Update Rust dependencies by jpculp · Pull Request #802 · bottlerocket-os/bottlerocket-update-operator

jpculp · 2026-02-17T01:19:09Z

Description of changes:

Updated various Rust dependencies including:

opentelemetry from 0.29 to 0.31.
kube from 0.88 to 2.
tokio from 1.46 to 1.47 LTS.
bottlerocket-sdk from 0.65.0 to 0.70.0.

Also removed unused webpki.

Testing done:

Updated k8s 1.29 cluster. (oldest supported)
Updated k8s 1.35 cluster. (latest)

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

Signed-off-by: Patrick J.P. Culp <jpculp@amazon.com>

jpculp · 2026-02-17T01:20:38Z

 # k8s-openapi must match the version required by kube and enable a k8s version feature
-k8s-openapi = { version = "0.21", default-features = false, features = ["v1_24"] }
-kube = { version = "0.88", default-features = false, features = [ "derive", "runtime", "rustls-tls" ] }
+k8s-openapi = { version = "0.26", default-features = false, features = ["v1_30"] }


Although this is set to v1_30 (the oldest supported by k8s-openapi@0.26) I didn't have any issues updating a k8s 1.29 cluster.

Kubernetes has a +/- 1 support story for the API, so 1.30 should work for 1.29.

We use very stable elements of the k8s API - theoretically very new versions of k8s could make changes that we don't support, but it is unlikely.

The https://kubernetes.io/releases/version-skew-policy/ says slightly different - the controller/client should not be newer than the api-server. So technically there is no guaranteed compatibility between controllers under version 1.30 and api-server under 1.29.

Is it possible to pin it to 1_29 until we drop the 1.29 variants?

I don't think that's necessary since we've confirmed the ability to update on a 1.29 cluster. Extended support does drop soon, but I don't think we should hold these updates back when we've validated the operator functionality.

jpculp · 2026-02-17T01:46:53Z

Addressed clippy warning.

Signed-off-by: Patrick J.P. Culp <jpculp@amazon.com>

jpculp · 2026-02-17T19:30:05Z

Updated CRDs.

Updated cargo dependencies with minimal tweaks to reduce multiple versions. Signed-off-by: Patrick J.P. Culp <jpculp@amazon.com>

Signed-off-by: Patrick J.P. Culp <jpculp@amazon.com>

jpculp · 2026-02-17T19:42:22Z

Bump actix-web.

cbgbt · 2026-02-17T22:17:09Z

-opentelemetry-instrumentation-actix-web = { version = "0.22", features = ["metrics"] }
+opentelemetry-instrumentation-actix-web = { version = "0.23", features = ["metrics"] }



May be worth querying the metric endpoint to see that they are properly exposed.

It looks like prometheus metrics are being properly exposed.

cbgbt · 2026-02-17T22:19:55Z

-        pod_store.apply_watcher_event(&Event::Restarted(pods));
+        pod_store.apply_watcher_event(&Event::Init);
+        for pod in pods {
+            pod_store.apply_watcher_event(&Event::InitApply(pod));
+        }
+        pod_store.apply_watcher_event(&Event::InitDone);


Do you know what the context on this change is?

There was an API change in the kube-runtime reflector store. Basically Event::Restarted was broken up into three phases.

cbgbt · 2026-02-17T22:20:59Z

 # k8s-openapi must match the version required by kube and enable a k8s version feature
-k8s-openapi = { version = "0.21", default-features = false, features = ["v1_24"] }
-kube = { version = "0.88", default-features = false, features = [ "derive", "runtime", "rustls-tls" ] }
+k8s-openapi = { version = "0.26", default-features = false, features = ["v1_30"] }


Kubernetes has a +/- 1 support story for the API, so 1.30 should work for 1.29.

We use very stable elements of the k8s API - theoretically very new versions of k8s could make changes that we don't support, but it is unlikely.

cbgbt · 2026-02-17T22:21:14Z

 opentelemetry-instrumentation-actix-web = { workspace = true }
 rustls = { workspace = true }
 rustls-pemfile = { workspace = true }
-webpki = { workspace = true }


What prompts this removal? Is it just marked as unused?

Just unused. We could leave it but it adds an unnecessary dependency and we have to keep clarify.toml and deny.toml up to date to accommodate it.

ytsssun · 2026-02-18T23:27:45Z

@@ -153,7 +153,7 @@ pub mod apiserver_error {

        #[snafu(display("Error creating prometheus registry: '{}'", source))]
        PrometheusRegsitry {


Nit: we have some pre-existing typo...

