Repository: elastic/cloud-on-k8s

Issue:
PDB per Node type (Master, Data, Ingest)


## PodDisruptionBudget per node type (master, data, injest, ...)

If we are performing maintenance on a kubernetes cluster (cordon, drain, updates/upgrades, then reboot) an ECK cluster can end up blocking the upgrade for a lengthy period of time while the ECK cluster goes into yellow status while a data node is removed from service but replaced on a separate node.  This disruption often causes re-balancing of shards and now the Elastic PDB prevents other ECK cluster pods from being evicted even though they may not have an impact on data loss such as a master pod.  If we had a PDB per node type we could mitigate some of the nodes that would be blocked while waiting for the ECK cluster to return to healthy green state.

It also appears that regardless of the underlying data redundancy the cluster is limited to a single disruption at this point.



Discussion:
@anyasabo: Just to address your last point, the `maxUnavailable` setting can be tuned to modify that behavior: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-update-strategy.html@sebgl: `updateStrategy.maxUnavailable` only impacts rolling upgrades of the cluster, not disruptions related to the PodDisruptionBudget.

Note that you can also [set your own PodDisruptionBudget](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-pod-disruption-budget.html), or override the default one. For your use case I think you may want something similar to the following:

```yaml
apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: quickstart
spec:
  version: 7.6.2
  nodeSets:
  - name: default
    count: 3
  podDisruptionBudget: {} # disable the default PDB
---
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  name: data-nodes-pdb
spec:
  minAvailable: 2 # should probably be (number of data nodes - 1), I'm considering you have 3 data nodes here
  selector:
    matchLabels:
      elasticsearch.k8s.elastic.co/cluster-name: your-es-cluster
      elasticsearch.k8s.elastic.co/node-data: true
      elasticsearch.k8s.elastic.co/node-master: false
---
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  name: master-nodes-pdb
spec:
  minAvailable: 2 # should probably be (number of master nodes - 1), I'm considering you have 3 master nodes here
  selector:
    matchLabels:
      elasticsearch.k8s.elastic.co/cluster-name: your-es-cluster
      elasticsearch.k8s.elastic.co/node-data: false
      elasticsearch.k8s.elastic.co/node-master: true
```

This example (to adapt to your use case) would:
* allow one data node to go down
* also allow one master node to go down
* allow any number of other node roles (eg. ingest) to go down, since no PDB is defined for them@sebgl: It's hard for ECK to come up with the best default depending on use cases here. In which case the example above demonstrates more flexibility to achieve one's needs.
Still keeping the issue open though, we may want to consider improving the existing defaults to allow disrupting more than one node under certain conditions.@sanderma: I also have some issues with the default pdb.
When people deploy an elastic to test with (single node) we are unable to reboot the Kubernetes nodes (see below text for the reason). This is because the operator by default sets a pdb of 1.

I have changed the operator to set the pdb to 0 when nodecount is 1.
IMHO when someone sets a nodecount of 1, he or she is not interested in being highly available.

> If you set maxUnavailable to 0% or 0, or you set minAvailable to 100% or the number of replicas, you are requiring zero voluntary evictions. When you set zero voluntary evictions for a workload object such as ReplicaSet, then you cannot successfully drain a Node running one of those Pods. If you try to drain a Node where an unevictable Pod is running, the drain never completes. This is permitted as per the semantics of PodDisruptionBudget.
source: https://kubernetes.io/docs/tasks/run-application/configure-pdb/#think-about-how-your-application-reacts-to-disruptions

```go
// buildPDBSpec returns a PDBSpec computed from the current StatefulSets,
// considering the cluster health and topology.
func buildPDBSpec(es esv1beta1.Elasticsearch, statefulSets sset.StatefulSetList) v1beta1.PodDisruptionBudgetSpec {
	// compute MinAvailable based on the maximum number of Pods we're supposed to have.
	// Do not set MinAvailable when nodecount is 1. When the PDB is 1, and the amount of pods is 1, Kubernetes will not be able to reboot the node.
	nodeCount := statefulSets.ExpectedNodeCount()
	var minAvailable int32
	if nodeCount == 1 {
		// when only single node, allow the pod to be rebooted, to ensure Kubernetes nodes do not get hung up by the pdb.
		minAvailable = 0
	} else {
		// maybe allow some Pods to be disrupted
		minAvailable = nodeCount - allowedDisruptions(es, statefulSets)
	}

	minAvailableIntStr := intstr.IntOrString{Type: intstr.Int, IntVal: minAvailable}

	return v1beta1.PodDisruptionBudgetSpec{
		// match all pods for this cluster
		Selector: &metav1.LabelSelector{
			MatchLabels: map[string]string{
				label.ClusterNameLabelName: es.Name,
			},
		},
		MinAvailable: &minAvailableIntStr,
		// MaxUnavailable can only be used if the selector matches a builtin controller selector
		// (eg. Deployments, StatefulSets, etc.). We cannot use it with our own cluster-name selector.
		MaxUnavailable: nil,
	}
}
```@sanderma: By setting this default this way, when one does not give a manual pdb, the operator will set the pdb to 0 when there is a single node cluster:
```bash
NAME                    MIN AVAILABLE   MAX UNAVAILABLE   ALLOWED DISRUPTIONS   AGE
quickstart-es-default   0               N/A               1                     8s
```

When you scale the cluster up, the operator will set the pdb as intended, and treat the cluster as highly available:

```bash
NAME                    MIN AVAILABLE   MAX UNAVAILABLE   ALLOWED DISRUPTIONS   AGE
quickstart-es-default   1               N/A               1                     38s
```@sebgl: @sanderma this makes sense to me. Thanks for mentioning the idea in the issue and then opening a PR! Will review it shortly.@erdody: @sebgl if you configure your own PDBs (and disable the default), you disable the ability of the operator to adjust it dynamically based on the cluster status ("It allows one Elasticsearch Pod to be taken down, as long as the cluster has a green health"). I would like to keep that behavior but restricted to data nodes only.  @sebgl: @erdody indeed. Can you give more details about what you're trying to achieve? Allowing all master nodes to be taken down would be rather dangerous?

I'm thinking about relaxing the way the default PDB can be configured to allow users to override the Pod selector only. So that you can keep that default logic for data nodes only and come up with your own additional PDBs for other type of nodes.@erdody: @sebgl that would work for us. I was in fact thinking of setting the non-data nodes PDBs separately. Besides data nodes, the other PDBs don't need any dynamic behavior anyways.@pebrc: Reading through this I don't see a specific need for a code change. The PDB fix for the single node clusters has been merged. So I am tempted to make this a documentation issue. I might make sense to include  @sebgl 's [example](https://github.com/elastic/cloud-on-k8s/issues/2936#issuecomment-618246812) to our PDB documentation page. @Tommmster: > @erdody indeed. Can you give more details about what you're trying to achieve? Allowing all master nodes to be taken down would be rather dangerous?
> 
> I'm thinking about relaxing the way the default PDB can be configured to allow users to override the Pod selector only. So that you can keep that default logic for data nodes only and come up with your own additional PDBs for other type of nodes.

@sebgl Is this a possibility or has it been discarded? We're facing the same issues (master node is restarted, no other nodes can be restarted -> rack drain is blocked). 
Thanks! @BenjaminHerbert: I understand, the default behavior is turned _off_, once I create own PDBs.

> It allows one Elasticsearch Pod to be taken down, as long as the cluster has a green health

What is the risk if this is turned off? Let's say I create separate `master` and `data` node PDBs.



@ebuildy: > What is the risk if this is turned off? Let's say I create separate `master` and `data` node PDBs.

PDB ensure a minimum pods always exist. There is no risk if you create a PDB for each nodes type.

You can lost a master and a data node in same time@BenjaminHerbert: I know about PDB behaviour. I am trying to understand the impact of using a separate PDB for each node with regard to the health of the Elasticsearch cluster. Because this would allow that a second Kubernetes pod is terminated, even though the cluster might be already in a yellow state. This is not allowed when the dynamic PDB handling is in place.@barkbay: Just to be sure I understand, if we can use `maxUnavailable ` instead of `minAvailable` as suggested in https://github.com/elastic/cloud-on-k8s/pull/8590, what is the value of managing the PDBs from the operator? Automatically manage the labels in the selector?

_Edit: Answering to myself: dynamically managing `maxUnavailable ` or `minAvailable`  depending on the cluster state._@naemono: # Update on the default PodDisruptionBudget Enhancements for NodeSets in ECK

We’ve been discussing ways to improve the management of PodDisruptionBudgets (PDBs) in the ECK operator, specifically addressing the limitations outlined in this issue. Our goal is to optimize disruption handling for Elasticsearch clusters, particularly during operations like Kubernetes upgrades. Below, we outline our proposed approach, the rationale behind it, and invite your feedback to help shape this feature.

## Current State

Currently, the ECK operator creates a single PDB for an entire Elasticsearch cluster, using a label selector that spans all nodeSets backed by StatefulSets. The minAvailable field is dynamically managed based on the total number of replicas and the cluster’s health (typically allowing disruptions only when the cluster is green).

## Problem

The single PDB approach causes delays in operations like Kubernetes upgrades, particularly for large clusters with diverse nodeSet roles (e.g., master, data_hot, coordinating). During operations like node maintenance or upgrades, the cluster may temporarily go yellow, halting further disruptions and prolonging the process. Users have expressed a need to allow disruptions for certain nodeSets (e.g., coordinating or ingest) even in a yellow state, while maintaining stricter protections for others (e.g., data_hot). The current workaround requires users to manually define PDBs per nodeSet, which is cumbersome and lacks operator-managed intelligence.

## Proposed Solution:

After evaluating several options we believe that the following solution is the best fit for our needs. This solution enhances the default PDB behavior for customers by creating dedicated PDBs per nodeSet with smarter disruption rules based on the nodeSet’s role and cluster health. The operator will automatically manage these PDBs, setting `maxUnavailable: 1` for specific nodeSets under the following conditions:

* Dedicated master nodeSet: Allow `maxUnavailable: 1` if the cluster is yellow or green.
* Dedicated coordinating nodeSet (no roles defined): Allow `maxUnavailable: 1` if the cluster is yellow or green.
* Dedicated pure data nodeSets (e.g., data_hot, data_warm, data_cold, data_content): Allow `maxUnavailable: 1` only if the cluster is green.
* Dedicated frozen data nodeSets: Allow `maxUnavailable: 1` if the cluster is yellow or green.
* Dedicated ingest, ML, or transform nodeSets: Allow maxUnavailable: 1 if the cluster is yellow or green.
* Mixed nodeSets (e.g., data_hot + ingest): Use the most conservative rule (e.g., maxUnavailable: 1 only when green).

### Pros

* No CRD changes: Maintains backward compatibility and avoids modifying the Elasticsearch spec.
* Automated management: The operator intelligently adjusts PDBs based on cluster health and nodeSet roles, reducing user effort.
* Optimized disruptions: Allows faster operations (e.g., upgrades) by permitting disruptions for certain nodeSets in yellow states.

### Cons

* Limited customization: Users cannot easily override maxUnavailable (e.g., set to 2 for specific nodeSets).
* Potential complexity: The “magic” of automatic PDB management may be less transparent to users.

## Alternatives Considered

We explored several other options, including:

* Extend the Elasticsearch spec to allow a PDB per nodeSet, fully user-controlled. This adds flexibility but requires CRD changes and potentially removes operator-managed health-based disruption controls. Unfortunately this option didn't allow PDBs to span multiple nodeSets.
* Allow a list of named PDBs in the spec, referenced within the nodeSets by name, supporting PDBs across multiple nodeSets but potentially removing operator-managed health checks.

# Example: Elasticsearch CRD with Multiple NodeSets and Resulting PDBs

Below is an example of an Elasticsearch Custom Resource Definition (CRD) with multiple nodeSets, each with distinct Elasticsearch roles, and the corresponding PodDisruptionBudgets (PDBs) generated by the ECK operator using the proposed option. This example illustrates how the operator would create dedicated PDBs per nodeSet (or group of nodeSets with similar roles) based on their roles and cluster health.

## Elasticsearch CRD Example

This CRD defines an Elasticsearch cluster with six nodeSets, each with different roles: master, data_hot, data_cold, coordinating, data_transform, and data_frozen.

```yaml
apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: elasticsearch
  namespace: elastic
spec:
  version: 8.16.1
  nodeSets:
  - name: master
    count: 3
    config:
      node.roles: ["master"]
  - name: data_hot
    count: 4
    config:
      node.roles: ["data_hot"]
  - name: data_cold
    count: 3
    config:
      node.roles: ["data_cold"]
  - name: coordinating
    count: 2
    config:
      node.roles: []
  - name: data-transform
    count: 2
    config:
      node.roles: ["transform"]
  - name: data-frozen
    count: 3
    config:
      node.roles: ["data_frozen"]
```

## Resulting PodDisruptionBudgets

Using the previously described approach, the ECK operator will automatically create dedicated PDBs for each nodeSet, with `maxUnavailable: 1` set based on the nodeSet's role and cluster health. Below are the PDBs that would be generated for the above CRD. Note that the operator groups nodeSets by their roles and applies the appropriate disruption policy.

### 1. PDB for Master NodeSet
- **Role**: Master
- **Policy**: Allow `maxUnavailable: 1` if the cluster is yellow or green.

```yaml
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: elasticsearch-es-master-pdb
  namespace: elastic
  labels:
    elasticsearch.k8s.elastic.co/cluster-name: elasticsearch
  ownerReferences:
  - apiVersion: elasticsearch.k8s.elastic.co/v1
    kind: Elasticsearch
    name: elasticsearch
    blockOwnerDeletion: true
    controller: true
spec:
  maxUnavailable: 1
  selector:
    matchExpressions:
      - { key: elasticsearch.k8s.elastic.co/cluster-name, operator: In, values: [elasticsearch] }
      - { key: elasticsearch.k8s.elastic.co/statefulset-name, operator: In, values: [elasticsearch-es-master] }
```

### 2. PDB for Data NodeSet (data_hot, data_cold)
- **Role**: Data (data_hot, data_cold)
- **Policy**: Allow `maxUnavailable: 1` only if the cluster is green (most conservative due to mixed data roles).

```yaml
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: elasticsearch-es-data-pdb
  namespace: elastic
  labels:
    elasticsearch.k8s.elastic.co/cluster-name: elasticsearch
  ownerReferences:
  - apiVersion: elasticsearch.k8s.elastic.co/v1
    kind: Elasticsearch
    name: elasticsearch
    blockOwnerDeletion: true
    controller: true
spec:
  maxUnavailable: 1
  selector:
    matchExpressions:
        - { key: elasticsearch.k8s.elastic.co/cluster-name, operator: In, values: [elasticsearch] }
        - { key: elasticsearch.k8s.elastic.co/statefulset-name, operator: In, values: [elasticsearch-es-data-hot, elasticsearch-es-data-cold] }
```

### 3. PDB for Coordinating NodeSet
- **Role**: Coordinating (no roles defined)
- **Policy**: Allow `maxUnavailable: 1` if the cluster is yellow or green (stateless, so more flexible).

```yaml
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: elasticsearch-es-coordinating-pdb
  namespace: elastic
  labels:
    elasticsearch.k8s.elastic.co/cluster-name: elasticsearch
  ownerReferences:
  - apiVersion: elasticsearch.k8s.elastic.co/v1
    kind: Elasticsearch
    name: elasticsearch
    blockOwnerDeletion: true
    controller: true
spec:
  maxUnavailable: 1
  selector:
    matchExpressions:
      - { key: elasticsearch.k8s.elastic.co/cluster-name, operator: In, values: [elasticsearch] }
      - { key: elasticsearch.k8s.elastic.co/statefulset-name, operator: In, values: [elasticsearch-es-coordinating] }
```

### 4. PDB for Data Transform NodeSet
- **Role**: Transform
- **Policy**: Allow `maxUnavailable: 1` if the cluster is yellow or green (stateless, so more flexible).

```yaml
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: elasticsearch-es-data-transform-pdb
  namespace: elastic
  labels:
    elasticsearch.k8s.elastic.co/cluster-name: elasticsearch
  ownerReferences:
  - apiVersion: elasticsearch.k8s.elastic.co/v1
    kind: Elasticsearch
    name: elasticsearch
    blockOwnerDeletion: true
    controller: true
spec:
  maxUnavailable: 1
  selector:
    matchExpressions:
      - { key: elasticsearch.k8s.elastic.co/cluster-name, operator: In, values: [elasticsearch] }
      - { key: elasticsearch.k8s.elastic.co/statefulset-name, operator: In, values: [elasticsearch-es-data-transform] }
```

### 5. PDB for Data Frozen NodeSet
- **Role**: Data Frozen
- **Policy**: Allow `maxUnavailable: 1` if the cluster is yellow or green (searchable snapshots reduce data-loss risk).

```yaml
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: elasticsearch-es-data-frozen-pdb
  namespace: elastic
  labels:
    elasticsearch.k8s.elastic.co/cluster-name: elasticsearch
  ownerReferences:
  - apiVersion: elasticsearch.k8s.elastic.co/v1
    kind: Elasticsearch
    name: elasticsearch
    blockOwnerDeletion: true
    controller: true
spec:
  maxUnavailable: 1
  selector:
    matchExpressions:
      - { key: elasticsearch.k8s.elastic.co/cluster-name, operator: In, values: [elasticsearch] }
      - { key: elasticsearch.k8s.elastic.co/statefulset-name, operator: In, values: [elasticsearch-es-data-frozen] }
```

## Feedback

We believe the proposed change meets the main requirement of protecting Elasticsearch during external disruptions while still allowing quick rollouts of planned upgrades, but additional feedback is welcome. 

Pinging those involved in this issue: @akrzos-bw @sanderma @erdody @Tommmster @BenjaminHerbert @ebuildy 

Solution patch:
diff --git a/.buildkite/Makefile b/.buildkite/Makefile
index 4402eff1a..2d49d1bef 100644
--- a/.buildkite/Makefile
+++ b/.buildkite/Makefile
@@ -4,7 +4,7 @@
 
 # This Makefile is used to run the buildkite agent in virtual machines when Docker access is required.
 
-CI_IMAGE               ?= docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+CI_IMAGE               ?= docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
 ROOT_DIR               := $(CURDIR)/..
 GO_MOUNT_PATH          ?= /go/src/github.com/elastic/cloud-on-k8s
 export VAULT_ROOT_PATH = secret/ci/elastic-cloud-on-k8s
diff --git a/.buildkite/e2e/nightly-main-matrix.yaml b/.buildkite/e2e/nightly-main-matrix.yaml
index 16e7904ca..62909b84e 100644
--- a/.buildkite/e2e/nightly-main-matrix.yaml
+++ b/.buildkite/e2e/nightly-main-matrix.yaml
@@ -3,19 +3,19 @@
   fixed:
     E2E_PROVIDER: gke
   mixed:
-    - E2E_STACK_VERSION: "8.18.0"
-    # current stack version 9.0.0 is tested in all other tests no need to test it again
-    - E2E_STACK_VERSION: "8.19.0-SNAPSHOT"
-    - E2E_STACK_VERSION: "9.1.0-SNAPSHOT"
+    - E2E_STACK_VERSION: "8.19.3"
+    # current stack version 9.1.2 is tested in all other tests no need to test it again
+    - E2E_STACK_VERSION: "8.19.4-SNAPSHOT"
+    - E2E_STACK_VERSION: "9.2.0-SNAPSHOT"
 
 - label: ocp
   fixed:
     E2E_PROVIDER: ocp
   mixed:
     ## Test the current stack version.
-    - E2E_STACK_VERSION: "9.0.0"
+    - E2E_STACK_VERSION: "9.1.2"
     ## Also test the next stack version to detect any change in the images that might not be compatible with the CRI-O runtime.
-    - E2E_STACK_VERSION: "9.1.0-SNAPSHOT"
+    - E2E_STACK_VERSION: "9.2.0-SNAPSHOT"
 
 - label: kind
   fixed:
diff --git a/.buildkite/e2e/pipeline-gen/main.go b/.buildkite/e2e/pipeline-gen/main.go
index 79bdb3f02..3b9467deb 100644
--- a/.buildkite/e2e/pipeline-gen/main.go
+++ b/.buildkite/e2e/pipeline-gen/main.go
@@ -44,7 +44,7 @@ const (
 	EnvVarOperatorImage        = "OPERATOR_IMAGE"
 	EnvVarE2EImage             = "E2E_IMG"
 
-	KindAgentsMachineType = "n1-standard-16"
+	K8sInDockerMachineType = "n1-standard-16"
 )
 
 var (
@@ -52,11 +52,11 @@ var (
 	pipelineTemplate string
 
 	// providersInDocker are k8s providers that require the deployer to run in Docker
-	providersInDocker = []string{"kind", "aks", "ocp"}
+	providersInDocker = []string{"kind", "aks", "ocp", "k3d"}
 	// providersNoCleanup are k8s providers that do not require the cluster to be deleted after use
-	providersNoCleanup = []string{"kind"}
+	providersNoCleanup = []string{"kind", "k3d"}
 	// providers are k8s providers for which it is not possible to retrieve the kube config after cluster creation
-	providersNoRemoteConfig = []string{"kind"}
+	providersNoRemoteConfig = []string{"kind", "k3d"}
 
 	semverRE = regexp.MustCompile(`\d*\.\d*\.\d*(-\w*)?`)
 	chars    = []rune("abcdefghijklmnopqrstuvwxyz")
@@ -158,9 +158,9 @@ func main() {
 	handleErr("Failed to parse template", err)
 
 	err = tpl.Execute(os.Stdout, map[string]interface{}{
-		"Cleanup":               cleanup,
-		"Tests":                 tests,
-		"KindAgentsMachineType": KindAgentsMachineType,
+		"Cleanup":                cleanup,
+		"Tests":                  tests,
+		"K8sInDockerMachineType": K8sInDockerMachineType,
 	})
 	handleErr("Failed to generate pipeline", err)
 }
diff --git a/.buildkite/e2e/pipeline-gen/pipeline.tpl.yaml b/.buildkite/e2e/pipeline-gen/pipeline.tpl.yaml
index 0d36b4c87..0c6c25eb4 100644
--- a/.buildkite/e2e/pipeline-gen/pipeline.tpl.yaml
+++ b/.buildkite/e2e/pipeline-gen/pipeline.tpl.yaml
@@ -19,7 +19,6 @@ steps:
 
     commands:
       - .buildkite/scripts/test/set-deployer-config.sh
-
       {{- if $test.Dind }}
       - make -C .buildkite TARGET="run-deployer" ci
       {{- else }}
@@ -29,12 +28,12 @@ steps:
     agents:
       {{- if $test.Dind }}
       provider: "gcp"
-      image: "family/core-ubuntu-2004"
-      {{- if eq $test.Provider "kind" }}
-      machineType: "{{ .KindAgentsMachineType }}"
+      image: "family/core-ubuntu-2204"
+      {{- if or (eq $test.Provider "kind") (eq $test.Provider "k3d") }}
+      machineType: "{{ $.K8sInDockerMachineType }}"
       {{- end }}
       {{- else }}
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: "5G"
       {{- end }}
 
@@ -80,13 +79,13 @@ steps:
     agents:
       {{- if $test.Dind }}
       provider: "gcp"
-      image: "family/core-ubuntu-2004"
-      {{- if eq $test.Provider "kind" }}
-      machineType: "{{ $.KindAgentsMachineType }}"
+      image: "family/core-ubuntu-2204"
+      {{- if or (eq $test.Provider "kind") (eq $test.Provider "k3d") }}
+      machineType: "{{ $.K8sInDockerMachineType }}"
       diskSizeGb: 150
       {{- end }}
       {{- else }}
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: "4G"
       {{- end }}
 
@@ -122,13 +121,13 @@ steps:
         {{- if not $test.Dind }}
           - make run-deployer
         agents:
-          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
           memory: "4G"
         {{- else }}
           - make -C .buildkite TARGET="run-deployer" ci
         agents:
           provider: "gcp"
-          image: "family/core-ubuntu-2004"
+          image: "family/core-ubuntu-2204"
         {{- end }}
 
     {{- end }}
@@ -145,5 +144,5 @@ steps:
       - ".buildkite/e2e/reporter/*.md"
       - ".buildkite/e2e/reporter/*.yml"
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: "2G"
diff --git a/.buildkite/e2e/release-branch-matrix.yaml b/.buildkite/e2e/release-branch-matrix.yaml
index ddac752c5..7c3982f84 100644
--- a/.buildkite/e2e/release-branch-matrix.yaml
+++ b/.buildkite/e2e/release-branch-matrix.yaml
@@ -1,4 +1,3 @@
-
 - label: stack
   fixed:
     E2E_PROVIDER: gke
@@ -21,11 +20,13 @@
     - E2E_STACK_VERSION: "8.14.3"
     - E2E_STACK_VERSION: "8.15.4"
     - E2E_STACK_VERSION: "8.16.6"
-    - E2E_STACK_VERSION: "8.17.5"
-    - E2E_STACK_VERSION: "8.18.0"
-    # current stack version 9.0.0 is tested in all other tests no need to test it again
+    - E2E_STACK_VERSION: "8.17.9"
+    - E2E_STACK_VERSION: "8.18.4"
+    - E2E_STACK_VERSION: "8.19.0"
+    - E2E_STACK_VERSION: "9.0.5"
+    # current stack version 9.1.2 is tested in all other tests no need to test it again
     - E2E_STACK_VERSION: "8.19.0-SNAPSHOT"
-    - E2E_STACK_VERSION: "9.1.0-SNAPSHOT"
+    - E2E_STACK_VERSION: "9.2.0-SNAPSHOT"
 
 - label: kind
   fixed:
@@ -41,6 +42,10 @@
     - DEPLOYER_KIND_NODE_IMAGE: kindest/node:v1.33.1@sha256:050072256b9a903bd914c0b2866828150cb229cea0efe5892e2b644d5dd3b34f
       DEPLOYER_KIND_IP_FAMILY: ipv6
 
+- label: k3d
+  fixed:
+    E2E_PROVIDER: k3d
+
 - label: gke
   fixed:
     E2E_PROVIDER: gke
diff --git a/.buildkite/e2e/reporter/templates/notify-failures.tpl.yml b/.buildkite/e2e/reporter/templates/notify-failures.tpl.yml
index 7d1c3e42c..a66a674ee 100644
--- a/.buildkite/e2e/reporter/templates/notify-failures.tpl.yml
+++ b/.buildkite/e2e/reporter/templates/notify-failures.tpl.yml
@@ -4,7 +4,7 @@ steps:
   - label: "{{ .ShortFailuresCount }} failure(s)"
     command: exit {{ .ShortFailuresCount }}
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: "2G"
 
   # notify e2e tests failures for the main branch and tags
@@ -13,7 +13,7 @@ steps:
     if: build.branch == "main" || build.tag != null
     command: echo "notify"
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: "2G"
 
     notify:
diff --git a/.buildkite/pipeline-e2e-clusters-cleanup.yml b/.buildkite/pipeline-e2e-clusters-cleanup.yml
index a77d88043..7cb9e53a9 100644
--- a/.buildkite/pipeline-e2e-clusters-cleanup.yml
+++ b/.buildkite/pipeline-e2e-clusters-cleanup.yml
@@ -10,7 +10,7 @@ steps:
       - make build-deployer
       - buildkite-agent artifact upload hack/deployer/deployer
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: 2G
 
   - label: ":broom: e2e test cluster cleanup gke"
@@ -26,7 +26,7 @@ steps:
       - chmod u+x /usr/local/hack/deployer/deployer
       - /usr/local/hack/deployer/deployer cleanup --plans-file hack/deployer/config/plans.yml --cluster-prefix $${E2E_TEST_CLUSTER_PREFIX} --config-file deployer-config.yml
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: 2G
 
   - label: ":broom: e2e test cluster cleanup aks"
@@ -55,7 +55,7 @@ steps:
       - chmod u+x /usr/local/hack/deployer/deployer
       - /usr/local/hack/deployer/deployer cleanup --plans-file hack/deployer/config/plans.yml --cluster-prefix $${E2E_TEST_CLUSTER_PREFIX} --config-file deployer-config.yml
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: 2G
 
   - label: ":broom: e2e test cluster cleanup eks-arm"
@@ -71,7 +71,7 @@ steps:
       - chmod u+x /usr/local/hack/deployer/deployer
       - /usr/local/hack/deployer/deployer cleanup --plans-file hack/deployer/config/plans.yml --cluster-prefix $${E2E_TEST_CLUSTER_PREFIX} --config-file deployer-config.yml
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: 2G
 
   - label: ":broom: e2e test cluster cleanup ocp"
diff --git a/.buildkite/pipeline-e2e-tests.yml b/.buildkite/pipeline-e2e-tests.yml
index ae92c4c6d..447e41e37 100644
--- a/.buildkite/pipeline-e2e-tests.yml
+++ b/.buildkite/pipeline-e2e-tests.yml
@@ -17,7 +17,7 @@ steps:
               E2E_PROVIDER: gke
           DEF
         agents:
-          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
           memory: "2G"
 
       # for nightly builds from main
@@ -30,7 +30,7 @@ steps:
           cd .buildkite/e2e/pipeline-gen && go build -o pipeline-gen
           cat ../nightly-main-matrix.yaml | ./pipeline-gen | buildkite-agent pipeline upload
         agents:
-          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
           memory: "2G"
 
       # for all tags
@@ -41,5 +41,5 @@ steps:
           cd .buildkite/e2e/pipeline-gen && go build -o pipeline-gen
           cat ../release-branch-matrix.yaml | ./pipeline-gen | buildkite-agent pipeline upload
         agents:
-          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
           memory: "2G"
diff --git a/.buildkite/pipeline-release-helm.yml b/.buildkite/pipeline-release-helm.yml
index 21edfab87..f88d8cd23 100644
--- a/.buildkite/pipeline-release-helm.yml
+++ b/.buildkite/pipeline-release-helm.yml
@@ -11,7 +11,7 @@ steps:
       - make build
       - buildkite-agent artifact upload bin/releaser
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: "2G"
 
   - label: "operator dev helm chart"
@@ -30,7 +30,7 @@ steps:
       - chmod u+x /usr/local/bin/releaser
       - releaser --env=dev --charts-dir=deploy/eck-operator
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: "2G"
 
   - wait
@@ -51,7 +51,7 @@ steps:
       - chmod u+x /usr/local/bin/releaser
       - releaser --env=dev --charts-dir=deploy/eck-stack
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: "2G"
 
   - wait
@@ -69,7 +69,7 @@ steps:
       - chmod u+x /usr/local/bin/releaser
       - releaser --env=prod --charts-dir=deploy/eck-operator
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: "2G"
 
   - wait
@@ -87,5 +87,5 @@ steps:
       - chmod u+x /usr/local/bin/releaser
       - releaser --env=prod --charts-dir=deploy/eck-stack
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: "2G"
diff --git a/.buildkite/pipeline-release-redhat.yml b/.buildkite/pipeline-release-redhat.yml
index c949aa647..f6a53719e 100644
--- a/.buildkite/pipeline-release-redhat.yml
+++ b/.buildkite/pipeline-release-redhat.yml
@@ -7,7 +7,7 @@ steps:
       - make build
       - buildkite-agent artifact upload bin/operatorhub
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: "2G"
 
   - label: ":docker: push container"
@@ -20,7 +20,7 @@ steps:
         cd hack/operatorhub
         operatorhub container push
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: "2G"
 
   - label: ":docker: preflight container check"
@@ -32,7 +32,7 @@ steps:
     commands:
       - .buildkite/scripts/release/redhat-preflight.sh
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: "2G"
 
   - label: ":docker: publish container"
@@ -47,7 +47,7 @@ steps:
         cd hack/operatorhub
         operatorhub container publish
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: "2G"
 
   - label: ":redhat: generate and create-pr"
@@ -62,5 +62,5 @@ steps:
         operatorhub generate-manifests
         operatorhub bundle create-pr
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: "2G"
diff --git a/.buildkite/pipeline-release.yml b/.buildkite/pipeline-release.yml
index 864dedd2e..b68582f52 100644
--- a/.buildkite/pipeline-release.yml
+++ b/.buildkite/pipeline-release.yml
@@ -10,7 +10,7 @@ steps:
         commands:
           - .buildkite/scripts/release/k8s-manifests.sh
         agents:
-          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
           memory: "2G"
 
       - label: "copy images to dockerhub"
diff --git a/.buildkite/pipeline.yml b/.buildkite/pipeline.yml
index 2663bbcdc..303df1f4f 100644
--- a/.buildkite/pipeline.yml
+++ b/.buildkite/pipeline.yml
@@ -9,14 +9,14 @@ steps:
       - label: ":go: lint"
         command: "make lint check-local-changes"
         agents:
-          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
           cpu: "6"
           memory: "7G"
 
       - label: ":go: generate"
         command: "make generate check-local-changes"
         agents:
-          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
           cpu: "4"
           memory: "4G"
 
@@ -25,7 +25,7 @@ steps:
           - "make check-license-header check-predicates shellcheck reattach-pv"
           - "make -C hack/helm/release build"
         agents:
-          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
           cpu: "4"
           memory: "4G"
 
@@ -35,28 +35,28 @@ steps:
       - label: ":go: unit-tests"
         command: "make unit-xml"
         agents:
-          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
           cpu: "4"
           memory: "4G"
 
       - label: ":go: integration-tests"
         command: "make integration-xml"
         agents:
-          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
           cpu: "4"
           memory: "4G"
 
       - label: ":go: manifest-gen-tests"
         command: "make manifest-gen-test"
         agents:
-          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
           cpu: "4"
           memory: "2G"
 
       - label: ":go: helm-tests"
         command: "make helm-test"
         agents:
-          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+          image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
           cpu: "4"
           memory: "2G"
 
@@ -112,7 +112,7 @@ steps:
           E2E_SKIP_CLEANUP: true
       DEF
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: "2G"
 
   # for PR comment
@@ -125,14 +125,14 @@ steps:
       $$(echo ./pipeline-gen $$GITHUB_PR_COMMENT_VAR_ARGS) \
         | buildkite-agent pipeline upload
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: "2G"
 
   # for the main branch (merge and nightly) and tags
   - label: ":buildkite:"
     command: buildkite-agent pipeline upload .buildkite/pipeline-e2e-tests.yml
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: "2G"
 
   # ----------
@@ -165,7 +165,7 @@ steps:
         done
       ) | buildkite-agent pipeline upload
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: "256Mi"
 
   - label: ":buildkite:"
@@ -173,5 +173,5 @@ steps:
       - "operator-image-build"
     command: buildkite-agent pipeline upload .buildkite/pipeline-release.yml
     agents:
-      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:c39fad65
+      image: docker.elastic.co/ci-agent-images/cloud-k8s-operator/buildkite-agent:a9130ecd
       memory: "2G"
diff --git a/Makefile b/Makefile
index 30c6c0f2a..2e4978ea7 100644
--- a/Makefile
+++ b/Makefile
@@ -350,6 +350,9 @@ switch-eks:
 switch-kind:
 	@ echo "kind" > hack/deployer/config/provider
 
+switch-k3d:
+	@ echo "k3d" > hack/deployer/config/provider
+
 #################################
 ##  --    Docker images    --  ##
 #################################
@@ -418,7 +421,7 @@ drivah-build-e2e:
 
 # -- run
 
-E2E_STACK_VERSION          ?= 9.0.0
+E2E_STACK_VERSION          ?= 9.1.2
 # regexp to filter tests to run
 export TESTS_MATCH         ?= "^Test"
 export E2E_JSON            ?= false
diff --git a/NOTICE.txt b/NOTICE.txt
index 395082256..d9b8df59a 100644
--- a/NOTICE.txt
+++ b/NOTICE.txt
@@ -46,6 +46,37 @@ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 
+--------------------------------------------------------------------------------
+Module  : github.com/KimMachineGun/automemlimit
+Version : v0.7.4
+Time    : 2025-07-10T02:38:34Z
+Licence : MIT
+
+Contents of probable licence file $GOMODCACHE/github.com/!kim!machine!gun/automemlimit@v0.7.4/LICENSE:
+
+MIT License
+
+Copyright (c) 2022 Geon Kim
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
 --------------------------------------------------------------------------------
 Module  : github.com/Masterminds/sprig/v3
 Version : v3.3.0
@@ -405,11 +436,11 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 --------------------------------------------------------------------------------
 Module  : github.com/gkampitakis/go-snaps
-Version : v0.5.13
-Time    : 2025-06-04T20:11:01Z
+Version : v0.5.14
+Time    : 2025-07-28T20:15:32Z
 Licence : MIT
 
-Contents of probable licence file $GOMODCACHE/github.com/gkampitakis/go-snaps@v0.5.13/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/gkampitakis/go-snaps@v0.5.14/LICENSE:
 
 MIT License
 
@@ -1731,11 +1762,11 @@ Exhibit B - "Incompatible With Secondary Licenses" Notice
 
 --------------------------------------------------------------------------------
 Module  : github.com/hashicorp/vault/api
-Version : v1.20.0
-Time    : 2025-06-04T18:42:15Z
+Version : v1.21.0
+Time    : 2025-09-01T15:28:10Z
 Licence : MPL-2.0
 
-Contents of probable licence file $GOMODCACHE/github.com/hashicorp/vault/api@v1.20.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/hashicorp/vault/api@v1.21.0/LICENSE:
 
 Copyright (c) 2015 HashiCorp, Inc.
 
@@ -2210,11 +2241,11 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 --------------------------------------------------------------------------------
 Module  : github.com/prometheus/client_golang
-Version : v1.22.0
-Time    : 2025-04-08T08:06:13Z
+Version : v1.23.2
+Time    : 2025-09-05T14:03:59Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/github.com/prometheus/client_golang@v1.22.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/prometheus/client_golang@v1.23.2/LICENSE:
 
                                  Apache License
                            Version 2.0, January 2004
@@ -2421,11 +2452,11 @@ Contents of probable licence file $GOMODCACHE/github.com/prometheus/client_golan
 
 --------------------------------------------------------------------------------
 Module  : github.com/prometheus/common
-Version : v0.65.0
-Time    : 2025-06-22T22:58:37Z
+Version : v0.66.1
+Time    : 2025-09-05T07:53:47Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/github.com/prometheus/common@v0.65.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/prometheus/common@v0.66.1/LICENSE:
 
                                  Apache License
                            Version 2.0, January 2004
@@ -2662,11 +2693,11 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 --------------------------------------------------------------------------------
 Module  : github.com/spf13/cobra
-Version : v1.9.1
-Time    : 2025-02-16T23:42:04Z
+Version : v1.10.1
+Time    : 2025-09-01T16:19:51Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/github.com/spf13/cobra@v1.9.1/LICENSE.txt:
+Contents of probable licence file $GOMODCACHE/github.com/spf13/cobra@v1.10.1/LICENSE.txt:
 
                                 Apache License
                            Version 2.0, January 2004
@@ -2846,11 +2877,11 @@ Contents of probable licence file $GOMODCACHE/github.com/spf13/cobra@v1.9.1/LICE
 
 --------------------------------------------------------------------------------
 Module  : github.com/spf13/pflag
-Version : v1.0.7
-Time    : 2025-07-16T21:42:25Z
+Version : v1.0.10
+Time    : 2025-09-02T06:08:29Z
 Licence : BSD-3-Clause
 
-Contents of probable licence file $GOMODCACHE/github.com/spf13/pflag@v1.0.7/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/spf13/pflag@v1.0.10/LICENSE:
 
 Copyright (c) 2012 Alex Ogier. All rights reserved.
 Copyright (c) 2012 The Go Authors. All rights reserved.
@@ -2884,11 +2915,11 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 --------------------------------------------------------------------------------
 Module  : github.com/spf13/viper
-Version : v1.20.1
-Time    : 2025-03-26T17:30:02Z
+Version : v1.21.0
+Time    : 2025-09-08T16:56:14Z
 Licence : MIT
 
-Contents of probable licence file $GOMODCACHE/github.com/spf13/viper@v1.20.1/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/spf13/viper@v1.21.0/LICENSE:
 
 The MIT License (MIT)
 
@@ -2914,11 +2945,11 @@ SOFTWARE.
 
 --------------------------------------------------------------------------------
 Module  : github.com/stretchr/testify
-Version : v1.10.0
-Time    : 2024-11-12T22:58:45Z
+Version : v1.11.1
+Time    : 2025-08-27T10:46:31Z
 Licence : MIT
 
-Contents of probable licence file $GOMODCACHE/github.com/stretchr/testify@v1.10.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/stretchr/testify@v1.11.1/LICENSE:
 
 MIT License
 
@@ -3846,11 +3877,11 @@ THE SOFTWARE.
 
 --------------------------------------------------------------------------------
 Module  : golang.org/x/crypto
-Version : v0.40.0
-Time    : 2025-07-10T17:21:43Z
+Version : v0.42.0
+Time    : 2025-09-08T15:14:28Z
 Licence : BSD-3-Clause
 
-Contents of probable licence file $GOMODCACHE/golang.org/x/crypto@v0.40.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/golang.org/x/crypto@v0.42.0/LICENSE:
 
 Copyright 2009 The Go Authors.
 
@@ -3980,11 +4011,11 @@ limitations under the License.
 
 --------------------------------------------------------------------------------
 Module  : k8s.io/api
-Version : v0.33.3
-Time    : 2025-07-16T01:18:25Z
+Version : v0.34.1
+Time    : 2025-09-10T04:39:36Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/k8s.io/api@v0.33.3/LICENSE:
+Contents of probable licence file $GOMODCACHE/k8s.io/api@v0.34.1/LICENSE:
 
 
                                  Apache License
@@ -4192,11 +4223,11 @@ Contents of probable licence file $GOMODCACHE/k8s.io/api@v0.33.3/LICENSE:
 
 --------------------------------------------------------------------------------
 Module  : k8s.io/apimachinery
-Version : v0.33.3
-Time    : 2025-05-13T12:05:15Z
+Version : v0.34.1
+Time    : 2025-08-16T07:57:26Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/k8s.io/apimachinery@v0.33.3/LICENSE:
+Contents of probable licence file $GOMODCACHE/k8s.io/apimachinery@v0.34.1/LICENSE:
 
 
                                  Apache License
@@ -4404,11 +4435,11 @@ Contents of probable licence file $GOMODCACHE/k8s.io/apimachinery@v0.33.3/LICENS
 
 --------------------------------------------------------------------------------
 Module  : k8s.io/client-go
-Version : v0.33.3
-Time    : 2025-07-16T01:32:24Z
+Version : v0.34.1
+Time    : 2025-09-10T04:55:33Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/k8s.io/client-go@v0.33.3/LICENSE:
+Contents of probable licence file $GOMODCACHE/k8s.io/client-go@v0.34.1/LICENSE:
 
 
                                  Apache License
@@ -4817,11 +4848,11 @@ third-party archives.
 
