chore(deps): update kube-components (patch)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
oss/binaries/kubernetes/kubernetes-node	v1.34.4	patch	v1.34.7 → v1.34.8
oss/binaries/kubernetes/kubernetes-node	v1.33.10	patch	v1.33.11 → v1.33.12
oss/v2/kubernetes/kube-proxy		patch	v1.35.4-3 → v1.35.5-4
oss/v2/kubernetes/kube-proxy		patch	v1.34.7-2 → v1.34.8-4
oss/v2/kubernetes/kube-proxy		patch	v1.33.11-2 → v1.33.12-5

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[aks-node-assistant]

AgentBaker Linux PR gate — Test-assertion regression on wireserver-blocking validator (NOT this PR, NOT fwupd)

• Run: 167348372 (failed)
• Failed task: Run AgentBaker E2E
• Test summary: DONE 457 tests, 95 skipped, 6 failures in 1973.563s (no fwupd hits in this run)

Failing scenarios (all Ubuntu 22.04, all hit the same assertion):
Test_Ubuntu2204_ContainerdHasCurrentVersion, Test_Ubuntu2204_KubeletCustomConfig, Test_Ubuntu2204_PMC_Install (default + scriptless variants).

Exact failure signature (identical across all three):

validation.go:345: 🔴 FAIL: wireserver check "wireserver port 80 goalstate":
  unexpected curl exit code "0" (want 28 timeout or 7 refused)
  stdout="", stderr=""
  FORWARD chain: ...
  exit code: 0

The validator that "wireserver must be blocked from unprivileged pods" expects curl to fail with 28 (timeout) or 7 (connection refused), but curl is returning 0 (success) with empty stdout/stderr — i.e. the curl call is succeeding (or being treated as such) when the validator expects it to be blocked. This is a validator assertion mismatch, not a node/VM regression.

Three-level analysis:

1. L1: wireserver-blocking validator fails because curl exits 0 instead of 28/7. Empty stdout suggests connection was established but no body returned, which curl can treat as success in some modes.
2. L2 corroboration: all 3 failing scenarios are 22.04, all hit the same line (validation.go:345), all run after CSE + Inspektor Gadget succeed, and the rest of the 457-test suite passes; this is a 6-failure run, not a mass failure. PR chore(deps): update kube-components (patch) #8509 is a kube-components (kubelet/kubectl) patch bump — nothing in that delta touches iptables/wireserver blocking, the validator code, or the curl invocation.
3. L3 challenge: alternatives — (a) PR-caused: refuted, kube-components patch has no path to changing wireserver iptables rules or curl behavior in debugnonhost-mariner-tolerated; (b) infra regression on the privileged-pod-blocking iptables rule: possible — if the FORWARD chain rule that should block traffic from unprivileged pods to wireserver was changed/loosened in a recent main commit, curl would succeed where it used to be blocked; (c) test-assertion drift: validator may have been recently tightened to expect 28/7 strictly when curl can also return 56/52/etc. Strongest alternative is (b) — a main-branch change to the wireserver-block iptables rules or networkd config — refuted as more likely than test-code drift if it reproduces across distros, but here only 22.04 fails. Either way, not this PR.

Build-vs-test: test/product split — needs E2E owner to confirm whether the FORWARD-chain block was changed in main or the validator assertion needs widening.
Confidence: HIGH that PR #8509 is not the cause. MEDIUM on the precise main owner (validator vs. iptables rule).

Recommended next action / owner: NodeSIG-dev / E2E owner of e2e/validation.go:345 (wireserver-blocked-from-unprivileged-pods validator) — review whether the expected-failure exit-code set should accept additional curl exit codes, and audit recent main changes to wireserver-block iptables/forward rules. PR author: do NOT block merge; this is not in the kube-components patch's scope.

Posted by Clawpilot AgentBaker gate detective.

[aks-node-assistant]

AgentBaker Linux PR gate — Ubuntu 24.04 fwupd.service mass E2E failure (RECURRING main regression, NOT this PR)

• Run: 167370131 (failed)
• Failed task: Run AgentBaker E2E
• Test summary: DONE 446 tests, 95 skipped, 18 failures in 1764.736s
• Primary signature: validators.go:995: 🔴 FAIL: the following systemd units have unexpectedly entered a failed state: [fwupd.service] (8 hits)

Failing scenarios — all Ubuntu 24.04: Test_LocalDNSHostsPlugin (+ Scriptless 24.04 leg), Test_Ubuntu2404_CSE_FullInstallPerformance, Test_Ubuntu2404_NPD_Basic, Test_Ubuntu2404_SecureTLSBootstrapping_BootstrapToken_Fallback, Test_Ubuntu2404Gen2, Test_Ubuntu2404Gen2_McrChinaCloud (+ Scriptless).

Note: The prior failure on this PR (build 167348372) was the wireserver-block validator's curl-exit-code-0 issue across Ubuntu 22.04 — that signature is gone in this run (0 wireserver-check failures), so that earlier issue appears to have been resolved on main. The 24.04 fwupd regression remains.

Same fwupd.service 24.04 main regression flagged on 11+ recent gate runs. Mitigation PR #8662 in flight.
Build-vs-test: product/VHD regression caught by E2E.
Confidence: HIGH that PR #8509 is not the cause; HIGH that this is the recurring 24.04 main regression.
Strongest alternative (less likely): kube-components patch breaking 24.04 fwupd — refuted, same signature across many unrelated PRs.

Recommended next action / owner: NodeSIG-dev — main fix tracked in PR #8662. PR author: do NOT block merge; rebase + rerun once #8662 lands.

