Merge https://github.com/kubernetes/cloud-provider-vsphere:master (22dce29) into main

[cloud-team-rebase-bot]

Summary by CodeRabbit

• Chores
  • Go toolchain updated to 1.26.0 across project files.
  • Kubernetes-related modules refreshed (approx. v0.35 → v0.36) and many Go dependencies upgraded.
  • Security tooling (Trivy) bumped to 0.69.2.
  • CI/build action and builder image references refreshed and version-pinned.
  • Helm chart index and chart metadata updated; README compatibility matrix revised.
• New
  • Added release/manifests and charts targeting v1.36.0 and default controller image/tag updates.

[coderabbitai]

Walkthrough

Bumps GitHub Action pins, Go toolchain and many Go module versions; updates CI/Cloud Build images, Makefile Trivy/GO defaults; increments Helm chart/app image versions and releases; updates numerous Kubernetes manifest image tags and adds a v1.36 release manifest; minor test change.

Changes

Cohort / File(s)	Summary
GitHub Actions — basic workflows .github/workflows/auto-sync-gh-pages.yml, .github/workflows/bump-k8s-dep.yml, .github/workflows/bump-test-k8s-dep.yml, .github/workflows/generate-release-notes.yml	Updated actions/checkout usage from v6.0.1 → v6.0.2.
GitHub Actions — security scan .github/workflows/weekly-security-scan.yaml	Pinned actions/checkout to v6.0.2 commit and upgraded actions/setup-go from v5.1.0 → v6.3.0.
Go modules & tooling go.mod, hack/tools/go.mod, test/e2e/go.mod	Bumped Go versions and refreshed many direct and indirect dependencies (k8s libs, govmomi, otel, protobuf, ginkgo/gomega, golang.org/x/*, etc.).
Makefile Makefile	Added GO_VERSION ?= 1.26.0; bumped TRIVY_VER 0.49.1 → 0.69.2.
Cloud Build cloudbuild.yaml, cloudbuild-nightly.yaml	Replaced digest-pinned gcb-docker-gcloud image with named tag v20260205-38cfa9523f.
Container build cluster/images/controller-manager/Dockerfile	Updated build-args: GOLANG_IMAGE golang:1.25.0 → golang:1.26.0 and default VERSION 1.35.1 → 1.36.0 (affects -X main.version).
Helm chart & values charts/vsphere-cpi/Chart.yaml, charts/vsphere-cpi/values.yaml, charts/vsphere-cpi/README.md	Bumped chart appVersion/version and default daemonset image tag from 1.35.1 → 1.36.0; README packaging VERSION adjusted.
Helm index index.yaml	Replaced vsphere-cpi 1.35.1 entry with 1.36.0 and refreshed timestamps/digests.
Manifests & release manifests manifests/controller-manager/.../vsphere-cloud-controller-manager-*.yaml, releases/v1.35/vsphere-cloud-controller-manager.yaml, releases/v1.36/vsphere-cloud-controller-manager.yaml, docs/book/tutorials/disable-node-deletion.yaml, releases/README.md, README.md	Updated CPI image tags across manifests and docs (primarily v1.35.1 → v1.36.0 or v1.35.1 → v1.35.0 where noted); added full releases/v1.36/... manifest set.
Test tweak pkg/cloudprovider/vsphereparavirtual/loadbalancer_test.go	Adjusted mocked apierrors.NewNotFound to use vmopv1.GroupVersion instead of vmopv1.SchemeGroupVersion.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

🚥 Pre-merge checks | ✅ 8 | ❌ 4

❌ Failed checks (2 warnings, 2 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Topology-Aware Scheduling Compatibility	⚠️ Warning	New v1.36 manifest adds DaemonSet with required node affinity for control-plane nodes, which breaks on HyperShift External topology where no control-plane nodes exist in hosted clusters.	Implement topology-aware scheduling by detecting ControlPlaneTopology and either using preferred affinity, conditional manifests, or adding fallback scheduling for non-HA topologies.
Title check	❓ Inconclusive	The title describes a merge action but does not clearly convey the main purpose or scope of the changes, making it difficult to understand what specific improvements or features this PR introduces.	Replace the generic merge description with a clear summary of the primary changes, e.g., 'Upgrade vSphere CPI to v1.36.0 with Kubernetes 1.36 support and security updates' or similar.
Test Structure And Quality	❓ Inconclusive	PR modifies only unit tests using Go's testing framework, not Ginkgo DSL tests. Ginkgo e2e tests were not modified.	Clarify if check applies to all tests or only Ginkgo tests. If all tests, the modified unit test follows good practices with subtests and meaningful names.