 --------------------------------------------------------------------------------
 Module  : k8s.io/utils
-Version : v0.0.0-20241104100929-3ea5e8cea738
-Time    : 2024-11-04T10:09:29Z
+Version : v0.0.0-20250604170112-4c0f3b243397
+Time    : 2025-06-04T17:01:12Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/k8s.io/utils@v0.0.0-20241104100929-3ea5e8cea738/LICENSE:
+Contents of probable licence file $GOMODCACHE/k8s.io/utils@v0.0.0-20250604170112-4c0f3b243397/LICENSE:
 
 
                                  Apache License
@@ -5029,11 +5060,11 @@ Contents of probable licence file $GOMODCACHE/k8s.io/utils@v0.0.0-20241104100929
 
 --------------------------------------------------------------------------------
 Module  : sigs.k8s.io/controller-runtime
-Version : v0.21.0
-Time    : 2025-05-20T07:15:15Z
+Version : v0.22.1
+Time    : 2025-09-05T13:19:27Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/sigs.k8s.io/controller-runtime@v0.21.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/sigs.k8s.io/controller-runtime@v0.22.1/LICENSE:
 
                                  Apache License
                            Version 2.0, January 2004
@@ -5240,11 +5271,11 @@ Contents of probable licence file $GOMODCACHE/sigs.k8s.io/controller-runtime@v0.
 
 --------------------------------------------------------------------------------
 Module  : sigs.k8s.io/controller-tools
-Version : v0.18.0
-Time    : 2025-05-08T11:25:15Z
+Version : v0.19.0
+Time    : 2025-08-28T05:51:10Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/sigs.k8s.io/controller-tools@v0.18.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/sigs.k8s.io/controller-tools@v0.19.0/LICENSE:
 
                                  Apache License
                            Version 2.0, January 2004
@@ -5457,11 +5488,11 @@ Indirect dependencies
 
 --------------------------------------------------------------------------------
 Module  : cel.dev/expr
-Version : v0.19.1
-Time    : 2024-12-06T18:41:39Z
+Version : v0.24.0
+Time    : 2025-05-07T15:31:15Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/cel.dev/expr@v0.19.1/LICENSE:
+Contents of probable licence file $GOMODCACHE/cel.dev/expr@v0.24.0/LICENSE:
 
 
                                  Apache License
@@ -7179,11 +7210,11 @@ Contents of probable licence file $GOMODCACHE/github.com/elastic/go-windows@v1.0
 
 --------------------------------------------------------------------------------
 Module  : github.com/emicklei/go-restful/v3
-Version : v3.12.1
-Time    : 2024-05-28T19:04:28Z
+Version : v3.12.2
+Time    : 2025-02-26T09:20:34Z
 Licence : MIT
 
-Contents of probable licence file $GOMODCACHE/github.com/emicklei/go-restful/v3@v3.12.1/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/emicklei/go-restful/v3@v3.12.2/LICENSE:
 
 Copyright (c) 2012,2013 Ernest Micklei
 
@@ -7370,11 +7401,11 @@ SOFTWARE.
 
 --------------------------------------------------------------------------------
 Module  : github.com/fsnotify/fsnotify
-Version : v1.8.0
-Time    : 2024-10-31T10:15:51Z
+Version : v1.9.0
+Time    : 2025-04-04T15:13:49Z
 Licence : BSD-3-Clause
 
-Contents of probable licence file $GOMODCACHE/github.com/fsnotify/fsnotify@v1.8.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/fsnotify/fsnotify@v1.9.0/LICENSE:
 
 Copyright © 2012 The Go Authors. All rights reserved.
 Copyright © fsnotify Authors. All rights reserved.
@@ -7405,11 +7436,11 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 --------------------------------------------------------------------------------
 Module  : github.com/fxamacker/cbor/v2
-Version : v2.7.0
-Time    : 2024-06-24T04:49:42Z
+Version : v2.9.0
+Time    : 2025-07-14T04:00:34Z
 Licence : MIT
 
-Contents of probable licence file $GOMODCACHE/github.com/fxamacker/cbor/v2@v2.7.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/fxamacker/cbor/v2@v2.9.0/LICENSE:
 
 MIT License
 
@@ -7496,11 +7527,11 @@ DEALINGS IN THE SOFTWARE.
 
 --------------------------------------------------------------------------------
 Module  : github.com/go-jose/go-jose/v4
-Version : v4.0.5
-Time    : 2025-02-24T20:06:34Z
+Version : v4.1.1
+Time    : 2025-06-23T23:41:10Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/github.com/go-jose/go-jose/v4@v4.0.5/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/go-jose/go-jose/v4@v4.1.1/LICENSE:
 
 
                                  Apache License
@@ -8795,11 +8826,11 @@ THE SOFTWARE.
 
 --------------------------------------------------------------------------------
 Module  : github.com/go-viper/mapstructure/v2
-Version : v2.3.0
-Time    : 2025-06-16T14:11:24Z
+Version : v2.4.0
+Time    : 2025-07-15T08:59:08Z
 Licence : MIT
 
-Contents of probable licence file $GOMODCACHE/github.com/go-viper/mapstructure/v2@v2.3.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/go-viper/mapstructure/v2@v2.4.0/LICENSE:
 
 The MIT License (MIT)
 
@@ -9152,11 +9183,11 @@ Contents of probable licence file $GOMODCACHE/github.com/google/btree@v1.1.3/LIC
 
 --------------------------------------------------------------------------------
 Module  : github.com/google/cel-go
-Version : v0.23.2
-Time    : 2025-01-31T21:08:08Z
+Version : v0.26.0
+Time    : 2025-07-14T20:45:46Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/github.com/google/cel-go@v0.23.2/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/google/cel-go@v0.26.0/LICENSE:
 
 
                                  Apache License
@@ -9395,11 +9426,11 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 --------------------------------------------------------------------------------
 Module  : github.com/google/gnostic-models
-Version : v0.6.9
-Time    : 2024-11-26T22:18:15Z
+Version : v0.7.0
+Time    : 2025-06-26T15:23:00Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/github.com/google/gnostic-models@v0.6.9/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/google/gnostic-models@v0.7.0/LICENSE:
 
 
                                  Apache License
@@ -10064,11 +10095,11 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 --------------------------------------------------------------------------------
 Module  : github.com/grpc-ecosystem/grpc-gateway/v2
-Version : v2.24.0
-Time    : 2024-11-22T18:27:14Z
+Version : v2.26.3
+Time    : 2025-03-04T17:40:45Z
 Licence : BSD-3-Clause
 
-Contents of probable licence file $GOMODCACHE/github.com/grpc-ecosystem/grpc-gateway/v2@v2.24.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/grpc-ecosystem/grpc-gateway/v2@v2.26.3/LICENSE:
 
 Copyright (c) 2015, Gengo, Inc.
 All rights reserved.
@@ -10867,11 +10898,11 @@ SOFTWARE.
 
 --------------------------------------------------------------------------------
 Module  : github.com/hashicorp/go-retryablehttp
-Version : v0.7.7
-Time    : 2024-05-30T00:13:00Z
+Version : v0.7.8
+Time    : 2025-06-18T14:25:10Z
 Licence : MPL-2.0
 
-Contents of probable licence file $GOMODCACHE/github.com/hashicorp/go-retryablehttp@v0.7.7/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/hashicorp/go-retryablehttp@v0.7.8/LICENSE:
 
 Copyright (c) 2015 HashiCorp, Inc.
 
@@ -11615,11 +11646,13 @@ Exhibit B - "Incompatible With Secondary Licenses" Notice
 
 --------------------------------------------------------------------------------
 Module  : github.com/hashicorp/go-secure-stdlib/parseutil
-Version : v0.1.6
-Time    : 2022-06-02T20:00:35Z
+Version : v0.2.0
+Time    : 2025-03-06T22:34:24Z
 Licence : MPL-2.0
 
-Contents of probable licence file $GOMODCACHE/github.com/hashicorp/go-secure-stdlib/parseutil@v0.1.6/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/hashicorp/go-secure-stdlib/parseutil@v0.2.0/LICENSE:
+
+Copyright (c) 2020 HashiCorp, Inc.
 
 Mozilla Public License, version 2.0
 
@@ -12361,11 +12394,13 @@ Exhibit B - "Incompatible With Secondary Licenses" Notice
 
 --------------------------------------------------------------------------------
 Module  : github.com/hashicorp/go-sockaddr
-Version : v1.0.2
-Time    : 2019-03-08T13:53:01Z
+Version : v1.0.7
+Time    : 2024-09-19T09:47:04Z
 Licence : MPL-2.0
 
-Contents of probable licence file $GOMODCACHE/github.com/hashicorp/go-sockaddr@v1.0.2/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/hashicorp/go-sockaddr@v1.0.7/LICENSE:
+
+Copyright (c) 2016 HashiCorp, Inc.
 
 Mozilla Public License Version 2.0
 ==================================
@@ -14225,11 +14260,11 @@ Contents of probable licence file $GOMODCACHE/github.com/maruel/natural@v1.1.1/L
 
 --------------------------------------------------------------------------------
 Module  : github.com/mattn/go-colorable
-Version : v0.1.13
-Time    : 2022-08-15T05:53:26Z
+Version : v0.1.14
+Time    : 2025-01-10T08:29:27Z
 Licence : MIT
 
-Contents of probable licence file $GOMODCACHE/github.com/mattn/go-colorable@v0.1.13/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/mattn/go-colorable@v0.1.14/LICENSE:
 
 The MIT License (MIT)
 
@@ -14822,11 +14857,11 @@ Contents of probable licence file $GOMODCACHE/github.com/modern-go/concurrent@v0
 
 --------------------------------------------------------------------------------
 Module  : github.com/modern-go/reflect2
-Version : v1.0.2
-Time    : 2021-09-11T02:10:30Z
+Version : v1.0.3-0.20250322232337-35a7c28c31ee
+Time    : 2025-03-22T23:23:37Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/github.com/modern-go/reflect2@v1.0.2/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/modern-go/reflect2@v1.0.3-0.20250322232337-35a7c28c31ee/LICENSE:
 
                                  Apache License
                            Version 2.0, January 2004
@@ -15204,11 +15239,11 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 --------------------------------------------------------------------------------
 Module  : github.com/onsi/gomega
-Version : v1.37.0
-Time    : 2025-04-02T15:20:58Z
+Version : v1.38.1
+Time    : 2025-08-22T13:45:44Z
 Licence : MIT
 
-Contents of probable licence file $GOMODCACHE/github.com/onsi/gomega@v1.37.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/onsi/gomega@v1.38.1/LICENSE:
 
 Copyright (c) 2013-2014 Onsi Fakhouri
 
@@ -15635,13 +15670,52 @@ Contents of probable licence file $GOMODCACHE/github.com/opencontainers/image-sp
    limitations under the License.
 
 
+--------------------------------------------------------------------------------
+Module  : github.com/pbnjay/memory
+Version : v0.0.0-20210728143218-7b4eea64cf58
+Time    : 2021-07-28T14:32:18Z
+Licence : BSD-3-Clause
+
+Contents of probable licence file $GOMODCACHE/github.com/pbnjay/memory@v0.0.0-20210728143218-7b4eea64cf58/LICENSE:
+
+BSD 3-Clause License
+
+Copyright (c) 2017, Jeremy Jay
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+
+* Neither the name of the copyright holder nor the names of its
+  contributors may be used to endorse or promote products derived from
+  this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
 --------------------------------------------------------------------------------
 Module  : github.com/pelletier/go-toml/v2
-Version : v2.2.3
-Time    : 2024-08-17T20:26:05Z
+Version : v2.2.4
+Time    : 2025-04-07T11:11:38Z
 Licence : MIT
 
-Contents of probable licence file $GOMODCACHE/github.com/pelletier/go-toml/v2@v2.2.3/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/pelletier/go-toml/v2@v2.2.4/LICENSE:
 
 The MIT License (MIT)
 
@@ -15911,11 +15985,11 @@ Contents of probable licence file $GOMODCACHE/github.com/prometheus/client_model
 
 --------------------------------------------------------------------------------
 Module  : github.com/prometheus/procfs
-Version : v0.16.0
-Time    : 2025-03-02T19:44:35Z
+Version : v0.16.1
+Time    : 2025-04-19T15:43:08Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/github.com/prometheus/procfs@v0.16.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/prometheus/procfs@v0.16.1/LICENSE:
 
                                  Apache License
                            Version 2.0, January 2004
@@ -16190,11 +16264,11 @@ SOFTWARE.
 
 --------------------------------------------------------------------------------
 Module  : github.com/sagikazarmark/locafero
-Version : v0.7.0
-Time    : 2025-01-09T11:09:44Z
+Version : v0.11.0
+Time    : 2025-09-08T16:42:20Z
 Licence : MIT
 
-Contents of probable licence file $GOMODCACHE/github.com/sagikazarmark/locafero@v0.7.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/sagikazarmark/locafero@v0.11.0/LICENSE:
 
 Copyright (c) 2023 Márk Sági-Kazár <mark.sagikazar@gmail.com>
 
@@ -16305,11 +16379,11 @@ THE SOFTWARE.
 
 --------------------------------------------------------------------------------
 Module  : github.com/sourcegraph/conc
-Version : v0.3.0
-Time    : 2023-02-25T04:04:07Z
+Version : v0.3.1-0.20240121214520-5f936abd7ae8
+Time    : 2024-01-21T21:45:20Z
 Licence : MIT
 
-Contents of probable licence file $GOMODCACHE/github.com/sourcegraph/conc@v0.3.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8/LICENSE:
 
 MIT License
 
@@ -16336,11 +16410,11 @@ SOFTWARE.
 
 --------------------------------------------------------------------------------
 Module  : github.com/spf13/afero
-Version : v1.12.0
-Time    : 2025-01-09T11:01:20Z
+Version : v1.15.0
+Time    : 2025-09-08T16:25:29Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/github.com/spf13/afero@v1.12.0/LICENSE.txt:
+Contents of probable licence file $GOMODCACHE/github.com/spf13/afero@v1.15.0/LICENSE.txt:
 
                                 Apache License
                            Version 2.0, January 2004
@@ -16520,11 +16594,11 @@ Contents of probable licence file $GOMODCACHE/github.com/spf13/afero@v1.12.0/LIC
 
 --------------------------------------------------------------------------------
 Module  : github.com/spf13/cast
-Version : v1.7.1
-Time    : 2024-10-18T17:53:17Z
+Version : v1.10.0
+Time    : 2025-09-08T16:45:31Z
 Licence : MIT
 
-Contents of probable licence file $GOMODCACHE/github.com/spf13/cast@v1.7.1/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/spf13/cast@v1.10.0/LICENSE:
 
 The MIT License (MIT)
 
@@ -17501,11 +17575,11 @@ Contents of probable licence file $GOMODCACHE/go.opentelemetry.io/otel@v1.36.0/L
 
 --------------------------------------------------------------------------------
 Module  : go.opentelemetry.io/otel/exporters/otlp/otlptrace
-Version : v1.33.0
-Time    : 2024-12-12T17:54:13Z
+Version : v1.34.0
+Time    : 2025-01-17T16:21:54Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.33.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.34.0/LICENSE:
 
                                  Apache License
                            Version 2.0, January 2004
@@ -17712,11 +17786,11 @@ Contents of probable licence file $GOMODCACHE/go.opentelemetry.io/otel/exporters
 
 --------------------------------------------------------------------------------
 Module  : go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
-Version : v1.33.0
-Time    : 2024-12-12T17:54:13Z
+Version : v1.34.0
+Time    : 2025-01-17T16:21:54Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.33.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.34.0/LICENSE:
 
                                  Apache License
                            Version 2.0, January 2004
@@ -18767,11 +18841,11 @@ Contents of probable licence file $GOMODCACHE/go.opentelemetry.io/otel/trace@v1.
 
 --------------------------------------------------------------------------------
 Module  : go.opentelemetry.io/proto/otlp
-Version : v1.4.0
-Time    : 2024-12-02T09:09:20Z
+Version : v1.5.0
+Time    : 2025-01-06T12:02:47Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/go.opentelemetry.io/proto/otlp@v1.4.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/go.opentelemetry.io/proto/otlp@v1.5.0/LICENSE:
 
                                  Apache License
                            Version 2.0, January 2004
@@ -19036,13 +19110,284 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 
 
+--------------------------------------------------------------------------------
+Module  : go.yaml.in/yaml/v2
+Version : v2.4.2
+Time    : 2025-06-02T16:37:17Z
+Licence : Apache-2.0
+
+Contents of probable licence file $GOMODCACHE/go.yaml.in/yaml/v2@v2.4.2/LICENSE:
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+
+--------------------------------------------------------------------------------
+Module  : go.yaml.in/yaml/v3
+Version : v3.0.4
+Time    : 2025-06-29T14:09:51Z
+Licence : MIT
+
+Contents of probable licence file $GOMODCACHE/go.yaml.in/yaml/v3@v3.0.4/LICENSE:
+
+
+This project is covered by two different licenses: MIT and Apache.
+
+#### MIT License ####
+
+The following files were ported to Go from C files of libyaml, and thus
+are still covered by their original MIT license, with the additional
+copyright staring in 2011 when the project was ported over:
+
+    apic.go emitterc.go parserc.go readerc.go scannerc.go
+    writerc.go yamlh.go yamlprivateh.go
+
+Copyright (c) 2006-2010 Kirill Simonov
+Copyright (c) 2006-2011 Kirill Simonov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+### Apache License ###
+
+All the remaining project files are covered by the Apache license:
+
+Copyright (c) 2011-2019 Canonical Ltd
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+
 --------------------------------------------------------------------------------
 Module  : golang.org/x/mod
-Version : v0.25.0
-Time    : 2025-05-08T14:04:30Z
+Version : v0.27.0
+Time    : 2025-08-07T14:51:59Z
 Licence : BSD-3-Clause
 
-Contents of probable licence file $GOMODCACHE/golang.org/x/mod@v0.25.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/golang.org/x/mod@v0.27.0/LICENSE:
 
 Copyright 2009 The Go Authors.
 
@@ -19075,11 +19420,11 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 --------------------------------------------------------------------------------
 Module  : golang.org/x/net
-Version : v0.41.0
-Time    : 2025-06-05T20:28:24Z
+Version : v0.43.0
+Time    : 2025-08-07T19:56:06Z
 Licence : BSD-3-Clause
 
-Contents of probable licence file $GOMODCACHE/golang.org/x/net@v0.41.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/golang.org/x/net@v0.43.0/LICENSE:
 
 Copyright 2009 The Go Authors.
 
@@ -19149,11 +19494,11 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 --------------------------------------------------------------------------------
 Module  : golang.org/x/sync
-Version : v0.16.0
-Time    : 2025-06-20T18:29:35Z
+Version : v0.17.0
+Time    : 2025-08-13T14:47:05Z
 Licence : BSD-3-Clause
 
-Contents of probable licence file $GOMODCACHE/golang.org/x/sync@v0.16.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/golang.org/x/sync@v0.17.0/LICENSE:
 
 Copyright 2009 The Go Authors.
 
@@ -19186,11 +19531,11 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 --------------------------------------------------------------------------------
 Module  : golang.org/x/sys
-Version : v0.34.0
-Time    : 2025-06-17T17:35:38Z
+Version : v0.36.0
+Time    : 2025-09-05T15:44:06Z
 Licence : BSD-3-Clause
 
-Contents of probable licence file $GOMODCACHE/golang.org/x/sys@v0.34.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/golang.org/x/sys@v0.36.0/LICENSE:
 
 Copyright 2009 The Go Authors.
 
@@ -19223,11 +19568,11 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 --------------------------------------------------------------------------------
 Module  : golang.org/x/term
-Version : v0.33.0
-Time    : 2025-07-09T20:10:58Z
+Version : v0.35.0
+Time    : 2025-09-08T03:32:07Z
 Licence : BSD-3-Clause
 
-Contents of probable licence file $GOMODCACHE/golang.org/x/term@v0.33.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/golang.org/x/term@v0.35.0/LICENSE:
 
 Copyright 2009 The Go Authors.
 
@@ -19260,11 +19605,11 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 --------------------------------------------------------------------------------
 Module  : golang.org/x/text
-Version : v0.27.0
-Time    : 2025-07-09T20:56:05Z
+Version : v0.29.0
+Time    : 2025-09-08T03:32:21Z
 Licence : BSD-3-Clause
 
-Contents of probable licence file $GOMODCACHE/golang.org/x/text@v0.27.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/golang.org/x/text@v0.29.0/LICENSE:
 
 Copyright 2009 The Go Authors.
 
@@ -19297,11 +19642,11 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 --------------------------------------------------------------------------------
 Module  : golang.org/x/time
-Version : v0.9.0
-Time    : 2025-01-03T16:42:23Z
+Version : v0.12.0
+Time    : 2025-06-04T19:36:50Z
 Licence : BSD-3-Clause
 
-Contents of probable licence file $GOMODCACHE/golang.org/x/time@v0.9.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/golang.org/x/time@v0.12.0/LICENSE:
 
 Copyright 2009 The Go Authors.
 
@@ -19334,11 +19679,85 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 --------------------------------------------------------------------------------
 Module  : golang.org/x/tools
-Version : v0.34.0
-Time    : 2025-06-05T21:20:03Z
+Version : v0.36.0
+Time    : 2025-08-07T20:42:58Z
 Licence : BSD-3-Clause
 
-Contents of probable licence file $GOMODCACHE/golang.org/x/tools@v0.34.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/golang.org/x/tools@v0.36.0/LICENSE:
+
+Copyright 2009 The Go Authors.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google LLC nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+--------------------------------------------------------------------------------
+Module  : golang.org/x/tools/go/expect
+Version : v0.1.0-deprecated
+Time    : 2025-06-12T15:17:39Z
+Licence : BSD-3-Clause
+
+Contents of probable licence file $GOMODCACHE/golang.org/x/tools/go/expect@v0.1.0-deprecated/LICENSE:
+
+Copyright 2009 The Go Authors.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google LLC nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+--------------------------------------------------------------------------------
+Module  : golang.org/x/tools/go/packages/packagestest
+Version : v0.1.1-deprecated
+Time    : 2025-06-13T18:44:18Z
+Licence : BSD-3-Clause
+
+Contents of probable licence file $GOMODCACHE/golang.org/x/tools/go/packages/packagestest@v0.1.1-deprecated/LICENSE:
 
 Copyright 2009 The Go Authors.
 
@@ -19583,11 +20002,11 @@ Contents of probable licence file $GOMODCACHE/gomodules.xyz/jsonpatch/v2@v2.4.0/
 
 --------------------------------------------------------------------------------
 Module  : google.golang.org/genproto/googleapis/api
-Version : v0.0.0-20241209162323-e6fa225c2576
-Time    : 2024-12-09T16:23:23Z
+Version : v0.0.0-20250303144028-a0af3efb3deb
+Time    : 2025-03-03T14:40:28Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/google.golang.org/genproto/googleapis/api@v0.0.0-20241209162323-e6fa225c2576/LICENSE:
+Contents of probable licence file $GOMODCACHE/google.golang.org/genproto/googleapis/api@v0.0.0-20250303144028-a0af3efb3deb/LICENSE:
 
 
                                  Apache License
@@ -19795,11 +20214,11 @@ Contents of probable licence file $GOMODCACHE/google.golang.org/genproto/googlea
 
 --------------------------------------------------------------------------------
 Module  : google.golang.org/genproto/googleapis/rpc
-Version : v0.0.0-20241223144023-3abc09e42ca8
-Time    : 2024-12-23T14:40:23Z
+Version : v0.0.0-20250303144028-a0af3efb3deb
+Time    : 2025-03-03T14:40:28Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/google.golang.org/genproto/googleapis/rpc@v0.0.0-20241223144023-3abc09e42ca8/LICENSE:
+Contents of probable licence file $GOMODCACHE/google.golang.org/genproto/googleapis/rpc@v0.0.0-20250303144028-a0af3efb3deb/LICENSE:
 
 
                                  Apache License
@@ -20007,11 +20426,11 @@ Contents of probable licence file $GOMODCACHE/google.golang.org/genproto/googlea
 
 --------------------------------------------------------------------------------
 Module  : google.golang.org/grpc
-Version : v1.68.1
-Time    : 2024-12-04T07:04:29Z
+Version : v1.72.1
+Time    : 2025-05-14T09:00:17Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/google.golang.org/grpc@v1.68.1/LICENSE:
+Contents of probable licence file $GOMODCACHE/google.golang.org/grpc@v1.72.1/LICENSE:
 
 
                                  Apache License
@@ -20219,11 +20638,11 @@ Contents of probable licence file $GOMODCACHE/google.golang.org/grpc@v1.68.1/LIC
 
 --------------------------------------------------------------------------------
 Module  : google.golang.org/protobuf
-Version : v1.36.6
-Time    : 2025-03-24T10:34:58Z
+Version : v1.36.8
+Time    : 2025-08-20T14:38:26Z
 Licence : BSD-3-Clause
 
-Contents of probable licence file $GOMODCACHE/google.golang.org/protobuf@v1.36.6/LICENSE:
+Contents of probable licence file $GOMODCACHE/google.golang.org/protobuf@v1.36.8/LICENSE:
 
 Copyright (c) 2018 The Go Authors. All rights reserved.
 
@@ -20705,11 +21124,11 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 --------------------------------------------------------------------------------
 Module  : k8s.io/apiextensions-apiserver
-Version : v0.33.0
-Time    : 2025-04-23T20:08:42Z
+Version : v0.34.0
+Time    : 2025-08-27T20:41:17Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/k8s.io/apiextensions-apiserver@v0.33.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/k8s.io/apiextensions-apiserver@v0.34.0/LICENSE:
 
 
                                  Apache License
@@ -20917,11 +21336,11 @@ Contents of probable licence file $GOMODCACHE/k8s.io/apiextensions-apiserver@v0.
 
 --------------------------------------------------------------------------------
 Module  : k8s.io/apiserver
-Version : v0.33.0
-Time    : 2025-04-23T19:49:54Z
+Version : v0.34.0
+Time    : 2025-08-27T20:24:55Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/k8s.io/apiserver@v0.33.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/k8s.io/apiserver@v0.34.0/LICENSE:
 
 
                                  Apache License
@@ -21129,11 +21548,11 @@ Contents of probable licence file $GOMODCACHE/k8s.io/apiserver@v0.33.0/LICENSE:
 
 --------------------------------------------------------------------------------
 Module  : k8s.io/code-generator
-Version : v0.33.0
-Time    : 2025-04-23T19:34:06Z
+Version : v0.34.0
+Time    : 2025-08-27T20:05:46Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/k8s.io/code-generator@v0.33.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/k8s.io/code-generator@v0.34.0/LICENSE:
 
 
                                  Apache License
@@ -21341,11 +21760,11 @@ Contents of probable licence file $GOMODCACHE/k8s.io/code-generator@v0.33.0/LICE
 
 --------------------------------------------------------------------------------
 Module  : k8s.io/component-base
-Version : v0.33.0
-Time    : 2025-04-23T19:37:02Z
+Version : v0.34.0
+Time    : 2025-08-27T20:09:10Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/k8s.io/component-base@v0.33.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/k8s.io/component-base@v0.34.0/LICENSE:
 
 
                                  Apache License
@@ -21553,11 +21972,11 @@ Contents of probable licence file $GOMODCACHE/k8s.io/component-base@v0.33.0/LICE
 
 --------------------------------------------------------------------------------
 Module  : k8s.io/gengo/v2
-Version : v2.0.0-20250207200755-1244d31929d7
-Time    : 2025-02-07T20:07:55Z
+Version : v2.0.0-20250604051438-85fd79dbfd9f
+Time    : 2025-06-04T05:14:38Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/k8s.io/gengo/v2@v2.0.0-20250207200755-1244d31929d7/LICENSE:
+Contents of probable licence file $GOMODCACHE/k8s.io/gengo/v2@v2.0.0-20250604051438-85fd79dbfd9f/LICENSE:
 
 
                                  Apache License
@@ -21765,11 +22184,11 @@ Contents of probable licence file $GOMODCACHE/k8s.io/gengo/v2@v2.0.0-20250207200
 
 --------------------------------------------------------------------------------
 Module  : k8s.io/kube-openapi
-Version : v0.0.0-20250318190949-c8a335a9a2ff
-Time    : 2025-03-18T19:09:49Z
+Version : v0.0.0-20250710124328-f3f2b991d03b
+Time    : 2025-07-10T12:43:28Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/k8s.io/kube-openapi@v0.0.0-20250318190949-c8a335a9a2ff/LICENSE:
+Contents of probable licence file $GOMODCACHE/k8s.io/kube-openapi@v0.0.0-20250710124328-f3f2b991d03b/LICENSE:
 
 
                                  Apache License
@@ -22188,11 +22607,11 @@ Contents of probable licence file $GOMODCACHE/sigs.k8s.io/apiserver-network-prox
 
 --------------------------------------------------------------------------------
 Module  : sigs.k8s.io/json
-Version : v0.0.0-20241010143419-9aa6b5e7a4b3
-Time    : 2024-10-10T14:34:19Z
+Version : v0.0.0-20241014173422-cfa47c3a1cc8
+Time    : 2024-10-14T17:34:22Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/sigs.k8s.io/json@v0.0.0-20241010143419-9aa6b5e7a4b3/LICENSE:
+Contents of probable licence file $GOMODCACHE/sigs.k8s.io/json@v0.0.0-20241014173422-cfa47c3a1cc8/LICENSE:
 
 Files other than internal/golang/* licensed under:
 
@@ -22647,12 +23066,12 @@ Contents of probable licence file $GOMODCACHE/sigs.k8s.io/randfill@v1.0.0/LICENS
 
 
 --------------------------------------------------------------------------------
-Module  : sigs.k8s.io/structured-merge-diff/v4
-Version : v4.6.0
-Time    : 2025-03-04T18:29:45Z
+Module  : sigs.k8s.io/structured-merge-diff/v6
+Version : v6.3.0
+Time    : 2025-07-16T20:34:24Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/sigs.k8s.io/structured-merge-diff/v4@v4.6.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/sigs.k8s.io/structured-merge-diff/v6@v6.3.0/LICENSE:
 
                                  Apache License
                            Version 2.0, January 2004
@@ -22859,11 +23278,11 @@ Contents of probable licence file $GOMODCACHE/sigs.k8s.io/structured-merge-diff/
 
 --------------------------------------------------------------------------------
 Module  : sigs.k8s.io/yaml
-Version : v1.4.0
-Time    : 2023-10-24T17:13:34Z
+Version : v1.6.0
+Time    : 2025-07-24T18:12:28Z
 Licence : Apache-2.0
 
-Contents of probable licence file $GOMODCACHE/sigs.k8s.io/yaml@v1.4.0/LICENSE:
+Contents of probable licence file $GOMODCACHE/sigs.k8s.io/yaml@v1.6.0/LICENSE:
 
 The MIT License (MIT)
 
diff --git a/build/Dockerfile b/build/Dockerfile
index be9e0730e..9fcaba230 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -1,5 +1,5 @@
 # Build the operator binary
-FROM docker.elastic.co/wolfi/go:1.24.5-r2@sha256:8b8d98d34d7c0892abead1f9be7cd3581587a556a26496553bb8b91e7520ae3e as builder
+FROM docker.elastic.co/wolfi/go:1.25.1@sha256:ebfb6455d2f211f5883fc890b3e015407b5001016447a7427942ad2bd327c68a as builder
 
 ARG VERSION
 ARG SHA1
@@ -27,7 +27,7 @@ RUN --mount=type=cache,mode=0755,target=/go/pkg/mod \
 
 # ---------------------------------------------
 # Copy the operator binary into a lighter image
-FROM docker.elastic.co/wolfi/static:latest@sha256:93b70336be10c325d5a96016971b71b38d8e79e5148af2144f2aae93ee9367c3
+FROM docker.elastic.co/wolfi/static:latest@sha256:b2e1c3d3627093e54f6805823e73edd17ab93d6c7202e672988080c863e0412b
 
 ARG VERSION
 
diff --git a/build/Dockerfile-ubi b/build/Dockerfile-ubi
index 5d2865291..0ea46badd 100644
--- a/build/Dockerfile-ubi
+++ b/build/Dockerfile-ubi
@@ -1,5 +1,5 @@
 # Build the operator binary
-FROM docker.elastic.co/wolfi/go:1.24.5-r2@sha256:8b8d98d34d7c0892abead1f9be7cd3581587a556a26496553bb8b91e7520ae3e as builder
+FROM docker.elastic.co/wolfi/go:1.25.1@sha256:ebfb6455d2f211f5883fc890b3e015407b5001016447a7427942ad2bd327c68a as builder
 
 ARG VERSION
 ARG SHA1
@@ -27,7 +27,7 @@ RUN --mount=type=cache,mode=0755,target=/go/pkg/mod \
 
 # ---------------------------------------------
 # Copy the operator binary into a lighter image
-FROM registry.access.redhat.com/ubi9/ubi-micro:9.6-1752751762
+FROM registry.access.redhat.com/ubi9/ubi-micro:9.6-1754467928
 
 ARG VERSION
 
diff --git a/cmd/main.go b/cmd/main.go
index 5c52e9f2b..a39a0e022 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -5,6 +5,8 @@
 package main
 
 import (
+	// By default this sets `GOMEMLIMIT` to 90% of cgroup's memory limit.
+	_ "github.com/KimMachineGun/automemlimit"
 	"github.com/spf13/cobra"
 
 	"github.com/elastic/cloud-on-k8s/v3/cmd/manager"
diff --git a/cmd/manager/main.go b/cmd/manager/main.go
index c9c0f4e9e..20e446da7 100644
--- a/cmd/manager/main.go
+++ b/cmd/manager/main.go
@@ -558,6 +558,7 @@ func startOperator(ctx context.Context) error {
 	// Setup Scheme for all resources
 	log.Info("Setting up scheme")
 	controllerscheme.SetupScheme()
+
 	// also set up the v1beta1 scheme, used by the v1beta1 webhook
 	controllerscheme.SetupV1beta1Scheme()
 
diff --git a/config/crds/v1/all-crds.yaml b/config/crds/v1/all-crds.yaml
index 34a0c1fff..bd4e0635e 100644
--- a/config/crds/v1/all-crds.yaml
+++ b/config/crds/v1/all-crds.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: agents.agent.k8s.elastic.co
 spec:
   group: agent.k8s.elastic.co
@@ -112,7 +112,7 @@ spec:
                               pod is available (Ready for at least minReadySeconds) the old DaemonSet pod
                               on that node is marked deleted. If the old pod becomes unavailable for any
                               reason (Ready transitions to false, is evicted, or is drained) an updated
-                              pod is immediatedly created on that node without considering surge limits.
+                              pod is immediately created on that node without considering surge limits.
                               Allowing surge implies the possibility that the resources consumed by the
                               daemonset on any given node can double if the readiness check fails, and
                               so resource intensive daemonsets should take into account that they may
@@ -226,7 +226,8 @@ spec:
                     secretName:
                       description: |-
                         SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                        Elastic resource not managed by the operator. The referenced secret must contain the following:
+                        Elastic resource not managed by the operator.
+                        The referenced secret must contain the following:
                         - `url`: the URL to reach the Elastic resource
                         - `username`: the username of the user to be authenticated to the Elastic resource
                         - `password`: the password of the user to be authenticated to the Elastic resource
@@ -250,6 +251,7 @@ spec:
                 description: |-
                   FleetServerRef is a reference to Fleet Server that this Agent should connect to to obtain it's configuration.
                   Don't set unless `mode` is set to `fleet`.
+                  References to Fleet servers running outside the Kubernetes cluster via the `secretName` attribute are not supported.
                 properties:
                   name:
                     description: Name of an existing Kubernetes object corresponding
@@ -262,7 +264,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -713,7 +716,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -1050,15 +1054,13 @@ spec:
                                 volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                 If specified, the CSI driver will create or update the volume with the attributes defined
                                 in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                will be set by the persistentvolume controller if it exists.
+                                it can be changed after the claim is created. An empty string or nil value indicates that no
+                                VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                this field can be reset to its previous value (including nil) to cancel the modification.
                                 If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                 set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                 exists.
                                 More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                               type: string
                             volumeMode:
                               description: |-
@@ -1128,7 +1130,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: apmservers.apm.k8s.elastic.co
 spec:
   group: apm.k8s.elastic.co
@@ -1206,7 +1208,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -1656,7 +1659,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -2353,7 +2357,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: beats.beat.k8s.elastic.co
 spec:
   group: beat.k8s.elastic.co
@@ -2467,7 +2471,7 @@ spec:
                               pod is available (Ready for at least minReadySeconds) the old DaemonSet pod
                               on that node is marked deleted. If the old pod becomes unavailable for any
                               reason (Ready transitions to false, is evicted, or is drained) an updated
-                              pod is immediatedly created on that node without considering surge limits.
+                              pod is immediately created on that node without considering surge limits.
                               Allowing surge implies the possibility that the resources consumed by the
                               daemonset on any given node can double if the readiness check fails, and
                               so resource intensive daemonsets should take into account that they may
@@ -2577,7 +2581,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -2612,7 +2617,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -2657,7 +2663,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -2698,7 +2705,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -2827,7 +2835,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: elasticmapsservers.maps.k8s.elastic.co
 spec:
   group: maps.k8s.elastic.co
@@ -2917,7 +2925,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -3423,7 +3432,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: elasticsearchautoscalers.autoscaling.k8s.elastic.co
 spec:
   group: autoscaling.k8s.elastic.co
@@ -3774,7 +3783,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: elasticsearches.elasticsearch.k8s.elastic.co
 spec:
   group: elasticsearch.k8s.elastic.co
@@ -4314,7 +4323,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -4355,7 +4365,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -4632,15 +4643,13 @@ spec:
                                   volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                   If specified, the CSI driver will create or update the volume with the attributes defined
                                   in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                  it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                  will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                  If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                  will be set by the persistentvolume controller if it exists.
+                                  it can be changed after the claim is created. An empty string or nil value indicates that no
+                                  VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                  this field can be reset to its previous value (including nil) to cancel the modification.
                                   If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                   set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                   exists.
                                   More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                  (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                 type: string
                               volumeMode:
                                 description: |-
@@ -4661,10 +4670,18 @@ spec:
                 type: array
               podDisruptionBudget:
                 description: |-
-                  PodDisruptionBudget provides access to the default Pod disruption budget for the Elasticsearch cluster.
-                  The default budget doesn't allow any Pod to be removed in case the cluster is not green or if there is only one node of type `data` or `master`.
-                  In all other cases the default PodDisruptionBudget sets `minUnavailable` equal to the total number of nodes minus 1.
-                  To disable, set `PodDisruptionBudget` to the empty value (`{}` in YAML).
+                  PodDisruptionBudget provides access to the default Pod disruption budget(s) for the Elasticsearch cluster.
+                  The behavior depends on the license level.
+                  With a Basic license or if podDisruptionBudget.spec is not empty:
+                    The default budget doesn't allow any Pod to be removed in case the cluster is not green or if there is only one node of type `data` or `master`.
+                    In all other cases the default podDisruptionBudget sets `minUnavailable` equal to the total number of nodes minus 1.
+                  With an Enterprise license and if podDisruptionBudget.spec is empty:
+                    The default budget is split into multiple budgets, each targeting a specific node role type allowing additional disruptions
+                    for certain roles according to the health status of the cluster.
+                      Example:
+                        All data roles (excluding frozen): allows disruptions only when the cluster is green.
+                        All other roles: allows disruptions only when the cluster is yellow or green.
+                  To disable, set `podDisruptionBudget` to the empty value (`{}` in YAML).
                 properties:
                   metadata:
                     description: |-
@@ -6303,15 +6320,13 @@ spec:
                                   volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                   If specified, the CSI driver will create or update the volume with the attributes defined
                                   in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                  it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                  will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                  If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                  will be set by the persistentvolume controller if it exists.
+                                  it can be changed after the claim is created. An empty string or nil value indicates that no
+                                  VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                  this field can be reset to its previous value (including nil) to cancel the modification.
                                   If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                   set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                   exists.
                                   More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                  (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                 type: string
                               volumeMode:
                                 description: |-
@@ -6558,7 +6573,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: enterprisesearches.enterprisesearch.k8s.elastic.co
 spec:
   group: enterprisesearch.k8s.elastic.co
@@ -6647,7 +6662,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -7225,7 +7241,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -7717,7 +7734,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: kibanas.kibana.k8s.elastic.co
 spec:
   group: kibana.k8s.elastic.co
@@ -7795,7 +7812,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -7826,7 +7844,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -8290,7 +8309,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -8331,7 +8351,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -9022,7 +9043,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: logstashes.logstash.k8s.elastic.co
 spec:
   group: logstash.k8s.elastic.co
@@ -9124,7 +9145,8 @@ spec:
                     secretName:
                       description: |-
                         SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                        Elastic resource not managed by the operator. The referenced secret must contain the following:
+                        Elastic resource not managed by the operator.
+                        The referenced secret must contain the following:
                         - `url`: the URL to reach the Elastic resource
                         - `username`: the username of the user to be authenticated to the Elastic resource
                         - `password`: the password of the user to be authenticated to the Elastic resource
@@ -9176,7 +9198,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -9217,7 +9240,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -9990,15 +10014,13 @@ spec:
                             volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                             If specified, the CSI driver will create or update the volume with the attributes defined
                             in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                            it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                            will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                            If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                            will be set by the persistentvolume controller if it exists.
+                            it can be changed after the claim is created. An empty string or nil value indicates that no
+                            VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                            this field can be reset to its previous value (including nil) to cancel the modification.
                             If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                             set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                             exists.
                             More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                            (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                           type: string
                         volumeMode:
                           description: |-
@@ -10161,13 +10183,11 @@ spec:
                           description: |-
                             currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
                             When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
-                            This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                           type: string
                         modifyVolumeStatus:
                           description: |-
                             ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
                             When this is unset, there is no ModifyVolume operation being attempted.
-                            This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                           properties:
                             status:
                               description: "status is the status of the ControllerModifyVolume
@@ -10257,7 +10277,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: stackconfigpolicies.stackconfigpolicy.k8s.elastic.co
 spec:
   group: stackconfigpolicy.k8s.elastic.co
diff --git a/config/crds/v1/resources/agent.k8s.elastic.co_agents.yaml b/config/crds/v1/resources/agent.k8s.elastic.co_agents.yaml
index 6aef4d080..f5f00c035 100644
--- a/config/crds/v1/resources/agent.k8s.elastic.co_agents.yaml
+++ b/config/crds/v1/resources/agent.k8s.elastic.co_agents.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: agents.agent.k8s.elastic.co
 spec:
   group: agent.k8s.elastic.co
@@ -698,8 +698,8 @@ spec:
                                       most preferred is the one with the greatest sum of weights, i.e.
                                       for each node that meets all of the scheduling requirements (resource
                                       request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                      compute a sum by iterating through the elements of this field and adding
-                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                      compute a sum by iterating through the elements of this field and subtracting
+                                      "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                       node(s) with the highest sum are the most preferred.
                                     items:
                                       description: The weights of all of the matched
@@ -1099,8 +1099,9 @@ spec:
                                       variable present in a Container.
                                     properties:
                                       name:
-                                        description: Name of the environment variable.
-                                          Must be a C_IDENTIFIER.
+                                        description: |-
+                                          Name of the environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       value:
                                         description: |-
@@ -1159,6 +1160,43 @@ spec:
                                             - fieldPath
                                             type: object
                                             x-kubernetes-map-type: atomic
+                                          fileKeyRef:
+                                            description: |-
+                                              FileKeyRef selects a key of the env file.
+                                              Requires the EnvFiles feature gate to be enabled.
+                                            properties:
+                                              key:
+                                                description: |-
+                                                  The key within the env file. An invalid key will prevent the pod from starting.
+                                                  The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                  During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                type: string
+                                              optional:
+                                                default: false
+                                                description: |-
+                                                  Specify whether the file or its key must be defined. If the file or key
+                                                  does not exist, then the env var is not published.
+                                                  If optional is set to true and the specified key does not exist,
+                                                  the environment variable will not be set in the Pod's containers.
+
+                                                  If optional is set to false and the specified key does not exist,
+                                                  an error will be returned during Pod creation.
+                                                type: boolean
+                                              path:
+                                                description: |-
+                                                  The path within the volume from which to select the file.
+                                                  Must be relative and may not contain the '..' path or start with '..'.
+                                                type: string
+                                              volumeName:
+                                                description: The name of the volume
+                                                  mount containing the env file.
+                                                type: string
+                                            required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                            type: object
+                                            x-kubernetes-map-type: atomic
                                           resourceFieldRef:
                                             description: |-
                                               Selects a resource of the container: only resources limits and requests
@@ -1222,8 +1260,8 @@ spec:
                                 envFrom:
                                   description: |-
                                     List of sources to populate environment variables in the container.
-                                    The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                    will be reported as an event when the container is starting. When a key exists in multiple
+                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                    When a key exists in multiple
                                     sources, the value associated with the last source will take precedence.
                                     Values defined by an Env with a duplicate key will take precedence.
                                     Cannot be updated.
@@ -1250,9 +1288,9 @@ spec:
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       prefix:
-                                        description: Optional text to prepend to the
-                                          name of each environment variable. Must
-                                          be a C_IDENTIFIER.
+                                        description: |-
+                                          Optional text to prepend to the name of each environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       secretRef:
                                         description: The Secret to select from
@@ -1939,7 +1977,7 @@ spec:
                                         Claims lists the names of resources, defined in spec.resourceClaims,
                                         that are used by this container.
 