Posted by Clawpilot AgentBaker gate detective.

[aks-node-assistant]

AgentBaker Linux PR gate — Mass kube.go:195 "node never appeared" on shared cluster abe2e-kubenet-v5-150ee (NOT this PR)

• Run: 167741291 (definition 119535, AKS Linux VHD Build - PR check-in gate)
• Failed: Stage e2e → Job/Task Run AgentBaker E2E (exit 1, ~62m)
• Surface (3-level RCA):
  1. 209 === FAIL, 0 PASS, 97 SKIP. 115 × kube.go:195 "<vmss>" haven't appeared in k8s API server: context deadline exceeded (~740s); 66 × kube.go:166 error listing nodes: client rate limiter Wait returned an error: context deadline exceeded. 126 VMSS created successfully; only 2 nodes ever reached Ready.
  2. Cluster: abe2e-kubenet-v5-150ee in abe2e-westus3 — same shared cluster as build 167737875 (unrelated PR feat(anc): support a base-to-version hotfix map in downloadHotfix #8694) which showed an identical 115-failure profile. Failures uniform across distros (Ubuntu2204, Ubuntu2404, AzureLinuxV3, ACL) AND bootstrap modes (default + scriptless_nbc); PR chore(deps): update kube-components (patch) #8509 is renovate-only kube-components version bump (no pkg/, parts/, CSE, or aks-node-controller changes).
  3. Root-cause challenge: ruled out (a) PR regression — renovate-only and the default script-based path fails identically to scriptless_nbc; (b) networkisolated-apiserver-fqdn-nxdomain — wrong cluster (kubenet-v5-150ee vs networkisolated-v3-kq4wzvpl) and wrong error (no VALIDATION_ERR=52/NXDOMAIN); (c) localdns-hostsplugin-canary-hotreload-timeout — no validation.go:106 canary errors; failure happens before validation. Strongest alternative: test-framework shared k8s client rate-limit exhaustion under concurrent scenarios — but evidence (azure-side VMSS creation succeeds, kubelet never registers, identical pattern on unrelated PRs) points to shared-cluster/control-plane saturation rather than framework.
• Classification: test infrastructure flake (shared-cluster fleet stress) — build-vs-test class: test/infra, not build/VHD/CSE.
• Flaky vs deterministic: deterministic on this cluster instance, flaky overall (intermittent, recurs on unrelated PRs).
• Confidence: HIGH (~90%) — exact match to existing wiki signature on same cluster.
• Wiki signature: kubenet-v5-node-not-ready-scriptless (existing) — see flakiness wiki. Adding 167741291 brings Count 4 → 5; still below the >6 escalation threshold.
• Recommended next action: rerun the Run AgentBaker E2E task (PR change is unrelated); owner for the underlying flake: AgentBaker E2E test-infra (investigate abe2e-kubenet-v5-150ee control-plane / VMSS→node registration path).

Posted by Clawpilot AgentBaker Linux Gate Detective. Not a status check; do not block the PR on this comment.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[github-actions]

Changes cached containers or packages on windows VHDs

Please get a Windows SIG member to approve.

The following dif file shows any additions or deletions from what will be cached on windows VHDs organised by VHD type.

• Additions are new things cached.
• Deletions are things no longer cached.

diff --git a/vhd_files/2022-containerd-gen2.txt b/vhd_files/2022-containerd-gen2.txt
index c51a47f..f345b67 100644
--- a/vhd_files/2022-containerd-gen2.txt
+++ b/vhd_files/2022-containerd-gen2.txt
@@ -28 +27,0 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.32.12/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.10/windowszip/v1.33.10-1int.zip
@@ -30 +29 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.11/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.4/windowszip/v1.34.4-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.12/windowszip/v1.33.12-1int.zip
@@ -31,0 +31 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.7/window
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.8/windowszip/v1.34.8-1int.zip
diff --git a/vhd_files/2022-containerd.txt b/vhd_files/2022-containerd.txt
index 7312c49..5da5d1f 100644
--- a/vhd_files/2022-containerd.txt
+++ b/vhd_files/2022-containerd.txt
@@ -28 +27,0 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.32.12/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.10/windowszip/v1.33.10-1int.zip
@@ -30 +29 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.11/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.4/windowszip/v1.34.4-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.12/windowszip/v1.33.12-1int.zip
@@ -31,0 +31 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.7/window
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.8/windowszip/v1.34.8-1int.zip
diff --git a/vhd_files/2025-gen2.txt b/vhd_files/2025-gen2.txt
index 36e3641..7880d4a 100644
--- a/vhd_files/2025-gen2.txt
+++ b/vhd_files/2025-gen2.txt
@@ -26 +25,0 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.32.12/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.10/windowszip/v1.33.10-1int.zip
@@ -28 +27 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.11/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.4/windowszip/v1.34.4-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.12/windowszip/v1.33.12-1int.zip
@@ -29,0 +29 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.7/window
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.8/windowszip/v1.34.8-1int.zip
diff --git a/vhd_files/2025.txt b/vhd_files/2025.txt
index b8873d5..7cd893e 100644
--- a/vhd_files/2025.txt
+++ b/vhd_files/2025.txt
@@ -26 +25,0 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.32.12/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.10/windowszip/v1.33.10-1int.zip
@@ -28 +27 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.11/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.4/windowszip/v1.34.4-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.12/windowszip/v1.33.12-1int.zip
@@ -29,0 +29 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.7/window
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.8/windowszip/v1.34.8-1int.zip