 0, patchID)
-		assert.Equal(t, 4, w.targetRunners)
+		assert.Equal(t, 4, w.lastPatch)
 		assert.Equal(t, 0, w.patchSeq)
 
-		w.dirty = true
-		patchID = w.setDesiredWorkerState(0)
-		assert.False(t, w.dirty)
+		patchID = w.setDesiredWorkerState(0, 3)
 		assert.Equal(t, 1, patchID)
-		assert.Equal(t, 1, w.targetRunners)
+		assert.Equal(t, 1, w.lastPatch)
 		assert.Equal(t, 1, w.patchSeq)
 
 		// Empty batch on min runners
-		patchID = w.setDesiredWorkerState(0)
-		assert.False(t, w.dirty)
+		patchID = w.setDesiredWorkerState(0, 0)
 		assert.Equal(t, 0, patchID) // forcing the state
-		assert.Equal(t, 1, w.targetRunners)
+		assert.Equal(t, 1, w.lastPatch)
 		assert.Equal(t, 2, w.patchSeq)
 	})
+
 }
 
 func TestSetDesiredWorkerState_MaxSet(t *testing.T) {
-	newEmptyWorker := func() *Scaler {
-		return &Scaler{
+	logger := logr.Discard()
+	newEmptyWorker := func() *Worker {
+		return &Worker{
 			config: Config{
 				MinRunners: 0,
 				MaxRunners: 5,
 			},
-			targetRunners: -1,
-			patchSeq:      -1,
-			logger:        discardLogger,
+			lastPatch: -1,
+			patchSeq:  -1,
+			logger:    &logger,
 		}
 	}
 
 	t.Run("initial scale when acquired == 0 and completed == 0", func(t *testing.T) {
 		w := newEmptyWorker()
-		patchID := w.setDesiredWorkerState(0)
-		assert.False(t, w.dirty)
+		patchID := w.setDesiredWorkerState(0, 0)
 		assert.Equal(t, 0, patchID)
-		assert.Equal(t, 0, w.targetRunners)
+		assert.Equal(t, 0, w.lastPatch)
 		assert.Equal(t, 0, w.patchSeq)
 	})
 
+	t.Run("re-use the old state on count == 0 and completed == 0", func(t *testing.T) {
+		w := newEmptyWorker()
+		patchID := w.setDesiredWorkerState(2, 0)
+		assert.Equal(t, 0, patchID)
+		patchID = w.setDesiredWorkerState(0, 0)
+		assert.Equal(t, 1, patchID)
+		assert.Equal(t, 2, w.lastPatch)
+		assert.Equal(t, 1, w.patchSeq)
+	})
+
 	t.Run("request back to 0 on job done", func(t *testing.T) {
 		w := newEmptyWorker()
-		patchID := w.setDesiredWorkerState(2)
-		assert.False(t, w.dirty)
+		patchID := w.setDesiredWorkerState(2, 0)
 		assert.Equal(t, 0, patchID)
-
-		w.dirty = true
-		patchID = w.setDesiredWorkerState(0)
-		assert.False(t, w.dirty)
+		patchID = w.setDesiredWorkerState(0, 1)
 		assert.Equal(t, 1, patchID)
-		assert.Equal(t, 0, w.targetRunners)
+		assert.Equal(t, 0, w.lastPatch)
 		assert.Equal(t, 1, w.patchSeq)
 	})
 
 	t.Run("scale up to max when count > max", func(t *testing.T) {
 		w := newEmptyWorker()
-		patchID := w.setDesiredWorkerState(6)
-		assert.False(t, w.dirty)
+		patchID := w.setDesiredWorkerState(6, 0)
 		assert.Equal(t, 0, patchID)
-		assert.Equal(t, 5, w.targetRunners)
+		assert.Equal(t, 5, w.lastPatch)
 		assert.Equal(t, 0, w.patchSeq)
 	})
 
 	t.Run("scale to max when count == max", func(t *testing.T) {
 		w := newEmptyWorker()
-		w.setDesiredWorkerState(5)
-		assert.False(t, w.dirty)
-		assert.Equal(t, 5, w.targetRunners)
+		w.setDesiredWorkerState(5, 0)
+		assert.Equal(t, 5, w.lastPatch)
 		assert.Equal(t, 0, w.patchSeq)
 	})
 
 	t.Run("scale to max when count > max and completed > 0", func(t *testing.T) {
 		w := newEmptyWorker()
-		patchID := w.setDesiredWorkerState(1)
-		assert.False(t, w.dirty)
+		patchID := w.setDesiredWorkerState(1, 0)
 		assert.Equal(t, 0, patchID)
-
-		w.dirty = true
-		patchID = w.setDesiredWorkerState(6)
-		assert.False(t, w.dirty)
+		patchID = w.setDesiredWorkerState(6, 1)
 		assert.Equal(t, 1, patchID)
-		assert.Equal(t, 5, w.targetRunners)
+		assert.Equal(t, 5, w.lastPatch)
 		assert.Equal(t, 1, w.patchSeq)
 	})
 
 	t.Run("scale back to 0 when count was > max", func(t *testing.T) {
 		w := newEmptyWorker()
-		patchID := w.setDesiredWorkerState(6)
-		assert.False(t, w.dirty)
+		patchID := w.setDesiredWorkerState(6, 0)
 		assert.Equal(t, 0, patchID)
-
-		w.dirty = true
-		patchID = w.setDesiredWorkerState(0)
-		assert.False(t, w.dirty)
+		patchID = w.setDesiredWorkerState(0, 1)
 		assert.Equal(t, 1, patchID)
-		assert.Equal(t, 0, w.targetRunners)
+		assert.Equal(t, 0, w.lastPatch)
 		assert.Equal(t, 1, w.patchSeq)
 	})
 
 	t.Run("force 0 on empty batch and last patch == min runners", func(t *testing.T) {
 		w := newEmptyWorker()
-		patchID := w.setDesiredWorkerState(3)
+		patchID := w.setDesiredWorkerState(3, 0)
 		assert.Equal(t, 0, patchID)
-		assert.Equal(t, 3, w.targetRunners)
+		assert.Equal(t, 3, w.lastPatch)
 		assert.Equal(t, 0, w.patchSeq)
 
-		w.dirty = true
-		patchID = w.setDesiredWorkerState(0)
+		patchID = w.setDesiredWorkerState(0, 3)
 		assert.Equal(t, 1, patchID)
-		assert.Equal(t, 0, w.targetRunners)
+		assert.Equal(t, 0, w.lastPatch)
 		assert.Equal(t, 1, w.patchSeq)
 
 		// Empty batch on min runners
-		patchID = w.setDesiredWorkerState(0)
+		patchID = w.setDesiredWorkerState(0, 0)
 		assert.Equal(t, 0, patchID) // forcing the state
-		assert.Equal(t, 0, w.targetRunners)
+		assert.Equal(t, 0, w.lastPatch)
 		assert.Equal(t, 2, w.patchSeq)
 	})
 }
 
 func TestSetDesiredWorkerState_MinMaxSet(t *testing.T) {
-	newEmptyWorker := func() *Scaler {
-		return &Scaler{
+	logger := logr.Discard()
+	newEmptyWorker := func() *Worker {
+		return &Worker{
 			config: Config{
 				MinRunners: 1,
 				MaxRunners: 3,
 			},
-			targetRunners: -1,
-			patchSeq:      -1,
-			logger:        discardLogger,
+			lastPatch: -1,
+			patchSeq:  -1,
+			logger:    &logger,
 		}
 	}
 
 	t.Run("initial scale when acquired == 0 and completed == 0", func(t *testing.T) {
 		w := newEmptyWorker()
-		patchID := w.setDesiredWorkerState(0)
-		assert.False(t, w.dirty)
+		patchID := w.setDesiredWorkerState(0, 0)
 		assert.Equal(t, 0, patchID)
-		assert.Equal(t, 1, w.targetRunners)
+		assert.Equal(t, 1, w.lastPatch)
 		assert.Equal(t, 0, w.patchSeq)
 	})
 
+	t.Run("re-use the old state on count == 0 and completed == 0", func(t *testing.T) {
+		w := newEmptyWorker()
+		patchID := w.setDesiredWorkerState(2, 0)
+		assert.Equal(t, 0, patchID)
+		patchID = w.setDesiredWorkerState(0, 0)
+		assert.Equal(t, 1, patchID)
+		assert.Equal(t, 3, w.lastPatch)
+		assert.Equal(t, 1, w.patchSeq)
+	})
+
 	t.Run("scale to min when count == 0", func(t *testing.T) {
 		w := newEmptyWorker()
-		patchID := w.setDesiredWorkerState(2)
-		assert.False(t, w.dirty)
+		patchID := w.setDesiredWorkerState(2, 0)
 		assert.Equal(t, 0, patchID)
-
-		w.dirty = true
-		patchID = w.setDesiredWorkerState(0)
-		assert.False(t, w.dirty)
+		patchID = w.setDesiredWorkerState(0, 1)
 		assert.Equal(t, 1, patchID)
-		assert.Equal(t, 1, w.targetRunners)
+		assert.Equal(t, 1, w.lastPatch)
 		assert.Equal(t, 1, w.patchSeq)
 	})
 
 	t.Run("scale up to max when count > max", func(t *testing.T) {
 		w := newEmptyWorker()
-		patchID := w.setDesiredWorkerState(4)
-		assert.False(t, w.dirty)
+		patchID := w.setDesiredWorkerState(4, 0)
 		assert.Equal(t, 0, patchID)
-		assert.Equal(t, 3, w.targetRunners)
+		assert.Equal(t, 3, w.lastPatch)
 		assert.Equal(t, 0, w.patchSeq)
 	})
 
 	t.Run("scale to max when count == max", func(t *testing.T) {
 		w := newEmptyWorker()
-		patchID := w.setDesiredWorkerState(3)
-		assert.False(t, w.dirty)
+		patchID := w.setDesiredWorkerState(3, 0)
 		assert.Equal(t, 0, patchID)
-		assert.Equal(t, 3, w.targetRunners)
+		assert.Equal(t, 3, w.lastPatch)
 		assert.Equal(t, 0, w.patchSeq)
 	})
 
 	t.Run("force 0 on empty batch and last patch == min runners", func(t *testing.T) {
 		w := newEmptyWorker()
-		patchID := w.setDesiredWorkerState(3)
-		assert.False(t, w.dirty)
+		patchID := w.setDesiredWorkerState(3, 0)
 		assert.Equal(t, 0, patchID)
-		assert.Equal(t, 3, w.targetRunners)
+		assert.Equal(t, 3, w.lastPatch)
 		assert.Equal(t, 0, w.patchSeq)
 
-		w.dirty = true
-		patchID = w.setDesiredWorkerState(0)
-		assert.False(t, w.dirty)
+		patchID = w.setDesiredWorkerState(0, 3)
 		assert.Equal(t, 1, patchID)
-		assert.Equal(t, 1, w.targetRunners)
+		assert.Equal(t, 1, w.lastPatch)
 		assert.Equal(t, 1, w.patchSeq)
 
 		// Empty batch on min runners
-		patchID = w.setDesiredWorkerState(0)
-		assert.False(t, w.dirty)
+		patchID = w.setDesiredWorkerState(0, 0)
 		assert.Equal(t, 0, patchID) // forcing the state
-		assert.Equal(t, 1, w.targetRunners)
+		assert.Equal(t, 1, w.lastPatch)
 		assert.Equal(t, 2, w.patchSeq)
 	})
 }

config/crd/bases/actions.github.com_autoscalinglisteners.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: autoscalinglisteners.actions.github.com
 spec:
   group: actions.github.com
@@ -525,6 +525,7 @@ spec:
                                             pod labels will be ignored. The default value is empty.
                                             The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                             Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                           items:
                                             type: string
                                           type: array
@@ -539,6 +540,7 @@ spec:
                                             pod labels will be ignored. The default value is empty.
                                             The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                             Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                           items:
                                             type: string
                                           type: array
@@ -706,6 +708,7 @@ spec:
                                         pod labels will be ignored. The default value is empty.
                                         The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                         Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                       items:
                                         type: string
                                       type: array
@@ -720,6 +723,7 @@ spec:
                                         pod labels will be ignored. The default value is empty.
                                         The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                         Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                       items:
                                         type: string
                                       type: array
@@ -813,8 +817,8 @@ spec:
                                   most preferred is the one with the greatest sum of weights, i.e.
                                   for each node that meets all of the scheduling requirements (resource
                                   request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                  compute a sum by iterating through the elements of this field and subtracting
-                                  "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  compute a sum by iterating through the elements of this field and adding
+                                  "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                   node(s) with the highest sum are the most preferred.
                                 items:
                                   description: The weights of all of the matched WeightedPodAffinityTerm
@@ -885,6 +889,7 @@ spec:
                                             pod labels will be ignored. The default value is empty.
                                             The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                             Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                           items:
                                             type: string
                                           type: array
@@ -899,6 +904,7 @@ spec:
                                             pod labels will be ignored. The default value is empty.
                                             The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                             Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                            This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                           items:
                                             type: string
                                           type: array
@@ -1066,6 +1072,7 @@ spec:
                                         pod labels will be ignored. The default value is empty.
                                         The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                         Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                       items:
                                         type: string
                                       type: array
@@ -1080,6 +1087,7 @@ spec:
                                         pod labels will be ignored. The default value is empty.
                                         The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                         Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                        This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                       items:
                                         type: string
                                       type: array
@@ -1212,9 +1220,8 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: |-
-                                      Name of the environment variable.
-                                      May consist of any printable ASCII characters except '='.
+                                    description: Name of the environment variable.
+                                      Must be a C_IDENTIFIER.
                                     type: string
                                   value:
                                     description: |-
@@ -1273,43 +1280,6 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
-                                      fileKeyRef:
-                                        description: |-
-                                          FileKeyRef selects a key of the env file.
-                                          Requires the EnvFiles feature gate to be enabled.
-                                        properties:
-                                          key:
-                                            description: |-
-                                              The key within the env file. An invalid key will prevent the pod from starting.
-                                              The keys defined within a source may consist of any printable ASCII characters except '='.
-                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                            type: string
-                                          optional:
-                                            default: false
-                                            description: |-
-                                              Specify whether the file or its key must be defined. If the file or key
-                                              does not exist, then the env var is not published.
-                                              If optional is set to true and the specified key does not exist,
-                                              the environment variable will not be set in the Pod's containers.
-
-                                              If optional is set to false and the specified key does not exist,
-                                              an error will be returned during Pod creation.
-                                            type: boolean
-                                          path:
-                                            description: |-
-                                              The path within the volume from which to select the file.
-                                              Must be relative and may not contain the '..' path or start with '..'.
-                                            type: string
-                                          volumeName:
-                                            description: The name of the volume mount
-                                              containing the env file.
-                                            type: string
-                                        required:
-                                        - key
-                                        - path
-                                        - volumeName
-                                        type: object
-                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -1372,14 +1342,14 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source may consist of any printable ASCII characters except '='.
-                                When a key exists in multiple
+                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                will be reported as an event when the container is starting. When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
                               items:
                                 description: EnvFromSource represents the source of
-                                  a set of ConfigMaps or Secrets
+                                  a set of ConfigMaps
                                 properties:
                                   configMapRef:
                                     description: The ConfigMap to select from
@@ -1400,9 +1370,8 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: |-
-                                      Optional text to prepend to the name of each environment variable.
-                                      May consist of any printable ASCII characters except '='.
+                                    description: An optional identifier to prepend
+                                      to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -1668,12 +1637,6 @@ spec:
                                       - port
                                       type: object
                                   type: object
-                                stopSignal:
-                                  description: |-
-                                    StopSignal defines which signal will be sent to a container when it is being stopped.
-                                    If not specified, the default is defined by the container runtime in use.
-                                    StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                  type: string
                               type: object
                             livenessProbe:
                               description: |-
@@ -2081,7 +2044,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This field depends on the
+                                    This is an alpha field and requires enabling the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -2136,10 +2099,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This overrides the pod-level restart policy. When this field is not specified,
+                                This field may only be set for init containers, and the only allowed value is "Always".
+                                For non-init containers or when this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Additionally, setting the RestartPolicy as "Always" for the init container will
-                                have the following effect:
+                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -2151,59 +2114,6 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
-                            restartPolicyRules:
-                              description: |-
-                                Represents a list of rules to be checked to determine if the
-                                container should be restarted on exit. The rules are evaluated in
-                                order. Once a rule matches a container exit condition, the remaining
-                                rules are ignored. If no rule matches the container exit condition,
-                                the Container-level restart policy determines the whether the container
-                                is restarted or not. Constraints on the rules:
-                                - At most 20 rules are allowed.
-                                - Rules can have the same action.
-                                - Identical rules are not forbidden in validations.
-                                When rules are specified, container MUST set RestartPolicy explicitly
-                                even it if matches the Pod's RestartPolicy.
-                              items:
-                                description: ContainerRestartRule describes how a
-                                  container exit is handled.
-                                properties:
-                                  action:
-                                    description: |-
-                                      Specifies the action taken on a container exit if the requirements
-                                      are satisfied. The only possible value is "Restart" to restart the
-                                      container.
-                                    type: string
-                                  exitCodes:
-                                    description: Represents the exit codes to check
-                                      on container exits.
-                                    properties:
-                                      operator:
-                                        description: |-
-                                          Represents the relationship between the container exit code(s) and the
-                                          specified values. Possible values are:
-                                          - In: the requirement is satisfied if the container exit code is in the
-                                            set of specified values.
-                                          - NotIn: the requirement is satisfied if the container exit code is
-                                            not in the set of specified values.
-                                        type: string
-                                      values:
-                                        description: |-
-                                          Specifies the set of values to check for container exit codes.
-                                          At most 255 elements are allowed.
-                                        items:
-                                          format: int32
-                                          type: integer
-                                        type: array
-                                        x-kubernetes-list-type: set
-                                    required:
-                                    - operator
-                                    type: object
-                                required:
-                                - action
-                                type: object
-                              type: array
-                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -2824,9 +2734,8 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: |-
-                                      Name of the environment variable.
-                                      May consist of any printable ASCII characters except '='.
+                                    description: Name of the environment variable.
+                                      Must be a C_IDENTIFIER.
                                     type: string
                                   value:
                                     description: |-
@@ -2885,43 +2794,6 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
-                                      fileKeyRef:
-                                        description: |-
-                                          FileKeyRef selects a key of the env file.
-                                          Requires the EnvFiles feature gate to be enabled.
-                                        properties:
-                                          key:
-                                            description: |-
-                                              The key within the env file. An invalid key will prevent the pod from starting.
-                                              The keys defined within a source may consist of any printable ASCII characters except '='.
-                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                            type: string
-                                          optional:
-                                            default: false
-                                            description: |-
-                                              Specify whether the file or its key must be defined. If the file or key
-                                              does not exist, then the env var is not published.
-                                              If optional is set to true and the specified key does not exist,
-                                              the environment variable will not be set in the Pod's containers.
-
-                                              If optional is set to false and the specified key does not exist,
-                                              an error will be returned during Pod creation.
-                                            type: boolean
-                                          path:
-                                            description: |-
-                                              The path within the volume from which to select the file.
-                                              Must be relative and may not contain the '..' path or start with '..'.
-                                            type: string
-                                          volumeName:
-                                            description: The name of the volume mount
-                                              containing the env file.
-                                            type: string
-                                        required:
-                                        - key
-                                        - path
-                                        - volumeName
-                                        type: object
-                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -2984,14 +2856,14 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source may consist of any printable ASCII characters except '='.
-                                When a key exists in multiple
+                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                will be reported as an event when the container is starting. When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
                               items:
                                 description: EnvFromSource represents the source of
-                                  a set of ConfigMaps or Secrets
+                                  a set of ConfigMaps
                                 properties:
                                   configMapRef:
                                     description: The ConfigMap to select from
@@ -3012,9 +2884,8 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: |-
-                                      Optional text to prepend to the name of each environment variable.
-                                      May consist of any printable ASCII characters except '='.
+                                    description: An optional identifier to prepend
+                                      to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -3277,12 +3148,6 @@ spec:
                                       - port
                                       type: object
                                   type: object
-                                stopSignal:
-                                  description: |-
-                                    StopSignal defines which signal will be sent to a container when it is being stopped.
-                                    If not specified, the default is defined by the container runtime in use.
-                                    StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                  type: string
                               type: object
                             livenessProbe:
                               description: Probes are not allowed for ephemeral containers.
@@ -3673,7 +3538,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This field depends on the
+                                    This is an alpha field and requires enabling the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -3729,53 +3594,9 @@ spec:
                               description: |-
                                 Restart policy for the container to manage the restart behavior of each
                                 container within a pod.
-                                You cannot set this field on ephemeral containers.
-                              type: string
-                            restartPolicyRules:
-                              description: |-
-                                Represents a list of rules to be checked to determine if the
-                                container should be restarted on exit. You cannot set this field on
+                                This may only be set for init containers. You cannot set this field on
                                 ephemeral containers.
-                              items:
-                                description: ContainerRestartRule describes how a
-                                  container exit is handled.
-                                properties:
-                                  action:
-                                    description: |-
-                                      Specifies the action taken on a container exit if the requirements
-                                      are satisfied. The only possible value is "Restart" to restart the
-                                      container.
-                                    type: string
-                                  exitCodes:
-                                    description: Represents the exit codes to check
-                                      on container exits.
-                                    properties:
-                                      operator:
-                                        description: |-
-                                          Represents the relationship between the container exit code(s) and the
-                                          specified values. Possible values are:
-                                          - In: the requirement is satisfied if the container exit code is in the
-                                            set of specified values.
-                                          - NotIn: the requirement is satisfied if the container exit code is
-                                            not in the set of specified values.
-                                        type: string
-                                      values:
-                                        description: |-
-                                          Specifies the set of values to check for container exit codes.
-                                          At most 255 elements are allowed.
-                                        items:
-                                          format: int32
-                                          type: integer
-                                        type: array
-                                        x-kubernetes-list-type: set
-                                    required:
-                                    - operator
-                                    type: object
-                                required:
-                                - action
-                                type: object
-                              type: array
-                              x-kubernetes-list-type: atomic
+                              type: string
                             securityContext:
                               description: |-
                                 Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -4314,9 +4135,7 @@ spec:
                       hostNetwork:
                         description: |-
                           Host networking requested for this pod. Use the host's network namespace.
-                          When using HostNetwork you should specify ports so the scheduler is aware.
-                          When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
-                          and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
+                          If this option is set, the ports that will be used must be specified.
                           Default to false.
                         type: boolean
                       hostPID:
@@ -4341,19 +4160,6 @@ spec:
                           Specifies the hostname of the Pod
                           If not specified, the pod's hostname will be set to a system-defined value.
                         type: string
-                      hostnameOverride:
-                        description: |-
-                          HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
-                          This field only specifies the pod's hostname and does not affect its DNS records.
-                          When this field is set to a non-empty string:
-                          - It takes precedence over the values set in `hostname` and `subdomain`.
-                          - The Pod's hostname will be set to this value.
-                          - `setHostnameAsFQDN` must be nil or set to false.
-                          - `hostNetwork` must be set to false.
-
-                          This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
-                          Requires the HostnameOverride feature gate to be enabled.
-                        type: string
                       imagePullSecrets:
                         description: |-
                           ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -4389,7 +4195,7 @@ spec:
                           Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.
                           The resourceRequirements of an init container are taken into account during scheduling
                           by finding the highest request/limit for each resource type, and then using the max of
-                          that value or the sum of the normal containers. Limits are applied to init containers
+                          of that value or the sum of the normal containers. Limits are applied to init containers
                           in a similar fashion.
                           Init containers cannot currently be added or removed.
                           Cannot be updated.
@@ -4435,9 +4241,8 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: |-
-                                      Name of the environment variable.
-                                      May consist of any printable ASCII characters except '='.
+                                    description: Name of the environment variable.
+                                      Must be a C_IDENTIFIER.
                                     type: string
                                   value:
                                     description: |-
@@ -4496,43 +4301,6 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
-                                      fileKeyRef:
-                                        description: |-
-                                          FileKeyRef selects a key of the env file.
-                                          Requires the EnvFiles feature gate to be enabled.
-                                        properties:
-                                          key:
-                                            description: |-
-                                              The key within the env file. An invalid key will prevent the pod from starting.
-                                              The keys defined within a source may consist of any printable ASCII characters except '='.
-                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                            type: string
-                                          optional:
-                                            default: false
-                                            description: |-
-                                              Specify whether the file or its key must be defined. If the file or key
-                                              does not exist, then the env var is not published.
-                                              If optional is set to true and the specified key does not exist,
-                                              the environment variable will not be set in the Pod's containers.
-
-                                              If optional is set to false and the specified key does not exist,
-                                              an error will be returned during Pod creation.
-                                            type: boolean
-                                          path:
-                                            description: |-
-                                              The path within the volume from which to select the file.
-                                              Must be relative and may not contain the '..' path or start with '..'.
-                                            type: string
-                                          volumeName:
-                                            description: The name of the volume mount
-                                              containing the env file.
-                                            type: string
-                                        required:
-                                        - key
-                                        - path
-                                        - volumeName
-                                        type: object
-                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -4595,14 +4363,14 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source may consist of any printable ASCII characters except '='.
-                                When a key exists in multiple
+                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                will be reported as an event when the container is starting. When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
                               items:
                                 description: EnvFromSource represents the source of
-                                  a set of ConfigMaps or Secrets
+                                  a set of ConfigMaps
                                 properties:
                                   configMapRef:
                                     description: The ConfigMap to select from
@@ -4623,9 +4391,8 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: |-
-                                      Optional text to prepend to the name of each environment variable.
-                                      May consist of any printable ASCII characters except '='.
+                                    description: An optional identifier to prepend
+                                      to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -4891,12 +4658,6 @@ spec:
                                       - port
                                       type: object
                                   type: object
-                                stopSignal:
-                                  description: |-
-                                    StopSignal defines which signal will be sent to a container when it is being stopped.
-                                    If not specified, the default is defined by the container runtime in use.
-                                    StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                  type: string
                               type: object
                             livenessProbe:
                               description: |-
@@ -5304,7 +5065,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This field depends on the
+                                    This is an alpha field and requires enabling the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -5359,10 +5120,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This overrides the pod-level restart policy. When this field is not specified,
+                                This field may only be set for init containers, and the only allowed value is "Always".
+                                For non-init containers or when this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Additionally, setting the RestartPolicy as "Always" for the init container will
-                                have the following effect:
+                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -5374,59 +5135,6 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
-                            restartPolicyRules:
-                              description: |-
-                                Represents a list of rules to be checked to determine if the
-                                container should be restarted on exit. The rules are evaluated in
-                                order. Once a rule matches a container exit condition, the remaining
-                                rules are ignored. If no rule matches the container exit condition,
-                                the Container-level restart policy determines the whether the container
-                                is restarted or not. Constraints on the rules:
-                                - At most 20 rules are allowed.
-                                - Rules can have the same action.
-                                - Identical rules are not forbidden in validations.
-                                When rules are specified, container MUST set RestartPolicy explicitly
-                                even it if matches the Pod's RestartPolicy.
-                              items:
-                                description: ContainerRestartRule describes how a
-                                  container exit is handled.
-                                properties:
-                                  action:
-                                    description: |-
-                                      Specifies the action taken on a container exit if the requirements
-                                      are satisfied. The only possible value is "Restart" to restart the
-                                      container.
-                                    type: string
-                                  exitCodes:
-                                    description: Represents the exit codes to check
-                                      on container exits.
-                                    properties:
-                                      operator:
-                                        description: |-
-                                          Represents the relationship between the container exit code(s) and the
-                                          specified values. Possible values are:
-                                          - In: the requirement is satisfied if the container exit code is in the
-                                            set of specified values.
-                                          - NotIn: the requirement is satisfied if the container exit code is
-                                            not in the set of specified values.
-                                        type: string
-                                      values:
-                                        description: |-
-                                          Specifies the set of values to check for container exit codes.
-                                          At most 255 elements are allowed.
-                                        items:
-                                          format: int32
-                                          type: integer
-                                        type: array
-                                        x-kubernetes-list-type: set
-                                    required:
-                                    - operator
-                                    type: object
-                                required:
-                                - action
-                                type: object
-                              type: array
-                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -5960,7 +5668,6 @@ spec:
                           - spec.hostPID
                           - spec.hostIPC
                           - spec.hostUsers
-                          - spec.resources
                           - spec.securityContext.appArmorProfile
                           - spec.securityContext.seLinuxOptions
                           - spec.securityContext.seccompProfile
@@ -6114,7 +5821,7 @@ spec:
                         description: |-
                           Resources is the total amount of CPU and Memory resources required by all
                           containers in the pod. It supports specifying Requests and Limits for
-                          "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
+                          "cpu" and "memory" resource names only. ResourceClaims are not supported.
 
                           This field enables fine-grained control over resource allocation for the
                           entire pod, allowing resource sharing among containers in a pod.
@@ -6127,7 +5834,7 @@ spec:
                               Claims lists the names of resources, defined in spec.resourceClaims,
                               that are used by this container.
 
-                              This field depends on the
+                              This is an alpha field and requires enabling the
                               DynamicResourceAllocation feature gate.
 
                               This field is immutable. It can only be set for containers.
@@ -6665,6 +6372,7 @@ spec:
                                 - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
 
                                 If this value is nil, the behavior is equivalent to the Honor policy.
+                                This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                               type: string
                             nodeTaintsPolicy:
                               description: |-
@@ -6675,6 +6383,7 @@ spec:
                                 - Ignore: node taints are ignored. All nodes are included.
 
                                 If this value is nil, the behavior is equivalent to the Ignore policy.
+                                This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                               type: string
                             topologyKey:
                               description: |-
@@ -7421,13 +7130,15 @@ spec:
                                             volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                             If specified, the CSI driver will create or update the volume with the attributes defined
                                             in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                            it can be changed after the claim is created. An empty string or nil value indicates that no
-                                            VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
-                                            this field can be reset to its previous value (including nil) to cancel the modification.
+                                            it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
+                                            will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
+                                            If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
+                                            will be set by the persistentvolume controller if it exists.
                                             If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                             set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                             exists.
                                             More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
+                                            (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                           type: string
                                         volumeMode:
                                           description: |-
@@ -7609,10 +7320,12 @@ spec:
                               description: |-
                                 glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                 Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
+                                More info: https://examples.k8s.io/volumes/glusterfs/README.md
                               properties:
                                 endpoints:
-                                  description: endpoints is the endpoint name that
-                                    details Glusterfs topology.
+                                  description: |-
+                                    endpoints is the endpoint name that details Glusterfs topology.
+                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
                                   type: string
                                 path:
                                   description: |-
@@ -7666,7 +7379,7 @@ spec:
                                 The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
                                 The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
                                 The volume will be mounted read-only (ro) and non-executable files (noexec).
-                                Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
+                                Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
                                 The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
                               properties:
                                 pullPolicy:
@@ -7691,7 +7404,7 @@ spec:
                               description: |-
                                 iscsi represents an ISCSI Disk resource that is attached to a
                                 kubelet's host machine and then exposed to the pod.
-                                More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
+                                More info: https://examples.k8s.io/volumes/iscsi/README.md
                               properties:
                                 chapAuthDiscovery:
                                   description: chapAuthDiscovery defines whether support
@@ -8117,111 +7830,6 @@ spec:
                                             type: array
                                             x-kubernetes-list-type: atomic
                                         type: object
-                                      podCertificate:
-                                        description: |-
-                                          Projects an auto-rotating credential bundle (private key and certificate
-                                          chain) that the pod can use either as a TLS client or server.
-
-                                          Kubelet generates a private key and uses it to send a
-                                          PodCertificateRequest to the named signer.  Once the signer approves the
-                                          request and issues a certificate chain, Kubelet writes the key and
-                                          certificate chain to the pod filesystem.  The pod does not start until
-                                          certificates have been issued for each podCertificate projected volume
-                                          source in its spec.
-
-                                          Kubelet will begin trying to rotate the certificate at the time indicated
-                                          by the signer using the PodCertificateRequest.Status.BeginRefreshAt
-                                          timestamp.
-
-                                          Kubelet can write a single file, indicated by the credentialBundlePath
-                                          field, or separate files, indicated by the keyPath and
-                                          certificateChainPath fields.
-
-                                          The credential bundle is a single file in PEM format.  The first PEM
-                                          entry is the private key (in PKCS#8 format), and the remaining PEM
-                                          entries are the certificate chain issued by the signer (typically,
-                                          signers will return their certificate chain in leaf-to-root order).
-
-                                          Prefer using the credential bundle format, since your application code
-                                          can read it atomically.  If you use keyPath and certificateChainPath,
-                                          your application must make two separate file reads. If these coincide
-                                          with a certificate rotation, it is possible that the private key and leaf
-                                          certificate you read may not correspond to each other.  Your application
-                                          will need to check for this condition, and re-read until they are
-                                          consistent.
-
-                                          The named signer controls chooses the format of the certificate it
-                                          issues; consult the signer implementation's documentation to learn how to
-                                          use the certificates it issues.
-                                        properties:
-                                          certificateChainPath:
-                                            description: |-
-                                              Write the certificate chain at this path in the projected volume.
-
-                                              Most applications should use credentialBundlePath.  When using keyPath
-                                              and certificateChainPath, your application needs to check that the key
-                                              and leaf certificate are consistent, because it is possible to read the
-                                              files mid-rotation.
-                                            type: string
-                                          credentialBundlePath:
-                                            description: |-
-                                              Write the credential bundle at this path in the projected volume.
-
-                                              The credential bundle is a single file that contains multiple PEM blocks.
-                                              The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
-                                              key.
-
-                                              The remaining blocks are CERTIFICATE blocks, containing the issued
-                                              certificate chain from the signer (leaf and any intermediates).
-
-                                              Using credentialBundlePath lets your Pod's application code make a single
-                                              atomic read that retrieves a consistent key and certificate chain.  If you
-                                              project them to separate files, your application code will need to
-                                              additionally check that the leaf certificate was issued to the key.
-                                            type: string
-                                          keyPath:
-                                            description: |-
-                                              Write the key at this path in the projected volume.
-
-                                              Most applications should use credentialBundlePath.  When using keyPath
-                                              and certificateChainPath, your application needs to check that the key
-                                              and leaf certificate are consistent, because it is possible to read the
-                                              files mid-rotation.
-                                            type: string
-                                          keyType:
-                                            description: |-
-                                              The type of keypair Kubelet will generate for the pod.
-
-                                              Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
-                                              "ECDSAP521", and "ED25519".
-                                            type: string
-                                          maxExpirationSeconds:
-                                            description: |-
-                                              maxExpirationSeconds is the maximum lifetime permitted for the
-                                              certificate.
-
-                                              Kubelet copies this value verbatim into the PodCertificateRequests it
-                                              generates for this projection.
-
-                                              If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
-                                              will reject values shorter than 3600 (1 hour).  The maximum allowable
-                                              value is 7862400 (91 days).
-
-                                              The signer implementation is then free to issue a certificate with any
-                                              lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
-                                              seconds (1 hour).  This constraint is enforced by kube-apiserver.
-                                              `kubernetes.io` signers will never issue certificates with a lifetime
-                                              longer than 24 hours.
-                                            format: int32
-                                            type: integer
-                                          signerName:
-                                            description: Kubelet's generated CSRs
-                                              will be addressed to this signer.
-                                            type: string
-                                        required:
-                                        - keyType
-                                        - signerName
-                                        type: object
                                       secret:
                                         description: secret information about the
                                           secret data to project
@@ -8356,6 +7964,7 @@ spec:
                               description: |-
                                 rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                 Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
+                                More info: https://examples.k8s.io/volumes/rbd/README.md
                               properties:
                                 fsType:
                                   description: |-

config/crd/bases/actions.github.com_ephemeralrunners.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: ephemeralrunners.actions.github.com
 spec:
   group: actions.github.com
@@ -430,6 +430,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                           Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -444,6 +445,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                           Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -604,6 +606,7 @@ spec:
                                       pod labels will be ignored. The default value is empty.
                                       The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                       Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                     items:
                                       type: string
                                     type: array
@@ -618,6 +621,7 @@ spec:
                                       pod labels will be ignored. The default value is empty.
                                       The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                       Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                     items:
                                       type: string
                                     type: array
@@ -706,8 +710,8 @@ spec:
                                 most preferred is the one with the greatest sum of weights, i.e.
                                 for each node that meets all of the scheduling requirements (resource
                                 request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                compute a sum by iterating through the elements of this field and subtracting
-                                "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                compute a sum by iterating through the elements of this field and adding
+                                "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                 node(s) with the highest sum are the most preferred.
                               items:
                                 description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
@@ -771,6 +775,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                           Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -785,6 +790,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                           Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -945,6 +951,7 @@ spec:
                                       pod labels will be ignored. The default value is empty.
                                       The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                       Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                     items:
                                       type: string
                                     type: array
@@ -959,6 +966,7 @@ spec:
                                       pod labels will be ignored. The default value is empty.
                                       The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                       Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                      This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                     items:
                                       type: string
                                     type: array
@@ -1085,9 +1093,7 @@ spec:
                               description: EnvVar represents an environment variable present in a Container.
                               properties:
                                 name:
-                                  description: |-
-                                    Name of the environment variable.
-                                    May consist of any printable ASCII characters except '='.
+                                  description: Name of the environment variable. Must be a C_IDENTIFIER.
                                   type: string
                                 value:
                                   description: |-
@@ -1141,42 +1147,6 @@ spec:
                                         - fieldPath
                                       type: object
                                       x-kubernetes-map-type: atomic
-                                    fileKeyRef:
-                                      description: |-
-                                        FileKeyRef selects a key of the env file.
-                                        Requires the EnvFiles feature gate to be enabled.
-                                      properties:
-                                        key:
-                                          description: |-
-                                            The key within the env file. An invalid key will prevent the pod from starting.
-                                            The keys defined within a source may consist of any printable ASCII characters except '='.
-                                            During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                          type: string
-                                        optional:
-                                          default: false
-                                          description: |-
-                                            Specify whether the file or its key must be defined. If the file or key
-                                            does not exist, then the env var is not published.
-                                            If optional is set to true and the specified key does not exist,
-                                            the environment variable will not be set in the Pod's containers.
-
-                                            If optional is set to false and the specified key does not exist,
-                                            an error will be returned during Pod creation.
-                                          type: boolean
-                                        path:
-                                          description: |-
-                                            The path within the volume from which to select the file.
-                                            Must be relative and may not contain the '..' path or start with '..'.
-                                          type: string
-                                        volumeName:
-                                          description: The name of the volume mount containing the env file.
-                                          type: string
-                                      required:
-                                        - key
-                                        - path
-                                        - volumeName
-                                      type: object
-                                      x-kubernetes-map-type: atomic
                                     resourceFieldRef:
                                       description: |-
                                         Selects a resource of the container: only resources limits and requests
@@ -1232,13 +1202,13 @@ spec:
                           envFrom:
                             description: |-
                               List of sources to populate environment variables in the container.
-                              The keys defined within a source may consist of any printable ASCII characters except '='.
-                              When a key exists in multiple
+                              The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                              will be reported as an event when the container is starting. When a key exists in multiple
                               sources, the value associated with the last source will take precedence.
                               Values defined by an Env with a duplicate key will take precedence.
                               Cannot be updated.
                             items:
-                              description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                              description: EnvFromSource represents the source of a set of ConfigMaps
                               properties:
                                 configMapRef:
                                   description: The ConfigMap to select from
@@ -1258,9 +1228,7 @@ spec:
                                   type: object
                                   x-kubernetes-map-type: atomic
                                 prefix:
-                                  description: |-
-                                    Optional text to prepend to the name of each environment variable.
-                                    May consist of any printable ASCII characters except '='.
+                                  description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                   type: string
                                 secretRef:
                                   description: The Secret to select from
@@ -1509,12 +1477,6 @@ spec:
                                       - port
                                     type: object
                                 type: object
-                              stopSignal:
-                                description: |-
-                                  StopSignal defines which signal will be sent to a container when it is being stopped.
-                                  If not specified, the default is defined by the container runtime in use.
-                                  StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                type: string
                             type: object
                           livenessProbe:
                             description: |-
@@ -1905,7 +1867,7 @@ spec:
                                   Claims lists the names of resources, defined in spec.resourceClaims,
                                   that are used by this container.
 