-                                        This is an alpha field and requires enabling the
+                                        This field depends on the
                                         DynamicResourceAllocation feature gate.
 
                                         This field is immutable. It can only be set for containers.
@@ -1994,10 +2032,10 @@ spec:
                                 restartPolicy:
                                   description: |-
                                     RestartPolicy defines the restart behavior of individual containers in a pod.
-                                    This field may only be set for init containers, and the only allowed value is "Always".
-                                    For non-init containers or when this field is not specified,
+                                    This overrides the pod-level restart policy. When this field is not specified,
                                     the restart behavior is defined by the Pod's restart policy and the container type.
-                                    Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                    Additionally, setting the RestartPolicy as "Always" for the init container will
+                                    have the following effect:
                                     this init container will be continually restarted on
                                     exit until all regular containers have terminated. Once all regular
                                     containers have completed, all init containers with restartPolicy "Always"
@@ -2009,6 +2047,59 @@ spec:
                                     init container is started, or after any startupProbe has successfully
                                     completed.
                                   type: string
+                                restartPolicyRules:
+                                  description: |-
+                                    Represents a list of rules to be checked to determine if the
+                                    container should be restarted on exit. The rules are evaluated in
+                                    order. Once a rule matches a container exit condition, the remaining
+                                    rules are ignored. If no rule matches the container exit condition,
+                                    the Container-level restart policy determines the whether the container
+                                    is restarted or not. Constraints on the rules:
+                                    - At most 20 rules are allowed.
+                                    - Rules can have the same action.
+                                    - Identical rules are not forbidden in validations.
+                                    When rules are specified, container MUST set RestartPolicy explicitly
+                                    even it if matches the Pod's RestartPolicy.
+                                  items:
+                                    description: ContainerRestartRule describes how
+                                      a container exit is handled.
+                                    properties:
+                                      action:
+                                        description: |-
+                                          Specifies the action taken on a container exit if the requirements
+                                          are satisfied. The only possible value is "Restart" to restart the
+                                          container.
+                                        type: string
+                                      exitCodes:
+                                        description: Represents the exit codes to
+                                          check on container exits.
+                                        properties:
+                                          operator:
+                                            description: |-
+                                              Represents the relationship between the container exit code(s) and the
+                                              specified values. Possible values are:
+                                              - In: the requirement is satisfied if the container exit code is in the
+                                                set of specified values.
+                                              - NotIn: the requirement is satisfied if the container exit code is
+                                                not in the set of specified values.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              Specifies the set of values to check for container exit codes.
+                                              At most 255 elements are allowed.
+                                            items:
+                                              format: int32
+                                              type: integer
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        required:
+                                        - operator
+                                        type: object
+                                    required:
+                                    - action
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
                                 securityContext:
                                   description: |-
                                     SecurityContext defines the security options the container should be run with.
@@ -2631,8 +2722,9 @@ spec:
                                       variable present in a Container.
                                     properties:
                                       name:
-                                        description: Name of the environment variable.
-                                          Must be a C_IDENTIFIER.
+                                        description: |-
+                                          Name of the environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       value:
                                         description: |-
@@ -2691,6 +2783,43 @@ spec:
                                             - fieldPath
                                             type: object
                                             x-kubernetes-map-type: atomic
+                                          fileKeyRef:
+                                            description: |-
+                                              FileKeyRef selects a key of the env file.
+                                              Requires the EnvFiles feature gate to be enabled.
+                                            properties:
+                                              key:
+                                                description: |-
+                                                  The key within the env file. An invalid key will prevent the pod from starting.
+                                                  The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                  During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                type: string
+                                              optional:
+                                                default: false
+                                                description: |-
+                                                  Specify whether the file or its key must be defined. If the file or key
+                                                  does not exist, then the env var is not published.
+                                                  If optional is set to true and the specified key does not exist,
+                                                  the environment variable will not be set in the Pod's containers.
+
+                                                  If optional is set to false and the specified key does not exist,
+                                                  an error will be returned during Pod creation.
+                                                type: boolean
+                                              path:
+                                                description: |-
+                                                  The path within the volume from which to select the file.
+                                                  Must be relative and may not contain the '..' path or start with '..'.
+                                                type: string
+                                              volumeName:
+                                                description: The name of the volume
+                                                  mount containing the env file.
+                                                type: string
+                                            required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                            type: object
+                                            x-kubernetes-map-type: atomic
                                           resourceFieldRef:
                                             description: |-
                                               Selects a resource of the container: only resources limits and requests
@@ -2754,8 +2883,8 @@ spec:
                                 envFrom:
                                   description: |-
                                     List of sources to populate environment variables in the container.
-                                    The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                    will be reported as an event when the container is starting. When a key exists in multiple
+                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                    When a key exists in multiple
                                     sources, the value associated with the last source will take precedence.
                                     Values defined by an Env with a duplicate key will take precedence.
                                     Cannot be updated.
@@ -2782,9 +2911,9 @@ spec:
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       prefix:
-                                        description: Optional text to prepend to the
-                                          name of each environment variable. Must
-                                          be a C_IDENTIFIER.
+                                        description: |-
+                                          Optional text to prepend to the name of each environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       secretRef:
                                         description: The Secret to select from
@@ -3454,7 +3583,7 @@ spec:
                                         Claims lists the names of resources, defined in spec.resourceClaims,
                                         that are used by this container.
 
-                                        This is an alpha field and requires enabling the
+                                        This field depends on the
                                         DynamicResourceAllocation feature gate.
 
                                         This field is immutable. It can only be set for containers.
@@ -3510,9 +3639,53 @@ spec:
                                   description: |-
                                     Restart policy for the container to manage the restart behavior of each
                                     container within a pod.
-                                    This may only be set for init containers. You cannot set this field on
-                                    ephemeral containers.
+                                    You cannot set this field on ephemeral containers.
                                   type: string
+                                restartPolicyRules:
+                                  description: |-
+                                    Represents a list of rules to be checked to determine if the
+                                    container should be restarted on exit. You cannot set this field on
+                                    ephemeral containers.
+                                  items:
+                                    description: ContainerRestartRule describes how
+                                      a container exit is handled.
+                                    properties:
+                                      action:
+                                        description: |-
+                                          Specifies the action taken on a container exit if the requirements
+                                          are satisfied. The only possible value is "Restart" to restart the
+                                          container.
+                                        type: string
+                                      exitCodes:
+                                        description: Represents the exit codes to
+                                          check on container exits.
+                                        properties:
+                                          operator:
+                                            description: |-
+                                              Represents the relationship between the container exit code(s) and the
+                                              specified values. Possible values are:
+                                              - In: the requirement is satisfied if the container exit code is in the
+                                                set of specified values.
+                                              - NotIn: the requirement is satisfied if the container exit code is
+                                                not in the set of specified values.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              Specifies the set of values to check for container exit codes.
+                                              At most 255 elements are allowed.
+                                            items:
+                                              format: int32
+                                              type: integer
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        required:
+                                        - operator
+                                        type: object
+                                    required:
+                                    - action
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
                                 securityContext:
                                   description: |-
                                     Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -4054,7 +4227,9 @@ spec:
                           hostNetwork:
                             description: |-
                               Host networking requested for this pod. Use the host's network namespace.
-                              If this option is set, the ports that will be used must be specified.
+                              When using HostNetwork you should specify ports so the scheduler is aware.
+                              When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
+                              and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
                               Default to false.
                             type: boolean
                           hostPID:
@@ -4079,6 +4254,19 @@ spec:
                               Specifies the hostname of the Pod
                               If not specified, the pod's hostname will be set to a system-defined value.
                             type: string
+                          hostnameOverride:
+                            description: |-
+                              HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
+                              This field only specifies the pod's hostname and does not affect its DNS records.
+                              When this field is set to a non-empty string:
+                              - It takes precedence over the values set in `hostname` and `subdomain`.
+                              - The Pod's hostname will be set to this value.
+                              - `setHostnameAsFQDN` must be nil or set to false.
+                              - `hostNetwork` must be set to false.
+
+                              This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
+                              Requires the HostnameOverride feature gate to be enabled.
+                            type: string
                           imagePullSecrets:
                             description: |-
                               ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -4160,8 +4348,9 @@ spec:
                                       variable present in a Container.
                                     properties:
                                       name:
-                                        description: Name of the environment variable.
-                                          Must be a C_IDENTIFIER.
+                                        description: |-
+                                          Name of the environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       value:
                                         description: |-
@@ -4220,6 +4409,43 @@ spec:
                                             - fieldPath
                                             type: object
                                             x-kubernetes-map-type: atomic
+                                          fileKeyRef:
+                                            description: |-
+                                              FileKeyRef selects a key of the env file.
+                                              Requires the EnvFiles feature gate to be enabled.
+                                            properties:
+                                              key:
+                                                description: |-
+                                                  The key within the env file. An invalid key will prevent the pod from starting.
+                                                  The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                  During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                type: string
+                                              optional:
+                                                default: false
+                                                description: |-
+                                                  Specify whether the file or its key must be defined. If the file or key
+                                                  does not exist, then the env var is not published.
+                                                  If optional is set to true and the specified key does not exist,
+                                                  the environment variable will not be set in the Pod's containers.
+
+                                                  If optional is set to false and the specified key does not exist,
+                                                  an error will be returned during Pod creation.
+                                                type: boolean
+                                              path:
+                                                description: |-
+                                                  The path within the volume from which to select the file.
+                                                  Must be relative and may not contain the '..' path or start with '..'.
+                                                type: string
+                                              volumeName:
+                                                description: The name of the volume
+                                                  mount containing the env file.
+                                                type: string
+                                            required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                            type: object
+                                            x-kubernetes-map-type: atomic
                                           resourceFieldRef:
                                             description: |-
                                               Selects a resource of the container: only resources limits and requests
@@ -4283,8 +4509,8 @@ spec:
                                 envFrom:
                                   description: |-
                                     List of sources to populate environment variables in the container.
-                                    The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                    will be reported as an event when the container is starting. When a key exists in multiple
+                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                    When a key exists in multiple
                                     sources, the value associated with the last source will take precedence.
                                     Values defined by an Env with a duplicate key will take precedence.
                                     Cannot be updated.
@@ -4311,9 +4537,9 @@ spec:
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       prefix:
-                                        description: Optional text to prepend to the
-                                          name of each environment variable. Must
-                                          be a C_IDENTIFIER.
+                                        description: |-
+                                          Optional text to prepend to the name of each environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       secretRef:
                                         description: The Secret to select from
@@ -5000,7 +5226,7 @@ spec:
                                         Claims lists the names of resources, defined in spec.resourceClaims,
                                         that are used by this container.
 
-                                        This is an alpha field and requires enabling the
+                                        This field depends on the
                                         DynamicResourceAllocation feature gate.
 
                                         This field is immutable. It can only be set for containers.
@@ -5055,10 +5281,10 @@ spec:
                                 restartPolicy:
                                   description: |-
                                     RestartPolicy defines the restart behavior of individual containers in a pod.
-                                    This field may only be set for init containers, and the only allowed value is "Always".
-                                    For non-init containers or when this field is not specified,
+                                    This overrides the pod-level restart policy. When this field is not specified,
                                     the restart behavior is defined by the Pod's restart policy and the container type.
-                                    Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                    Additionally, setting the RestartPolicy as "Always" for the init container will
+                                    have the following effect:
                                     this init container will be continually restarted on
                                     exit until all regular containers have terminated. Once all regular
                                     containers have completed, all init containers with restartPolicy "Always"
@@ -5070,6 +5296,59 @@ spec:
                                     init container is started, or after any startupProbe has successfully
                                     completed.
                                   type: string
+                                restartPolicyRules:
+                                  description: |-
+                                    Represents a list of rules to be checked to determine if the
+                                    container should be restarted on exit. The rules are evaluated in
+                                    order. Once a rule matches a container exit condition, the remaining
+                                    rules are ignored. If no rule matches the container exit condition,
+                                    the Container-level restart policy determines the whether the container
+                                    is restarted or not. Constraints on the rules:
+                                    - At most 20 rules are allowed.
+                                    - Rules can have the same action.
+                                    - Identical rules are not forbidden in validations.
+                                    When rules are specified, container MUST set RestartPolicy explicitly
+                                    even it if matches the Pod's RestartPolicy.
+                                  items:
+                                    description: ContainerRestartRule describes how
+                                      a container exit is handled.
+                                    properties:
+                                      action:
+                                        description: |-
+                                          Specifies the action taken on a container exit if the requirements
+                                          are satisfied. The only possible value is "Restart" to restart the
+                                          container.
+                                        type: string
+                                      exitCodes:
+                                        description: Represents the exit codes to
+                                          check on container exits.
+                                        properties:
+                                          operator:
+                                            description: |-
+                                              Represents the relationship between the container exit code(s) and the
+                                              specified values. Possible values are:
+                                              - In: the requirement is satisfied if the container exit code is in the
+                                                set of specified values.
+                                              - NotIn: the requirement is satisfied if the container exit code is
+                                                not in the set of specified values.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              Specifies the set of values to check for container exit codes.
+                                              At most 255 elements are allowed.
+                                            items:
+                                              format: int32
+                                              type: integer
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        required:
+                                        - operator
+                                        type: object
+                                    required:
+                                    - action
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
                                 securityContext:
                                   description: |-
                                     SecurityContext defines the security options the container should be run with.
@@ -5605,6 +5884,7 @@ spec:
                               - spec.hostPID
                               - spec.hostIPC
                               - spec.hostUsers
+                              - spec.resources
                               - spec.securityContext.appArmorProfile
                               - spec.securityContext.seLinuxOptions
                               - spec.securityContext.seccompProfile
@@ -5758,7 +6038,7 @@ spec:
                             description: |-
                               Resources is the total amount of CPU and Memory resources required by all
                               containers in the pod. It supports specifying Requests and Limits for
-                              "cpu" and "memory" resource names only. ResourceClaims are not supported.
+                              "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
 
                               This field enables fine-grained control over resource allocation for the
                               entire pod, allowing resource sharing among containers in a pod.
@@ -5771,7 +6051,7 @@ spec:
                                   Claims lists the names of resources, defined in spec.resourceClaims,
                                   that are used by this container.
 
-                                  This is an alpha field and requires enabling the
+                                  This field depends on the
                                   DynamicResourceAllocation feature gate.
 
                                   This field is immutable. It can only be set for containers.
@@ -7070,15 +7350,13 @@ spec:
                                                 volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                                 If specified, the CSI driver will create or update the volume with the attributes defined
                                                 in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                                it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                                will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                                If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                                will be set by the persistentvolume controller if it exists.
+                                                it can be changed after the claim is created. An empty string or nil value indicates that no
+                                                VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                                this field can be reset to its previous value (including nil) to cancel the modification.
                                                 If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                                 set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                                 exists.
                                                 More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                                (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                               type: string
                                             volumeMode:
                                               description: |-
@@ -7263,12 +7541,10 @@ spec:
                                   description: |-
                                     glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                     Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md
                                   properties:
                                     endpoints:
-                                      description: |-
-                                        endpoints is the endpoint name that details Glusterfs topology.
-                                        More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                      description: endpoints is the endpoint name
+                                        that details Glusterfs topology.
                                       type: string
                                     path:
                                       description: |-
@@ -7347,7 +7623,7 @@ spec:
                                   description: |-
                                     iscsi represents an ISCSI Disk resource that is attached to a
                                     kubelet's host machine and then exposed to the pod.
-                                    More info: https://examples.k8s.io/volumes/iscsi/README.md
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                                   properties:
                                     chapAuthDiscovery:
                                       description: chapAuthDiscovery defines whether
@@ -7781,6 +8057,111 @@ spec:
                                                 type: array
                                                 x-kubernetes-list-type: atomic
                                             type: object
+                                          podCertificate:
+                                            description: |-
+                                              Projects an auto-rotating credential bundle (private key and certificate
+                                              chain) that the pod can use either as a TLS client or server.
+
+                                              Kubelet generates a private key and uses it to send a
+                                              PodCertificateRequest to the named signer.  Once the signer approves the
+                                              request and issues a certificate chain, Kubelet writes the key and
+                                              certificate chain to the pod filesystem.  The pod does not start until
+                                              certificates have been issued for each podCertificate projected volume
+                                              source in its spec.
+
+                                              Kubelet will begin trying to rotate the certificate at the time indicated
+                                              by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                              timestamp.
+
+                                              Kubelet can write a single file, indicated by the credentialBundlePath
+                                              field, or separate files, indicated by the keyPath and
+                                              certificateChainPath fields.
+
+                                              The credential bundle is a single file in PEM format.  The first PEM
+                                              entry is the private key (in PKCS#8 format), and the remaining PEM
+                                              entries are the certificate chain issued by the signer (typically,
+                                              signers will return their certificate chain in leaf-to-root order).
+
+                                              Prefer using the credential bundle format, since your application code
+                                              can read it atomically.  If you use keyPath and certificateChainPath,
+                                              your application must make two separate file reads. If these coincide
+                                              with a certificate rotation, it is possible that the private key and leaf
+                                              certificate you read may not correspond to each other.  Your application
+                                              will need to check for this condition, and re-read until they are
+                                              consistent.
+
+                                              The named signer controls chooses the format of the certificate it
+                                              issues; consult the signer implementation's documentation to learn how to
+                                              use the certificates it issues.
+                                            properties:
+                                              certificateChainPath:
+                                                description: |-
+                                                  Write the certificate chain at this path in the projected volume.
+
+                                                  Most applications should use credentialBundlePath.  When using keyPath
+                                                  and certificateChainPath, your application needs to check that the key
+                                                  and leaf certificate are consistent, because it is possible to read the
+                                                  files mid-rotation.
+                                                type: string
+                                              credentialBundlePath:
+                                                description: |-
+                                                  Write the credential bundle at this path in the projected volume.
+
+                                                  The credential bundle is a single file that contains multiple PEM blocks.
+                                                  The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                                  key.
+
+                                                  The remaining blocks are CERTIFICATE blocks, containing the issued
+                                                  certificate chain from the signer (leaf and any intermediates).
+
+                                                  Using credentialBundlePath lets your Pod's application code make a single
+                                                  atomic read that retrieves a consistent key and certificate chain.  If you
+                                                  project them to separate files, your application code will need to
+                                                  additionally check that the leaf certificate was issued to the key.
+                                                type: string
+                                              keyPath:
+                                                description: |-
+                                                  Write the key at this path in the projected volume.
+
+                                                  Most applications should use credentialBundlePath.  When using keyPath
+                                                  and certificateChainPath, your application needs to check that the key
+                                                  and leaf certificate are consistent, because it is possible to read the
+                                                  files mid-rotation.
+                                                type: string
+                                              keyType:
+                                                description: |-
+                                                  The type of keypair Kubelet will generate for the pod.
+
+                                                  Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                                  "ECDSAP521", and "ED25519".
+                                                type: string
+                                              maxExpirationSeconds:
+                                                description: |-
+                                                  maxExpirationSeconds is the maximum lifetime permitted for the
+                                                  certificate.
+
+                                                  Kubelet copies this value verbatim into the PodCertificateRequests it
+                                                  generates for this projection.
+
+                                                  If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                                  will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                                  value is 7862400 (91 days).
+
+                                                  The signer implementation is then free to issue a certificate with any
+                                                  lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                                  seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                                  `kubernetes.io` signers will never issue certificates with a lifetime
+                                                  longer than 24 hours.
+                                                format: int32
+                                                type: integer
+                                              signerName:
+                                                description: Kubelet's generated CSRs
+                                                  will be addressed to this signer.
+                                                type: string
+                                            required:
+                                            - keyType
+                                            - signerName
+                                            type: object
                                           secret:
                                             description: secret information about
                                               the secret data to project
@@ -7918,7 +8299,6 @@ spec:
                                   description: |-
                                     rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                     Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                                    More info: https://examples.k8s.io/volumes/rbd/README.md
                                   properties:
                                     fsType:
                                       description: |-
@@ -8238,7 +8618,7 @@ spec:
                               pod is available (Ready for at least minReadySeconds) the old DaemonSet pod
                               on that node is marked deleted. If the old pod becomes unavailable for any
                               reason (Ready transitions to false, is evicted, or is drained) an updated
-                              pod is immediatedly created on that node without considering surge limits.
+                              pod is immediately created on that node without considering surge limits.
                               Allowing surge implies the possibility that the resources consumed by the
                               daemonset on any given node can double if the readiness check fails, and
                               so resource intensive daemonsets should take into account that they may
@@ -8892,8 +9272,8 @@ spec:
                                       most preferred is the one with the greatest sum of weights, i.e.
                                       for each node that meets all of the scheduling requirements (resource
                                       request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                      compute a sum by iterating through the elements of this field and adding
-                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                      compute a sum by iterating through the elements of this field and subtracting
+                                      "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                       node(s) with the highest sum are the most preferred.
                                     items:
                                       description: The weights of all of the matched
@@ -9293,8 +9673,9 @@ spec:
                                       variable present in a Container.
                                     properties:
                                       name:
-                                        description: Name of the environment variable.
-                                          Must be a C_IDENTIFIER.
+                                        description: |-
+                                          Name of the environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       value:
                                         description: |-
@@ -9353,6 +9734,43 @@ spec:
                                             - fieldPath
                                             type: object
                                             x-kubernetes-map-type: atomic
+                                          fileKeyRef:
+                                            description: |-
+                                              FileKeyRef selects a key of the env file.
+                                              Requires the EnvFiles feature gate to be enabled.
+                                            properties:
+                                              key:
+                                                description: |-
+                                                  The key within the env file. An invalid key will prevent the pod from starting.
+                                                  The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                  During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                type: string
+                                              optional:
+                                                default: false
+                                                description: |-
+                                                  Specify whether the file or its key must be defined. If the file or key
+                                                  does not exist, then the env var is not published.
+                                                  If optional is set to true and the specified key does not exist,
+                                                  the environment variable will not be set in the Pod's containers.
+
+                                                  If optional is set to false and the specified key does not exist,
+                                                  an error will be returned during Pod creation.
+                                                type: boolean
+                                              path:
+                                                description: |-
+                                                  The path within the volume from which to select the file.
+                                                  Must be relative and may not contain the '..' path or start with '..'.
+                                                type: string
+                                              volumeName:
+                                                description: The name of the volume
+                                                  mount containing the env file.
+                                                type: string
+                                            required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                            type: object
+                                            x-kubernetes-map-type: atomic
                                           resourceFieldRef:
                                             description: |-
                                               Selects a resource of the container: only resources limits and requests
@@ -9416,8 +9834,8 @@ spec:
                                 envFrom:
                                   description: |-
                                     List of sources to populate environment variables in the container.
-                                    The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                    will be reported as an event when the container is starting. When a key exists in multiple
+                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                    When a key exists in multiple
                                     sources, the value associated with the last source will take precedence.
                                     Values defined by an Env with a duplicate key will take precedence.
                                     Cannot be updated.
@@ -9444,9 +9862,9 @@ spec:
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       prefix:
-                                        description: Optional text to prepend to the
-                                          name of each environment variable. Must
-                                          be a C_IDENTIFIER.
+                                        description: |-
+                                          Optional text to prepend to the name of each environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       secretRef:
                                         description: The Secret to select from
@@ -10133,7 +10551,7 @@ spec:
                                         Claims lists the names of resources, defined in spec.resourceClaims,
                                         that are used by this container.
 
-                                        This is an alpha field and requires enabling the
+                                        This field depends on the
                                         DynamicResourceAllocation feature gate.
 
                                         This field is immutable. It can only be set for containers.
@@ -10188,10 +10606,10 @@ spec:
                                 restartPolicy:
                                   description: |-
                                     RestartPolicy defines the restart behavior of individual containers in a pod.
-                                    This field may only be set for init containers, and the only allowed value is "Always".
-                                    For non-init containers or when this field is not specified,
+                                    This overrides the pod-level restart policy. When this field is not specified,
                                     the restart behavior is defined by the Pod's restart policy and the container type.
-                                    Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                    Additionally, setting the RestartPolicy as "Always" for the init container will
+                                    have the following effect:
                                     this init container will be continually restarted on
                                     exit until all regular containers have terminated. Once all regular
                                     containers have completed, all init containers with restartPolicy "Always"
@@ -10203,6 +10621,59 @@ spec:
                                     init container is started, or after any startupProbe has successfully
                                     completed.
                                   type: string
+                                restartPolicyRules:
+                                  description: |-
+                                    Represents a list of rules to be checked to determine if the
+                                    container should be restarted on exit. The rules are evaluated in
+                                    order. Once a rule matches a container exit condition, the remaining
+                                    rules are ignored. If no rule matches the container exit condition,
+                                    the Container-level restart policy determines the whether the container
+                                    is restarted or not. Constraints on the rules:
+                                    - At most 20 rules are allowed.
+                                    - Rules can have the same action.
+                                    - Identical rules are not forbidden in validations.
+                                    When rules are specified, container MUST set RestartPolicy explicitly
+                                    even it if matches the Pod's RestartPolicy.
+                                  items:
+                                    description: ContainerRestartRule describes how
+                                      a container exit is handled.
+                                    properties:
+                                      action:
+                                        description: |-
+                                          Specifies the action taken on a container exit if the requirements
+                                          are satisfied. The only possible value is "Restart" to restart the
+                                          container.
+                                        type: string
+                                      exitCodes:
+                                        description: Represents the exit codes to
+                                          check on container exits.
+                                        properties:
+                                          operator:
+                                            description: |-
+                                              Represents the relationship between the container exit code(s) and the
+                                              specified values. Possible values are:
+                                              - In: the requirement is satisfied if the container exit code is in the
+                                                set of specified values.
+                                              - NotIn: the requirement is satisfied if the container exit code is
+                                                not in the set of specified values.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              Specifies the set of values to check for container exit codes.
+                                              At most 255 elements are allowed.
+                                            items:
+                                              format: int32
+                                              type: integer
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        required:
+                                        - operator
+                                        type: object
+                                    required:
+                                    - action
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
                                 securityContext:
                                   description: |-
                                     SecurityContext defines the security options the container should be run with.
@@ -10825,8 +11296,9 @@ spec:
                                       variable present in a Container.
                                     properties:
                                       name:
-                                        description: Name of the environment variable.
-                                          Must be a C_IDENTIFIER.
+                                        description: |-
+                                          Name of the environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       value:
                                         description: |-
@@ -10885,6 +11357,43 @@ spec:
                                             - fieldPath
                                             type: object
                                             x-kubernetes-map-type: atomic
+                                          fileKeyRef:
+                                            description: |-
+                                              FileKeyRef selects a key of the env file.
+                                              Requires the EnvFiles feature gate to be enabled.
+                                            properties:
+                                              key:
+                                                description: |-
+                                                  The key within the env file. An invalid key will prevent the pod from starting.
+                                                  The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                  During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                type: string
+                                              optional:
+                                                default: false
+                                                description: |-
+                                                  Specify whether the file or its key must be defined. If the file or key
+                                                  does not exist, then the env var is not published.
+                                                  If optional is set to true and the specified key does not exist,
+                                                  the environment variable will not be set in the Pod's containers.
+
+                                                  If optional is set to false and the specified key does not exist,
+                                                  an error will be returned during Pod creation.
+                                                type: boolean
+                                              path:
+                                                description: |-
+                                                  The path within the volume from which to select the file.
+                                                  Must be relative and may not contain the '..' path or start with '..'.
+                                                type: string
+                                              volumeName:
+                                                description: The name of the volume
+                                                  mount containing the env file.
+                                                type: string
+                                            required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                            type: object
+                                            x-kubernetes-map-type: atomic
                                           resourceFieldRef:
                                             description: |-
                                               Selects a resource of the container: only resources limits and requests
@@ -10948,8 +11457,8 @@ spec:
                                 envFrom:
                                   description: |-
                                     List of sources to populate environment variables in the container.
-                                    The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                    will be reported as an event when the container is starting. When a key exists in multiple
+                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                    When a key exists in multiple
                                     sources, the value associated with the last source will take precedence.
                                     Values defined by an Env with a duplicate key will take precedence.
                                     Cannot be updated.
@@ -10976,9 +11485,9 @@ spec:
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       prefix:
-                                        description: Optional text to prepend to the
-                                          name of each environment variable. Must
-                                          be a C_IDENTIFIER.
+                                        description: |-
+                                          Optional text to prepend to the name of each environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       secretRef:
                                         description: The Secret to select from
@@ -11648,7 +12157,7 @@ spec:
                                         Claims lists the names of resources, defined in spec.resourceClaims,
                                         that are used by this container.
 
-                                        This is an alpha field and requires enabling the
+                                        This field depends on the
                                         DynamicResourceAllocation feature gate.
 
                                         This field is immutable. It can only be set for containers.
@@ -11704,9 +12213,53 @@ spec:
                                   description: |-
                                     Restart policy for the container to manage the restart behavior of each
                                     container within a pod.
-                                    This may only be set for init containers. You cannot set this field on
-                                    ephemeral containers.
+                                    You cannot set this field on ephemeral containers.
                                   type: string
+                                restartPolicyRules:
+                                  description: |-
+                                    Represents a list of rules to be checked to determine if the
+                                    container should be restarted on exit. You cannot set this field on
+                                    ephemeral containers.
+                                  items:
+                                    description: ContainerRestartRule describes how
+                                      a container exit is handled.
+                                    properties:
+                                      action:
+                                        description: |-
+                                          Specifies the action taken on a container exit if the requirements
+                                          are satisfied. The only possible value is "Restart" to restart the
+                                          container.
+                                        type: string
+                                      exitCodes:
+                                        description: Represents the exit codes to
+                                          check on container exits.
+                                        properties:
+                                          operator:
+                                            description: |-
+                                              Represents the relationship between the container exit code(s) and the
+                                              specified values. Possible values are:
+                                              - In: the requirement is satisfied if the container exit code is in the
+                                                set of specified values.
+                                              - NotIn: the requirement is satisfied if the container exit code is
+                                                not in the set of specified values.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              Specifies the set of values to check for container exit codes.
+                                              At most 255 elements are allowed.
+                                            items:
+                                              format: int32
+                                              type: integer
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        required:
+                                        - operator
+                                        type: object
+                                    required:
+                                    - action
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
                                 securityContext:
                                   description: |-
                                     Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -12248,7 +12801,9 @@ spec:
                           hostNetwork:
                             description: |-
                               Host networking requested for this pod. Use the host's network namespace.
-                              If this option is set, the ports that will be used must be specified.
+                              When using HostNetwork you should specify ports so the scheduler is aware.
+                              When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
+                              and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
                               Default to false.
                             type: boolean
                           hostPID:
@@ -12273,6 +12828,19 @@ spec:
                               Specifies the hostname of the Pod
                               If not specified, the pod's hostname will be set to a system-defined value.
                             type: string
+                          hostnameOverride:
+                            description: |-
+                              HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
+                              This field only specifies the pod's hostname and does not affect its DNS records.
+                              When this field is set to a non-empty string:
+                              - It takes precedence over the values set in `hostname` and `subdomain`.
+                              - The Pod's hostname will be set to this value.
+                              - `setHostnameAsFQDN` must be nil or set to false.
+                              - `hostNetwork` must be set to false.
+
+                              This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
+                              Requires the HostnameOverride feature gate to be enabled.
+                            type: string
                           imagePullSecrets:
                             description: |-
                               ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -12354,8 +12922,9 @@ spec:
                                       variable present in a Container.
                                     properties:
                                       name:
-                                        description: Name of the environment variable.
-                                          Must be a C_IDENTIFIER.
+                                        description: |-
+                                          Name of the environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       value:
                                         description: |-
@@ -12414,6 +12983,43 @@ spec:
                                             - fieldPath
                                             type: object
                                             x-kubernetes-map-type: atomic
+                                          fileKeyRef:
+                                            description: |-
+                                              FileKeyRef selects a key of the env file.
+                                              Requires the EnvFiles feature gate to be enabled.
+                                            properties:
+                                              key:
+                                                description: |-
+                                                  The key within the env file. An invalid key will prevent the pod from starting.
+                                                  The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                  During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                type: string
+                                              optional:
+                                                default: false
+                                                description: |-
+                                                  Specify whether the file or its key must be defined. If the file or key
+                                                  does not exist, then the env var is not published.
+                                                  If optional is set to true and the specified key does not exist,
+                                                  the environment variable will not be set in the Pod's containers.
+
+                                                  If optional is set to false and the specified key does not exist,
+                                                  an error will be returned during Pod creation.
+                                                type: boolean
+                                              path:
+                                                description: |-
+                                                  The path within the volume from which to select the file.
+                                                  Must be relative and may not contain the '..' path or start with '..'.
+                                                type: string
+                                              volumeName:
+                                                description: The name of the volume
+                                                  mount containing the env file.
+                                                type: string
+                                            required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                            type: object
+                                            x-kubernetes-map-type: atomic
                                           resourceFieldRef:
                                             description: |-
                                               Selects a resource of the container: only resources limits and requests
@@ -12477,8 +13083,8 @@ spec:
                                 envFrom:
                                   description: |-
                                     List of sources to populate environment variables in the container.
-                                    The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                    will be reported as an event when the container is starting. When a key exists in multiple
+                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                    When a key exists in multiple
                                     sources, the value associated with the last source will take precedence.
                                     Values defined by an Env with a duplicate key will take precedence.
                                     Cannot be updated.
@@ -12505,9 +13111,9 @@ spec:
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       prefix:
-                                        description: Optional text to prepend to the
-                                          name of each environment variable. Must
-                                          be a C_IDENTIFIER.
+                                        description: |-
+                                          Optional text to prepend to the name of each environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       secretRef:
                                         description: The Secret to select from
@@ -13194,7 +13800,7 @@ spec:
                                         Claims lists the names of resources, defined in spec.resourceClaims,
                                         that are used by this container.
 
-                                        This is an alpha field and requires enabling the
+                                        This field depends on the
                                         DynamicResourceAllocation feature gate.
 
                                         This field is immutable. It can only be set for containers.
@@ -13249,10 +13855,10 @@ spec:
                                 restartPolicy:
                                   description: |-
                                     RestartPolicy defines the restart behavior of individual containers in a pod.
-                                    This field may only be set for init containers, and the only allowed value is "Always".
-                                    For non-init containers or when this field is not specified,
+                                    This overrides the pod-level restart policy. When this field is not specified,
                                     the restart behavior is defined by the Pod's restart policy and the container type.
-                                    Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                    Additionally, setting the RestartPolicy as "Always" for the init container will
+                                    have the following effect:
                                     this init container will be continually restarted on
                                     exit until all regular containers have terminated. Once all regular
                                     containers have completed, all init containers with restartPolicy "Always"
@@ -13264,6 +13870,59 @@ spec:
                                     init container is started, or after any startupProbe has successfully
                                     completed.
                                   type: string
+                                restartPolicyRules:
+                                  description: |-
+                                    Represents a list of rules to be checked to determine if the
+                                    container should be restarted on exit. The rules are evaluated in
+                                    order. Once a rule matches a container exit condition, the remaining
+                                    rules are ignored. If no rule matches the container exit condition,
+                                    the Container-level restart policy determines the whether the container
+                                    is restarted or not. Constraints on the rules:
+                                    - At most 20 rules are allowed.
+                                    - Rules can have the same action.
+                                    - Identical rules are not forbidden in validations.
+                                    When rules are specified, container MUST set RestartPolicy explicitly
+                                    even it if matches the Pod's RestartPolicy.
+                                  items:
+                                    description: ContainerRestartRule describes how
+                                      a container exit is handled.
+                                    properties:
+                                      action:
+                                        description: |-
+                                          Specifies the action taken on a container exit if the requirements
+                                          are satisfied. The only possible value is "Restart" to restart the
+                                          container.
+                                        type: string
+                                      exitCodes:
+                                        description: Represents the exit codes to
+                                          check on container exits.
+                                        properties:
+                                          operator:
+                                            description: |-
+                                              Represents the relationship between the container exit code(s) and the
+                                              specified values. Possible values are:
+                                              - In: the requirement is satisfied if the container exit code is in the
+                                                set of specified values.
+                                              - NotIn: the requirement is satisfied if the container exit code is
+                                                not in the set of specified values.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              Specifies the set of values to check for container exit codes.
+                                              At most 255 elements are allowed.
+                                            items:
+                                              format: int32
+                                              type: integer
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        required:
+                                        - operator
+                                        type: object
+                                    required:
+                                    - action
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
                                 securityContext:
                                   description: |-
                                     SecurityContext defines the security options the container should be run with.
@@ -13799,6 +14458,7 @@ spec:
                               - spec.hostPID
                               - spec.hostIPC
                               - spec.hostUsers
+                              - spec.resources
                               - spec.securityContext.appArmorProfile
                               - spec.securityContext.seLinuxOptions
                               - spec.securityContext.seccompProfile
@@ -13952,7 +14612,7 @@ spec:
                             description: |-
                               Resources is the total amount of CPU and Memory resources required by all
                               containers in the pod. It supports specifying Requests and Limits for
-                              "cpu" and "memory" resource names only. ResourceClaims are not supported.
+                              "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
 
                               This field enables fine-grained control over resource allocation for the
                               entire pod, allowing resource sharing among containers in a pod.
@@ -13965,7 +14625,7 @@ spec:
                                   Claims lists the names of resources, defined in spec.resourceClaims,
                                   that are used by this container.
 
-                                  This is an alpha field and requires enabling the
+                                  This field depends on the
                                   DynamicResourceAllocation feature gate.
 