✅ Passed checks (8 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Repository uses traditional Go testing with func TestXxx patterns, not Ginkgo. No Ginkgo test declarations (It, Describe, Context, When) found in codebase.
Microshift Test Compatibility	✅ Passed	This PR does not introduce any new Ginkgo e2e tests; it only modifies configuration files, manifests, Go module dependencies, and includes a minor unit test fix.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This pull request does not add any new Ginkgo e2e tests. The repository contains only pre-existing e2e tests in test/e2e/ (3 tests in cpi_vm_test.go and 2 tests in cpi_install_test.go), all of which were already in the codebase. The PR only updates dependency versions and modifies an existing unit test's mock error. No new test definitions using Ginkgo patterns are introduced.
Ote Binary Stdout Contract	✅ Passed	This pull request modifies only configuration, documentation, and manifest files with no Go source code changes, making the OTE Binary Stdout Contract check inapplicable.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	This pull request does not add any new Ginkgo e2e tests. The changes consist of version bumps, manifest updates, and dependency updates. The only test-related change is a single-line modification to an existing test.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

Hi @cloud-team-rebase-bot[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

Actionable comments posted: 1

♻️ Duplicate comments (2)

go.mod (1)

89-93: ⚠️ Potential issue | 🟠 Major

Upgrade vulnerable go.opentelemetry.io/otel/sdk and align OTel module versions.

go.opentelemetry.io/otel/sdk v1.40.0 remains in the graph and is flagged with GHSA-hfvc-g4fc-pqhx. Also, the OTel modules are mixed across 1.40/1.41, which is risky for compatibility. Please bump SDK to a fixed release (>= v1.43.0) and keep OTel modules on a consistent version set.

Suggested go.mod adjustment

-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect
 	go.opentelemetry.io/otel/metric v1.41.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.40.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
 	go.opentelemetry.io/otel/trace v1.41.0 // indirect

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@go.mod` around lines 89 - 93, The go.mod currently pins mixed OTel versions
and uses go.opentelemetry.io/otel/sdk v1.40.0 which is vulnerable; update go.mod
so all OTel modules (e.g., go.opentelemetry.io/otel,
go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/metric,
go.opentelemetry.io/otel/sdk, go.opentelemetry.io/otel/exporters/otlp/otlptrace
and otlptracegrpc) are aligned to a safe, consistent release (bump sdk to >=
v1.43.0 and set the other otel modules to the same vX.Y.Z), then run go mod tidy
and go list -m all to verify the vulnerable version is removed from the
dependency graph.

README.md (1)

104-104: ⚠️ Potential issue | 🟠 Major

Fix the incorrect “latest version” image tag.

Line 104 marks v1.33.0 as latest, but this PR ships v1.36.0 artifacts/manifests. This will mislead users during installs/upgrades.

Suggested patch

-registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.33.0 # <== latest version
+registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.36.0 # <== latest version

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@README.md` at line 104, Update the incorrect image tag in README.md: replace
the registry string
"registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.33.0" with the
correct released tag
"registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.36.0" so the README
reflects the PR's shipped artifacts/manifests.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@releases/v1.36/vsphere-cloud-controller-manager.yaml`:
- Around line 236-249: The vsphere-cloud-controller-manager container definition
(container name "vsphere-cloud-controller-manager") lacks a securityContext
override; update that container spec to include
securityContext.allowPrivilegeEscalation: false (add a securityContext block
under the container with allowPrivilegeEscalation: false) so the pod cannot
escalate privileges and meets hardened cluster policies; keep the change scoped
to the container spec and do not alter other volumeMounts or args.

---

Duplicate comments:
In `@go.mod`:
- Around line 89-93: The go.mod currently pins mixed OTel versions and uses
go.opentelemetry.io/otel/sdk v1.40.0 which is vulnerable; update go.mod so all
OTel modules (e.g., go.opentelemetry.io/otel, go.opentelemetry.io/otel/trace,
go.opentelemetry.io/otel/metric, go.opentelemetry.io/otel/sdk,
go.opentelemetry.io/otel/exporters/otlp/otlptrace and otlptracegrpc) are aligned
to a safe, consistent release (bump sdk to >= v1.43.0 and set the other otel
modules to the same vX.Y.Z), then run go mod tidy and go list -m all to verify
the vulnerable version is removed from the dependency graph.