-                                  This field depends on the
+                                  This is an alpha field and requires enabling the
                                   DynamicResourceAllocation feature gate.
 
                                   This field is immutable. It can only be set for containers.
@@ -1956,10 +1918,10 @@ spec:
                           restartPolicy:
                             description: |-
                               RestartPolicy defines the restart behavior of individual containers in a pod.
-                              This overrides the pod-level restart policy. When this field is not specified,
+                              This field may only be set for init containers, and the only allowed value is "Always".
+                              For non-init containers or when this field is not specified,
                               the restart behavior is defined by the Pod's restart policy and the container type.
-                              Additionally, setting the RestartPolicy as "Always" for the init container will
-                              have the following effect:
+                              Setting the RestartPolicy as "Always" for the init container will have the following effect:
                               this init container will be continually restarted on
                               exit until all regular containers have terminated. Once all regular
                               containers have completed, all init containers with restartPolicy "Always"
@@ -1971,57 +1933,6 @@ spec:
                               init container is started, or after any startupProbe has successfully
                               completed.
                             type: string
-                          restartPolicyRules:
-                            description: |-
-                              Represents a list of rules to be checked to determine if the
-                              container should be restarted on exit. The rules are evaluated in
-                              order. Once a rule matches a container exit condition, the remaining
-                              rules are ignored. If no rule matches the container exit condition,
-                              the Container-level restart policy determines the whether the container
-                              is restarted or not. Constraints on the rules:
-                              - At most 20 rules are allowed.
-                              - Rules can have the same action.
-                              - Identical rules are not forbidden in validations.
-                              When rules are specified, container MUST set RestartPolicy explicitly
-                              even it if matches the Pod's RestartPolicy.
-                            items:
-                              description: ContainerRestartRule describes how a container exit is handled.
-                              properties:
-                                action:
-                                  description: |-
-                                    Specifies the action taken on a container exit if the requirements
-                                    are satisfied. The only possible value is "Restart" to restart the
-                                    container.
-                                  type: string
-                                exitCodes:
-                                  description: Represents the exit codes to check on container exits.
-                                  properties:
-                                    operator:
-                                      description: |-
-                                        Represents the relationship between the container exit code(s) and the
-                                        specified values. Possible values are:
-                                        - In: the requirement is satisfied if the container exit code is in the
-                                          set of specified values.
-                                        - NotIn: the requirement is satisfied if the container exit code is
-                                          not in the set of specified values.
-                                      type: string
-                                    values:
-                                      description: |-
-                                        Specifies the set of values to check for container exit codes.
-                                        At most 255 elements are allowed.
-                                      items:
-                                        format: int32
-                                        type: integer
-                                      type: array
-                                      x-kubernetes-list-type: set
-                                  required:
-                                    - operator
-                                  type: object
-                              required:
-                                - action
-                              type: object
-                            type: array
-                            x-kubernetes-list-type: atomic
                           securityContext:
                             description: |-
                               SecurityContext defines the security options the container should be run with.
@@ -2619,9 +2530,7 @@ spec:
                               description: EnvVar represents an environment variable present in a Container.
                               properties:
                                 name:
-                                  description: |-
-                                    Name of the environment variable.
-                                    May consist of any printable ASCII characters except '='.
+                                  description: Name of the environment variable. Must be a C_IDENTIFIER.
                                   type: string
                                 value:
                                   description: |-
@@ -2675,42 +2584,6 @@ spec:
                                         - fieldPath
                                       type: object
                                       x-kubernetes-map-type: atomic
-                                    fileKeyRef:
-                                      description: |-
-                                        FileKeyRef selects a key of the env file.
-                                        Requires the EnvFiles feature gate to be enabled.
-                                      properties:
-                                        key:
-                                          description: |-
-                                            The key within the env file. An invalid key will prevent the pod from starting.
-                                            The keys defined within a source may consist of any printable ASCII characters except '='.
-                                            During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                          type: string
-                                        optional:
-                                          default: false
-                                          description: |-
-                                            Specify whether the file or its key must be defined. If the file or key
-                                            does not exist, then the env var is not published.
-                                            If optional is set to true and the specified key does not exist,
-                                            the environment variable will not be set in the Pod's containers.
-
-                                            If optional is set to false and the specified key does not exist,
-                                            an error will be returned during Pod creation.
-                                          type: boolean
-                                        path:
-                                          description: |-
-                                            The path within the volume from which to select the file.
-                                            Must be relative and may not contain the '..' path or start with '..'.
-                                          type: string
-                                        volumeName:
-                                          description: The name of the volume mount containing the env file.
-                                          type: string
-                                      required:
-                                        - key
-                                        - path
-                                        - volumeName
-                                      type: object
-                                      x-kubernetes-map-type: atomic
                                     resourceFieldRef:
                                       description: |-
                                         Selects a resource of the container: only resources limits and requests
@@ -2766,13 +2639,13 @@ spec:
                           envFrom:
                             description: |-
                               List of sources to populate environment variables in the container.
-                              The keys defined within a source may consist of any printable ASCII characters except '='.
-                              When a key exists in multiple
+                              The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                              will be reported as an event when the container is starting. When a key exists in multiple
                               sources, the value associated with the last source will take precedence.
                               Values defined by an Env with a duplicate key will take precedence.
                               Cannot be updated.
                             items:
-                              description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                              description: EnvFromSource represents the source of a set of ConfigMaps
                               properties:
                                 configMapRef:
                                   description: The ConfigMap to select from
@@ -2792,9 +2665,7 @@ spec:
                                   type: object
                                   x-kubernetes-map-type: atomic
                                 prefix:
-                                  description: |-
-                                    Optional text to prepend to the name of each environment variable.
-                                    May consist of any printable ASCII characters except '='.
+                                  description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                   type: string
                                 secretRef:
                                   description: The Secret to select from
@@ -3039,12 +2910,6 @@ spec:
                                       - port
                                     type: object
                                 type: object
-                              stopSignal:
-                                description: |-
-                                  StopSignal defines which signal will be sent to a container when it is being stopped.
-                                  If not specified, the default is defined by the container runtime in use.
-                                  StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                type: string
                             type: object
                           livenessProbe:
                             description: Probes are not allowed for ephemeral containers.
@@ -3418,7 +3283,7 @@ spec:
                                   Claims lists the names of resources, defined in spec.resourceClaims,
                                   that are used by this container.
 
-                                  This field depends on the
+                                  This is an alpha field and requires enabling the
                                   DynamicResourceAllocation feature gate.
 
                                   This field is immutable. It can only be set for containers.
@@ -3470,51 +3335,9 @@ spec:
                             description: |-
                               Restart policy for the container to manage the restart behavior of each
                               container within a pod.
-                              You cannot set this field on ephemeral containers.
-                            type: string
-                          restartPolicyRules:
-                            description: |-
-                              Represents a list of rules to be checked to determine if the
-                              container should be restarted on exit. You cannot set this field on
+                              This may only be set for init containers. You cannot set this field on
                               ephemeral containers.
-                            items:
-                              description: ContainerRestartRule describes how a container exit is handled.
-                              properties:
-                                action:
-                                  description: |-
-                                    Specifies the action taken on a container exit if the requirements
-                                    are satisfied. The only possible value is "Restart" to restart the
-                                    container.
-                                  type: string
-                                exitCodes:
-                                  description: Represents the exit codes to check on container exits.
-                                  properties:
-                                    operator:
-                                      description: |-
-                                        Represents the relationship between the container exit code(s) and the
-                                        specified values. Possible values are:
-                                        - In: the requirement is satisfied if the container exit code is in the
-                                          set of specified values.
-                                        - NotIn: the requirement is satisfied if the container exit code is
-                                          not in the set of specified values.
-                                      type: string
-                                    values:
-                                      description: |-
-                                        Specifies the set of values to check for container exit codes.
-                                        At most 255 elements are allowed.
-                                      items:
-                                        format: int32
-                                        type: integer
-                                      type: array
-                                      x-kubernetes-list-type: set
-                                  required:
-                                    - operator
-                                  type: object
-                              required:
-                                - action
-                              type: object
-                            type: array
-                            x-kubernetes-list-type: atomic
+                            type: string
                           securityContext:
                             description: |-
                               Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -4033,9 +3856,7 @@ spec:
                     hostNetwork:
                       description: |-
                         Host networking requested for this pod. Use the host's network namespace.
-                        When using HostNetwork you should specify ports so the scheduler is aware.
-                        When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
-                        and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
+                        If this option is set, the ports that will be used must be specified.
                         Default to false.
                       type: boolean
                     hostPID:
@@ -4060,19 +3881,6 @@ spec:
                         Specifies the hostname of the Pod
                         If not specified, the pod's hostname will be set to a system-defined value.
                       type: string
-                    hostnameOverride:
-                      description: |-
-                        HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
-                        This field only specifies the pod's hostname and does not affect its DNS records.
-                        When this field is set to a non-empty string:
-                        - It takes precedence over the values set in `hostname` and `subdomain`.
-                        - The Pod's hostname will be set to this value.
-                        - `setHostnameAsFQDN` must be nil or set to false.
-                        - `hostNetwork` must be set to false.
-
-                        This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
-                        Requires the HostnameOverride feature gate to be enabled.
-                      type: string
                     imagePullSecrets:
                       description: |-
                         ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -4108,7 +3916,7 @@ spec:
                         Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.
                         The resourceRequirements of an init container are taken into account during scheduling
                         by finding the highest request/limit for each resource type, and then using the max of
-                        that value or the sum of the normal containers. Limits are applied to init containers
+                        of that value or the sum of the normal containers. Limits are applied to init containers
                         in a similar fashion.
                         Init containers cannot currently be added or removed.
                         Cannot be updated.
@@ -4152,9 +3960,7 @@ spec:
                               description: EnvVar represents an environment variable present in a Container.
                               properties:
                                 name:
-                                  description: |-
-                                    Name of the environment variable.
-                                    May consist of any printable ASCII characters except '='.
+                                  description: Name of the environment variable. Must be a C_IDENTIFIER.
                                   type: string
                                 value:
                                   description: |-
@@ -4208,42 +4014,6 @@ spec:
                                         - fieldPath
                                       type: object
                                       x-kubernetes-map-type: atomic
-                                    fileKeyRef:
-                                      description: |-
-                                        FileKeyRef selects a key of the env file.
-                                        Requires the EnvFiles feature gate to be enabled.
-                                      properties:
-                                        key:
-                                          description: |-
-                                            The key within the env file. An invalid key will prevent the pod from starting.
-                                            The keys defined within a source may consist of any printable ASCII characters except '='.
-                                            During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                          type: string
-                                        optional:
-                                          default: false
-                                          description: |-
-                                            Specify whether the file or its key must be defined. If the file or key
-                                            does not exist, then the env var is not published.
-                                            If optional is set to true and the specified key does not exist,
-                                            the environment variable will not be set in the Pod's containers.
-
-                                            If optional is set to false and the specified key does not exist,
-                                            an error will be returned during Pod creation.
-                                          type: boolean
-                                        path:
-                                          description: |-
-                                            The path within the volume from which to select the file.
-                                            Must be relative and may not contain the '..' path or start with '..'.
-                                          type: string
-                                        volumeName:
-                                          description: The name of the volume mount containing the env file.
-                                          type: string
-                                      required:
-                                        - key
-                                        - path
-                                        - volumeName
-                                      type: object
-                                      x-kubernetes-map-type: atomic
                                     resourceFieldRef:
                                       description: |-
                                         Selects a resource of the container: only resources limits and requests
@@ -4299,13 +4069,13 @@ spec:
                           envFrom:
                             description: |-
                               List of sources to populate environment variables in the container.
-                              The keys defined within a source may consist of any printable ASCII characters except '='.
-                              When a key exists in multiple
+                              The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                              will be reported as an event when the container is starting. When a key exists in multiple
                               sources, the value associated with the last source will take precedence.
                               Values defined by an Env with a duplicate key will take precedence.
                               Cannot be updated.
                             items:
-                              description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                              description: EnvFromSource represents the source of a set of ConfigMaps
                               properties:
                                 configMapRef:
                                   description: The ConfigMap to select from
@@ -4325,9 +4095,7 @@ spec:
                                   type: object
                                   x-kubernetes-map-type: atomic
                                 prefix:
-                                  description: |-
-                                    Optional text to prepend to the name of each environment variable.
-                                    May consist of any printable ASCII characters except '='.
+                                  description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                   type: string
                                 secretRef:
                                   description: The Secret to select from
@@ -4576,12 +4344,6 @@ spec:
                                       - port
                                     type: object
                                 type: object
-                              stopSignal:
-                                description: |-
-                                  StopSignal defines which signal will be sent to a container when it is being stopped.
-                                  If not specified, the default is defined by the container runtime in use.
-                                  StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                type: string
                             type: object
                           livenessProbe:
                             description: |-
@@ -4972,7 +4734,7 @@ spec:
                                   Claims lists the names of resources, defined in spec.resourceClaims,
                                   that are used by this container.
 
-                                  This field depends on the
+                                  This is an alpha field and requires enabling the
                                   DynamicResourceAllocation feature gate.
 
                                   This field is immutable. It can only be set for containers.
@@ -5023,10 +4785,10 @@ spec:
                           restartPolicy:
                             description: |-
                               RestartPolicy defines the restart behavior of individual containers in a pod.
-                              This overrides the pod-level restart policy. When this field is not specified,
+                              This field may only be set for init containers, and the only allowed value is "Always".
+                              For non-init containers or when this field is not specified,
                               the restart behavior is defined by the Pod's restart policy and the container type.
-                              Additionally, setting the RestartPolicy as "Always" for the init container will
-                              have the following effect:
+                              Setting the RestartPolicy as "Always" for the init container will have the following effect:
                               this init container will be continually restarted on
                               exit until all regular containers have terminated. Once all regular
                               containers have completed, all init containers with restartPolicy "Always"
@@ -5038,57 +4800,6 @@ spec:
                               init container is started, or after any startupProbe has successfully
                               completed.
                             type: string
-                          restartPolicyRules:
-                            description: |-
-                              Represents a list of rules to be checked to determine if the
-                              container should be restarted on exit. The rules are evaluated in
-                              order. Once a rule matches a container exit condition, the remaining
-                              rules are ignored. If no rule matches the container exit condition,
-                              the Container-level restart policy determines the whether the container
-                              is restarted or not. Constraints on the rules:
-                              - At most 20 rules are allowed.
-                              - Rules can have the same action.
-                              - Identical rules are not forbidden in validations.
-                              When rules are specified, container MUST set RestartPolicy explicitly
-                              even it if matches the Pod's RestartPolicy.
-                            items:
-                              description: ContainerRestartRule describes how a container exit is handled.
-                              properties:
-                                action:
-                                  description: |-
-                                    Specifies the action taken on a container exit if the requirements
-                                    are satisfied. The only possible value is "Restart" to restart the
-                                    container.
-                                  type: string
-                                exitCodes:
-                                  description: Represents the exit codes to check on container exits.
-                                  properties:
-                                    operator:
-                                      description: |-
-                                        Represents the relationship between the container exit code(s) and the
-                                        specified values. Possible values are:
-                                        - In: the requirement is satisfied if the container exit code is in the
-                                          set of specified values.
-                                        - NotIn: the requirement is satisfied if the container exit code is
-                                          not in the set of specified values.
-                                      type: string
-                                    values:
-                                      description: |-
-                                        Specifies the set of values to check for container exit codes.
-                                        At most 255 elements are allowed.
-                                      items:
-                                        format: int32
-                                        type: integer
-                                      type: array
-                                      x-kubernetes-list-type: set
-                                  required:
-                                    - operator
-                                  type: object
-                              required:
-                                - action
-                              type: object
-                            type: array
-                            x-kubernetes-list-type: atomic
                           securityContext:
                             description: |-
                               SecurityContext defines the security options the container should be run with.
@@ -5602,7 +5313,6 @@ spec:
                         - spec.hostPID
                         - spec.hostIPC
                         - spec.hostUsers
-                        - spec.resources
                         - spec.securityContext.appArmorProfile
                         - spec.securityContext.seLinuxOptions
                         - spec.securityContext.seccompProfile
@@ -5754,7 +5464,7 @@ spec:
                       description: |-
                         Resources is the total amount of CPU and Memory resources required by all
                         containers in the pod. It supports specifying Requests and Limits for
-                        "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
+                        "cpu" and "memory" resource names only. ResourceClaims are not supported.
 
                         This field enables fine-grained control over resource allocation for the
                         entire pod, allowing resource sharing among containers in a pod.
@@ -5767,7 +5477,7 @@ spec:
                             Claims lists the names of resources, defined in spec.resourceClaims,
                             that are used by this container.
 
-                            This field depends on the
+                            This is an alpha field and requires enabling the
                             DynamicResourceAllocation feature gate.
 
                             This field is immutable. It can only be set for containers.
@@ -6295,6 +6005,7 @@ spec:
                               - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
 
                               If this value is nil, the behavior is equivalent to the Honor policy.
+                              This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                             type: string
                           nodeTaintsPolicy:
                             description: |-
@@ -6305,6 +6016,7 @@ spec:
                               - Ignore: node taints are ignored. All nodes are included.
 
                               If this value is nil, the behavior is equivalent to the Ignore policy.
+                              This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                             type: string
                           topologyKey:
                             description: |-
@@ -7010,13 +6722,15 @@ spec:
                                           volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                           If specified, the CSI driver will create or update the volume with the attributes defined
                                           in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                          it can be changed after the claim is created. An empty string or nil value indicates that no
-                                          VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
-                                          this field can be reset to its previous value (including nil) to cancel the modification.
+                                          it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
+                                          will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
+                                          If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
+                                          will be set by the persistentvolume controller if it exists.
                                           If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                           set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                           exists.
                                           More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
+                                          (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                         type: string
                                       volumeMode:
                                         description: |-
@@ -7190,9 +6904,12 @@ spec:
                             description: |-
                               glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                               Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
+                              More info: https://examples.k8s.io/volumes/glusterfs/README.md
                             properties:
                               endpoints:
-                                description: endpoints is the endpoint name that details Glusterfs topology.
+                                description: |-
+                                  endpoints is the endpoint name that details Glusterfs topology.
+                                  More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
                                 type: string
                               path:
                                 description: |-
@@ -7246,7 +6963,7 @@ spec:
                               The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
                               The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
                               The volume will be mounted read-only (ro) and non-executable files (noexec).
-                              Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
+                              Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
                               The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
                             properties:
                               pullPolicy:
@@ -7271,7 +6988,7 @@ spec:
                             description: |-
                               iscsi represents an ISCSI Disk resource that is attached to a
                               kubelet's host machine and then exposed to the pod.
-                              More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
+                              More info: https://examples.k8s.io/volumes/iscsi/README.md
                             properties:
                               chapAuthDiscovery:
                                 description: chapAuthDiscovery defines whether support iSCSI Discovery CHAP authentication
@@ -7661,110 +7378,6 @@ spec:
                                           type: array
                                           x-kubernetes-list-type: atomic
                                       type: object
-                                    podCertificate:
-                                      description: |-
-                                        Projects an auto-rotating credential bundle (private key and certificate
-                                        chain) that the pod can use either as a TLS client or server.
-
-                                        Kubelet generates a private key and uses it to send a
-                                        PodCertificateRequest to the named signer.  Once the signer approves the
-                                        request and issues a certificate chain, Kubelet writes the key and
-                                        certificate chain to the pod filesystem.  The pod does not start until
-                                        certificates have been issued for each podCertificate projected volume
-                                        source in its spec.
-
-                                        Kubelet will begin trying to rotate the certificate at the time indicated
-                                        by the signer using the PodCertificateRequest.Status.BeginRefreshAt
-                                        timestamp.
-
-                                        Kubelet can write a single file, indicated by the credentialBundlePath
-                                        field, or separate files, indicated by the keyPath and
-                                        certificateChainPath fields.
-
-                                        The credential bundle is a single file in PEM format.  The first PEM
-                                        entry is the private key (in PKCS#8 format), and the remaining PEM
-                                        entries are the certificate chain issued by the signer (typically,
-                                        signers will return their certificate chain in leaf-to-root order).
-
-                                        Prefer using the credential bundle format, since your application code
-                                        can read it atomically.  If you use keyPath and certificateChainPath,
-                                        your application must make two separate file reads. If these coincide
-                                        with a certificate rotation, it is possible that the private key and leaf
-                                        certificate you read may not correspond to each other.  Your application
-                                        will need to check for this condition, and re-read until they are
-                                        consistent.
-
-                                        The named signer controls chooses the format of the certificate it
-                                        issues; consult the signer implementation's documentation to learn how to
-                                        use the certificates it issues.
-                                      properties:
-                                        certificateChainPath:
-                                          description: |-
-                                            Write the certificate chain at this path in the projected volume.
-
-                                            Most applications should use credentialBundlePath.  When using keyPath
-                                            and certificateChainPath, your application needs to check that the key
-                                            and leaf certificate are consistent, because it is possible to read the
-                                            files mid-rotation.
-                                          type: string
-                                        credentialBundlePath:
-                                          description: |-
-                                            Write the credential bundle at this path in the projected volume.
-
-                                            The credential bundle is a single file that contains multiple PEM blocks.
-                                            The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
-                                            key.
-
-                                            The remaining blocks are CERTIFICATE blocks, containing the issued
-                                            certificate chain from the signer (leaf and any intermediates).
-
-                                            Using credentialBundlePath lets your Pod's application code make a single
-                                            atomic read that retrieves a consistent key and certificate chain.  If you
-                                            project them to separate files, your application code will need to
-                                            additionally check that the leaf certificate was issued to the key.
-                                          type: string
-                                        keyPath:
-                                          description: |-
-                                            Write the key at this path in the projected volume.
-
-                                            Most applications should use credentialBundlePath.  When using keyPath
-                                            and certificateChainPath, your application needs to check that the key
-                                            and leaf certificate are consistent, because it is possible to read the
-                                            files mid-rotation.
-                                          type: string
-                                        keyType:
-                                          description: |-
-                                            The type of keypair Kubelet will generate for the pod.
-
-                                            Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
-                                            "ECDSAP521", and "ED25519".
-                                          type: string
-                                        maxExpirationSeconds:
-                                          description: |-
-                                            maxExpirationSeconds is the maximum lifetime permitted for the
-                                            certificate.
-
-                                            Kubelet copies this value verbatim into the PodCertificateRequests it
-                                            generates for this projection.
-
-                                            If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
-                                            will reject values shorter than 3600 (1 hour).  The maximum allowable
-                                            value is 7862400 (91 days).
-
-                                            The signer implementation is then free to issue a certificate with any
-                                            lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
-                                            seconds (1 hour).  This constraint is enforced by kube-apiserver.
-                                            `kubernetes.io` signers will never issue certificates with a lifetime
-                                            longer than 24 hours.
-                                          format: int32
-                                          type: integer
-                                        signerName:
-                                          description: Kubelet's generated CSRs will be addressed to this signer.
-                                          type: string
-                                      required:
-                                        - keyType
-                                        - signerName
-                                      type: object
                                     secret:
                                       description: secret information about the secret data to project
                                       properties:
@@ -7894,6 +7507,7 @@ spec:
                             description: |-
                               rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                               Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
+                              More info: https://examples.k8s.io/volumes/rbd/README.md
                             properties:
                               fsType:
                                 description: |-

config/crd/bases/actions.github.com_ephemeralrunnersets.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: ephemeralrunnersets.actions.github.com
 spec:
   group: actions.github.com
@@ -421,6 +421,7 @@ spec:
                                               pod labels will be ignored. The default value is empty.
                                               The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                               Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                              This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                             items:
                                               type: string
                                             type: array
@@ -435,6 +436,7 @@ spec:
                                               pod labels will be ignored. The default value is empty.
                                               The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                               Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                              This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                             items:
                                               type: string
                                             type: array
@@ -595,6 +597,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                           Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -609,6 +612,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                           Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -697,8 +701,8 @@ spec:
                                     most preferred is the one with the greatest sum of weights, i.e.
                                     for each node that meets all of the scheduling requirements (resource
                                     request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                    compute a sum by iterating through the elements of this field and subtracting
-                                    "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                    compute a sum by iterating through the elements of this field and adding
+                                    "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                     node(s) with the highest sum are the most preferred.
                                   items:
                                     description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
@@ -762,6 +766,7 @@ spec:
                                               pod labels will be ignored. The default value is empty.
                                               The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                               Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                              This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                             items:
                                               type: string
                                             type: array
@@ -776,6 +781,7 @@ spec:
                                               pod labels will be ignored. The default value is empty.
                                               The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                               Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                              This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                             items:
                                               type: string
                                             type: array
@@ -936,6 +942,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                           Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -950,6 +957,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                           Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -1076,9 +1084,7 @@ spec:
                                   description: EnvVar represents an environment variable present in a Container.
                                   properties:
                                     name:
-                                      description: |-
-                                        Name of the environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: Name of the environment variable. Must be a C_IDENTIFIER.
                                       type: string
                                     value:
                                       description: |-
@@ -1132,42 +1138,6 @@ spec:
                                             - fieldPath
                                           type: object
                                           x-kubernetes-map-type: atomic
-                                        fileKeyRef:
-                                          description: |-
-                                            FileKeyRef selects a key of the env file.
-                                            Requires the EnvFiles feature gate to be enabled.
-                                          properties:
-                                            key:
-                                              description: |-
-                                                The key within the env file. An invalid key will prevent the pod from starting.
-                                                The keys defined within a source may consist of any printable ASCII characters except '='.
-                                                During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                              type: string
-                                            optional:
-                                              default: false
-                                              description: |-
-                                                Specify whether the file or its key must be defined. If the file or key
-                                                does not exist, then the env var is not published.
-                                                If optional is set to true and the specified key does not exist,
-                                                the environment variable will not be set in the Pod's containers.
-
-                                                If optional is set to false and the specified key does not exist,
-                                                an error will be returned during Pod creation.
-                                              type: boolean
-                                            path:
-                                              description: |-
-                                                The path within the volume from which to select the file.
-                                                Must be relative and may not contain the '..' path or start with '..'.
-                                              type: string
-                                            volumeName:
-                                              description: The name of the volume mount containing the env file.
-                                              type: string
-                                          required:
-                                            - key
-                                            - path
-                                            - volumeName
-                                          type: object
-                                          x-kubernetes-map-type: atomic
                                         resourceFieldRef:
                                           description: |-
                                             Selects a resource of the container: only resources limits and requests
@@ -1223,13 +1193,13 @@ spec:
                               envFrom:
                                 description: |-
                                   List of sources to populate environment variables in the container.
-                                  The keys defined within a source may consist of any printable ASCII characters except '='.
-                                  When a key exists in multiple
+                                  The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                  will be reported as an event when the container is starting. When a key exists in multiple
                                   sources, the value associated with the last source will take precedence.
                                   Values defined by an Env with a duplicate key will take precedence.
                                   Cannot be updated.
                                 items:
-                                  description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                                  description: EnvFromSource represents the source of a set of ConfigMaps
                                   properties:
                                     configMapRef:
                                       description: The ConfigMap to select from
@@ -1249,9 +1219,7 @@ spec:
                                       type: object
                                       x-kubernetes-map-type: atomic
                                     prefix:
-                                      description: |-
-                                        Optional text to prepend to the name of each environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                       type: string
                                     secretRef:
                                       description: The Secret to select from
@@ -1500,12 +1468,6 @@ spec:
                                           - port
                                         type: object
                                     type: object
-                                  stopSignal:
-                                    description: |-
-                                      StopSignal defines which signal will be sent to a container when it is being stopped.
-                                      If not specified, the default is defined by the container runtime in use.
-                                      StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                    type: string
                                 type: object
                               livenessProbe:
                                 description: |-
@@ -1896,7 +1858,7 @@ spec:
                                       Claims lists the names of resources, defined in spec.resourceClaims,
                                       that are used by this container.
 
-                                      This field depends on the
+                                      This is an alpha field and requires enabling the
                                       DynamicResourceAllocation feature gate.
 
                                       This field is immutable. It can only be set for containers.
@@ -1947,10 +1909,10 @@ spec:
                               restartPolicy:
                                 description: |-
                                   RestartPolicy defines the restart behavior of individual containers in a pod.
-                                  This overrides the pod-level restart policy. When this field is not specified,
+                                  This field may only be set for init containers, and the only allowed value is "Always".
+                                  For non-init containers or when this field is not specified,
                                   the restart behavior is defined by the Pod's restart policy and the container type.
-                                  Additionally, setting the RestartPolicy as "Always" for the init container will
-                                  have the following effect:
+                                  Setting the RestartPolicy as "Always" for the init container will have the following effect:
                                   this init container will be continually restarted on
                                   exit until all regular containers have terminated. Once all regular
                                   containers have completed, all init containers with restartPolicy "Always"
@@ -1962,57 +1924,6 @@ spec:
                                   init container is started, or after any startupProbe has successfully
                                   completed.
                                 type: string
-                              restartPolicyRules:
-                                description: |-
-                                  Represents a list of rules to be checked to determine if the
-                                  container should be restarted on exit. The rules are evaluated in
-                                  order. Once a rule matches a container exit condition, the remaining
-                                  rules are ignored. If no rule matches the container exit condition,
-                                  the Container-level restart policy determines the whether the container
-                                  is restarted or not. Constraints on the rules:
-                                  - At most 20 rules are allowed.
-                                  - Rules can have the same action.
-                                  - Identical rules are not forbidden in validations.
-                                  When rules are specified, container MUST set RestartPolicy explicitly
-                                  even it if matches the Pod's RestartPolicy.
-                                items:
-                                  description: ContainerRestartRule describes how a container exit is handled.
-                                  properties:
-                                    action:
-                                      description: |-
-                                        Specifies the action taken on a container exit if the requirements
-                                        are satisfied. The only possible value is "Restart" to restart the
-                                        container.
-                                      type: string
-                                    exitCodes:
-                                      description: Represents the exit codes to check on container exits.
-                                      properties:
-                                        operator:
-                                          description: |-
-                                            Represents the relationship between the container exit code(s) and the
-                                            specified values. Possible values are:
-                                            - In: the requirement is satisfied if the container exit code is in the
-                                              set of specified values.
-                                            - NotIn: the requirement is satisfied if the container exit code is
-                                              not in the set of specified values.
-                                          type: string
-                                        values:
-                                          description: |-
-                                            Specifies the set of values to check for container exit codes.
-                                            At most 255 elements are allowed.
-                                          items:
-                                            format: int32
-                                            type: integer
-                                          type: array
-                                          x-kubernetes-list-type: set
-                                      required:
-                                        - operator
-                                      type: object
-                                  required:
-                                    - action
-                                  type: object
-                                type: array
-                                x-kubernetes-list-type: atomic
                               securityContext:
                                 description: |-
                                   SecurityContext defines the security options the container should be run with.
@@ -2610,9 +2521,7 @@ spec:
                                   description: EnvVar represents an environment variable present in a Container.
                                   properties:
                                     name:
-                                      description: |-
-                                        Name of the environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: Name of the environment variable. Must be a C_IDENTIFIER.
                                       type: string
                                     value:
                                       description: |-
@@ -2666,42 +2575,6 @@ spec:
                                             - fieldPath
                                           type: object
                                           x-kubernetes-map-type: atomic
-                                        fileKeyRef:
-                                          description: |-
-                                            FileKeyRef selects a key of the env file.
-                                            Requires the EnvFiles feature gate to be enabled.
-                                          properties:
-                                            key:
-                                              description: |-
-                                                The key within the env file. An invalid key will prevent the pod from starting.
-                                                The keys defined within a source may consist of any printable ASCII characters except '='.
-                                                During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                              type: string
-                                            optional:
-                                              default: false
-                                              description: |-
-                                                Specify whether the file or its key must be defined. If the file or key
-                                                does not exist, then the env var is not published.
-                                                If optional is set to true and the specified key does not exist,
-                                                the environment variable will not be set in the Pod's containers.
-
-                                                If optional is set to false and the specified key does not exist,
-                                                an error will be returned during Pod creation.
-                                              type: boolean
-                                            path:
-                                              description: |-
-                                                The path within the volume from which to select the file.
-                                                Must be relative and may not contain the '..' path or start with '..'.
-                                              type: string
-                                            volumeName:
-                                              description: The name of the volume mount containing the env file.
-                                              type: string
-                                          required:
-                                            - key
-                                            - path
-                                            - volumeName
-                                          type: object
-                                          x-kubernetes-map-type: atomic
                                         resourceFieldRef:
                                           description: |-
                                             Selects a resource of the container: only resources limits and requests
@@ -2757,13 +2630,13 @@ spec:
                               envFrom:
                                 description: |-
                                   List of sources to populate environment variables in the container.
-                                  The keys defined within a source may consist of any printable ASCII characters except '='.
-                                  When a key exists in multiple
+                                  The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                  will be reported as an event when the container is starting. When a key exists in multiple
                                   sources, the value associated with the last source will take precedence.
                                   Values defined by an Env with a duplicate key will take precedence.
                                   Cannot be updated.
                                 items:
-                                  description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                                  description: EnvFromSource represents the source of a set of ConfigMaps
                                   properties:
                                     configMapRef:
                                       description: The ConfigMap to select from
@@ -2783,9 +2656,7 @@ spec:
                                       type: object
                                       x-kubernetes-map-type: atomic
                                     prefix:
-                                      description: |-
-                                        Optional text to prepend to the name of each environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                       type: string
                                     secretRef:
                                       description: The Secret to select from
@@ -3030,12 +2901,6 @@ spec:
                                           - port
                                         type: object
                                     type: object
-                                  stopSignal:
-                                    description: |-
-                                      StopSignal defines which signal will be sent to a container when it is being stopped.
-                                      If not specified, the default is defined by the container runtime in use.
-                                      StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                    type: string
                                 type: object
                               livenessProbe:
                                 description: Probes are not allowed for ephemeral containers.
@@ -3409,7 +3274,7 @@ spec:
                                       Claims lists the names of resources, defined in spec.resourceClaims,
                                       that are used by this container.
 
-                                      This field depends on the
+                                      This is an alpha field and requires enabling the
                                       DynamicResourceAllocation feature gate.
 
                                       This field is immutable. It can only be set for containers.
@@ -3461,51 +3326,9 @@ spec:
                                 description: |-
                                   Restart policy for the container to manage the restart behavior of each
                                   container within a pod.
-                                  You cannot set this field on ephemeral containers.
-                                type: string
-                              restartPolicyRules:
-                                description: |-
-                                  Represents a list of rules to be checked to determine if the
-                                  container should be restarted on exit. You cannot set this field on
+                                  This may only be set for init containers. You cannot set this field on
                                   ephemeral containers.
-                                items:
-                                  description: ContainerRestartRule describes how a container exit is handled.
-                                  properties:
-                                    action:
-                                      description: |-
-                                        Specifies the action taken on a container exit if the requirements
-                                        are satisfied. The only possible value is "Restart" to restart the
-                                        container.
-                                      type: string
-                                    exitCodes:
-                                      description: Represents the exit codes to check on container exits.
-                                      properties:
-                                        operator:
-                                          description: |-
-                                            Represents the relationship between the container exit code(s) and the
-                                            specified values. Possible values are:
-                                            - In: the requirement is satisfied if the container exit code is in the
-                                              set of specified values.
-                                            - NotIn: the requirement is satisfied if the container exit code is
-                                              not in the set of specified values.
-                                          type: string
-                                        values:
-                                          description: |-
-                                            Specifies the set of values to check for container exit codes.
-                                            At most 255 elements are allowed.
-                                          items:
-                                            format: int32
-                                            type: integer
-                                          type: array
-                                          x-kubernetes-list-type: set
-                                      required:
-                                        - operator
-                                      type: object
-                                  required:
-                                    - action
-                                  type: object
-                                type: array
-                                x-kubernetes-list-type: atomic
+                                type: string
                               securityContext:
                                 description: |-
                                   Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -4024,9 +3847,7 @@ spec:
                         hostNetwork:
                           description: |-
                             Host networking requested for this pod. Use the host's network namespace.
-                            When using HostNetwork you should specify ports so the scheduler is aware.
-                            When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
-                            and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
+                            If this option is set, the ports that will be used must be specified.
                             Default to false.
                           type: boolean
                         hostPID:
@@ -4051,19 +3872,6 @@ spec:
                             Specifies the hostname of the Pod
                             If not specified, the pod's hostname will be set to a system-defined value.
                           type: string
-                        hostnameOverride:
-                          description: |-
-                            HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
-                            This field only specifies the pod's hostname and does not affect its DNS records.
-                            When this field is set to a non-empty string:
-                            - It takes precedence over the values set in `hostname` and `subdomain`.
-                            - The Pod's hostname will be set to this value.
-                            - `setHostnameAsFQDN` must be nil or set to false.
-                            - `hostNetwork` must be set to false.
-
-                            This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
-                            Requires the HostnameOverride feature gate to be enabled.
-                          type: string
                         imagePullSecrets:
                           description: |-
                             ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -4099,7 +3907,7 @@ spec:
                             Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.
                             The resourceRequirements of an init container are taken into account during scheduling
                             by finding the highest request/limit for each resource type, and then using the max of
-                            that value or the sum of the normal containers. Limits are applied to init containers
+                            of that value or the sum of the normal containers. Limits are applied to init containers
                             in a similar fashion.
                             Init containers cannot currently be added or removed.
                             Cannot be updated.
@@ -4143,9 +3951,7 @@ spec:
                                   description: EnvVar represents an environment variable present in a Container.
                                   properties:
                                     name:
-                                      description: |-
-                                        Name of the environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: Name of the environment variable. Must be a C_IDENTIFIER.
                                       type: string
                                     value:
                                       description: |-
@@ -4199,42 +4005,6 @@ spec:
                                             - fieldPath
                                           type: object
                                           x-kubernetes-map-type: atomic
-                                        fileKeyRef:
-                                          description: |-
-                                            FileKeyRef selects a key of the env file.
-                                            Requires the EnvFiles feature gate to be enabled.
-                                          properties:
-                                            key:
-                                              description: |-
-                                                The key within the env file. An invalid key will prevent the pod from starting.
-                                                The keys defined within a source may consist of any printable ASCII characters except '='.
-                                                During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                              type: string
-                                            optional:
-                                              default: false
-                                              description: |-
-                                                Specify whether the file or its key must be defined. If the file or key
-                                                does not exist, then the env var is not published.
-                                                If optional is set to true and the specified key does not exist,
-                                                the environment variable will not be set in the Pod's containers.
-
-                                                If optional is set to false and the specified key does not exist,
-                                                an error will be returned during Pod creation.
-                                              type: boolean
-                                            path:
-                                              description: |-
-                                                The path within the volume from which to select the file.
-                                                Must be relative and may not contain the '..' path or start with '..'.
-                                              type: string
-                                            volumeName:
-                                              description: The name of the volume mount containing the env file.
-                                              type: string
-                                          required:
-                                            - key
-                                            - path
-                                            - volumeName
-                                          type: object
-                                          x-kubernetes-map-type: atomic
                                         resourceFieldRef:
                                           description: |-
                                             Selects a resource of the container: only resources limits and requests
@@ -4290,13 +4060,13 @@ spec:
                               envFrom:
                                 description: |-
                                   List of sources to populate environment variables in the container.
-                                  The keys defined within a source may consist of any printable ASCII characters except '='.
-                                  When a key exists in multiple
+                                  The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                  will be reported as an event when the container is starting. When a key exists in multiple
                                   sources, the value associated with the last source will take precedence.
                                   Values defined by an Env with a duplicate key will take precedence.
                                   Cannot be updated.
                                 items:
-                                  description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                                  description: EnvFromSource represents the source of a set of ConfigMaps
                                   properties:
                                     configMapRef:
                                       description: The ConfigMap to select from
@@ -4316,9 +4086,7 @@ spec:
                                       type: object
                                       x-kubernetes-map-type: atomic
                                     prefix:
-                                      description: |-
-                                        Optional text to prepend to the name of each environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                       type: string
                                     secretRef:
                                       description: The Secret to select from
@@ -4567,12 +4335,6 @@ spec:
                                           - port
                                         type: object
                                     type: object
-                                  stopSignal:
-                                    description: |-
-                                      StopSignal defines which signal will be sent to a container when it is being stopped.
-                                      If not specified, the default is defined by the container runtime in use.
-                                      StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                    type: string
                                 type: object
                               livenessProbe:
                                 description: |-
@@ -4963,7 +4725,7 @@ spec:
                                       Claims lists the names of resources, defined in spec.resourceClaims,
                                       that are used by this container.
 