                                   This field is immutable. It can only be set for containers.
@@ -15264,15 +15924,13 @@ spec:
                                                 volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                                 If specified, the CSI driver will create or update the volume with the attributes defined
                                                 in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                                it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                                will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                                If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                                will be set by the persistentvolume controller if it exists.
+                                                it can be changed after the claim is created. An empty string or nil value indicates that no
+                                                VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                                this field can be reset to its previous value (including nil) to cancel the modification.
                                                 If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                                 set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                                 exists.
                                                 More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                                (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                               type: string
                                             volumeMode:
                                               description: |-
@@ -15457,12 +16115,10 @@ spec:
                                   description: |-
                                     glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                     Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md
                                   properties:
                                     endpoints:
-                                      description: |-
-                                        endpoints is the endpoint name that details Glusterfs topology.
-                                        More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                      description: endpoints is the endpoint name
+                                        that details Glusterfs topology.
                                       type: string
                                     path:
                                       description: |-
@@ -15541,7 +16197,7 @@ spec:
                                   description: |-
                                     iscsi represents an ISCSI Disk resource that is attached to a
                                     kubelet's host machine and then exposed to the pod.
-                                    More info: https://examples.k8s.io/volumes/iscsi/README.md
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                                   properties:
                                     chapAuthDiscovery:
                                       description: chapAuthDiscovery defines whether
@@ -15975,6 +16631,111 @@ spec:
                                                 type: array
                                                 x-kubernetes-list-type: atomic
                                             type: object
+                                          podCertificate:
+                                            description: |-
+                                              Projects an auto-rotating credential bundle (private key and certificate
+                                              chain) that the pod can use either as a TLS client or server.
+
+                                              Kubelet generates a private key and uses it to send a
+                                              PodCertificateRequest to the named signer.  Once the signer approves the
+                                              request and issues a certificate chain, Kubelet writes the key and
+                                              certificate chain to the pod filesystem.  The pod does not start until
+                                              certificates have been issued for each podCertificate projected volume
+                                              source in its spec.
+
+                                              Kubelet will begin trying to rotate the certificate at the time indicated
+                                              by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                              timestamp.
+
+                                              Kubelet can write a single file, indicated by the credentialBundlePath
+                                              field, or separate files, indicated by the keyPath and
+                                              certificateChainPath fields.
+
+                                              The credential bundle is a single file in PEM format.  The first PEM
+                                              entry is the private key (in PKCS#8 format), and the remaining PEM
+                                              entries are the certificate chain issued by the signer (typically,
+                                              signers will return their certificate chain in leaf-to-root order).
+
+                                              Prefer using the credential bundle format, since your application code
+                                              can read it atomically.  If you use keyPath and certificateChainPath,
+                                              your application must make two separate file reads. If these coincide
+                                              with a certificate rotation, it is possible that the private key and leaf
+                                              certificate you read may not correspond to each other.  Your application
+                                              will need to check for this condition, and re-read until they are
+                                              consistent.
+
+                                              The named signer controls chooses the format of the certificate it
+                                              issues; consult the signer implementation's documentation to learn how to
+                                              use the certificates it issues.
+                                            properties:
+                                              certificateChainPath:
+                                                description: |-
+                                                  Write the certificate chain at this path in the projected volume.
+
+                                                  Most applications should use credentialBundlePath.  When using keyPath
+                                                  and certificateChainPath, your application needs to check that the key
+                                                  and leaf certificate are consistent, because it is possible to read the
+                                                  files mid-rotation.
+                                                type: string
+                                              credentialBundlePath:
+                                                description: |-
+                                                  Write the credential bundle at this path in the projected volume.
+
+                                                  The credential bundle is a single file that contains multiple PEM blocks.
+                                                  The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                                  key.
+
+                                                  The remaining blocks are CERTIFICATE blocks, containing the issued
+                                                  certificate chain from the signer (leaf and any intermediates).
+
+                                                  Using credentialBundlePath lets your Pod's application code make a single
+                                                  atomic read that retrieves a consistent key and certificate chain.  If you
+                                                  project them to separate files, your application code will need to
+                                                  additionally check that the leaf certificate was issued to the key.
+                                                type: string
+                                              keyPath:
+                                                description: |-
+                                                  Write the key at this path in the projected volume.
+
+                                                  Most applications should use credentialBundlePath.  When using keyPath
+                                                  and certificateChainPath, your application needs to check that the key
+                                                  and leaf certificate are consistent, because it is possible to read the
+                                                  files mid-rotation.
+                                                type: string
+                                              keyType:
+                                                description: |-
+                                                  The type of keypair Kubelet will generate for the pod.
+
+                                                  Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                                  "ECDSAP521", and "ED25519".
+                                                type: string
+                                              maxExpirationSeconds:
+                                                description: |-
+                                                  maxExpirationSeconds is the maximum lifetime permitted for the
+                                                  certificate.
+
+                                                  Kubelet copies this value verbatim into the PodCertificateRequests it
+                                                  generates for this projection.
+
+                                                  If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                                  will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                                  value is 7862400 (91 days).
+
+                                                  The signer implementation is then free to issue a certificate with any
+                                                  lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                                  seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                                  `kubernetes.io` signers will never issue certificates with a lifetime
+                                                  longer than 24 hours.
+                                                format: int32
+                                                type: integer
+                                              signerName:
+                                                description: Kubelet's generated CSRs
+                                                  will be addressed to this signer.
+                                                type: string
+                                            required:
+                                            - keyType
+                                            - signerName
+                                            type: object
                                           secret:
                                             description: secret information about
                                               the secret data to project
@@ -16112,7 +16873,6 @@ spec:
                                   description: |-
                                     rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                     Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                                    More info: https://examples.k8s.io/volumes/rbd/README.md
                                   properties:
                                     fsType:
                                       description: |-
@@ -16477,7 +17237,8 @@ spec:
                     secretName:
                       description: |-
                         SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                        Elastic resource not managed by the operator. The referenced secret must contain the following:
+                        Elastic resource not managed by the operator.
+                        The referenced secret must contain the following:
                         - `url`: the URL to reach the Elastic resource
                         - `username`: the username of the user to be authenticated to the Elastic resource
                         - `password`: the password of the user to be authenticated to the Elastic resource
@@ -16501,6 +17262,7 @@ spec:
                 description: |-
                   FleetServerRef is a reference to Fleet Server that this Agent should connect to to obtain it's configuration.
                   Don't set unless `mode` is set to `fleet`.
+                  References to Fleet servers running outside the Kubernetes cluster via the `secretName` attribute are not supported.
                 properties:
                   name:
                     description: Name of an existing Kubernetes object corresponding
@@ -16513,7 +17275,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -16964,7 +17727,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -17678,8 +18442,8 @@ spec:
                                       most preferred is the one with the greatest sum of weights, i.e.
                                       for each node that meets all of the scheduling requirements (resource
                                       request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                      compute a sum by iterating through the elements of this field and adding
-                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                      compute a sum by iterating through the elements of this field and subtracting
+                                      "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                       node(s) with the highest sum are the most preferred.
                                     items:
                                       description: The weights of all of the matched
@@ -18079,8 +18843,9 @@ spec:
                                       variable present in a Container.
                                     properties:
                                       name:
-                                        description: Name of the environment variable.
-                                          Must be a C_IDENTIFIER.
+                                        description: |-
+                                          Name of the environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       value:
                                         description: |-
@@ -18139,6 +18904,43 @@ spec:
                                             - fieldPath
                                             type: object
                                             x-kubernetes-map-type: atomic
+                                          fileKeyRef:
+                                            description: |-
+                                              FileKeyRef selects a key of the env file.
+                                              Requires the EnvFiles feature gate to be enabled.
+                                            properties:
+                                              key:
+                                                description: |-
+                                                  The key within the env file. An invalid key will prevent the pod from starting.
+                                                  The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                  During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                type: string
+                                              optional:
+                                                default: false
+                                                description: |-
+                                                  Specify whether the file or its key must be defined. If the file or key
+                                                  does not exist, then the env var is not published.
+                                                  If optional is set to true and the specified key does not exist,
+                                                  the environment variable will not be set in the Pod's containers.
+
+                                                  If optional is set to false and the specified key does not exist,
+                                                  an error will be returned during Pod creation.
+                                                type: boolean
+                                              path:
+                                                description: |-
+                                                  The path within the volume from which to select the file.
+                                                  Must be relative and may not contain the '..' path or start with '..'.
+                                                type: string
+                                              volumeName:
+                                                description: The name of the volume
+                                                  mount containing the env file.
+                                                type: string
+                                            required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                            type: object
+                                            x-kubernetes-map-type: atomic
                                           resourceFieldRef:
                                             description: |-
                                               Selects a resource of the container: only resources limits and requests
@@ -18202,8 +19004,8 @@ spec:
                                 envFrom:
                                   description: |-
                                     List of sources to populate environment variables in the container.
-                                    The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                    will be reported as an event when the container is starting. When a key exists in multiple
+                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                    When a key exists in multiple
                                     sources, the value associated with the last source will take precedence.
                                     Values defined by an Env with a duplicate key will take precedence.
                                     Cannot be updated.
@@ -18230,9 +19032,9 @@ spec:
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       prefix:
-                                        description: Optional text to prepend to the
-                                          name of each environment variable. Must
-                                          be a C_IDENTIFIER.
+                                        description: |-
+                                          Optional text to prepend to the name of each environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       secretRef:
                                         description: The Secret to select from
@@ -18919,7 +19721,7 @@ spec:
                                         Claims lists the names of resources, defined in spec.resourceClaims,
                                         that are used by this container.
 
-                                        This is an alpha field and requires enabling the
+                                        This field depends on the
                                         DynamicResourceAllocation feature gate.
 
                                         This field is immutable. It can only be set for containers.
@@ -18974,10 +19776,10 @@ spec:
                                 restartPolicy:
                                   description: |-
                                     RestartPolicy defines the restart behavior of individual containers in a pod.
-                                    This field may only be set for init containers, and the only allowed value is "Always".
-                                    For non-init containers or when this field is not specified,
+                                    This overrides the pod-level restart policy. When this field is not specified,
                                     the restart behavior is defined by the Pod's restart policy and the container type.
-                                    Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                    Additionally, setting the RestartPolicy as "Always" for the init container will
+                                    have the following effect:
                                     this init container will be continually restarted on
                                     exit until all regular containers have terminated. Once all regular
                                     containers have completed, all init containers with restartPolicy "Always"
@@ -18989,6 +19791,59 @@ spec:
                                     init container is started, or after any startupProbe has successfully
                                     completed.
                                   type: string
+                                restartPolicyRules:
+                                  description: |-
+                                    Represents a list of rules to be checked to determine if the
+                                    container should be restarted on exit. The rules are evaluated in
+                                    order. Once a rule matches a container exit condition, the remaining
+                                    rules are ignored. If no rule matches the container exit condition,
+                                    the Container-level restart policy determines the whether the container
+                                    is restarted or not. Constraints on the rules:
+                                    - At most 20 rules are allowed.
+                                    - Rules can have the same action.
+                                    - Identical rules are not forbidden in validations.
+                                    When rules are specified, container MUST set RestartPolicy explicitly
+                                    even it if matches the Pod's RestartPolicy.
+                                  items:
+                                    description: ContainerRestartRule describes how
+                                      a container exit is handled.
+                                    properties:
+                                      action:
+                                        description: |-
+                                          Specifies the action taken on a container exit if the requirements
+                                          are satisfied. The only possible value is "Restart" to restart the
+                                          container.
+                                        type: string
+                                      exitCodes:
+                                        description: Represents the exit codes to
+                                          check on container exits.
+                                        properties:
+                                          operator:
+                                            description: |-
+                                              Represents the relationship between the container exit code(s) and the
+                                              specified values. Possible values are:
+                                              - In: the requirement is satisfied if the container exit code is in the
+                                                set of specified values.
+                                              - NotIn: the requirement is satisfied if the container exit code is
+                                                not in the set of specified values.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              Specifies the set of values to check for container exit codes.
+                                              At most 255 elements are allowed.
+                                            items:
+                                              format: int32
+                                              type: integer
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        required:
+                                        - operator
+                                        type: object
+                                    required:
+                                    - action
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
                                 securityContext:
                                   description: |-
                                     SecurityContext defines the security options the container should be run with.
@@ -19611,8 +20466,9 @@ spec:
                                       variable present in a Container.
                                     properties:
                                       name:
-                                        description: Name of the environment variable.
-                                          Must be a C_IDENTIFIER.
+                                        description: |-
+                                          Name of the environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       value:
                                         description: |-
@@ -19671,6 +20527,43 @@ spec:
                                             - fieldPath
                                             type: object
                                             x-kubernetes-map-type: atomic
+                                          fileKeyRef:
+                                            description: |-
+                                              FileKeyRef selects a key of the env file.
+                                              Requires the EnvFiles feature gate to be enabled.
+                                            properties:
+                                              key:
+                                                description: |-
+                                                  The key within the env file. An invalid key will prevent the pod from starting.
+                                                  The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                  During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                type: string
+                                              optional:
+                                                default: false
+                                                description: |-
+                                                  Specify whether the file or its key must be defined. If the file or key
+                                                  does not exist, then the env var is not published.
+                                                  If optional is set to true and the specified key does not exist,
+                                                  the environment variable will not be set in the Pod's containers.
+
+                                                  If optional is set to false and the specified key does not exist,
+                                                  an error will be returned during Pod creation.
+                                                type: boolean
+                                              path:
+                                                description: |-
+                                                  The path within the volume from which to select the file.
+                                                  Must be relative and may not contain the '..' path or start with '..'.
+                                                type: string
+                                              volumeName:
+                                                description: The name of the volume
+                                                  mount containing the env file.
+                                                type: string
+                                            required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                            type: object
+                                            x-kubernetes-map-type: atomic
                                           resourceFieldRef:
                                             description: |-
                                               Selects a resource of the container: only resources limits and requests
@@ -19734,8 +20627,8 @@ spec:
                                 envFrom:
                                   description: |-
                                     List of sources to populate environment variables in the container.
-                                    The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                    will be reported as an event when the container is starting. When a key exists in multiple
+                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                    When a key exists in multiple
                                     sources, the value associated with the last source will take precedence.
                                     Values defined by an Env with a duplicate key will take precedence.
                                     Cannot be updated.
@@ -19762,9 +20655,9 @@ spec:
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       prefix:
-                                        description: Optional text to prepend to the
-                                          name of each environment variable. Must
-                                          be a C_IDENTIFIER.
+                                        description: |-
+                                          Optional text to prepend to the name of each environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       secretRef:
                                         description: The Secret to select from
@@ -20434,7 +21327,7 @@ spec:
                                         Claims lists the names of resources, defined in spec.resourceClaims,
                                         that are used by this container.
 
-                                        This is an alpha field and requires enabling the
+                                        This field depends on the
                                         DynamicResourceAllocation feature gate.
 
                                         This field is immutable. It can only be set for containers.
@@ -20490,9 +21383,53 @@ spec:
                                   description: |-
                                     Restart policy for the container to manage the restart behavior of each
                                     container within a pod.
-                                    This may only be set for init containers. You cannot set this field on
-                                    ephemeral containers.
+                                    You cannot set this field on ephemeral containers.
                                   type: string
+                                restartPolicyRules:
+                                  description: |-
+                                    Represents a list of rules to be checked to determine if the
+                                    container should be restarted on exit. You cannot set this field on
+                                    ephemeral containers.
+                                  items:
+                                    description: ContainerRestartRule describes how
+                                      a container exit is handled.
+                                    properties:
+                                      action:
+                                        description: |-
+                                          Specifies the action taken on a container exit if the requirements
+                                          are satisfied. The only possible value is "Restart" to restart the
+                                          container.
+                                        type: string
+                                      exitCodes:
+                                        description: Represents the exit codes to
+                                          check on container exits.
+                                        properties:
+                                          operator:
+                                            description: |-
+                                              Represents the relationship between the container exit code(s) and the
+                                              specified values. Possible values are:
+                                              - In: the requirement is satisfied if the container exit code is in the
+                                                set of specified values.
+                                              - NotIn: the requirement is satisfied if the container exit code is
+                                                not in the set of specified values.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              Specifies the set of values to check for container exit codes.
+                                              At most 255 elements are allowed.
+                                            items:
+                                              format: int32
+                                              type: integer
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        required:
+                                        - operator
+                                        type: object
+                                    required:
+                                    - action
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
                                 securityContext:
                                   description: |-
                                     Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -21034,7 +21971,9 @@ spec:
                           hostNetwork:
                             description: |-
                               Host networking requested for this pod. Use the host's network namespace.
-                              If this option is set, the ports that will be used must be specified.
+                              When using HostNetwork you should specify ports so the scheduler is aware.
+                              When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
+                              and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
                               Default to false.
                             type: boolean
                           hostPID:
@@ -21059,6 +21998,19 @@ spec:
                               Specifies the hostname of the Pod
                               If not specified, the pod's hostname will be set to a system-defined value.
                             type: string
+                          hostnameOverride:
+                            description: |-
+                              HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
+                              This field only specifies the pod's hostname and does not affect its DNS records.
+                              When this field is set to a non-empty string:
+                              - It takes precedence over the values set in `hostname` and `subdomain`.
+                              - The Pod's hostname will be set to this value.
+                              - `setHostnameAsFQDN` must be nil or set to false.
+                              - `hostNetwork` must be set to false.
+
+                              This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
+                              Requires the HostnameOverride feature gate to be enabled.
+                            type: string
                           imagePullSecrets:
                             description: |-
                               ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -21140,8 +22092,9 @@ spec:
                                       variable present in a Container.
                                     properties:
                                       name:
-                                        description: Name of the environment variable.
-                                          Must be a C_IDENTIFIER.
+                                        description: |-
+                                          Name of the environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       value:
                                         description: |-
@@ -21200,6 +22153,43 @@ spec:
                                             - fieldPath
                                             type: object
                                             x-kubernetes-map-type: atomic
+                                          fileKeyRef:
+                                            description: |-
+                                              FileKeyRef selects a key of the env file.
+                                              Requires the EnvFiles feature gate to be enabled.
+                                            properties:
+                                              key:
+                                                description: |-
+                                                  The key within the env file. An invalid key will prevent the pod from starting.
+                                                  The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                  During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                type: string
+                                              optional:
+                                                default: false
+                                                description: |-
+                                                  Specify whether the file or its key must be defined. If the file or key
+                                                  does not exist, then the env var is not published.
+                                                  If optional is set to true and the specified key does not exist,
+                                                  the environment variable will not be set in the Pod's containers.
+
+                                                  If optional is set to false and the specified key does not exist,
+                                                  an error will be returned during Pod creation.
+                                                type: boolean
+                                              path:
+                                                description: |-
+                                                  The path within the volume from which to select the file.
+                                                  Must be relative and may not contain the '..' path or start with '..'.
+                                                type: string
+                                              volumeName:
+                                                description: The name of the volume
+                                                  mount containing the env file.
+                                                type: string
+                                            required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                            type: object
+                                            x-kubernetes-map-type: atomic
                                           resourceFieldRef:
                                             description: |-
                                               Selects a resource of the container: only resources limits and requests
@@ -21263,8 +22253,8 @@ spec:
                                 envFrom:
                                   description: |-
                                     List of sources to populate environment variables in the container.
-                                    The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                    will be reported as an event when the container is starting. When a key exists in multiple
+                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                    When a key exists in multiple
                                     sources, the value associated with the last source will take precedence.
                                     Values defined by an Env with a duplicate key will take precedence.
                                     Cannot be updated.
@@ -21291,9 +22281,9 @@ spec:
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       prefix:
-                                        description: Optional text to prepend to the
-                                          name of each environment variable. Must
-                                          be a C_IDENTIFIER.
+                                        description: |-
+                                          Optional text to prepend to the name of each environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       secretRef:
                                         description: The Secret to select from
@@ -21980,7 +22970,7 @@ spec:
                                         Claims lists the names of resources, defined in spec.resourceClaims,
                                         that are used by this container.
 
-                                        This is an alpha field and requires enabling the
+                                        This field depends on the
                                         DynamicResourceAllocation feature gate.
 
                                         This field is immutable. It can only be set for containers.
@@ -22035,10 +23025,10 @@ spec:
                                 restartPolicy:
                                   description: |-
                                     RestartPolicy defines the restart behavior of individual containers in a pod.
-                                    This field may only be set for init containers, and the only allowed value is "Always".
-                                    For non-init containers or when this field is not specified,
+                                    This overrides the pod-level restart policy. When this field is not specified,
                                     the restart behavior is defined by the Pod's restart policy and the container type.
-                                    Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                    Additionally, setting the RestartPolicy as "Always" for the init container will
+                                    have the following effect:
                                     this init container will be continually restarted on
                                     exit until all regular containers have terminated. Once all regular
                                     containers have completed, all init containers with restartPolicy "Always"
@@ -22050,6 +23040,59 @@ spec:
                                     init container is started, or after any startupProbe has successfully
                                     completed.
                                   type: string
+                                restartPolicyRules:
+                                  description: |-
+                                    Represents a list of rules to be checked to determine if the
+                                    container should be restarted on exit. The rules are evaluated in
+                                    order. Once a rule matches a container exit condition, the remaining
+                                    rules are ignored. If no rule matches the container exit condition,
+                                    the Container-level restart policy determines the whether the container
+                                    is restarted or not. Constraints on the rules:
+                                    - At most 20 rules are allowed.
+                                    - Rules can have the same action.
+                                    - Identical rules are not forbidden in validations.
+                                    When rules are specified, container MUST set RestartPolicy explicitly
+                                    even it if matches the Pod's RestartPolicy.
+                                  items:
+                                    description: ContainerRestartRule describes how
+                                      a container exit is handled.
+                                    properties:
+                                      action:
+                                        description: |-
+                                          Specifies the action taken on a container exit if the requirements
+                                          are satisfied. The only possible value is "Restart" to restart the
+                                          container.
+                                        type: string
+                                      exitCodes:
+                                        description: Represents the exit codes to
+                                          check on container exits.
+                                        properties:
+                                          operator:
+                                            description: |-
+                                              Represents the relationship between the container exit code(s) and the
+                                              specified values. Possible values are:
+                                              - In: the requirement is satisfied if the container exit code is in the
+                                                set of specified values.
+                                              - NotIn: the requirement is satisfied if the container exit code is
+                                                not in the set of specified values.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              Specifies the set of values to check for container exit codes.
+                                              At most 255 elements are allowed.
+                                            items:
+                                              format: int32
+                                              type: integer
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        required:
+                                        - operator
+                                        type: object
+                                    required:
+                                    - action
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
                                 securityContext:
                                   description: |-
                                     SecurityContext defines the security options the container should be run with.
@@ -22585,6 +23628,7 @@ spec:
                               - spec.hostPID
                               - spec.hostIPC
                               - spec.hostUsers
+                              - spec.resources
                               - spec.securityContext.appArmorProfile
                               - spec.securityContext.seLinuxOptions
                               - spec.securityContext.seccompProfile
@@ -22738,7 +23782,7 @@ spec:
                             description: |-
                               Resources is the total amount of CPU and Memory resources required by all
                               containers in the pod. It supports specifying Requests and Limits for
-                              "cpu" and "memory" resource names only. ResourceClaims are not supported.
+                              "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
 
                               This field enables fine-grained control over resource allocation for the
                               entire pod, allowing resource sharing among containers in a pod.
@@ -22751,7 +23795,7 @@ spec:
                                   Claims lists the names of resources, defined in spec.resourceClaims,
                                   that are used by this container.
 
-                                  This is an alpha field and requires enabling the
+                                  This field depends on the
                                   DynamicResourceAllocation feature gate.
 
                                   This field is immutable. It can only be set for containers.
@@ -24050,15 +25094,13 @@ spec:
                                                 volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                                 If specified, the CSI driver will create or update the volume with the attributes defined
                                                 in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                                it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                                will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                                If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                                will be set by the persistentvolume controller if it exists.
+                                                it can be changed after the claim is created. An empty string or nil value indicates that no
+                                                VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                                this field can be reset to its previous value (including nil) to cancel the modification.
                                                 If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                                 set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                                 exists.
                                                 More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                                (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                               type: string
                                             volumeMode:
                                               description: |-
@@ -24243,12 +25285,10 @@ spec:
                                   description: |-
                                     glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                     Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md
                                   properties:
                                     endpoints:
-                                      description: |-
-                                        endpoints is the endpoint name that details Glusterfs topology.
-                                        More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                      description: endpoints is the endpoint name
+                                        that details Glusterfs topology.
                                       type: string
                                     path:
                                       description: |-
@@ -24327,7 +25367,7 @@ spec:
                                   description: |-
                                     iscsi represents an ISCSI Disk resource that is attached to a
                                     kubelet's host machine and then exposed to the pod.
-                                    More info: https://examples.k8s.io/volumes/iscsi/README.md
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                                   properties:
                                     chapAuthDiscovery:
                                       description: chapAuthDiscovery defines whether
@@ -24761,6 +25801,111 @@ spec:
                                                 type: array
                                                 x-kubernetes-list-type: atomic
                                             type: object
+                                          podCertificate:
+                                            description: |-
+                                              Projects an auto-rotating credential bundle (private key and certificate
+                                              chain) that the pod can use either as a TLS client or server.
+
+                                              Kubelet generates a private key and uses it to send a
+                                              PodCertificateRequest to the named signer.  Once the signer approves the
+                                              request and issues a certificate chain, Kubelet writes the key and
+                                              certificate chain to the pod filesystem.  The pod does not start until
+                                              certificates have been issued for each podCertificate projected volume
+                                              source in its spec.
+
+                                              Kubelet will begin trying to rotate the certificate at the time indicated
+                                              by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                              timestamp.
+
+                                              Kubelet can write a single file, indicated by the credentialBundlePath
+                                              field, or separate files, indicated by the keyPath and
+                                              certificateChainPath fields.
+
+                                              The credential bundle is a single file in PEM format.  The first PEM
+                                              entry is the private key (in PKCS#8 format), and the remaining PEM
+                                              entries are the certificate chain issued by the signer (typically,
+                                              signers will return their certificate chain in leaf-to-root order).
+
+                                              Prefer using the credential bundle format, since your application code
+                                              can read it atomically.  If you use keyPath and certificateChainPath,
+                                              your application must make two separate file reads. If these coincide
+                                              with a certificate rotation, it is possible that the private key and leaf
+                                              certificate you read may not correspond to each other.  Your application
+                                              will need to check for this condition, and re-read until they are
+                                              consistent.
+
+                                              The named signer controls chooses the format of the certificate it
+                                              issues; consult the signer implementation's documentation to learn how to
+                                              use the certificates it issues.
+                                            properties:
+                                              certificateChainPath:
+                                                description: |-
+                                                  Write the certificate chain at this path in the projected volume.
+
+                                                  Most applications should use credentialBundlePath.  When using keyPath
+                                                  and certificateChainPath, your application needs to check that the key
+                                                  and leaf certificate are consistent, because it is possible to read the
+                                                  files mid-rotation.
+                                                type: string
+                                              credentialBundlePath:
+                                                description: |-
+                                                  Write the credential bundle at this path in the projected volume.
+
+                                                  The credential bundle is a single file that contains multiple PEM blocks.
+                                                  The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                                  key.
+
+                                                  The remaining blocks are CERTIFICATE blocks, containing the issued
+                                                  certificate chain from the signer (leaf and any intermediates).
+
+                                                  Using credentialBundlePath lets your Pod's application code make a single
+                                                  atomic read that retrieves a consistent key and certificate chain.  If you
+                                                  project them to separate files, your application code will need to
+                                                  additionally check that the leaf certificate was issued to the key.
+                                                type: string
+                                              keyPath:
+                                                description: |-
+                                                  Write the key at this path in the projected volume.
+
+                                                  Most applications should use credentialBundlePath.  When using keyPath
+                                                  and certificateChainPath, your application needs to check that the key
+                                                  and leaf certificate are consistent, because it is possible to read the
+                                                  files mid-rotation.
+                                                type: string
+                                              keyType:
+                                                description: |-
+                                                  The type of keypair Kubelet will generate for the pod.
+
+                                                  Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                                  "ECDSAP521", and "ED25519".
+                                                type: string
+                                              maxExpirationSeconds:
+                                                description: |-
+                                                  maxExpirationSeconds is the maximum lifetime permitted for the
+                                                  certificate.
+
+                                                  Kubelet copies this value verbatim into the PodCertificateRequests it
+                                                  generates for this projection.
+
+                                                  If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                                  will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                                  value is 7862400 (91 days).
+
+                                                  The signer implementation is then free to issue a certificate with any
+                                                  lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                                  seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                                  `kubernetes.io` signers will never issue certificates with a lifetime
+                                                  longer than 24 hours.
+                                                format: int32
+                                                type: integer
+                                              signerName:
+                                                description: Kubelet's generated CSRs
+                                                  will be addressed to this signer.
+                                                type: string
+                                            required:
+                                            - keyType
+                                            - signerName
+                                            type: object
                                           secret:
                                             description: secret information about
                                               the secret data to project
@@ -24898,7 +26043,6 @@ spec:
                                   description: |-
                                     rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                     Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                                    More info: https://examples.k8s.io/volumes/rbd/README.md
                                   properties:
                                     fsType:
                                       description: |-
@@ -25426,15 +26570,13 @@ spec:
                                 volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                 If specified, the CSI driver will create or update the volume with the attributes defined
                                 in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                will be set by the persistentvolume controller if it exists.
+                                it can be changed after the claim is created. An empty string or nil value indicates that no
+                                VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                this field can be reset to its previous value (including nil) to cancel the modification.
                                 If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                 set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                 exists.
                                 More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                               type: string
                             volumeMode:
                               description: |-
@@ -25602,13 +26744,11 @@ spec:
                               description: |-
                                 currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
                                 When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
-                                This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                               type: string
                             modifyVolumeStatus:
                               description: |-
                                 ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
                                 When this is unset, there is no ModifyVolume operation being attempted.
-                                This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                               properties:
                                 status:
                                   description: "status is the status of the ControllerModifyVolume
diff --git a/config/crds/v1/resources/apm.k8s.elastic.co_apmservers.yaml b/config/crds/v1/resources/apm.k8s.elastic.co_apmservers.yaml
index e29e6a128..81569d53d 100644
--- a/config/crds/v1/resources/apm.k8s.elastic.co_apmservers.yaml
+++ b/config/crds/v1/resources/apm.k8s.elastic.co_apmservers.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: apmservers.apm.k8s.elastic.co
 spec:
   group: apm.k8s.elastic.co
@@ -81,7 +81,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -531,7 +532,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -1161,8 +1163,8 @@ spec:
                                   most preferred is the one with the greatest sum of weights, i.e.
                                   for each node that meets all of the scheduling requirements (resource
                                   request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                  compute a sum by iterating through the elements of this field and adding
-                                  "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  compute a sum by iterating through the elements of this field and subtracting
+                                  "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                   node(s) with the highest sum are the most preferred.
                                 items:
                                   description: The weights of all of the matched WeightedPodAffinityTerm
@@ -1560,8 +1562,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -1620,6 +1623,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -1682,8 +1722,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -1710,8 +1750,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -2390,7 +2431,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -2445,10 +2486,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This field may only be set for init containers, and the only allowed value is "Always".
-                                For non-init containers or when this field is not specified,
+                                This overrides the pod-level restart policy. When this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                Additionally, setting the RestartPolicy as "Always" for the init container will
+                                have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -2460,6 +2501,59 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. The rules are evaluated in
+                                order. Once a rule matches a container exit condition, the remaining
+                                rules are ignored. If no rule matches the container exit condition,
+                                the Container-level restart policy determines the whether the container
+                                is restarted or not. Constraints on the rules:
+                                - At most 20 rules are allowed.
+                                - Rules can have the same action.
+                                - Identical rules are not forbidden in validations.
+                                When rules are specified, container MUST set RestartPolicy explicitly
+                                even it if matches the Pod's RestartPolicy.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -3080,8 +3174,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -3140,6 +3235,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -3202,8 +3334,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -3230,8 +3362,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -3890,7 +4023,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -3946,9 +4079,53 @@ spec:
                               description: |-
                                 Restart policy for the container to manage the restart behavior of each
                                 container within a pod.
-                                This may only be set for init containers. You cannot set this field on
-                                ephemeral containers.
+                                You cannot set this field on ephemeral containers.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. You cannot set this field on
+                                ephemeral containers.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -4487,7 +4664,9 @@ spec:
                       hostNetwork:
                         description: |-
                           Host networking requested for this pod. Use the host's network namespace.
-                          If this option is set, the ports that will be used must be specified.
+                          When using HostNetwork you should specify ports so the scheduler is aware.
+                          When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
+                          and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
                           Default to false.
                         type: boolean
                       hostPID:
@@ -4512,6 +4691,19 @@ spec:
                           Specifies the hostname of the Pod
                           If not specified, the pod's hostname will be set to a system-defined value.
                         type: string
+                      hostnameOverride:
+                        description: |-
+                          HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
+                          This field only specifies the pod's hostname and does not affect its DNS records.
+                          When this field is set to a non-empty string:
+                          - It takes precedence over the values set in `hostname` and `subdomain`.
+                          - The Pod's hostname will be set to this value.
+                          - `setHostnameAsFQDN` must be nil or set to false.
+                          - `hostNetwork` must be set to false.
+
+                          This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
+                          Requires the HostnameOverride feature gate to be enabled.
+                        type: string
                       imagePullSecrets:
                         description: |-
                           ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -4593,8 +4785,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -4653,6 +4846,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -4715,8 +4945,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -4743,8 +4973,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -5423,7 +5654,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -5478,10 +5709,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This field may only be set for init containers, and the only allowed value is "Always".
-                                For non-init containers or when this field is not specified,
+                                This overrides the pod-level restart policy. When this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                Additionally, setting the RestartPolicy as "Always" for the init container will
+                                have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -5493,6 +5724,59 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. The rules are evaluated in
+                                order. Once a rule matches a container exit condition, the remaining
+                                rules are ignored. If no rule matches the container exit condition,
+                                the Container-level restart policy determines the whether the container
+                                is restarted or not. Constraints on the rules:
+                                - At most 20 rules are allowed.
+                                - Rules can have the same action.
+                                - Identical rules are not forbidden in validations.
+                                When rules are specified, container MUST set RestartPolicy explicitly
+                                even it if matches the Pod's RestartPolicy.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -6026,6 +6310,7 @@ spec:
                           - spec.hostPID
                           - spec.hostIPC
                           - spec.hostUsers
+                          - spec.resources
                           - spec.securityContext.appArmorProfile
                           - spec.securityContext.seLinuxOptions
                           - spec.securityContext.seccompProfile
@@ -6179,7 +6464,7 @@ spec:
                         description: |-
                           Resources is the total amount of CPU and Memory resources required by all
                           containers in the pod. It supports specifying Requests and Limits for
-                          "cpu" and "memory" resource names only. ResourceClaims are not supported.
+                          "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
 
                           This field enables fine-grained control over resource allocation for the
                           entire pod, allowing resource sharing among containers in a pod.
@@ -6192,7 +6477,7 @@ spec:
                               Claims lists the names of resources, defined in spec.resourceClaims,
                               that are used by this container.
 
-                              This is an alpha field and requires enabling the
+                              This field depends on the
                               DynamicResourceAllocation feature gate.
 
                               This field is immutable. It can only be set for containers.
@@ -7486,15 +7771,13 @@ spec:
                                             volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                             If specified, the CSI driver will create or update the volume with the attributes defined
                                             in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                            it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                            will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                            If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                            will be set by the persistentvolume controller if it exists.
+                                            it can be changed after the claim is created. An empty string or nil value indicates that no
+                                            VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                            this field can be reset to its previous value (including nil) to cancel the modification.
                                             If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                             set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                             exists.
                                             More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                            (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                           type: string
                                         volumeMode:
                                           description: |-
@@ -7676,12 +7959,10 @@ spec:
                               description: |-
                                 glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                 Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                                More info: https://examples.k8s.io/volumes/glusterfs/README.md
                               properties:
                                 endpoints:
-                                  description: |-
-                                    endpoints is the endpoint name that details Glusterfs topology.
-                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                  description: endpoints is the endpoint name that
+                                    details Glusterfs topology.
                                   type: string
                                 path:
                                   description: |-
@@ -7760,7 +8041,7 @@ spec:
                               description: |-
                                 iscsi represents an ISCSI Disk resource that is attached to a
                                 kubelet's host machine and then exposed to the pod.
-                                More info: https://examples.k8s.io/volumes/iscsi/README.md
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                               properties:
                                 chapAuthDiscovery:
                                   description: chapAuthDiscovery defines whether support
@@ -8186,6 +8467,111 @@ spec:
                                             type: array
                                             x-kubernetes-list-type: atomic
                                         type: object
+                                      podCertificate:
+                                        description: |-
+                                          Projects an auto-rotating credential bundle (private key and certificate
+                                          chain) that the pod can use either as a TLS client or server.
+
+                                          Kubelet generates a private key and uses it to send a
+                                          PodCertificateRequest to the named signer.  Once the signer approves the
+                                          request and issues a certificate chain, Kubelet writes the key and
+                                          certificate chain to the pod filesystem.  The pod does not start until
+                                          certificates have been issued for each podCertificate projected volume
+                                          source in its spec.
+
+                                          Kubelet will begin trying to rotate the certificate at the time indicated
+                                          by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                          timestamp.
+
+                                          Kubelet can write a single file, indicated by the credentialBundlePath
+                                          field, or separate files, indicated by the keyPath and
+                                          certificateChainPath fields.
+
+                                          The credential bundle is a single file in PEM format.  The first PEM
+                                          entry is the private key (in PKCS#8 format), and the remaining PEM
+                                          entries are the certificate chain issued by the signer (typically,
+                                          signers will return their certificate chain in leaf-to-root order).
+
+                                          Prefer using the credential bundle format, since your application code
+                                          can read it atomically.  If you use keyPath and certificateChainPath,
+                                          your application must make two separate file reads. If these coincide
+                                          with a certificate rotation, it is possible that the private key and leaf
+                                          certificate you read may not correspond to each other.  Your application
+                                          will need to check for this condition, and re-read until they are
+                                          consistent.
+
+                                          The named signer controls chooses the format of the certificate it
+                                          issues; consult the signer implementation's documentation to learn how to
+                                          use the certificates it issues.
+                                        properties:
+                                          certificateChainPath:
+                                            description: |-
+                                              Write the certificate chain at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          credentialBundlePath:
+                                            description: |-
+                                              Write the credential bundle at this path in the projected volume.
+
+                                              The credential bundle is a single file that contains multiple PEM blocks.
+                                              The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                              key.
+
+                                              The remaining blocks are CERTIFICATE blocks, containing the issued
+                                              certificate chain from the signer (leaf and any intermediates).
+
+                                              Using credentialBundlePath lets your Pod's application code make a single
+                                              atomic read that retrieves a consistent key and certificate chain.  If you
+                                              project them to separate files, your application code will need to
+                                              additionally check that the leaf certificate was issued to the key.
+                                            type: string
+                                          keyPath:
+                                            description: |-
+                                              Write the key at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          keyType:
+                                            description: |-
+                                              The type of keypair Kubelet will generate for the pod.
+
+                                              Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                              "ECDSAP521", and "ED25519".
+                                            type: string
+                                          maxExpirationSeconds:
+                                            description: |-
+                                              maxExpirationSeconds is the maximum lifetime permitted for the
+                                              certificate.
+
+                                              Kubelet copies this value verbatim into the PodCertificateRequests it
+                                              generates for this projection.
+
+                                              If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                              will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                              value is 7862400 (91 days).
+
+                                              The signer implementation is then free to issue a certificate with any
+                                              lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                              seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                              `kubernetes.io` signers will never issue certificates with a lifetime
+                                              longer than 24 hours.
+                                            format: int32
+                                            type: integer
+                                          signerName:
+                                            description: Kubelet's generated CSRs
+                                              will be addressed to this signer.
+                                            type: string
+                                        required:
+                                        - keyType
+                                        - signerName
+                                        type: object
                                       secret:
                                         description: secret information about the
                                           secret data to project
@@ -8320,7 +8706,6 @@ spec:
                               description: |-
                                 rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                 Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                                More info: https://examples.k8s.io/volumes/rbd/README.md
                               properties:
                                 fsType:
                                   description: |-
@@ -9818,8 +10203,8 @@ spec:
                                   most preferred is the one with the greatest sum of weights, i.e.
                                   for each node that meets all of the scheduling requirements (resource
                                   request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                  compute a sum by iterating through the elements of this field and adding
-                                  "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  compute a sum by iterating through the elements of this field and subtracting
+                                  "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                   node(s) with the highest sum are the most preferred.
                                 items:
                                   description: The weights of all of the matched WeightedPodAffinityTerm
@@ -10217,8 +10602,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -10277,6 +10663,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -10339,8 +10762,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -10367,8 +10790,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -11047,7 +11471,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -11102,10 +11526,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This field may only be set for init containers, and the only allowed value is "Always".
-                                For non-init containers or when this field is not specified,
+                                This overrides the pod-level restart policy. When this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                Additionally, setting the RestartPolicy as "Always" for the init container will
+                                have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -11117,6 +11541,59 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. The rules are evaluated in
+                                order. Once a rule matches a container exit condition, the remaining
+                                rules are ignored. If no rule matches the container exit condition,
+                                the Container-level restart policy determines the whether the container
+                                is restarted or not. Constraints on the rules:
+                                - At most 20 rules are allowed.
+                                - Rules can have the same action.
+                                - Identical rules are not forbidden in validations.
+                                When rules are specified, container MUST set RestartPolicy explicitly
+                                even it if matches the Pod's RestartPolicy.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -11737,8 +12214,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -11797,6 +12275,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -11859,8 +12374,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -11887,8 +12402,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -12547,7 +13063,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -12603,9 +13119,53 @@ spec:
                               description: |-
                                 Restart policy for the container to manage the restart behavior of each
                                 container within a pod.
-                                This may only be set for init containers. You cannot set this field on
-                                ephemeral containers.
+                                You cannot set this field on ephemeral containers.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. You cannot set this field on
+                                ephemeral containers.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -13144,7 +13704,9 @@ spec:
                       hostNetwork:
                         description: |-
                           Host networking requested for this pod. Use the host's network namespace.
-                          If this option is set, the ports that will be used must be specified.
+                          When using HostNetwork you should specify ports so the scheduler is aware.
+                          When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
+                          and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
                           Default to false.
                         type: boolean
                       hostPID:
@@ -13169,6 +13731,19 @@ spec:
                           Specifies the hostname of the Pod
                           If not specified, the pod's hostname will be set to a system-defined value.
                         type: string
+                      hostnameOverride:
+                        description: |-
+                          HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
+                          This field only specifies the pod's hostname and does not affect its DNS records.
+                          When this field is set to a non-empty string:
+                          - It takes precedence over the values set in `hostname` and `subdomain`.
+                          - The Pod's hostname will be set to this value.
+                          - `setHostnameAsFQDN` must be nil or set to false.
+                          - `hostNetwork` must be set to false.
+
+                          This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
+                          Requires the HostnameOverride feature gate to be enabled.
+                        type: string
                       imagePullSecrets:
                         description: |-
                           ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -13250,8 +13825,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -13310,6 +13886,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -13372,8 +13985,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -13400,8 +14013,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -14080,7 +14694,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -14135,10 +14749,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This field may only be set for init containers, and the only allowed value is "Always".
-                                For non-init containers or when this field is not specified,
+                                This overrides the pod-level restart policy. When this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                Additionally, setting the RestartPolicy as "Always" for the init container will
+                                have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -14150,6 +14764,59 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. The rules are evaluated in
+                                order. Once a rule matches a container exit condition, the remaining
+                                rules are ignored. If no rule matches the container exit condition,
+                                the Container-level restart policy determines the whether the container
+                                is restarted or not. Constraints on the rules:
+                                - At most 20 rules are allowed.
+                                - Rules can have the same action.
+                                - Identical rules are not forbidden in validations.
+                                When rules are specified, container MUST set RestartPolicy explicitly
+                                even it if matches the Pod's RestartPolicy.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -14683,6 +15350,7 @@ spec:
                           - spec.hostPID
                           - spec.hostIPC
                           - spec.hostUsers
+                          - spec.resources
                           - spec.securityContext.appArmorProfile
                           - spec.securityContext.seLinuxOptions
                           - spec.securityContext.seccompProfile
@@ -14836,7 +15504,7 @@ spec:
                         description: |-
                           Resources is the total amount of CPU and Memory resources required by all
                           containers in the pod. It supports specifying Requests and Limits for
-                          "cpu" and "memory" resource names only. ResourceClaims are not supported.
+                          "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
 
                           This field enables fine-grained control over resource allocation for the
                           entire pod, allowing resource sharing among containers in a pod.
@@ -14849,7 +15517,7 @@ spec:
                               Claims lists the names of resources, defined in spec.resourceClaims,
                               that are used by this container.
 