In `@README.md`:
- Line 104: Update the incorrect image tag in README.md: replace the registry
string "registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.33.0" with
the correct released tag
"registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.36.0" so the README
reflects the PR's shipped artifacts/manifests.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c827549f-d843-42a6-862f-469f8615979b

📥 Commits

Reviewing files that changed from the base of the PR and between ba1e93f and 3758a8e.

⛔ Files ignored due to path filters (274)

• go.sum is excluded by !**/*.sum
• hack/tools/go.sum is excluded by !**/*.sum
• hack/tools/vendor/github.com/google/pprof/profile/merge.go is excluded by !**/vendor/**
• hack/tools/vendor/github.com/google/pprof/profile/profile.go is excluded by !**/vendor/**
• hack/tools/vendor/github.com/google/pprof/profile/proto.go is excluded by !**/vendor/**
• hack/tools/vendor/github.com/google/pprof/profile/prune.go is excluded by !**/vendor/**
• hack/tools/vendor/github.com/onsi/ginkgo/v2/ginkgo/command/command.go is excluded by !**/vendor/**
• hack/tools/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/run.go is excluded by !**/vendor/**
• hack/tools/vendor/github.com/onsi/ginkgo/v2/ginkgo/run/run_command.go is excluded by !**/vendor/**
• hack/tools/vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson.go is excluded by !**/vendor/**
• hack/tools/vendor/github.com/onsi/ginkgo/v2/reporters/default_reporter.go is excluded by !**/vendor/**
• hack/tools/vendor/github.com/onsi/ginkgo/v2/reporters/junit_report.go is excluded by !**/vendor/**
• hack/tools/vendor/github.com/onsi/ginkgo/v2/reporters/teamcity_report.go is excluded by !**/vendor/**
• hack/tools/vendor/github.com/onsi/ginkgo/v2/types/errors.go is excluded by !**/vendor/**
• hack/tools/vendor/github.com/onsi/ginkgo/v2/types/semver_filter.go is excluded by !**/vendor/**
• hack/tools/vendor/github.com/onsi/ginkgo/v2/types/types.go is excluded by !**/vendor/**
• hack/tools/vendor/github.com/onsi/ginkgo/v2/types/version.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/mod/semver/semver.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sync/errgroup/errgroup.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/affinity_linux.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/fdset.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/ifreq_linux.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/mkall.sh is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/mkerrors.sh is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/syscall_linux.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/syscall_netbsd.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/syscall_solaris.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/zerrors_linux.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/zerrors_linux_386.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/zsyscall_linux.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/ztypes_linux.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/go/ast/inspector/cursor.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/go/packages/golist.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/go/packages/packages.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/go/packages/visit.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/go/types/objectpath/objectpath.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/go/types/typeutil/callee.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/go/types/typeutil/map.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/event/core/event.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/event/core/export.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/event/label/label.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/gcimporter/bimport.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/gcimporter/iexport.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/gcimporter/iimport.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/gcimporter/iimport_go122.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/stdlib/deps.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/stdlib/import.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/stdlib/manifest.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/stdlib/stdlib.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/typeparams/normalize.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/typesinternal/classify_call.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/typesinternal/element.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/typesinternal/fx.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/typesinternal/isnamed.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/typesinternal/qualifier.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/typesinternal/types.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/typesinternal/varkind.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/typesinternal/varkind_go124.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/typesinternal/zerovalue.go is excluded by !**/vendor/**
• hack/tools/vendor/golang.org/x/tools/internal/versions/features.go is excluded by !**/vendor/**
• hack/tools/vendor/modules.txt is excluded by !**/vendor/**
• test/e2e/go.sum is excluded by !**/*.sum
• test/e2e/vendor/github.com/google/pprof/profile/profile.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/google/pprof/profile/proto.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/moby/spdystream/NOTICE is excluded by !**/vendor/**
• test/e2e/vendor/github.com/moby/spdystream/connection.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/moby/spdystream/spdy/LICENSE is excluded by !**/vendor/**
• test/e2e/vendor/github.com/moby/spdystream/spdy/PATENTS is excluded by !**/vendor/**
• test/e2e/vendor/github.com/moby/spdystream/spdy/dictionary.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/moby/spdystream/spdy/options.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/moby/spdystream/spdy/read.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/moby/spdystream/spdy/types.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/moby/spdystream/spdy/write.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/ginkgo/v2/README.md is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/ginkgo/v2/core_dsl.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/ginkgo/v2/decorator_dsl.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/ginkgo/v2/ginkgo/command/command.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/run.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/ginkgo/v2/ginkgo/run/run_command.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/ginkgo/v2/internal/focus.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/ginkgo/v2/internal/group.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/ginkgo/v2/internal/node.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/ginkgo/v2/internal/suite.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/ginkgo/v2/reporters/default_reporter.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/ginkgo/v2/reporters/junit_report.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/ginkgo/v2/reporters/teamcity_report.