-                                      This field depends on the
+                                      This is an alpha field and requires enabling the
                                       DynamicResourceAllocation feature gate.
 
                                       This field is immutable. It can only be set for containers.
@@ -5014,10 +4776,10 @@ spec:
                               restartPolicy:
                                 description: |-
                                   RestartPolicy defines the restart behavior of individual containers in a pod.
-                                  This overrides the pod-level restart policy. When this field is not specified,
+                                  This field may only be set for init containers, and the only allowed value is "Always".
+                                  For non-init containers or when this field is not specified,
                                   the restart behavior is defined by the Pod's restart policy and the container type.
-                                  Additionally, setting the RestartPolicy as "Always" for the init container will
-                                  have the following effect:
+                                  Setting the RestartPolicy as "Always" for the init container will have the following effect:
                                   this init container will be continually restarted on
                                   exit until all regular containers have terminated. Once all regular
                                   containers have completed, all init containers with restartPolicy "Always"
@@ -5029,57 +4791,6 @@ spec:
                                   init container is started, or after any startupProbe has successfully
                                   completed.
                                 type: string
-                              restartPolicyRules:
-                                description: |-
-                                  Represents a list of rules to be checked to determine if the
-                                  container should be restarted on exit. The rules are evaluated in
-                                  order. Once a rule matches a container exit condition, the remaining
-                                  rules are ignored. If no rule matches the container exit condition,
-                                  the Container-level restart policy determines the whether the container
-                                  is restarted or not. Constraints on the rules:
-                                  - At most 20 rules are allowed.
-                                  - Rules can have the same action.
-                                  - Identical rules are not forbidden in validations.
-                                  When rules are specified, container MUST set RestartPolicy explicitly
-                                  even it if matches the Pod's RestartPolicy.
-                                items:
-                                  description: ContainerRestartRule describes how a container exit is handled.
-                                  properties:
-                                    action:
-                                      description: |-
-                                        Specifies the action taken on a container exit if the requirements
-                                        are satisfied. The only possible value is "Restart" to restart the
-                                        container.
-                                      type: string
-                                    exitCodes:
-                                      description: Represents the exit codes to check on container exits.
-                                      properties:
-                                        operator:
-                                          description: |-
-                                            Represents the relationship between the container exit code(s) and the
-                                            specified values. Possible values are:
-                                            - In: the requirement is satisfied if the container exit code is in the
-                                              set of specified values.
-                                            - NotIn: the requirement is satisfied if the container exit code is
-                                              not in the set of specified values.
-                                          type: string
-                                        values:
-                                          description: |-
-                                            Specifies the set of values to check for container exit codes.
-                                            At most 255 elements are allowed.
-                                          items:
-                                            format: int32
-                                            type: integer
-                                          type: array
-                                          x-kubernetes-list-type: set
-                                      required:
-                                        - operator
-                                      type: object
-                                  required:
-                                    - action
-                                  type: object
-                                type: array
-                                x-kubernetes-list-type: atomic
                               securityContext:
                                 description: |-
                                   SecurityContext defines the security options the container should be run with.
@@ -5593,7 +5304,6 @@ spec:
                             - spec.hostPID
                             - spec.hostIPC
                             - spec.hostUsers
-                            - spec.resources
                             - spec.securityContext.appArmorProfile
                             - spec.securityContext.seLinuxOptions
                             - spec.securityContext.seccompProfile
@@ -5745,7 +5455,7 @@ spec:
                           description: |-
                             Resources is the total amount of CPU and Memory resources required by all
                             containers in the pod. It supports specifying Requests and Limits for
-                            "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
+                            "cpu" and "memory" resource names only. ResourceClaims are not supported.
 
                             This field enables fine-grained control over resource allocation for the
                             entire pod, allowing resource sharing among containers in a pod.
@@ -5758,7 +5468,7 @@ spec:
                                 Claims lists the names of resources, defined in spec.resourceClaims,
                                 that are used by this container.
 
-                                This field depends on the
+                                This is an alpha field and requires enabling the
                                 DynamicResourceAllocation feature gate.
 
                                 This field is immutable. It can only be set for containers.
@@ -6286,6 +5996,7 @@ spec:
                                   - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
 
                                   If this value is nil, the behavior is equivalent to the Honor policy.
+                                  This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                                 type: string
                               nodeTaintsPolicy:
                                 description: |-
@@ -6296,6 +6007,7 @@ spec:
                                   - Ignore: node taints are ignored. All nodes are included.
 
                                   If this value is nil, the behavior is equivalent to the Ignore policy.
+                                  This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                                 type: string
                               topologyKey:
                                 description: |-
@@ -7001,13 +6713,15 @@ spec:
                                               volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                               If specified, the CSI driver will create or update the volume with the attributes defined
                                               in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                              it can be changed after the claim is created. An empty string or nil value indicates that no
-                                              VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
-                                              this field can be reset to its previous value (including nil) to cancel the modification.
+                                              it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
+                                              will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
+                                              If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
+                                              will be set by the persistentvolume controller if it exists.
                                               If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                               set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                               exists.
                                               More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
+                                              (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                             type: string
                                           volumeMode:
                                             description: |-
@@ -7181,9 +6895,12 @@ spec:
                                 description: |-
                                   glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                   Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
+                                  More info: https://examples.k8s.io/volumes/glusterfs/README.md
                                 properties:
                                   endpoints:
-                                    description: endpoints is the endpoint name that details Glusterfs topology.
+                                    description: |-
+                                      endpoints is the endpoint name that details Glusterfs topology.
+                                      More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
                                     type: string
                                   path:
                                     description: |-
@@ -7237,7 +6954,7 @@ spec:
                                   The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
                                   The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
                                   The volume will be mounted read-only (ro) and non-executable files (noexec).
-                                  Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
+                                  Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
                                   The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
                                 properties:
                                   pullPolicy:
@@ -7262,7 +6979,7 @@ spec:
                                 description: |-
                                   iscsi represents an ISCSI Disk resource that is attached to a
                                   kubelet's host machine and then exposed to the pod.
-                                  More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
+                                  More info: https://examples.k8s.io/volumes/iscsi/README.md
                                 properties:
                                   chapAuthDiscovery:
                                     description: chapAuthDiscovery defines whether support iSCSI Discovery CHAP authentication
@@ -7652,110 +7369,6 @@ spec:
                                               type: array
                                               x-kubernetes-list-type: atomic
                                           type: object
-                                        podCertificate:
-                                          description: |-
-                                            Projects an auto-rotating credential bundle (private key and certificate
-                                            chain) that the pod can use either as a TLS client or server.
-
-                                            Kubelet generates a private key and uses it to send a
-                                            PodCertificateRequest to the named signer.  Once the signer approves the
-                                            request and issues a certificate chain, Kubelet writes the key and
-                                            certificate chain to the pod filesystem.  The pod does not start until
-                                            certificates have been issued for each podCertificate projected volume
-                                            source in its spec.
-
-                                            Kubelet will begin trying to rotate the certificate at the time indicated
-                                            by the signer using the PodCertificateRequest.Status.BeginRefreshAt
-                                            timestamp.
-
-                                            Kubelet can write a single file, indicated by the credentialBundlePath
-                                            field, or separate files, indicated by the keyPath and
-                                            certificateChainPath fields.
-
-                                            The credential bundle is a single file in PEM format.  The first PEM
-                                            entry is the private key (in PKCS#8 format), and the remaining PEM
-                                            entries are the certificate chain issued by the signer (typically,
-                                            signers will return their certificate chain in leaf-to-root order).
-
-                                            Prefer using the credential bundle format, since your application code
-                                            can read it atomically.  If you use keyPath and certificateChainPath,
-                                            your application must make two separate file reads. If these coincide
-                                            with a certificate rotation, it is possible that the private key and leaf
-                                            certificate you read may not correspond to each other.  Your application
-                                            will need to check for this condition, and re-read until they are
-                                            consistent.
-
-                                            The named signer controls chooses the format of the certificate it
-                                            issues; consult the signer implementation's documentation to learn how to
-                                            use the certificates it issues.
-                                          properties:
-                                            certificateChainPath:
-                                              description: |-
-                                                Write the certificate chain at this path in the projected volume.
-
-                                                Most applications should use credentialBundlePath.  When using keyPath
-                                                and certificateChainPath, your application needs to check that the key
-                                                and leaf certificate are consistent, because it is possible to read the
-                                                files mid-rotation.
-                                              type: string
-                                            credentialBundlePath:
-                                              description: |-
-                                                Write the credential bundle at this path in the projected volume.
-
-                                                The credential bundle is a single file that contains multiple PEM blocks.
-                                                The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
-                                                key.
-
-                                                The remaining blocks are CERTIFICATE blocks, containing the issued
-                                                certificate chain from the signer (leaf and any intermediates).
-
-                                                Using credentialBundlePath lets your Pod's application code make a single
-                                                atomic read that retrieves a consistent key and certificate chain.  If you
-                                                project them to separate files, your application code will need to
-                                                additionally check that the leaf certificate was issued to the key.
-                                              type: string
-                                            keyPath:
-                                              description: |-
-                                                Write the key at this path in the projected volume.
-
-                                                Most applications should use credentialBundlePath.  When using keyPath
-                                                and certificateChainPath, your application needs to check that the key
-                                                and leaf certificate are consistent, because it is possible to read the
-                                                files mid-rotation.
-                                              type: string
-                                            keyType:
-                                              description: |-
-                                                The type of keypair Kubelet will generate for the pod.
-
-                                                Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
-                                                "ECDSAP521", and "ED25519".
-                                              type: string
-                                            maxExpirationSeconds:
-                                              description: |-
-                                                maxExpirationSeconds is the maximum lifetime permitted for the
-                                                certificate.
-
-                                                Kubelet copies this value verbatim into the PodCertificateRequests it
-                                                generates for this projection.
-
-                                                If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
-                                                will reject values shorter than 3600 (1 hour).  The maximum allowable
-                                                value is 7862400 (91 days).
-
-                                                The signer implementation is then free to issue a certificate with any
-                                                lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
-                                                seconds (1 hour).  This constraint is enforced by kube-apiserver.
-                                                `kubernetes.io` signers will never issue certificates with a lifetime
-                                                longer than 24 hours.
-                                              format: int32
-                                              type: integer
-                                            signerName:
-                                              description: Kubelet's generated CSRs will be addressed to this signer.
-                                              type: string
-                                          required:
-                                            - keyType
-                                            - signerName
-                                          type: object
                                         secret:
                                           description: secret information about the secret data to project
                                           properties:
@@ -7885,6 +7498,7 @@ spec:
                                 description: |-
                                   rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                   Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
+                                  More info: https://examples.k8s.io/volumes/rbd/README.md
                                 properties:
                                   fsType:
                                     description: |-

config/crd/bases/actions.summerwind.dev_horizontalrunnerautoscalers.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: horizontalrunnerautoscalers.actions.summerwind.dev
 spec:
   group: actions.summerwind.dev

config/crd/bases/actions.summerwind.dev_runnersets.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.19.0
+    controller-gen.kubebuilder.io/version: v0.17.2
   name: runnersets.actions.summerwind.dev
 spec:
   group: actions.summerwind.dev
@@ -554,6 +554,7 @@ spec:
                                               pod labels will be ignored. The default value is empty.
                                               The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                               Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                              This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                             items:
                                               type: string
                                             type: array
@@ -568,6 +569,7 @@ spec:
                                               pod labels will be ignored. The default value is empty.
                                               The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                               Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                              This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                             items:
                                               type: string
                                             type: array
@@ -728,6 +730,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                           Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -742,6 +745,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                           Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -830,8 +834,8 @@ spec:
                                     most preferred is the one with the greatest sum of weights, i.e.
                                     for each node that meets all of the scheduling requirements (resource
                                     request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                    compute a sum by iterating through the elements of this field and subtracting
-                                    "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                    compute a sum by iterating through the elements of this field and adding
+                                    "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                     node(s) with the highest sum are the most preferred.
                                   items:
                                     description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
@@ -895,6 +899,7 @@ spec:
                                               pod labels will be ignored. The default value is empty.
                                               The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                               Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                              This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                             items:
                                               type: string
                                             type: array
@@ -909,6 +914,7 @@ spec:
                                               pod labels will be ignored. The default value is empty.
                                               The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                               Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                              This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                             items:
                                               type: string
                                             type: array
@@ -1069,6 +1075,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                           Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -1083,6 +1090,7 @@ spec:
                                           pod labels will be ignored. The default value is empty.
                                           The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                           Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                         items:
                                           type: string
                                         type: array
@@ -1209,9 +1217,7 @@ spec:
                                   description: EnvVar represents an environment variable present in a Container.
                                   properties:
                                     name:
-                                      description: |-
-                                        Name of the environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: Name of the environment variable. Must be a C_IDENTIFIER.
                                       type: string
                                     value:
                                       description: |-
@@ -1265,42 +1271,6 @@ spec:
                                             - fieldPath
                                           type: object
                                           x-kubernetes-map-type: atomic
-                                        fileKeyRef:
-                                          description: |-
-                                            FileKeyRef selects a key of the env file.
-                                            Requires the EnvFiles feature gate to be enabled.
-                                          properties:
-                                            key:
-                                              description: |-
-                                                The key within the env file. An invalid key will prevent the pod from starting.
-                                                The keys defined within a source may consist of any printable ASCII characters except '='.
-                                                During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                              type: string
-                                            optional:
-                                              default: false
-                                              description: |-
-                                                Specify whether the file or its key must be defined. If the file or key
-                                                does not exist, then the env var is not published.
-                                                If optional is set to true and the specified key does not exist,
-                                                the environment variable will not be set in the Pod's containers.
-
-                                                If optional is set to false and the specified key does not exist,
-                                                an error will be returned during Pod creation.
-                                              type: boolean
-                                            path:
-                                              description: |-
-                                                The path within the volume from which to select the file.
-                                                Must be relative and may not contain the '..' path or start with '..'.
-                                              type: string
-                                            volumeName:
-                                              description: The name of the volume mount containing the env file.
-                                              type: string
-                                          required:
-                                            - key
-                                            - path
-                                            - volumeName
-                                          type: object
-                                          x-kubernetes-map-type: atomic
                                         resourceFieldRef:
                                           description: |-
                                             Selects a resource of the container: only resources limits and requests
@@ -1356,13 +1326,13 @@ spec:
                               envFrom:
                                 description: |-
                                   List of sources to populate environment variables in the container.
-                                  The keys defined within a source may consist of any printable ASCII characters except '='.
-                                  When a key exists in multiple
+                                  The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                  will be reported as an event when the container is starting. When a key exists in multiple
                                   sources, the value associated with the last source will take precedence.
                                   Values defined by an Env with a duplicate key will take precedence.
                                   Cannot be updated.
                                 items:
-                                  description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                                  description: EnvFromSource represents the source of a set of ConfigMaps
                                   properties:
                                     configMapRef:
                                       description: The ConfigMap to select from
@@ -1382,9 +1352,7 @@ spec:
                                       type: object
                                       x-kubernetes-map-type: atomic
                                     prefix:
-                                      description: |-
-                                        Optional text to prepend to the name of each environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                       type: string
                                     secretRef:
                                       description: The Secret to select from
@@ -1633,12 +1601,6 @@ spec:
                                           - port
                                         type: object
                                     type: object
-                                  stopSignal:
-                                    description: |-
-                                      StopSignal defines which signal will be sent to a container when it is being stopped.
-                                      If not specified, the default is defined by the container runtime in use.
-                                      StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                    type: string
                                 type: object
                               livenessProbe:
                                 description: |-
@@ -2029,7 +1991,7 @@ spec:
                                       Claims lists the names of resources, defined in spec.resourceClaims,
                                       that are used by this container.
 
-                                      This field depends on the
+                                      This is an alpha field and requires enabling the
                                       DynamicResourceAllocation feature gate.
 
                                       This field is immutable. It can only be set for containers.
@@ -2080,10 +2042,10 @@ spec:
                               restartPolicy:
                                 description: |-
                                   RestartPolicy defines the restart behavior of individual containers in a pod.
-                                  This overrides the pod-level restart policy. When this field is not specified,
+                                  This field may only be set for init containers, and the only allowed value is "Always".
+                                  For non-init containers or when this field is not specified,
                                   the restart behavior is defined by the Pod's restart policy and the container type.
-                                  Additionally, setting the RestartPolicy as "Always" for the init container will
-                                  have the following effect:
+                                  Setting the RestartPolicy as "Always" for the init container will have the following effect:
                                   this init container will be continually restarted on
                                   exit until all regular containers have terminated. Once all regular
                                   containers have completed, all init containers with restartPolicy "Always"
@@ -2095,57 +2057,6 @@ spec:
                                   init container is started, or after any startupProbe has successfully
                                   completed.
                                 type: string
-                              restartPolicyRules:
-                                description: |-
-                                  Represents a list of rules to be checked to determine if the
-                                  container should be restarted on exit. The rules are evaluated in
-                                  order. Once a rule matches a container exit condition, the remaining
-                                  rules are ignored. If no rule matches the container exit condition,
-                                  the Container-level restart policy determines the whether the container
-                                  is restarted or not. Constraints on the rules:
-                                  - At most 20 rules are allowed.
-                                  - Rules can have the same action.
-                                  - Identical rules are not forbidden in validations.
-                                  When rules are specified, container MUST set RestartPolicy explicitly
-                                  even it if matches the Pod's RestartPolicy.
-                                items:
-                                  description: ContainerRestartRule describes how a container exit is handled.
-                                  properties:
-                                    action:
-                                      description: |-
-                                        Specifies the action taken on a container exit if the requirements
-                                        are satisfied. The only possible value is "Restart" to restart the
-                                        container.
-                                      type: string
-                                    exitCodes:
-                                      description: Represents the exit codes to check on container exits.
-                                      properties:
-                                        operator:
-                                          description: |-
-                                            Represents the relationship between the container exit code(s) and the
-                                            specified values. Possible values are:
-                                            - In: the requirement is satisfied if the container exit code is in the
-                                              set of specified values.
-                                            - NotIn: the requirement is satisfied if the container exit code is
-                                              not in the set of specified values.
-                                          type: string
-                                        values:
-                                          description: |-
-                                            Specifies the set of values to check for container exit codes.
-                                            At most 255 elements are allowed.
-                                          items:
-                                            format: int32
-                                            type: integer
-                                          type: array
-                                          x-kubernetes-list-type: set
-                                      required:
-                                        - operator
-                                      type: object
-                                  required:
-                                    - action
-                                  type: object
-                                type: array
-                                x-kubernetes-list-type: atomic
                               securityContext:
                                 description: |-
                                   SecurityContext defines the security options the container should be run with.
@@ -2743,9 +2654,7 @@ spec:
                                   description: EnvVar represents an environment variable present in a Container.
                                   properties:
                                     name:
-                                      description: |-
-                                        Name of the environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: Name of the environment variable. Must be a C_IDENTIFIER.
                                       type: string
                                     value:
                                       description: |-
@@ -2799,42 +2708,6 @@ spec:
                                             - fieldPath
                                           type: object
                                           x-kubernetes-map-type: atomic
-                                        fileKeyRef:
-                                          description: |-
-                                            FileKeyRef selects a key of the env file.
-                                            Requires the EnvFiles feature gate to be enabled.
-                                          properties:
-                                            key:
-                                              description: |-
-                                                The key within the env file. An invalid key will prevent the pod from starting.
-                                                The keys defined within a source may consist of any printable ASCII characters except '='.
-                                                During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                              type: string
-                                            optional:
-                                              default: false
-                                              description: |-
-                                                Specify whether the file or its key must be defined. If the file or key
-                                                does not exist, then the env var is not published.
-                                                If optional is set to true and the specified key does not exist,
-                                                the environment variable will not be set in the Pod's containers.
-
-                                                If optional is set to false and the specified key does not exist,
-                                                an error will be returned during Pod creation.
-                                              type: boolean
-                                            path:
-                                              description: |-
-                                                The path within the volume from which to select the file.
-                                                Must be relative and may not contain the '..' path or start with '..'.
-                                              type: string
-                                            volumeName:
-                                              description: The name of the volume mount containing the env file.
-                                              type: string
-                                          required:
-                                            - key
-                                            - path
-                                            - volumeName
-                                          type: object
-                                          x-kubernetes-map-type: atomic
                                         resourceFieldRef:
                                           description: |-
                                             Selects a resource of the container: only resources limits and requests
@@ -2890,13 +2763,13 @@ spec:
                               envFrom:
                                 description: |-
                                   List of sources to populate environment variables in the container.
-                                  The keys defined within a source may consist of any printable ASCII characters except '='.
-                                  When a key exists in multiple
+                                  The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                  will be reported as an event when the container is starting. When a key exists in multiple
                                   sources, the value associated with the last source will take precedence.
                                   Values defined by an Env with a duplicate key will take precedence.
                                   Cannot be updated.
                                 items:
-                                  description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                                  description: EnvFromSource represents the source of a set of ConfigMaps
                                   properties:
                                     configMapRef:
                                       description: The ConfigMap to select from
@@ -2916,9 +2789,7 @@ spec:
                                       type: object
                                       x-kubernetes-map-type: atomic
                                     prefix:
-                                      description: |-
-                                        Optional text to prepend to the name of each environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                       type: string
                                     secretRef:
                                       description: The Secret to select from
@@ -3163,12 +3034,6 @@ spec:
                                           - port
                                         type: object
                                     type: object
-                                  stopSignal:
-                                    description: |-
-                                      StopSignal defines which signal will be sent to a container when it is being stopped.
-                                      If not specified, the default is defined by the container runtime in use.
-                                      StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                    type: string
                                 type: object
                               livenessProbe:
                                 description: Probes are not allowed for ephemeral containers.
@@ -3542,7 +3407,7 @@ spec:
                                       Claims lists the names of resources, defined in spec.resourceClaims,
                                       that are used by this container.
 
-                                      This field depends on the
+                                      This is an alpha field and requires enabling the
                                       DynamicResourceAllocation feature gate.
 
                                       This field is immutable. It can only be set for containers.
@@ -3594,51 +3459,9 @@ spec:
                                 description: |-
                                   Restart policy for the container to manage the restart behavior of each
                                   container within a pod.
-                                  You cannot set this field on ephemeral containers.
-                                type: string
-                              restartPolicyRules:
-                                description: |-
-                                  Represents a list of rules to be checked to determine if the
-                                  container should be restarted on exit. You cannot set this field on
+                                  This may only be set for init containers. You cannot set this field on
                                   ephemeral containers.
-                                items:
-                                  description: ContainerRestartRule describes how a container exit is handled.
-                                  properties:
-                                    action:
-                                      description: |-
-                                        Specifies the action taken on a container exit if the requirements
-                                        are satisfied. The only possible value is "Restart" to restart the
-                                        container.
-                                      type: string
-                                    exitCodes:
-                                      description: Represents the exit codes to check on container exits.
-                                      properties:
-                                        operator:
-                                          description: |-
-                                            Represents the relationship between the container exit code(s) and the
-                                            specified values. Possible values are:
-                                            - In: the requirement is satisfied if the container exit code is in the
-                                              set of specified values.
-                                            - NotIn: the requirement is satisfied if the container exit code is
-                                              not in the set of specified values.
-                                          type: string
-                                        values:
-                                          description: |-
-                                            Specifies the set of values to check for container exit codes.
-                                            At most 255 elements are allowed.
-                                          items:
-                                            format: int32
-                                            type: integer
-                                          type: array
-                                          x-kubernetes-list-type: set
-                                      required:
-                                        - operator
-                                      type: object
-                                  required:
-                                    - action
-                                  type: object
-                                type: array
-                                x-kubernetes-list-type: atomic
+                                type: string
                               securityContext:
                                 description: |-
                                   Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -4157,9 +3980,7 @@ spec:
                         hostNetwork:
                           description: |-
                             Host networking requested for this pod. Use the host's network namespace.
-                            When using HostNetwork you should specify ports so the scheduler is aware.
-                            When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
-                            and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
+                            If this option is set, the ports that will be used must be specified.
                             Default to false.
                           type: boolean
                         hostPID:
@@ -4184,19 +4005,6 @@ spec:
                             Specifies the hostname of the Pod
                             If not specified, the pod's hostname will be set to a system-defined value.
                           type: string
-                        hostnameOverride:
-                          description: |-
-                            HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
-                            This field only specifies the pod's hostname and does not affect its DNS records.
-                            When this field is set to a non-empty string:
-                            - It takes precedence over the values set in `hostname` and `subdomain`.
-                            - The Pod's hostname will be set to this value.
-                            - `setHostnameAsFQDN` must be nil or set to false.
-                            - `hostNetwork` must be set to false.
-
-                            This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
-                            Requires the HostnameOverride feature gate to be enabled.
-                          type: string
                         imagePullSecrets:
                           description: |-
                             ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -4232,7 +4040,7 @@ spec:
                             Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.
                             The resourceRequirements of an init container are taken into account during scheduling
                             by finding the highest request/limit for each resource type, and then using the max of
-                            that value or the sum of the normal containers. Limits are applied to init containers
+                            of that value or the sum of the normal containers. Limits are applied to init containers
                             in a similar fashion.
                             Init containers cannot currently be added or removed.
                             Cannot be updated.
@@ -4276,9 +4084,7 @@ spec:
                                   description: EnvVar represents an environment variable present in a Container.
                                   properties:
                                     name:
-                                      description: |-
-                                        Name of the environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: Name of the environment variable. Must be a C_IDENTIFIER.
                                       type: string
                                     value:
                                       description: |-
@@ -4332,42 +4138,6 @@ spec:
                                             - fieldPath
                                           type: object
                                           x-kubernetes-map-type: atomic
-                                        fileKeyRef:
-                                          description: |-
-                                            FileKeyRef selects a key of the env file.
-                                            Requires the EnvFiles feature gate to be enabled.
-                                          properties:
-                                            key:
-                                              description: |-
-                                                The key within the env file. An invalid key will prevent the pod from starting.
-                                                The keys defined within a source may consist of any printable ASCII characters except '='.
-                                                During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
-                                              type: string
-                                            optional:
-                                              default: false
-                                              description: |-
-                                                Specify whether the file or its key must be defined. If the file or key
-                                                does not exist, then the env var is not published.
-                                                If optional is set to true and the specified key does not exist,
-                                                the environment variable will not be set in the Pod's containers.
-
-                                                If optional is set to false and the specified key does not exist,
-                                                an error will be returned during Pod creation.
-                                              type: boolean
-                                            path:
-                                              description: |-
-                                                The path within the volume from which to select the file.
-                                                Must be relative and may not contain the '..' path or start with '..'.
-                                              type: string
-                                            volumeName:
-                                              description: The name of the volume mount containing the env file.
-                                              type: string
-                                          required:
-                                            - key
-                                            - path
-                                            - volumeName
-                                          type: object
-                                          x-kubernetes-map-type: atomic
                                         resourceFieldRef:
                                           description: |-
                                             Selects a resource of the container: only resources limits and requests
@@ -4423,13 +4193,13 @@ spec:
                               envFrom:
                                 description: |-
                                   List of sources to populate environment variables in the container.
-                                  The keys defined within a source may consist of any printable ASCII characters except '='.
-                                  When a key exists in multiple
+                                  The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+                                  will be reported as an event when the container is starting. When a key exists in multiple
                                   sources, the value associated with the last source will take precedence.
                                   Values defined by an Env with a duplicate key will take precedence.
                                   Cannot be updated.
                                 items:
-                                  description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                                  description: EnvFromSource represents the source of a set of ConfigMaps
                                   properties:
                                     configMapRef:
                                       description: The ConfigMap to select from
@@ -4449,9 +4219,7 @@ spec:
                                       type: object
                                       x-kubernetes-map-type: atomic
                                     prefix:
-                                      description: |-
-                                        Optional text to prepend to the name of each environment variable.
-                                        May consist of any printable ASCII characters except '='.
+                                      description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                       type: string
                                     secretRef:
                                       description: The Secret to select from
@@ -4700,12 +4468,6 @@ spec:
                                           - port
                                         type: object
                                     type: object
-                                  stopSignal:
-                                    description: |-
-                                      StopSignal defines which signal will be sent to a container when it is being stopped.
-                                      If not specified, the default is defined by the container runtime in use.
-                                      StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                    type: string
                                 type: object
                               livenessProbe:
                                 description: |-
@@ -5096,7 +4858,7 @@ spec:
                                       Claims lists the names of resources, defined in spec.resourceClaims,
                                       that are used by this container.
 
-                                      This field depends on the
+                                      This is an alpha field and requires enabling the
                                       DynamicResourceAllocation feature gate.
 
                                       This field is immutable. It can only be set for containers.
@@ -5147,10 +4909,10 @@ spec:
                               restartPolicy:
                                 description: |-
                                   RestartPolicy defines the restart behavior of individual containers in a pod.
-                                  This overrides the pod-level restart policy. When this field is not specified,
+                                  This field may only be set for init containers, and the only allowed value is "Always".
+                                  For non-init containers or when this field is not specified,
                                   the restart behavior is defined by the Pod's restart policy and the container type.
-                                  Additionally, setting the RestartPolicy as "Always" for the init container will
-                                  have the following effect:
+                                  Setting the RestartPolicy as "Always" for the init container will have the following effect:
                                   this init container will be continually restarted on
                                   exit until all regular containers have terminated. Once all regular
                                   containers have completed, all init containers with restartPolicy "Always"
@@ -5162,57 +4924,6 @@ spec:
                                   init container is started, or after any startupProbe has successfully
                                   completed.
                                 type: string
-                              restartPolicyRules:
-                                description: |-
-                                  Represents a list of rules to be checked to determine if the
-                                  container should be restarted on exit. The rules are evaluated in
-                                  order. Once a rule matches a container exit condition, the remaining
-                                  rules are ignored. If no rule matches the container exit condition,
-                                  the Container-level restart policy determines the whether the container
-                                  is restarted or not. Constraints on the rules:
-                                  - At most 20 rules are allowed.
-                                  - Rules can have the same action.
-                                  - Identical rules are not forbidden in validations.
-                                  When rules are specified, container MUST set RestartPolicy explicitly
-                                  even it if matches the Pod's RestartPolicy.
-                                items:
-                                  description: ContainerRestartRule describes how a container exit is handled.
-                                  properties:
-                                    action:
-                                      description: |-
-                                        Specifies the action taken on a container exit if the requirements
-                                        are satisfied. The only possible value is "Restart" to restart the
-                                        container.
-                                      type: string
-                                    exitCodes:
-                                      description: Represents the exit codes to check on container exits.
-                                      properties:
-                                        operator:
-                                          description: |-
-                                            Represents the relationship between the container exit code(s) and the
-                                            specified values. Possible values are:
-                                            - In: the requirement is satisfied if the container exit code is in the
-                                              set of specified values.
-                                            - NotIn: the requirement is satisfied if the container exit code is
-                                              not in the set of specified values.
-                                          type: string
-                                        values:
-                                          description: |-
-                                            Specifies the set of values to check for container exit codes.
-                                            At most 255 elements are allowed.
-                                          items:
-                                            format: int32
-                                            type: integer
-                                          type: array
-                                          x-kubernetes-list-type: set
-                                      required:
-                                        - operator
-                                      type: object
-                                  required:
-                                    - action
-                                  type: object
-                                type: array
-                                x-kubernetes-list-type: atomic
                               securityContext:
                                 description: |-
                                   SecurityContext defines the security options the container should be run with.
@@ -5726,7 +5437,6 @@ spec:
                             - spec.hostPID
                             - spec.hostIPC
                             - spec.hostUsers
-                            - spec.resources
                             - spec.securityContext.appArmorProfile
                             - spec.securityContext.seLinuxOptions
                             - spec.securityContext.seccompProfile
@@ -5878,7 +5588,7 @@ spec:
                           description: |-
                             Resources is the total amount of CPU and Memory resources required by all
                             containers in the pod. It supports specifying Requests and Limits for
-                            "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
+                            "cpu" and "memory" resource names only. ResourceClaims are not supported.
 
                             This field enables fine-grained control over resource allocation for the
                             entire pod, allowing resource sharing among containers in a pod.
@@ -5891,7 +5601,7 @@ spec:
                                 Claims lists the names of resources, defined in spec.resourceClaims,
                                 that are used by this container.
 
-                                This field depends on the
+                                This is an alpha field and requires enabling the
                                 DynamicResourceAllocation feature gate.
 
                                 This field is immutable. It can only be set for containers.
@@ -6416,6 +6126,7 @@ spec:
                                   - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
 
                                   If this value is nil, the behavior is equivalent to the Honor policy.
+                                  This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                                 type: string
                               nodeTaintsPolicy:
                                 description: |-
@@ -6426,6 +6137,7 @@ spec:
                                   - Ignore: node taints are ignored. All nodes are included.
 