-                              This is an alpha field and requires enabling the
+                              This field depends on the
                               DynamicResourceAllocation feature gate.
 
                               This field is immutable. It can only be set for containers.
@@ -16143,15 +16811,13 @@ spec:
                                             volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                             If specified, the CSI driver will create or update the volume with the attributes defined
                                             in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                            it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                            will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                            If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                            will be set by the persistentvolume controller if it exists.
+                                            it can be changed after the claim is created. An empty string or nil value indicates that no
+                                            VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                            this field can be reset to its previous value (including nil) to cancel the modification.
                                             If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                             set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                             exists.
                                             More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                            (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                           type: string
                                         volumeMode:
                                           description: |-
@@ -16333,12 +16999,10 @@ spec:
                               description: |-
                                 glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                 Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                                More info: https://examples.k8s.io/volumes/glusterfs/README.md
                               properties:
                                 endpoints:
-                                  description: |-
-                                    endpoints is the endpoint name that details Glusterfs topology.
-                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                  description: endpoints is the endpoint name that
+                                    details Glusterfs topology.
                                   type: string
                                 path:
                                   description: |-
@@ -16417,7 +17081,7 @@ spec:
                               description: |-
                                 iscsi represents an ISCSI Disk resource that is attached to a
                                 kubelet's host machine and then exposed to the pod.
-                                More info: https://examples.k8s.io/volumes/iscsi/README.md
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                               properties:
                                 chapAuthDiscovery:
                                   description: chapAuthDiscovery defines whether support
@@ -16843,6 +17507,111 @@ spec:
                                             type: array
                                             x-kubernetes-list-type: atomic
                                         type: object
+                                      podCertificate:
+                                        description: |-
+                                          Projects an auto-rotating credential bundle (private key and certificate
+                                          chain) that the pod can use either as a TLS client or server.
+
+                                          Kubelet generates a private key and uses it to send a
+                                          PodCertificateRequest to the named signer.  Once the signer approves the
+                                          request and issues a certificate chain, Kubelet writes the key and
+                                          certificate chain to the pod filesystem.  The pod does not start until
+                                          certificates have been issued for each podCertificate projected volume
+                                          source in its spec.
+
+                                          Kubelet will begin trying to rotate the certificate at the time indicated
+                                          by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                          timestamp.
+
+                                          Kubelet can write a single file, indicated by the credentialBundlePath
+                                          field, or separate files, indicated by the keyPath and
+                                          certificateChainPath fields.
+
+                                          The credential bundle is a single file in PEM format.  The first PEM
+                                          entry is the private key (in PKCS#8 format), and the remaining PEM
+                                          entries are the certificate chain issued by the signer (typically,
+                                          signers will return their certificate chain in leaf-to-root order).
+
+                                          Prefer using the credential bundle format, since your application code
+                                          can read it atomically.  If you use keyPath and certificateChainPath,
+                                          your application must make two separate file reads. If these coincide
+                                          with a certificate rotation, it is possible that the private key and leaf
+                                          certificate you read may not correspond to each other.  Your application
+                                          will need to check for this condition, and re-read until they are
+                                          consistent.
+
+                                          The named signer controls chooses the format of the certificate it
+                                          issues; consult the signer implementation's documentation to learn how to
+                                          use the certificates it issues.
+                                        properties:
+                                          certificateChainPath:
+                                            description: |-
+                                              Write the certificate chain at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          credentialBundlePath:
+                                            description: |-
+                                              Write the credential bundle at this path in the projected volume.
+
+                                              The credential bundle is a single file that contains multiple PEM blocks.
+                                              The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                              key.
+
+                                              The remaining blocks are CERTIFICATE blocks, containing the issued
+                                              certificate chain from the signer (leaf and any intermediates).
+
+                                              Using credentialBundlePath lets your Pod's application code make a single
+                                              atomic read that retrieves a consistent key and certificate chain.  If you
+                                              project them to separate files, your application code will need to
+                                              additionally check that the leaf certificate was issued to the key.
+                                            type: string
+                                          keyPath:
+                                            description: |-
+                                              Write the key at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          keyType:
+                                            description: |-
+                                              The type of keypair Kubelet will generate for the pod.
+
+                                              Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                              "ECDSAP521", and "ED25519".
+                                            type: string
+                                          maxExpirationSeconds:
+                                            description: |-
+                                              maxExpirationSeconds is the maximum lifetime permitted for the
+                                              certificate.
+
+                                              Kubelet copies this value verbatim into the PodCertificateRequests it
+                                              generates for this projection.
+
+                                              If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                              will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                              value is 7862400 (91 days).
+
+                                              The signer implementation is then free to issue a certificate with any
+                                              lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                              seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                              `kubernetes.io` signers will never issue certificates with a lifetime
+                                              longer than 24 hours.
+                                            format: int32
+                                            type: integer
+                                          signerName:
+                                            description: Kubelet's generated CSRs
+                                              will be addressed to this signer.
+                                            type: string
+                                        required:
+                                        - keyType
+                                        - signerName
+                                        type: object
                                       secret:
                                         description: secret information about the
                                           secret data to project
@@ -16977,7 +17746,6 @@ spec:
                               description: |-
                                 rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                 Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                                More info: https://examples.k8s.io/volumes/rbd/README.md
                               properties:
                                 fsType:
                                   description: |-
diff --git a/config/crds/v1/resources/autoscaling.k8s.elastic.co_elasticsearchautoscalers.yaml b/config/crds/v1/resources/autoscaling.k8s.elastic.co_elasticsearchautoscalers.yaml
index 45765e7c8..886cc05aa 100644
--- a/config/crds/v1/resources/autoscaling.k8s.elastic.co_elasticsearchautoscalers.yaml
+++ b/config/crds/v1/resources/autoscaling.k8s.elastic.co_elasticsearchautoscalers.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: elasticsearchautoscalers.autoscaling.k8s.elastic.co
 spec:
   group: autoscaling.k8s.elastic.co
diff --git a/config/crds/v1/resources/beat.k8s.elastic.co_beats.yaml b/config/crds/v1/resources/beat.k8s.elastic.co_beats.yaml
index cebc5c508..391dededc 100644
--- a/config/crds/v1/resources/beat.k8s.elastic.co_beats.yaml
+++ b/config/crds/v1/resources/beat.k8s.elastic.co_beats.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: beats.beat.k8s.elastic.co
 spec:
   group: beat.k8s.elastic.co
@@ -702,8 +702,8 @@ spec:
                                       most preferred is the one with the greatest sum of weights, i.e.
                                       for each node that meets all of the scheduling requirements (resource
                                       request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                      compute a sum by iterating through the elements of this field and adding
-                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                      compute a sum by iterating through the elements of this field and subtracting
+                                      "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                       node(s) with the highest sum are the most preferred.
                                     items:
                                       description: The weights of all of the matched
@@ -1103,8 +1103,9 @@ spec:
                                       variable present in a Container.
                                     properties:
                                       name:
-                                        description: Name of the environment variable.
-                                          Must be a C_IDENTIFIER.
+                                        description: |-
+                                          Name of the environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       value:
                                         description: |-
@@ -1163,6 +1164,43 @@ spec:
                                             - fieldPath
                                             type: object
                                             x-kubernetes-map-type: atomic
+                                          fileKeyRef:
+                                            description: |-
+                                              FileKeyRef selects a key of the env file.
+                                              Requires the EnvFiles feature gate to be enabled.
+                                            properties:
+                                              key:
+                                                description: |-
+                                                  The key within the env file. An invalid key will prevent the pod from starting.
+                                                  The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                  During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                type: string
+                                              optional:
+                                                default: false
+                                                description: |-
+                                                  Specify whether the file or its key must be defined. If the file or key
+                                                  does not exist, then the env var is not published.
+                                                  If optional is set to true and the specified key does not exist,
+                                                  the environment variable will not be set in the Pod's containers.
+
+                                                  If optional is set to false and the specified key does not exist,
+                                                  an error will be returned during Pod creation.
+                                                type: boolean
+                                              path:
+                                                description: |-
+                                                  The path within the volume from which to select the file.
+                                                  Must be relative and may not contain the '..' path or start with '..'.
+                                                type: string
+                                              volumeName:
+                                                description: The name of the volume
+                                                  mount containing the env file.
+                                                type: string
+                                            required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                            type: object
+                                            x-kubernetes-map-type: atomic
                                           resourceFieldRef:
                                             description: |-
                                               Selects a resource of the container: only resources limits and requests
@@ -1226,8 +1264,8 @@ spec:
                                 envFrom:
                                   description: |-
                                     List of sources to populate environment variables in the container.
-                                    The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                    will be reported as an event when the container is starting. When a key exists in multiple
+                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                    When a key exists in multiple
                                     sources, the value associated with the last source will take precedence.
                                     Values defined by an Env with a duplicate key will take precedence.
                                     Cannot be updated.
@@ -1254,9 +1292,9 @@ spec:
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       prefix:
-                                        description: Optional text to prepend to the
-                                          name of each environment variable. Must
-                                          be a C_IDENTIFIER.
+                                        description: |-
+                                          Optional text to prepend to the name of each environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       secretRef:
                                         description: The Secret to select from
@@ -1943,7 +1981,7 @@ spec:
                                         Claims lists the names of resources, defined in spec.resourceClaims,
                                         that are used by this container.
 
-                                        This is an alpha field and requires enabling the
+                                        This field depends on the
                                         DynamicResourceAllocation feature gate.
 
                                         This field is immutable. It can only be set for containers.
@@ -1998,10 +2036,10 @@ spec:
                                 restartPolicy:
                                   description: |-
                                     RestartPolicy defines the restart behavior of individual containers in a pod.
-                                    This field may only be set for init containers, and the only allowed value is "Always".
-                                    For non-init containers or when this field is not specified,
+                                    This overrides the pod-level restart policy. When this field is not specified,
                                     the restart behavior is defined by the Pod's restart policy and the container type.
-                                    Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                    Additionally, setting the RestartPolicy as "Always" for the init container will
+                                    have the following effect:
                                     this init container will be continually restarted on
                                     exit until all regular containers have terminated. Once all regular
                                     containers have completed, all init containers with restartPolicy "Always"
@@ -2013,6 +2051,59 @@ spec:
                                     init container is started, or after any startupProbe has successfully
                                     completed.
                                   type: string
+                                restartPolicyRules:
+                                  description: |-
+                                    Represents a list of rules to be checked to determine if the
+                                    container should be restarted on exit. The rules are evaluated in
+                                    order. Once a rule matches a container exit condition, the remaining
+                                    rules are ignored. If no rule matches the container exit condition,
+                                    the Container-level restart policy determines the whether the container
+                                    is restarted or not. Constraints on the rules:
+                                    - At most 20 rules are allowed.
+                                    - Rules can have the same action.
+                                    - Identical rules are not forbidden in validations.
+                                    When rules are specified, container MUST set RestartPolicy explicitly
+                                    even it if matches the Pod's RestartPolicy.
+                                  items:
+                                    description: ContainerRestartRule describes how
+                                      a container exit is handled.
+                                    properties:
+                                      action:
+                                        description: |-
+                                          Specifies the action taken on a container exit if the requirements
+                                          are satisfied. The only possible value is "Restart" to restart the
+                                          container.
+                                        type: string
+                                      exitCodes:
+                                        description: Represents the exit codes to
+                                          check on container exits.
+                                        properties:
+                                          operator:
+                                            description: |-
+                                              Represents the relationship between the container exit code(s) and the
+                                              specified values. Possible values are:
+                                              - In: the requirement is satisfied if the container exit code is in the
+                                                set of specified values.
+                                              - NotIn: the requirement is satisfied if the container exit code is
+                                                not in the set of specified values.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              Specifies the set of values to check for container exit codes.
+                                              At most 255 elements are allowed.
+                                            items:
+                                              format: int32
+                                              type: integer
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        required:
+                                        - operator
+                                        type: object
+                                    required:
+                                    - action
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
                                 securityContext:
                                   description: |-
                                     SecurityContext defines the security options the container should be run with.
@@ -2635,8 +2726,9 @@ spec:
                                       variable present in a Container.
                                     properties:
                                       name:
-                                        description: Name of the environment variable.
-                                          Must be a C_IDENTIFIER.
+                                        description: |-
+                                          Name of the environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       value:
                                         description: |-
@@ -2695,6 +2787,43 @@ spec:
                                             - fieldPath
                                             type: object
                                             x-kubernetes-map-type: atomic
+                                          fileKeyRef:
+                                            description: |-
+                                              FileKeyRef selects a key of the env file.
+                                              Requires the EnvFiles feature gate to be enabled.
+                                            properties:
+                                              key:
+                                                description: |-
+                                                  The key within the env file. An invalid key will prevent the pod from starting.
+                                                  The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                  During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                type: string
+                                              optional:
+                                                default: false
+                                                description: |-
+                                                  Specify whether the file or its key must be defined. If the file or key
+                                                  does not exist, then the env var is not published.
+                                                  If optional is set to true and the specified key does not exist,
+                                                  the environment variable will not be set in the Pod's containers.
+
+                                                  If optional is set to false and the specified key does not exist,
+                                                  an error will be returned during Pod creation.
+                                                type: boolean
+                                              path:
+                                                description: |-
+                                                  The path within the volume from which to select the file.
+                                                  Must be relative and may not contain the '..' path or start with '..'.
+                                                type: string
+                                              volumeName:
+                                                description: The name of the volume
+                                                  mount containing the env file.
+                                                type: string
+                                            required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                            type: object
+                                            x-kubernetes-map-type: atomic
                                           resourceFieldRef:
                                             description: |-
                                               Selects a resource of the container: only resources limits and requests
@@ -2758,8 +2887,8 @@ spec:
                                 envFrom:
                                   description: |-
                                     List of sources to populate environment variables in the container.
-                                    The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                    will be reported as an event when the container is starting. When a key exists in multiple
+                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                    When a key exists in multiple
                                     sources, the value associated with the last source will take precedence.
                                     Values defined by an Env with a duplicate key will take precedence.
                                     Cannot be updated.
@@ -2786,9 +2915,9 @@ spec:
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       prefix:
-                                        description: Optional text to prepend to the
-                                          name of each environment variable. Must
-                                          be a C_IDENTIFIER.
+                                        description: |-
+                                          Optional text to prepend to the name of each environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       secretRef:
                                         description: The Secret to select from
@@ -3458,7 +3587,7 @@ spec:
                                         Claims lists the names of resources, defined in spec.resourceClaims,
                                         that are used by this container.
 
-                                        This is an alpha field and requires enabling the
+                                        This field depends on the
                                         DynamicResourceAllocation feature gate.
 
                                         This field is immutable. It can only be set for containers.
@@ -3514,9 +3643,53 @@ spec:
                                   description: |-
                                     Restart policy for the container to manage the restart behavior of each
                                     container within a pod.
-                                    This may only be set for init containers. You cannot set this field on
-                                    ephemeral containers.
+                                    You cannot set this field on ephemeral containers.
                                   type: string
+                                restartPolicyRules:
+                                  description: |-
+                                    Represents a list of rules to be checked to determine if the
+                                    container should be restarted on exit. You cannot set this field on
+                                    ephemeral containers.
+                                  items:
+                                    description: ContainerRestartRule describes how
+                                      a container exit is handled.
+                                    properties:
+                                      action:
+                                        description: |-
+                                          Specifies the action taken on a container exit if the requirements
+                                          are satisfied. The only possible value is "Restart" to restart the
+                                          container.
+                                        type: string
+                                      exitCodes:
+                                        description: Represents the exit codes to
+                                          check on container exits.
+                                        properties:
+                                          operator:
+                                            description: |-
+                                              Represents the relationship between the container exit code(s) and the
+                                              specified values. Possible values are:
+                                              - In: the requirement is satisfied if the container exit code is in the
+                                                set of specified values.
+                                              - NotIn: the requirement is satisfied if the container exit code is
+                                                not in the set of specified values.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              Specifies the set of values to check for container exit codes.
+                                              At most 255 elements are allowed.
+                                            items:
+                                              format: int32
+                                              type: integer
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        required:
+                                        - operator
+                                        type: object
+                                    required:
+                                    - action
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
                                 securityContext:
                                   description: |-
                                     Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -4058,7 +4231,9 @@ spec:
                           hostNetwork:
                             description: |-
                               Host networking requested for this pod. Use the host's network namespace.
-                              If this option is set, the ports that will be used must be specified.
+                              When using HostNetwork you should specify ports so the scheduler is aware.
+                              When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
+                              and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
                               Default to false.
                             type: boolean
                           hostPID:
@@ -4083,6 +4258,19 @@ spec:
                               Specifies the hostname of the Pod
                               If not specified, the pod's hostname will be set to a system-defined value.
                             type: string
+                          hostnameOverride:
+                            description: |-
+                              HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
+                              This field only specifies the pod's hostname and does not affect its DNS records.
+                              When this field is set to a non-empty string:
+                              - It takes precedence over the values set in `hostname` and `subdomain`.
+                              - The Pod's hostname will be set to this value.
+                              - `setHostnameAsFQDN` must be nil or set to false.
+                              - `hostNetwork` must be set to false.
+
+                              This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
+                              Requires the HostnameOverride feature gate to be enabled.
+                            type: string
                           imagePullSecrets:
                             description: |-
                               ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -4164,8 +4352,9 @@ spec:
                                       variable present in a Container.
                                     properties:
                                       name:
-                                        description: Name of the environment variable.
-                                          Must be a C_IDENTIFIER.
+                                        description: |-
+                                          Name of the environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       value:
                                         description: |-
@@ -4224,6 +4413,43 @@ spec:
                                             - fieldPath
                                             type: object
                                             x-kubernetes-map-type: atomic
+                                          fileKeyRef:
+                                            description: |-
+                                              FileKeyRef selects a key of the env file.
+                                              Requires the EnvFiles feature gate to be enabled.
+                                            properties:
+                                              key:
+                                                description: |-
+                                                  The key within the env file. An invalid key will prevent the pod from starting.
+                                                  The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                  During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                type: string
+                                              optional:
+                                                default: false
+                                                description: |-
+                                                  Specify whether the file or its key must be defined. If the file or key
+                                                  does not exist, then the env var is not published.
+                                                  If optional is set to true and the specified key does not exist,
+                                                  the environment variable will not be set in the Pod's containers.
+
+                                                  If optional is set to false and the specified key does not exist,
+                                                  an error will be returned during Pod creation.
+                                                type: boolean
+                                              path:
+                                                description: |-
+                                                  The path within the volume from which to select the file.
+                                                  Must be relative and may not contain the '..' path or start with '..'.
+                                                type: string
+                                              volumeName:
+                                                description: The name of the volume
+                                                  mount containing the env file.
+                                                type: string
+                                            required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                            type: object
+                                            x-kubernetes-map-type: atomic
                                           resourceFieldRef:
                                             description: |-
                                               Selects a resource of the container: only resources limits and requests
@@ -4287,8 +4513,8 @@ spec:
                                 envFrom:
                                   description: |-
                                     List of sources to populate environment variables in the container.
-                                    The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                    will be reported as an event when the container is starting. When a key exists in multiple
+                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                    When a key exists in multiple
                                     sources, the value associated with the last source will take precedence.
                                     Values defined by an Env with a duplicate key will take precedence.
                                     Cannot be updated.
@@ -4315,9 +4541,9 @@ spec:
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       prefix:
-                                        description: Optional text to prepend to the
-                                          name of each environment variable. Must
-                                          be a C_IDENTIFIER.
+                                        description: |-
+                                          Optional text to prepend to the name of each environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       secretRef:
                                         description: The Secret to select from
@@ -5004,7 +5230,7 @@ spec:
                                         Claims lists the names of resources, defined in spec.resourceClaims,
                                         that are used by this container.
 
-                                        This is an alpha field and requires enabling the
+                                        This field depends on the
                                         DynamicResourceAllocation feature gate.
 
                                         This field is immutable. It can only be set for containers.
@@ -5059,10 +5285,10 @@ spec:
                                 restartPolicy:
                                   description: |-
                                     RestartPolicy defines the restart behavior of individual containers in a pod.
-                                    This field may only be set for init containers, and the only allowed value is "Always".
-                                    For non-init containers or when this field is not specified,
+                                    This overrides the pod-level restart policy. When this field is not specified,
                                     the restart behavior is defined by the Pod's restart policy and the container type.
-                                    Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                    Additionally, setting the RestartPolicy as "Always" for the init container will
+                                    have the following effect:
                                     this init container will be continually restarted on
                                     exit until all regular containers have terminated. Once all regular
                                     containers have completed, all init containers with restartPolicy "Always"
@@ -5074,6 +5300,59 @@ spec:
                                     init container is started, or after any startupProbe has successfully
                                     completed.
                                   type: string
+                                restartPolicyRules:
+                                  description: |-
+                                    Represents a list of rules to be checked to determine if the
+                                    container should be restarted on exit. The rules are evaluated in
+                                    order. Once a rule matches a container exit condition, the remaining
+                                    rules are ignored. If no rule matches the container exit condition,
+                                    the Container-level restart policy determines the whether the container
+                                    is restarted or not. Constraints on the rules:
+                                    - At most 20 rules are allowed.
+                                    - Rules can have the same action.
+                                    - Identical rules are not forbidden in validations.
+                                    When rules are specified, container MUST set RestartPolicy explicitly
+                                    even it if matches the Pod's RestartPolicy.
+                                  items:
+                                    description: ContainerRestartRule describes how
+                                      a container exit is handled.
+                                    properties:
+                                      action:
+                                        description: |-
+                                          Specifies the action taken on a container exit if the requirements
+                                          are satisfied. The only possible value is "Restart" to restart the
+                                          container.
+                                        type: string
+                                      exitCodes:
+                                        description: Represents the exit codes to
+                                          check on container exits.
+                                        properties:
+                                          operator:
+                                            description: |-
+                                              Represents the relationship between the container exit code(s) and the
+                                              specified values. Possible values are:
+                                              - In: the requirement is satisfied if the container exit code is in the
+                                                set of specified values.
+                                              - NotIn: the requirement is satisfied if the container exit code is
+                                                not in the set of specified values.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              Specifies the set of values to check for container exit codes.
+                                              At most 255 elements are allowed.
+                                            items:
+                                              format: int32
+                                              type: integer
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        required:
+                                        - operator
+                                        type: object
+                                    required:
+                                    - action
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
                                 securityContext:
                                   description: |-
                                     SecurityContext defines the security options the container should be run with.
@@ -5609,6 +5888,7 @@ spec:
                               - spec.hostPID
                               - spec.hostIPC
                               - spec.hostUsers
+                              - spec.resources
                               - spec.securityContext.appArmorProfile
                               - spec.securityContext.seLinuxOptions
                               - spec.securityContext.seccompProfile
@@ -5762,7 +6042,7 @@ spec:
                             description: |-
                               Resources is the total amount of CPU and Memory resources required by all
                               containers in the pod. It supports specifying Requests and Limits for
-                              "cpu" and "memory" resource names only. ResourceClaims are not supported.
+                              "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
 
                               This field enables fine-grained control over resource allocation for the
                               entire pod, allowing resource sharing among containers in a pod.
@@ -5775,7 +6055,7 @@ spec:
                                   Claims lists the names of resources, defined in spec.resourceClaims,
                                   that are used by this container.
 
-                                  This is an alpha field and requires enabling the
+                                  This field depends on the
                                   DynamicResourceAllocation feature gate.
 
                                   This field is immutable. It can only be set for containers.
@@ -7074,15 +7354,13 @@ spec:
                                                 volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                                 If specified, the CSI driver will create or update the volume with the attributes defined
                                                 in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                                it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                                will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                                If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                                will be set by the persistentvolume controller if it exists.
+                                                it can be changed after the claim is created. An empty string or nil value indicates that no
+                                                VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                                this field can be reset to its previous value (including nil) to cancel the modification.
                                                 If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                                 set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                                 exists.
                                                 More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                                (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                               type: string
                                             volumeMode:
                                               description: |-
@@ -7267,12 +7545,10 @@ spec:
                                   description: |-
                                     glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                     Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md
                                   properties:
                                     endpoints:
-                                      description: |-
-                                        endpoints is the endpoint name that details Glusterfs topology.
-                                        More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                      description: endpoints is the endpoint name
+                                        that details Glusterfs topology.
                                       type: string
                                     path:
                                       description: |-
@@ -7351,7 +7627,7 @@ spec:
                                   description: |-
                                     iscsi represents an ISCSI Disk resource that is attached to a
                                     kubelet's host machine and then exposed to the pod.
-                                    More info: https://examples.k8s.io/volumes/iscsi/README.md
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                                   properties:
                                     chapAuthDiscovery:
                                       description: chapAuthDiscovery defines whether
@@ -7785,6 +8061,111 @@ spec:
                                                 type: array
                                                 x-kubernetes-list-type: atomic
                                             type: object
+                                          podCertificate:
+                                            description: |-
+                                              Projects an auto-rotating credential bundle (private key and certificate
+                                              chain) that the pod can use either as a TLS client or server.
+
+                                              Kubelet generates a private key and uses it to send a
+                                              PodCertificateRequest to the named signer.  Once the signer approves the
+                                              request and issues a certificate chain, Kubelet writes the key and
+                                              certificate chain to the pod filesystem.  The pod does not start until
+                                              certificates have been issued for each podCertificate projected volume
+                                              source in its spec.
+
+                                              Kubelet will begin trying to rotate the certificate at the time indicated
+                                              by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                              timestamp.
+
+                                              Kubelet can write a single file, indicated by the credentialBundlePath
+                                              field, or separate files, indicated by the keyPath and
+                                              certificateChainPath fields.
+
+                                              The credential bundle is a single file in PEM format.  The first PEM
+                                              entry is the private key (in PKCS#8 format), and the remaining PEM
+                                              entries are the certificate chain issued by the signer (typically,
+                                              signers will return their certificate chain in leaf-to-root order).
+
+                                              Prefer using the credential bundle format, since your application code
+                                              can read it atomically.  If you use keyPath and certificateChainPath,
+                                              your application must make two separate file reads. If these coincide
+                                              with a certificate rotation, it is possible that the private key and leaf
+                                              certificate you read may not correspond to each other.  Your application
+                                              will need to check for this condition, and re-read until they are
+                                              consistent.
+
+                                              The named signer controls chooses the format of the certificate it
+                                              issues; consult the signer implementation's documentation to learn how to
+                                              use the certificates it issues.
+                                            properties:
+                                              certificateChainPath:
+                                                description: |-
+                                                  Write the certificate chain at this path in the projected volume.
+
+                                                  Most applications should use credentialBundlePath.  When using keyPath
+                                                  and certificateChainPath, your application needs to check that the key
+                                                  and leaf certificate are consistent, because it is possible to read the
+                                                  files mid-rotation.
+                                                type: string
+                                              credentialBundlePath:
+                                                description: |-
+                                                  Write the credential bundle at this path in the projected volume.
+
+                                                  The credential bundle is a single file that contains multiple PEM blocks.
+                                                  The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                                  key.
+
+                                                  The remaining blocks are CERTIFICATE blocks, containing the issued
+                                                  certificate chain from the signer (leaf and any intermediates).
+
+                                                  Using credentialBundlePath lets your Pod's application code make a single
+                                                  atomic read that retrieves a consistent key and certificate chain.  If you
+                                                  project them to separate files, your application code will need to
+                                                  additionally check that the leaf certificate was issued to the key.
+                                                type: string
+                                              keyPath:
+                                                description: |-
+                                                  Write the key at this path in the projected volume.
+
+                                                  Most applications should use credentialBundlePath.  When using keyPath
+                                                  and certificateChainPath, your application needs to check that the key
+                                                  and leaf certificate are consistent, because it is possible to read the
+                                                  files mid-rotation.
+                                                type: string
+                                              keyType:
+                                                description: |-
+                                                  The type of keypair Kubelet will generate for the pod.
+
+                                                  Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                                  "ECDSAP521", and "ED25519".
+                                                type: string
+                                              maxExpirationSeconds:
+                                                description: |-
+                                                  maxExpirationSeconds is the maximum lifetime permitted for the
+                                                  certificate.
+
+                                                  Kubelet copies this value verbatim into the PodCertificateRequests it
+                                                  generates for this projection.
+
+                                                  If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                                  will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                                  value is 7862400 (91 days).
+
+                                                  The signer implementation is then free to issue a certificate with any
+                                                  lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                                  seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                                  `kubernetes.io` signers will never issue certificates with a lifetime
+                                                  longer than 24 hours.
+                                                format: int32
+                                                type: integer
+                                              signerName:
+                                                description: Kubelet's generated CSRs
+                                                  will be addressed to this signer.
+                                                type: string
+                                            required:
+                                            - keyType
+                                            - signerName
+                                            type: object
                                           secret:
                                             description: secret information about
                                               the secret data to project
@@ -7922,7 +8303,6 @@ spec:
                                   description: |-
                                     rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                     Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                                    More info: https://examples.k8s.io/volumes/rbd/README.md
                                   properties:
                                     fsType:
                                       description: |-
@@ -8242,7 +8622,7 @@ spec:
                               pod is available (Ready for at least minReadySeconds) the old DaemonSet pod
                               on that node is marked deleted. If the old pod becomes unavailable for any
                               reason (Ready transitions to false, is evicted, or is drained) an updated
-                              pod is immediatedly created on that node without considering surge limits.
+                              pod is immediately created on that node without considering surge limits.
                               Allowing surge implies the possibility that the resources consumed by the
                               daemonset on any given node can double if the readiness check fails, and
                               so resource intensive daemonsets should take into account that they may
@@ -8896,8 +9276,8 @@ spec:
                                       most preferred is the one with the greatest sum of weights, i.e.
                                       for each node that meets all of the scheduling requirements (resource
                                       request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                      compute a sum by iterating through the elements of this field and adding
-                                      "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                      compute a sum by iterating through the elements of this field and subtracting
+                                      "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                       node(s) with the highest sum are the most preferred.
                                     items:
                                       description: The weights of all of the matched
@@ -9297,8 +9677,9 @@ spec:
                                       variable present in a Container.
                                     properties:
                                       name:
-                                        description: Name of the environment variable.
-                                          Must be a C_IDENTIFIER.
+                                        description: |-
+                                          Name of the environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       value:
                                         description: |-
@@ -9357,6 +9738,43 @@ spec:
                                             - fieldPath
                                             type: object
                                             x-kubernetes-map-type: atomic
+                                          fileKeyRef:
+                                            description: |-
+                                              FileKeyRef selects a key of the env file.
+                                              Requires the EnvFiles feature gate to be enabled.
+                                            properties:
+                                              key:
+                                                description: |-
+                                                  The key within the env file. An invalid key will prevent the pod from starting.
+                                                  The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                  During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                type: string
+                                              optional:
+                                                default: false
+                                                description: |-
+                                                  Specify whether the file or its key must be defined. If the file or key
+                                                  does not exist, then the env var is not published.
+                                                  If optional is set to true and the specified key does not exist,
+                                                  the environment variable will not be set in the Pod's containers.
+
+                                                  If optional is set to false and the specified key does not exist,
+                                                  an error will be returned during Pod creation.
+                                                type: boolean
+                                              path:
+                                                description: |-
+                                                  The path within the volume from which to select the file.
+                                                  Must be relative and may not contain the '..' path or start with '..'.
+                                                type: string
+                                              volumeName:
+                                                description: The name of the volume
+                                                  mount containing the env file.
+                                                type: string
+                                            required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                            type: object
+                                            x-kubernetes-map-type: atomic
                                           resourceFieldRef:
                                             description: |-
                                               Selects a resource of the container: only resources limits and requests
@@ -9420,8 +9838,8 @@ spec:
                                 envFrom:
                                   description: |-
                                     List of sources to populate environment variables in the container.
-                                    The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                    will be reported as an event when the container is starting. When a key exists in multiple
+                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                    When a key exists in multiple
                                     sources, the value associated with the last source will take precedence.
                                     Values defined by an Env with a duplicate key will take precedence.
                                     Cannot be updated.
@@ -9448,9 +9866,9 @@ spec:
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       prefix:
-                                        description: Optional text to prepend to the
-                                          name of each environment variable. Must
-                                          be a C_IDENTIFIER.
+                                        description: |-
+                                          Optional text to prepend to the name of each environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       secretRef:
                                         description: The Secret to select from
@@ -10137,7 +10555,7 @@ spec:
                                         Claims lists the names of resources, defined in spec.resourceClaims,
                                         that are used by this container.
 
-                                        This is an alpha field and requires enabling the
+                                        This field depends on the
                                         DynamicResourceAllocation feature gate.
 
                                         This field is immutable. It can only be set for containers.
@@ -10192,10 +10610,10 @@ spec:
                                 restartPolicy:
                                   description: |-
                                     RestartPolicy defines the restart behavior of individual containers in a pod.
-                                    This field may only be set for init containers, and the only allowed value is "Always".
-                                    For non-init containers or when this field is not specified,
+                                    This overrides the pod-level restart policy. When this field is not specified,
                                     the restart behavior is defined by the Pod's restart policy and the container type.
-                                    Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                    Additionally, setting the RestartPolicy as "Always" for the init container will
+                                    have the following effect:
                                     this init container will be continually restarted on
                                     exit until all regular containers have terminated. Once all regular
                                     containers have completed, all init containers with restartPolicy "Always"
@@ -10207,6 +10625,59 @@ spec:
                                     init container is started, or after any startupProbe has successfully
                                     completed.
                                   type: string
+                                restartPolicyRules:
+                                  description: |-
+                                    Represents a list of rules to be checked to determine if the
+                                    container should be restarted on exit. The rules are evaluated in
+                                    order. Once a rule matches a container exit condition, the remaining
+                                    rules are ignored. If no rule matches the container exit condition,
+                                    the Container-level restart policy determines the whether the container
+                                    is restarted or not. Constraints on the rules:
+                                    - At most 20 rules are allowed.
+                                    - Rules can have the same action.
+                                    - Identical rules are not forbidden in validations.
+                                    When rules are specified, container MUST set RestartPolicy explicitly
+                                    even it if matches the Pod's RestartPolicy.
+                                  items:
+                                    description: ContainerRestartRule describes how
+                                      a container exit is handled.
+                                    properties:
+                                      action:
+                                        description: |-
+                                          Specifies the action taken on a container exit if the requirements
+                                          are satisfied. The only possible value is "Restart" to restart the
+                                          container.
+                                        type: string
+                                      exitCodes:
+                                        description: Represents the exit codes to
+                                          check on container exits.
+                                        properties:
+                                          operator:
+                                            description: |-
+                                              Represents the relationship between the container exit code(s) and the
+                                              specified values. Possible values are:
+                                              - In: the requirement is satisfied if the container exit code is in the
+                                                set of specified values.
+                                              - NotIn: the requirement is satisfied if the container exit code is
+                                                not in the set of specified values.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              Specifies the set of values to check for container exit codes.
+                                              At most 255 elements are allowed.
+                                            items:
+                                              format: int32
+                                              type: integer
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        required:
+                                        - operator
+                                        type: object
+                                    required:
+                                    - action
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
                                 securityContext:
                                   description: |-
                                     SecurityContext defines the security options the container should be run with.
@@ -10829,8 +11300,9 @@ spec:
                                       variable present in a Container.
                                     properties:
                                       name:
-                                        description: Name of the environment variable.
-                                          Must be a C_IDENTIFIER.
+                                        description: |-
+                                          Name of the environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       value:
                                         description: |-
@@ -10889,6 +11361,43 @@ spec:
                                             - fieldPath
                                             type: object
                                             x-kubernetes-map-type: atomic
+                                          fileKeyRef:
+                                            description: |-
+                                              FileKeyRef selects a key of the env file.
+                                              Requires the EnvFiles feature gate to be enabled.
+                                            properties:
+                                              key:
+                                                description: |-
+                                                  The key within the env file. An invalid key will prevent the pod from starting.
+                                                  The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                  During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                type: string
+                                              optional:
+                                                default: false
+                                                description: |-
+                                                  Specify whether the file or its key must be defined. If the file or key
+                                                  does not exist, then the env var is not published.
+                                                  If optional is set to true and the specified key does not exist,
+                                                  the environment variable will not be set in the Pod's containers.
+
+                                                  If optional is set to false and the specified key does not exist,
+                                                  an error will be returned during Pod creation.
+                                                type: boolean
+                                              path:
+                                                description: |-
+                                                  The path within the volume from which to select the file.
+                                                  Must be relative and may not contain the '..' path or start with '..'.
+                                                type: string
+                                              volumeName:
+                                                description: The name of the volume
+                                                  mount containing the env file.
+                                                type: string
+                                            required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                            type: object
+                                            x-kubernetes-map-type: atomic
                                           resourceFieldRef:
                                             description: |-
                                               Selects a resource of the container: only resources limits and requests
@@ -10952,8 +11461,8 @@ spec:
                                 envFrom:
                                   description: |-
                                     List of sources to populate environment variables in the container.
-                                    The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                    will be reported as an event when the container is starting. When a key exists in multiple
+                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                    When a key exists in multiple
                                     sources, the value associated with the last source will take precedence.
                                     Values defined by an Env with a duplicate key will take precedence.
                                     Cannot be updated.
@@ -10980,9 +11489,9 @@ spec:
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       prefix:
-                                        description: Optional text to prepend to the
-                                          name of each environment variable. Must
-                                          be a C_IDENTIFIER.
+                                        description: |-
+                                          Optional text to prepend to the name of each environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       secretRef:
                                         description: The Secret to select from
@@ -11652,7 +12161,7 @@ spec:
                                         Claims lists the names of resources, defined in spec.resourceClaims,
                                         that are used by this container.
 
-                                        This is an alpha field and requires enabling the
+                                        This field depends on the
                                         DynamicResourceAllocation feature gate.
 
                                         This field is immutable. It can only be set for containers.
@@ -11708,9 +12217,53 @@ spec:
                                   description: |-
                                     Restart policy for the container to manage the restart behavior of each
                                     container within a pod.
-                                    This may only be set for init containers. You cannot set this field on
-                                    ephemeral containers.
+                                    You cannot set this field on ephemeral containers.
                                   type: string
+                                restartPolicyRules:
+                                  description: |-
+                                    Represents a list of rules to be checked to determine if the
+                                    container should be restarted on exit. You cannot set this field on
+                                    ephemeral containers.
+                                  items:
+                                    description: ContainerRestartRule describes how
+                                      a container exit is handled.
+                                    properties:
+                                      action:
+                                        description: |-
+                                          Specifies the action taken on a container exit if the requirements
+                                          are satisfied. The only possible value is "Restart" to restart the
+                                          container.
+                                        type: string
+                                      exitCodes:
+                                        description: Represents the exit codes to
+                                          check on container exits.
+                                        properties:
+                                          operator:
+                                            description: |-
+                                              Represents the relationship between the container exit code(s) and the
+                                              specified values. Possible values are:
+                                              - In: the requirement is satisfied if the container exit code is in the
+                                                set of specified values.
+                                              - NotIn: the requirement is satisfied if the container exit code is
+                                                not in the set of specified values.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              Specifies the set of values to check for container exit codes.
+                                              At most 255 elements are allowed.
+                                            items:
+                                              format: int32
+                                              type: integer
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        required:
+                                        - operator
+                                        type: object
+                                    required:
+                                    - action
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
                                 securityContext:
                                   description: |-
                                     Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -12252,7 +12805,9 @@ spec:
                           hostNetwork:
                             description: |-
                               Host networking requested for this pod. Use the host's network namespace.
-                              If this option is set, the ports that will be used must be specified.
+                              When using HostNetwork you should specify ports so the scheduler is aware.
+                              When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
+                              and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
                               Default to false.
                             type: boolean
                           hostPID:
@@ -12277,6 +12832,19 @@ spec:
                               Specifies the hostname of the Pod
                               If not specified, the pod's hostname will be set to a system-defined value.
                             type: string
+                          hostnameOverride:
+                            description: |-
+                              HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
+                              This field only specifies the pod's hostname and does not affect its DNS records.
+                              When this field is set to a non-empty string:
+                              - It takes precedence over the values set in `hostname` and `subdomain`.
+                              - The Pod's hostname will be set to this value.
+                              - `setHostnameAsFQDN` must be nil or set to false.
+                              - `hostNetwork` must be set to false.
+
+                              This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
+                              Requires the HostnameOverride feature gate to be enabled.
+                            type: string
                           imagePullSecrets:
                             description: |-
                               ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -12358,8 +12926,9 @@ spec:
                                       variable present in a Container.
                                     properties:
                                       name:
-                                        description: Name of the environment variable.
-                                          Must be a C_IDENTIFIER.
+                                        description: |-
+                                          Name of the environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       value:
                                         description: |-
@@ -12418,6 +12987,43 @@ spec:
                                             - fieldPath
                                             type: object
                                             x-kubernetes-map-type: atomic
+                                          fileKeyRef:
+                                            description: |-
+                                              FileKeyRef selects a key of the env file.
+                                              Requires the EnvFiles feature gate to be enabled.
+                                            properties:
+                                              key:
+                                                description: |-
+                                                  The key within the env file. An invalid key will prevent the pod from starting.
+                                                  The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                  During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                type: string
+                                              optional:
+                                                default: false
+                                                description: |-
+                                                  Specify whether the file or its key must be defined. If the file or key
+                                                  does not exist, then the env var is not published.
+                                                  If optional is set to true and the specified key does not exist,
+                                                  the environment variable will not be set in the Pod's containers.
+
+                                                  If optional is set to false and the specified key does not exist,
+                                                  an error will be returned during Pod creation.
+                                                type: boolean
+                                              path:
+                                                description: |-
+                                                  The path within the volume from which to select the file.
+                                                  Must be relative and may not contain the '..' path or start with '..'.
+                                                type: string
+                                              volumeName:
+                                                description: The name of the volume
+                                                  mount containing the env file.
+                                                type: string
+                                            required:
+                                            - key
+                                            - path
+                                            - volumeName
+                                            type: object
+                                            x-kubernetes-map-type: atomic
                                           resourceFieldRef:
                                             description: |-
                                               Selects a resource of the container: only resources limits and requests
@@ -12481,8 +13087,8 @@ spec:
                                 envFrom:
                                   description: |-
                                     List of sources to populate environment variables in the container.
-                                    The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                    will be reported as an event when the container is starting. When a key exists in multiple
+                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                    When a key exists in multiple
                                     sources, the value associated with the last source will take precedence.
                                     Values defined by an Env with a duplicate key will take precedence.
                                     Cannot be updated.
@@ -12509,9 +13115,9 @@ spec:
                                         type: object
                                         x-kubernetes-map-type: atomic
                                       prefix:
-                                        description: Optional text to prepend to the
-                                          name of each environment variable. Must
-                                          be a C_IDENTIFIER.
+                                        description: |-
+                                          Optional text to prepend to the name of each environment variable.
+                                          May consist of any printable ASCII characters except '='.
                                         type: string
                                       secretRef:
                                         description: The Secret to select from
@@ -13198,7 +13804,7 @@ spec:
                                         Claims lists the names of resources, defined in spec.resourceClaims,
                                         that are used by this container.
 