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/ginkgo/v2/types/errors.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/ginkgo/v2/types/semver_filter.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/ginkgo/v2/types/types.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/ginkgo/v2/types/version.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/gomega/CHANGELOG.md is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/gomega/gomega_dsl.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/gomega/matchers.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/onsi/gomega/matchers/match_error_strictly_matcher.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/fault/meta_types.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/internal/version/version.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/list/lister.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/object/datastore.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/object/folder.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/object/host_system.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/object/virtual_device_list.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/vapi/internal/internal.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/vapi/rest/client.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/vapi/rest/errors.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/vapi/rest/notifications.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/vim25/client.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/vim25/methods/methods.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/vim25/methods/unreleased.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/vim25/mo/extra.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/vim25/mo/registry.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/vim25/types/enum.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/vim25/types/guest.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/vim25/types/hardware_version.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/vim25/types/helpers.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/vim25/types/types.go is excluded by !**/vendor/**
• test/e2e/vendor/github.com/vmware/govmomi/vim25/types/unreleased.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/crypto/scrypt/scrypt.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/crypto/ssh/cipher.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/crypto/ssh/client_auth.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/net/html/iter.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/net/html/node.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/net/html/nodetype_string.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/net/http2/client_priority_go126.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/net/http2/client_priority_go127.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/net/http2/frame.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/net/http2/http2.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/net/http2/server.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/net/http2/transport.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/net/http2/writesched.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/net/http2/writesched_priority_rfc7540.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/net/http2/writesched_priority_rfc9218.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/net/http2/writesched_random.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/net/internal/httpsfv/httpsfv.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/net/websocket/hybi.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sync/singleflight/singleflight.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/cpu/asm_darwin_arm64_gc.s is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/cpu/cpu_arm64.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/cpu/cpu_darwin_arm64.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/cpu/cpu_darwin_arm64_other.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/cpu/cpu_gccgo_arm64.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/cpu/cpu_other_arm64.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/cpu/cpu_x86.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/cpu/syscall_darwin_arm64_gc.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/plan9/syscall_plan9.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/unix/ioctl_signed.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/unix/ioctl_unsigned.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/unix/syscall_solaris.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/unix/syscall_unix.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/unix/ztypes_linux.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/windows/aliases.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/windows/dll_windows.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/windows/registry/key.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/windows/security_windows.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/windows/syscall_windows.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/windows/types_windows.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/sys/windows/zsyscall_windows.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/term/terminal.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/cases/tables10.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/cases/tables11.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/cases/tables12.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/cases/tables15.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/cases/tables17.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/cases/tables9.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/message/catalog/catalog.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/message/catalog/dict.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/message/catalog/go19.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/message/catalog/gopre19.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/secure/bidirule/bidirule.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/secure/bidirule/bidirule10.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/secure/bidirule/bidirule9.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/unicode/bidi/tables10.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/unicode/bidi/tables11.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/unicode/bidi/tables12.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/unicode/bidi/tables13.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/unicode/bidi/tables15.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/unicode/bidi/tables17.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/unicode/bidi/tables9.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/unicode/norm/forminfo.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/unicode/norm/tables10.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/unicode/norm/tables11.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/unicode/norm/tables12.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/unicode/norm/tables15.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/unicode/norm/tables17.