Merge branch 'main' into feature/chart-security-context

Author: vishwakt

.github/workflows/goreleaser.yml

@@ -11,12 +11,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: go.mod
 
@@ -33,7 +33,7 @@ jobs:
       - name: Run GoReleaser for snapshot
         # This does not actually publish anything, but makes sure that the images can be build
         if: "!startsWith(github.ref, 'refs/tags/')"
-        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
         with:
           version: "~> v2"
           args: release --snapshot --clean
@@ -49,7 +49,7 @@ jobs:
 
       - name: Run GoReleaser for tag
         if: "startsWith(github.ref, 'refs/tags/')"
-        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
         with:
           version: "~> v2"
           args: release --clean

.github/workflows/lint.yml

@@ -17,9 +17,9 @@ jobs:
           - v4.0.0 # renovate: datasource=github-releases depName=helm/helm versioning=same-major
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: 3.x
 
@@ -46,13 +46,13 @@ jobs:
       # Helm lints are executed in a separate action with a version matrix
       SKIP: "helm-lint,helm-snapshots,deploy-manifests"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: 3.x
 
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: ~/.cache/golangci-lint
           key: pre-commit-golangci-lint|${{ env.pythonLocation }}|${{ hashFiles('.pre-commit-config.yaml') }}|${{ hashFiles('**/*.go') }}

.github/workflows/robot.yml

@@ -26,7 +26,7 @@ jobs:
       ANSIBLE_FORCE_COLOR: true
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Install robot server
         env:

.github/workflows/test.yml

@@ -9,14 +9,14 @@ jobs:
     name: unit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: go.mod
 
       - run: go test -v -race -coverprofile=coverage.txt ./...
 
-      - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7
         if: >
           !startsWith(github.head_ref, 'renovate/') &&
           !startsWith(github.head_ref, 'releaser-pleaser--')
@@ -53,17 +53,17 @@ jobs:
       CERT_DOMAIN: hc-integrations-test.de
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: go.mod
 
       - uses: hetznercloud/setup-hcloud@ac9e7d74fb41a3ca44a6a3da123bd5aa70731e3a # v2
 
-      - uses: opentofu/setup-opentofu@847eaa4afeb791b06daa46e8eafa8b1b68d7cfb4 # v2
+      - uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2
         with:
-          tofu_version: v1.12.1 # renovate: datasource=github-releases depName=opentofu/opentofu
+          tofu_version: v1.12.3 # renovate: datasource=github-releases depName=opentofu/opentofu
           tofu_wrapper: false
 
       - uses: yokawasa/action-setup-kube-tools@9d39563c24d4a419d1a8289c34d6da5a6171252c # v0.13.5
@@ -72,9 +72,9 @@ jobs:
             helm
             kubectl
             skaffold
-          helm: v4.2.0 # renovate: datasource=github-releases depName=helm/helm
-          kubectl: v1.36.1 # renovate: datasource=github-releases depName=kubernetes/kubernetes
-          skaffold: v2.21.0 # renovate: datasource=github-releases depName=GoogleContainerTools/skaffold
+          helm: v4.2.2 # renovate: datasource=github-releases depName=helm/helm
+          kubectl: v1.36.2 # renovate: datasource=github-releases depName=kubernetes/kubernetes
+          skaffold: v2.23.0 # renovate: datasource=github-releases depName=GoogleContainerTools/skaffold
 
       - name: Setup k3sup
         env:
@@ -106,7 +106,7 @@ jobs:
           bash scripts/get-coverage-from-k8s.sh
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7
         if: >
           !startsWith(github.head_ref, 'renovate/') &&
           !startsWith(github.head_ref, 'releaser-pleaser--')
@@ -171,17 +171,17 @@ jobs:
       ROBOT_ENABLED: "true"
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: go.mod
 
       - uses: hetznercloud/setup-hcloud@ac9e7d74fb41a3ca44a6a3da123bd5aa70731e3a # v2
 
-      - uses: opentofu/setup-opentofu@847eaa4afeb791b06daa46e8eafa8b1b68d7cfb4 # v2
+      - uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2
         with:
-          tofu_version: v1.12.1 # renovate: datasource=github-releases depName=opentofu/opentofu
+          tofu_version: v1.12.3 # renovate: datasource=github-releases depName=opentofu/opentofu
           tofu_wrapper: false
 
       - uses: yokawasa/action-setup-kube-tools@9d39563c24d4a419d1a8289c34d6da5a6171252c # v0.13.5
@@ -190,9 +190,9 @@ jobs:
             helm
             kubectl
             skaffold
-          helm: v4.2.0 # renovate: datasource=github-releases depName=helm/helm
-          kubectl: v1.36.1 # renovate: datasource=github-releases depName=kubernetes/kubernetes
-          skaffold: v2.21.0 # renovate: datasource=github-releases depName=GoogleContainerTools/skaffold
+          helm: v4.2.2 # renovate: datasource=github-releases depName=helm/helm
+          kubectl: v1.36.2 # renovate: datasource=github-releases depName=kubernetes/kubernetes
+          skaffold: v2.23.0 # renovate: datasource=github-releases depName=GoogleContainerTools/skaffold
 
       - name: Install k3sup
         run: |
@@ -229,7 +229,7 @@ jobs:
           bash scripts/get-coverage-from-k8s.sh
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7
         if: >
           !startsWith(github.head_ref, 'renovate/') &&
           !startsWith(github.head_ref, 'releaser-pleaser--')