Suggested change

PrometheusRegsitry {

PrometheusRegistry {

Since this is an already big change I'd like to save this for a separate PR.

ytsssun · 2026-02-18T23:28:07Z

@@ -190,7 +190,7 @@ pub mod controller_error {

        #[snafu(display("Error creating prometheus registry: '{}'", source))]
        PrometheusRegsitry {


Nit: we have pre-existing typo

Suggested change

PrometheusRegsitry {

PrometheusRegistry {

ytsssun · 2026-02-19T22:33:00Z

-k8s-openapi = { version = "0.21", default-features = false, features = ["v1_24"] }
-kube = { version = "0.88", default-features = false, features = [ "derive", "runtime", "rustls-tls" ] }
+k8s-openapi = { version = "0.26", default-features = false, features = ["v1_30"] }
+kube = { version = "2", default-features = false, features = [ "derive", "runtime", "rustls-tls" ] }


kube crate has a 3.0 now. Any concern if we further bump to that?

We want to maintain compatibility with v1_30. Jumping to kube@3.0 only guarantees API compatibility with a minimum of v1_31.

build(deps): bump opentelemetry from 0.29 to 0.31

b4ca7fa

Signed-off-by: Patrick J.P. Culp <jpculp@amazon.com>

jpculp requested review from cbgbt, mgsharm and ytsssun February 17, 2026 01:19

jpculp commented Feb 17, 2026

View reviewed changes

jpculp force-pushed the 20260216-deps branch from 624091d to fcf974f Compare February 17, 2026 01:46

jpculp added 3 commits February 17, 2026 11:26

build(deps): bump kube from 0.88 to 2

b7d6571

build(deps): remove webpki

459c20b

Signed-off-by: Patrick J.P. Culp <jpculp@amazon.com>

build(deps): bump tokio from 1.46 to 1.47 (LTS)

3a056b1

Signed-off-by: Patrick J.P. Culp <jpculp@amazon.com>

jpculp force-pushed the 20260216-deps branch from fcf974f to 0a27443 Compare February 17, 2026 19:29

This was referenced Feb 17, 2026

build(deps): bump rustls from 0.23.32 to 0.23.36 #807

Closed

build(deps): bump opentelemetry_sdk from 0.29.0 to 0.31.0 #806

Closed

build(deps): bump tracing from 0.1.41 to 0.1.44 #805

Closed

build(deps): bump tokio from 1.46.1 to 1.49.0 #804

Closed

jpculp added 2 commits February 17, 2026 11:41

build(deps): cargo update

4eed9ff

Updated cargo dependencies with minimal tweaks to reduce multiple versions. Signed-off-by: Patrick J.P. Culp <jpculp@amazon.com>

build(deps): bump bottlerocket-sdk from 0.65.0 to 0.70.0

1b15474

Signed-off-by: Patrick J.P. Culp <jpculp@amazon.com>

jpculp force-pushed the 20260216-deps branch from 0a27443 to 1b15474 Compare February 17, 2026 19:42

jpculp mentioned this pull request Feb 17, 2026

build(deps): bump actix-web from 4.11.0 to 4.12.1 #803

Closed

cbgbt reviewed Feb 17, 2026

View reviewed changes

jpculp requested a review from cbgbt February 17, 2026 23:59

cbgbt approved these changes Feb 19, 2026

View reviewed changes

ytsssun reviewed Feb 19, 2026

View reviewed changes

ytsssun approved these changes Feb 19, 2026

View reviewed changes

mgsharm approved these changes Feb 19, 2026

View reviewed changes

jpculp merged commit c8d9be9 into bottlerocket-os:develop Feb 20, 2026
2 checks passed

jpculp deleted the 20260216-deps branch February 20, 2026 23:21

		opentelemetry-instrumentation-actix-web = { version = "0.22", features = ["metrics"] }
		opentelemetry-instrumentation-actix-web = { version = "0.23", features = ["metrics"] }

		@@ -153,7 +153,7 @@ pub mod apiserver_error {

		#[snafu(display("Error creating prometheus registry: '{}'", source))]
		PrometheusRegsitry {

		@@ -190,7 +190,7 @@ pub mod controller_error {

		#[snafu(display("Error creating prometheus registry: '{}'", source))]
		PrometheusRegsitry {

Uh oh!

Conversation

jpculp commented Feb 17, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jpculp commented Feb 17, 2026

Uh oh!

jpculp commented Feb 17, 2026

Uh oh!

jpculp commented Feb 17, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants