chore(deps): Bump kube from 3.1.0 to 4.2.0

[dependabot]

Bumps kube from 3.1.0 to 4.2.0.

Release notes

Sourced from kube's releases.

4.2.0

What's Changed

Maintenance release for 4.0.0. Fixes, and https proxy. MSRV 1.89. All PRs here.

Added

• add support for https proxy by @​goenning in kube-rs/kube#2013

Fixed

• Update kube-cel requirement from 0.7.0 to 0.8.0 by @​dependabot[bot] in kube-rs/kube#2017
• client: include sources in CommitError's error message by @​iniw in kube-rs/kube#2020
• Include error sources in Display messages at client, core, runtime by @​doxxx93 in kube-rs/kube#2021
• Remove extraneous Sync bound in Controller::reconcile_all_on by @​bojidar-bg in kube-rs/kube#2029
• client: fall back to OS-native cert store via rustls-platform-verifier by @​aviramha in kube-rs/kube#2030
• Avoid deep-cloning ObjectMeta per event in trigger_owners by @​doxxx93 in kube-rs/kube#2039
• config: resolve relative exec plugin command paths by @​deepu105 in kube-rs/kube#2037
• Construct typed CustomResourceDefinition in derived crd() by @​doxxx93 in kube-rs/kube#2042

New Contributors

• @​iniw made their first contribution in kube-rs/kube#2020
• @​bojidar-bg made their first contribution in kube-rs/kube#2029
• @​deepu105 made their first contribution in kube-rs/kube#2037

Full Changelog: kube-rs/kube@4.0.0...4.2.0

4.0.0

New Major

As per the release schedule to match up with the latest Kubernetes ハル release. Lots of fixes and improvements. Thanks to everyone who contributed!

Kubernetes v1_36 support via k8s-openapi 0.28

Please upgrade k8s-openapi along with kube to avoid conflicts.

CEL Validation

A new optional crate kube-cel is being re-exported through kube::core::cel via kube-rs/kube#1954

Kubernetes CRDs support CEL validation rules via x-kubernetes-validations, and were supported from 3.0 via KubeSchema, but these rules could only be evaluated server-side by the API server.

The new crate allows evaluating these rules locally using rules matching the upstream Kubernetes CEL libraries.

While low-level, a higher-level CEL validator integrates with CustomResource via #[kube(cel)] from kube-rs/kube#2011 and can be used as;

#[derive(CustomResource, Serialize, Deserialize, Clone, KubeSchema)]
#[kube(group = "example.com", version = "v1", kind = "Foo", namespaced)]
#[kube(cel, validation = "self.spec.replicas >= 0")] // cel trigger + validation rule
struct FooSpec { replicas: i32 }
</tr></table>

... (truncated)

Changelog

Sourced from kube's changelog.

4.2.0 / 2026-07-22

• see kube-rs/kube@4.0.0...main

4.0.0 / 2026-06-16

New Major

As per the release schedule to match up with the latest Kubernetes ハル release. Lots of fixes and improvements. Thanks to everyone who contributed!

Kubernetes v1_36 support via k8s-openapi 0.28

Please upgrade k8s-openapi along with kube to avoid conflicts.

CEL Validation

A new optional crate kube-cel is being re-exported through kube::core::cel via kube-rs/kube#1954

Kubernetes CRDs support CEL validation rules via x-kubernetes-validations, and were supported from 3.0 via KubeSchema, but these rules could only be evaluated server-side by the API server.

The new crate allows evaluating these rules locally using rules matching the upstream Kubernetes CEL libraries.

While low-level, a higher-level CEL validator integrates with CustomResource via #[kube(cel)] from kube-rs/kube#2011 and can be used as;

#[derive(CustomResource, Serialize, Deserialize, Clone, KubeSchema)]
#[kube(group = "example.com", version = "v1", kind = "Foo", namespaced)]
#[kube(cel, validation = "self.spec.replicas >= 0")] // cel trigger + validation rule
struct FooSpec { replicas: i32 }
let foo = Foo::new("test", FooSpec { replicas: -1 });
foo.validate_cel()?;                     // new impl; checks creation rules
new_foo.validate_cel_update(&old_foo)?;  // new impl; checks transition rules

See examples/crd_derive_cel.rs for more details.

This is available under the kube/cel feature, courtesy of @​doxxx93.

Config

A lot of improvements to config handling;

• better error handling of malformed client certs in kube-rs/kube#1966
• add missing Kubeconfig fields in kube-rs/kube#1965
• Kubeconfig future key compatibility for new fields by adding catch-all other key via kube-rs/kube#1964
• deserialization changed from serde-yaml to serde-saphyr to get rid of the long-deprecated dependency. kube-rs/kube#1975

Retry and Timeouts

Better timeout and retry handling to better deal with flaky network conditions, and busy or initializing apiservers.

... (truncated)

Commits

• 526f1f2 release 4.2.0
• 3b811b5 break circular dependency on explicit dev-dep versions
• 48d1ad5 Construct typed CustomResourceDefinition in derived crd() (#2042)
• d0328f7 config: resolve relative exec plugin command paths (#2037)
• 76fee02 ignore multiple versions of syn (#2046)
• fe44fa2 Amortize PredicateFilter cache eviction across polls (#2040)
• 5afcf19 Avoid deep-cloning ObjectMeta per event in trigger_owners (#2039)
• 660966e Chore(deps): Update serde-saphyr requirement from 0.0.27 to 0.0.29 (#2032)
• 0bcb4c7 bump msrv to 1.89 (#2035)
• f671d57 fix deny failures (#2034)
• Additional commits viewable in compare view

[praxis-bot]

Critical: k8s-openapi version split. kube 4.2.0 depends on k8s-openapi 0.28.0, but the operator's Cargo.toml still pins k8s-openapi at 0.27.1. The resolved Cargo.lock contains both k8s-openapi 0.27.1 and 0.28.0, creating type incompatibilities -- any k8s-openapi type passed between the operator's direct code and kube's API surface will fail to compile or produce confusing type errors. The kube 4.0 release notes explicitly state: "Please upgrade k8s-openapi along with kube to avoid conflicts."

Critical: gateway-api version conflict. The gateway-api crate still depends on kube 3.1.0 and k8s-openapi 0.27.1. With kube bumped to 4.2.0 in the operator, there will be two incompatible versions of kube in the dependency tree. Types from gateway-api (using kube 3.x types) cannot be used interchangeably with the operator's kube 4.x types. This requires either an upstream gateway-api release compatible with kube 4.x, or a coordinated update.

Action required: Bump k8s-openapi to 0.28.0 in the same PR. Verify that gateway-api has a release compatible with kube 4.x; if not, this bump must wait for one.

Also: this PR includes unrelated changes to docs/proposals.md and deletes docs/proposals/template.md. These should be in a separate PR.

[praxis-bot]

kube 4.2.0 requires k8s-openapi 0.28.0, but line 15 still pins k8s-openapi at 0.27.1. Bump k8s-openapi to 0.28.0 here to avoid a version split in the dependency tree. Also verify that gateway-api 0.21.0 is compatible with kube 4.x -- if not, this bump must wait for an upstream gateway-api release.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.