.pre-commit-config.yaml

@@ -62,7 +62,7 @@ repos:
         language: node
         types: [text]
         require_serial: false
-        additional_dependencies: [prettier@3.8.3]
+        additional_dependencies: [prettier@3.9.1]
         files: \.(md|ya?ml)$
         exclude: ^(CHANGELOG.md|chart/templates/.*|chart/.snapshots/.*|docs/reference/load_balancer_.*\.md|)$
 
@@ -85,7 +85,7 @@ repos:
     rev: v2.12.2
     hooks:
       - id: golangci-lint-full
-        language_version: 1.26.3 # renovate: datasource=golang-version depName=go
+        language_version: 1.26.4 # renovate: datasource=golang-version depName=go
 
   - repo: local
     hooks:

CHANGELOG.md

@@ -1,5 +1,63 @@
 # Changelog
 
+## [v1.33.0](https://github.com/hetznercloud/hcloud-cloud-controller-manager/releases/tag/v1.33.0)
+
+### Changed
+
+Renamed `HCLOUD_SERVER_CACHE_TTL` to `HCLOUD_SERVER_CACHE_MAX_AGE`. The server cache lifetime is now configured via `HCLOUD_SERVER_CACHE_MAX_AGE` (default 10s). Individual controllers may override this default for specific lookups — for example, the routes controller uses a longer max age. Action required: if you set `HCLOUD_SERVER_CACHE_TTL`, switch to `HCLOUD_SERVER_CACHE_MAX_AGE`; the old variable is no longer recognized.
+
+### Removed
+
+Removed the `hcops/AllServersCache.*` operation metrics. The legacy AllServersCache was replaced by the shared server cache, so the following `cloud_controller_manager_operations_total` series labeled op="hcops/AllServersCache.*" are no longer emitted:
+- `hcops/AllServersCache.ByID`
+- `hcops/AllServersCache.ByName`
+- `hcops/AllServersCache.ByPrivateIP`
+- `hcops/AllServersCache.getCache`
+- `hcops/AllServersCache.refreshCache`
+
+They are superseded by the new server cache metric `cloud_controller_manager_server_cache_requests_total`, a counter partitioned by subsystem, mode, and result:
+
+- subsystem: instances_v2, routes (or none when unset)
+- mode: all, one, off
+- result: hit, miss
+
+```
+cloud_controller_manager_server_cache_requests_total{subsystem="instances_v2", mode="all", result="hit"}
+cloud_controller_manager_server_cache_requests_total{subsystem="routes",       mode="all", result="miss"}
+```
+
+Update any dashboards or alerts referencing the old op series accordingly.
+
+### Features
+
+- **cache**: replace TTL with max-age
+- **cache**: use server cache in routes controller
+
+### Bug Fixes
+
+- **cache**: when api returns not found do not return an expired entry (#1271)
+
+## [v1.32.0](https://github.com/hetznercloud/hcloud-cloud-controller-manager/releases/tag/v1.32.0)
+
+### Cache Server Lookups in Node Controllers
+
+This release introduces an experimental server cache to reduce Hetzner Cloud API calls. During an experimental phase, breaking changes on those features may occur within minor releases.
+
+The node and node lifecycle controllers look up Servers by ID or name, generating significant API traffic during cluster scaling. A new cache sits between the controllers and the API to serve these lookups, reducing the number of requests.
+
+It is enabled by default since we believe the implementation is safe in practice, but is experimental and may see breaking changes within minor releases. Configure it via environment variables:
+
+- `HCLOUD_SERVER_CACHE_MODE` (`all` | `one` | `off`, default `all`):
+
+  - `all` — fetch all Servers once and serve lookups from the snapshot until the TTL expires.
+  - `one`  — cache each Server individually with its own expiration.
+  - `off`  — disable caching; every lookup hits the API.
+- `HCLOUD_SERVER_CACHE_TTL` (duration, default `10s`): lifetime of cached entries (e.g. `30s`, `2m`); values above a minute are not recommended.
+
+### Features
+
+- **instances**: cache server lookups to reduce API calls (#1252)
+
 ## [v1.31.1](https://github.com/hetznercloud/hcloud-cloud-controller-manager/releases/tag/v1.31.1)
 
 ### Bug Fixes

Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.23
+FROM alpine:3.24
 RUN apk add --no-cache ca-certificates bash
 COPY hcloud-cloud-controller-manager /bin/hcloud-cloud-controller-manager
 ENTRYPOINT ["/bin/hcloud-cloud-controller-manager"]

chart/.snapshots/default.yaml

@@ -167,7 +167,7 @@ spec:
                   key: robot-user
                   name: hcloud
                   optional: true
-          image: docker.io/hetznercloud/hcloud-cloud-controller-manager:v1.31.1 # x-releaser-pleaser-version
+          image: docker.io/hetznercloud/hcloud-cloud-controller-manager:v1.33.0 # x-releaser-pleaser-version
           ports:
             - name: metrics
               containerPort: 8233

chart/.snapshots/full.daemonset.yaml

@@ -176,7 +176,7 @@ spec:
                   key: robot-user
                   name: hcloud
                   optional: true
-          image: docker.io/hetznercloud/hcloud-cloud-controller-manager:v1.31.1 # x-releaser-pleaser-version
+          image: docker.io/hetznercloud/hcloud-cloud-controller-manager:v1.33.0 # x-releaser-pleaser-version
           ports:
             - name: metrics
               containerPort: 8233

chart/Chart.yaml

@@ -1,4 +1,4 @@
 apiVersion: v2
 name: hcloud-cloud-controller-manager
 type: application
-version: 1.31.1 # x-releaser-pleaser-version
+version: 1.33.0 # x-releaser-pleaser-version