                                   If this value is nil, the behavior is equivalent to the Ignore policy.
+                                  This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                                 type: string
                               topologyKey:
                                 description: |-
@@ -7131,13 +6843,15 @@ spec:
                                               volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                               If specified, the CSI driver will create or update the volume with the attributes defined
                                               in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                              it can be changed after the claim is created. An empty string or nil value indicates that no
-                                              VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
-                                              this field can be reset to its previous value (including nil) to cancel the modification.
+                                              it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
+                                              will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
+                                              If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
+                                              will be set by the persistentvolume controller if it exists.
                                               If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                               set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                               exists.
                                               More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
+                                              (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                             type: string
                                           volumeMode:
                                             description: |-
@@ -7311,9 +7025,12 @@ spec:
                                 description: |-
                                   glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                   Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
+                                  More info: https://examples.k8s.io/volumes/glusterfs/README.md
                                 properties:
                                   endpoints:
-                                    description: endpoints is the endpoint name that details Glusterfs topology.
+                                    description: |-
+                                      endpoints is the endpoint name that details Glusterfs topology.
+                                      More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
                                     type: string
                                   path:
                                     description: |-
@@ -7367,7 +7084,7 @@ spec:
                                   The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
                                   The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
                                   The volume will be mounted read-only (ro) and non-executable files (noexec).
-                                  Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
+                                  Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
                                   The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
                                 properties:
                                   pullPolicy:
@@ -7392,7 +7109,7 @@ spec:
                                 description: |-
                                   iscsi represents an ISCSI Disk resource that is attached to a
                                   kubelet's host machine and then exposed to the pod.
-                                  More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
+                                  More info: https://examples.k8s.io/volumes/iscsi/README.md
                                 properties:
                                   chapAuthDiscovery:
                                     description: chapAuthDiscovery defines whether support iSCSI Discovery CHAP authentication
@@ -7782,110 +7499,6 @@ spec:
                                               type: array
                                               x-kubernetes-list-type: atomic
                                           type: object
-                                        podCertificate:
-                                          description: |-
-                                            Projects an auto-rotating credential bundle (private key and certificate
-                                            chain) that the pod can use either as a TLS client or server.
-
-                                            Kubelet generates a private key and uses it to send a
-                                            PodCertificateRequest to the named signer.  Once the signer approves the
-                                            request and issues a certificate chain, Kubelet writes the key and
-                                            certificate chain to the pod filesystem.  The pod does not start until
-                                            certificates have been issued for each podCertificate projected volume
-                                            source in its spec.
-
-                                            Kubelet will begin trying to rotate the certificate at the time indicated
-                                            by the signer using the PodCertificateRequest.Status.BeginRefreshAt
-                                            timestamp.
-
-                                            Kubelet can write a single file, indicated by the credentialBundlePath
-                                            field, or separate files, indicated by the keyPath and
-                                            certificateChainPath fields.
-
-                                            The credential bundle is a single file in PEM format.  The first PEM
-                                            entry is the private key (in PKCS#8 format), and the remaining PEM
-                                            entries are the certificate chain issued by the signer (typically,
-                                            signers will return their certificate chain in leaf-to-root order).
-
-                                            Prefer using the credential bundle format, since your application code
-                                            can read it atomically.  If you use keyPath and certificateChainPath,
-                                            your application must make two separate file reads. If these coincide
-                                            with a certificate rotation, it is possible that the private key and leaf
-                                            certificate you read may not correspond to each other.  Your application
-                                            will need to check for this condition, and re-read until they are
-                                            consistent.
-
-                                            The named signer controls chooses the format of the certificate it
-                                            issues; consult the signer implementation's documentation to learn how to
-                                            use the certificates it issues.
-                                          properties:
-                                            certificateChainPath:
-                                              description: |-
-                                                Write the certificate chain at this path in the projected volume.
-
-                                                Most applications should use credentialBundlePath.  When using keyPath
-                                                and certificateChainPath, your application needs to check that the key
-                                                and leaf certificate are consistent, because it is possible to read the
-                                                files mid-rotation.
-                                              type: string
-                                            credentialBundlePath:
-                                              description: |-
-                                                Write the credential bundle at this path in the projected volume.
-
-                                                The credential bundle is a single file that contains multiple PEM blocks.
-                                                The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
-                                                key.
-
-                                                The remaining blocks are CERTIFICATE blocks, containing the issued
-                                                certificate chain from the signer (leaf and any intermediates).
-
-                                                Using credentialBundlePath lets your Pod's application code make a single
-                                                atomic read that retrieves a consistent key and certificate chain.  If you
-                                                project them to separate files, your application code will need to
-                                                additionally check that the leaf certificate was issued to the key.
-                                              type: string
-                                            keyPath:
-                                              description: |-
-                                                Write the key at this path in the projected volume.
-
-                                                Most applications should use credentialBundlePath.  When using keyPath
-                                                and certificateChainPath, your application needs to check that the key
-                                                and leaf certificate are consistent, because it is possible to read the
-                                                files mid-rotation.
-                                              type: string
-                                            keyType:
-                                              description: |-
-                                                The type of keypair Kubelet will generate for the pod.
-
-                                                Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
-                                                "ECDSAP521", and "ED25519".
-                                              type: string
-                                            maxExpirationSeconds:
-                                              description: |-
-                                                maxExpirationSeconds is the maximum lifetime permitted for the
-                                                certificate.
-
-                                                Kubelet copies this value verbatim into the PodCertificateRequests it
-                                                generates for this projection.
-
-                                                If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
-                                                will reject values shorter than 3600 (1 hour).  The maximum allowable
-                                                value is 7862400 (91 days).
-
-                                                The signer implementation is then free to issue a certificate with any
-                                                lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
-                                                seconds (1 hour).  This constraint is enforced by kube-apiserver.
-                                                `kubernetes.io` signers will never issue certificates with a lifetime
-                                                longer than 24 hours.
-                                              format: int32
-                                              type: integer
-                                            signerName:
-                                              description: Kubelet's generated CSRs will be addressed to this signer.
-                                              type: string
-                                          required:
-                                            - keyType
-                                            - signerName
-                                          type: object
                                         secret:
                                           description: secret information about the secret data to project
                                           properties:
@@ -8015,6 +7628,7 @@ spec:
                                 description: |-
                                   rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                   Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
+                                  More info: https://examples.k8s.io/volumes/rbd/README.md
                                 properties:
                                   fsType:
                                     description: |-
@@ -8556,13 +8170,15 @@ spec:
                               volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                               If specified, the CSI driver will create or update the volume with the attributes defined
                               in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                              it can be changed after the claim is created. An empty string or nil value indicates that no
-                              VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
-                              this field can be reset to its previous value (including nil) to cancel the modification.
+                              it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
+                              will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
+                              If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
+                              will be set by the persistentvolume controller if it exists.
                               If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                               set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                               exists.
                               More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
+                              (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                             type: string
                           volumeMode:
                             description: |-
@@ -8662,11 +8278,13 @@ spec:
                             description: |-
                               currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
                               When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
+                              This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                             type: string
                           modifyVolumeStatus:
                             description: |-
                               ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
                               When this is unset, there is no ModifyVolume operation being attempted.
+                              This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                             properties:
                               status:
                                 description: "status is the status of the ControllerModifyVolume operation. It can be in any of following states:\n - Pending\n   Pending indicates that the PersistentVolumeClaim cannot be modified due to unmet requirements, such as\n   the specified VolumeAttributesClass not existing.\n - InProgress\n   InProgress indicates that the volume is being modified.\n - Infeasible\n  Infeasible indicates that the request has been rejected as invalid by the CSI driver. To\n\t  resolve the error, a valid VolumeAttributesClass needs to be specified.\nNote: New statuses can be added in the future. Consumers should check for unknown statuses and fail appropriately."
@@ -8737,6 +8355,7 @@ spec:
                   type: object
               required:
                 - selector
+                - serviceName
                 - template
               type: object
             status:

controllers/actions.github.com/autoscalinglistener_controller.go

@@ -19,7 +19,6 @@ package actionsgithubcom
 import (
 	"context"
 	"fmt"
-	"time"
 
 	"github.com/go-logr/logr"
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
@@ -85,14 +84,14 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl.
 		}
 
 		log.Info("Deleting resources")
-		requeue, err := r.cleanupResources(ctx, autoscalingListener, log)
+		done, err := r.cleanupResources(ctx, autoscalingListener, log)
 		if err != nil {
 			log.Error(err, "Failed to cleanup resources after deletion")
 			return ctrl.Result{}, err
 		}
-		if requeue {
+		if !done {
 			log.Info("Waiting for resources to be deleted before removing finalizer")
-			return ctrl.Result{Requeue: true, RequeueAfter: time.Second}, nil
+			return ctrl.Result{Requeue: true}, nil
 		}
 
 		log.Info("Removing finalizer")
@@ -211,14 +210,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl.
 	// TODO: make sure the role binding has the up-to-date role and service account
 
 	listenerPod := new(corev1.Pod)
-	if err := r.Get(
-		ctx,
-		client.ObjectKey{
-			Namespace: autoscalingListener.Namespace,
-			Name:      autoscalingListener.Name,
-		},
-		listenerPod,
-	); err != nil {
+	if err := r.Get(ctx, client.ObjectKey{Namespace: autoscalingListener.Namespace, Name: autoscalingListener.Name}, listenerPod); err != nil {
 		if !kerrors.IsNotFound(err) {
 			log.Error(err, "Unable to get listener pod", "namespace", autoscalingListener.Namespace, "name", autoscalingListener.Name)
 			return ctrl.Result{}, err
@@ -236,30 +228,37 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl.
 
 	cs := listenerContainerStatus(listenerPod)
 	switch {
-	case listenerPod.Status.Reason == "Evicted":
-		log.Info(
-			"Listener pod is evicted",
-			"phase", listenerPod.Status.Phase,
-			"reason", listenerPod.Status.Reason,
-			"message", listenerPod.Status.Message,
-		)
-
-		return ctrl.Result{}, r.deleteListenerPod(ctx, autoscalingListener, listenerPod, log)
-
 	case cs == nil:
 		log.Info("Listener pod is not ready", "namespace", listenerPod.Namespace, "name", listenerPod.Name)
 		return ctrl.Result{}, nil
 	case cs.State.Terminated != nil:
-		log.Info(
-			"Listener pod is terminated",
-			"namespace", listenerPod.Namespace,
-			"name", listenerPod.Name,
-			"reason", cs.State.Terminated.Reason,
-			"message", cs.State.Terminated.Message,
-		)
+		log.Info("Listener pod is terminated", "namespace", listenerPod.Namespace, "name", listenerPod.Name, "reason", cs.State.Terminated.Reason, "message", cs.State.Terminated.Message)
 
-		return ctrl.Result{}, r.deleteListenerPod(ctx, autoscalingListener, listenerPod, log)
+		if err := r.publishRunningListener(autoscalingListener, false); err != nil {
+			log.Error(err, "Unable to publish runner listener down metric", "namespace", listenerPod.Namespace, "name", listenerPod.Name)
+		}
 
+		if listenerPod.DeletionTimestamp.IsZero() {
+			log.Info("Deleting the listener pod", "namespace", listenerPod.Namespace, "name", listenerPod.Name)
+			if err := r.Delete(ctx, listenerPod); err != nil && !kerrors.IsNotFound(err) {
+				log.Error(err, "Unable to delete the listener pod", "namespace", listenerPod.Namespace, "name", listenerPod.Name)
+				return ctrl.Result{}, err
+			}
+
+			// delete the listener config secret as well, so it gets recreated when the listener pod is recreated, with any new data if it exists
+			var configSecret corev1.Secret
+			err := r.Get(ctx, types.NamespacedName{Namespace: autoscalingListener.Namespace, Name: scaleSetListenerConfigName(autoscalingListener)}, &configSecret)
+			switch {
+			case err == nil && configSecret.DeletionTimestamp.IsZero():
+				log.Info("Deleting the listener config secret")
+				if err := r.Delete(ctx, &configSecret); err != nil {
+					return ctrl.Result{}, fmt.Errorf("failed to delete listener config secret: %w", err)
+				}
+			case !kerrors.IsNotFound(err):
+				return ctrl.Result{}, fmt.Errorf("failed to get the listener config secret: %w", err)
+			}
+		}
+		return ctrl.Result{}, nil
 	case cs.State.Running != nil:
 		if err := r.publishRunningListener(autoscalingListener, true); err != nil {
 			log.Error(err, "Unable to publish running listener", "namespace", listenerPod.Namespace, "name", listenerPod.Name)
@@ -269,40 +268,11 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl.
 			return ctrl.Result{}, nil
 		}
 		return ctrl.Result{}, nil
-
 	}
 	return ctrl.Result{}, nil
 }
 
-func (r *AutoscalingListenerReconciler) deleteListenerPod(ctx context.Context, autoscalingListener *v1alpha1.AutoscalingListener, listenerPod *corev1.Pod, log logr.Logger) error {
-	if err := r.publishRunningListener(autoscalingListener, false); err != nil {
-		log.Error(err, "Unable to publish runner listener down metric", "namespace", listenerPod.Namespace, "name", listenerPod.Name)
-	}
-
-	if listenerPod.DeletionTimestamp.IsZero() {
-		log.Info("Deleting the listener pod", "namespace", listenerPod.Namespace, "name", listenerPod.Name)
-		if err := r.Delete(ctx, listenerPod); err != nil && !kerrors.IsNotFound(err) {
-			log.Error(err, "Unable to delete the listener pod", "namespace", listenerPod.Namespace, "name", listenerPod.Name)
-			return err
-		}
-
-		// delete the listener config secret as well, so it gets recreated when the listener pod is recreated, with any new data if it exists
-		var configSecret corev1.Secret
-		err := r.Get(ctx, types.NamespacedName{Namespace: autoscalingListener.Namespace, Name: scaleSetListenerConfigName(autoscalingListener)}, &configSecret)
-		switch {
-		case err == nil && configSecret.DeletionTimestamp.IsZero():
-			log.Info("Deleting the listener config secret")
-			if err := r.Delete(ctx, &configSecret); err != nil {
-				return fmt.Errorf("failed to delete listener config secret: %w", err)
-			}
-		case !kerrors.IsNotFound(err):
-			return fmt.Errorf("failed to get the listener config secret: %w", err)
-		}
-	}
-	return nil
-}
-
-func (r *AutoscalingListenerReconciler) cleanupResources(ctx context.Context, autoscalingListener *v1alpha1.AutoscalingListener, logger logr.Logger) (requeue bool, err error) {
+func (r *AutoscalingListenerReconciler) cleanupResources(ctx context.Context, autoscalingListener *v1alpha1.AutoscalingListener, logger logr.Logger) (done bool, err error) {
 	logger.Info("Cleaning up the listener pod")
 	listenerPod := new(corev1.Pod)
 	err = r.Get(ctx, types.NamespacedName{Name: autoscalingListener.Name, Namespace: autoscalingListener.Namespace}, listenerPod)
@@ -314,7 +284,7 @@ func (r *AutoscalingListenerReconciler) cleanupResources(ctx context.Context, au
 				return false, fmt.Errorf("failed to delete listener pod: %w", err)
 			}
 		}
-		requeue = true
+		return false, nil
 	case kerrors.IsNotFound(err):
 		_ = r.publishRunningListener(autoscalingListener, false) // If error is returned, we never published metrics so it is safe to ignore
 	default:
@@ -332,7 +302,7 @@ func (r *AutoscalingListenerReconciler) cleanupResources(ctx context.Context, au
 				return false, fmt.Errorf("failed to delete listener config secret: %w", err)
 			}
 		}
-		requeue = true
+		return false, nil
 	case !kerrors.IsNotFound(err):
 		return false, fmt.Errorf("failed to get listener config secret: %w", err)
 	}
@@ -349,7 +319,7 @@ func (r *AutoscalingListenerReconciler) cleanupResources(ctx context.Context, au
 					return false, fmt.Errorf("failed to delete listener proxy secret: %w", err)
 				}
 			}
-			requeue = true
+			return false, nil
 		case !kerrors.IsNotFound(err):
 			return false, fmt.Errorf("failed to get listener proxy secret: %w", err)
 		}
@@ -366,7 +336,7 @@ func (r *AutoscalingListenerReconciler) cleanupResources(ctx context.Context, au
 				return false, fmt.Errorf("failed to delete listener role binding: %w", err)
 			}
 		}
-		requeue = true
+		return false, nil
 	case !kerrors.IsNotFound(err):
 		return false, fmt.Errorf("failed to get listener role binding: %w", err)
 	}
@@ -382,7 +352,7 @@ func (r *AutoscalingListenerReconciler) cleanupResources(ctx context.Context, au
 				return false, fmt.Errorf("failed to delete listener role: %w", err)
 			}
 		}
-		requeue = true
+		return false, nil
 	case !kerrors.IsNotFound(err):
 		return false, fmt.Errorf("failed to get listener role: %w", err)
 	}
@@ -399,13 +369,13 @@ func (r *AutoscalingListenerReconciler) cleanupResources(ctx context.Context, au
 				return false, fmt.Errorf("failed to delete listener service account: %w", err)
 			}
 		}
-		requeue = true
+		return false, nil
 	case !kerrors.IsNotFound(err):
 		return false, fmt.Errorf("failed to get listener service account: %w", err)
 	}
 	logger.Info("Listener service account is deleted")
 
-	return requeue, nil
+	return true, nil
 }
 
 func (r *AutoscalingListenerReconciler) createServiceAccountForListener(ctx context.Context, autoscalingListener *v1alpha1.AutoscalingListener, logger logr.Logger) (ctrl.Result, error) {

controllers/actions.github.com/autoscalinglistener_controller_test.go

@@ -26,8 +26,9 @@ import (
 )
 
 const (
-	autoscalingListenerTestTimeout  = time.Second * 20
-	autoscalingListenerTestInterval = time.Millisecond * 250
+	autoscalingListenerTestTimeout     = time.Second * 20
+	autoscalingListenerTestInterval    = time.Millisecond * 250
+	autoscalingListenerTestGitHubToken = "gh_token"
 )
 
 var _ = Describe("Test AutoScalingListener controller", func() {
@@ -671,55 +672,6 @@ var _ = Describe("Test AutoScalingListener customization", func() {
 				autoscalingListenerTestInterval,
 			).ShouldNot(BeEquivalentTo(oldPodUID), "Pod should be created")
 		})
-
-		It("Should re-create pod when the listener pod is evicted", func() {
-			pod := new(corev1.Pod)
-			Eventually(
-				func() (string, error) {
-					err := k8sClient.Get(
-						ctx,
-						client.ObjectKey{
-							Name:      autoscalingListener.Name,
-							Namespace: autoscalingListener.Namespace,
-						},
-						pod,
-					)
-					if err != nil {
-						return "", err
-					}
-
-					return pod.Name, nil
-				},
-				autoscalingListenerTestTimeout,
-				autoscalingListenerTestInterval,
-			).Should(
-				BeEquivalentTo(autoscalingListener.Name),
-				"Pod should be created",
-			)
-
-			updated := pod.DeepCopy()
-			oldPodUID := string(pod.UID)
-			updated.Status.Reason = "Evicted"
-			err := k8sClient.Status().Update(ctx, updated)
-			Expect(err).NotTo(HaveOccurred(), "failed to update pod status")
-
-			pod = new(corev1.Pod)
-			Eventually(
-				func() (string, error) {
-					err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingListener.Name, Namespace: autoscalingListener.Namespace}, pod)
-					if err != nil {
-						return "", err
-					}
-
-					return string(pod.UID), nil
-				},
-				autoscalingListenerTestTimeout,
-				autoscalingListenerTestInterval,
-			).ShouldNot(
-				BeEquivalentTo(oldPodUID),
-				"Pod should be created",
-			)
-		})
 	})
 })
 

controllers/actions.github.com/autoscalingrunnerset_controller.go

@@ -48,7 +48,7 @@ const (
 	annotationKeyValuesHash = "actions.github.com/values-hash"
 
 	autoscalingRunnerSetFinalizerName = "autoscalingrunnerset.actions.github.com/finalizer"
-	runnerScaleSetIDAnnotationKey     = "runner-scale-set-id"
+	runnerScaleSetIdAnnotationKey     = "runner-scale-set-id"
 )
 
 type UpdateStrategy string
@@ -180,14 +180,14 @@ func (r *AutoscalingRunnerSetReconciler) Reconcile(ctx context.Context, req ctrl
 		return ctrl.Result{}, nil
 	}
 
-	scaleSetIDRaw, ok := autoscalingRunnerSet.Annotations[runnerScaleSetIDAnnotationKey]
+	scaleSetIdRaw, ok := autoscalingRunnerSet.Annotations[runnerScaleSetIdAnnotationKey]
 	if !ok {
 		// Need to create a new runner scale set on Actions service
 		log.Info("Runner scale set id annotation does not exist. Creating a new runner scale set.")
 		return r.createRunnerScaleSet(ctx, autoscalingRunnerSet, log)
 	}
 
-	if id, err := strconv.Atoi(scaleSetIDRaw); err != nil || id <= 0 {
+	if id, err := strconv.Atoi(scaleSetIdRaw); err != nil || id <= 0 {
 		log.Info("Runner scale set id annotation is not an id, or is <= 0. Creating a new runner scale set.")
 		// something modified the scaleSetId. Try to create one
 		return r.createRunnerScaleSet(ctx, autoscalingRunnerSet, log)
@@ -403,7 +403,7 @@ func (r *AutoscalingRunnerSetReconciler) createRunnerScaleSet(ctx context.Contex
 		return ctrl.Result{}, err
 	}
 
-	runnerGroupID := 1
+	runnerGroupId := 1
 	if len(autoscalingRunnerSet.Spec.RunnerGroup) > 0 {
 		runnerGroup, err := actionsClient.GetRunnerGroupByName(ctx, autoscalingRunnerSet.Spec.RunnerGroup)
 		if err != nil {
@@ -411,14 +411,14 @@ func (r *AutoscalingRunnerSetReconciler) createRunnerScaleSet(ctx context.Contex
 			return ctrl.Result{}, err
 		}
 
-		runnerGroupID = int(runnerGroup.ID)
+		runnerGroupId = int(runnerGroup.ID)
 	}
 
-	runnerScaleSet, err := actionsClient.GetRunnerScaleSet(ctx, runnerGroupID, autoscalingRunnerSet.Spec.RunnerScaleSetName)
+	runnerScaleSet, err := actionsClient.GetRunnerScaleSet(ctx, runnerGroupId, autoscalingRunnerSet.Spec.RunnerScaleSetName)
 	if err != nil {
 		logger.Error(err, "Failed to get runner scale set from Actions service",
 			"runnerGroupId",
-			strconv.Itoa(runnerGroupID),
+			strconv.Itoa(runnerGroupId),
 			"runnerScaleSetName",
 			autoscalingRunnerSet.Spec.RunnerScaleSetName)
 		return ctrl.Result{}, err
@@ -429,7 +429,7 @@ func (r *AutoscalingRunnerSetReconciler) createRunnerScaleSet(ctx context.Contex
 			ctx,
 			&actions.RunnerScaleSet{
 				Name:          autoscalingRunnerSet.Spec.RunnerScaleSetName,
-				RunnerGroupId: runnerGroupID,
+				RunnerGroupId: runnerGroupId,
 				Labels: []actions.Label{
 					{
 						Name: autoscalingRunnerSet.Spec.RunnerScaleSetName,
@@ -466,7 +466,7 @@ func (r *AutoscalingRunnerSetReconciler) createRunnerScaleSet(ctx context.Contex
 	logger.Info("Adding runner scale set ID, name and runner group name as an annotation and url labels")
 	if err = patch(ctx, r.Client, autoscalingRunnerSet, func(obj *v1alpha1.AutoscalingRunnerSet) {
 		obj.Annotations[AnnotationKeyGitHubRunnerScaleSetName] = runnerScaleSet.Name
-		obj.Annotations[runnerScaleSetIDAnnotationKey] = strconv.Itoa(runnerScaleSet.Id)
+		obj.Annotations[runnerScaleSetIdAnnotationKey] = strconv.Itoa(runnerScaleSet.Id)
 		obj.Annotations[AnnotationKeyGitHubRunnerGroupName] = runnerScaleSet.RunnerGroupName
 		if err := applyGitHubURLLabels(obj.Spec.GitHubConfigUrl, obj.Labels); err != nil { // should never happen
 			logger.Error(err, "Failed to apply GitHub URL labels")
@@ -484,7 +484,7 @@ func (r *AutoscalingRunnerSetReconciler) createRunnerScaleSet(ctx context.Contex
 }
 
 func (r *AutoscalingRunnerSetReconciler) updateRunnerScaleSetRunnerGroup(ctx context.Context, autoscalingRunnerSet *v1alpha1.AutoscalingRunnerSet, logger logr.Logger) (ctrl.Result, error) {
-	runnerScaleSetID, err := strconv.Atoi(autoscalingRunnerSet.Annotations[runnerScaleSetIDAnnotationKey])
+	runnerScaleSetId, err := strconv.Atoi(autoscalingRunnerSet.Annotations[runnerScaleSetIdAnnotationKey])
 	if err != nil {
 		logger.Error(err, "Failed to parse runner scale set ID")
 		return ctrl.Result{}, err
@@ -496,7 +496,7 @@ func (r *AutoscalingRunnerSetReconciler) updateRunnerScaleSetRunnerGroup(ctx con
 		return ctrl.Result{}, err
 	}
 
-	runnerGroupID := 1
+	runnerGroupId := 1
 	if len(autoscalingRunnerSet.Spec.RunnerGroup) > 0 {
 		runnerGroup, err := actionsClient.GetRunnerGroupByName(ctx, autoscalingRunnerSet.Spec.RunnerGroup)
 		if err != nil {
@@ -504,12 +504,12 @@ func (r *AutoscalingRunnerSetReconciler) updateRunnerScaleSetRunnerGroup(ctx con
 			return ctrl.Result{}, err
 		}
 
-		runnerGroupID = int(runnerGroup.ID)
+		runnerGroupId = int(runnerGroup.ID)
 	}
 
-	updatedRunnerScaleSet, err := actionsClient.UpdateRunnerScaleSet(ctx, runnerScaleSetID, &actions.RunnerScaleSet{RunnerGroupId: runnerGroupID})
+	updatedRunnerScaleSet, err := actionsClient.UpdateRunnerScaleSet(ctx, runnerScaleSetId, &actions.RunnerScaleSet{RunnerGroupId: runnerGroupId})
 	if err != nil {
-		logger.Error(err, "Failed to update runner scale set", "runnerScaleSetId", runnerScaleSetID)
+		logger.Error(err, "Failed to update runner scale set", "runnerScaleSetId", runnerScaleSetId)
 		return ctrl.Result{}, err
 	}
 
@@ -527,7 +527,7 @@ func (r *AutoscalingRunnerSetReconciler) updateRunnerScaleSetRunnerGroup(ctx con
 }
 
 func (r *AutoscalingRunnerSetReconciler) updateRunnerScaleSetName(ctx context.Context, autoscalingRunnerSet *v1alpha1.AutoscalingRunnerSet, logger logr.Logger) (ctrl.Result, error) {
-	runnerScaleSetID, err := strconv.Atoi(autoscalingRunnerSet.Annotations[runnerScaleSetIDAnnotationKey])
+	runnerScaleSetId, err := strconv.Atoi(autoscalingRunnerSet.Annotations[runnerScaleSetIdAnnotationKey])
 	if err != nil {
 		logger.Error(err, "Failed to parse runner scale set ID")
 		return ctrl.Result{}, err
@@ -544,9 +544,9 @@ func (r *AutoscalingRunnerSetReconciler) updateRunnerScaleSetName(ctx context.Co
 		return ctrl.Result{}, err
 	}
 
-	updatedRunnerScaleSet, err := actionsClient.UpdateRunnerScaleSet(ctx, runnerScaleSetID, &actions.RunnerScaleSet{Name: autoscalingRunnerSet.Spec.RunnerScaleSetName})
+	updatedRunnerScaleSet, err := actionsClient.UpdateRunnerScaleSet(ctx, runnerScaleSetId, &actions.RunnerScaleSet{Name: autoscalingRunnerSet.Spec.RunnerScaleSetName})
 	if err != nil {
-		logger.Error(err, "Failed to update runner scale set", "runnerScaleSetId", runnerScaleSetID)
+		logger.Error(err, "Failed to update runner scale set", "runnerScaleSetId", runnerScaleSetId)
 		return ctrl.Result{}, err
 	}
 
@@ -563,7 +563,7 @@ func (r *AutoscalingRunnerSetReconciler) updateRunnerScaleSetName(ctx context.Co
 }
 
 func (r *AutoscalingRunnerSetReconciler) deleteRunnerScaleSet(ctx context.Context, autoscalingRunnerSet *v1alpha1.AutoscalingRunnerSet, logger logr.Logger) error {
-	scaleSetID, ok := autoscalingRunnerSet.Annotations[runnerScaleSetIDAnnotationKey]
+	scaleSetId, ok := autoscalingRunnerSet.Annotations[runnerScaleSetIdAnnotationKey]
 	if !ok {
 		// Annotation not being present can occur in 3 scenarios
 		// 1. Scale set is never created.
@@ -580,7 +580,7 @@ func (r *AutoscalingRunnerSetReconciler) deleteRunnerScaleSet(ctx context.Contex
 		return nil
 	}
 	logger.Info("Deleting the runner scale set from Actions service")
-	runnerScaleSetID, err := strconv.Atoi(scaleSetID)
+	runnerScaleSetId, err := strconv.Atoi(scaleSetId)
 	if err != nil {
 		// If the annotation is not set correctly, we are going to get stuck in a loop trying to parse the scale set id.
 		// If the configuration is invalid (secret does not exist for example), we never got to the point to create runner set.
@@ -595,17 +595,17 @@ func (r *AutoscalingRunnerSetReconciler) deleteRunnerScaleSet(ctx context.Contex
 		return err
 	}
 
-	err = actionsClient.DeleteRunnerScaleSet(ctx, runnerScaleSetID)
+	err = actionsClient.DeleteRunnerScaleSet(ctx, runnerScaleSetId)
 	if err != nil {
-		logger.Error(err, "Failed to delete runner scale set", "runnerScaleSetId", runnerScaleSetID)
+		logger.Error(err, "Failed to delete runner scale set", "runnerScaleSetId", runnerScaleSetId)
 		return err
 	}
 
 	err = patch(ctx, r.Client, autoscalingRunnerSet, func(obj *v1alpha1.AutoscalingRunnerSet) {
-		delete(obj.Annotations, runnerScaleSetIDAnnotationKey)
+		delete(obj.Annotations, runnerScaleSetIdAnnotationKey)
 	})
 	if err != nil {
-		logger.Error(err, "Failed to patch autoscaling runner set with annotation removed", "annotation", runnerScaleSetIDAnnotationKey)
+		logger.Error(err, "Failed to patch autoscaling runner set with annotation removed", "annotation", runnerScaleSetIdAnnotationKey)
 		return err
 	}
 
@@ -1006,7 +1006,6 @@ func (c *autoscalingRunnerSetFinalizerDependencyCleaner) removeManagerRoleFinali
 
 // NOTE: if this is logic should be used for other resources,
 // consider using generics
-
 type EphemeralRunnerSets struct {
 	list   *v1alpha1.EphemeralRunnerSetList
 	sorted bool

controllers/actions.github.com/autoscalingrunnerset_controller_test.go

@@ -34,8 +34,9 @@ import (
 )
 
 const (
-	autoscalingRunnerSetTestTimeout  = time.Second * 20
-	autoscalingRunnerSetTestInterval = time.Millisecond * 250
+	autoscalingRunnerSetTestTimeout     = time.Second * 20
+	autoscalingRunnerSetTestInterval    = time.Millisecond * 250
+	autoscalingRunnerSetTestGitHubToken = "gh_token"
 )
 
 var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() {
@@ -140,7 +141,7 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() {
 						return "", err
 					}
 
-					if _, ok := created.Annotations[runnerScaleSetIDAnnotationKey]; !ok {
+					if _, ok := created.Annotations[runnerScaleSetIdAnnotationKey]; !ok {
 						return "", nil
 					}
 
@@ -148,7 +149,7 @@ var _ = Describe("Test AutoScalingRunnerSet controller", Ordered, func() {
 						return "", nil
 					}
 
-					return fmt.Sprintf("%s_%s", created.Annotations[runnerScaleSetIDAnnotationKey], created.Annotations[AnnotationKeyGitHubRunnerGroupName]), nil
+					return fmt.Sprintf("%s_%s", created.Annotations[runnerScaleSetIdAnnotationKey], created.Annotations[AnnotationKeyGitHubRunnerGroupName]), nil
 				},
 				autoscalingRunnerSetTestTimeout,
 				autoscalingRunnerSetTestInterval).Should(BeEquivalentTo("1_testgroup"), "RunnerScaleSet should be created/fetched and update the AutoScalingRunnerSet's annotation")

controllers/actions.github.com/constants.go

@@ -28,9 +28,6 @@ const (
 	LabelKeyKubernetesComponent = "app.kubernetes.io/component"
 	LabelKeyKubernetesVersion   = "app.kubernetes.io/version"
 
-	// Well-known Kubernetes node labels
-	LabelKeyKubernetesOS = "kubernetes.io/os"
-
 	// Github labels
 	LabelKeyGitHubScaleSetName      = "actions.github.com/scale-set-name"
 	LabelKeyGitHubScaleSetNamespace = "actions.github.com/scale-set-namespace"
@@ -39,8 +36,7 @@ const (
 	LabelKeyGitHubRepository        = "actions.github.com/repository"
 )
 
-// AutoscalingRunnerSetCleanupFinalizerName is a finalizer used to protect resources
-// from deletion while AutoscalingRunnerSet is running
+// Finalizer used to protect resources from deletion while AutoscalingRunnerSet is running
 const AutoscalingRunnerSetCleanupFinalizerName = "actions.github.com/cleanup-protection"
 
 const (

controllers/actions.github.com/ephemeralrunner_controller.go

@@ -22,7 +22,6 @@ import (
 	"fmt"
 	"net/http"
 	"strconv"
-	"strings"
 	"time"
 
 	"github.com/actions/actions-runner-controller/apis/actions.github.com/v1alpha1"
@@ -154,17 +153,31 @@ func (r *EphemeralRunnerReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		return ctrl.Result{}, nil
 	}
 
-	addFinalizers := !controllerutil.ContainsFinalizer(ephemeralRunner, ephemeralRunnerFinalizerName) || !controllerutil.ContainsFinalizer(ephemeralRunner, ephemeralRunnerActionsFinalizerName)
-	if addFinalizers {
-		log.Info("Adding finalizers")
+	if !controllerutil.ContainsFinalizer(ephemeralRunner, ephemeralRunnerFinalizerName) {
+		log.Info("Adding finalizer")
 		if err := patch(ctx, r.Client, ephemeralRunner, func(obj *v1alpha1.EphemeralRunner) {
 			controllerutil.AddFinalizer(obj, ephemeralRunnerFinalizerName)
-			controllerutil.AddFinalizer(obj, ephemeralRunnerActionsFinalizerName)
 		}); err != nil {
 			log.Error(err, "Failed to update with finalizer set")
 			return ctrl.Result{}, err
 		}
-		log.Info("Successfully added finalizers")
+
+		log.Info("Successfully added finalizer")
+		return ctrl.Result{}, nil
+	}
+
+	if !controllerutil.ContainsFinalizer(ephemeralRunner, ephemeralRunnerActionsFinalizerName) {
+		log.Info("Adding runner registration finalizer")
+		err := patch(ctx, r.Client, ephemeralRunner, func(obj *v1alpha1.EphemeralRunner) {
+			controllerutil.AddFinalizer(obj, ephemeralRunnerActionsFinalizerName)
+		})
+		if err != nil {
+			log.Error(err, "Failed to update with runner registration finalizer set")
+			return ctrl.Result{}, err
+		}
+
+		log.Info("Successfully added runner registration finalizer")
+		return ctrl.Result{}, nil
 	}
 
 	secret := new(corev1.Secret)
@@ -269,34 +282,7 @@ func (r *EphemeralRunnerReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		case kerrors.IsAlreadyExists(err):
 			log.Info("Runner pod already exists. Waiting for the pod event to be received")
 			return ctrl.Result{Requeue: true, RequeueAfter: 5 * time.Second}, nil
-		case kerrors.IsInvalid(err):
-			log.Error(err, "Failed to create a pod due to unrecoverable failure")
-			errMessage := fmt.Sprintf("Failed to create the pod: %v", err)
-			if err := r.markAsFailed(ctx, ephemeralRunner, errMessage, ReasonInvalidPodFailure, log); err != nil {
-				log.Error(err, "Failed to set ephemeral runner to phase Failed")
-				return ctrl.Result{}, err
-			}
-			return ctrl.Result{}, nil
-		case kerrors.IsForbidden(err):
-			if status, ok := err.(kerrors.APIStatus); ok || errors.As(err, &status) {
-				isResourceQuotaExceeded := strings.Contains(status.Status().Message, "exceeded quota:")
-				isAboutToExpire := ephemeralRunner.CreationTimestamp.Time.Add(10 * time.Minute).Before(time.Now())
-				switch {
-				case isResourceQuotaExceeded && isAboutToExpire:
-					log.Error(err, "Failed to create a pod due to resource quota exceeded and the ephemeral runner is about to expire; re-creating the ephemeral runner")
-					if err := r.Delete(ctx, ephemeralRunner); err != nil {
-						log.Error(err, "Failed to delete the ephemeral runner")
-						return ctrl.Result{}, err
-					}
-					return ctrl.Result{}, nil
-				case isResourceQuotaExceeded:
-					log.Error(err, "Resource quota is exceeded; requeue in 30s to retry pod creation")
-					return ctrl.Result{RequeueAfter: 30 * time.Second}, nil
-				default:
-					// other forbidden errors
-					// fallthrough to the default handling below
-				}
-			}
+		case kerrors.IsInvalid(err) || kerrors.IsForbidden(err):
 			log.Error(err, "Failed to create a pod due to unrecoverable failure")
 			errMessage := fmt.Sprintf("Failed to create the pod: %v", err)
 			if err := r.markAsFailed(ctx, ephemeralRunner, errMessage, ReasonInvalidPodFailure, log); err != nil {
@@ -312,46 +298,26 @@ func (r *EphemeralRunnerReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 
 	cs := runnerContainerStatus(pod)
 	switch {
-	case pod.Status.Phase == corev1.PodFailed: // All containers are stopped
-		log.Info("Pod is in failed phase, inspecting runner container status",
-			"podReason", pod.Status.Reason,
-			"podMessage", pod.Status.Message,
-			"podConditions", pod.Status.Conditions,
-		)
-		// If the runner pod did not have chance to start, terminated state may not be set.
-		// Therefore, we should try to restart it.
-		if cs == nil || cs.State.Terminated == nil {
-			log.Info("Runner container does not have state set, deleting pod as failed so it can be restarted")
-			return ctrl.Result{}, r.deleteEphemeralRunnerOrPod(ctx, ephemeralRunner, pod, log)
-		}
+	case cs == nil:
+		// starting, no container state yet
+		log.Info("Waiting for runner container status to be available")
+		return ctrl.Result{}, nil
+	case cs.State.Terminated == nil: // still running or evicted
+		if pod.Status.Phase == corev1.PodFailed && pod.Status.Reason == "Evicted" {
+			log.Info("Pod set the termination phase, but container state is not terminated. Deleting pod",
+				"PodPhase", pod.Status.Phase,
+				"PodReason", pod.Status.Reason,
+				"PodMessage", pod.Status.Message,
+			)
 
-		if cs.State.Terminated.ExitCode == 0 {
-			log.Info("Runner container has succeeded but pod is in failed phase; Assume successful exit")
-			// If the pod is in a failed state, that means that at least one container exited with non-zero exit code.
-			// If the runner container exits with 0, we assume that the runner has finished successfully.
-			// If side-car container exits with non-zero, it shouldn't affect the runner. Runner exit code
-			// drives the controller's inference of whether the job has succeeded or failed.
-			if err := r.Delete(ctx, ephemeralRunner); err != nil {
-				log.Error(err, "Failed to delete ephemeral runner after successful completion")
+			if err := r.deletePodAsFailed(ctx, ephemeralRunner, pod, log); err != nil {
+				log.Error(err, "failed to delete pod as failed on pod.Status.Phase: Failed")
 				return ctrl.Result{}, err
 			}
 			return ctrl.Result{}, nil
 		}
 
-		log.Error(
-			errors.New("ephemeral runner container has failed, with runner container exit code non-zero"),
-			"Ephemeral runner container has failed, and runner container termination exit code is non-zero",
-			"containerTerminatedState", cs.State.Terminated,
-		)
-		return ctrl.Result{}, r.deleteEphemeralRunnerOrPod(ctx, ephemeralRunner, pod, log)
-
-	case cs == nil:
-		// starting, no container state yet
-		log.Info("Waiting for runner container status to be available")
-		return ctrl.Result{}, nil
-
-	case cs.State.Terminated == nil: // container is not terminated and pod phase is not failed, so runner is still running
-		log.Info("Runner container is still running; updating ephemeral runner status")
+		log.Info("Ephemeral runner container is still running")
 		if err := r.updateRunStatusFromPod(ctx, ephemeralRunner, pod, log); err != nil {
 			log.Info("Failed to update ephemeral runner status. Requeue to not miss this event")
 			return ctrl.Result{}, err
@@ -360,7 +326,23 @@ func (r *EphemeralRunnerReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 
 	case cs.State.Terminated.ExitCode != 0: // failed
 		log.Info("Ephemeral runner container failed", "exitCode", cs.State.Terminated.ExitCode)
-		return ctrl.Result{}, r.deleteEphemeralRunnerOrPod(ctx, ephemeralRunner, pod, log)
+		if ephemeralRunner.HasJob() {
+			log.Error(
+				errors.New("ephemeral runner has a job assigned, but the pod has failed"),
+				"Ephemeral runner either has faulty entrypoint or something external killing the runner",
+			)
+			log.Info("Deleting the ephemeral runner that has a job assigned but the pod has failed")
+			if err := r.Delete(ctx, ephemeralRunner); err != nil {
+				log.Error(err, "Failed to delete the ephemeral runner that has a job assigned but the pod has failed")
+				return ctrl.Result{}, err
+			}
+			return ctrl.Result{}, nil
+		}
+		if err := r.deletePodAsFailed(ctx, ephemeralRunner, pod, log); err != nil {
+			log.Error(err, "Failed to delete runner pod on failure")
+			return ctrl.Result{}, err
+		}
+		return ctrl.Result{}, nil
 
 	default: // succeeded
 		log.Info("Ephemeral runner has finished successfully, deleting ephemeral runner", "exitCode", cs.State.Terminated.ExitCode)
@@ -372,41 +354,6 @@ func (r *EphemeralRunnerReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 	}
 }
 