-                                        This is an alpha field and requires enabling the
+                                        This field depends on the
                                         DynamicResourceAllocation feature gate.
 
                                         This field is immutable. It can only be set for containers.
@@ -13253,10 +13859,10 @@ spec:
                                 restartPolicy:
                                   description: |-
                                     RestartPolicy defines the restart behavior of individual containers in a pod.
-                                    This field may only be set for init containers, and the only allowed value is "Always".
-                                    For non-init containers or when this field is not specified,
+                                    This overrides the pod-level restart policy. When this field is not specified,
                                     the restart behavior is defined by the Pod's restart policy and the container type.
-                                    Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                    Additionally, setting the RestartPolicy as "Always" for the init container will
+                                    have the following effect:
                                     this init container will be continually restarted on
                                     exit until all regular containers have terminated. Once all regular
                                     containers have completed, all init containers with restartPolicy "Always"
@@ -13268,6 +13874,59 @@ spec:
                                     init container is started, or after any startupProbe has successfully
                                     completed.
                                   type: string
+                                restartPolicyRules:
+                                  description: |-
+                                    Represents a list of rules to be checked to determine if the
+                                    container should be restarted on exit. The rules are evaluated in
+                                    order. Once a rule matches a container exit condition, the remaining
+                                    rules are ignored. If no rule matches the container exit condition,
+                                    the Container-level restart policy determines the whether the container
+                                    is restarted or not. Constraints on the rules:
+                                    - At most 20 rules are allowed.
+                                    - Rules can have the same action.
+                                    - Identical rules are not forbidden in validations.
+                                    When rules are specified, container MUST set RestartPolicy explicitly
+                                    even it if matches the Pod's RestartPolicy.
+                                  items:
+                                    description: ContainerRestartRule describes how
+                                      a container exit is handled.
+                                    properties:
+                                      action:
+                                        description: |-
+                                          Specifies the action taken on a container exit if the requirements
+                                          are satisfied. The only possible value is "Restart" to restart the
+                                          container.
+                                        type: string
+                                      exitCodes:
+                                        description: Represents the exit codes to
+                                          check on container exits.
+                                        properties:
+                                          operator:
+                                            description: |-
+                                              Represents the relationship between the container exit code(s) and the
+                                              specified values. Possible values are:
+                                              - In: the requirement is satisfied if the container exit code is in the
+                                                set of specified values.
+                                              - NotIn: the requirement is satisfied if the container exit code is
+                                                not in the set of specified values.
+                                            type: string
+                                          values:
+                                            description: |-
+                                              Specifies the set of values to check for container exit codes.
+                                              At most 255 elements are allowed.
+                                            items:
+                                              format: int32
+                                              type: integer
+                                            type: array
+                                            x-kubernetes-list-type: set
+                                        required:
+                                        - operator
+                                        type: object
+                                    required:
+                                    - action
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
                                 securityContext:
                                   description: |-
                                     SecurityContext defines the security options the container should be run with.
@@ -13803,6 +14462,7 @@ spec:
                               - spec.hostPID
                               - spec.hostIPC
                               - spec.hostUsers
+                              - spec.resources
                               - spec.securityContext.appArmorProfile
                               - spec.securityContext.seLinuxOptions
                               - spec.securityContext.seccompProfile
@@ -13956,7 +14616,7 @@ spec:
                             description: |-
                               Resources is the total amount of CPU and Memory resources required by all
                               containers in the pod. It supports specifying Requests and Limits for
-                              "cpu" and "memory" resource names only. ResourceClaims are not supported.
+                              "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
 
                               This field enables fine-grained control over resource allocation for the
                               entire pod, allowing resource sharing among containers in a pod.
@@ -13969,7 +14629,7 @@ spec:
                                   Claims lists the names of resources, defined in spec.resourceClaims,
                                   that are used by this container.
 
-                                  This is an alpha field and requires enabling the
+                                  This field depends on the
                                   DynamicResourceAllocation feature gate.
 
                                   This field is immutable. It can only be set for containers.
@@ -15268,15 +15928,13 @@ spec:
                                                 volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                                 If specified, the CSI driver will create or update the volume with the attributes defined
                                                 in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                                it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                                will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                                If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                                will be set by the persistentvolume controller if it exists.
+                                                it can be changed after the claim is created. An empty string or nil value indicates that no
+                                                VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                                this field can be reset to its previous value (including nil) to cancel the modification.
                                                 If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                                 set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                                 exists.
                                                 More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                                (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                               type: string
                                             volumeMode:
                                               description: |-
@@ -15461,12 +16119,10 @@ spec:
                                   description: |-
                                     glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                     Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md
                                   properties:
                                     endpoints:
-                                      description: |-
-                                        endpoints is the endpoint name that details Glusterfs topology.
-                                        More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                      description: endpoints is the endpoint name
+                                        that details Glusterfs topology.
                                       type: string
                                     path:
                                       description: |-
@@ -15545,7 +16201,7 @@ spec:
                                   description: |-
                                     iscsi represents an ISCSI Disk resource that is attached to a
                                     kubelet's host machine and then exposed to the pod.
-                                    More info: https://examples.k8s.io/volumes/iscsi/README.md
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                                   properties:
                                     chapAuthDiscovery:
                                       description: chapAuthDiscovery defines whether
@@ -15979,6 +16635,111 @@ spec:
                                                 type: array
                                                 x-kubernetes-list-type: atomic
                                             type: object
+                                          podCertificate:
+                                            description: |-
+                                              Projects an auto-rotating credential bundle (private key and certificate
+                                              chain) that the pod can use either as a TLS client or server.
+
+                                              Kubelet generates a private key and uses it to send a
+                                              PodCertificateRequest to the named signer.  Once the signer approves the
+                                              request and issues a certificate chain, Kubelet writes the key and
+                                              certificate chain to the pod filesystem.  The pod does not start until
+                                              certificates have been issued for each podCertificate projected volume
+                                              source in its spec.
+
+                                              Kubelet will begin trying to rotate the certificate at the time indicated
+                                              by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                              timestamp.
+
+                                              Kubelet can write a single file, indicated by the credentialBundlePath
+                                              field, or separate files, indicated by the keyPath and
+                                              certificateChainPath fields.
+
+                                              The credential bundle is a single file in PEM format.  The first PEM
+                                              entry is the private key (in PKCS#8 format), and the remaining PEM
+                                              entries are the certificate chain issued by the signer (typically,
+                                              signers will return their certificate chain in leaf-to-root order).
+
+                                              Prefer using the credential bundle format, since your application code
+                                              can read it atomically.  If you use keyPath and certificateChainPath,
+                                              your application must make two separate file reads. If these coincide
+                                              with a certificate rotation, it is possible that the private key and leaf
+                                              certificate you read may not correspond to each other.  Your application
+                                              will need to check for this condition, and re-read until they are
+                                              consistent.
+
+                                              The named signer controls chooses the format of the certificate it
+                                              issues; consult the signer implementation's documentation to learn how to
+                                              use the certificates it issues.
+                                            properties:
+                                              certificateChainPath:
+                                                description: |-
+                                                  Write the certificate chain at this path in the projected volume.
+
+                                                  Most applications should use credentialBundlePath.  When using keyPath
+                                                  and certificateChainPath, your application needs to check that the key
+                                                  and leaf certificate are consistent, because it is possible to read the
+                                                  files mid-rotation.
+                                                type: string
+                                              credentialBundlePath:
+                                                description: |-
+                                                  Write the credential bundle at this path in the projected volume.
+
+                                                  The credential bundle is a single file that contains multiple PEM blocks.
+                                                  The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                                  key.
+
+                                                  The remaining blocks are CERTIFICATE blocks, containing the issued
+                                                  certificate chain from the signer (leaf and any intermediates).
+
+                                                  Using credentialBundlePath lets your Pod's application code make a single
+                                                  atomic read that retrieves a consistent key and certificate chain.  If you
+                                                  project them to separate files, your application code will need to
+                                                  additionally check that the leaf certificate was issued to the key.
+                                                type: string
+                                              keyPath:
+                                                description: |-
+                                                  Write the key at this path in the projected volume.
+
+                                                  Most applications should use credentialBundlePath.  When using keyPath
+                                                  and certificateChainPath, your application needs to check that the key
+                                                  and leaf certificate are consistent, because it is possible to read the
+                                                  files mid-rotation.
+                                                type: string
+                                              keyType:
+                                                description: |-
+                                                  The type of keypair Kubelet will generate for the pod.
+
+                                                  Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                                  "ECDSAP521", and "ED25519".
+                                                type: string
+                                              maxExpirationSeconds:
+                                                description: |-
+                                                  maxExpirationSeconds is the maximum lifetime permitted for the
+                                                  certificate.
+
+                                                  Kubelet copies this value verbatim into the PodCertificateRequests it
+                                                  generates for this projection.
+
+                                                  If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                                  will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                                  value is 7862400 (91 days).
+
+                                                  The signer implementation is then free to issue a certificate with any
+                                                  lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                                  seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                                  `kubernetes.io` signers will never issue certificates with a lifetime
+                                                  longer than 24 hours.
+                                                format: int32
+                                                type: integer
+                                              signerName:
+                                                description: Kubelet's generated CSRs
+                                                  will be addressed to this signer.
+                                                type: string
+                                            required:
+                                            - keyType
+                                            - signerName
+                                            type: object
                                           secret:
                                             description: secret information about
                                               the secret data to project
@@ -16116,7 +16877,6 @@ spec:
                                   description: |-
                                     rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                     Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                                    More info: https://examples.k8s.io/volumes/rbd/README.md
                                   properties:
                                     fsType:
                                       description: |-
@@ -16477,7 +17237,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -16512,7 +17273,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -16557,7 +17319,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -16598,7 +17361,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
diff --git a/config/crds/v1/resources/elasticsearch.k8s.elastic.co_elasticsearches.yaml b/config/crds/v1/resources/elasticsearch.k8s.elastic.co_elasticsearches.yaml
index cf14063fd..3240b2872 100644
--- a/config/crds/v1/resources/elasticsearch.k8s.elastic.co_elasticsearches.yaml
+++ b/config/crds/v1/resources/elasticsearch.k8s.elastic.co_elasticsearches.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: elasticsearches.elasticsearch.k8s.elastic.co
 spec:
   group: elasticsearch.k8s.elastic.co
@@ -543,7 +543,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -584,7 +585,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -1245,8 +1247,8 @@ spec:
                                         most preferred is the one with the greatest sum of weights, i.e.
                                         for each node that meets all of the scheduling requirements (resource
                                         request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                        compute a sum by iterating through the elements of this field and adding
-                                        "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                        compute a sum by iterating through the elements of this field and subtracting
+                                        "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                         node(s) with the highest sum are the most preferred.
                                       items:
                                         description: The weights of all of the matched
@@ -1650,8 +1652,9 @@ spec:
                                         variable present in a Container.
                                       properties:
                                         name:
-                                          description: Name of the environment variable.
-                                            Must be a C_IDENTIFIER.
+                                          description: |-
+                                            Name of the environment variable.
+                                            May consist of any printable ASCII characters except '='.
                                           type: string
                                         value:
                                           description: |-
@@ -1711,6 +1714,43 @@ spec:
                                               - fieldPath
                                               type: object
                                               x-kubernetes-map-type: atomic
+                                            fileKeyRef:
+                                              description: |-
+                                                FileKeyRef selects a key of the env file.
+                                                Requires the EnvFiles feature gate to be enabled.
+                                              properties:
+                                                key:
+                                                  description: |-
+                                                    The key within the env file. An invalid key will prevent the pod from starting.
+                                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                    During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                  type: string
+                                                optional:
+                                                  default: false
+                                                  description: |-
+                                                    Specify whether the file or its key must be defined. If the file or key
+                                                    does not exist, then the env var is not published.
+                                                    If optional is set to true and the specified key does not exist,
+                                                    the environment variable will not be set in the Pod's containers.
+
+                                                    If optional is set to false and the specified key does not exist,
+                                                    an error will be returned during Pod creation.
+                                                  type: boolean
+                                                path:
+                                                  description: |-
+                                                    The path within the volume from which to select the file.
+                                                    Must be relative and may not contain the '..' path or start with '..'.
+                                                  type: string
+                                                volumeName:
+                                                  description: The name of the volume
+                                                    mount containing the env file.
+                                                  type: string
+                                              required:
+                                              - key
+                                              - path
+                                              - volumeName
+                                              type: object
+                                              x-kubernetes-map-type: atomic
                                             resourceFieldRef:
                                               description: |-
                                                 Selects a resource of the container: only resources limits and requests
@@ -1775,8 +1815,8 @@ spec:
                                   envFrom:
                                     description: |-
                                       List of sources to populate environment variables in the container.
-                                      The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                      will be reported as an event when the container is starting. When a key exists in multiple
+                                      The keys defined within a source may consist of any printable ASCII characters except '='.
+                                      When a key exists in multiple
                                       sources, the value associated with the last source will take precedence.
                                       Values defined by an Env with a duplicate key will take precedence.
                                       Cannot be updated.
@@ -1803,9 +1843,9 @@ spec:
                                           type: object
                                           x-kubernetes-map-type: atomic
                                         prefix:
-                                          description: Optional text to prepend to
-                                            the name of each environment variable.
-                                            Must be a C_IDENTIFIER.
+                                          description: |-
+                                            Optional text to prepend to the name of each environment variable.
+                                            May consist of any printable ASCII characters except '='.
                                           type: string
                                         secretRef:
                                           description: The Secret to select from
@@ -2494,7 +2534,7 @@ spec:
                                           Claims lists the names of resources, defined in spec.resourceClaims,
                                           that are used by this container.
 
-                                          This is an alpha field and requires enabling the
+                                          This field depends on the
                                           DynamicResourceAllocation feature gate.
 
                                           This field is immutable. It can only be set for containers.
@@ -2549,10 +2589,10 @@ spec:
                                   restartPolicy:
                                     description: |-
                                       RestartPolicy defines the restart behavior of individual containers in a pod.
-                                      This field may only be set for init containers, and the only allowed value is "Always".
-                                      For non-init containers or when this field is not specified,
+                                      This overrides the pod-level restart policy. When this field is not specified,
                                       the restart behavior is defined by the Pod's restart policy and the container type.
-                                      Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                      Additionally, setting the RestartPolicy as "Always" for the init container will
+                                      have the following effect:
                                       this init container will be continually restarted on
                                       exit until all regular containers have terminated. Once all regular
                                       containers have completed, all init containers with restartPolicy "Always"
@@ -2564,6 +2604,59 @@ spec:
                                       init container is started, or after any startupProbe has successfully
                                       completed.
                                     type: string
+                                  restartPolicyRules:
+                                    description: |-
+                                      Represents a list of rules to be checked to determine if the
+                                      container should be restarted on exit. The rules are evaluated in
+                                      order. Once a rule matches a container exit condition, the remaining
+                                      rules are ignored. If no rule matches the container exit condition,
+                                      the Container-level restart policy determines the whether the container
+                                      is restarted or not. Constraints on the rules:
+                                      - At most 20 rules are allowed.
+                                      - Rules can have the same action.
+                                      - Identical rules are not forbidden in validations.
+                                      When rules are specified, container MUST set RestartPolicy explicitly
+                                      even it if matches the Pod's RestartPolicy.
+                                    items:
+                                      description: ContainerRestartRule describes
+                                        how a container exit is handled.
+                                      properties:
+                                        action:
+                                          description: |-
+                                            Specifies the action taken on a container exit if the requirements
+                                            are satisfied. The only possible value is "Restart" to restart the
+                                            container.
+                                          type: string
+                                        exitCodes:
+                                          description: Represents the exit codes to
+                                            check on container exits.
+                                          properties:
+                                            operator:
+                                              description: |-
+                                                Represents the relationship between the container exit code(s) and the
+                                                specified values. Possible values are:
+                                                - In: the requirement is satisfied if the container exit code is in the
+                                                  set of specified values.
+                                                - NotIn: the requirement is satisfied if the container exit code is
+                                                  not in the set of specified values.
+                                              type: string
+                                            values:
+                                              description: |-
+                                                Specifies the set of values to check for container exit codes.
+                                                At most 255 elements are allowed.
+                                              items:
+                                                format: int32
+                                                type: integer
+                                              type: array
+                                              x-kubernetes-list-type: set
+                                          required:
+                                          - operator
+                                          type: object
+                                      required:
+                                      - action
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
                                   securityContext:
                                     description: |-
                                       SecurityContext defines the security options the container should be run with.
@@ -3187,8 +3280,9 @@ spec:
                                         variable present in a Container.
                                       properties:
                                         name:
-                                          description: Name of the environment variable.
-                                            Must be a C_IDENTIFIER.
+                                          description: |-
+                                            Name of the environment variable.
+                                            May consist of any printable ASCII characters except '='.
                                           type: string
                                         value:
                                           description: |-
@@ -3248,6 +3342,43 @@ spec:
                                               - fieldPath
                                               type: object
                                               x-kubernetes-map-type: atomic
+                                            fileKeyRef:
+                                              description: |-
+                                                FileKeyRef selects a key of the env file.
+                                                Requires the EnvFiles feature gate to be enabled.
+                                              properties:
+                                                key:
+                                                  description: |-
+                                                    The key within the env file. An invalid key will prevent the pod from starting.
+                                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                    During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                  type: string
+                                                optional:
+                                                  default: false
+                                                  description: |-
+                                                    Specify whether the file or its key must be defined. If the file or key
+                                                    does not exist, then the env var is not published.
+                                                    If optional is set to true and the specified key does not exist,
+                                                    the environment variable will not be set in the Pod's containers.
+
+                                                    If optional is set to false and the specified key does not exist,
+                                                    an error will be returned during Pod creation.
+                                                  type: boolean
+                                                path:
+                                                  description: |-
+                                                    The path within the volume from which to select the file.
+                                                    Must be relative and may not contain the '..' path or start with '..'.
+                                                  type: string
+                                                volumeName:
+                                                  description: The name of the volume
+                                                    mount containing the env file.
+                                                  type: string
+                                              required:
+                                              - key
+                                              - path
+                                              - volumeName
+                                              type: object
+                                              x-kubernetes-map-type: atomic
                                             resourceFieldRef:
                                               description: |-
                                                 Selects a resource of the container: only resources limits and requests
@@ -3312,8 +3443,8 @@ spec:
                                   envFrom:
                                     description: |-
                                       List of sources to populate environment variables in the container.
-                                      The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                      will be reported as an event when the container is starting. When a key exists in multiple
+                                      The keys defined within a source may consist of any printable ASCII characters except '='.
+                                      When a key exists in multiple
                                       sources, the value associated with the last source will take precedence.
                                       Values defined by an Env with a duplicate key will take precedence.
                                       Cannot be updated.
@@ -3340,9 +3471,9 @@ spec:
                                           type: object
                                           x-kubernetes-map-type: atomic
                                         prefix:
-                                          description: Optional text to prepend to
-                                            the name of each environment variable.
-                                            Must be a C_IDENTIFIER.
+                                          description: |-
+                                            Optional text to prepend to the name of each environment variable.
+                                            May consist of any printable ASCII characters except '='.
                                           type: string
                                         secretRef:
                                           description: The Secret to select from
@@ -4014,7 +4145,7 @@ spec:
                                           Claims lists the names of resources, defined in spec.resourceClaims,
                                           that are used by this container.
 
-                                          This is an alpha field and requires enabling the
+                                          This field depends on the
                                           DynamicResourceAllocation feature gate.
 
                                           This field is immutable. It can only be set for containers.
@@ -4070,9 +4201,53 @@ spec:
                                     description: |-
                                       Restart policy for the container to manage the restart behavior of each
                                       container within a pod.
-                                      This may only be set for init containers. You cannot set this field on
-                                      ephemeral containers.
+                                      You cannot set this field on ephemeral containers.
                                     type: string
+                                  restartPolicyRules:
+                                    description: |-
+                                      Represents a list of rules to be checked to determine if the
+                                      container should be restarted on exit. You cannot set this field on
+                                      ephemeral containers.
+                                    items:
+                                      description: ContainerRestartRule describes
+                                        how a container exit is handled.
+                                      properties:
+                                        action:
+                                          description: |-
+                                            Specifies the action taken on a container exit if the requirements
+                                            are satisfied. The only possible value is "Restart" to restart the
+                                            container.
+                                          type: string
+                                        exitCodes:
+                                          description: Represents the exit codes to
+                                            check on container exits.
+                                          properties:
+                                            operator:
+                                              description: |-
+                                                Represents the relationship between the container exit code(s) and the
+                                                specified values. Possible values are:
+                                                - In: the requirement is satisfied if the container exit code is in the
+                                                  set of specified values.
+                                                - NotIn: the requirement is satisfied if the container exit code is
+                                                  not in the set of specified values.
+                                              type: string
+                                            values:
+                                              description: |-
+                                                Specifies the set of values to check for container exit codes.
+                                                At most 255 elements are allowed.
+                                              items:
+                                                format: int32
+                                                type: integer
+                                              type: array
+                                              x-kubernetes-list-type: set
+                                          required:
+                                          - operator
+                                          type: object
+                                      required:
+                                      - action
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
                                   securityContext:
                                     description: |-
                                       Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -4615,7 +4790,9 @@ spec:
                             hostNetwork:
                               description: |-
                                 Host networking requested for this pod. Use the host's network namespace.
-                                If this option is set, the ports that will be used must be specified.
+                                When using HostNetwork you should specify ports so the scheduler is aware.
+                                When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
+                                and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
                                 Default to false.
                               type: boolean
                             hostPID:
@@ -4640,6 +4817,19 @@ spec:
                                 Specifies the hostname of the Pod
                                 If not specified, the pod's hostname will be set to a system-defined value.
                               type: string
+                            hostnameOverride:
+                              description: |-
+                                HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
+                                This field only specifies the pod's hostname and does not affect its DNS records.
+                                When this field is set to a non-empty string:
+                                - It takes precedence over the values set in `hostname` and `subdomain`.
+                                - The Pod's hostname will be set to this value.
+                                - `setHostnameAsFQDN` must be nil or set to false.
+                                - `hostNetwork` must be set to false.
+
+                                This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
+                                Requires the HostnameOverride feature gate to be enabled.
+                              type: string
                             imagePullSecrets:
                               description: |-
                                 ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -4721,8 +4911,9 @@ spec:
                                         variable present in a Container.
                                       properties:
                                         name:
-                                          description: Name of the environment variable.
-                                            Must be a C_IDENTIFIER.
+                                          description: |-
+                                            Name of the environment variable.
+                                            May consist of any printable ASCII characters except '='.
                                           type: string
                                         value:
                                           description: |-
@@ -4782,6 +4973,43 @@ spec:
                                               - fieldPath
                                               type: object
                                               x-kubernetes-map-type: atomic
+                                            fileKeyRef:
+                                              description: |-
+                                                FileKeyRef selects a key of the env file.
+                                                Requires the EnvFiles feature gate to be enabled.
+                                              properties:
+                                                key:
+                                                  description: |-
+                                                    The key within the env file. An invalid key will prevent the pod from starting.
+                                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                    During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                  type: string
+                                                optional:
+                                                  default: false
+                                                  description: |-
+                                                    Specify whether the file or its key must be defined. If the file or key
+                                                    does not exist, then the env var is not published.
+                                                    If optional is set to true and the specified key does not exist,
+                                                    the environment variable will not be set in the Pod's containers.
+
+                                                    If optional is set to false and the specified key does not exist,
+                                                    an error will be returned during Pod creation.
+                                                  type: boolean
+                                                path:
+                                                  description: |-
+                                                    The path within the volume from which to select the file.
+                                                    Must be relative and may not contain the '..' path or start with '..'.
+                                                  type: string
+                                                volumeName:
+                                                  description: The name of the volume
+                                                    mount containing the env file.
+                                                  type: string
+                                              required:
+                                              - key
+                                              - path
+                                              - volumeName
+                                              type: object
+                                              x-kubernetes-map-type: atomic
                                             resourceFieldRef:
                                               description: |-
                                                 Selects a resource of the container: only resources limits and requests
@@ -4846,8 +5074,8 @@ spec:
                                   envFrom:
                                     description: |-
                                       List of sources to populate environment variables in the container.
-                                      The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                      will be reported as an event when the container is starting. When a key exists in multiple
+                                      The keys defined within a source may consist of any printable ASCII characters except '='.
+                                      When a key exists in multiple
                                       sources, the value associated with the last source will take precedence.
                                       Values defined by an Env with a duplicate key will take precedence.
                                       Cannot be updated.
@@ -4874,9 +5102,9 @@ spec:
                                           type: object
                                           x-kubernetes-map-type: atomic
                                         prefix:
-                                          description: Optional text to prepend to
-                                            the name of each environment variable.
-                                            Must be a C_IDENTIFIER.
+                                          description: |-
+                                            Optional text to prepend to the name of each environment variable.
+                                            May consist of any printable ASCII characters except '='.
                                           type: string
                                         secretRef:
                                           description: The Secret to select from
@@ -5565,7 +5793,7 @@ spec:
                                           Claims lists the names of resources, defined in spec.resourceClaims,
                                           that are used by this container.
 
-                                          This is an alpha field and requires enabling the
+                                          This field depends on the
                                           DynamicResourceAllocation feature gate.
 
                                           This field is immutable. It can only be set for containers.
@@ -5620,10 +5848,10 @@ spec:
                                   restartPolicy:
                                     description: |-
                                       RestartPolicy defines the restart behavior of individual containers in a pod.
-                                      This field may only be set for init containers, and the only allowed value is "Always".
-                                      For non-init containers or when this field is not specified,
+                                      This overrides the pod-level restart policy. When this field is not specified,
                                       the restart behavior is defined by the Pod's restart policy and the container type.
-                                      Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                      Additionally, setting the RestartPolicy as "Always" for the init container will
+                                      have the following effect:
                                       this init container will be continually restarted on
                                       exit until all regular containers have terminated. Once all regular
                                       containers have completed, all init containers with restartPolicy "Always"
@@ -5635,6 +5863,59 @@ spec:
                                       init container is started, or after any startupProbe has successfully
                                       completed.
                                     type: string
+                                  restartPolicyRules:
+                                    description: |-
+                                      Represents a list of rules to be checked to determine if the
+                                      container should be restarted on exit. The rules are evaluated in
+                                      order. Once a rule matches a container exit condition, the remaining
+                                      rules are ignored. If no rule matches the container exit condition,
+                                      the Container-level restart policy determines the whether the container
+                                      is restarted or not. Constraints on the rules:
+                                      - At most 20 rules are allowed.
+                                      - Rules can have the same action.
+                                      - Identical rules are not forbidden in validations.
+                                      When rules are specified, container MUST set RestartPolicy explicitly
+                                      even it if matches the Pod's RestartPolicy.
+                                    items:
+                                      description: ContainerRestartRule describes
+                                        how a container exit is handled.
+                                      properties:
+                                        action:
+                                          description: |-
+                                            Specifies the action taken on a container exit if the requirements
+                                            are satisfied. The only possible value is "Restart" to restart the
+                                            container.
+                                          type: string
+                                        exitCodes:
+                                          description: Represents the exit codes to
+                                            check on container exits.
+                                          properties:
+                                            operator:
+                                              description: |-
+                                                Represents the relationship between the container exit code(s) and the
+                                                specified values. Possible values are:
+                                                - In: the requirement is satisfied if the container exit code is in the
+                                                  set of specified values.
+                                                - NotIn: the requirement is satisfied if the container exit code is
+                                                  not in the set of specified values.
+                                              type: string
+                                            values:
+                                              description: |-
+                                                Specifies the set of values to check for container exit codes.
+                                                At most 255 elements are allowed.
+                                              items:
+                                                format: int32
+                                                type: integer
+                                              type: array
+                                              x-kubernetes-list-type: set
+                                          required:
+                                          - operator
+                                          type: object
+                                      required:
+                                      - action
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
                                   securityContext:
                                     description: |-
                                       SecurityContext defines the security options the container should be run with.
@@ -6171,6 +6452,7 @@ spec:
                                 - spec.hostPID
                                 - spec.hostIPC
                                 - spec.hostUsers
+                                - spec.resources
                                 - spec.securityContext.appArmorProfile
                                 - spec.securityContext.seLinuxOptions
                                 - spec.securityContext.seccompProfile
@@ -6324,7 +6606,7 @@ spec:
                               description: |-
                                 Resources is the total amount of CPU and Memory resources required by all
                                 containers in the pod. It supports specifying Requests and Limits for
-                                "cpu" and "memory" resource names only. ResourceClaims are not supported.
+                                "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
 
                                 This field enables fine-grained control over resource allocation for the
                                 entire pod, allowing resource sharing among containers in a pod.
@@ -6337,7 +6619,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -7640,15 +7922,13 @@ spec:
                                                   volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                                   If specified, the CSI driver will create or update the volume with the attributes defined
                                                   in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                                  it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                                  will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                                  If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                                  will be set by the persistentvolume controller if it exists.
+                                                  it can be changed after the claim is created. An empty string or nil value indicates that no
+                                                  VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                                  this field can be reset to its previous value (including nil) to cancel the modification.
                                                   If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                                   set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                                   exists.
                                                   More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                                  (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                                 type: string
                                               volumeMode:
                                                 description: |-
@@ -7833,12 +8113,10 @@ spec:
                                     description: |-
                                       glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                       Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                                      More info: https://examples.k8s.io/volumes/glusterfs/README.md
                                     properties:
                                       endpoints:
-                                        description: |-
-                                          endpoints is the endpoint name that details Glusterfs topology.
-                                          More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                        description: endpoints is the endpoint name
+                                          that details Glusterfs topology.
                                         type: string
                                       path:
                                         description: |-
@@ -7917,7 +8195,7 @@ spec:
                                     description: |-
                                       iscsi represents an ISCSI Disk resource that is attached to a
                                       kubelet's host machine and then exposed to the pod.
-                                      More info: https://examples.k8s.io/volumes/iscsi/README.md
+                                      More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                                     properties:
                                       chapAuthDiscovery:
                                         description: chapAuthDiscovery defines whether
@@ -8353,6 +8631,112 @@ spec:
                                                   type: array
                                                   x-kubernetes-list-type: atomic
                                               type: object
+                                            podCertificate:
+                                              description: |-
+                                                Projects an auto-rotating credential bundle (private key and certificate
+                                                chain) that the pod can use either as a TLS client or server.
+
+                                                Kubelet generates a private key and uses it to send a
+                                                PodCertificateRequest to the named signer.  Once the signer approves the
+                                                request and issues a certificate chain, Kubelet writes the key and
+                                                certificate chain to the pod filesystem.  The pod does not start until
+                                                certificates have been issued for each podCertificate projected volume
+                                                source in its spec.
+
+                                                Kubelet will begin trying to rotate the certificate at the time indicated
+                                                by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                                timestamp.
+
+                                                Kubelet can write a single file, indicated by the credentialBundlePath
+                                                field, or separate files, indicated by the keyPath and
+                                                certificateChainPath fields.
+
+                                                The credential bundle is a single file in PEM format.  The first PEM
+                                                entry is the private key (in PKCS#8 format), and the remaining PEM
+                                                entries are the certificate chain issued by the signer (typically,
+                                                signers will return their certificate chain in leaf-to-root order).
+
+                                                Prefer using the credential bundle format, since your application code
+                                                can read it atomically.  If you use keyPath and certificateChainPath,
+                                                your application must make two separate file reads. If these coincide
+                                                with a certificate rotation, it is possible that the private key and leaf
+                                                certificate you read may not correspond to each other.  Your application
+                                                will need to check for this condition, and re-read until they are
+                                                consistent.
+
+                                                The named signer controls chooses the format of the certificate it
+                                                issues; consult the signer implementation's documentation to learn how to
+                                                use the certificates it issues.
+                                              properties:
+                                                certificateChainPath:
+                                                  description: |-
+                                                    Write the certificate chain at this path in the projected volume.
+
+                                                    Most applications should use credentialBundlePath.  When using keyPath
+                                                    and certificateChainPath, your application needs to check that the key
+                                                    and leaf certificate are consistent, because it is possible to read the
+                                                    files mid-rotation.
+                                                  type: string
+                                                credentialBundlePath:
+                                                  description: |-
+                                                    Write the credential bundle at this path in the projected volume.
+
+                                                    The credential bundle is a single file that contains multiple PEM blocks.
+                                                    The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                                    key.
+
+                                                    The remaining blocks are CERTIFICATE blocks, containing the issued
+                                                    certificate chain from the signer (leaf and any intermediates).
+
+                                                    Using credentialBundlePath lets your Pod's application code make a single
+                                                    atomic read that retrieves a consistent key and certificate chain.  If you
+                                                    project them to separate files, your application code will need to
+                                                    additionally check that the leaf certificate was issued to the key.
+                                                  type: string
+                                                keyPath:
+                                                  description: |-
+                                                    Write the key at this path in the projected volume.
+
+                                                    Most applications should use credentialBundlePath.  When using keyPath
+                                                    and certificateChainPath, your application needs to check that the key
+                                                    and leaf certificate are consistent, because it is possible to read the
+                                                    files mid-rotation.
+                                                  type: string
+                                                keyType:
+                                                  description: |-
+                                                    The type of keypair Kubelet will generate for the pod.
+
+                                                    Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                                    "ECDSAP521", and "ED25519".
+                                                  type: string
+                                                maxExpirationSeconds:
+                                                  description: |-
+                                                    maxExpirationSeconds is the maximum lifetime permitted for the
+                                                    certificate.
+
+                                                    Kubelet copies this value verbatim into the PodCertificateRequests it
+                                                    generates for this projection.
+
+                                                    If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                                    will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                                    value is 7862400 (91 days).
+
+                                                    The signer implementation is then free to issue a certificate with any
+                                                    lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                                    seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                                    `kubernetes.io` signers will never issue certificates with a lifetime
+                                                    longer than 24 hours.
+                                                  format: int32
+                                                  type: integer
+                                                signerName:
+                                                  description: Kubelet's generated
+                                                    CSRs will be addressed to this
+                                                    signer.
+                                                  type: string
+                                              required:
+                                              - keyType
+                                              - signerName
+                                              type: object
                                             secret:
                                               description: secret information about
                                                 the secret data to project
@@ -8490,7 +8874,6 @@ spec:
                                     description: |-
                                       rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                       Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                                      More info: https://examples.k8s.io/volumes/rbd/README.md
                                     properties:
                                       fsType:
                                         description: |-
@@ -9015,15 +9398,13 @@ spec:
                                   volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                   If specified, the CSI driver will create or update the volume with the attributes defined
                                   in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                  it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                  will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                  If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                  will be set by the persistentvolume controller if it exists.
+                                  it can be changed after the claim is created. An empty string or nil value indicates that no
+                                  VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                  this field can be reset to its previous value (including nil) to cancel the modification.
                                   If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                   set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                   exists.
                                   More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                  (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                 type: string
                               volumeMode:
                                 description: |-
@@ -9194,13 +9575,11 @@ spec:
                                 description: |-
                                   currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
                                   When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
-                                  This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                                 type: string
                               modifyVolumeStatus:
                                 description: |-
                                   ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
                                   When this is unset, there is no ModifyVolume operation being attempted.
-                                  This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                                 properties:
                                   status:
                                     description: "status is the status of the ControllerModifyVolume
@@ -9239,10 +9618,18 @@ spec:
                 type: array
               podDisruptionBudget:
                 description: |-
-                  PodDisruptionBudget provides access to the default Pod disruption budget for the Elasticsearch cluster.
-                  The default budget doesn't allow any Pod to be removed in case the cluster is not green or if there is only one node of type `data` or `master`.
-                  In all other cases the default PodDisruptionBudget sets `minUnavailable` equal to the total number of nodes minus 1.
-                  To disable, set `PodDisruptionBudget` to the empty value (`{}` in YAML).
+                  PodDisruptionBudget provides access to the default Pod disruption budget(s) for the Elasticsearch cluster.
+                  The behavior depends on the license level.
+                  With a Basic license or if podDisruptionBudget.spec is not empty:
+                    The default budget doesn't allow any Pod to be removed in case the cluster is not green or if there is only one node of type `data` or `master`.
+                    In all other cases the default podDisruptionBudget sets `minUnavailable` equal to the total number of nodes minus 1.
+                  With an Enterprise license and if podDisruptionBudget.spec is empty:
+                    The default budget is split into multiple budgets, each targeting a specific node role type allowing additional disruptions
+                    for certain roles according to the health status of the cluster.
+                      Example:
+                        All data roles (excluding frozen): allows disruptions only when the cluster is green.
+                        All other roles: allows disruptions only when the cluster is yellow or green.
+                  To disable, set `podDisruptionBudget` to the empty value (`{}` in YAML).
                 properties:
                   metadata:
                     description: |-
@@ -11266,8 +11653,8 @@ spec:
                                         most preferred is the one with the greatest sum of weights, i.e.
                                         for each node that meets all of the scheduling requirements (resource
                                         request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                        compute a sum by iterating through the elements of this field and adding
-                                        "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                        compute a sum by iterating through the elements of this field and subtracting
+                                        "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                         node(s) with the highest sum are the most preferred.
                                       items:
                                         description: The weights of all of the matched
@@ -11671,8 +12058,9 @@ spec:
                                         variable present in a Container.
                                       properties:
                                         name:
-                                          description: Name of the environment variable.
-                                            Must be a C_IDENTIFIER.
+                                          description: |-
+                                            Name of the environment variable.
+                                            May consist of any printable ASCII characters except '='.
                                           type: string
                                         value:
                                           description: |-
@@ -11732,6 +12120,43 @@ spec:
                                               - fieldPath
                                               type: object
                                               x-kubernetes-map-type: atomic
+                                            fileKeyRef:
+                                              description: |-
+                                                FileKeyRef selects a key of the env file.
+                                                Requires the EnvFiles feature gate to be enabled.
+                                              properties:
+                                                key:
+                                                  description: |-
+                                                    The key within the env file. An invalid key will prevent the pod from starting.
+                                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                    During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                  type: string
+                                                optional:
+                                                  default: false
+                                                  description: |-
+                                                    Specify whether the file or its key must be defined. If the file or key
+                                                    does not exist, then the env var is not published.
+                                                    If optional is set to true and the specified key does not exist,
+                                                    the environment variable will not be set in the Pod's containers.
+
+                                                    If optional is set to false and the specified key does not exist,
+                                                    an error will be returned during Pod creation.
+                                                  type: boolean
+                                                path:
+                                                  description: |-
+                                                    The path within the volume from which to select the file.
+                                                    Must be relative and may not contain the '..' path or start with '..'.
+                                                  type: string
+                                                volumeName:
+                                                  description: The name of the volume
+                                                    mount containing the env file.
+                                                  type: string
+                                              required:
+                                              - key
+                                              - path
+                                              - volumeName
+                                              type: object
+                                              x-kubernetes-map-type: atomic
                                             resourceFieldRef:
                                               description: |-
                                                 Selects a resource of the container: only resources limits and requests
@@ -11796,8 +12221,8 @@ spec:
                                   envFrom:
                                     description: |-
                                       List of sources to populate environment variables in the container.
-                                      The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                      will be reported as an event when the container is starting. When a key exists in multiple
+                                      The keys defined within a source may consist of any printable ASCII characters except '='.
+                                      When a key exists in multiple
                                       sources, the value associated with the last source will take precedence.
                                       Values defined by an Env with a duplicate key will take precedence.
                                       Cannot be updated.
@@ -11824,9 +12249,9 @@ spec:
                                           type: object
                                           x-kubernetes-map-type: atomic
                                         prefix:
-                                          description: Optional text to prepend to
-                                            the name of each environment variable.
-                                            Must be a C_IDENTIFIER.
+                                          description: |-
+                                            Optional text to prepend to the name of each environment variable.
+                                            May consist of any printable ASCII characters except '='.
                                           type: string
                                         secretRef:
                                           description: The Secret to select from
@@ -12515,7 +12940,7 @@ spec:
                                           Claims lists the names of resources, defined in spec.resourceClaims,
                                           that are used by this container.
 
-                                          This is an alpha field and requires enabling the
+                                          This field depends on the
                                           DynamicResourceAllocation feature gate.
 