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/text/unicode/norm/tables9.0.0.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/tools/go/ast/inspector/cursor.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/tools/go/ast/inspector/inspector.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/tools/go/ast/inspector/iter.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/tools/go/packages/golist.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/tools/go/packages/packages.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/tools/go/types/objectpath/objectpath.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/tools/internal/aliases/aliases.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/tools/internal/aliases/aliases_go122.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/tools/internal/event/core/event.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/tools/internal/event/keys/keys.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/tools/internal/event/label/label.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/tools/internal/gcimporter/iexport.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/tools/internal/gcimporter/iimport.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/tools/internal/gcimporter/ureader_yes.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/tools/internal/stdlib/deps.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/tools/internal/stdlib/manifest.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/tools/internal/typeparams/free.go is excluded by !**/vendor/**
• test/e2e/vendor/golang.org/x/tools/internal/typesinternal/types.go is excluded by !**/vendor/**
• test/e2e/vendor/google.golang.org/protobuf/internal/genid/api_gen.go is excluded by !**/vendor/**
• test/e2e/vendor/google.golang.org/protobuf/internal/version/version.go is excluded by !**/vendor/**
• test/e2e/vendor/google.golang.org/protobuf/types/descriptorpb/descriptor.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• test/e2e/vendor/gopkg.in/evanphx/json-patch.v4/README.md is excluded by !**/vendor/**
• test/e2e/vendor/gopkg.in/evanphx/json-patch.v4/patch.go is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/admission/v1/doc.go is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/admission/v1/generated.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• test/e2e/vendor/k8s.io/api/admission/v1/generated.proto is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/admission/v1/generated.protomessage.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• test/e2e/vendor/k8s.io/api/admission/v1/types.go is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/admission/v1/types_swagger_doc_generated.go is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/admission/v1/zz_generated.model_name.go is excluded by !**/vendor/**, !**/zz_generated*
• test/e2e/vendor/k8s.io/api/admission/v1beta1/doc.go is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/admission/v1beta1/generated.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• test/e2e/vendor/k8s.io/api/admission/v1beta1/generated.proto is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/admission/v1beta1/generated.protomessage.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• test/e2e/vendor/k8s.io/api/admission/v1beta1/types.go is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/admission/v1beta1/types_swagger_doc_generated.go is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/admission/v1beta1/zz_generated.model_name.go is excluded by !**/vendor/**, !**/zz_generated*
• test/e2e/vendor/k8s.io/api/admissionregistration/v1/doc.go is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/admissionregistration/v1/generated.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• test/e2e/vendor/k8s.io/api/admissionregistration/v1/generated.protomessage.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• test/e2e/vendor/k8s.io/api/admissionregistration/v1/types.go is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/admissionregistration/v1/zz_generated.model_name.go is excluded by !**/vendor/**, !**/zz_generated*
• test/e2e/vendor/k8s.io/api/admissionregistration/v1alpha1/doc.go is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/admissionregistration/v1alpha1/generated.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• test/e2e/vendor/k8s.io/api/admissionregistration/v1alpha1/generated.protomessage.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• test/e2e/vendor/k8s.io/api/admissionregistration/v1alpha1/types.go is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/admissionregistration/v1alpha1/zz_generated.model_name.go is excluded by !**/vendor/**, !**/zz_generated*
• test/e2e/vendor/k8s.io/api/admissionregistration/v1beta1/doc.go is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/admissionregistration/v1beta1/generated.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• test/e2e/vendor/k8s.io/api/admissionregistration/v1beta1/generated.proto is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/admissionregistration/v1beta1/generated.protomessage.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• test/e2e/vendor/k8s.io/api/admissionregistration/v1beta1/types.go is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/admissionregistration/v1beta1/zz_generated.model_name.go is excluded by !**/vendor/**, !**/zz_generated*
• test/e2e/vendor/k8s.io/api/apidiscovery/v2/doc.go is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/apidiscovery/v2/generated.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• test/e2e/vendor/k8s.io/api/apidiscovery/v2/generated.protomessage.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• test/e2e/vendor/k8s.io/api/apidiscovery/v2/zz_generated.model_name.go is excluded by !**/vendor/**, !**/zz_generated*
• test/e2e/vendor/k8s.io/api/apidiscovery/v2beta1/doc.go is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/apidiscovery/v2beta1/generated.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• test/e2e/vendor/k8s.io/api/apidiscovery/v2beta1/generated.protomessage.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• test/e2e/vendor/k8s.io/api/apidiscovery/v2beta1/zz_generated.model_name.go is excluded by !**/vendor/**, !**/zz_generated*
• test/e2e/vendor/k8s.io/api/apiserverinternal/v1alpha1/doc.go is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/apiserverinternal/v1alpha1/generated.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• test/e2e/vendor/k8s.io/api/apiserverinternal/v1alpha1/generated.protomessage.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• test/e2e/vendor/k8s.io/api/apiserverinternal/v1alpha1/zz_generated.model_name.go is excluded by !**/vendor/**, !**/zz_generated*
• test/e2e/vendor/k8s.io/api/apps/v1/doc.go is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/apps/v1/generated.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• test/e2e/vendor/k8s.io/api/apps/v1/generated.proto is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/apps/v1/generated.protomessage.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• test/e2e/vendor/k8s.io/api/apps/v1/types.go is excluded by !**/vendor/**
• test/e2e/vendor/k8s.io/api/apps/v1/types_swagger_doc_generated.go is excluded by !**/vendor/**