-func (r *EphemeralRunnerReconciler) deleteEphemeralRunnerOrPod(ctx context.Context, ephemeralRunner *v1alpha1.EphemeralRunner, pod *corev1.Pod, log logr.Logger) error {
-	if ephemeralRunner.HasJob() {
-		log.Error(
-			errors.New("ephemeral runner has a job assigned, but the pod has failed"),
-			"Ephemeral runner either has faulty entrypoint or something external killing the runner",
-		)
-		log.Info("Deleting the ephemeral runner that has a job assigned but the pod has failed")
-		if err := r.Delete(ctx, ephemeralRunner); err != nil {
-			log.Error(err, "Failed to delete the ephemeral runner that has a job assigned but the pod has failed")
-			return err
-		}
-
-		log.Info("Deleted the ephemeral runner that has a job assigned but the pod has failed")
-		log.Info("Trying to remove the runner from the service")
-		actionsClient, err := r.GetActionsService(ctx, ephemeralRunner)
-		if err != nil {
-			log.Error(err, "Failed to get actions client for removing the runner from the service")
-			return nil
-		}
-		if err := actionsClient.RemoveRunner(ctx, int64(ephemeralRunner.Status.RunnerId)); err != nil {
-			log.Error(err, "Failed to remove the runner from the service")
-			return nil
-		}
-		log.Info("Removed the runner from the service")
-		return nil
-	}
-
-	if err := r.deletePodAsFailed(ctx, ephemeralRunner, pod, log); err != nil {
-		log.Error(err, "Failed to delete runner pod on failure")
-		return err
-	}
-
-	return nil
-}
-
 func (r *EphemeralRunnerReconciler) cleanupRunnerFromService(ctx context.Context, ephemeralRunner *v1alpha1.EphemeralRunner, log logr.Logger) (ok bool, err error) {
 	if err := r.deleteRunnerFromService(ctx, ephemeralRunner, log); err != nil {
 		actionsError := &actions.ActionsError{}
@@ -572,8 +519,6 @@ func (r *EphemeralRunnerReconciler) markAsFailed(ctx context.Context, ephemeralR
 
 // deletePodAsFailed is responsible for deleting the pod and updating the .Status.Failures for tracking failure count.
 // It should not be responsible for setting the status to Failed.
-//
-// It should be called by deleteEphemeralRunnerOrPod which is responsible for deciding whether to delete the EphemeralRunner or just the Pod.
 func (r *EphemeralRunnerReconciler) deletePodAsFailed(ctx context.Context, ephemeralRunner *v1alpha1.EphemeralRunner, pod *corev1.Pod, log logr.Logger) error {
 	if pod.DeletionTimestamp.IsZero() {
 		log.Info("Deleting the ephemeral runner pod", "podId", pod.UID)
@@ -717,7 +662,7 @@ func (r *EphemeralRunnerReconciler) createPod(ctx context.Context, runner *v1alp
 	}
 
 	log.Info("Creating new pod for ephemeral runner")
-	newPod := r.newEphemeralRunnerPod(runner, secret, envs...)
+	newPod := r.newEphemeralRunnerPod(ctx, runner, secret, envs...)
 
 	if err := ctrl.SetControllerReference(runner, newPod, r.Scheme); err != nil {
 		log.Error(err, "Failed to set controller reference to a new pod")

controllers/actions.github.com/ephemeralrunner_controller_test.go

@@ -261,238 +261,6 @@ var _ = Describe("EphemeralRunner", func() {
 			).Should(BeTrue(), "Ephemeral runner should eventually be deleted")
 		})
 
-		It("It should delete ephemeral runner when pod failed before runner state is recorded and job assigned", func() {
-			er := new(v1alpha1.EphemeralRunner)
-			Eventually(func() error {
-				return k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, er)
-			}, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(Succeed(), "failed to get ephemeral runner")
-
-			er.Status.JobID = "1"
-			err := k8sClient.Status().Update(ctx, er)
-			Expect(err).To(BeNil(), "failed to update ephemeral runner status")
-
-			Eventually(func() (string, error) {
-				current := new(v1alpha1.EphemeralRunner)
-				if err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, current); err != nil {
-					return "", err
-				}
-				return current.Status.JobID, nil
-			}, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(BeEquivalentTo("1"))
-
-			pod := new(corev1.Pod)
-			Eventually(func() (bool, error) {
-				if err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, pod); err != nil {
-					return false, err
-				}
-				return true, nil
-			}, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(BeEquivalentTo(true))
-
-			pod.Status.Phase = corev1.PodFailed
-			pod.Status.ContainerStatuses = nil
-			err = k8sClient.Status().Update(ctx, pod)
-			Expect(err).To(BeNil(), "Failed to update pod status")
-
-			Eventually(func() bool {
-				check := new(v1alpha1.EphemeralRunner)
-				err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, check)
-				return kerrors.IsNotFound(err)
-			}, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(BeTrue(), "Ephemeral runner should eventually be deleted")
-		})
-
-		It("It should delete ephemeral runner when pod failed before runner state is recorded and job not assigned", func() {
-			pod := new(corev1.Pod)
-			Eventually(func() (bool, error) {
-				if err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, pod); err != nil {
-					return false, err
-				}
-				return true, nil
-			}, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(BeEquivalentTo(true))
-
-			oldPodUID := pod.UID
-
-			pod.Status.Phase = corev1.PodFailed
-			pod.Status.ContainerStatuses = nil
-			err := k8sClient.Status().Update(ctx, pod)
-			Expect(err).To(BeNil(), "Failed to update pod status")
-
-			Eventually(
-				func() (int, error) {
-					updated := new(v1alpha1.EphemeralRunner)
-					err := k8sClient.Get(
-						ctx,
-						client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace},
-						updated,
-					)
-					if err != nil {
-						return 0, err
-					}
-					return len(updated.Status.Failures), nil
-				},
-				ephemeralRunnerTimeout,
-				ephemeralRunnerInterval,
-			).Should(BeEquivalentTo(1))
-
-			Eventually(
-				func() (bool, error) {
-					newPod := new(corev1.Pod)
-					err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, newPod)
-					if err != nil {
-						return false, err
-					}
-					return newPod.UID != oldPodUID, nil
-				},
-				ephemeralRunnerTimeout,
-				ephemeralRunnerInterval,
-			).Should(BeTrue(), "Pod should be re-created")
-		})
-
-		It("It should treat pod failed with runner container exit 0 as success with job id", func() {
-			er := new(v1alpha1.EphemeralRunner)
-			Eventually(func() error {
-				return k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, er)
-			}, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(Succeed(), "failed to get ephemeral runner")
-
-			er.Status.JobID = "1"
-			err := k8sClient.Status().Update(ctx, er)
-			Expect(err).To(BeNil(), "failed to update ephemeral runner status")
-
-			pod := new(corev1.Pod)
-			Eventually(
-				func() error {
-					if err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, pod); err != nil {
-						return err
-					}
-					return nil
-				},
-				ephemeralRunnerTimeout,
-				ephemeralRunnerInterval,
-			).Should(Succeed(), "failed to get pod")
-
-			pod.Status.Phase = corev1.PodFailed
-			pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{
-				Name: v1alpha1.EphemeralRunnerContainerName,
-				State: corev1.ContainerState{
-					Terminated: &corev1.ContainerStateTerminated{
-						ExitCode: 0,
-					},
-				},
-			})
-			err = k8sClient.Status().Update(ctx, pod)
-			Expect(err).To(BeNil(), "Failed to update pod status")
-
-			Eventually(
-				func() bool {
-					check := new(v1alpha1.EphemeralRunner)
-					err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, check)
-					return kerrors.IsNotFound(err)
-				},
-				ephemeralRunnerTimeout,
-				ephemeralRunnerInterval,
-			).Should(BeTrue(), "Ephemeral runner should eventually be deleted")
-		})
-
-		It("It should treat pod failed with runner container exit 0 as success with no job id", func() {
-			pod := new(corev1.Pod)
-			Eventually(
-				func() error {
-					if err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, pod); err != nil {
-						return err
-					}
-					return nil
-				},
-				ephemeralRunnerTimeout,
-				ephemeralRunnerInterval,
-			).Should(Succeed(), "failed to get pod")
-
-			pod.Status.Phase = corev1.PodFailed
-			pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{
-				Name: v1alpha1.EphemeralRunnerContainerName,
-				State: corev1.ContainerState{
-					Terminated: &corev1.ContainerStateTerminated{
-						ExitCode: 0,
-					},
-				},
-			})
-			err := k8sClient.Status().Update(ctx, pod)
-			Expect(err).To(BeNil(), "Failed to update pod status")
-
-			Eventually(
-				func() bool {
-					check := new(v1alpha1.EphemeralRunner)
-					err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, check)
-					return kerrors.IsNotFound(err)
-				},
-				ephemeralRunnerTimeout,
-				ephemeralRunnerInterval,
-			).Should(BeTrue(), "Ephemeral runner should eventually be deleted")
-		})
-
-		It("It should mark as failed when job is not assigned and pod is failed", func() {
-			er := new(v1alpha1.EphemeralRunner)
-			Eventually(func() error {
-				return k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, er)
-			},
-				ephemeralRunnerTimeout,
-				ephemeralRunnerInterval,
-			).Should(Succeed(), "failed to get ephemeral runner")
-
-			pod := new(corev1.Pod)
-			Eventually(
-				func() error {
-					if err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, pod); err != nil {
-						return err
-					}
-					return nil
-				},
-				ephemeralRunnerTimeout,
-				ephemeralRunnerInterval,
-			).Should(Succeed(), "failed to get pod")
-
-			pod.Status.Phase = corev1.PodFailed
-			oldPodUID := pod.UID
-			pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{
-				Name: v1alpha1.EphemeralRunnerContainerName,
-				State: corev1.ContainerState{
-					Terminated: &corev1.ContainerStateTerminated{
-						ExitCode: 1,
-					},
-				},
-			})
-
-			err := k8sClient.Status().Update(ctx, pod)
-			Expect(err).To(BeNil(), "Failed to update pod status")
-
-			Eventually(
-				func() (int, error) {
-					updated := new(v1alpha1.EphemeralRunner)
-					err := k8sClient.Get(
-						ctx,
-						client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace},
-						updated,
-					)
-					if err != nil {
-						return 0, err
-					}
-					return len(updated.Status.Failures), nil
-				},
-				ephemeralRunnerTimeout,
-				ephemeralRunnerInterval,
-			).Should(BeEquivalentTo(1))
-
-			Eventually(
-				func() (bool, error) {
-					newPod := new(corev1.Pod)
-					err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, newPod)
-					if err != nil {
-						return false, err
-					}
-					return newPod.UID != oldPodUID, nil
-				},
-				ephemeralRunnerTimeout,
-				ephemeralRunnerInterval,
-			).Should(BeTrue(), "Pod should be re-created")
-		})
-
 		It("It should failed if a pod template is invalid", func() {
 			invalideEphemeralRunner := newExampleRunner("invalid-ephemeral-runner", autoscalingNS.Name, configSecret.Name)
 			invalideEphemeralRunner.Spec.Spec.PriorityClassName = "notexist"
@@ -977,52 +745,6 @@ var _ = Describe("EphemeralRunner", func() {
 			).Should(BeEquivalentTo(true))
 		})
 
-		It("It should re-create pod on reason starting with OutOf", func() {
-			pod := new(corev1.Pod)
-			Eventually(
-				func() (bool, error) {
-					err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, pod)
-					if err != nil {
-						return false, err
-					}
-					return true, nil
-				},
-				ephemeralRunnerTimeout,
-				ephemeralRunnerInterval,
-			).Should(BeEquivalentTo(true))
-
-			pod.Status.Phase = corev1.PodFailed
-			pod.Status.Reason = "OutOfpods"
-			pod.Status.ContainerStatuses = append(pod.Status.ContainerStatuses, corev1.ContainerStatus{
-				Name:  v1alpha1.EphemeralRunnerContainerName,
-				State: corev1.ContainerState{},
-			})
-			err := k8sClient.Status().Update(ctx, pod)
-			Expect(err).To(BeNil(), "failed to patch pod status")
-
-			updated := new(v1alpha1.EphemeralRunner)
-			Eventually(func() (bool, error) {
-				err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, updated)
-				if err != nil {
-					return false, err
-				}
-				return len(updated.Status.Failures) == 1, nil
-			}, ephemeralRunnerTimeout, ephemeralRunnerInterval).Should(BeEquivalentTo(true))
-
-			// should re-create after failure
-			Eventually(
-				func() (bool, error) {
-					pod := new(corev1.Pod)
-					if err := k8sClient.Get(ctx, client.ObjectKey{Name: ephemeralRunner.Name, Namespace: ephemeralRunner.Namespace}, pod); err != nil {
-						return false, err
-					}
-					return true, nil
-				},
-				ephemeralRunnerTimeout,
-				ephemeralRunnerInterval,
-			).Should(BeEquivalentTo(true))
-		})
-
 		It("It should not set the phase to succeeded without pod termination status", func() {
 			pod := new(corev1.Pod)
 			Eventually(

controllers/actions.github.com/ephemeralrunnerset_controller_test.go

@@ -32,8 +32,9 @@ import (
 )
 
 const (
-	ephemeralRunnerSetTestTimeout  = time.Second * 20
-	ephemeralRunnerSetTestInterval = time.Millisecond * 250
+	ephemeralRunnerSetTestTimeout     = time.Second * 20
+	ephemeralRunnerSetTestInterval    = time.Millisecond * 250
+	ephemeralRunnerSetTestGitHubToken = "gh_token"
 )
 
 func TestPrecomputedConstants(t *testing.T) {
@@ -118,7 +119,8 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			Consistently(
 				func() (int, error) {
 					runnerList := new(v1alpha1.EphemeralRunnerList)
-					if err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace); err != nil {
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
+					if err != nil {
 						return -1, err
 					}
 
@@ -151,7 +153,8 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			Eventually(
 				func() (int, error) {
 					runnerList := new(v1alpha1.EphemeralRunnerList)
-					if err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace); err != nil {
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
+					if err != nil {
 						return -1, err
 					}
 
@@ -169,7 +172,8 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 					}
 
 					if refetch {
-						if err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace); err != nil {
+						err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
+						if err != nil {
 							return -1, err
 						}
 					}
@@ -211,7 +215,8 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			Eventually(
 				func() (int, error) {
 					runnerList := new(v1alpha1.EphemeralRunnerList)
-					if err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace); err != nil {
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
+					if err != nil {
 						return -1, err
 					}
 
@@ -229,7 +234,8 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 					}
 
 					if refetch {
-						if err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace); err != nil {
+						err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
+						if err != nil {
 							return -1, err
 						}
 					}
@@ -247,7 +253,8 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			Eventually(
 				func() (int, error) {
 					runnerList := new(v1alpha1.EphemeralRunnerList)
-					if err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace); err != nil {
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
+					if err != nil {
 						return -1, err
 					}
 
@@ -292,7 +299,8 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			runnerList := new(v1alpha1.EphemeralRunnerList)
 			Eventually(
 				func() (int, error) {
-					if err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace); err != nil {
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
+					if err != nil {
 						return -1, err
 					}
 
@@ -318,7 +326,8 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			runnerList := new(v1alpha1.EphemeralRunnerList)
 			Eventually(
 				func() (int, error) {
-					if err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace); err != nil {
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
+					if err != nil {
 						return -1, err
 					}
 
@@ -342,7 +351,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			runnerList = new(v1alpha1.EphemeralRunnerList)
 			Eventually(
 				func() (int, error) {
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return -1, err
 					}
@@ -369,7 +378,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			runnerList := new(v1alpha1.EphemeralRunnerList)
 			Eventually(
 				func() (int, error) {
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return -1, err
 					}
@@ -394,7 +403,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			runnerList = new(v1alpha1.EphemeralRunnerList)
 			Eventually(
 				func() (int, error) {
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return -1, err
 					}
@@ -420,7 +429,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			runnerList = new(v1alpha1.EphemeralRunnerList)
 			Eventually(
 				func() (int, error) {
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return -1, err
 					}
@@ -447,7 +456,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			runnerList := new(v1alpha1.EphemeralRunnerList)
 			Eventually(
 				func() (int, error) {
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return -1, err
 					}
@@ -472,7 +481,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			runnerList = new(v1alpha1.EphemeralRunnerList)
 			Consistently(
 				func() (int, error) {
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return -1, err
 					}
@@ -499,7 +508,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			runnerList := new(v1alpha1.EphemeralRunnerList)
 			Eventually(
 				func() (int, error) {
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return -1, err
 					}
@@ -536,7 +545,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			// We should have 3 runners, and have no Succeeded ones
 			Eventually(
 				func() error {
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return err
 					}
@@ -573,7 +582,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			runnerList := new(v1alpha1.EphemeralRunnerList)
 			Eventually(
 				func() (int, error) {
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return -1, err
 					}
@@ -598,7 +607,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			runnerList = new(v1alpha1.EphemeralRunnerList)
 			Eventually(
 				func() error {
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return err
 					}
@@ -639,7 +648,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			// We should have 1 runner up and pending
 			Eventually(
 				func() error {
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return err
 					}
@@ -666,7 +675,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 
 			Eventually(
 				func() (int, error) {
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return -1, err
 					}
@@ -693,7 +702,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			runnerList := new(v1alpha1.EphemeralRunnerList)
 			Eventually(
 				func() (int, error) {
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return -1, err
 					}
@@ -719,7 +728,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			runnerList = new(v1alpha1.EphemeralRunnerList)
 			Eventually(
 				func() error {
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return err
 					}
@@ -763,7 +772,8 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			runnerList = new(v1alpha1.EphemeralRunnerList)
 			Consistently(
 				func() (int, error) {
-					if err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace); err != nil {
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
+					if err != nil {
 						return -1, err
 					}
 
@@ -789,7 +799,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			runnerList = new(v1alpha1.EphemeralRunnerList)
 			Eventually(
 				func() (int, error) {
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return -1, err
 					}
@@ -816,7 +826,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			runnerList := new(v1alpha1.EphemeralRunnerList)
 			Eventually(
 				func() (int, error) {
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return -1, err
 					}
@@ -843,7 +853,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			runnerList = new(v1alpha1.EphemeralRunnerList)
 			Eventually(
 				func() error {
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return err
 					}
@@ -887,7 +897,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			runnerList = new(v1alpha1.EphemeralRunnerList)
 			Eventually(
 				func() error {
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return err
 					}
@@ -928,7 +938,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			runnerList := new(v1alpha1.EphemeralRunnerList)
 			Eventually(
 				func() (bool, error) {
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return false, err
 					}
@@ -1036,7 +1046,7 @@ var _ = Describe("Test EphemeralRunnerSet controller", func() {
 			Eventually(
 				func() (int, error) {
 					runnerList = new(v1alpha1.EphemeralRunnerList)
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return -1, err
 					}
@@ -1198,7 +1208,7 @@ var _ = Describe("Test EphemeralRunnerSet controller with proxy settings", func(
 
 		Eventually(func(g Gomega) {
 			runnerList := new(v1alpha1.EphemeralRunnerList)
-			err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+			err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 			g.Expect(err).NotTo(HaveOccurred(), "failed to list EphemeralRunners")
 
 			for _, runner := range runnerList.Items {
@@ -1216,7 +1226,7 @@ var _ = Describe("Test EphemeralRunnerSet controller with proxy settings", func(
 		Eventually(
 			func(g Gomega) (int, error) {
 				runnerList := new(v1alpha1.EphemeralRunnerList)
-				err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+				err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 				if err != nil {
 					return -1, err
 				}
@@ -1235,7 +1245,7 @@ var _ = Describe("Test EphemeralRunnerSet controller with proxy settings", func(
 				}
 
 				if refetch {
-					err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+					err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 					if err != nil {
 						return -1, err
 					}
@@ -1250,18 +1260,6 @@ var _ = Describe("Test EphemeralRunnerSet controller with proxy settings", func(
 		err = k8sClient.Delete(ctx, ephemeralRunnerSet)
 		Expect(err).NotTo(HaveOccurred(), "failed to delete EphemeralRunnerSet")
 
-		Eventually(func(g Gomega) (int, error) {
-			runnerList := new(v1alpha1.EphemeralRunnerList)
-			err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
-			if err != nil {
-				return -1, err
-			}
-			return len(runnerList.Items), nil
-		},
-			ephemeralRunnerSetTestTimeout,
-			ephemeralRunnerSetTestInterval,
-		).Should(BeEquivalentTo(0), "EphemeralRunners should be deleted")
-
 		// Assert that the proxy secret is deleted
 		Eventually(func(g Gomega) {
 			proxySecret := &corev1.Secret{}
@@ -1345,7 +1343,7 @@ var _ = Describe("Test EphemeralRunnerSet controller with proxy settings", func(
 
 		runnerList := new(v1alpha1.EphemeralRunnerList)
 		Eventually(func() (int, error) {
-			err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+			err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 			if err != nil {
 				return -1, err
 			}
@@ -1492,7 +1490,7 @@ var _ = Describe("Test EphemeralRunnerSet controller with custom root CA", func(
 
 		runnerList := new(v1alpha1.EphemeralRunnerList)
 		Eventually(func() (int, error) {
-			err := listEphemeralRunnersAndRemoveFinalizers(ctx, k8sClient, runnerList, ephemeralRunnerSet.Namespace)
+			err := k8sClient.List(ctx, runnerList, client.InNamespace(ephemeralRunnerSet.Namespace))
 			if err != nil {
 				return -1, err
 			}
@@ -1531,27 +1529,3 @@ var _ = Describe("Test EphemeralRunnerSet controller with custom root CA", func(
 		).Should(BeTrue(), "server was not called")
 	})
 })
-
-// helper function to remove ephemeral runners since in the test, ephemeral runner reconciler is not started
-func listEphemeralRunnersAndRemoveFinalizers(ctx context.Context, k8sClient client.Client, list *v1alpha1.EphemeralRunnerList, namespace string) error {
-	err := k8sClient.List(ctx, list, client.InNamespace(namespace))
-	if err != nil {
-		return err
-	}
-
-	// Since we are not starting ephemeral runner reconciler, ignore
-	liveItems := make([]v1alpha1.EphemeralRunner, 0)
-	for _, item := range list.Items {
-		if !item.DeletionTimestamp.IsZero() {
-			if err := patch(ctx, k8sClient, &item, func(runner *v1alpha1.EphemeralRunner) {
-				runner.Finalizers = []string{}
-			}); err != nil {
-				return err
-			}
-			continue
-		}
-		liveItems = append(liveItems, item)
-	}
-	list.Items = liveItems
-	return nil
-}

controllers/actions.github.com/helpers_test.go

@@ -42,11 +42,11 @@ func createNamespace(t ginkgo.GinkgoTInterface, client client.Client) (*corev1.N
 		ObjectMeta: metav1.ObjectMeta{Name: "testns-autoscaling" + RandStringRunes(5)},
 	}
 
-	err := client.Create(context.Background(), ns)
+	err := k8sClient.Create(context.Background(), ns)
 	require.NoError(t, err)
 
 	t.Cleanup(func() {
-		err := client.Delete(context.Background(), ns)
+		err := k8sClient.Delete(context.Background(), ns)
 		require.NoError(t, err)
 	})
 

controllers/actions.github.com/resourcebuilder.go

@@ -2,6 +2,7 @@ package actionsgithubcom
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"fmt"
 	"maps"
@@ -82,7 +83,7 @@ func boolPtr(v bool) *bool {
 }
 
 func (b *ResourceBuilder) newAutoScalingListener(autoscalingRunnerSet *v1alpha1.AutoscalingRunnerSet, ephemeralRunnerSet *v1alpha1.EphemeralRunnerSet, namespace, image string, imagePullSecrets []corev1.LocalObjectReference) (*v1alpha1.AutoscalingListener, error) {
-	runnerScaleSetID, err := strconv.Atoi(autoscalingRunnerSet.Annotations[runnerScaleSetIDAnnotationKey])
+	runnerScaleSetId, err := strconv.Atoi(autoscalingRunnerSet.Annotations[runnerScaleSetIdAnnotationKey])
 	if err != nil {
 		return nil, err
 	}
@@ -124,7 +125,7 @@ func (b *ResourceBuilder) newAutoScalingListener(autoscalingRunnerSet *v1alpha1.
 			GitHubConfigUrl:               autoscalingRunnerSet.Spec.GitHubConfigUrl,
 			GitHubConfigSecret:            autoscalingRunnerSet.Spec.GitHubConfigSecret,
 			VaultConfig:                   autoscalingRunnerSet.VaultConfig(),
-			RunnerScaleSetId:              runnerScaleSetID,
+			RunnerScaleSetId:              runnerScaleSetId,
 			AutoscalingRunnerSetNamespace: autoscalingRunnerSet.Namespace,
 			AutoscalingRunnerSetName:      autoscalingRunnerSet.Name,
 			EphemeralRunnerSetName:        ephemeralRunnerSet.Name,
@@ -179,7 +180,7 @@ func (b *ResourceBuilder) newScaleSetListenerConfig(autoscalingListener *v1alpha
 		EphemeralRunnerSetName:      autoscalingListener.Spec.EphemeralRunnerSetName,
 		MaxRunners:                  autoscalingListener.Spec.MaxRunners,
 		MinRunners:                  autoscalingListener.Spec.MinRunners,
-		RunnerScaleSetID:            autoscalingListener.Spec.RunnerScaleSetId,
+		RunnerScaleSetId:            autoscalingListener.Spec.RunnerScaleSetId,
 		RunnerScaleSetName:          autoscalingListener.Spec.AutoscalingRunnerSetName,
 		ServerRootCA:                cert,
 		LogLevel:                    scaleSetListenerLogLevel,
@@ -244,9 +245,6 @@ func (b *ResourceBuilder) newScaleSetListenerPod(autoscalingListener *v1alpha1.A
 	terminationGracePeriodSeconds := int64(60)
 	podSpec := corev1.PodSpec{
 		ServiceAccountName: serviceAccount.Name,
-		NodeSelector: map[string]string{
-			LabelKeyKubernetesOS: "linux",
-		},
 		Containers: []corev1.Container{
 			{
 				Name:  autoscalingListenerContainerName,
@@ -356,16 +354,13 @@ func mergeListenerPodWithTemplate(pod *corev1.Pod, tmpl *corev1.PodTemplateSpec)
 		pod.Spec.ImagePullSecrets = tmpl.Spec.ImagePullSecrets
 	}
 
-	if tmpl.Spec.NodeSelector != nil {
-		pod.Spec.NodeSelector = tmpl.Spec.NodeSelector
-	}
-
 	pod.Spec.Volumes = append(pod.Spec.Volumes, tmpl.Spec.Volumes...)
 	pod.Spec.InitContainers = tmpl.Spec.InitContainers
 	pod.Spec.EphemeralContainers = tmpl.Spec.EphemeralContainers
 	pod.Spec.TerminationGracePeriodSeconds = tmpl.Spec.TerminationGracePeriodSeconds
 	pod.Spec.ActiveDeadlineSeconds = tmpl.Spec.ActiveDeadlineSeconds
 	pod.Spec.DNSPolicy = tmpl.Spec.DNSPolicy
+	pod.Spec.NodeSelector = tmpl.Spec.NodeSelector
 	pod.Spec.NodeName = tmpl.Spec.NodeName
 	pod.Spec.HostNetwork = tmpl.Spec.HostNetwork
 	pod.Spec.HostPID = tmpl.Spec.HostPID
@@ -501,7 +496,7 @@ func (b *ResourceBuilder) newScaleSetListenerRoleBinding(autoscalingListener *v1
 }
 
 func (b *ResourceBuilder) newEphemeralRunnerSet(autoscalingRunnerSet *v1alpha1.AutoscalingRunnerSet) (*v1alpha1.EphemeralRunnerSet, error) {
-	runnerScaleSetID, err := strconv.Atoi(autoscalingRunnerSet.Annotations[runnerScaleSetIDAnnotationKey])
+	runnerScaleSetId, err := strconv.Atoi(autoscalingRunnerSet.Annotations[runnerScaleSetIdAnnotationKey])
 	if err != nil {
 		return nil, err
 	}
@@ -546,7 +541,7 @@ func (b *ResourceBuilder) newEphemeralRunnerSet(autoscalingRunnerSet *v1alpha1.A
 		Spec: v1alpha1.EphemeralRunnerSetSpec{
 			Replicas: 0,
 			EphemeralRunnerSpec: v1alpha1.EphemeralRunnerSpec{
-				RunnerScaleSetId:   runnerScaleSetID,
+				RunnerScaleSetId:   runnerScaleSetId,
 				GitHubConfigUrl:    autoscalingRunnerSet.Spec.GitHubConfigUrl,
 				GitHubConfigSecret: autoscalingRunnerSet.Spec.GitHubConfigSecret,
 				Proxy:              autoscalingRunnerSet.Spec.Proxy,
@@ -561,23 +556,28 @@ func (b *ResourceBuilder) newEphemeralRunnerSet(autoscalingRunnerSet *v1alpha1.A
 }
 
 func (b *ResourceBuilder) newEphemeralRunner(ephemeralRunnerSet *v1alpha1.EphemeralRunnerSet) *v1alpha1.EphemeralRunner {
-	labels := make(map[string]string, len(ephemeralRunnerSet.Labels))
-	maps.Copy(labels, ephemeralRunnerSet.Labels)
-	labels[LabelKeyKubernetesComponent] = "runner"
+	labels := make(map[string]string)
+	for k, v := range ephemeralRunnerSet.Labels {
+		if k == LabelKeyKubernetesComponent {
+			labels[k] = "runner"
+		} else {
+			labels[k] = v
+		}
+	}
+
+	annotations := make(map[string]string)
+	for key, val := range ephemeralRunnerSet.Annotations {
+		annotations[key] = val
+	}
 
-	annotations := make(map[string]string, len(ephemeralRunnerSet.Annotations)+1)
-	maps.Copy(annotations, ephemeralRunnerSet.Annotations)
 	annotations[AnnotationKeyPatchID] = strconv.Itoa(ephemeralRunnerSet.Spec.PatchID)
 	return &v1alpha1.EphemeralRunner{
+		TypeMeta: metav1.TypeMeta{},
 		ObjectMeta: metav1.ObjectMeta{
 			GenerateName: ephemeralRunnerSet.Name + "-runner-",
 			Namespace:    ephemeralRunnerSet.Namespace,
 			Labels:       labels,
 			Annotations:  annotations,
-			Finalizers: []string{
-				ephemeralRunnerFinalizerName,
-				ephemeralRunnerActionsFinalizerName,
-			},
 			OwnerReferences: []metav1.OwnerReference{
 				{
 					APIVersion:         ephemeralRunnerSet.GetObjectKind().GroupVersionKind().GroupVersion().String(),
@@ -593,17 +593,27 @@ func (b *ResourceBuilder) newEphemeralRunner(ephemeralRunnerSet *v1alpha1.Epheme
 	}
 }
 
-func (b *ResourceBuilder) newEphemeralRunnerPod(runner *v1alpha1.EphemeralRunner, secret *corev1.Secret, envs ...corev1.EnvVar) *corev1.Pod {
+func (b *ResourceBuilder) newEphemeralRunnerPod(ctx context.Context, runner *v1alpha1.EphemeralRunner, secret *corev1.Secret, envs ...corev1.EnvVar) *corev1.Pod {
 	var newPod corev1.Pod
 
-	annotations := make(map[string]string, len(runner.Annotations)+len(runner.Spec.Annotations))
-	maps.Copy(annotations, runner.Annotations)
-	maps.Copy(annotations, runner.Spec.Annotations)
+	labels := map[string]string{}
+	annotations := map[string]string{}
 
-	labels := make(map[string]string, len(runner.Labels)+len(runner.Spec.Labels)+2)
-	maps.Copy(labels, runner.Labels)
-	maps.Copy(labels, runner.Spec.Labels)
+	for k, v := range runner.Labels {
+		labels[k] = v
+	}
+	for k, v := range runner.Spec.Labels {
+		labels[k] = v
+	}
 	labels["actions-ephemeral-runner"] = string(corev1.ConditionTrue)
+
+	for k, v := range runner.Annotations {
+		annotations[k] = v
+	}
+	for k, v := range runner.Spec.Annotations {
+		annotations[k] = v
+	}
+
 	labels[LabelKeyPodTemplateHash] = hash.FNVHashStringObjects(
 		FilterLabels(labels, LabelKeyRunnerTemplateHash),
 		annotations,
@@ -680,28 +690,20 @@ func scaleSetListenerConfigName(autoscalingListener *v1alpha1.AutoscalingListene
 	return fmt.Sprintf("%s-config", autoscalingListener.Name)
 }
 
-func hashSuffix(namespace, runnerGroup, configURL string) string {
-	namespaceHash := hash.FNVHashString(namespace + "@" + runnerGroup + "@" + configURL)
+func scaleSetListenerName(autoscalingRunnerSet *v1alpha1.AutoscalingRunnerSet) string {
+	namespaceHash := hash.FNVHashString(autoscalingRunnerSet.Namespace)
 	if len(namespaceHash) > 8 {
 		namespaceHash = namespaceHash[:8]
 	}
-	return namespaceHash
-}
-
-func scaleSetListenerName(autoscalingRunnerSet *v1alpha1.AutoscalingRunnerSet) string {
-	return fmt.Sprintf(
-		"%v-%v-listener",
-		autoscalingRunnerSet.Name,
-		hashSuffix(
-			autoscalingRunnerSet.Namespace,
-			autoscalingRunnerSet.Spec.RunnerGroup,
-			autoscalingRunnerSet.Spec.GitHubConfigUrl,
-		),
-	)
+	return fmt.Sprintf("%v-%v-listener", autoscalingRunnerSet.Name, namespaceHash)
 }
 
 func proxyListenerSecretName(autoscalingListener *v1alpha1.AutoscalingListener) string {
-	return autoscalingListener.Name + "-proxy"
+	namespaceHash := hash.FNVHashString(autoscalingListener.Spec.AutoscalingRunnerSetNamespace)
+	if len(namespaceHash) > 8 {
+		namespaceHash = namespaceHash[:8]
+	}
+	return fmt.Sprintf("%v-%v-listener-proxy", autoscalingListener.Spec.AutoscalingRunnerSetName, namespaceHash)
 }
 
 func proxyEphemeralRunnerSetSecretName(ephemeralRunnerSet *v1alpha1.EphemeralRunnerSet) string {

controllers/actions.github.com/resourcebuilder_test.go

@@ -1,6 +1,7 @@
 package actionsgithubcom
 
 import (
+	"context"
 	"fmt"
 	"strings"
 	"testing"
@@ -27,7 +28,7 @@ func TestLabelPropagation(t *testing.T) {
 				"directly.excluded.org/arbitrary": "not-excluded-value",
 			},
 			Annotations: map[string]string{
-				runnerScaleSetIDAnnotationKey:         "1",
+				runnerScaleSetIdAnnotationKey:         "1",
 				AnnotationKeyGitHubRunnerGroupName:    "test-group",
 				AnnotationKeyGitHubRunnerScaleSetName: "test-scale-set",
 			},
@@ -103,7 +104,7 @@ func TestLabelPropagation(t *testing.T) {
 			Name: "test",
 		},
 	}
-	pod := b.newEphemeralRunnerPod(ephemeralRunner, runnerSecret)
+	pod := b.newEphemeralRunnerPod(context.TODO(), ephemeralRunner, runnerSecret)
 	for key := range ephemeralRunner.Labels {
 		assert.Equal(t, ephemeralRunner.Labels[key], pod.Labels[key])
 	}
@@ -123,7 +124,7 @@ func TestGitHubURLTrimLabelValues(t *testing.T) {
 				LabelKeyKubernetesVersion: "0.2.0",
 			},
 			Annotations: map[string]string{
-				runnerScaleSetIDAnnotationKey:         "1",
+				runnerScaleSetIdAnnotationKey:         "1",
 				AnnotationKeyGitHubRunnerGroupName:    "test-group",
 				AnnotationKeyGitHubRunnerScaleSetName: "test-scale-set",
 			},
@@ -189,7 +190,7 @@ func TestOwnershipRelationships(t *testing.T) {
 				LabelKeyKubernetesVersion: "0.2.0",
 			},
 			Annotations: map[string]string{
-				runnerScaleSetIDAnnotationKey:         "1",
+				runnerScaleSetIdAnnotationKey:         "1",
 				AnnotationKeyGitHubRunnerGroupName:    "test-group",
 				AnnotationKeyGitHubRunnerScaleSetName: "test-scale-set",
 				annotationKeyValuesHash:               "test-hash",
@@ -232,7 +233,7 @@ func TestOwnershipRelationships(t *testing.T) {
 			Name: "test-secret",
 		},
 	}
-	pod := b.newEphemeralRunnerPod(ephemeralRunner, runnerSecret)
+	pod := b.newEphemeralRunnerPod(context.TODO(), ephemeralRunner, runnerSecret)
 