                                           This field is immutable. It can only be set for containers.
@@ -12570,10 +12995,10 @@ spec:
                                   restartPolicy:
                                     description: |-
                                       RestartPolicy defines the restart behavior of individual containers in a pod.
-                                      This field may only be set for init containers, and the only allowed value is "Always".
-                                      For non-init containers or when this field is not specified,
+                                      This overrides the pod-level restart policy. When this field is not specified,
                                       the restart behavior is defined by the Pod's restart policy and the container type.
-                                      Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                      Additionally, setting the RestartPolicy as "Always" for the init container will
+                                      have the following effect:
                                       this init container will be continually restarted on
                                       exit until all regular containers have terminated. Once all regular
                                       containers have completed, all init containers with restartPolicy "Always"
@@ -12585,6 +13010,59 @@ spec:
                                       init container is started, or after any startupProbe has successfully
                                       completed.
                                     type: string
+                                  restartPolicyRules:
+                                    description: |-
+                                      Represents a list of rules to be checked to determine if the
+                                      container should be restarted on exit. The rules are evaluated in
+                                      order. Once a rule matches a container exit condition, the remaining
+                                      rules are ignored. If no rule matches the container exit condition,
+                                      the Container-level restart policy determines the whether the container
+                                      is restarted or not. Constraints on the rules:
+                                      - At most 20 rules are allowed.
+                                      - Rules can have the same action.
+                                      - Identical rules are not forbidden in validations.
+                                      When rules are specified, container MUST set RestartPolicy explicitly
+                                      even it if matches the Pod's RestartPolicy.
+                                    items:
+                                      description: ContainerRestartRule describes
+                                        how a container exit is handled.
+                                      properties:
+                                        action:
+                                          description: |-
+                                            Specifies the action taken on a container exit if the requirements
+                                            are satisfied. The only possible value is "Restart" to restart the
+                                            container.
+                                          type: string
+                                        exitCodes:
+                                          description: Represents the exit codes to
+                                            check on container exits.
+                                          properties:
+                                            operator:
+                                              description: |-
+                                                Represents the relationship between the container exit code(s) and the
+                                                specified values. Possible values are:
+                                                - In: the requirement is satisfied if the container exit code is in the
+                                                  set of specified values.
+                                                - NotIn: the requirement is satisfied if the container exit code is
+                                                  not in the set of specified values.
+                                              type: string
+                                            values:
+                                              description: |-
+                                                Specifies the set of values to check for container exit codes.
+                                                At most 255 elements are allowed.
+                                              items:
+                                                format: int32
+                                                type: integer
+                                              type: array
+                                              x-kubernetes-list-type: set
+                                          required:
+                                          - operator
+                                          type: object
+                                      required:
+                                      - action
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
                                   securityContext:
                                     description: |-
                                       SecurityContext defines the security options the container should be run with.
@@ -13208,8 +13686,9 @@ spec:
                                         variable present in a Container.
                                       properties:
                                         name:
-                                          description: Name of the environment variable.
-                                            Must be a C_IDENTIFIER.
+                                          description: |-
+                                            Name of the environment variable.
+                                            May consist of any printable ASCII characters except '='.
                                           type: string
                                         value:
                                           description: |-
@@ -13269,6 +13748,43 @@ spec:
                                               - fieldPath
                                               type: object
                                               x-kubernetes-map-type: atomic
+                                            fileKeyRef:
+                                              description: |-
+                                                FileKeyRef selects a key of the env file.
+                                                Requires the EnvFiles feature gate to be enabled.
+                                              properties:
+                                                key:
+                                                  description: |-
+                                                    The key within the env file. An invalid key will prevent the pod from starting.
+                                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                    During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                  type: string
+                                                optional:
+                                                  default: false
+                                                  description: |-
+                                                    Specify whether the file or its key must be defined. If the file or key
+                                                    does not exist, then the env var is not published.
+                                                    If optional is set to true and the specified key does not exist,
+                                                    the environment variable will not be set in the Pod's containers.
+
+                                                    If optional is set to false and the specified key does not exist,
+                                                    an error will be returned during Pod creation.
+                                                  type: boolean
+                                                path:
+                                                  description: |-
+                                                    The path within the volume from which to select the file.
+                                                    Must be relative and may not contain the '..' path or start with '..'.
+                                                  type: string
+                                                volumeName:
+                                                  description: The name of the volume
+                                                    mount containing the env file.
+                                                  type: string
+                                              required:
+                                              - key
+                                              - path
+                                              - volumeName
+                                              type: object
+                                              x-kubernetes-map-type: atomic
                                             resourceFieldRef:
                                               description: |-
                                                 Selects a resource of the container: only resources limits and requests
@@ -13333,8 +13849,8 @@ spec:
                                   envFrom:
                                     description: |-
                                       List of sources to populate environment variables in the container.
-                                      The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                      will be reported as an event when the container is starting. When a key exists in multiple
+                                      The keys defined within a source may consist of any printable ASCII characters except '='.
+                                      When a key exists in multiple
                                       sources, the value associated with the last source will take precedence.
                                       Values defined by an Env with a duplicate key will take precedence.
                                       Cannot be updated.
@@ -13361,9 +13877,9 @@ spec:
                                           type: object
                                           x-kubernetes-map-type: atomic
                                         prefix:
-                                          description: Optional text to prepend to
-                                            the name of each environment variable.
-                                            Must be a C_IDENTIFIER.
+                                          description: |-
+                                            Optional text to prepend to the name of each environment variable.
+                                            May consist of any printable ASCII characters except '='.
                                           type: string
                                         secretRef:
                                           description: The Secret to select from
@@ -14035,7 +14551,7 @@ spec:
                                           Claims lists the names of resources, defined in spec.resourceClaims,
                                           that are used by this container.
 
-                                          This is an alpha field and requires enabling the
+                                          This field depends on the
                                           DynamicResourceAllocation feature gate.
 
                                           This field is immutable. It can only be set for containers.
@@ -14091,9 +14607,53 @@ spec:
                                     description: |-
                                       Restart policy for the container to manage the restart behavior of each
                                       container within a pod.
-                                      This may only be set for init containers. You cannot set this field on
-                                      ephemeral containers.
+                                      You cannot set this field on ephemeral containers.
                                     type: string
+                                  restartPolicyRules:
+                                    description: |-
+                                      Represents a list of rules to be checked to determine if the
+                                      container should be restarted on exit. You cannot set this field on
+                                      ephemeral containers.
+                                    items:
+                                      description: ContainerRestartRule describes
+                                        how a container exit is handled.
+                                      properties:
+                                        action:
+                                          description: |-
+                                            Specifies the action taken on a container exit if the requirements
+                                            are satisfied. The only possible value is "Restart" to restart the
+                                            container.
+                                          type: string
+                                        exitCodes:
+                                          description: Represents the exit codes to
+                                            check on container exits.
+                                          properties:
+                                            operator:
+                                              description: |-
+                                                Represents the relationship between the container exit code(s) and the
+                                                specified values. Possible values are:
+                                                - In: the requirement is satisfied if the container exit code is in the
+                                                  set of specified values.
+                                                - NotIn: the requirement is satisfied if the container exit code is
+                                                  not in the set of specified values.
+                                              type: string
+                                            values:
+                                              description: |-
+                                                Specifies the set of values to check for container exit codes.
+                                                At most 255 elements are allowed.
+                                              items:
+                                                format: int32
+                                                type: integer
+                                              type: array
+                                              x-kubernetes-list-type: set
+                                          required:
+                                          - operator
+                                          type: object
+                                      required:
+                                      - action
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
                                   securityContext:
                                     description: |-
                                       Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -14636,7 +15196,9 @@ spec:
                             hostNetwork:
                               description: |-
                                 Host networking requested for this pod. Use the host's network namespace.
-                                If this option is set, the ports that will be used must be specified.
+                                When using HostNetwork you should specify ports so the scheduler is aware.
+                                When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
+                                and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
                                 Default to false.
                               type: boolean
                             hostPID:
@@ -14661,6 +15223,19 @@ spec:
                                 Specifies the hostname of the Pod
                                 If not specified, the pod's hostname will be set to a system-defined value.
                               type: string
+                            hostnameOverride:
+                              description: |-
+                                HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
+                                This field only specifies the pod's hostname and does not affect its DNS records.
+                                When this field is set to a non-empty string:
+                                - It takes precedence over the values set in `hostname` and `subdomain`.
+                                - The Pod's hostname will be set to this value.
+                                - `setHostnameAsFQDN` must be nil or set to false.
+                                - `hostNetwork` must be set to false.
+
+                                This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
+                                Requires the HostnameOverride feature gate to be enabled.
+                              type: string
                             imagePullSecrets:
                               description: |-
                                 ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -14742,8 +15317,9 @@ spec:
                                         variable present in a Container.
                                       properties:
                                         name:
-                                          description: Name of the environment variable.
-                                            Must be a C_IDENTIFIER.
+                                          description: |-
+                                            Name of the environment variable.
+                                            May consist of any printable ASCII characters except '='.
                                           type: string
                                         value:
                                           description: |-
@@ -14803,6 +15379,43 @@ spec:
                                               - fieldPath
                                               type: object
                                               x-kubernetes-map-type: atomic
+                                            fileKeyRef:
+                                              description: |-
+                                                FileKeyRef selects a key of the env file.
+                                                Requires the EnvFiles feature gate to be enabled.
+                                              properties:
+                                                key:
+                                                  description: |-
+                                                    The key within the env file. An invalid key will prevent the pod from starting.
+                                                    The keys defined within a source may consist of any printable ASCII characters except '='.
+                                                    During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                                  type: string
+                                                optional:
+                                                  default: false
+                                                  description: |-
+                                                    Specify whether the file or its key must be defined. If the file or key
+                                                    does not exist, then the env var is not published.
+                                                    If optional is set to true and the specified key does not exist,
+                                                    the environment variable will not be set in the Pod's containers.
+
+                                                    If optional is set to false and the specified key does not exist,
+                                                    an error will be returned during Pod creation.
+                                                  type: boolean
+                                                path:
+                                                  description: |-
+                                                    The path within the volume from which to select the file.
+                                                    Must be relative and may not contain the '..' path or start with '..'.
+                                                  type: string
+                                                volumeName:
+                                                  description: The name of the volume
+                                                    mount containing the env file.
+                                                  type: string
+                                              required:
+                                              - key
+                                              - path
+                                              - volumeName
+                                              type: object
+                                              x-kubernetes-map-type: atomic
                                             resourceFieldRef:
                                               description: |-
                                                 Selects a resource of the container: only resources limits and requests
@@ -14867,8 +15480,8 @@ spec:
                                   envFrom:
                                     description: |-
                                       List of sources to populate environment variables in the container.
-                                      The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                      will be reported as an event when the container is starting. When a key exists in multiple
+                                      The keys defined within a source may consist of any printable ASCII characters except '='.
+                                      When a key exists in multiple
                                       sources, the value associated with the last source will take precedence.
                                       Values defined by an Env with a duplicate key will take precedence.
                                       Cannot be updated.
@@ -14895,9 +15508,9 @@ spec:
                                           type: object
                                           x-kubernetes-map-type: atomic
                                         prefix:
-                                          description: Optional text to prepend to
-                                            the name of each environment variable.
-                                            Must be a C_IDENTIFIER.
+                                          description: |-
+                                            Optional text to prepend to the name of each environment variable.
+                                            May consist of any printable ASCII characters except '='.
                                           type: string
                                         secretRef:
                                           description: The Secret to select from
@@ -15586,7 +16199,7 @@ spec:
                                           Claims lists the names of resources, defined in spec.resourceClaims,
                                           that are used by this container.
 
-                                          This is an alpha field and requires enabling the
+                                          This field depends on the
                                           DynamicResourceAllocation feature gate.
 
                                           This field is immutable. It can only be set for containers.
@@ -15641,10 +16254,10 @@ spec:
                                   restartPolicy:
                                     description: |-
                                       RestartPolicy defines the restart behavior of individual containers in a pod.
-                                      This field may only be set for init containers, and the only allowed value is "Always".
-                                      For non-init containers or when this field is not specified,
+                                      This overrides the pod-level restart policy. When this field is not specified,
                                       the restart behavior is defined by the Pod's restart policy and the container type.
-                                      Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                      Additionally, setting the RestartPolicy as "Always" for the init container will
+                                      have the following effect:
                                       this init container will be continually restarted on
                                       exit until all regular containers have terminated. Once all regular
                                       containers have completed, all init containers with restartPolicy "Always"
@@ -15656,6 +16269,59 @@ spec:
                                       init container is started, or after any startupProbe has successfully
                                       completed.
                                     type: string
+                                  restartPolicyRules:
+                                    description: |-
+                                      Represents a list of rules to be checked to determine if the
+                                      container should be restarted on exit. The rules are evaluated in
+                                      order. Once a rule matches a container exit condition, the remaining
+                                      rules are ignored. If no rule matches the container exit condition,
+                                      the Container-level restart policy determines the whether the container
+                                      is restarted or not. Constraints on the rules:
+                                      - At most 20 rules are allowed.
+                                      - Rules can have the same action.
+                                      - Identical rules are not forbidden in validations.
+                                      When rules are specified, container MUST set RestartPolicy explicitly
+                                      even it if matches the Pod's RestartPolicy.
+                                    items:
+                                      description: ContainerRestartRule describes
+                                        how a container exit is handled.
+                                      properties:
+                                        action:
+                                          description: |-
+                                            Specifies the action taken on a container exit if the requirements
+                                            are satisfied. The only possible value is "Restart" to restart the
+                                            container.
+                                          type: string
+                                        exitCodes:
+                                          description: Represents the exit codes to
+                                            check on container exits.
+                                          properties:
+                                            operator:
+                                              description: |-
+                                                Represents the relationship between the container exit code(s) and the
+                                                specified values. Possible values are:
+                                                - In: the requirement is satisfied if the container exit code is in the
+                                                  set of specified values.
+                                                - NotIn: the requirement is satisfied if the container exit code is
+                                                  not in the set of specified values.
+                                              type: string
+                                            values:
+                                              description: |-
+                                                Specifies the set of values to check for container exit codes.
+                                                At most 255 elements are allowed.
+                                              items:
+                                                format: int32
+                                                type: integer
+                                              type: array
+                                              x-kubernetes-list-type: set
+                                          required:
+                                          - operator
+                                          type: object
+                                      required:
+                                      - action
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
                                   securityContext:
                                     description: |-
                                       SecurityContext defines the security options the container should be run with.
@@ -16192,6 +16858,7 @@ spec:
                                 - spec.hostPID
                                 - spec.hostIPC
                                 - spec.hostUsers
+                                - spec.resources
                                 - spec.securityContext.appArmorProfile
                                 - spec.securityContext.seLinuxOptions
                                 - spec.securityContext.seccompProfile
@@ -16345,7 +17012,7 @@ spec:
                               description: |-
                                 Resources is the total amount of CPU and Memory resources required by all
                                 containers in the pod. It supports specifying Requests and Limits for
-                                "cpu" and "memory" resource names only. ResourceClaims are not supported.
+                                "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
 
                                 This field enables fine-grained control over resource allocation for the
                                 entire pod, allowing resource sharing among containers in a pod.
@@ -16358,7 +17025,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -17661,15 +18328,13 @@ spec:
                                                   volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                                   If specified, the CSI driver will create or update the volume with the attributes defined
                                                   in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                                  it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                                  will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                                  If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                                  will be set by the persistentvolume controller if it exists.
+                                                  it can be changed after the claim is created. An empty string or nil value indicates that no
+                                                  VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                                  this field can be reset to its previous value (including nil) to cancel the modification.
                                                   If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                                   set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                                   exists.
                                                   More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                                  (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                                 type: string
                                               volumeMode:
                                                 description: |-
@@ -17854,12 +18519,10 @@ spec:
                                     description: |-
                                       glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                       Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                                      More info: https://examples.k8s.io/volumes/glusterfs/README.md
                                     properties:
                                       endpoints:
-                                        description: |-
-                                          endpoints is the endpoint name that details Glusterfs topology.
-                                          More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                        description: endpoints is the endpoint name
+                                          that details Glusterfs topology.
                                         type: string
                                       path:
                                         description: |-
@@ -17938,7 +18601,7 @@ spec:
                                     description: |-
                                       iscsi represents an ISCSI Disk resource that is attached to a
                                       kubelet's host machine and then exposed to the pod.
-                                      More info: https://examples.k8s.io/volumes/iscsi/README.md
+                                      More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                                     properties:
                                       chapAuthDiscovery:
                                         description: chapAuthDiscovery defines whether
@@ -18374,6 +19037,112 @@ spec:
                                                   type: array
                                                   x-kubernetes-list-type: atomic
                                               type: object
+                                            podCertificate:
+                                              description: |-
+                                                Projects an auto-rotating credential bundle (private key and certificate
+                                                chain) that the pod can use either as a TLS client or server.
+
+                                                Kubelet generates a private key and uses it to send a
+                                                PodCertificateRequest to the named signer.  Once the signer approves the
+                                                request and issues a certificate chain, Kubelet writes the key and
+                                                certificate chain to the pod filesystem.  The pod does not start until
+                                                certificates have been issued for each podCertificate projected volume
+                                                source in its spec.
+
+                                                Kubelet will begin trying to rotate the certificate at the time indicated
+                                                by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                                timestamp.
+
+                                                Kubelet can write a single file, indicated by the credentialBundlePath
+                                                field, or separate files, indicated by the keyPath and
+                                                certificateChainPath fields.
+
+                                                The credential bundle is a single file in PEM format.  The first PEM
+                                                entry is the private key (in PKCS#8 format), and the remaining PEM
+                                                entries are the certificate chain issued by the signer (typically,
+                                                signers will return their certificate chain in leaf-to-root order).
+
+                                                Prefer using the credential bundle format, since your application code
+                                                can read it atomically.  If you use keyPath and certificateChainPath,
+                                                your application must make two separate file reads. If these coincide
+                                                with a certificate rotation, it is possible that the private key and leaf
+                                                certificate you read may not correspond to each other.  Your application
+                                                will need to check for this condition, and re-read until they are
+                                                consistent.
+
+                                                The named signer controls chooses the format of the certificate it
+                                                issues; consult the signer implementation's documentation to learn how to
+                                                use the certificates it issues.
+                                              properties:
+                                                certificateChainPath:
+                                                  description: |-
+                                                    Write the certificate chain at this path in the projected volume.
+
+                                                    Most applications should use credentialBundlePath.  When using keyPath
+                                                    and certificateChainPath, your application needs to check that the key
+                                                    and leaf certificate are consistent, because it is possible to read the
+                                                    files mid-rotation.
+                                                  type: string
+                                                credentialBundlePath:
+                                                  description: |-
+                                                    Write the credential bundle at this path in the projected volume.
+
+                                                    The credential bundle is a single file that contains multiple PEM blocks.
+                                                    The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                                    key.
+
+                                                    The remaining blocks are CERTIFICATE blocks, containing the issued
+                                                    certificate chain from the signer (leaf and any intermediates).
+
+                                                    Using credentialBundlePath lets your Pod's application code make a single
+                                                    atomic read that retrieves a consistent key and certificate chain.  If you
+                                                    project them to separate files, your application code will need to
+                                                    additionally check that the leaf certificate was issued to the key.
+                                                  type: string
+                                                keyPath:
+                                                  description: |-
+                                                    Write the key at this path in the projected volume.
+
+                                                    Most applications should use credentialBundlePath.  When using keyPath
+                                                    and certificateChainPath, your application needs to check that the key
+                                                    and leaf certificate are consistent, because it is possible to read the
+                                                    files mid-rotation.
+                                                  type: string
+                                                keyType:
+                                                  description: |-
+                                                    The type of keypair Kubelet will generate for the pod.
+
+                                                    Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                                    "ECDSAP521", and "ED25519".
+                                                  type: string
+                                                maxExpirationSeconds:
+                                                  description: |-
+                                                    maxExpirationSeconds is the maximum lifetime permitted for the
+                                                    certificate.
+
+                                                    Kubelet copies this value verbatim into the PodCertificateRequests it
+                                                    generates for this projection.
+
+                                                    If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                                    will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                                    value is 7862400 (91 days).
+
+                                                    The signer implementation is then free to issue a certificate with any
+                                                    lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                                    seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                                    `kubernetes.io` signers will never issue certificates with a lifetime
+                                                    longer than 24 hours.
+                                                  format: int32
+                                                  type: integer
+                                                signerName:
+                                                  description: Kubelet's generated
+                                                    CSRs will be addressed to this
+                                                    signer.
+                                                  type: string
+                                              required:
+                                              - keyType
+                                              - signerName
+                                              type: object
                                             secret:
                                               description: secret information about
                                                 the secret data to project
@@ -18511,7 +19280,6 @@ spec:
                                     description: |-
                                       rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                       Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                                      More info: https://examples.k8s.io/volumes/rbd/README.md
                                     properties:
                                       fsType:
                                         description: |-
@@ -19035,15 +19803,13 @@ spec:
                                   volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                   If specified, the CSI driver will create or update the volume with the attributes defined
                                   in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                  it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                  will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                  If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                  will be set by the persistentvolume controller if it exists.
+                                  it can be changed after the claim is created. An empty string or nil value indicates that no
+                                  VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                  this field can be reset to its previous value (including nil) to cancel the modification.
                                   If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                   set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                   exists.
                                   More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                  (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                 type: string
                               volumeMode:
                                 description: |-
@@ -19214,13 +19980,11 @@ spec:
                                 description: |-
                                   currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
                                   When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
-                                  This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                                 type: string
                               modifyVolumeStatus:
                                 description: |-
                                   ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
                                   When this is unset, there is no ModifyVolume operation being attempted.
-                                  This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                                 properties:
                                   status:
                                     description: "status is the status of the ControllerModifyVolume
diff --git a/config/crds/v1/resources/enterprisesearch.k8s.elastic.co_enterprisesearches.yaml b/config/crds/v1/resources/enterprisesearch.k8s.elastic.co_enterprisesearches.yaml
index 760880304..e7e5a7bae 100644
--- a/config/crds/v1/resources/enterprisesearch.k8s.elastic.co_enterprisesearches.yaml
+++ b/config/crds/v1/resources/enterprisesearch.k8s.elastic.co_enterprisesearches.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: enterprisesearches.enterprisesearch.k8s.elastic.co
 spec:
   group: enterprisesearch.k8s.elastic.co
@@ -92,7 +92,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -1141,8 +1142,8 @@ spec:
                                   most preferred is the one with the greatest sum of weights, i.e.
                                   for each node that meets all of the scheduling requirements (resource
                                   request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                  compute a sum by iterating through the elements of this field and adding
-                                  "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  compute a sum by iterating through the elements of this field and subtracting
+                                  "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                   node(s) with the highest sum are the most preferred.
                                 items:
                                   description: The weights of all of the matched WeightedPodAffinityTerm
@@ -1540,8 +1541,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -1600,6 +1602,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -1662,8 +1701,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -1690,8 +1729,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -2370,7 +2410,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -2425,10 +2465,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This field may only be set for init containers, and the only allowed value is "Always".
-                                For non-init containers or when this field is not specified,
+                                This overrides the pod-level restart policy. When this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                Additionally, setting the RestartPolicy as "Always" for the init container will
+                                have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -2440,6 +2480,59 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. The rules are evaluated in
+                                order. Once a rule matches a container exit condition, the remaining
+                                rules are ignored. If no rule matches the container exit condition,
+                                the Container-level restart policy determines the whether the container
+                                is restarted or not. Constraints on the rules:
+                                - At most 20 rules are allowed.
+                                - Rules can have the same action.
+                                - Identical rules are not forbidden in validations.
+                                When rules are specified, container MUST set RestartPolicy explicitly
+                                even it if matches the Pod's RestartPolicy.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -3060,8 +3153,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -3120,6 +3214,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -3182,8 +3313,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -3210,8 +3341,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -3870,7 +4002,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -3926,9 +4058,53 @@ spec:
                               description: |-
                                 Restart policy for the container to manage the restart behavior of each
                                 container within a pod.
-                                This may only be set for init containers. You cannot set this field on
-                                ephemeral containers.
+                                You cannot set this field on ephemeral containers.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. You cannot set this field on
+                                ephemeral containers.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -4467,7 +4643,9 @@ spec:
                       hostNetwork:
                         description: |-
                           Host networking requested for this pod. Use the host's network namespace.
-                          If this option is set, the ports that will be used must be specified.
+                          When using HostNetwork you should specify ports so the scheduler is aware.
+                          When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
+                          and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
                           Default to false.
                         type: boolean
                       hostPID:
@@ -4492,6 +4670,19 @@ spec:
                           Specifies the hostname of the Pod
                           If not specified, the pod's hostname will be set to a system-defined value.
                         type: string
+                      hostnameOverride:
+                        description: |-
+                          HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
+                          This field only specifies the pod's hostname and does not affect its DNS records.
+                          When this field is set to a non-empty string:
+                          - It takes precedence over the values set in `hostname` and `subdomain`.
+                          - The Pod's hostname will be set to this value.
+                          - `setHostnameAsFQDN` must be nil or set to false.
+                          - `hostNetwork` must be set to false.
+
+                          This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
+                          Requires the HostnameOverride feature gate to be enabled.
+                        type: string
                       imagePullSecrets:
                         description: |-
                           ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -4573,8 +4764,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -4633,6 +4825,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -4695,8 +4924,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -4723,8 +4952,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -5403,7 +5633,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -5458,10 +5688,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This field may only be set for init containers, and the only allowed value is "Always".
-                                For non-init containers or when this field is not specified,
+                                This overrides the pod-level restart policy. When this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                Additionally, setting the RestartPolicy as "Always" for the init container will
+                                have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -5473,6 +5703,59 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. The rules are evaluated in
+                                order. Once a rule matches a container exit condition, the remaining
+                                rules are ignored. If no rule matches the container exit condition,
+                                the Container-level restart policy determines the whether the container
+                                is restarted or not. Constraints on the rules:
+                                - At most 20 rules are allowed.
+                                - Rules can have the same action.
+                                - Identical rules are not forbidden in validations.
+                                When rules are specified, container MUST set RestartPolicy explicitly
+                                even it if matches the Pod's RestartPolicy.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -6006,6 +6289,7 @@ spec:
                           - spec.hostPID
                           - spec.hostIPC
                           - spec.hostUsers
+                          - spec.resources
                           - spec.securityContext.appArmorProfile
                           - spec.securityContext.seLinuxOptions
                           - spec.securityContext.seccompProfile
@@ -6159,7 +6443,7 @@ spec:
                         description: |-
                           Resources is the total amount of CPU and Memory resources required by all
                           containers in the pod. It supports specifying Requests and Limits for
-                          "cpu" and "memory" resource names only. ResourceClaims are not supported.
+                          "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
 
                           This field enables fine-grained control over resource allocation for the
                           entire pod, allowing resource sharing among containers in a pod.
@@ -6172,7 +6456,7 @@ spec:
                               Claims lists the names of resources, defined in spec.resourceClaims,
                               that are used by this container.
 
-                              This is an alpha field and requires enabling the
+                              This field depends on the
                               DynamicResourceAllocation feature gate.
 
                               This field is immutable. It can only be set for containers.
@@ -7466,15 +7750,13 @@ spec:
                                             volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                             If specified, the CSI driver will create or update the volume with the attributes defined
                                             in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                            it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                            will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                            If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                            will be set by the persistentvolume controller if it exists.
+                                            it can be changed after the claim is created. An empty string or nil value indicates that no
+                                            VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                            this field can be reset to its previous value (including nil) to cancel the modification.
                                             If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                             set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                             exists.
                                             More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                            (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                           type: string
                                         volumeMode:
                                           description: |-
@@ -7656,12 +7938,10 @@ spec:
                               description: |-
                                 glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                 Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                                More info: https://examples.k8s.io/volumes/glusterfs/README.md
                               properties:
                                 endpoints:
-                                  description: |-
-                                    endpoints is the endpoint name that details Glusterfs topology.
-                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                  description: endpoints is the endpoint name that
+                                    details Glusterfs topology.
                                   type: string
                                 path:
                                   description: |-
@@ -7740,7 +8020,7 @@ spec:
                               description: |-
                                 iscsi represents an ISCSI Disk resource that is attached to a
                                 kubelet's host machine and then exposed to the pod.
-                                More info: https://examples.k8s.io/volumes/iscsi/README.md
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                               properties:
                                 chapAuthDiscovery:
                                   description: chapAuthDiscovery defines whether support
@@ -8166,6 +8446,111 @@ spec:
                                             type: array
                                             x-kubernetes-list-type: atomic
                                         type: object
+                                      podCertificate:
+                                        description: |-
+                                          Projects an auto-rotating credential bundle (private key and certificate
+                                          chain) that the pod can use either as a TLS client or server.
+
+                                          Kubelet generates a private key and uses it to send a
+                                          PodCertificateRequest to the named signer.  Once the signer approves the
+                                          request and issues a certificate chain, Kubelet writes the key and
+                                          certificate chain to the pod filesystem.  The pod does not start until
+                                          certificates have been issued for each podCertificate projected volume
+                                          source in its spec.
+
+                                          Kubelet will begin trying to rotate the certificate at the time indicated
+                                          by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                          timestamp.
+
+                                          Kubelet can write a single file, indicated by the credentialBundlePath
+                                          field, or separate files, indicated by the keyPath and
+                                          certificateChainPath fields.
+
+                                          The credential bundle is a single file in PEM format.  The first PEM
+                                          entry is the private key (in PKCS#8 format), and the remaining PEM
+                                          entries are the certificate chain issued by the signer (typically,
+                                          signers will return their certificate chain in leaf-to-root order).
+
+                                          Prefer using the credential bundle format, since your application code
+                                          can read it atomically.  If you use keyPath and certificateChainPath,
+                                          your application must make two separate file reads. If these coincide
+                                          with a certificate rotation, it is possible that the private key and leaf
+                                          certificate you read may not correspond to each other.  Your application
+                                          will need to check for this condition, and re-read until they are
+                                          consistent.
+
+                                          The named signer controls chooses the format of the certificate it
+                                          issues; consult the signer implementation's documentation to learn how to
+                                          use the certificates it issues.
+                                        properties:
+                                          certificateChainPath:
+                                            description: |-
+                                              Write the certificate chain at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          credentialBundlePath:
+                                            description: |-
+                                              Write the credential bundle at this path in the projected volume.
+
+                                              The credential bundle is a single file that contains multiple PEM blocks.
+                                              The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                              key.
+
+                                              The remaining blocks are CERTIFICATE blocks, containing the issued
+                                              certificate chain from the signer (leaf and any intermediates).
+
+                                              Using credentialBundlePath lets your Pod's application code make a single
+                                              atomic read that retrieves a consistent key and certificate chain.  If you
+                                              project them to separate files, your application code will need to
+                                              additionally check that the leaf certificate was issued to the key.
+                                            type: string
+                                          keyPath:
+                                            description: |-
+                                              Write the key at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          keyType:
+                                            description: |-
+                                              The type of keypair Kubelet will generate for the pod.
+
+                                              Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                              "ECDSAP521", and "ED25519".
+                                            type: string
+                                          maxExpirationSeconds:
+                                            description: |-
+                                              maxExpirationSeconds is the maximum lifetime permitted for the
+                                              certificate.
+
+                                              Kubelet copies this value verbatim into the PodCertificateRequests it
+                                              generates for this projection.
+
+                                              If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                              will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                              value is 7862400 (91 days).
+
+                                              The signer implementation is then free to issue a certificate with any
+                                              lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                              seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                              `kubernetes.io` signers will never issue certificates with a lifetime
+                                              longer than 24 hours.
+                                            format: int32
+                                            type: integer
+                                          signerName:
+                                            description: Kubelet's generated CSRs
+                                              will be addressed to this signer.
+                                            type: string
+                                        required:
+                                        - keyType
+                                        - signerName
+                                        type: object
                                       secret:
                                         description: secret information about the
                                           secret data to project
@@ -8300,7 +8685,6 @@ spec:
                               description: |-
                                 rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                 Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                                More info: https://examples.k8s.io/volumes/rbd/README.md
                               properties:
                                 fsType:
                                   description: |-
@@ -8731,7 +9115,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -9780,8 +10165,8 @@ spec:
                                   most preferred is the one with the greatest sum of weights, i.e.
                                   for each node that meets all of the scheduling requirements (resource
                                   request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                  compute a sum by iterating through the elements of this field and adding
-                                  "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  compute a sum by iterating through the elements of this field and subtracting
+                                  "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                   node(s) with the highest sum are the most preferred.
                                 items:
                                   description: The weights of all of the matched WeightedPodAffinityTerm
@@ -10179,8 +10564,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -10239,6 +10625,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -10301,8 +10724,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -10329,8 +10752,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -11009,7 +11433,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -11064,10 +11488,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This field may only be set for init containers, and the only allowed value is "Always".
-                                For non-init containers or when this field is not specified,
+                                This overrides the pod-level restart policy. When this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                Additionally, setting the RestartPolicy as "Always" for the init container will
+                                have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -11079,6 +11503,59 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. The rules are evaluated in
+                                order. Once a rule matches a container exit condition, the remaining
+                                rules are ignored. If no rule matches the container exit condition,
+                                the Container-level restart policy determines the whether the container
+                                is restarted or not. Constraints on the rules:
+                                - At most 20 rules are allowed.
+                                - Rules can have the same action.
+                                - Identical rules are not forbidden in validations.
+                                When rules are specified, container MUST set RestartPolicy explicitly
+                                even it if matches the Pod's RestartPolicy.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -11699,8 +12176,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -11759,6 +12237,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -11821,8 +12336,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -11849,8 +12364,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -12509,7 +13025,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -12565,9 +13081,53 @@ spec:
                               description: |-
                                 Restart policy for the container to manage the restart behavior of each
                                 container within a pod.
-                                This may only be set for init containers. You cannot set this field on
-                                ephemeral containers.
+                                You cannot set this field on ephemeral containers.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. You cannot set this field on
+                                ephemeral containers.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -13106,7 +13666,9 @@ spec:
                       hostNetwork:
                         description: |-
                           Host networking requested for this pod. Use the host's network namespace.
-                          If this option is set, the ports that will be used must be specified.
+                          When using HostNetwork you should specify ports so the scheduler is aware.
+                          When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
+                          and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
                           Default to false.
                         type: boolean
                       hostPID:
@@ -13131,6 +13693,19 @@ spec:
                           Specifies the hostname of the Pod
                           If not specified, the pod's hostname will be set to a system-defined value.
                         type: string
+                      hostnameOverride:
+                        description: |-
+                          HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
+                          This field only specifies the pod's hostname and does not affect its DNS records.
+                          When this field is set to a non-empty string:
+                          - It takes precedence over the values set in `hostname` and `subdomain`.
+                          - The Pod's hostname will be set to this value.
+                          - `setHostnameAsFQDN` must be nil or set to false.
+                          - `hostNetwork` must be set to false.
+
+                          This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
+                          Requires the HostnameOverride feature gate to be enabled.
+                        type: string
                       imagePullSecrets:
                         description: |-
                           ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -13212,8 +13787,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -13272,6 +13848,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -13334,8 +13947,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -13362,8 +13975,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -14042,7 +14656,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -14097,10 +14711,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This field may only be set for init containers, and the only allowed value is "Always".
-                                For non-init containers or when this field is not specified,
+                                This overrides the pod-level restart policy. When this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                Additionally, setting the RestartPolicy as "Always" for the init container will
+                                have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -14112,6 +14726,59 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. The rules are evaluated in
+                                order. Once a rule matches a container exit condition, the remaining
+                                rules are ignored. If no rule matches the container exit condition,
+                                the Container-level restart policy determines the whether the container
+                                is restarted or not. Constraints on the rules:
+                                - At most 20 rules are allowed.
+                                - Rules can have the same action.
+                                - Identical rules are not forbidden in validations.
+                                When rules are specified, container MUST set RestartPolicy explicitly
+                                even it if matches the Pod's RestartPolicy.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -14645,6 +15312,7 @@ spec:
                           - spec.hostPID
                           - spec.hostIPC
                           - spec.hostUsers
+                          - spec.resources
                           - spec.securityContext.appArmorProfile
                           - spec.securityContext.seLinuxOptions
                           - spec.securityContext.seccompProfile
@@ -14798,7 +15466,7 @@ spec:
                         description: |-
                           Resources is the total amount of CPU and Memory resources required by all
                           containers in the pod. It supports specifying Requests and Limits for
-                          "cpu" and "memory" resource names only. ResourceClaims are not supported.
+                          "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
 
                           This field enables fine-grained control over resource allocation for the
                           entire pod, allowing resource sharing among containers in a pod.
@@ -14811,7 +15479,7 @@ spec:
                               Claims lists the names of resources, defined in spec.resourceClaims,
                               that are used by this container.
 
-                              This is an alpha field and requires enabling the
+                              This field depends on the
                               DynamicResourceAllocation feature gate.
 
                               This field is immutable. It can only be set for containers.
@@ -16105,15 +16773,13 @@ spec:
                                             volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                             If specified, the CSI driver will create or update the volume with the attributes defined
                                             in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                            it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                            will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                            If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                            will be set by the persistentvolume controller if it exists.
+                                            it can be changed after the claim is created. An empty string or nil value indicates that no
+                                            VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                            this field can be reset to its previous value (including nil) to cancel the modification.
                                             If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                             set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                             exists.
                                             More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                            (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                           type: string
                                         volumeMode:
                                           description: |-
@@ -16295,12 +16961,10 @@ spec:
                               description: |-
                                 glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                 Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                                More info: https://examples.k8s.io/volumes/glusterfs/README.md
                               properties:
                                 endpoints:
-                                  description: |-
-                                    endpoints is the endpoint name that details Glusterfs topology.
-                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                  description: endpoints is the endpoint name that
+                                    details Glusterfs topology.
                                   type: string
                                 path:
                                   description: |-
@@ -16379,7 +17043,7 @@ spec:
                               description: |-
                                 iscsi represents an ISCSI Disk resource that is attached to a
                                 kubelet's host machine and then exposed to the pod.
-                                More info: https://examples.k8s.io/volumes/iscsi/README.md
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                               properties:
                                 chapAuthDiscovery:
                                   description: chapAuthDiscovery defines whether support
@@ -16805,6 +17469,111 @@ spec:
                                             type: array
                                             x-kubernetes-list-type: atomic
                                         type: object
+                                      podCertificate:
+                                        description: |-
+                                          Projects an auto-rotating credential bundle (private key and certificate
+                                          chain) that the pod can use either as a TLS client or server.
+
+                                          Kubelet generates a private key and uses it to send a
+                                          PodCertificateRequest to the named signer.  Once the signer approves the
+                                          request and issues a certificate chain, Kubelet writes the key and
+                                          certificate chain to the pod filesystem.  The pod does not start until
+                                          certificates have been issued for each podCertificate projected volume
+                                          source in its spec.
+
+                                          Kubelet will begin trying to rotate the certificate at the time indicated
+                                          by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                          timestamp.
+
+                                          Kubelet can write a single file, indicated by the credentialBundlePath
+                                          field, or separate files, indicated by the keyPath and
+                                          certificateChainPath fields.
+
+                                          The credential bundle is a single file in PEM format.  The first PEM
+                                          entry is the private key (in PKCS#8 format), and the remaining PEM
+                                          entries are the certificate chain issued by the signer (typically,
+                                          signers will return their certificate chain in leaf-to-root order).
+
+                                          Prefer using the credential bundle format, since your application code
+                                          can read it atomically.  If you use keyPath and certificateChainPath,
+                                          your application must make two separate file reads. If these coincide
+                                          with a certificate rotation, it is possible that the private key and leaf
+                                          certificate you read may not correspond to each other.  Your application
+                                          will need to check for this condition, and re-read until they are
+                                          consistent.
+
+                                          The named signer controls chooses the format of the certificate it
+                                          issues; consult the signer implementation's documentation to learn how to
+                                          use the certificates it issues.
+                                        properties:
+                                          certificateChainPath:
+                                            description: |-
+                                              Write the certificate chain at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          credentialBundlePath:
+                                            description: |-
+                                              Write the credential bundle at this path in the projected volume.
+
+                                              The credential bundle is a single file that contains multiple PEM blocks.
+                                              The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                              key.
+
+                                              The remaining blocks are CERTIFICATE blocks, containing the issued
+                                              certificate chain from the signer (leaf and any intermediates).
+
+                                              Using credentialBundlePath lets your Pod's application code make a single
+                                              atomic read that retrieves a consistent key and certificate chain.  If you
+                                              project them to separate files, your application code will need to
+                                              additionally check that the leaf certificate was issued to the key.
+                                            type: string
+                                          keyPath:
+                                            description: |-
+                                              Write the key at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          keyType:
+                                            description: |-
+                                              The type of keypair Kubelet will generate for the pod.
+
+                                              Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                              "ECDSAP521", and "ED25519".
+                                            type: string
+                                          maxExpirationSeconds:
+                                            description: |-
+                                              maxExpirationSeconds is the maximum lifetime permitted for the
+                                              certificate.
+
+                                              Kubelet copies this value verbatim into the PodCertificateRequests it
+                                              generates for this projection.
+
+                                              If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                              will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                              value is 7862400 (91 days).
+
+                                              The signer implementation is then free to issue a certificate with any
+                                              lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                              seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                              `kubernetes.io` signers will never issue certificates with a lifetime
+                                              longer than 24 hours.
+                                            format: int32
+                                            type: integer
+                                          signerName:
+                                            description: Kubelet's generated CSRs
+                                              will be addressed to this signer.
+                                            type: string
+                                        required:
+                                        - keyType
+                                        - signerName
+                                        type: object
                                       secret:
                                         description: secret information about the
                                           secret data to project
@@ -16939,7 +17708,6 @@ spec:
                               description: |-
                                 rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                 Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                                More info: https://examples.k8s.io/volumes/rbd/README.md
                               properties:
                                 fsType:
                                   description: |-
diff --git a/config/crds/v1/resources/kibana.k8s.elastic.co_kibanas.yaml b/config/crds/v1/resources/kibana.k8s.elastic.co_kibanas.yaml
index 7ff7d5ef4..a1ab3cc60 100644
--- a/config/crds/v1/resources/kibana.k8s.elastic.co_kibanas.yaml
+++ b/config/crds/v1/resources/kibana.k8s.elastic.co_kibanas.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: kibanas.kibana.k8s.elastic.co
 spec:
   group: kibana.k8s.elastic.co
@@ -81,7 +81,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -112,7 +113,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -576,7 +578,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -617,7 +620,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -1249,8 +1253,8 @@ spec:
                                   most preferred is the one with the greatest sum of weights, i.e.
                                   for each node that meets all of the scheduling requirements (resource
                                   request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                  compute a sum by iterating through the elements of this field and adding
-                                  "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  compute a sum by iterating through the elements of this field and subtracting
+                                  "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                   node(s) with the highest sum are the most preferred.
                                 items:
                                   description: The weights of all of the matched WeightedPodAffinityTerm
@@ -1648,8 +1652,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -1708,6 +1713,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -1770,8 +1812,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -1798,8 +1840,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -2478,7 +2521,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -2533,10 +2576,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This field may only be set for init containers, and the only allowed value is "Always".
-                                For non-init containers or when this field is not specified,
+                                This overrides the pod-level restart policy. When this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                Additionally, setting the RestartPolicy as "Always" for the init container will
+                                have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -2548,6 +2591,59 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. The rules are evaluated in
+                                order. Once a rule matches a container exit condition, the remaining
+                                rules are ignored. If no rule matches the container exit condition,
+                                the Container-level restart policy determines the whether the container
+                                is restarted or not. Constraints on the rules:
+                                - At most 20 rules are allowed.
+                                - Rules can have the same action.
+                                - Identical rules are not forbidden in validations.
+                                When rules are specified, container MUST set RestartPolicy explicitly
+                                even it if matches the Pod's RestartPolicy.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -3168,8 +3264,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -3228,6 +3325,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -3290,8 +3424,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -3318,8 +3452,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -3978,7 +4113,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -4034,9 +4169,53 @@ spec:
                               description: |-
                                 Restart policy for the container to manage the restart behavior of each
                                 container within a pod.
-                                This may only be set for init containers. You cannot set this field on
-                                ephemeral containers.
+                                You cannot set this field on ephemeral containers.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. You cannot set this field on
+                                ephemeral containers.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -4575,7 +4754,9 @@ spec:
                       hostNetwork:
                         description: |-
                           Host networking requested for this pod. Use the host's network namespace.
-                          If this option is set, the ports that will be used must be specified.
+                          When using HostNetwork you should specify ports so the scheduler is aware.
+                          When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
+                          and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
                           Default to false.
                         type: boolean
                       hostPID:
@@ -4600,6 +4781,19 @@ spec:
                           Specifies the hostname of the Pod
                           If not specified, the pod's hostname will be set to a system-defined value.
                         type: string
+                      hostnameOverride:
+                        description: |-
+                          HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
+                          This field only specifies the pod's hostname and does not affect its DNS records.
+                          When this field is set to a non-empty string:
+                          - It takes precedence over the values set in `hostname` and `subdomain`.
+                          - The Pod's hostname will be set to this value.
+                          - `setHostnameAsFQDN` must be nil or set to false.
+                          - `hostNetwork` must be set to false.
+
+                          This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
+                          Requires the HostnameOverride feature gate to be enabled.
+                        type: string
                       imagePullSecrets:
                         description: |-
                           ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -4681,8 +4875,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -4741,6 +4936,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -4803,8 +5035,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -4831,8 +5063,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -5511,7 +5744,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -5566,10 +5799,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This field may only be set for init containers, and the only allowed value is "Always".
-                                For non-init containers or when this field is not specified,
+                                This overrides the pod-level restart policy. When this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                Additionally, setting the RestartPolicy as "Always" for the init container will
+                                have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -5581,6 +5814,59 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. The rules are evaluated in
+                                order. Once a rule matches a container exit condition, the remaining
+                                rules are ignored. If no rule matches the container exit condition,
+                                the Container-level restart policy determines the whether the container
+                                is restarted or not. Constraints on the rules:
+                                - At most 20 rules are allowed.
+                                - Rules can have the same action.
+                                - Identical rules are not forbidden in validations.
+                                When rules are specified, container MUST set RestartPolicy explicitly
+                                even it if matches the Pod's RestartPolicy.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -6114,6 +6400,7 @@ spec:
                           - spec.hostPID
                           - spec.hostIPC
                           - spec.hostUsers
+                          - spec.resources
                           - spec.securityContext.appArmorProfile
                           - spec.securityContext.seLinuxOptions
                           - spec.securityContext.seccompProfile
@@ -6267,7 +6554,7 @@ spec:
                         description: |-
                           Resources is the total amount of CPU and Memory resources required by all
                           containers in the pod. It supports specifying Requests and Limits for
-                          "cpu" and "memory" resource names only. ResourceClaims are not supported.
+                          "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
 
                           This field enables fine-grained control over resource allocation for the
                           entire pod, allowing resource sharing among containers in a pod.
@@ -6280,7 +6567,7 @@ spec:
                               Claims lists the names of resources, defined in spec.resourceClaims,
                               that are used by this container.
 