📒 Files selected for processing (26)

• .github/workflows/auto-sync-gh-pages.yml
• .github/workflows/bump-k8s-dep.yml
• .github/workflows/bump-test-k8s-dep.yml
• .github/workflows/generate-release-notes.yml
• .github/workflows/weekly-security-scan.yaml
• Makefile
• README.md
• charts/vsphere-cpi-1.35.1.tgz
• charts/vsphere-cpi-1.36.0.tgz
• charts/vsphere-cpi/Chart.yaml
• charts/vsphere-cpi/README.md
• charts/vsphere-cpi/values.yaml
• cloudbuild-nightly.yaml
• cloudbuild.yaml
• cluster/images/controller-manager/Dockerfile
• docs/book/tutorials/disable-node-deletion.yaml
• go.mod
• hack/tools/go.mod
• index.yaml
• manifests/controller-manager/vsphere-cloud-controller-manager-ds.yaml
• manifests/controller-manager/vsphere-cloud-controller-manager-pod.yaml
• pkg/cloudprovider/vsphereparavirtual/loadbalancer_test.go
• releases/README.md
• releases/v1.35/vsphere-cloud-controller-manager.yaml
• releases/v1.36/vsphere-cloud-controller-manager.yaml
• test/e2e/go.mod

✅ Files skipped from review due to trivial changes (16)

• .github/workflows/auto-sync-gh-pages.yml
• .github/workflows/bump-k8s-dep.yml
• charts/vsphere-cpi/README.md
• .github/workflows/bump-test-k8s-dep.yml
• .github/workflows/generate-release-notes.yml
• pkg/cloudprovider/vsphereparavirtual/loadbalancer_test.go
• cloudbuild.yaml
• cloudbuild-nightly.yaml
• docs/book/tutorials/disable-node-deletion.yaml
• cluster/images/controller-manager/Dockerfile
• releases/v1.35/vsphere-cloud-controller-manager.yaml
• charts/vsphere-cpi/Chart.yaml
• releases/README.md
• hack/tools/go.mod
• .github/workflows/weekly-security-scan.yaml
• manifests/controller-manager/vsphere-cloud-controller-manager-pod.yaml

🚧 Files skipped from review as they are similar to previous changes (4)

• manifests/controller-manager/vsphere-cloud-controller-manager-ds.yaml
• charts/vsphere-cpi/values.yaml
• Makefile
• test/e2e/go.mod

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Set container allowPrivilegeEscalation: false for hardened clusters.

At Line 236 onward, the container has no securityContext.allowPrivilegeEscalation override, so it defaults to permissive behavior. This weakens pod security posture and can be rejected by stricter policies.

Suggested patch

       containers:
         - name: vsphere-cloud-controller-manager
           image: registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.36.0
+          securityContext:
+            allowPrivilegeEscalation: false
           args:
             - --cloud-provider=vsphere
             - --v=2
             - --cloud-config=/etc/cloud/vsphere.conf

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	- name: vsphere-cloud-controller-manager
	image: registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.36.0
	args:
	- --cloud-provider=vsphere
	- --v=2
	- --cloud-config=/etc/cloud/vsphere.conf
	volumeMounts:
	- mountPath: /etc/cloud
	name: vsphere-config-volume
	readOnly: true
	resources:
	requests:
	cpu: 200m
	hostNetwork: true
	- name: vsphere-cloud-controller-manager
	image: registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.36.0
	securityContext:
	allowPrivilegeEscalation: false
	args:
	- --cloud-provider=vsphere
	- --v=2
	- --cloud-config=/etc/cloud/vsphere.conf
	volumeMounts:
	- mountPath: /etc/cloud
	name: vsphere-config-volume
	readOnly: true
	resources:
	requests:
	cpu: 200m
	hostNetwork: true

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@releases/v1.36/vsphere-cloud-controller-manager.yaml` around lines 236 - 249,
The vsphere-cloud-controller-manager container definition (container name
"vsphere-cloud-controller-manager") lacks a securityContext override; update
that container spec to include securityContext.allowPrivilegeEscalation: false
(add a securityContext block under the container with allowPrivilegeEscalation:
false) so the pod cannot escalate privileges and meets hardened cluster
policies; keep the change scoped to the container spec and do not alter other
volumeMounts or args.