 	// Test EphemeralRunnerPod ownership
 	require.Len(t, pod.OwnerReferences, 1, "EphemeralRunnerPod should have exactly one owner reference")
@@ -242,111 +243,3 @@ func TestOwnershipRelationships(t *testing.T) {
 	assert.Equal(t, true, *ownerRef.Controller, "Controller flag should be true")
 	assert.Equal(t, true, *ownerRef.BlockOwnerDeletion, "BlockOwnerDeletion flag should be true")
 }
-
-func TestListenerPodNodeSelector(t *testing.T) {
-	autoscalingRunnerSet := v1alpha1.AutoscalingRunnerSet{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "test-scale-set",
-			Namespace: "test-ns",
-			Labels: map[string]string{
-				LabelKeyKubernetesPartOf:  labelValueKubernetesPartOf,
-				LabelKeyKubernetesVersion: "0.2.0",
-			},
-			Annotations: map[string]string{
-				runnerScaleSetIDAnnotationKey:         "1",
-				AnnotationKeyGitHubRunnerGroupName:    "test-group",
-				AnnotationKeyGitHubRunnerScaleSetName: "test-scale-set",
-			},
-		},
-		Spec: v1alpha1.AutoscalingRunnerSetSpec{
-			GitHubConfigUrl: "https://github.com/org/repo",
-		},
-	}
-
-	b := ResourceBuilder{}
-	ephemeralRunnerSet, err := b.newEphemeralRunnerSet(&autoscalingRunnerSet)
-	require.NoError(t, err)
-
-	listener, err := b.newAutoScalingListener(&autoscalingRunnerSet, ephemeralRunnerSet, autoscalingRunnerSet.Namespace, "test:latest", nil)
-	require.NoError(t, err)
-
-	listenerServiceAccount := &corev1.ServiceAccount{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: "test",
-		},
-	}
-
-	t.Run("default listener pod has linux nodeSelector", func(t *testing.T) {
-		pod, err := b.newScaleSetListenerPod(listener, &corev1.Secret{}, listenerServiceAccount, nil)
-		require.NoError(t, err)
-		require.NotNil(t, pod.Spec.NodeSelector)
-		assert.Equal(t, "linux", pod.Spec.NodeSelector[LabelKeyKubernetesOS],
-			"listener pod should default to linux nodeSelector")
-	})
-
-	t.Run("nil listenerTemplate preserves linux nodeSelector", func(t *testing.T) {
-		listenerNoTemplate := listener.DeepCopy()
-		listenerNoTemplate.Spec.Template = nil
-
-		pod, err := b.newScaleSetListenerPod(listenerNoTemplate, &corev1.Secret{}, listenerServiceAccount, nil)
-		require.NoError(t, err)
-		require.NotNil(t, pod.Spec.NodeSelector)
-		assert.Equal(t, "linux", pod.Spec.NodeSelector[LabelKeyKubernetesOS],
-			"listener pod should keep linux nodeSelector when no template is provided")
-	})
-
-	t.Run("listenerTemplate with nil nodeSelector preserves linux default", func(t *testing.T) {
-		listenerWithTemplate := listener.DeepCopy()
-		listenerWithTemplate.Spec.Template = &corev1.PodTemplateSpec{
-			Spec: corev1.PodSpec{
-				// NodeSelector intentionally nil
-				Tolerations: []corev1.Toleration{
-					{Key: "example.com/test", Operator: corev1.TolerationOpExists},
-				},
-			},
-		}
-
-		pod, err := b.newScaleSetListenerPod(listenerWithTemplate, &corev1.Secret{}, listenerServiceAccount, nil)
-		require.NoError(t, err)
-		require.NotNil(t, pod.Spec.NodeSelector,
-			"linux nodeSelector should not be cleared by template with nil nodeSelector")
-		assert.Equal(t, "linux", pod.Spec.NodeSelector[LabelKeyKubernetesOS])
-		assert.Len(t, pod.Spec.Tolerations, 1, "other template fields should still be applied")
-	})
-
-	t.Run("listenerTemplate with explicit nodeSelector overrides default", func(t *testing.T) {
-		listenerWithTemplate := listener.DeepCopy()
-		listenerWithTemplate.Spec.Template = &corev1.PodTemplateSpec{
-			Spec: corev1.PodSpec{
-				NodeSelector: map[string]string{
-					LabelKeyKubernetesOS: "linux",
-					"custom-label/pool":  "listeners",
-				},
-			},
-		}
-
-		pod, err := b.newScaleSetListenerPod(listenerWithTemplate, &corev1.Secret{}, listenerServiceAccount, nil)
-		require.NoError(t, err)
-		require.NotNil(t, pod.Spec.NodeSelector)
-		assert.Equal(t, "linux", pod.Spec.NodeSelector[LabelKeyKubernetesOS])
-		assert.Equal(t, "listeners", pod.Spec.NodeSelector["custom-label/pool"],
-			"explicit template nodeSelector should be applied")
-	})
-
-	t.Run("listenerTemplate with empty nodeSelector overrides default", func(t *testing.T) {
-		listenerWithTemplate := listener.DeepCopy()
-		listenerWithTemplate.Spec.Template = &corev1.PodTemplateSpec{
-			Spec: corev1.PodSpec{
-				NodeSelector: map[string]string{},
-			},
-		}
-
-		pod, err := b.newScaleSetListenerPod(listenerWithTemplate, &corev1.Secret{}, listenerServiceAccount, nil)
-		require.NoError(t, err)
-		// An explicitly set empty map is non-nil, so it overrides the default.
-		// This is intentional: the user explicitly opted out of nodeSelector constraints.
-		assert.NotNil(t, pod.Spec.NodeSelector)
-		assert.Empty(t, pod.Spec.NodeSelector,
-			"explicitly empty nodeSelector should override the linux default")
-	})
-}

controllers/actions.summerwind.net/horizontal_runner_autoscaler_webhook.go

@@ -321,34 +321,26 @@ func (autoscaler *HorizontalRunnerAutoscalerGitHubWebhook) findHRAsByKey(ctx con
 		defaultListOpts = append(defaultListOpts, client.InNamespace(ns))
 	}
 
-	// Get all HRAs since we can't use the index for repository/organization lookup anymore
-	var hraList v1alpha1.HorizontalRunnerAutoscalerList
-	if err := autoscaler.List(ctx, &hraList, defaultListOpts...); err != nil {
-		return nil, err
-	}
+	var hras []v1alpha1.HorizontalRunnerAutoscaler
 
-	var matchingHRAs []v1alpha1.HorizontalRunnerAutoscaler
+	if value != "" {
+		opts := append([]client.ListOption{}, defaultListOpts...)
+		opts = append(opts, client.MatchingFields{scaleTargetKey: value})
 
-	if value == "" {
-		return matchingHRAs, nil
-	}
-
-	// For each HRA, resolve its ScaleTargetRef and check if it matches the requested value
-	for _, hra := range hraList.Items {
-		if hra.Spec.ScaleTargetRef.Name == "" {
-			continue
+		if autoscaler.Namespace != "" {
+			opts = append(opts, client.InNamespace(autoscaler.Namespace))
 		}
 
-		keys := autoscaler.getHRAKeys(ctx, &hra)
-		for _, key := range keys {
-			if key == value {
-				matchingHRAs = append(matchingHRAs, hra)
-				break
-			}
+		var hraList v1alpha1.HorizontalRunnerAutoscalerList
+
+		if err := autoscaler.List(ctx, &hraList, opts...); err != nil {
+			return nil, err
 		}
+
+		hras = append(hras, hraList.Items...)
 	}
 
-	return matchingHRAs, nil
+	return hras, nil
 }
 
 type ScaleTarget struct {
@@ -718,36 +710,10 @@ func (autoscaler *HorizontalRunnerAutoscalerGitHubWebhook) indexer(rawObj client
 		return nil
 	}
 
-	// Return a simple key based on the ScaleTargetRef to avoid client calls in indexer
-	// The actual repository/organization resolution will be done later when needed
-	kind := hra.Spec.ScaleTargetRef.Kind
-	if kind == "" {
-		kind = "RunnerDeployment" // default
-	}
-
-	key := fmt.Sprintf("%s/%s/%s", kind, hra.Namespace, hra.Spec.ScaleTargetRef.Name)
-	autoscaler.Log.V(2).Info(fmt.Sprintf("HRA indexed for HRA %s with key: %s", hra.Name, key))
-	return []string{key}
-}
-
-func enterpriseKey(name string) string {
-	return keyPrefixEnterprise + name
-}
-
-func organizationalRunnerGroupKey(owner, group string) string {
-	return owner + keyRunnerGroup + group
-}
-
-func enterpriseRunnerGroupKey(enterprise, group string) string {
-	return keyPrefixEnterprise + enterprise + keyRunnerGroup + group
-}
-
-// getHRAKeys resolves the ScaleTargetRef and returns the repository/organization keys for an HRA
-func (autoscaler *HorizontalRunnerAutoscalerGitHubWebhook) getHRAKeys(ctx context.Context, hra *v1alpha1.HorizontalRunnerAutoscaler) []string {
 	switch hra.Spec.ScaleTargetRef.Kind {
 	case "", "RunnerDeployment":
 		var rd v1alpha1.RunnerDeployment
-		if err := autoscaler.Get(ctx, types.NamespacedName{Namespace: hra.Namespace, Name: hra.Spec.ScaleTargetRef.Name}, &rd); err != nil {
+		if err := autoscaler.Get(context.Background(), types.NamespacedName{Namespace: hra.Namespace, Name: hra.Spec.ScaleTargetRef.Name}, &rd); err != nil {
 			autoscaler.Log.V(1).Info(fmt.Sprintf("RunnerDeployment not found with scale target ref name %s for hra %s", hra.Spec.ScaleTargetRef.Name, hra.Name))
 			return nil
 		}
@@ -770,10 +736,11 @@ func (autoscaler *HorizontalRunnerAutoscalerGitHubWebhook) getHRAKeys(ctx contex
 				keys = append(keys, enterpriseKey(enterprise)) // Enterprise runners
 			}
 		}
+		autoscaler.Log.V(2).Info(fmt.Sprintf("HRA keys indexed for HRA %s: %v", hra.Name, keys))
 		return keys
 	case "RunnerSet":
 		var rs v1alpha1.RunnerSet
-		if err := autoscaler.Get(ctx, types.NamespacedName{Namespace: hra.Namespace, Name: hra.Spec.ScaleTargetRef.Name}, &rs); err != nil {
+		if err := autoscaler.Get(context.Background(), types.NamespacedName{Namespace: hra.Namespace, Name: hra.Spec.ScaleTargetRef.Name}, &rs); err != nil {
 			autoscaler.Log.V(1).Info(fmt.Sprintf("RunnerSet not found with scale target ref name %s for hra %s", hra.Spec.ScaleTargetRef.Name, hra.Name))
 			return nil
 		}
@@ -794,8 +761,21 @@ func (autoscaler *HorizontalRunnerAutoscalerGitHubWebhook) getHRAKeys(ctx contex
 				keys = append(keys, enterpriseRunnerGroupKey(enterprise, rs.Spec.Group)) // Enterprise runner groups
 			}
 		}
+		autoscaler.Log.V(2).Info(fmt.Sprintf("HRA keys indexed for HRA %s: %v", hra.Name, keys))
 		return keys
 	}
 
 	return nil
 }
+
+func enterpriseKey(name string) string {
+	return keyPrefixEnterprise + name
+}
+
+func organizationalRunnerGroupKey(owner, group string) string {
+	return owner + keyRunnerGroup + group
+}
+
+func enterpriseRunnerGroupKey(enterprise, group string) string {
+	return keyPrefixEnterprise + enterprise + keyRunnerGroup + group
+}

controllers/actions.summerwind.net/horizontal_runner_autoscaler_webhook_test.go

@@ -9,7 +9,6 @@ import (
 	"net/http/httptest"
 	"net/url"
 	"os"
-	"sync"
 	"testing"
 	"time"
 
@@ -420,14 +419,9 @@ func TestGetValidCapacityReservations(t *testing.T) {
 func installTestLogger(webhook *HorizontalRunnerAutoscalerGitHubWebhook) *bytes.Buffer {
 	logs := &bytes.Buffer{}
 
-	// Wrap the buffer with a synchronized writer to prevent race conditions
-	syncWriter := &syncWriter{
-		writer: logs,
-	}
-
 	sink := &testLogSink{
 		name:   "testlog",
-		writer: syncWriter,
+		writer: logs,
 	}
 
 	log := logr.New(sink)
@@ -523,18 +517,6 @@ func sendWebhook(server *httptest.Server, eventType string, event interface{}) (
 	return http.DefaultClient.Do(req)
 }
 
-// syncWriter wraps an io.Writer with a mutex for thread-safe writes
-type syncWriter struct {
-	writer io.Writer
-	mu     sync.Mutex
-}
-
-func (sw *syncWriter) Write(p []byte) (n int, err error) {
-	sw.mu.Lock()
-	defer sw.mu.Unlock()
-	return sw.writer.Write(p)
-}
-
 // testLogSink is a sample logr.Logger that logs in-memory.
 // It's only for testing log outputs.
 type testLogSink struct {

controllers/actions.summerwind.net/multi_githubclient.go

@@ -2,7 +2,7 @@ package actionssummerwindnet
 
 import (
 	"context"
-	"crypto/sha256"
+	"crypto/sha1"
 	"encoding/hex"
 	"fmt"
 	"sort"
@@ -176,7 +176,7 @@ func (c *MultiGitHubClient) initClientForSecret(secret *corev1.Secret, dependent
 
 	sort.SliceStable(ks, func(i, j int) bool { return ks[i] < ks[j] })
 
-	hash := sha256.New()
+	hash := sha1.New()
 	for _, k := range ks {
 		hash.Write(secret.Data[k])
 	}

docs/gha-runner-scale-set-controller/README.md

@@ -43,48 +43,6 @@ You can follow [this troubleshooting guide](https://docs.github.com/en/actions/h
 
 ## Changelog
 
-### 0.13.1
-
-1. Make restart pod more flexible to different failure scenarios [#4340](https://github.com/actions/actions-runner-controller/pull/4340)
-1. Bump golangci/golangci-lint-action from 9.1.0 to 9.2.0 in the actions group [#4335](https://github.com/actions/actions-runner-controller/pull/4335)
-1. Bump the gomod group across 1 directory with 10 updates [#4338](https://github.com/actions/actions-runner-controller/pull/4338)
-1. Re-schedule if the failed reason starts with OutOf [#4336](https://github.com/actions/actions-runner-controller/pull/4336)
-1. Restart the listener if pod is evicted [#4332](https://github.com/actions/actions-runner-controller/pull/4332)
-1. Typo in test name caused test to not execute [#4330](https://github.com/actions/actions-runner-controller/pull/4330)
-1. Bump the actions group with 3 updates [#4328](https://github.com/actions/actions-runner-controller/pull/4328)
-1. Remove old e2e tests [#4325](https://github.com/actions/actions-runner-controller/pull/4325)
-1. Bump the actions group across 1 directory with 4 updates [#4309](https://github.com/actions/actions-runner-controller/pull/4309)
-1. Bump golang.org/x/crypto from 0.43.0 to 0.45.0 [#4318](https://github.com/actions/actions-runner-controller/pull/4318)
-1. Add support for giving kubernetes mode scaleset service account additional permissions [#4282](https://github.com/actions/actions-runner-controller/pull/4282)
-1. Bump the gomod group across 1 directory with 11 updates [#4317](https://github.com/actions/actions-runner-controller/pull/4317)
-1. Code style changes on the controller [#4324](https://github.com/actions/actions-runner-controller/pull/4324)
-1. Add ephemeral runner finalizer during creation and check finalizer without requeue [#4320](https://github.com/actions/actions-runner-controller/pull/4320)
-1. e2e: move from deprecated openebs charts to new registry [#4321](https://github.com/actions/actions-runner-controller/pull/4321)
-1. Create e2e test suite [#3136](https://github.com/actions/actions-runner-controller/pull/3136)
-1. Handle resource quota on status forbidden by retrying [#4305](https://github.com/actions/actions-runner-controller/pull/4305)
-1. Use combination of namespace, GitHub URL, and runner group when hashing the listener name [#4299](https://github.com/actions/actions-runner-controller/pull/4299)
-1. Bump kubebuilder tools in the workflow [#4300](https://github.com/actions/actions-runner-controller/pull/4300)
-1. Bump timeout for min runners workflow to 30s [#4306](https://github.com/actions/actions-runner-controller/pull/4306)
-1. Fix for code scanning alert no. 5: Workflow does not contain permissions [#4292](https://github.com/actions/actions-runner-controller/pull/4292)
-1. Delete listener resources without requeueing on each call [#4289](https://github.com/actions/actions-runner-controller/pull/4289)
-1. Fix first interaction action [#4290](https://github.com/actions/actions-runner-controller/pull/4290)
-1. Bump github/codeql-action from 3 to 4 in the actions group [#4281](https://github.com/actions/actions-runner-controller/pull/4281)
-
-### 0.13.0
-
-1. Remove workflow actions version comments since upgrades are done via dependabot [#4161](https://github.com/actions/actions-runner-controller/pull/4161)
-1. Fix image pull secrets list arguments in the chart [#4164](https://github.com/actions/actions-runner-controller/pull/4164)
-1. Update example GitHub URLs in values.yaml to include an example for enterprise account-level runners [#4181](https://github.com/actions/actions-runner-controller/pull/4181)
-1. docs: fix repo path typo [#4229](https://github.com/actions/actions-runner-controller/pull/4229)
-1. Remove deprecated preserveUnknownFields from CRDs [#4135](https://github.com/actions/actions-runner-controller/pull/4135)
-1. Add workflow name and target labels [#4240](https://github.com/actions/actions-runner-controller/pull/4240)
-1. docs: fix broken Grafana dashboard JSON path [#4270](https://github.com/actions/actions-runner-controller/pull/4270)
-1. Ensure ephemeral runner is deleted from the service on exit != 0 [#4260](https://github.com/actions/actions-runner-controller/pull/4260)
-1. Remove JIT config from ephemeral runner status field [#4191](https://github.com/actions/actions-runner-controller/pull/4191)
-1. Remove ephemeral runner when exit code != 0 and is patched with the job [#4239](https://github.com/actions/actions-runner-controller/pull/4239)
-1. Bump the gomod group across 1 directory with 4 updates [#4277](https://github.com/actions/actions-runner-controller/pull/4277)
-1. Bump all dependencies [#4266](https://github.com/actions/actions-runner-controller/pull/4266)
-
 ### 0.12.1
 
 1. Fix indentation of startupProbe attributes in dind sidecar [#4126](https://github.com/actions/actions-runner-controller/pull/4126)

docs/gha-runner-scale-set-controller/samples/grafana-dashboard/README.md

@@ -15,7 +15,7 @@ This sample dashboard shows how to visualize the metrics with [Grafana](https://
 
 1. Make sure to have [Grafana](https://grafana.com/docs/grafana/latest/installation/) and [Prometheus](https://prometheus.io/docs/prometheus/latest/installation/) running in your cluster.
 2. Make sure that Prometheus is properly scraping the metrics endpoints of the controller-manager and listeners.
-3. Import the [dashboard](ARC-Autoscaling-Runner-Set-Monitoring.json) into Grafana.
+3. Import the [dashboard](ARC-Autoscaling-Runner-Set-Monitoring_1692627561838.json) into Grafana.
 
 ## Required metrics
 

github/actions/client.go

@@ -34,6 +34,7 @@ const (
 // Header used to propagate capacity information to the back-end
 const HeaderScaleSetMaxCapacity = "X-ScaleSetMaxCapacity"
 
+//go:generate mockery --inpackage --name=ActionsService
 type ActionsService interface {
 	GetRunnerScaleSet(ctx context.Context, runnerGroupId int, runnerScaleSetName string) (*RunnerScaleSet, error)
 	GetRunnerScaleSetById(ctx context.Context, runnerScaleSetId int) (*RunnerScaleSet, error)
@@ -273,10 +274,6 @@ func (c *Client) Identifier() string {
 func (c *Client) Do(req *http.Request) (*http.Response, error) {
 	resp, err := c.Client.Do(req)
 	if err != nil {
-		// If we have a response even with an error, include the status code
-		if resp != nil {
-			return nil, fmt.Errorf("client request failed with status code %d: %w", resp.StatusCode, err)
-		}
 		return nil, fmt.Errorf("client request failed: %w", err)
 	}
 
@@ -859,8 +856,7 @@ func (c *Client) GenerateJitRunnerConfig(ctx context.Context, jitRunnerSetting *
 
 	resp, err := c.Do(req)
 	if err != nil {
-		// Include the URL and method in the error for better debugging
-		return nil, fmt.Errorf("failed to issue the request %s %s: %w", req.Method, req.URL.String(), err)
+		return nil, fmt.Errorf("failed to issue the request: %w", err)
 	}
 
 	if resp.StatusCode != http.StatusOK {

github/actions/client_generate_jit_test.go

@@ -2,7 +2,6 @@ package actions_test
 
 import (
 	"context"
-	"errors"
 	"net/http"
 	"testing"
 	"time"
@@ -59,37 +58,4 @@ func TestGenerateJitRunnerConfig(t *testing.T) {
 		assert.NotNil(t, err)
 		assert.Equalf(t, actualRetry, expectedRetry, "A retry was expected after the first request but got: %v", actualRetry)
 	})
-
-	t.Run("Error includes HTTP method and URL when request fails", func(t *testing.T) {
-		runnerSettings := &actions.RunnerScaleSetJitRunnerSetting{}
-
-		server := newActionsServer(t, http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-			w.WriteHeader(http.StatusInternalServerError)
-		}))
-
-		client, err := actions.NewClient(
-			server.configURLForOrg("my-org"),
-			auth,
-			actions.WithRetryMax(0), // No retries to get immediate error
-			actions.WithRetryWaitMax(1*time.Millisecond),
-		)
-		require.NoError(t, err)
-
-		_, err = client.GenerateJitRunnerConfig(ctx, runnerSettings, 1)
-		require.NotNil(t, err)
-		// Verify error message includes HTTP method and URL for better debugging
-		errMsg := err.Error()
-		assert.Contains(t, errMsg, "POST", "Error message should include HTTP method")
-		assert.Contains(t, errMsg, "generatejitconfig", "Error message should include URL path")
-
-		// The error might be an ActionsError (if response was received) or a wrapped error (if Do() failed)
-		// In either case, the error message should include request details
-		var actionsErr *actions.ActionsError
-		if errors.As(err, &actionsErr) {
-			// If we got an ActionsError, verify the status code is included
-			assert.Equal(t, http.StatusInternalServerError, actionsErr.StatusCode)
-		}
-		// If it's a wrapped error from Do(), the error message already includes the method and URL
-		// which is what we're testing for
-	})
 }

github/actions/config_test.go

@@ -15,12 +15,10 @@ import (
 func TestGitHubConfig(t *testing.T) {
 	t.Run("when given a valid URL", func(t *testing.T) {
 		tests := []struct {
-			name      string
 			configURL string
 			expected  *actions.GitHubConfig
 		}{
 			{
-				name:      "repository URL",
 				configURL: "https://github.com/org/repo",
 				expected: &actions.GitHubConfig{
 					Scope:        actions.GitHubScopeRepository,
@@ -31,7 +29,6 @@ func TestGitHubConfig(t *testing.T) {
 				},
 			},
 			{
-				name:      "repository URL with trailing slash",
 				configURL: "https://github.com/org/repo/",
 				expected: &actions.GitHubConfig{
 					Scope:        actions.GitHubScopeRepository,
@@ -42,7 +39,6 @@ func TestGitHubConfig(t *testing.T) {
 				},
 			},
 			{
-				name:      "organization URL",
 				configURL: "https://github.com/org",
 				expected: &actions.GitHubConfig{
 					Scope:        actions.GitHubScopeOrganization,
@@ -53,7 +49,6 @@ func TestGitHubConfig(t *testing.T) {
 				},
 			},
 			{
-				name:      "enterprise URL",
 				configURL: "https://github.com/enterprises/my-enterprise",
 				expected: &actions.GitHubConfig{
 					Scope:        actions.GitHubScopeEnterprise,
@@ -64,7 +59,6 @@ func TestGitHubConfig(t *testing.T) {
 				},
 			},
 			{
-				name:      "enterprise URL with trailing slash",
 				configURL: "https://github.com/enterprises/my-enterprise/",
 				expected: &actions.GitHubConfig{
 					Scope:        actions.GitHubScopeEnterprise,
@@ -75,7 +69,6 @@ func TestGitHubConfig(t *testing.T) {
 				},
 			},
 			{
-				name:      "organization URL with www",
 				configURL: "https://www.github.com/org",
 				expected: &actions.GitHubConfig{
 					Scope:        actions.GitHubScopeOrganization,
@@ -86,7 +79,6 @@ func TestGitHubConfig(t *testing.T) {
 				},
 			},
 			{
-				name:      "organization URL with www and trailing slash",
 				configURL: "https://www.github.com/org/",
 				expected: &actions.GitHubConfig{
 					Scope:        actions.GitHubScopeOrganization,
@@ -97,7 +89,6 @@ func TestGitHubConfig(t *testing.T) {
 				},
 			},
 			{
-				name:      "github local URL",
 				configURL: "https://github.localhost/org",
 				expected: &actions.GitHubConfig{
 					Scope:        actions.GitHubScopeOrganization,
@@ -108,7 +99,6 @@ func TestGitHubConfig(t *testing.T) {
 				},
 			},
 			{
-				name:      "github local org URL",
 				configURL: "https://my-ghes.com/org",
 				expected: &actions.GitHubConfig{
 					Scope:        actions.GitHubScopeOrganization,
@@ -119,7 +109,6 @@ func TestGitHubConfig(t *testing.T) {
 				},
 			},
 			{
-				name:      "github local URL with trailing slash",
 				configURL: "https://my-ghes.com/org/",
 				expected: &actions.GitHubConfig{
 					Scope:        actions.GitHubScopeOrganization,
@@ -130,7 +119,6 @@ func TestGitHubConfig(t *testing.T) {
 				},
 			},
 			{
-				name:      "github local URL with ghe.com",
 				configURL: "https://my-ghes.ghe.com/org/",
 				expected: &actions.GitHubConfig{
 					Scope:        actions.GitHubScopeOrganization,
@@ -143,7 +131,7 @@ func TestGitHubConfig(t *testing.T) {
 		}
 
 		for _, test := range tests {
-			t.Run(test.name, func(t *testing.T) {
+			t.Run(test.configURL, func(t *testing.T) {
 				parsedURL, err := url.Parse(strings.Trim(test.configURL, "/"))
 				require.NoError(t, err)
 				test.expected.ConfigURL = parsedURL

github/actions/errors.go

@@ -36,7 +36,7 @@ type ActionsError struct {
 }
 
 func (e *ActionsError) Error() string {
-	return fmt.Sprintf("actions error: StatusCode %d, ActivityId %q: %v", e.StatusCode, e.ActivityID, e.Err)
+	return fmt.Sprintf("actions error: StatusCode %d, AcivityId %q: %v", e.StatusCode, e.ActivityID, e.Err)
 }
 
 func (e *ActionsError) Unwrap() error {
@@ -112,7 +112,7 @@ type MessageQueueTokenExpiredError struct {
 }
 
 func (e *MessageQueueTokenExpiredError) Error() string {
-	return fmt.Sprintf("MessageQueueTokenExpiredError: ActivityId %q, StatusCode %d: %s", e.activityID, e.statusCode, e.msg)
+	return fmt.Sprintf("MessageQueueTokenExpiredError: AcivityId %q, StatusCode %d: %s", e.activityID, e.statusCode, e.msg)
 }
 
 type HttpClientSideError struct {

github/actions/errors_test.go

@@ -22,7 +22,7 @@ func TestActionsError(t *testing.T) {
 
 		s := err.Error()
 		assert.Contains(t, s, "StatusCode 404")
-		assert.Contains(t, s, "ActivityId \"activity-id\"")
+		assert.Contains(t, s, "AcivityId \"activity-id\"")
 		assert.Contains(t, s, "example error description")
 	})
 
@@ -119,84 +119,88 @@ func TestGitHubAPIError(t *testing.T) {
 	})
 }
 
-func TestParseActionsErrorFromResponse(t *testing.T) {
+func ParseActionsErrorFromResponse(t *testing.T) {
 	t.Run("empty content length", func(t *testing.T) {
 		response := &http.Response{
 			ContentLength: 0,
-			Header:        http.Header{},
-			StatusCode:    404,
+			Header: http.Header{
+				actions.HeaderActionsActivityID: []string{"activity-id"},
+			},
+			StatusCode: 404,
 		}
-		response.Header.Add(actions.HeaderActionsActivityID, "activity-id")
 
 		err := actions.ParseActionsErrorFromResponse(response)
 		require.Error(t, err)
-		assert.Equal(t, "activity-id", err.(*actions.ActionsError).ActivityID)
-		assert.Equal(t, 404, err.(*actions.ActionsError).StatusCode)
-		assert.Equal(t, "unknown exception", err.(*actions.ActionsError).Err.Error())
+		assert.Equal(t, err.(*actions.ActionsError).ActivityID, "activity-id")
+		assert.Equal(t, err.(*actions.ActionsError).StatusCode, 404)
+		assert.Equal(t, err.(*actions.ActionsError).Err.Error(), "unknown exception")
 	})
 
 	t.Run("contains text plain error", func(t *testing.T) {
 		errorMessage := "example error message"
 		response := &http.Response{
 			ContentLength: int64(len(errorMessage)),
-			StatusCode:    404,
-			Header:        http.Header{},
-			Body:          io.NopCloser(strings.NewReader(errorMessage)),
+			Header: http.Header{
+				actions.HeaderActionsActivityID: []string{"activity-id"},
+				"Content-Type":                  []string{"text/plain"},
+			},
+			StatusCode: 404,
+			Body:       io.NopCloser(strings.NewReader(errorMessage)),
 		}
-		response.Header.Add(actions.HeaderActionsActivityID, "activity-id")
-		response.Header.Add("Content-Type", "text/plain")
 
 		err := actions.ParseActionsErrorFromResponse(response)
 		require.Error(t, err)
 		var actionsError *actions.ActionsError
-		require.ErrorAs(t, err, &actionsError)
-		assert.Equal(t, "activity-id", actionsError.ActivityID)
-		assert.Equal(t, 404, actionsError.StatusCode)
-		assert.Equal(t, errorMessage, actionsError.Err.Error())
+		assert.ErrorAs(t, err, &actionsError)
+		assert.Equal(t, actionsError.ActivityID, "activity-id")
+		assert.Equal(t, actionsError.StatusCode, 404)
+		assert.Equal(t, actionsError.Err.Error(), errorMessage)
 	})
 
 	t.Run("contains json error", func(t *testing.T) {
 		errorMessage := `{"typeName":"exception-name","message":"example error message"}`
 		response := &http.Response{
 			ContentLength: int64(len(errorMessage)),
-			Header:        http.Header{},
-			StatusCode:    404,
-			Body:          io.NopCloser(strings.NewReader(errorMessage)),
+			Header: http.Header{
+				actions.HeaderActionsActivityID: []string{"activity-id"},
+				"Content-Type":                  []string{"application/json"},
+			},
+			StatusCode: 404,
+			Body:       io.NopCloser(strings.NewReader(errorMessage)),
 		}
-		response.Header.Add(actions.HeaderActionsActivityID, "activity-id")
-		response.Header.Add("Content-Type", "application/json")
 
 		err := actions.ParseActionsErrorFromResponse(response)
 		require.Error(t, err)
 		var actionsError *actions.ActionsError
-		require.ErrorAs(t, err, &actionsError)
-		assert.Equal(t, "activity-id", actionsError.ActivityID)
-		assert.Equal(t, 404, actionsError.StatusCode)
+		assert.ErrorAs(t, err, &actionsError)
+		assert.Equal(t, actionsError.ActivityID, "activity-id")
+		assert.Equal(t, actionsError.StatusCode, 404)
 
 		inner, ok := actionsError.Err.(*actions.ActionsExceptionError)
 		require.True(t, ok)
-		assert.Equal(t, "exception-name", inner.ExceptionName)
-		assert.Equal(t, "example error message", inner.Message)
+		assert.Equal(t, inner.ExceptionName, "exception-name")
+		assert.Equal(t, inner.Message, "example error message")
 	})
 
 	t.Run("wrapped exception error", func(t *testing.T) {
 		errorMessage := `{"typeName":"exception-name","message":"example error message"}`
 		response := &http.Response{
 			ContentLength: int64(len(errorMessage)),
-			Header:        http.Header{},
-			StatusCode:    404,
-			Body:          io.NopCloser(strings.NewReader(errorMessage)),
+			Header: http.Header{
+				actions.HeaderActionsActivityID: []string{"activity-id"},
+				"Content-Type":                  []string{"application/json"},
+			},
+			StatusCode: 404,
+			Body:       io.NopCloser(strings.NewReader(errorMessage)),
 		}
-		response.Header.Add(actions.HeaderActionsActivityID, "activity-id")
-		response.Header.Add("Content-Type", "application/json")
 
 		err := actions.ParseActionsErrorFromResponse(response)
 		require.Error(t, err)
 
 		var actionsExceptionError *actions.ActionsExceptionError
-		require.ErrorAs(t, err, &actionsExceptionError)
+		assert.ErrorAs(t, err, &actionsExceptionError)
 
-		assert.Equal(t, "exception-name", actionsExceptionError.ExceptionName)
-		assert.Equal(t, "example error message", actionsExceptionError.Message)
+		assert.Equal(t, actionsExceptionError.ExceptionName, "exception-name")
+		assert.Equal(t, actionsExceptionError.Message, "example error message")
 	})
 }

github/actions/mock_ActionsService.go

@@ -0,0 +1,428 @@
+// Code generated by mockery v2.36.1. DO NOT EDIT.
+
+package actions
+
+import (
+	context "context"
+
+	uuid "github.com/google/uuid"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// MockActionsService is an autogenerated mock type for the ActionsService type
+type MockActionsService struct {
+	mock.Mock
+}
+
+// AcquireJobs provides a mock function with given fields: ctx, runnerScaleSetId, messageQueueAccessToken, requestIds
+func (_m *MockActionsService) AcquireJobs(ctx context.Context, runnerScaleSetId int, messageQueueAccessToken string, requestIds []int64) ([]int64, error) {
+	ret := _m.Called(ctx, runnerScaleSetId, messageQueueAccessToken, requestIds)
+
+	var r0 []int64
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, int, string, []int64) ([]int64, error)); ok {
+		return rf(ctx, runnerScaleSetId, messageQueueAccessToken, requestIds)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, int, string, []int64) []int64); ok {
+		r0 = rf(ctx, runnerScaleSetId, messageQueueAccessToken, requestIds)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]int64)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, int, string, []int64) error); ok {
+		r1 = rf(ctx, runnerScaleSetId, messageQueueAccessToken, requestIds)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// CreateMessageSession provides a mock function with given fields: ctx, runnerScaleSetId, owner
+func (_m *MockActionsService) CreateMessageSession(ctx context.Context, runnerScaleSetId int, owner string) (*RunnerScaleSetSession, error) {
+	ret := _m.Called(ctx, runnerScaleSetId, owner)
+
+	var r0 *RunnerScaleSetSession
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, int, string) (*RunnerScaleSetSession, error)); ok {
+		return rf(ctx, runnerScaleSetId, owner)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, int, string) *RunnerScaleSetSession); ok {
+		r0 = rf(ctx, runnerScaleSetId, owner)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*RunnerScaleSetSession)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, int, string) error); ok {
+		r1 = rf(ctx, runnerScaleSetId, owner)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// CreateRunnerScaleSet provides a mock function with given fields: ctx, runnerScaleSet
+func (_m *MockActionsService) CreateRunnerScaleSet(ctx context.Context, runnerScaleSet *RunnerScaleSet) (*RunnerScaleSet, error) {
+	ret := _m.Called(ctx, runnerScaleSet)
+
+	var r0 *RunnerScaleSet
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *RunnerScaleSet) (*RunnerScaleSet, error)); ok {
+		return rf(ctx, runnerScaleSet)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *RunnerScaleSet) *RunnerScaleSet); ok {
+		r0 = rf(ctx, runnerScaleSet)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*RunnerScaleSet)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *RunnerScaleSet) error); ok {
+		r1 = rf(ctx, runnerScaleSet)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// DeleteMessage provides a mock function with given fields: ctx, messageQueueUrl, messageQueueAccessToken, messageId
+func (_m *MockActionsService) DeleteMessage(ctx context.Context, messageQueueUrl string, messageQueueAccessToken string, messageId int64) error {
+	ret := _m.Called(ctx, messageQueueUrl, messageQueueAccessToken, messageId)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, string, string, int64) error); ok {
+		r0 = rf(ctx, messageQueueUrl, messageQueueAccessToken, messageId)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// DeleteMessageSession provides a mock function with given fields: ctx, runnerScaleSetId, sessionId
+func (_m *MockActionsService) DeleteMessageSession(ctx context.Context, runnerScaleSetId int, sessionId *uuid.UUID) error {
+	ret := _m.Called(ctx, runnerScaleSetId, sessionId)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, int, *uuid.UUID) error); ok {
+		r0 = rf(ctx, runnerScaleSetId, sessionId)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// DeleteRunnerScaleSet provides a mock function with given fields: ctx, runnerScaleSetId
+func (_m *MockActionsService) DeleteRunnerScaleSet(ctx context.Context, runnerScaleSetId int) error {
+	ret := _m.Called(ctx, runnerScaleSetId)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, int) error); ok {
+		r0 = rf(ctx, runnerScaleSetId)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// GenerateJitRunnerConfig provides a mock function with given fields: ctx, jitRunnerSetting, scaleSetId
+func (_m *MockActionsService) GenerateJitRunnerConfig(ctx context.Context, jitRunnerSetting *RunnerScaleSetJitRunnerSetting, scaleSetId int) (*RunnerScaleSetJitRunnerConfig, error) {
+	ret := _m.Called(ctx, jitRunnerSetting, scaleSetId)
+
+	var r0 *RunnerScaleSetJitRunnerConfig
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *RunnerScaleSetJitRunnerSetting, int) (*RunnerScaleSetJitRunnerConfig, error)); ok {
+		return rf(ctx, jitRunnerSetting, scaleSetId)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *RunnerScaleSetJitRunnerSetting, int) *RunnerScaleSetJitRunnerConfig); ok {
+		r0 = rf(ctx, jitRunnerSetting, scaleSetId)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*RunnerScaleSetJitRunnerConfig)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *RunnerScaleSetJitRunnerSetting, int) error); ok {
+		r1 = rf(ctx, jitRunnerSetting, scaleSetId)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetAcquirableJobs provides a mock function with given fields: ctx, runnerScaleSetId
+func (_m *MockActionsService) GetAcquirableJobs(ctx context.Context, runnerScaleSetId int) (*AcquirableJobList, error) {
+	ret := _m.Called(ctx, runnerScaleSetId)
+
+	var r0 *AcquirableJobList
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, int) (*AcquirableJobList, error)); ok {
+		return rf(ctx, runnerScaleSetId)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, int) *AcquirableJobList); ok {
+		r0 = rf(ctx, runnerScaleSetId)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*AcquirableJobList)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, int) error); ok {
+		r1 = rf(ctx, runnerScaleSetId)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetMessage provides a mock function with given fields: ctx, messageQueueUrl, messageQueueAccessToken, lastMessageId, maxCapacity
+func (_m *MockActionsService) GetMessage(ctx context.Context, messageQueueUrl string, messageQueueAccessToken string, lastMessageId int64, maxCapacity int) (*RunnerScaleSetMessage, error) {
+	ret := _m.Called(ctx, messageQueueUrl, messageQueueAccessToken, lastMessageId, maxCapacity)
+
+	var r0 *RunnerScaleSetMessage
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string, string, int64, int) (*RunnerScaleSetMessage, error)); ok {
+		return rf(ctx, messageQueueUrl, messageQueueAccessToken, lastMessageId, maxCapacity)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, string, string, int64, int) *RunnerScaleSetMessage); ok {
+		r0 = rf(ctx, messageQueueUrl, messageQueueAccessToken, lastMessageId, maxCapacity)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*RunnerScaleSetMessage)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, string, string, int64, int) error); ok {
+		r1 = rf(ctx, messageQueueUrl, messageQueueAccessToken, lastMessageId, maxCapacity)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetRunner provides a mock function with given fields: ctx, runnerId
+func (_m *MockActionsService) GetRunner(ctx context.Context, runnerId int64) (*RunnerReference, error) {
+	ret := _m.Called(ctx, runnerId)
+
+	var r0 *RunnerReference
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, int64) (*RunnerReference, error)); ok {
+		return rf(ctx, runnerId)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, int64) *RunnerReference); ok {
+		r0 = rf(ctx, runnerId)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*RunnerReference)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, int64) error); ok {
+		r1 = rf(ctx, runnerId)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetRunnerByName provides a mock function with given fields: ctx, runnerName
+func (_m *MockActionsService) GetRunnerByName(ctx context.Context, runnerName string) (*RunnerReference, error) {
+	ret := _m.Called(ctx, runnerName)
+
+	var r0 *RunnerReference
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) (*RunnerReference, error)); ok {
+		return rf(ctx, runnerName)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, string) *RunnerReference); ok {
+		r0 = rf(ctx, runnerName)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*RunnerReference)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
+		r1 = rf(ctx, runnerName)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetRunnerGroupByName provides a mock function with given fields: ctx, runnerGroup
+func (_m *MockActionsService) GetRunnerGroupByName(ctx context.Context, runnerGroup string) (*RunnerGroup, error) {
+	ret := _m.Called(ctx, runnerGroup)
+
+	var r0 *RunnerGroup
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) (*RunnerGroup, error)); ok {
+		return rf(ctx, runnerGroup)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, string) *RunnerGroup); ok {
+		r0 = rf(ctx, runnerGroup)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*RunnerGroup)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
+		r1 = rf(ctx, runnerGroup)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetRunnerScaleSet provides a mock function with given fields: ctx, runnerGroupId, runnerScaleSetName
+func (_m *MockActionsService) GetRunnerScaleSet(ctx context.Context, runnerGroupId int, runnerScaleSetName string) (*RunnerScaleSet, error) {
+	ret := _m.Called(ctx, runnerGroupId, runnerScaleSetName)
+
+	var r0 *RunnerScaleSet
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, int, string) (*RunnerScaleSet, error)); ok {
+		return rf(ctx, runnerGroupId, runnerScaleSetName)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, int, string) *RunnerScaleSet); ok {
+		r0 = rf(ctx, runnerGroupId, runnerScaleSetName)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*RunnerScaleSet)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, int, string) error); ok {
+		r1 = rf(ctx, runnerGroupId, runnerScaleSetName)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetRunnerScaleSetById provides a mock function with given fields: ctx, runnerScaleSetId
+func (_m *MockActionsService) GetRunnerScaleSetById(ctx context.Context, runnerScaleSetId int) (*RunnerScaleSet, error) {
+	ret := _m.Called(ctx, runnerScaleSetId)
+
+	var r0 *RunnerScaleSet
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, int) (*RunnerScaleSet, error)); ok {
+		return rf(ctx, runnerScaleSetId)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, int) *RunnerScaleSet); ok {
+		r0 = rf(ctx, runnerScaleSetId)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*RunnerScaleSet)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, int) error); ok {
+		r1 = rf(ctx, runnerScaleSetId)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// RefreshMessageSession provides a mock function with given fields: ctx, runnerScaleSetId, sessionId
+func (_m *MockActionsService) RefreshMessageSession(ctx context.Context, runnerScaleSetId int, sessionId *uuid.UUID) (*RunnerScaleSetSession, error) {
+	ret := _m.Called(ctx, runnerScaleSetId, sessionId)
+
+	var r0 *RunnerScaleSetSession
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, int, *uuid.UUID) (*RunnerScaleSetSession, error)); ok {
+		return rf(ctx, runnerScaleSetId, sessionId)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, int, *uuid.UUID) *RunnerScaleSetSession); ok {
+		r0 = rf(ctx, runnerScaleSetId, sessionId)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*RunnerScaleSetSession)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, int, *uuid.UUID) error); ok {
+		r1 = rf(ctx, runnerScaleSetId, sessionId)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// RemoveRunner provides a mock function with given fields: ctx, runnerId
+func (_m *MockActionsService) RemoveRunner(ctx context.Context, runnerId int64) error {
+	ret := _m.Called(ctx, runnerId)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, int64) error); ok {
+		r0 = rf(ctx, runnerId)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// SetUserAgent provides a mock function with given fields: info
+func (_m *MockActionsService) SetUserAgent(info UserAgentInfo) {
+	_m.Called(info)
+}
+
+// UpdateRunnerScaleSet provides a mock function with given fields: ctx, runnerScaleSetId, runnerScaleSet
+func (_m *MockActionsService) UpdateRunnerScaleSet(ctx context.Context, runnerScaleSetId int, runnerScaleSet *RunnerScaleSet) (*RunnerScaleSet, error) {
+	ret := _m.Called(ctx, runnerScaleSetId, runnerScaleSet)
+
+	var r0 *RunnerScaleSet
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, int, *RunnerScaleSet) (*RunnerScaleSet, error)); ok {
+		return rf(ctx, runnerScaleSetId, runnerScaleSet)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, int, *RunnerScaleSet) *RunnerScaleSet); ok {
+		r0 = rf(ctx, runnerScaleSetId, runnerScaleSet)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*RunnerScaleSet)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, int, *RunnerScaleSet) error); ok {
+		r1 = rf(ctx, runnerScaleSetId, runnerScaleSet)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// NewMockActionsService creates a new instance of MockActionsService. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewMockActionsService(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *MockActionsService {
+	mock := &MockActionsService{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

github/actions/mock_SessionService.go

@@ -0,0 +1,108 @@
+// Code generated by mockery v2.36.1. DO NOT EDIT.
+
+package actions
+
+import (
+	context "context"
+
+	mock "github.com/stretchr/testify/mock"
+)
+
+// MockSessionService is an autogenerated mock type for the SessionService type
+type MockSessionService struct {
+	mock.Mock
+}
+
+// AcquireJobs provides a mock function with given fields: ctx, requestIds
+func (_m *MockSessionService) AcquireJobs(ctx context.Context, requestIds []int64) ([]int64, error) {
+	ret := _m.Called(ctx, requestIds)
+
+	var r0 []int64
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, []int64) ([]int64, error)); ok {
+		return rf(ctx, requestIds)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, []int64) []int64); ok {
+		r0 = rf(ctx, requestIds)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]int64)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, []int64) error); ok {
+		r1 = rf(ctx, requestIds)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Close provides a mock function with given fields:
+func (_m *MockSessionService) Close() error {
+	ret := _m.Called()
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func() error); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// DeleteMessage provides a mock function with given fields: ctx, messageId
+func (_m *MockSessionService) DeleteMessage(ctx context.Context, messageId int64) error {
+	ret := _m.Called(ctx, messageId)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, int64) error); ok {
+		r0 = rf(ctx, messageId)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// GetMessage provides a mock function with given fields: ctx, lastMessageId, maxCapacity
+func (_m *MockSessionService) GetMessage(ctx context.Context, lastMessageId int64, maxCapacity int) (*RunnerScaleSetMessage, error) {
+	ret := _m.Called(ctx, lastMessageId, maxCapacity)
+
+	var r0 *RunnerScaleSetMessage
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, int64, int) (*RunnerScaleSetMessage, error)); ok {
+		return rf(ctx, lastMessageId, maxCapacity)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, int64, int) *RunnerScaleSetMessage); ok {
+		r0 = rf(ctx, lastMessageId, maxCapacity)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*RunnerScaleSetMessage)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, int64, int) error); ok {
+		r1 = rf(ctx, lastMessageId, maxCapacity)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// NewMockSessionService creates a new instance of MockSessionService. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewMockSessionService(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *MockSessionService {
+	mock := &MockSessionService{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

github/actions/sessionservice.go

@@ -5,6 +5,7 @@ import (
 	"io"
 )
 
+//go:generate mockery --inpackage --name=SessionService
 type SessionService interface {
 	GetMessage(ctx context.Context, lastMessageId int64, maxCapacity int) (*RunnerScaleSetMessage, error)
 	DeleteMessage(ctx context.Context, messageId int64) error

go.mod

@@ -1,215 +1,180 @@
 module github.com/actions/actions-runner-controller
 
-go 1.25.3
+go 1.24.3
 
 require (
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1
-	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.4.0
-	github.com/actions/scaleset v0.1.1-0.20260218224657-feb84c6d04fb
-	github.com/bradleyfalzon/ghinstallation/v2 v2.17.0
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.17.0
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.1
+	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.3.0
+	github.com/bradleyfalzon/ghinstallation/v2 v2.14.0
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
 	github.com/evanphx/json-patch v5.9.11+incompatible
-	github.com/go-logr/logr v1.4.3
+	github.com/go-logr/logr v1.4.2
 	github.com/golang-jwt/jwt/v4 v4.5.2
 	github.com/google/go-cmp v0.7.0
 	github.com/google/go-github/v52 v52.0.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/mux v1.8.1
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79
-	github.com/gruntwork-io/terratest v0.54.0
-	github.com/hashicorp/go-retryablehttp v0.7.8
+	github.com/gruntwork-io/terratest v0.48.2
+	github.com/hashicorp/go-retryablehttp v0.7.7
 	github.com/kelseyhightower/envconfig v1.4.0
 	github.com/onsi/ginkgo v1.16.5
-	github.com/onsi/ginkgo/v2 v2.27.3
-	github.com/onsi/gomega v1.38.3
-	github.com/prometheus/client_golang v1.23.2
-	github.com/stretchr/testify v1.11.1
+	github.com/onsi/ginkgo/v2 v2.23.3
+	github.com/onsi/gomega v1.36.3
+	github.com/prometheus/client_golang v1.21.1
+	github.com/stretchr/testify v1.10.0
 	github.com/teambition/rrule-go v1.8.2
 	go.uber.org/multierr v1.11.0
-	go.uber.org/zap v1.27.1
-	golang.org/x/net v0.48.0
-	golang.org/x/oauth2 v0.34.0
-	golang.org/x/sync v0.19.0
+	go.uber.org/zap v1.27.0
+	golang.org/x/net v0.38.0
+	golang.org/x/oauth2 v0.28.0
+	golang.org/x/sync v0.12.0
 	gomodules.xyz/jsonpatch/v2 v2.5.0
 	gopkg.in/yaml.v2 v2.4.0
-	k8s.io/api v0.34.3
-	k8s.io/apimachinery v0.34.3
-	k8s.io/client-go v0.34.3
-	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
-	sigs.k8s.io/controller-runtime v0.22.4
-	sigs.k8s.io/yaml v1.6.0
+	k8s.io/api v0.32.3
+	k8s.io/apimachinery v0.32.3
+	k8s.io/client-go v0.32.3
+	k8s.io/utils v0.0.0-20241210054802-24370beab758
+	sigs.k8s.io/controller-runtime v0.20.4
+	sigs.k8s.io/yaml v1.4.0
 )
 
 require (
 	filippo.io/edwards25519 v1.1.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect
-	github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect
-	github.com/BurntSushi/toml v1.5.0 // indirect
-	github.com/Masterminds/semver/v3 v3.4.0 // indirect
-	github.com/ProtonMail/go-crypto v1.3.0 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.39.2 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.31.12 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.18.16 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.9 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.19.11 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.0 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.3.2 // indirect
+	github.com/BurntSushi/toml v1.4.0 // indirect
+	github.com/ProtonMail/go-crypto v1.1.6 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.36.3 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.29.9 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.62 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.65 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/acm v1.37.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/autoscaling v1.59.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.58.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/dynamodb v1.51.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ec2 v1.254.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ecr v1.50.5 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ecs v1.65.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/iam v1.47.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.11.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/kms v1.45.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/lambda v1.77.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/rds v1.108.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/route53 v1.58.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.88.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.39.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sns v1.38.5 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sqs v1.42.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssm v1.65.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.29.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.38.6 // indirect
-	github.com/aws/smithy-go v1.23.0 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 // indirect
+	github.com/aws/aws-sdk-go-v2/service/acm v1.31.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/autoscaling v1.52.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.46.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/dynamodb v1.41.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ec2 v1.208.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ecr v1.42.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ecs v1.54.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/iam v1.40.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.6.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/kms v1.38.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/lambda v1.70.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/rds v1.94.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/route53 v1.49.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.78.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sns v1.34.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sqs v1.38.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssm v1.57.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.25.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.29.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.33.17 // indirect
+	github.com/aws/smithy-go v1.22.3 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/boombuler/barcode v1.1.0 // indirect
-	github.com/brunoga/deep v1.2.4 // indirect
+	github.com/boombuler/barcode v1.0.2 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cloudflare/circl v1.6.1 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
-	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
-	github.com/fatih/structs v1.1.0 // indirect
-	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/fsnotify/fsnotify v1.8.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/go-errors/errors v1.5.1 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
-	github.com/go-openapi/jsonpointer v0.22.1 // indirect
-	github.com/go-openapi/jsonreference v0.21.2 // indirect
-	github.com/go-openapi/swag v0.25.1 // indirect
-	github.com/go-openapi/swag/cmdutils v0.25.1 // indirect
-	github.com/go-openapi/swag/conv v0.25.1 // indirect
-	github.com/go-openapi/swag/fileutils v0.25.1 // indirect
-	github.com/go-openapi/swag/jsonname v0.25.1 // indirect
-	github.com/go-openapi/swag/jsonutils v0.25.1 // indirect
-	github.com/go-openapi/swag/loading v0.25.1 // indirect
-	github.com/go-openapi/swag/mangling v0.25.1 // indirect
-	github.com/go-openapi/swag/netutils v0.25.1 // indirect
-	github.com/go-openapi/swag/stringutils v0.25.1 // indirect
-	github.com/go-openapi/swag/typeutils v0.25.1 // indirect
-	github.com/go-openapi/swag/yamlutils v0.25.1 // indirect
-	github.com/go-sql-driver/mysql v1.9.3 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/go-sql-driver/mysql v1.9.0 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
-	github.com/gonvenience/bunt v1.4.2 // indirect
-	github.com/gonvenience/idem v0.0.2 // indirect
-	github.com/gonvenience/neat v1.3.16 // indirect
-	github.com/gonvenience/term v1.0.4 // indirect
-	github.com/gonvenience/text v1.0.9 // indirect
-	github.com/gonvenience/ytbx v1.4.7 // indirect
+	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/gonvenience/bunt v1.4.0 // indirect
+	github.com/gonvenience/idem v0.0.1 // indirect
+	github.com/gonvenience/neat v1.3.15 // indirect
+	github.com/gonvenience/term v1.0.3 // indirect
+	github.com/gonvenience/text v1.0.8 // indirect
+	github.com/gonvenience/ytbx v1.4.6 // indirect
 	github.com/google/btree v1.1.3 // indirect
-	github.com/google/gnostic-models v0.7.0 // indirect
-	github.com/google/go-github/v75 v75.0.0 // indirect
+	github.com/google/gnostic-models v0.6.9 // indirect
+	github.com/google/go-github/v69 v69.2.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/google/pprof v0.0.0-20251002213607-436353cc1ee6 // indirect
-	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/pprof v0.0.0-20250302191652-9094ed2288e7 // indirect
+	github.com/gorilla/websocket v1.5.3 // indirect
 	github.com/gruntwork-io/go-commons v0.17.2 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/homeport/dyff v1.10.2 // indirect
-	github.com/huandu/xstrings v1.5.0 // indirect
-	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/homeport/dyff v1.10.1 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgx/v5 v5.7.6 // indirect
+	github.com/jackc/pgx/v5 v5.7.2 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
-	github.com/jedib0t/go-pretty/v6 v6.6.7 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/knadh/koanf/maps v0.1.2 // indirect
-	github.com/knadh/koanf/parsers/yaml v0.1.0 // indirect
-	github.com/knadh/koanf/providers/env v1.0.0 // indirect
-	github.com/knadh/koanf/providers/file v1.1.2 // indirect
-	github.com/knadh/koanf/providers/posflag v0.1.0 // indirect
-	github.com/knadh/koanf/providers/structs v0.1.0 // indirect
-	github.com/knadh/koanf/v2 v2.3.0 // indirect
+	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
-	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
+	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattn/go-ciede2000 v0.0.0-20170301095244-782e8c62fec3 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mattn/go-zglob v0.0.6 // indirect
-	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
 	github.com/mitchellh/hashstructure v1.1.0 // indirect
-	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/spdystream v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
+	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/pquerna/otp v1.5.0 // indirect
-	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.66.1 // indirect
-	github.com/prometheus/procfs v0.17.0 // indirect
-	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/rs/zerolog v1.33.0 // indirect
+	github.com/pquerna/otp v1.4.0 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/common v0.62.0 // indirect
+	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/sergi/go-diff v1.4.0 // indirect
-	github.com/spf13/cobra v1.10.1 // indirect
-	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
+	github.com/spf13/pflag v1.0.6 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/texttheater/golang-levenshtein v1.0.1 // indirect
-	github.com/urfave/cli/v2 v2.27.7 // indirect
-	github.com/vektra/mockery/v3 v3.6.1 // indirect
+	github.com/urfave/cli/v2 v2.27.6 // indirect
 	github.com/virtuald/go-ordered-json v0.0.0-20170621173500-b18e6e673d74 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
-	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
-	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
-	github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 // indirect
-	go.yaml.in/yaml/v2 v2.4.3 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.46.0 // indirect
-	golang.org/x/exp v0.0.0-20251002181428-27f1f14c8bb9 // indirect
-	golang.org/x/mod v0.30.0 // indirect
-	golang.org/x/sys v0.39.0 // indirect
-	golang.org/x/term v0.38.0 // indirect
-	golang.org/x/text v0.32.0 // indirect
-	golang.org/x/time v0.14.0 // indirect
-	golang.org/x/tools v0.39.0 // indirect
-	google.golang.org/protobuf v1.36.10 // indirect
-	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
+	github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
+	golang.org/x/crypto v0.36.0 // indirect
+	golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 // indirect
+	golang.org/x/sys v0.31.0 // indirect
+	golang.org/x/term v0.30.0 // indirect
+	golang.org/x/text v0.23.0 // indirect
+	golang.org/x/time v0.11.0 // indirect
+	golang.org/x/tools v0.31.0 // indirect
+	google.golang.org/protobuf v1.36.5 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/apiextensions-apiserver v0.34.1 // indirect
+	k8s.io/apiextensions-apiserver v0.32.2 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
-	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	k8s.io/kube-openapi v0.0.0-20250304201544-e5f78fe3ede9 // indirect
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
 )
 
-tool github.com/vektra/mockery/v3
-
 replace github.com/gregjones/httpcache => github.com/actions-runner-controller/httpcache v0.2.0

go.sum

@@ -1,201 +1,160 @@
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 github.com/Azure/azure-sdk-for-go v51.0.0+incompatible h1:p7blnyJSjJqf5jflHbSGhIhEpXIgIFmYZNg5uwqweso=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2/go.mod h1:XtLgD3ZD34DAaVIIAyG3objl5DynM3CQ/vMcbBNJZGI=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.4.0 h1:/g8S6wk65vfC6m3FIxJ+i5QDyN9JWwXI8Hb0Img10hU=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.4.0/go.mod h1:gpl+q95AzZlKVI3xSoseF9QPrypk0hQqBiJYeB/cR/I=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 h1:nCYfgcSyHZXJI8J0IWE5MsCGlb2xp9fJiXyxWgmOFg4=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0/go.mod h1:ucUjca2JtSZboY8IoUqyQyuuXvwbMBVwFOm0vdQPNhA=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.17.0 h1:g0EZJwz7xkXQiZAI5xi9f3WWFYBlX1CPTrR+NDToRkQ=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.17.0/go.mod h1:XCW7KnZet0Opnr7HccfUw1PLc4CjHqpcaxW8DHklNkQ=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.1 h1:1mvYtZfWQAnwNah/C+Z+Jb9rQH95LPE2vlmMuWAHJk8=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.1/go.mod h1:75I/mXtme1JyWFtz8GocPHVFyH421IBoZErnO16dd0k=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.1 h1:Bk5uOhSAenHyR5P61D/NzeQCv+4fEVV8mOkJ82NqpWw=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.1/go.mod h1:QZ4pw3or1WPmRBxf0cHd1tknzrT54WPBOQoGutCPvSU=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 h1:ywEEhmNahHBihViHepv3xPBn1663uRv2t2q/ESv9seY=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0/go.mod h1:iZDifYGJTIgIIkYRNWPENUnqx6bJ2xnSDFI2tjwZNuY=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.3.0 h1:WLUIpeyv04H0RCcQHaA4TNoyrQ39Ox7V+re+iaqzTe0=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.3.0/go.mod h1:hd8hTTIY3VmUVPRHNH7GVCHO3SHgXkJKZHReby/bnUQ=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.0 h1:eXnN9kaS8TiDwXjoie3hMRLuwdUBUMW9KRgOqB3mCaw=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.0/go.mod h1:XIpam8wumeZ5rVMuhdDQLMfIPDf1WO3IzrCRO3e3e3o=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgvJqCH0sFfrBUTnUJSBrBf7++ypk+twtRs=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
-github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
-github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
-github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
-github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
-github.com/ProtonMail/go-crypto v1.3.0 h1:ILq8+Sf5If5DCpHQp4PbZdS1J7HDFRXz/+xKBiRGFrw=
-github.com/ProtonMail/go-crypto v1.3.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.3.2 h1:kYRSnvJju5gYVyhkij+RTJ/VR6QIUaCfWeaFm2ycsjQ=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.3.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
+github.com/BurntSushi/toml v1.4.0 h1:kuoIxZQy2WRRk1pttg9asf+WVv6tWQuBNVmK8+nqPr0=
+github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw=
+github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
 github.com/actions-runner-controller/httpcache v0.2.0 h1:hCNvYuVPJ2xxYBymqBvH0hSiQpqz4PHF/LbU3XghGNI=
 github.com/actions-runner-controller/httpcache v0.2.0/go.mod h1:JLu9/2M/btPz1Zu/vTZ71XzukQHn2YeISPmJoM5exBI=
-github.com/actions/scaleset v0.1.1-0.20260218224657-feb84c6d04fb h1:9jQ9/kHm00UTvZf5MiQcZgIVounynwFEhh0wCV3Ts00=
-github.com/actions/scaleset v0.1.1-0.20260218224657-feb84c6d04fb/go.mod h1:ncR5vzCCTUSyLgvclAtZ5dRBgF6qwA2nbTfTXmOJp84=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
-github.com/aws/aws-sdk-go-v2 v1.39.2 h1:EJLg8IdbzgeD7xgvZ+I8M1e0fL0ptn/M47lianzth0I=
-github.com/aws/aws-sdk-go-v2 v1.39.2/go.mod h1:sDioUELIUO9Znk23YVmIk86/9DOpkbyyVb1i/gUNFXY=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1 h1:i8p8P4diljCr60PpJp6qZXNlgX4m2yQFpYk+9ZT+J4E=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1/go.mod h1:ddqbooRZYNoJ2dsTwOty16rM+/Aqmk/GOXrK8cg7V00=
-github.com/aws/aws-sdk-go-v2/config v1.31.12 h1:pYM1Qgy0dKZLHX2cXslNacbcEFMkDMl+Bcj5ROuS6p8=
-github.com/aws/aws-sdk-go-v2/config v1.31.12/go.mod h1:/MM0dyD7KSDPR+39p9ZNVKaHDLb9qnfDurvVS2KAhN8=
-github.com/aws/aws-sdk-go-v2/credentials v1.18.16 h1:4JHirI4zp958zC026Sm+V4pSDwW4pwLefKrc0bF2lwI=
-github.com/aws/aws-sdk-go-v2/credentials v1.18.16/go.mod h1:qQMtGx9OSw7ty1yLclzLxXCRbrkjWAM7JnObZjmCB7I=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.9 h1:Mv4Bc0mWmv6oDuSWTKnk+wgeqPL5DRFu5bQL9BGPQ8Y=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.9/go.mod h1:IKlKfRppK2a1y0gy1yH6zD+yX5uplJ6UuPlgd48dJiQ=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.19.11 h1:w4GjasReY0m9vZA/3YhoBUBi1ZIWUHYQRm61v0BKcZg=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.19.11/go.mod h1:IPS1CSYQ8lfLYGytpMEPW4erZmVFUdxLpC0RCI/RCn8=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9 h1:se2vOWGD3dWQUtfn4wEjRQJb1HK1XsNIt825gskZ970=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9/go.mod h1:hijCGH2VfbZQxqCDN7bwz/4dzxV+hkyhjawAtdPWKZA=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9 h1:6RBnKZLkJM4hQ+kN6E7yWFveOTg8NLPHAkqrs4ZPlTU=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9/go.mod h1:V9rQKRmK7AWuEsOMnHzKj8WyrIir1yUJbZxDuZLFvXI=
+github.com/aws/aws-sdk-go-v2 v1.36.3 h1:mJoei2CxPutQVxaATCzDUjcZEjVRdpsiiXi2o38yqWM=
+github.com/aws/aws-sdk-go-v2 v1.36.3/go.mod h1:LLXuLpgzEbD766Z5ECcRmi8AzSwfZItDtmABVkRLGzg=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 h1:zAybnyUQXIZ5mok5Jqwlf58/TFE7uvd3IAsa1aF9cXs=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10/go.mod h1:qqvMj6gHLR/EXWZw4ZbqlPbQUyenf4h82UQUlKc+l14=
+github.com/aws/aws-sdk-go-v2/config v1.29.9 h1:Kg+fAYNaJeGXp1vmjtidss8O2uXIsXwaRqsQJKXVr+0=
+github.com/aws/aws-sdk-go-v2/config v1.29.9/go.mod h1:oU3jj2O53kgOU4TXq/yipt6ryiooYjlkqqVaZk7gY/U=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.62 h1:fvtQY3zFzYJ9CfixuAQ96IxDrBajbBWGqjNTCa79ocU=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.62/go.mod h1:ElETBxIQqcxej++Cs8GyPBbgMys5DgQPTwo7cUPDKt8=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30 h1:x793wxmUWVDhshP8WW2mlnXuFrO4cOd3HLBroh1paFw=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30/go.mod h1:Jpne2tDnYiFascUEs2AWHJL9Yp7A5ZVy3TNyxaAjD6M=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.65 h1:03zF9oWZyXvw08Say761JGpE9PbeGPd4FAmdpgDAm/I=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.65/go.mod h1:hBobvLKm46Igpcw6tkq9hFUmU14iAOrC5KL6EyYYckA=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 h1:ZK5jHhnrioRkUNOc+hOgQKlUL5JeC3S6JgLxtQ+Rm0Q=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34/go.mod h1:p4VfIceZokChbA9FzMbRGz5OV+lekcVtHlPKEO0gSZY=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 h1:SZwFm17ZUNNg5Np0ioo/gq8Mn6u9w19Mri8DnJ15Jf0=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34/go.mod h1:dFZsC0BLo346mvKQLWmoJxT+Sjp+qcVR1tRVHQGOH9Q=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.9 h1:w9LnHqTq8MEdlnyhV4Bwfizd65lfNCNgdlNC6mM5paE=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.9/go.mod h1:LGEP6EK4nj+bwWNdrvX/FnDTFowdBNwcSPuZu/ouFys=
-github.com/aws/aws-sdk-go-v2/service/acm v1.37.6 h1:48oGbMpBSzihrU145gpjrxySIs+VNGCXu9kLTLAdJJg=
-github.com/aws/aws-sdk-go-v2/service/acm v1.37.6/go.mod h1:4Xgg9iUMFMpWd19UokmUwBCU6fqNJ7LPo11YYt3/xl4=
-github.com/aws/aws-sdk-go-v2/service/autoscaling v1.59.3 h1:2tVkkifL19ZmmCRJyOudUuTNRzA1SYN7D32iEkB8CvE=
-github.com/aws/aws-sdk-go-v2/service/autoscaling v1.59.3/go.mod h1:/Utcw7rzRwiW7C9ypYInnEtgyU7Nr8eG3+RFUUvuE1o=
-github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.58.2 h1:JPW6ND8muLsBwALrf/VXikyokUmGWNKZa88qZWwFGWA=
-github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.58.2/go.mod h1:3Dh12t3s/KrpEm7HNfg5RH+XWzi9LW2QI7velkc61ac=
-github.com/aws/aws-sdk-go-v2/service/dynamodb v1.51.0 h1:TfglMkeRNYNGkyJ+XOTQJJ/RQb+MBlkiMn2H7DYuZok=
-github.com/aws/aws-sdk-go-v2/service/dynamodb v1.51.0/go.mod h1:AdM9p8Ytg90UaNYrZIsOivYeC5cDvTPC2Mqw4/2f2aM=
-github.com/aws/aws-sdk-go-v2/service/ec2 v1.254.1 h1:7p9bJCZ/b3EJXXARW7JMEs2IhsnI4YFHpfXQfgMh0eg=
-github.com/aws/aws-sdk-go-v2/service/ec2 v1.254.1/go.mod h1:M8WWWIfXmxA4RgTXcI/5cSByxRqjgne32Sh0VIbrn0A=
-github.com/aws/aws-sdk-go-v2/service/ecr v1.50.5 h1:jzjNyiIrXJHumV1hwofcQLpIZtcDw+vPQL00rLI3s4g=
-github.com/aws/aws-sdk-go-v2/service/ecr v1.50.5/go.mod h1:UtPKcYVHY6RrV9EaaM1KZGNaf9dgviFdsT6xoFMLQsM=
-github.com/aws/aws-sdk-go-v2/service/ecs v1.65.1 h1:pBbXc1fGRbrYl7NFujuubMmEFEp7CJiKTBsoDOIUkuk=
-github.com/aws/aws-sdk-go-v2/service/ecs v1.65.1/go.mod h1:fu6WrWUHYyPRjzYO13UDXA7O6OShI8QbH5YSl9SOJwQ=
-github.com/aws/aws-sdk-go-v2/service/iam v1.47.7 h1:0EDAdmMTzsgXl++8a0JZ+Yx0/dOqT8o/EONknxlQK94=
-github.com/aws/aws-sdk-go-v2/service/iam v1.47.7/go.mod h1:NkNbn/8/mFrPUq0Kg6EM6c0+GaTLG+aPzXxwB7RF5xo=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 h1:oegbebPEMA/1Jny7kvwejowCaHz1FWZAQ94WXFNCyTM=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1/go.mod h1:kemo5Myr9ac0U9JfSjMo9yHLtw+pECEHsFtJ9tqCEI8=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.9 h1:by3nYZLR9l8bUH7kgaMU4dJgYFjyRdFEfORlDpPILB4=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.9/go.mod h1:IWjQYlqw4EX9jw2g3qnEPPWvCE6bS8fKzhMed1OK7c8=
-github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.11.9 h1:7ILIzhRlYbHmZDdkF15B+RGEO8sGbdSe0RelD0RcV6M=
-github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.11.9/go.mod h1:6LLPgzztobazqK65Q5qYsFnxwsN0v6cktuIvLC5M7DM=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.9 h1:5r34CgVOD4WZudeEKZ9/iKpiT6cM1JyEROpXjOcdWv8=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.9/go.mod h1:dB12CEbNWPbzO2uC6QSWHteqOg4JfBVJOojbAoAUb5I=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.9 h1:wuZ5uW2uhJR63zwNlqWH2W4aL4ZjeJP3o92/W+odDY4=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.9/go.mod h1:/G58M2fGszCrOzvJUkDdY8O9kycodunH4VdT5oBAqls=
-github.com/aws/aws-sdk-go-v2/service/kms v1.45.6 h1:Br3kil4j7RPW+7LoLVkYt8SuhIWlg6ylmbmzXJ7PgXY=
-github.com/aws/aws-sdk-go-v2/service/kms v1.45.6/go.mod h1:FKXkHzw1fJZtg1P1qoAIiwen5thz/cDRTTDCIu8ljxc=
-github.com/aws/aws-sdk-go-v2/service/lambda v1.77.6 h1:bU48NwA1e9jFkng1qYUVQjdJFEIv0oxhDO/Zz57M5IU=
-github.com/aws/aws-sdk-go-v2/service/lambda v1.77.6/go.mod h1:LFNm6TvaFI2Li7U18hJB++k+qH5nK3TveIFD7x9TFHc=
-github.com/aws/aws-sdk-go-v2/service/rds v1.108.0 h1:YjrOsnMMAv01zkaBxbGzEm2gy4/mrFfSiIlbYLAf8ZQ=
-github.com/aws/aws-sdk-go-v2/service/rds v1.108.0/go.mod h1:VOBL5tbhS7AF0m5YpfwLuRBpb5QVp4EWSPizUr/D6iE=
-github.com/aws/aws-sdk-go-v2/service/route53 v1.58.4 h1:KycXrohD5OxAZ5h02YechO2gevvoHfAPAaJM5l8zqb0=
-github.com/aws/aws-sdk-go-v2/service/route53 v1.58.4/go.mod h1:xNLZLn4SusktBQ5moqUOgiDKGz3a7vHwF4W0KD+WBPc=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.88.3 h1:P18I4ipbk+b/3dZNq5YYh+Hq6XC0vp5RWkLp1tJldDA=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.88.3/go.mod h1:Rm3gw2Jov6e6kDuamDvyIlZJDMYk97VeCZ82wz/mVZ0=
-github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.39.6 h1:9PWl450XOG+m5lKv+qg5BXso1eLxpsZLqq7VPug5km0=
-github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.39.6/go.mod h1:hwt7auGsDcaNQ8pzLgE2kCNyIWouYlAKSjuUu5Dqr7I=
-github.com/aws/aws-sdk-go-v2/service/sns v1.38.5 h1:c0hINjMfDQvQLJJxfNNcIaLYVLC7E0W2zOQOVVKLnnU=
-github.com/aws/aws-sdk-go-v2/service/sns v1.38.5/go.mod h1:E427ZzdOMWh/4KtD48AGfbWLX14iyw9URVOdIwtv80o=
-github.com/aws/aws-sdk-go-v2/service/sqs v1.42.8 h1:cWiY+//XL5QOYKJyf4Pvt+oE/5wSIi095+bS+ME2lGw=
-github.com/aws/aws-sdk-go-v2/service/sqs v1.42.8/go.mod h1:sLvnKf0p0sMQ33nkJGP2NpYyWHMojpL0O9neiCGc9lc=
-github.com/aws/aws-sdk-go-v2/service/ssm v1.65.1 h1:TFg6XiS7EsHN0/jpV3eVNczZi/sPIVP5jxIs+euIESQ=
-github.com/aws/aws-sdk-go-v2/service/ssm v1.65.1/go.mod h1:OIezd9K0sM/64DDP4kXx/i0NdgXu6R5KE6SCsIPJsjc=
-github.com/aws/aws-sdk-go-v2/service/sso v1.29.6 h1:A1oRkiSQOWstGh61y4Wc/yQ04sqrQZr1Si/oAXj20/s=
-github.com/aws/aws-sdk-go-v2/service/sso v1.29.6/go.mod h1:5PfYspyCU5Vw1wNPsxi15LZovOnULudOQuVxphSflQA=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.1 h1:5fm5RTONng73/QA73LhCNR7UT9RpFH3hR6HWL6bIgVY=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.1/go.mod h1:xBEjWD13h+6nq+z4AkqSfSvqRKFgDIQeaMguAJndOWo=
-github.com/aws/aws-sdk-go-v2/service/sts v1.38.6 h1:p3jIvqYwUZgu/XYeI48bJxOhvm47hZb5HUQ0tn6Q9kA=
-github.com/aws/aws-sdk-go-v2/service/sts v1.38.6/go.mod h1:WtKK+ppze5yKPkZ0XwqIVWD4beCwv056ZbPQNoeHqM8=
-github.com/aws/smithy-go v1.23.0 h1:8n6I3gXzWJB2DxBDnfxgBaSX6oe0d/t10qGz7OKqMCE=
-github.com/aws/smithy-go v1.23.0/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 h1:ZNTqv4nIdE/DiBfUUfXcLZ/Spcuz+RjeziUtNJackkM=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34/go.mod h1:zf7Vcd1ViW7cPqYWEHLHJkS50X0JS2IKz9Cgaj6ugrs=
+github.com/aws/aws-sdk-go-v2/service/acm v1.31.1 h1:FB1PgU6vlXbqehxZiHuYQRWo5Ou6sQrFJcUaRe27lRo=
+github.com/aws/aws-sdk-go-v2/service/acm v1.31.1/go.mod h1:3sKYAgRbuBa2QMYGh/WEclwnmfx+QoPhhX25PdSQSQM=
+github.com/aws/aws-sdk-go-v2/service/autoscaling v1.52.1 h1:wj4AION3NjQvjOiI8wm+TVU8y+8EsTl7fSgJAzk9cgc=
+github.com/aws/aws-sdk-go-v2/service/autoscaling v1.52.1/go.mod h1:CDqMoc3KRdZJ8qziW96J35lKH01Wq3B2aihtHj2JbRs=
+github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.46.1 h1:pYm/RS3V/UaSAkHAGZUJuECz7f9y8WTPmu9Q+4JcigE=
+github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.46.1/go.mod h1:uo14VBn5cNk/BPGTPz3kyLBxgpgOObgO8lmz+H7Z4Ck=
+github.com/aws/aws-sdk-go-v2/service/dynamodb v1.41.1 h1:DEys4E5Q2p735j56lteNVyByIBDAlMrO5VIEd9RC0/4=
+github.com/aws/aws-sdk-go-v2/service/dynamodb v1.41.1/go.mod h1:yYaWRnVSPyAmexW5t7G3TcuYoalYfT+xQwzWsvtUQ7M=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.208.0 h1:qzT4wyLo7ssa4QU8Xcf+h+iyCF4WTeQtM8fjr+UUKyI=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.208.0/go.mod h1:ouvGEfHbLaIlWwpDpOVWPWR+YwO0HDv3vm5tYLq8ImY=
+github.com/aws/aws-sdk-go-v2/service/ecr v1.42.1 h1:mgtRN6wS2Frq29O7YNTn18ieokL193RFpLhUbsvs7o0=
+github.com/aws/aws-sdk-go-v2/service/ecr v1.42.1/go.mod h1:iQ1skgw1XRK+6Lgkb0I9ODatAP72WoTILh0zXQ5DtbU=
+github.com/aws/aws-sdk-go-v2/service/ecs v1.54.1 h1:h0D7tqShlfhcTT6FGbE7IFsCIZLCmLXpYnYORZqg37I=
+github.com/aws/aws-sdk-go-v2/service/ecs v1.54.1/go.mod h1:wAtdeFanDuF9Re/ge4DRDaYe3Wy1OGrU7jG042UcuI4=
+github.com/aws/aws-sdk-go-v2/service/iam v1.40.1 h1:PaHCkW8rtLrA89xM/0LsY/NSIQETqmN+f1vt70EmpB8=
+github.com/aws/aws-sdk-go-v2/service/iam v1.40.1/go.mod h1:mPJkGQzeCoPs82ElNILor2JzZgYENr4UaSKUT8K27+c=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 h1:eAh2A4b5IzM/lum78bZ590jy36+d/aFLgKF/4Vd1xPE=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3/go.mod h1:0yKJC/kb8sAnmlYa6Zs3QVYqaC8ug2AbnNChv5Ox3uA=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.6.2 h1:t/gZFyrijKuSU0elA5kRngP/oU3mc0I+Dvp8HwRE4c0=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.6.2/go.mod h1:iu6FSzgt+M2/x3Dk8zhycdIcHjEFb36IS8HVUVFoMg0=
+github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.15 h1:M1R1rud7HzDrfCdlBQ7NjnRsDNEhXO/vGhuD189Ggmk=
+github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.15/go.mod h1:uvFKBSq9yMPV4LGAi7N4awn4tLY+hKE35f8THes2mzQ=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 h1:dM9/92u2F1JbDaGooxTq18wmmFzbJRfXfVfy96/1CXM=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15/go.mod h1:SwFBy2vjtA0vZbjjaFtfN045boopadnoVPhu4Fv66vY=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 h1:moLQUoVq91LiqT1nbvzDukyqAlCv89ZmwaHw/ZFlFZg=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15/go.mod h1:ZH34PJUc8ApjBIfgQCFvkWcUDBtl/WTD+uiYHjd8igA=
+github.com/aws/aws-sdk-go-v2/service/kms v1.38.1 h1:tecq7+mAav5byF+Mr+iONJnCBf4B4gon8RSp4BrweSc=
+github.com/aws/aws-sdk-go-v2/service/kms v1.38.1/go.mod h1:cQn6tAF77Di6m4huxovNM7NVAozWTZLsDRp9t8Z/WYk=
+github.com/aws/aws-sdk-go-v2/service/lambda v1.70.1 h1:EabaKQAptxXAeSL0sXKqfupPe/CpH965wqoloUK0aMM=
+github.com/aws/aws-sdk-go-v2/service/lambda v1.70.1/go.mod h1:c27kk10S36lBYgbG1jR3opn4OAS5Y/4wjJa1GiHK/X4=
+github.com/aws/aws-sdk-go-v2/service/rds v1.94.1 h1:OxrMHbabEdgwKLdMYvnHJju4XFyemN+rknceKU3lyvE=
+github.com/aws/aws-sdk-go-v2/service/rds v1.94.1/go.mod h1:CXiHj5rVyQ5Q3zNSoYzwaJfWm8IGDweyyCGfO8ei5fQ=
+github.com/aws/aws-sdk-go-v2/service/route53 v1.49.1 h1:krDhGq5RpSgpfPB9riTYLLSoCB8bNBhtdva6t1HDEWc=
+github.com/aws/aws-sdk-go-v2/service/route53 v1.49.1/go.mod h1:kGYOjvTa0Vw0qxrqrOLut1vMnui6qLxqv/SX3vYeM8Y=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.78.1 h1:1M0gSbyP6q06gl3384wpoKPaH9G16NPqZFieEhLboSU=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.78.1/go.mod h1:4qzsZSzB/KiX2EzDjs9D7A8rI/WGJxZceVJIHqtJjIU=
+github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.2 h1:vlYXbindmagyVA3RS2SPd47eKZ00GZZQcr+etTviHtc=
+github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.2/go.mod h1:yGhDiLKguA3iFJYxbrQkQiNzuy+ddxesSZYWVeeEH5Q=
+github.com/aws/aws-sdk-go-v2/service/sns v1.34.2 h1:PajtbJ/5bEo6iUAIGMYnK8ljqg2F1h4mMCGh1acjN30=
+github.com/aws/aws-sdk-go-v2/service/sns v1.34.2/go.mod h1:PJtxxMdj747j8DeZENRTTYAz/lx/pADn/U0k7YNNiUY=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.38.1 h1:ZtgZeMPJH8+/vNs9vJFFLI0QEzYbcN0p7x1/FFwyROc=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.38.1/go.mod h1:Bar4MrRxeqdn6XIh8JGfiXuFRmyrrsZNTJotxEJmWW0=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.57.2 h1:3//q1r7gW/kpiWiPfFILw+N81rangyyMJV6vrznFyvw=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.57.2/go.mod h1:PUWUl5MDiYNQkUHN9Pyd9kgtA/YhbxnSnHP+yQqzrM8=
+github.com/aws/aws-sdk-go-v2/service/sso v1.25.1 h1:8JdC7Gr9NROg1Rusk25IcZeTO59zLxsKgE0gkh5O6h0=
+github.com/aws/aws-sdk-go-v2/service/sso v1.25.1/go.mod h1:qs4a9T5EMLl/Cajiw2TcbNt2UNo/Hqlyp+GiuG4CFDI=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.29.1 h1:KwuLovgQPcdjNMfFt9OhUd9a2OwcOKhxfvF4glTzLuA=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.29.1/go.mod h1:MlYRNmYu/fGPoxBQVvBYr9nyr948aY/WLUvwBMBJubs=
+github.com/aws/aws-sdk-go-v2/service/sts v1.33.17 h1:PZV5W8yk4OtH1JAuhV2PXwwO9v5G5Aoj+eMCn4T+1Kc=
+github.com/aws/aws-sdk-go-v2/service/sts v1.33.17/go.mod h1:cQnB8CUnxbMU82JvlqjKR2HBOm3fe9pWorWBza6MBJ4=
+github.com/aws/smithy-go v1.22.3 h1:Z//5NuZCSW6R4PhQ93hShNbyBbn8BWCmCVCt+Q8Io5k=
+github.com/aws/smithy-go v1.22.3/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
-github.com/boombuler/barcode v1.1.0 h1:ChaYjBR63fr4LFyGn8E8nt7dBSt3MiU3zMOZqFvVkHo=
-github.com/boombuler/barcode v1.1.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
-github.com/bradleyfalzon/ghinstallation/v2 v2.17.0 h1:SmbUK/GxpAspRjSQbB6ARvH+ArzlNzTtHydNyXUQ6zg=
-github.com/bradleyfalzon/ghinstallation/v2 v2.17.0/go.mod h1:vuD/xvJT9Y+ZVZRv4HQ42cMyPFIYqpc7AbB4Gvt/DlY=
-github.com/brunoga/deep v1.2.4 h1:Aj9E9oUbE+ccbyh35VC/NHlzzjfIVU69BXu2mt2LmL8=
-github.com/brunoga/deep v1.2.4/go.mod h1:GDV6dnXqn80ezsLSZ5Wlv1PdKAWAO4L5PnKYtv2dgaI=
+github.com/boombuler/barcode v1.0.2 h1:79yrbttoZrLGkL/oOI8hBrUKucwOL0oOjUgEguGMcJ4=
+github.com/boombuler/barcode v1.0.2/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
+github.com/bradleyfalzon/ghinstallation/v2 v2.14.0 h1:0D4vKCHOvYrDU8u61TnE2JfNT4VRrBLphmxtqazTO+M=
+github.com/bradleyfalzon/ghinstallation/v2 v2.14.0/go.mod h1:LOVmdZYVZ8jqdr4n9wWm1ocDiMz9IfMGfRkaYC1a52A=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
 github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
-github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
-github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
-github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
+github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
+github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/evanphx/json-patch v5.9.11+incompatible h1:ixHHqfcGvxhWkniF1tWxBHA0yb4Z+d1UQi45df52xW8=
 github.com/evanphx/json-patch v5.9.11+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
 github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
 github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
 github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
-github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=
-github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
-github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
-github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
-github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/gkampitakis/ciinfo v0.3.2 h1:JcuOPk8ZU7nZQjdUhctuhQofk7BGHuIy0c9Ez8BNhXs=
-github.com/gkampitakis/ciinfo v0.3.2/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo=
-github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZdC4M=
-github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6OPYerdAAS9tk=
-github.com/gkampitakis/go-snaps v0.5.15 h1:amyJrvM1D33cPHwVrjo9jQxX8g/7E2wYdZ+01KS3zGE=
-github.com/gkampitakis/go-snaps v0.5.15/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc=
+github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
+github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
+github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
 github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
 github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
-github.com/go-openapi/jsonpointer v0.22.1 h1:sHYI1He3b9NqJ4wXLoJDKmUmHkWy/L7rtEo92JUxBNk=
-github.com/go-openapi/jsonpointer v0.22.1/go.mod h1:pQT9OsLkfz1yWoMgYFy4x3U5GY5nUlsOn1qSBH5MkCM=
-github.com/go-openapi/jsonreference v0.21.2 h1:Wxjda4M/BBQllegefXrY/9aq1fxBA8sI5M/lFU6tSWU=
-github.com/go-openapi/jsonreference v0.21.2/go.mod h1:pp3PEjIsJ9CZDGCNOyXIQxsNuroxm8FAJ/+quA0yKzQ=
-github.com/go-openapi/swag v0.25.1 h1:6uwVsx+/OuvFVPqfQmOOPsqTcm5/GkBhNwLqIR916n8=
-github.com/go-openapi/swag v0.25.1/go.mod h1:bzONdGlT0fkStgGPd3bhZf1MnuPkf2YAys6h+jZipOo=
-github.com/go-openapi/swag/cmdutils v0.25.1 h1:nDke3nAFDArAa631aitksFGj2omusks88GF1VwdYqPY=
-github.com/go-openapi/swag/cmdutils v0.25.1/go.mod h1:pdae/AFo6WxLl5L0rq87eRzVPm/XRHM3MoYgRMvG4A0=
-github.com/go-openapi/swag/conv v0.25.1 h1:+9o8YUg6QuqqBM5X6rYL/p1dpWeZRhoIt9x7CCP+he0=
-github.com/go-openapi/swag/conv v0.25.1/go.mod h1:Z1mFEGPfyIKPu0806khI3zF+/EUXde+fdeksUl2NiDs=
-github.com/go-openapi/swag/fileutils v0.25.1 h1:rSRXapjQequt7kqalKXdcpIegIShhTPXx7yw0kek2uU=
-github.com/go-openapi/swag/fileutils v0.25.1/go.mod h1:+NXtt5xNZZqmpIpjqcujqojGFek9/w55b3ecmOdtg8M=
-github.com/go-openapi/swag/jsonname v0.25.1 h1:Sgx+qbwa4ej6AomWC6pEfXrA6uP2RkaNjA9BR8a1RJU=
-github.com/go-openapi/swag/jsonname v0.25.1/go.mod h1:71Tekow6UOLBD3wS7XhdT98g5J5GR13NOTQ9/6Q11Zo=
-github.com/go-openapi/swag/jsonutils v0.25.1 h1:AihLHaD0brrkJoMqEZOBNzTLnk81Kg9cWr+SPtxtgl8=
-github.com/go-openapi/swag/jsonutils v0.25.1/go.mod h1:JpEkAjxQXpiaHmRO04N1zE4qbUEg3b7Udll7AMGTNOo=
-github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.1 h1:DSQGcdB6G0N9c/KhtpYc71PzzGEIc/fZ1no35x4/XBY=
-github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.1/go.mod h1:kjmweouyPwRUEYMSrbAidoLMGeJ5p6zdHi9BgZiqmsg=
-github.com/go-openapi/swag/loading v0.25.1 h1:6OruqzjWoJyanZOim58iG2vj934TysYVptyaoXS24kw=
-github.com/go-openapi/swag/loading v0.25.1/go.mod h1:xoIe2EG32NOYYbqxvXgPzne989bWvSNoWoyQVWEZicc=
-github.com/go-openapi/swag/mangling v0.25.1 h1:XzILnLzhZPZNtmxKaz/2xIGPQsBsvmCjrJOWGNz/ync=
-github.com/go-openapi/swag/mangling v0.25.1/go.mod h1:CdiMQ6pnfAgyQGSOIYnZkXvqhnnwOn997uXZMAd/7mQ=
-github.com/go-openapi/swag/netutils v0.25.1 h1:2wFLYahe40tDUHfKT1GRC4rfa5T1B4GWZ+msEFA4Fl4=
-github.com/go-openapi/swag/netutils v0.25.1/go.mod h1:CAkkvqnUJX8NV96tNhEQvKz8SQo2KF0f7LleiJwIeRE=
-github.com/go-openapi/swag/stringutils v0.25.1 h1:Xasqgjvk30eUe8VKdmyzKtjkVjeiXx1Iz0zDfMNpPbw=
-github.com/go-openapi/swag/stringutils v0.25.1/go.mod h1:JLdSAq5169HaiDUbTvArA2yQxmgn4D6h4A+4HqVvAYg=
-github.com/go-openapi/swag/typeutils v0.25.1 h1:rD/9HsEQieewNt6/k+JBwkxuAHktFtH3I3ysiFZqukA=
-github.com/go-openapi/swag/typeutils v0.25.1/go.mod h1:9McMC/oCdS4BKwk2shEB7x17P6HmMmA6dQRtAkSnNb8=
-github.com/go-openapi/swag/yamlutils v0.25.1 h1:mry5ez8joJwzvMbaTGLhw8pXUnhDK91oSJLDPF1bmGk=
-github.com/go-openapi/swag/yamlutils v0.25.1/go.mod h1:cm9ywbzncy3y6uPm/97ysW8+wZ09qsks+9RS8fLWKqg=
-github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
-github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
+github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
+github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
+github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
+github.com/go-sql-driver/mysql v1.9.0 h1:Y0zIbQXhQKmQgTp44Y1dp3wTXcn804QoTptLZT1vtvo=
+github.com/go-sql-driver/mysql v1.9.0/go.mod h1:pDetrLJeA3oMujJuvXc8RJoasr589B6A9fwzD3QMrqw=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
-github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
-github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
-github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
-github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
-github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
 github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
-github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
-github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
+github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
@@ -203,49 +162,52 @@ github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrU
 github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/gonvenience/bunt v1.4.2 h1:nTgkFZsw38SIJKABhLj8aXj2rqion9Zo1so/EBkbFBY=
-github.com/gonvenience/bunt v1.4.2/go.mod h1:WjyEO2rSYR+OLZg67Ucl+gjdXPs8GpFl63SCA02XDyI=
-github.com/gonvenience/idem v0.0.2 h1:jWHknjPfSbiWgYKre9wB2FhMgVLd1RWXCXzVq+7VIWg=
-github.com/gonvenience/idem v0.0.2/go.mod h1:0Xv1MpnNL40+dsyOxaJFa7L8ekeTRr63WaWXpiWLFFM=
-github.com/gonvenience/neat v1.3.16 h1:Vb0iCkSHGWaA+ry69RY3HpQ6Ooo6o/g2wjI80db8DjI=
-github.com/gonvenience/neat v1.3.16/go.mod h1:sLxdQNNluxbpROxTTHs3XBSJX8fwFX5toEULUy74ODA=
-github.com/gonvenience/term v1.0.4 h1:qkCGfmUtpzs9W4jWgNijaGF6dg3oSIh+kZCzT5cPNZY=
-github.com/gonvenience/term v1.0.4/go.mod h1:OzNdQC5NVBou9AifaHd1QG6EP8iDdpaT7GFm1bVgslg=
-github.com/gonvenience/text v1.0.9 h1:U29BxT3NZnNPcfiEnAwt6yHXe38fQs2Q+WTqs1X+atI=
-github.com/gonvenience/text v1.0.9/go.mod h1:JQF1ifXNRaa66jnPLqoITA+y8WATlG0eJzFC9ElJS3s=
-github.com/gonvenience/ytbx v1.4.7 h1:3wJ7EOfdv3Lg+h0mzKo7f8d1zMY1EJtVzzYrA3UhjHQ=
-github.com/gonvenience/ytbx v1.4.7/go.mod h1:ZmAU727eOTYeC4aUJuqyb9vogNAN7NiSKfw6Aoxbqys=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/gonvenience/bunt v1.4.0 h1:xRAANCgSmQwGoHIyWg80yFgomTiblBayUUSBBPjDHK4=
+github.com/gonvenience/bunt v1.4.0/go.mod h1:J9S2b1ZmUKdvybPxhq0hhrIvAwxcUXJjerudNa2Fhdw=
+github.com/gonvenience/idem v0.0.1 h1:SMqv4DI2ErBOsoohVyqBOeCCLrag6N7iClwJbmZBTYo=
+github.com/gonvenience/idem v0.0.1/go.mod h1:Br/o1pWtrbiPTuZrn7nPV6TJQL0qbaoGNmJZ8+A7MyU=
+github.com/gonvenience/neat v1.3.15 h1:qRMZzVP/HtLsQLKZGW8NGZIXdH1TMHsPjMJe2tvzDqk=
+github.com/gonvenience/neat v1.3.15/go.mod h1:TMdu+WVzfRU46GvcMAYALdvlWxiUxP1yqpZn/hKUhP8=
+github.com/gonvenience/term v1.0.3 h1:8MleXhMCCzLeWXmiEA/IQ/ZoaKBL5mHrmRVJsU1nWtI=
+github.com/gonvenience/term v1.0.3/go.mod h1:VJaaP9pwAlSYSlyv1O7schD/GZJRg8HUmiulQmGOABw=
+github.com/gonvenience/text v1.0.8 h1:yIxiyXnKDqfe8JDPldZYaeYHU19XOPNN5VFPETCyNI0=
+github.com/gonvenience/text v1.0.8/go.mod h1:pUCCo022AtxoY2LJfJPNBzBc0oC2/Vp+tx8UaIc5RR8=
+github.com/gonvenience/ytbx v1.4.6 h1:sXf0/kCBEAbrOBsj8aRpDvdRRkVl/3UZmNLKy4oFY+I=
+github.com/gonvenience/ytbx v1.4.6/go.mod h1:LHhrtuB5ghXlU+l1NJJR3Wt1ZnpbQScqyshpXisYplE=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
-github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
-github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
+github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-github/v52 v52.0.0 h1:uyGWOY+jMQ8GVGSX8dkSwCzlehU3WfdxQ7GweO/JP7M=
 github.com/google/go-github/v52 v52.0.0/go.mod h1:WJV6VEEUPuMo5pXqqa2ZCZEdbQqua4zAk2MZTIo+m+4=
-github.com/google/go-github/v75 v75.0.0 h1:k7q8Bvg+W5KxRl9Tjq16a9XEgVY1pwuiG5sIL7435Ic=
-github.com/google/go-github/v75 v75.0.0/go.mod h1:H3LUJEA1TCrzuUqtdAQniBNwuKiQIqdGKgBo1/M/uqI=
+github.com/google/go-github/v69 v69.2.0 h1:wR+Wi/fN2zdUx9YxSmYE0ktiX9IAR/BeePzeaUUbEHE=
+github.com/google/go-github/v69 v69.2.0/go.mod h1:xne4jymxLR6Uj9b7J7PyTpkMYstEMMwGZa0Aehh1azM=
 github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
 github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20251002213607-436353cc1ee6 h1:/WHh/1k4thM/w+PAZEIiZK9NwCMFahw5tUzKUCnUtds=
-github.com/google/pprof v0.0.0-20251002213607-436353cc1ee6/go.mod h1:I6V7YzU0XDpsHqbsyrghnFZLO1gwK6NPTNvmetQIk9U=
+github.com/google/pprof v0.0.0-20250302191652-9094ed2288e7 h1:+J3r2e8+RsmN3vKfo75g0YSY61ms37qzPglu4p0sGro=
+github.com/google/pprof v0.0.0-20250302191652-9094ed2288e7/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
-github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
-github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
+github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
+github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gruntwork-io/go-commons v0.17.2 h1:14dsCJ7M5Vv2X3BIPKeG9Kdy6vTMGhM8L4WZazxfTuY=
 github.com/gruntwork-io/go-commons v0.17.2/go.mod h1:zs7Q2AbUKuTarBPy19CIxJVUX/rBamfW8IwuWKniWkE=
-github.com/gruntwork-io/terratest v0.54.0 h1:JOVATYDpU0NAPbEkgYUP50BR2m45UGiR4dbs20sKzck=
-github.com/gruntwork-io/terratest v0.54.0/go.mod h1:QvwQWZMTJmJB4E0d1Uc18quQm7+X53liKKp+fJSuaKA=
+github.com/gruntwork-io/terratest v0.48.2 h1:+VwfODchq8jxZZWD+s8gBlhD1z6/C4bFLNrhpm9ONrs=
+github.com/gruntwork-io/terratest v0.48.2/go.mod h1:Y5ETyD4ZQ2MZhasPno272fWuCpKwvTPYDi8Y0tIMqTE=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -255,51 +217,31 @@ github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB1
 github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
-github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
-github.com/homeport/dyff v1.10.2 h1:XyB+D0KVwjbUFTZYIkvPtsImwkfh+ObH2CEdEHTqdr4=
-github.com/homeport/dyff v1.10.2/go.mod h1:0kIjL/JOGaXigzrLY6kcl5esSStbAa99r6GzEvr7lrs=
+github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
+github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
+github.com/homeport/dyff v1.10.1 h1:D5Ydf++licJ1WblIGh8oSw2p1oBg9P6M8wAJcKuyjX0=
+github.com/homeport/dyff v1.10.1/go.mod h1:RvQm7AT4Sx0RI8C5/xCc+6QvKuSjc4aX53qarA2PnZU=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
-github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
-github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
-github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
-github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.7.6 h1:rWQc5FwZSPX58r1OQmkuaNicxdmExaEz5A2DO2hUuTk=
-github.com/jackc/pgx/v5 v5.7.6/go.mod h1:aruU7o91Tc2q2cFp5h4uP3f6ztExVpyVv88Xl/8Vl8M=
+github.com/jackc/pgx/v5 v5.7.2 h1:mLoDLV6sonKlvjIEsV56SkWNCnuNv531l94GaIzO+XI=
+github.com/jackc/pgx/v5 v5.7.2/go.mod h1:ncY89UGWxg82EykZUwSpUKEfccBGGYq1xjrOpsbsfGQ=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
-github.com/jedib0t/go-pretty/v6 v6.6.7 h1:m+LbHpm0aIAPLzLbMfn8dc3Ht8MW7lsSO4MPItz/Uuo=
-github.com/jedib0t/go-pretty/v6 v6.6.7/go.mod h1:YwC5CE4fJ1HFUDeivSV1r//AmANFHyqczZk+U6BDALU=
-github.com/joshdk/go-junit v1.0.0 h1:S86cUKIdwBHWwA6xCmFlf3RTLfVXYQfvanM5Uh+K6GE=
-github.com/joshdk/go-junit v1.0.0/go.mod h1:TiiV0PqkaNfFXjEiyjWM3XXrhVyCa1K4Zfga6W52ung=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kelseyhightower/envconfig v1.4.0 h1:Im6hONhd3pLkfDFsbRgu68RDNkGF1r3dvMUtDTo2cv8=
 github.com/kelseyhightower/envconfig v1.4.0/go.mod h1:cccZRl6mQpaq41TPp5QxidR+Sa3axMbJDNb//FQX6Gg=
-github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU=
-github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k=
+github.com/keybase/go-keychain v0.0.0-20231219164618-57a3676c3af6 h1:IsMZxCuZqKuao2vNdfD82fjjgPLfyHLpR41Z88viRWs=
+github.com/keybase/go-keychain v0.0.0-20231219164618-57a3676c3af6/go.mod h1:3VeWNIJaW+O5xpRQbPp0Ybqu1vJd/pm7s2F473HRrkw=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
-github.com/knadh/koanf/maps v0.1.2 h1:RBfmAW5CnZT+PJ1CVc1QSJKf4Xu9kxfQgYVQSu8hpbo=
-github.com/knadh/koanf/maps v0.1.2/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI=
-github.com/knadh/koanf/parsers/yaml v0.1.0 h1:ZZ8/iGfRLvKSaMEECEBPM1HQslrZADk8fP1XFUxVI5w=
-github.com/knadh/koanf/parsers/yaml v0.1.0/go.mod h1:cvbUDC7AL23pImuQP0oRw/hPuccrNBS2bps8asS0CwY=
-github.com/knadh/koanf/providers/env v1.0.0 h1:ufePaI9BnWH+ajuxGGiJ8pdTG0uLEUWC7/HDDPGLah0=
-github.com/knadh/koanf/providers/env v1.0.0/go.mod h1:mzFyRZueYhb37oPmC1HAv/oGEEuyvJDA98r3XAa8Gak=
-github.com/knadh/koanf/providers/file v1.1.2 h1:aCC36YGOgV5lTtAFz2qkgtWdeQsgfxUkxDOe+2nQY3w=
-github.com/knadh/koanf/providers/file v1.1.2/go.mod h1:/faSBcv2mxPVjFrXck95qeoyoZ5myJ6uxN8OOVNJJCI=
-github.com/knadh/koanf/providers/posflag v0.1.0 h1:mKJlLrKPcAP7Ootf4pBZWJ6J+4wHYujwipe7Ie3qW6U=
-github.com/knadh/koanf/providers/posflag v0.1.0/go.mod h1:SYg03v/t8ISBNrMBRMlojH8OsKowbkXV7giIbBVgbz0=
-github.com/knadh/koanf/providers/structs v0.1.0 h1:wJRteCNn1qvLtE5h8KQBvLJovidSdntfdyIbbCzEyE0=
-github.com/knadh/koanf/providers/structs v0.1.0/go.mod h1:sw2YZ3txUcqA3Z27gPlmmBzWn1h8Nt9O6EP/91MkcWE=
-github.com/knadh/koanf/v2 v2.3.0 h1:Qg076dDRFHvqnKG97ZEsi9TAg2/nFTa9hCdcSa1lvlM=
-github.com/knadh/koanf/v2 v2.3.0/go.mod h1:gRb40VRAbd4iJMYYD5IxZ6hfuopFcXBpc9bbQpZwo28=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
@@ -309,42 +251,31 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag=
-github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
-github.com/maruel/natural v1.1.1 h1:Hja7XhhmvEFhcByqDoHz9QZbkWey+COd9xWfCfn1ioo=
-github.com/maruel/natural v1.1.1/go.mod h1:v+Rfd79xlw1AgVBjbO0BEQmptqb5HvL/k9GRHB7ZKEg=
+github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
+github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
+github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
 github.com/mattn/go-ciede2000 v0.0.0-20170301095244-782e8c62fec3 h1:BXxTozrOU8zgC5dkpn3J6NTRdoP+hjok/e+ACr4Hibk=
 github.com/mattn/go-ciede2000 v0.0.0-20170301095244-782e8c62fec3/go.mod h1:x1uk6vxTiVuNt6S5R2UYgdhpj3oKojXvOXauHZ7dEnI=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
-github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-zglob v0.0.6 h1:mP8RnmCgho4oaUYDIDn6GNxYk+qJGUs8fJLn+twYj2A=
 github.com/mattn/go-zglob v0.0.6/go.mod h1:MxxjyoXXnMxfIpxTK2GAkw1w8glPsQILx3N5wrKakiY=
-github.com/mfridman/tparse v0.18.0 h1:wh6dzOKaIwkUGyKgOntDW4liXSo37qg5AXbIhkMV3vE=
-github.com/mfridman/tparse v0.18.0/go.mod h1:gEvqZTuCgEhPbYk/2lS3Kcxg1GmTxxU7kTC8DvP0i/A=
-github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
-github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
 github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg=
 github.com/mitchellh/hashstructure v1.1.0 h1:P6P1hdjqAAknpY/M1CGipelZgp+4y9ja9kmUZPXP+H0=
 github.com/mitchellh/hashstructure v1.1.0/go.mod h1:xUDAozZz0Wmdiufv0uyhnHkUTN6/6d8ulp4AwfLKrmA=
-github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
-github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
 github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
-github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
@@ -355,12 +286,12 @@ github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+W
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
 github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
-github.com/onsi/ginkgo/v2 v2.27.3 h1:ICsZJ8JoYafeXFFlFAG75a7CxMsJHwgKwtO+82SE9L8=
-github.com/onsi/ginkgo/v2 v2.27.3/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
+github.com/onsi/ginkgo/v2 v2.23.3 h1:edHxnszytJ4lD9D5Jjc4tiDkPBZ3siDeJJkUZJJVkp0=
+github.com/onsi/ginkgo/v2 v2.23.3/go.mod h1:zXTP6xIp3U8aVuXN8ENK9IXRaTjFnpVB9mGmaSRvxnM=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
-github.com/onsi/gomega v1.38.3 h1:eTX+W6dobAYfFeGC2PV6RwXRu/MyT+cQguijutvkpSM=
-github.com/onsi/gomega v1.38.3/go.mod h1:ZCU1pkQcXDO5Sl9/VVEGlDyp+zm0m1cmeG5TOzLgdh4=
+github.com/onsi/gomega v1.36.3 h1:hID7cr8t3Wp26+cYnfcjR6HpJ00fdogN6dqZ1t6IylU=
+github.com/onsi/gomega v1.36.3/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -368,33 +299,26 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
-github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
-github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
-github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
-github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
-github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.66.1 h1:h5E0h5/Y8niHc5DlaLlWLArTQI7tMrsfQjHV+d9ZoGs=
-github.com/prometheus/common v0.66.1/go.mod h1:gcaUsgf3KfRSwHY4dIMXLPV0K/Wg1oZ8+SbZk/HH/dA=
-github.com/prometheus/procfs v0.17.0 h1:FuLQ+05u4ZI+SS/w9+BWEM2TXiHKsUQ9TADiRH7DuK0=
-github.com/prometheus/procfs v0.17.0/go.mod h1:oPQLaDAMRbA+u8H5Pbfq+dl3VDAvHxMUOVhe0wYB2zw=
-github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
-github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
-github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
-github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
-github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
-github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
-github.com/rs/zerolog v1.33.0 h1:1cU2KZkvPxNyfgEmhHAz/1A9Bz+llsdYzklWFzgp0r8=
-github.com/rs/zerolog v1.33.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss=
+github.com/pquerna/otp v1.4.0 h1:wZvl1TIVxKRThZIBiwOOHOGP/1+nZyWBil9Y2XNEDzg=
+github.com/pquerna/otp v1.4.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
+github.com/prometheus/client_golang v1.21.1 h1:DOvXXTqVzvkIewV/CDPFdejpMCGeMcbGCQ8YOmu+Ibk=
+github.com/prometheus/client_golang v1.21.1/go.mod h1:U9NM32ykUErtVBxdvD3zfi+EuFkkaBvMb09mIfe0Zgg=
+github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
+github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
+github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
+github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
+github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
+github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
+github.com/redis/go-redis/v9 v9.7.0 h1:HhLSs+B6O021gwzl+locl0zEDnyNkxMtf/Z3NNBMa9E=
+github.com/redis/go-redis/v9 v9.7.0/go.mod h1:f6zhXITC7JUJIlPEiBOTXxJgPLdZcA93GewI7inzyWw=
+github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
+github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
-github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
-github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s=
-github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0=
-github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
+github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
+github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
@@ -402,75 +326,53 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/teambition/rrule-go v1.8.2 h1:lIjpjvWTj9fFUZCmuoVDrKVOtdiyzbzc93qTmRVe/J8=
 github.com/teambition/rrule-go v1.8.2/go.mod h1:Ieq5AbrKGciP1V//Wq8ktsTXwSwJHDD5mD/wLBGl3p4=
 github.com/texttheater/golang-levenshtein v1.0.1 h1:+cRNoVrfiwufQPhoMzB6N0Yf/Mqajr6t1lOv8GyGE2U=
 github.com/texttheater/golang-levenshtein v1.0.1/go.mod h1:PYAKrbF5sAiq9wd+H82hs7gNaen0CplQ9uvm6+enD/8=
-github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
-github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
-github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
-github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
-github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
-github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
-github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
-github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
-github.com/urfave/cli/v2 v2.27.7 h1:bH59vdhbjLv3LAvIu6gd0usJHgoTTPhCFib8qqOwXYU=
-github.com/urfave/cli/v2 v2.27.7/go.mod h1:CyNAG/xg+iAOg0N4MPGZqVmv2rCoP267496AOXUZjA4=
-github.com/vektra/mockery/v3 v3.6.1 h1:YyqAXihdNML8y6SJnvPKYr+2HAHvBjdvqFu/fMYlX8g=
-github.com/vektra/mockery/v3 v3.6.1/go.mod h1:Oti3Df0WP8wwT31yuVri3QNsDeMUQU5Q4QEg8EabaBw=
+github.com/urfave/cli/v2 v2.27.6 h1:VdRdS98FNhKZ8/Az8B7MTyGQmpIr36O1EHybx/LaZ4g=
+github.com/urfave/cli/v2 v2.27.6/go.mod h1:3Sevf16NykTbInEnD0yKkjDAeZDS0A6bzhBH5hrMvTQ=
 github.com/virtuald/go-ordered-json v0.0.0-20170621173500-b18e6e673d74 h1:JwtAtbp7r/7QSyGz8mKUbYJBg2+6Cd7OjM8o/GNOcVo=
 github.com/virtuald/go-ordered-json v0.0.0-20170621173500-b18e6e673d74/go.mod h1:RmMWU37GKR2s6pgrIEB4ixgpVCt/cf7dnJv3fuH1J1c=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
-github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f h1:J9EGpcZtP0E/raorCMxlFGSTBrsSlaDGf3jU/qvAE2c=
-github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
-github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
-github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
-github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
-github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
-github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 h1:FnBeRrxr7OU4VvAzt5X7s6266i6cSVkkFPS0TuXWbIg=
-github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
+github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 h1:gEOO8jv9F4OT7lGCjxCBTO/36wtF6j2nSip77qHd4x4=
+github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
-go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
-go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
-go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
-golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
-golang.org/x/exp v0.0.0-20251002181428-27f1f14c8bb9 h1:TQwNpfvNkxAVlItJf6Cr5JTsVZoC/Sj7K3OZv2Pc14A=
-golang.org/x/exp v0.0.0-20251002181428-27f1f14c8bb9/go.mod h1:TwQYMMnGpvZyc+JpB/UAuTNIsVJifOlSkrZkhcvpVUk=
+golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
+golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
+golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 h1:nDVHiLt8aIbd/VzvPWN6kSOPE7+F/fNFDSXLVYkE/Iw=
+golang.org/x/exp v0.0.0-20250305212735-054e65f0b394/go.mod h1:sIifuuw/Yco/y6yb6+bDNfyeQ/MdPUy/hKEMYQV17cM=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk=
-golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
-golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
-golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
-golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
+golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/oauth2 v0.28.0 h1:CrgCKl8PPAVtLnU3c+EDw6x11699EWlsDeWNWKdIOkc=
+golang.org/x/oauth2 v0.28.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
+golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -480,27 +382,25 @@ golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
-golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
-golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
+golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
-golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
-golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
-golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
+golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.39.0 h1:ik4ho21kwuQln40uelmciQPp9SipgNDdrafrYA4TmQQ=
-golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
+golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
+golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -513,14 +413,14 @@ google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQ
 google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
 google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
-google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
+google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
-gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
+gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
@@ -533,27 +433,28 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.34.3 h1:D12sTP257/jSH2vHV2EDYrb16bS7ULlHpdNdNhEw2S4=
-k8s.io/api v0.34.3/go.mod h1:PyVQBF886Q5RSQZOim7DybQjAbVs8g7gwJNhGtY5MBk=
-k8s.io/apiextensions-apiserver v0.34.1 h1:NNPBva8FNAPt1iSVwIE0FsdrVriRXMsaWFMqJbII2CI=
-k8s.io/apiextensions-apiserver v0.34.1/go.mod h1:hP9Rld3zF5Ay2Of3BeEpLAToP+l4s5UlxiHfqRaRcMc=
-k8s.io/apimachinery v0.34.3 h1:/TB+SFEiQvN9HPldtlWOTp0hWbJ+fjU+wkxysf/aQnE=
-k8s.io/apimachinery v0.34.3/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
-k8s.io/client-go v0.34.3 h1:wtYtpzy/OPNYf7WyNBTj3iUA0XaBHVqhv4Iv3tbrF5A=
-k8s.io/client-go v0.34.3/go.mod h1:OxxeYagaP9Kdf78UrKLa3YZixMCfP6bgPwPwNBQBzpM=
+k8s.io/api v0.32.3 h1:Hw7KqxRusq+6QSplE3NYG4MBxZw1BZnq4aP4cJVINls=
+k8s.io/api v0.32.3/go.mod h1:2wEDTXADtm/HA7CCMD8D8bK4yuBUptzaRhYcYEEYA3k=
+k8s.io/apiextensions-apiserver v0.32.2 h1:2YMk285jWMk2188V2AERy5yDwBYrjgWYggscghPCvV4=
+k8s.io/apiextensions-apiserver v0.32.2/go.mod h1:GPwf8sph7YlJT3H6aKUWtd0E+oyShk/YHWQHf/OOgCA=
+k8s.io/apimachinery v0.32.3 h1:JmDuDarhDmA/Li7j3aPrwhpNBA94Nvk5zLeOge9HH1U=
+k8s.io/apimachinery v0.32.3/go.mod h1:GpHVgxoKlTxClKcteaeuF1Ul/lDVb74KpZcxcmLDElE=
+k8s.io/client-go v0.32.3 h1:RKPVltzopkSgHS7aS98QdscAgtgah/+zmpAogooIqVU=
+k8s.io/client-go v0.32.3/go.mod h1:3v0+3k4IcT9bXTc4V2rt+d2ZPPG700Xy6Oi0Gdl2PaY=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE=
-k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
-k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzkbzn+gDM4X9T4Ck=
-k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/controller-runtime v0.22.4 h1:GEjV7KV3TY8e+tJ2LCTxUTanW4z/FmNB7l327UfMq9A=
-sigs.k8s.io/controller-runtime v0.22.4/go.mod h1:+QX1XUpTXN4mLoblf4tqr5CQcyHPAki2HLXqQMY6vh8=
-sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
-sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+k8s.io/kube-openapi v0.0.0-20250304201544-e5f78fe3ede9 h1:t0huyHnz6HsokckRxAF1bY0cqPFwzINKCL7yltEjZQc=
+k8s.io/kube-openapi v0.0.0-20250304201544-e5f78fe3ede9/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
+k8s.io/utils v0.0.0-20241210054802-24370beab758 h1:sdbE21q2nlQtFh65saZY+rRM6x6aJJI8IUa1AmH/qa0=
+k8s.io/utils v0.0.0-20241210054802-24370beab758/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/controller-runtime v0.20.4 h1:X3c+Odnxz+iPTRobG4tp092+CvBU9UK0t/bRf+n0DGU=
+sigs.k8s.io/controller-runtime v0.20.4/go.mod h1:xg2XB0K5ShQzAgsoujxuKN4LNXR2LfwwHsPj7Iaw+XY=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
-sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
-sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
+sigs.k8s.io/structured-merge-diff/v4 v4.6.0 h1:IUA9nvMmnKWcj5jl84xn+T5MnlZKThmUW1TdblaLVAc=
+sigs.k8s.io/structured-merge-diff/v4 v4.6.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
+sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=