-                              This is an alpha field and requires enabling the
+                              This field depends on the
                               DynamicResourceAllocation feature gate.
 
                               This field is immutable. It can only be set for containers.
@@ -7574,15 +7861,13 @@ spec:
                                             volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                             If specified, the CSI driver will create or update the volume with the attributes defined
                                             in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                            it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                            will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                            If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                            will be set by the persistentvolume controller if it exists.
+                                            it can be changed after the claim is created. An empty string or nil value indicates that no
+                                            VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                            this field can be reset to its previous value (including nil) to cancel the modification.
                                             If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                             set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                             exists.
                                             More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                            (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                           type: string
                                         volumeMode:
                                           description: |-
@@ -7764,12 +8049,10 @@ spec:
                               description: |-
                                 glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                 Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                                More info: https://examples.k8s.io/volumes/glusterfs/README.md
                               properties:
                                 endpoints:
-                                  description: |-
-                                    endpoints is the endpoint name that details Glusterfs topology.
-                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                  description: endpoints is the endpoint name that
+                                    details Glusterfs topology.
                                   type: string
                                 path:
                                   description: |-
@@ -7848,7 +8131,7 @@ spec:
                               description: |-
                                 iscsi represents an ISCSI Disk resource that is attached to a
                                 kubelet's host machine and then exposed to the pod.
-                                More info: https://examples.k8s.io/volumes/iscsi/README.md
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                               properties:
                                 chapAuthDiscovery:
                                   description: chapAuthDiscovery defines whether support
@@ -8274,6 +8557,111 @@ spec:
                                             type: array
                                             x-kubernetes-list-type: atomic
                                         type: object
+                                      podCertificate:
+                                        description: |-
+                                          Projects an auto-rotating credential bundle (private key and certificate
+                                          chain) that the pod can use either as a TLS client or server.
+
+                                          Kubelet generates a private key and uses it to send a
+                                          PodCertificateRequest to the named signer.  Once the signer approves the
+                                          request and issues a certificate chain, Kubelet writes the key and
+                                          certificate chain to the pod filesystem.  The pod does not start until
+                                          certificates have been issued for each podCertificate projected volume
+                                          source in its spec.
+
+                                          Kubelet will begin trying to rotate the certificate at the time indicated
+                                          by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                          timestamp.
+
+                                          Kubelet can write a single file, indicated by the credentialBundlePath
+                                          field, or separate files, indicated by the keyPath and
+                                          certificateChainPath fields.
+
+                                          The credential bundle is a single file in PEM format.  The first PEM
+                                          entry is the private key (in PKCS#8 format), and the remaining PEM
+                                          entries are the certificate chain issued by the signer (typically,
+                                          signers will return their certificate chain in leaf-to-root order).
+
+                                          Prefer using the credential bundle format, since your application code
+                                          can read it atomically.  If you use keyPath and certificateChainPath,
+                                          your application must make two separate file reads. If these coincide
+                                          with a certificate rotation, it is possible that the private key and leaf
+                                          certificate you read may not correspond to each other.  Your application
+                                          will need to check for this condition, and re-read until they are
+                                          consistent.
+
+                                          The named signer controls chooses the format of the certificate it
+                                          issues; consult the signer implementation's documentation to learn how to
+                                          use the certificates it issues.
+                                        properties:
+                                          certificateChainPath:
+                                            description: |-
+                                              Write the certificate chain at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          credentialBundlePath:
+                                            description: |-
+                                              Write the credential bundle at this path in the projected volume.
+
+                                              The credential bundle is a single file that contains multiple PEM blocks.
+                                              The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                              key.
+
+                                              The remaining blocks are CERTIFICATE blocks, containing the issued
+                                              certificate chain from the signer (leaf and any intermediates).
+
+                                              Using credentialBundlePath lets your Pod's application code make a single
+                                              atomic read that retrieves a consistent key and certificate chain.  If you
+                                              project them to separate files, your application code will need to
+                                              additionally check that the leaf certificate was issued to the key.
+                                            type: string
+                                          keyPath:
+                                            description: |-
+                                              Write the key at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          keyType:
+                                            description: |-
+                                              The type of keypair Kubelet will generate for the pod.
+
+                                              Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                              "ECDSAP521", and "ED25519".
+                                            type: string
+                                          maxExpirationSeconds:
+                                            description: |-
+                                              maxExpirationSeconds is the maximum lifetime permitted for the
+                                              certificate.
+
+                                              Kubelet copies this value verbatim into the PodCertificateRequests it
+                                              generates for this projection.
+
+                                              If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                              will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                              value is 7862400 (91 days).
+
+                                              The signer implementation is then free to issue a certificate with any
+                                              lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                              seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                              `kubernetes.io` signers will never issue certificates with a lifetime
+                                              longer than 24 hours.
+                                            format: int32
+                                            type: integer
+                                          signerName:
+                                            description: Kubelet's generated CSRs
+                                              will be addressed to this signer.
+                                            type: string
+                                        required:
+                                        - keyType
+                                        - signerName
+                                        type: object
                                       secret:
                                         description: secret information about the
                                           secret data to project
@@ -8408,7 +8796,6 @@ spec:
                               description: |-
                                 rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                 Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                                More info: https://examples.k8s.io/volumes/rbd/README.md
                               properties:
                                 fsType:
                                   description: |-
@@ -9908,8 +10295,8 @@ spec:
                                   most preferred is the one with the greatest sum of weights, i.e.
                                   for each node that meets all of the scheduling requirements (resource
                                   request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                  compute a sum by iterating through the elements of this field and adding
-                                  "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  compute a sum by iterating through the elements of this field and subtracting
+                                  "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                   node(s) with the highest sum are the most preferred.
                                 items:
                                   description: The weights of all of the matched WeightedPodAffinityTerm
@@ -10307,8 +10694,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -10367,6 +10755,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -10429,8 +10854,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -10457,8 +10882,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -11137,7 +11563,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -11192,10 +11618,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This field may only be set for init containers, and the only allowed value is "Always".
-                                For non-init containers or when this field is not specified,
+                                This overrides the pod-level restart policy. When this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                Additionally, setting the RestartPolicy as "Always" for the init container will
+                                have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -11207,6 +11633,59 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. The rules are evaluated in
+                                order. Once a rule matches a container exit condition, the remaining
+                                rules are ignored. If no rule matches the container exit condition,
+                                the Container-level restart policy determines the whether the container
+                                is restarted or not. Constraints on the rules:
+                                - At most 20 rules are allowed.
+                                - Rules can have the same action.
+                                - Identical rules are not forbidden in validations.
+                                When rules are specified, container MUST set RestartPolicy explicitly
+                                even it if matches the Pod's RestartPolicy.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -11827,8 +12306,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -11887,6 +12367,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -11949,8 +12466,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -11977,8 +12494,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -12637,7 +13155,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -12693,9 +13211,53 @@ spec:
                               description: |-
                                 Restart policy for the container to manage the restart behavior of each
                                 container within a pod.
-                                This may only be set for init containers. You cannot set this field on
-                                ephemeral containers.
+                                You cannot set this field on ephemeral containers.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. You cannot set this field on
+                                ephemeral containers.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -13234,7 +13796,9 @@ spec:
                       hostNetwork:
                         description: |-
                           Host networking requested for this pod. Use the host's network namespace.
-                          If this option is set, the ports that will be used must be specified.
+                          When using HostNetwork you should specify ports so the scheduler is aware.
+                          When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
+                          and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
                           Default to false.
                         type: boolean
                       hostPID:
@@ -13259,6 +13823,19 @@ spec:
                           Specifies the hostname of the Pod
                           If not specified, the pod's hostname will be set to a system-defined value.
                         type: string
+                      hostnameOverride:
+                        description: |-
+                          HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
+                          This field only specifies the pod's hostname and does not affect its DNS records.
+                          When this field is set to a non-empty string:
+                          - It takes precedence over the values set in `hostname` and `subdomain`.
+                          - The Pod's hostname will be set to this value.
+                          - `setHostnameAsFQDN` must be nil or set to false.
+                          - `hostNetwork` must be set to false.
+
+                          This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
+                          Requires the HostnameOverride feature gate to be enabled.
+                        type: string
                       imagePullSecrets:
                         description: |-
                           ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -13340,8 +13917,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -13400,6 +13978,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -13462,8 +14077,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -13490,8 +14105,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -14170,7 +14786,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -14225,10 +14841,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This field may only be set for init containers, and the only allowed value is "Always".
-                                For non-init containers or when this field is not specified,
+                                This overrides the pod-level restart policy. When this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                Additionally, setting the RestartPolicy as "Always" for the init container will
+                                have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -14240,6 +14856,59 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. The rules are evaluated in
+                                order. Once a rule matches a container exit condition, the remaining
+                                rules are ignored. If no rule matches the container exit condition,
+                                the Container-level restart policy determines the whether the container
+                                is restarted or not. Constraints on the rules:
+                                - At most 20 rules are allowed.
+                                - Rules can have the same action.
+                                - Identical rules are not forbidden in validations.
+                                When rules are specified, container MUST set RestartPolicy explicitly
+                                even it if matches the Pod's RestartPolicy.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -14773,6 +15442,7 @@ spec:
                           - spec.hostPID
                           - spec.hostIPC
                           - spec.hostUsers
+                          - spec.resources
                           - spec.securityContext.appArmorProfile
                           - spec.securityContext.seLinuxOptions
                           - spec.securityContext.seccompProfile
@@ -14926,7 +15596,7 @@ spec:
                         description: |-
                           Resources is the total amount of CPU and Memory resources required by all
                           containers in the pod. It supports specifying Requests and Limits for
-                          "cpu" and "memory" resource names only. ResourceClaims are not supported.
+                          "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
 
                           This field enables fine-grained control over resource allocation for the
                           entire pod, allowing resource sharing among containers in a pod.
@@ -14939,7 +15609,7 @@ spec:
                               Claims lists the names of resources, defined in spec.resourceClaims,
                               that are used by this container.
 
-                              This is an alpha field and requires enabling the
+                              This field depends on the
                               DynamicResourceAllocation feature gate.
 
                               This field is immutable. It can only be set for containers.
@@ -16233,15 +16903,13 @@ spec:
                                             volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                             If specified, the CSI driver will create or update the volume with the attributes defined
                                             in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                            it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                            will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                            If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                            will be set by the persistentvolume controller if it exists.
+                                            it can be changed after the claim is created. An empty string or nil value indicates that no
+                                            VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                            this field can be reset to its previous value (including nil) to cancel the modification.
                                             If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                             set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                             exists.
                                             More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                            (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                           type: string
                                         volumeMode:
                                           description: |-
@@ -16423,12 +17091,10 @@ spec:
                               description: |-
                                 glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                 Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                                More info: https://examples.k8s.io/volumes/glusterfs/README.md
                               properties:
                                 endpoints:
-                                  description: |-
-                                    endpoints is the endpoint name that details Glusterfs topology.
-                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                  description: endpoints is the endpoint name that
+                                    details Glusterfs topology.
                                   type: string
                                 path:
                                   description: |-
@@ -16507,7 +17173,7 @@ spec:
                               description: |-
                                 iscsi represents an ISCSI Disk resource that is attached to a
                                 kubelet's host machine and then exposed to the pod.
-                                More info: https://examples.k8s.io/volumes/iscsi/README.md
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                               properties:
                                 chapAuthDiscovery:
                                   description: chapAuthDiscovery defines whether support
@@ -16933,6 +17599,111 @@ spec:
                                             type: array
                                             x-kubernetes-list-type: atomic
                                         type: object
+                                      podCertificate:
+                                        description: |-
+                                          Projects an auto-rotating credential bundle (private key and certificate
+                                          chain) that the pod can use either as a TLS client or server.
+
+                                          Kubelet generates a private key and uses it to send a
+                                          PodCertificateRequest to the named signer.  Once the signer approves the
+                                          request and issues a certificate chain, Kubelet writes the key and
+                                          certificate chain to the pod filesystem.  The pod does not start until
+                                          certificates have been issued for each podCertificate projected volume
+                                          source in its spec.
+
+                                          Kubelet will begin trying to rotate the certificate at the time indicated
+                                          by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                          timestamp.
+
+                                          Kubelet can write a single file, indicated by the credentialBundlePath
+                                          field, or separate files, indicated by the keyPath and
+                                          certificateChainPath fields.
+
+                                          The credential bundle is a single file in PEM format.  The first PEM
+                                          entry is the private key (in PKCS#8 format), and the remaining PEM
+                                          entries are the certificate chain issued by the signer (typically,
+                                          signers will return their certificate chain in leaf-to-root order).
+
+                                          Prefer using the credential bundle format, since your application code
+                                          can read it atomically.  If you use keyPath and certificateChainPath,
+                                          your application must make two separate file reads. If these coincide
+                                          with a certificate rotation, it is possible that the private key and leaf
+                                          certificate you read may not correspond to each other.  Your application
+                                          will need to check for this condition, and re-read until they are
+                                          consistent.
+
+                                          The named signer controls chooses the format of the certificate it
+                                          issues; consult the signer implementation's documentation to learn how to
+                                          use the certificates it issues.
+                                        properties:
+                                          certificateChainPath:
+                                            description: |-
+                                              Write the certificate chain at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          credentialBundlePath:
+                                            description: |-
+                                              Write the credential bundle at this path in the projected volume.
+
+                                              The credential bundle is a single file that contains multiple PEM blocks.
+                                              The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                              key.
+
+                                              The remaining blocks are CERTIFICATE blocks, containing the issued
+                                              certificate chain from the signer (leaf and any intermediates).
+
+                                              Using credentialBundlePath lets your Pod's application code make a single
+                                              atomic read that retrieves a consistent key and certificate chain.  If you
+                                              project them to separate files, your application code will need to
+                                              additionally check that the leaf certificate was issued to the key.
+                                            type: string
+                                          keyPath:
+                                            description: |-
+                                              Write the key at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          keyType:
+                                            description: |-
+                                              The type of keypair Kubelet will generate for the pod.
+
+                                              Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                              "ECDSAP521", and "ED25519".
+                                            type: string
+                                          maxExpirationSeconds:
+                                            description: |-
+                                              maxExpirationSeconds is the maximum lifetime permitted for the
+                                              certificate.
+
+                                              Kubelet copies this value verbatim into the PodCertificateRequests it
+                                              generates for this projection.
+
+                                              If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                              will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                              value is 7862400 (91 days).
+
+                                              The signer implementation is then free to issue a certificate with any
+                                              lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                              seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                              `kubernetes.io` signers will never issue certificates with a lifetime
+                                              longer than 24 hours.
+                                            format: int32
+                                            type: integer
+                                          signerName:
+                                            description: Kubelet's generated CSRs
+                                              will be addressed to this signer.
+                                            type: string
+                                        required:
+                                        - keyType
+                                        - signerName
+                                        type: object
                                       secret:
                                         description: secret information about the
                                           secret data to project
@@ -17067,7 +17838,6 @@ spec:
                               description: |-
                                 rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                 Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                                More info: https://examples.k8s.io/volumes/rbd/README.md
                               properties:
                                 fsType:
                                   description: |-
diff --git a/config/crds/v1/resources/logstash.k8s.elastic.co_logstashes.yaml b/config/crds/v1/resources/logstash.k8s.elastic.co_logstashes.yaml
index 3b183f24a..974b3fa4b 100644
--- a/config/crds/v1/resources/logstash.k8s.elastic.co_logstashes.yaml
+++ b/config/crds/v1/resources/logstash.k8s.elastic.co_logstashes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: logstashes.logstash.k8s.elastic.co
 spec:
   group: logstash.k8s.elastic.co
@@ -105,7 +105,8 @@ spec:
                     secretName:
                       description: |-
                         SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                        Elastic resource not managed by the operator. The referenced secret must contain the following:
+                        Elastic resource not managed by the operator.
+                        The referenced secret must contain the following:
                         - `url`: the URL to reach the Elastic resource
                         - `username`: the username of the user to be authenticated to the Elastic resource
                         - `password`: the password of the user to be authenticated to the Elastic resource
@@ -157,7 +158,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -198,7 +200,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -847,8 +850,8 @@ spec:
                                   most preferred is the one with the greatest sum of weights, i.e.
                                   for each node that meets all of the scheduling requirements (resource
                                   request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                  compute a sum by iterating through the elements of this field and adding
-                                  "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  compute a sum by iterating through the elements of this field and subtracting
+                                  "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                   node(s) with the highest sum are the most preferred.
                                 items:
                                   description: The weights of all of the matched WeightedPodAffinityTerm
@@ -1246,8 +1249,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -1306,6 +1310,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -1368,8 +1409,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -1396,8 +1437,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -2076,7 +2118,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -2131,10 +2173,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This field may only be set for init containers, and the only allowed value is "Always".
-                                For non-init containers or when this field is not specified,
+                                This overrides the pod-level restart policy. When this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                Additionally, setting the RestartPolicy as "Always" for the init container will
+                                have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -2146,6 +2188,59 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. The rules are evaluated in
+                                order. Once a rule matches a container exit condition, the remaining
+                                rules are ignored. If no rule matches the container exit condition,
+                                the Container-level restart policy determines the whether the container
+                                is restarted or not. Constraints on the rules:
+                                - At most 20 rules are allowed.
+                                - Rules can have the same action.
+                                - Identical rules are not forbidden in validations.
+                                When rules are specified, container MUST set RestartPolicy explicitly
+                                even it if matches the Pod's RestartPolicy.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -2766,8 +2861,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -2826,6 +2922,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -2888,8 +3021,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -2916,8 +3049,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -3576,7 +3710,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -3632,9 +3766,53 @@ spec:
                               description: |-
                                 Restart policy for the container to manage the restart behavior of each
                                 container within a pod.
-                                This may only be set for init containers. You cannot set this field on
-                                ephemeral containers.
+                                You cannot set this field on ephemeral containers.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. You cannot set this field on
+                                ephemeral containers.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -4173,7 +4351,9 @@ spec:
                       hostNetwork:
                         description: |-
                           Host networking requested for this pod. Use the host's network namespace.
-                          If this option is set, the ports that will be used must be specified.
+                          When using HostNetwork you should specify ports so the scheduler is aware.
+                          When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
+                          and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
                           Default to false.
                         type: boolean
                       hostPID:
@@ -4198,6 +4378,19 @@ spec:
                           Specifies the hostname of the Pod
                           If not specified, the pod's hostname will be set to a system-defined value.
                         type: string
+                      hostnameOverride:
+                        description: |-
+                          HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
+                          This field only specifies the pod's hostname and does not affect its DNS records.
+                          When this field is set to a non-empty string:
+                          - It takes precedence over the values set in `hostname` and `subdomain`.
+                          - The Pod's hostname will be set to this value.
+                          - `setHostnameAsFQDN` must be nil or set to false.
+                          - `hostNetwork` must be set to false.
+
+                          This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
+                          Requires the HostnameOverride feature gate to be enabled.
+                        type: string
                       imagePullSecrets:
                         description: |-
                           ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -4279,8 +4472,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -4339,6 +4533,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -4401,8 +4632,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -4429,8 +4660,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -5109,7 +5341,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -5164,10 +5396,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This field may only be set for init containers, and the only allowed value is "Always".
-                                For non-init containers or when this field is not specified,
+                                This overrides the pod-level restart policy. When this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                Additionally, setting the RestartPolicy as "Always" for the init container will
+                                have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -5179,6 +5411,59 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. The rules are evaluated in
+                                order. Once a rule matches a container exit condition, the remaining
+                                rules are ignored. If no rule matches the container exit condition,
+                                the Container-level restart policy determines the whether the container
+                                is restarted or not. Constraints on the rules:
+                                - At most 20 rules are allowed.
+                                - Rules can have the same action.
+                                - Identical rules are not forbidden in validations.
+                                When rules are specified, container MUST set RestartPolicy explicitly
+                                even it if matches the Pod's RestartPolicy.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -5712,6 +5997,7 @@ spec:
                           - spec.hostPID
                           - spec.hostIPC
                           - spec.hostUsers
+                          - spec.resources
                           - spec.securityContext.appArmorProfile
                           - spec.securityContext.seLinuxOptions
                           - spec.securityContext.seccompProfile
@@ -5865,7 +6151,7 @@ spec:
                         description: |-
                           Resources is the total amount of CPU and Memory resources required by all
                           containers in the pod. It supports specifying Requests and Limits for
-                          "cpu" and "memory" resource names only. ResourceClaims are not supported.
+                          "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
 
                           This field enables fine-grained control over resource allocation for the
                           entire pod, allowing resource sharing among containers in a pod.
@@ -5878,7 +6164,7 @@ spec:
                               Claims lists the names of resources, defined in spec.resourceClaims,
                               that are used by this container.
 
-                              This is an alpha field and requires enabling the
+                              This field depends on the
                               DynamicResourceAllocation feature gate.
 
                               This field is immutable. It can only be set for containers.
@@ -7172,15 +7458,13 @@ spec:
                                             volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                             If specified, the CSI driver will create or update the volume with the attributes defined
                                             in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                            it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                            will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                            If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                            will be set by the persistentvolume controller if it exists.
+                                            it can be changed after the claim is created. An empty string or nil value indicates that no
+                                            VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                            this field can be reset to its previous value (including nil) to cancel the modification.
                                             If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                             set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                             exists.
                                             More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                            (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                           type: string
                                         volumeMode:
                                           description: |-
@@ -7362,12 +7646,10 @@ spec:
                               description: |-
                                 glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                 Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                                More info: https://examples.k8s.io/volumes/glusterfs/README.md
                               properties:
                                 endpoints:
-                                  description: |-
-                                    endpoints is the endpoint name that details Glusterfs topology.
-                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                  description: endpoints is the endpoint name that
+                                    details Glusterfs topology.
                                   type: string
                                 path:
                                   description: |-
@@ -7446,7 +7728,7 @@ spec:
                               description: |-
                                 iscsi represents an ISCSI Disk resource that is attached to a
                                 kubelet's host machine and then exposed to the pod.
-                                More info: https://examples.k8s.io/volumes/iscsi/README.md
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                               properties:
                                 chapAuthDiscovery:
                                   description: chapAuthDiscovery defines whether support
@@ -7872,6 +8154,111 @@ spec:
                                             type: array
                                             x-kubernetes-list-type: atomic
                                         type: object
+                                      podCertificate:
+                                        description: |-
+                                          Projects an auto-rotating credential bundle (private key and certificate
+                                          chain) that the pod can use either as a TLS client or server.
+
+                                          Kubelet generates a private key and uses it to send a
+                                          PodCertificateRequest to the named signer.  Once the signer approves the
+                                          request and issues a certificate chain, Kubelet writes the key and
+                                          certificate chain to the pod filesystem.  The pod does not start until
+                                          certificates have been issued for each podCertificate projected volume
+                                          source in its spec.
+
+                                          Kubelet will begin trying to rotate the certificate at the time indicated
+                                          by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                          timestamp.
+
+                                          Kubelet can write a single file, indicated by the credentialBundlePath
+                                          field, or separate files, indicated by the keyPath and
+                                          certificateChainPath fields.
+
+                                          The credential bundle is a single file in PEM format.  The first PEM
+                                          entry is the private key (in PKCS#8 format), and the remaining PEM
+                                          entries are the certificate chain issued by the signer (typically,
+                                          signers will return their certificate chain in leaf-to-root order).
+
+                                          Prefer using the credential bundle format, since your application code
+                                          can read it atomically.  If you use keyPath and certificateChainPath,
+                                          your application must make two separate file reads. If these coincide
+                                          with a certificate rotation, it is possible that the private key and leaf
+                                          certificate you read may not correspond to each other.  Your application
+                                          will need to check for this condition, and re-read until they are
+                                          consistent.
+
+                                          The named signer controls chooses the format of the certificate it
+                                          issues; consult the signer implementation's documentation to learn how to
+                                          use the certificates it issues.
+                                        properties:
+                                          certificateChainPath:
+                                            description: |-
+                                              Write the certificate chain at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          credentialBundlePath:
+                                            description: |-
+                                              Write the credential bundle at this path in the projected volume.
+
+                                              The credential bundle is a single file that contains multiple PEM blocks.
+                                              The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                              key.
+
+                                              The remaining blocks are CERTIFICATE blocks, containing the issued
+                                              certificate chain from the signer (leaf and any intermediates).
+
+                                              Using credentialBundlePath lets your Pod's application code make a single
+                                              atomic read that retrieves a consistent key and certificate chain.  If you
+                                              project them to separate files, your application code will need to
+                                              additionally check that the leaf certificate was issued to the key.
+                                            type: string
+                                          keyPath:
+                                            description: |-
+                                              Write the key at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          keyType:
+                                            description: |-
+                                              The type of keypair Kubelet will generate for the pod.
+
+                                              Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                              "ECDSAP521", and "ED25519".
+                                            type: string
+                                          maxExpirationSeconds:
+                                            description: |-
+                                              maxExpirationSeconds is the maximum lifetime permitted for the
+                                              certificate.
+
+                                              Kubelet copies this value verbatim into the PodCertificateRequests it
+                                              generates for this projection.
+
+                                              If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                              will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                              value is 7862400 (91 days).
+
+                                              The signer implementation is then free to issue a certificate with any
+                                              lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                              seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                              `kubernetes.io` signers will never issue certificates with a lifetime
+                                              longer than 24 hours.
+                                            format: int32
+                                            type: integer
+                                          signerName:
+                                            description: Kubelet's generated CSRs
+                                              will be addressed to this signer.
+                                            type: string
+                                        required:
+                                        - keyType
+                                        - signerName
+                                        type: object
                                       secret:
                                         description: secret information about the
                                           secret data to project
@@ -8006,7 +8393,6 @@ spec:
                               description: |-
                                 rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                 Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                                More info: https://examples.k8s.io/volumes/rbd/README.md
                               properties:
                                 fsType:
                                   description: |-
@@ -9032,15 +9418,13 @@ spec:
                             volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                             If specified, the CSI driver will create or update the volume with the attributes defined
                             in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                            it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                            will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                            If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                            will be set by the persistentvolume controller if it exists.
+                            it can be changed after the claim is created. An empty string or nil value indicates that no
+                            VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                            this field can be reset to its previous value (including nil) to cancel the modification.
                             If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                             set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                             exists.
                             More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                            (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                           type: string
                         volumeMode:
                           description: |-
@@ -9203,13 +9587,11 @@ spec:
                           description: |-
                             currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
                             When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
-                            This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                           type: string
                         modifyVolumeStatus:
                           description: |-
                             ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
                             When this is unset, there is no ModifyVolume operation being attempted.
-                            This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                           properties:
                             status:
                               description: "status is the status of the ControllerModifyVolume
diff --git a/config/crds/v1/resources/maps.k8s.elastic.co_elasticmapsservers.yaml b/config/crds/v1/resources/maps.k8s.elastic.co_elasticmapsservers.yaml
index af4f4d52c..36040fa7e 100644
--- a/config/crds/v1/resources/maps.k8s.elastic.co_elasticmapsservers.yaml
+++ b/config/crds/v1/resources/maps.k8s.elastic.co_elasticmapsservers.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: elasticmapsservers.maps.k8s.elastic.co
 spec:
   group: maps.k8s.elastic.co
@@ -93,7 +93,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -1142,8 +1143,8 @@ spec:
                                   most preferred is the one with the greatest sum of weights, i.e.
                                   for each node that meets all of the scheduling requirements (resource
                                   request, requiredDuringScheduling anti-affinity expressions, etc.),
-                                  compute a sum by iterating through the elements of this field and adding
-                                  "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  compute a sum by iterating through the elements of this field and subtracting
+                                  "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                   node(s) with the highest sum are the most preferred.
                                 items:
                                   description: The weights of all of the matched WeightedPodAffinityTerm
@@ -1541,8 +1542,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -1601,6 +1603,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -1663,8 +1702,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -1691,8 +1730,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -2371,7 +2411,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -2426,10 +2466,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This field may only be set for init containers, and the only allowed value is "Always".
-                                For non-init containers or when this field is not specified,
+                                This overrides the pod-level restart policy. When this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                Additionally, setting the RestartPolicy as "Always" for the init container will
+                                have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -2441,6 +2481,59 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. The rules are evaluated in
+                                order. Once a rule matches a container exit condition, the remaining
+                                rules are ignored. If no rule matches the container exit condition,
+                                the Container-level restart policy determines the whether the container
+                                is restarted or not. Constraints on the rules:
+                                - At most 20 rules are allowed.
+                                - Rules can have the same action.
+                                - Identical rules are not forbidden in validations.
+                                When rules are specified, container MUST set RestartPolicy explicitly
+                                even it if matches the Pod's RestartPolicy.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -3061,8 +3154,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -3121,6 +3215,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -3183,8 +3314,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -3211,8 +3342,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -3871,7 +4003,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -3927,9 +4059,53 @@ spec:
                               description: |-
                                 Restart policy for the container to manage the restart behavior of each
                                 container within a pod.
-                                This may only be set for init containers. You cannot set this field on
-                                ephemeral containers.
+                                You cannot set this field on ephemeral containers.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. You cannot set this field on
+                                ephemeral containers.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 Optional: SecurityContext defines the security options the ephemeral container should be run with.
@@ -4468,7 +4644,9 @@ spec:
                       hostNetwork:
                         description: |-
                           Host networking requested for this pod. Use the host's network namespace.
-                          If this option is set, the ports that will be used must be specified.
+                          When using HostNetwork you should specify ports so the scheduler is aware.
+                          When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
+                          and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
                           Default to false.
                         type: boolean
                       hostPID:
@@ -4493,6 +4671,19 @@ spec:
                           Specifies the hostname of the Pod
                           If not specified, the pod's hostname will be set to a system-defined value.
                         type: string
+                      hostnameOverride:
+                        description: |-
+                          HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod.
+                          This field only specifies the pod's hostname and does not affect its DNS records.
+                          When this field is set to a non-empty string:
+                          - It takes precedence over the values set in `hostname` and `subdomain`.
+                          - The Pod's hostname will be set to this value.
+                          - `setHostnameAsFQDN` must be nil or set to false.
+                          - `hostNetwork` must be set to false.
+
+                          This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
+                          Requires the HostnameOverride feature gate to be enabled.
+                        type: string
                       imagePullSecrets:
                         description: |-
                           ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
@@ -4574,8 +4765,9 @@ spec:
                                   present in a Container.
                                 properties:
                                   name:
-                                    description: Name of the environment variable.
-                                      Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Name of the environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   value:
                                     description: |-
@@ -4634,6 +4826,43 @@ spec:
                                         - fieldPath
                                         type: object
                                         x-kubernetes-map-type: atomic
+                                      fileKeyRef:
+                                        description: |-
+                                          FileKeyRef selects a key of the env file.
+                                          Requires the EnvFiles feature gate to be enabled.
+                                        properties:
+                                          key:
+                                            description: |-
+                                              The key within the env file. An invalid key will prevent the pod from starting.
+                                              The keys defined within a source may consist of any printable ASCII characters except '='.
+                                              During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+                                            type: string
+                                          optional:
+                                            default: false
+                                            description: |-
+                                              Specify whether the file or its key must be defined. If the file or key
+                                              does not exist, then the env var is not published.
+                                              If optional is set to true and the specified key does not exist,
+                                              the environment variable will not be set in the Pod's containers.
+
+                                              If optional is set to false and the specified key does not exist,
+                                              an error will be returned during Pod creation.
+                                            type: boolean
+                                          path:
+                                            description: |-
+                                              The path within the volume from which to select the file.
+                                              Must be relative and may not contain the '..' path or start with '..'.
+                                            type: string
+                                          volumeName:
+                                            description: The name of the volume mount
+                                              containing the env file.
+                                            type: string
+                                        required:
+                                        - key
+                                        - path
+                                        - volumeName
+                                        type: object
+                                        x-kubernetes-map-type: atomic
                                       resourceFieldRef:
                                         description: |-
                                           Selects a resource of the container: only resources limits and requests
@@ -4696,8 +4925,8 @@ spec:
                             envFrom:
                               description: |-
                                 List of sources to populate environment variables in the container.
-                                The keys defined within a source must be a C_IDENTIFIER. All invalid keys
-                                will be reported as an event when the container is starting. When a key exists in multiple
+                                The keys defined within a source may consist of any printable ASCII characters except '='.
+                                When a key exists in multiple
                                 sources, the value associated with the last source will take precedence.
                                 Values defined by an Env with a duplicate key will take precedence.
                                 Cannot be updated.
@@ -4724,8 +4953,9 @@ spec:
                                     type: object
                                     x-kubernetes-map-type: atomic
                                   prefix:
-                                    description: Optional text to prepend to the name
-                                      of each environment variable. Must be a C_IDENTIFIER.
+                                    description: |-
+                                      Optional text to prepend to the name of each environment variable.
+                                      May consist of any printable ASCII characters except '='.
                                     type: string
                                   secretRef:
                                     description: The Secret to select from
@@ -5404,7 +5634,7 @@ spec:
                                     Claims lists the names of resources, defined in spec.resourceClaims,
                                     that are used by this container.
 
-                                    This is an alpha field and requires enabling the
+                                    This field depends on the
                                     DynamicResourceAllocation feature gate.
 
                                     This field is immutable. It can only be set for containers.
@@ -5459,10 +5689,10 @@ spec:
                             restartPolicy:
                               description: |-
                                 RestartPolicy defines the restart behavior of individual containers in a pod.
-                                This field may only be set for init containers, and the only allowed value is "Always".
-                                For non-init containers or when this field is not specified,
+                                This overrides the pod-level restart policy. When this field is not specified,
                                 the restart behavior is defined by the Pod's restart policy and the container type.
-                                Setting the RestartPolicy as "Always" for the init container will have the following effect:
+                                Additionally, setting the RestartPolicy as "Always" for the init container will
+                                have the following effect:
                                 this init container will be continually restarted on
                                 exit until all regular containers have terminated. Once all regular
                                 containers have completed, all init containers with restartPolicy "Always"
@@ -5474,6 +5704,59 @@ spec:
                                 init container is started, or after any startupProbe has successfully
                                 completed.
                               type: string
+                            restartPolicyRules:
+                              description: |-
+                                Represents a list of rules to be checked to determine if the
+                                container should be restarted on exit. The rules are evaluated in
+                                order. Once a rule matches a container exit condition, the remaining
+                                rules are ignored. If no rule matches the container exit condition,
+                                the Container-level restart policy determines the whether the container
+                                is restarted or not. Constraints on the rules:
+                                - At most 20 rules are allowed.
+                                - Rules can have the same action.
+                                - Identical rules are not forbidden in validations.
+                                When rules are specified, container MUST set RestartPolicy explicitly
+                                even it if matches the Pod's RestartPolicy.
+                              items:
+                                description: ContainerRestartRule describes how a
+                                  container exit is handled.
+                                properties:
+                                  action:
+                                    description: |-
+                                      Specifies the action taken on a container exit if the requirements
+                                      are satisfied. The only possible value is "Restart" to restart the
+                                      container.
+                                    type: string
+                                  exitCodes:
+                                    description: Represents the exit codes to check
+                                      on container exits.
+                                    properties:
+                                      operator:
+                                        description: |-
+                                          Represents the relationship between the container exit code(s) and the
+                                          specified values. Possible values are:
+                                          - In: the requirement is satisfied if the container exit code is in the
+                                            set of specified values.
+                                          - NotIn: the requirement is satisfied if the container exit code is
+                                            not in the set of specified values.
+                                        type: string
+                                      values:
+                                        description: |-
+                                          Specifies the set of values to check for container exit codes.
+                                          At most 255 elements are allowed.
+                                        items:
+                                          format: int32
+                                          type: integer
+                                        type: array
+                                        x-kubernetes-list-type: set
+                                    required:
+                                    - operator
+                                    type: object
+                                required:
+                                - action
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
                             securityContext:
                               description: |-
                                 SecurityContext defines the security options the container should be run with.
@@ -6007,6 +6290,7 @@ spec:
                           - spec.hostPID
                           - spec.hostIPC
                           - spec.hostUsers
+                          - spec.resources
                           - spec.securityContext.appArmorProfile
                           - spec.securityContext.seLinuxOptions
                           - spec.securityContext.seccompProfile
@@ -6160,7 +6444,7 @@ spec:
                         description: |-
                           Resources is the total amount of CPU and Memory resources required by all
                           containers in the pod. It supports specifying Requests and Limits for
-                          "cpu" and "memory" resource names only. ResourceClaims are not supported.
+                          "cpu", "memory" and "hugepages-" resource names only. ResourceClaims are not supported.
 
                           This field enables fine-grained control over resource allocation for the
                           entire pod, allowing resource sharing among containers in a pod.
@@ -6173,7 +6457,7 @@ spec:
                               Claims lists the names of resources, defined in spec.resourceClaims,
                               that are used by this container.
 
-                              This is an alpha field and requires enabling the
+                              This field depends on the
                               DynamicResourceAllocation feature gate.
 
                               This field is immutable. It can only be set for containers.
@@ -7467,15 +7751,13 @@ spec:
                                             volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                             If specified, the CSI driver will create or update the volume with the attributes defined
                                             in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                            it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                            will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                            If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                            will be set by the persistentvolume controller if it exists.
+                                            it can be changed after the claim is created. An empty string or nil value indicates that no
+                                            VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                            this field can be reset to its previous value (including nil) to cancel the modification.
                                             If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                             set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                             exists.
                                             More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                            (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                           type: string
                                         volumeMode:
                                           description: |-
@@ -7657,12 +7939,10 @@ spec:
                               description: |-
                                 glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                                 Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
-                                More info: https://examples.k8s.io/volumes/glusterfs/README.md
                               properties:
                                 endpoints:
-                                  description: |-
-                                    endpoints is the endpoint name that details Glusterfs topology.
-                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                  description: endpoints is the endpoint name that
+                                    details Glusterfs topology.
                                   type: string
                                 path:
                                   description: |-
@@ -7741,7 +8021,7 @@ spec:
                               description: |-
                                 iscsi represents an ISCSI Disk resource that is attached to a
                                 kubelet's host machine and then exposed to the pod.
-                                More info: https://examples.k8s.io/volumes/iscsi/README.md
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                               properties:
                                 chapAuthDiscovery:
                                   description: chapAuthDiscovery defines whether support
@@ -8167,6 +8447,111 @@ spec:
                                             type: array
                                             x-kubernetes-list-type: atomic
                                         type: object
+                                      podCertificate:
+                                        description: |-
+                                          Projects an auto-rotating credential bundle (private key and certificate
+                                          chain) that the pod can use either as a TLS client or server.
+
+                                          Kubelet generates a private key and uses it to send a
+                                          PodCertificateRequest to the named signer.  Once the signer approves the
+                                          request and issues a certificate chain, Kubelet writes the key and
+                                          certificate chain to the pod filesystem.  The pod does not start until
+                                          certificates have been issued for each podCertificate projected volume
+                                          source in its spec.
+
+                                          Kubelet will begin trying to rotate the certificate at the time indicated
+                                          by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                          timestamp.
+
+                                          Kubelet can write a single file, indicated by the credentialBundlePath
+                                          field, or separate files, indicated by the keyPath and
+                                          certificateChainPath fields.
+
+                                          The credential bundle is a single file in PEM format.  The first PEM
+                                          entry is the private key (in PKCS#8 format), and the remaining PEM
+                                          entries are the certificate chain issued by the signer (typically,
+                                          signers will return their certificate chain in leaf-to-root order).
+
+                                          Prefer using the credential bundle format, since your application code
+                                          can read it atomically.  If you use keyPath and certificateChainPath,
+                                          your application must make two separate file reads. If these coincide
+                                          with a certificate rotation, it is possible that the private key and leaf
+                                          certificate you read may not correspond to each other.  Your application
+                                          will need to check for this condition, and re-read until they are
+                                          consistent.
+
+                                          The named signer controls chooses the format of the certificate it
+                                          issues; consult the signer implementation's documentation to learn how to
+                                          use the certificates it issues.
+                                        properties:
+                                          certificateChainPath:
+                                            description: |-
+                                              Write the certificate chain at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          credentialBundlePath:
+                                            description: |-
+                                              Write the credential bundle at this path in the projected volume.
+
+                                              The credential bundle is a single file that contains multiple PEM blocks.
+                                              The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                              key.
+
+                                              The remaining blocks are CERTIFICATE blocks, containing the issued
+                                              certificate chain from the signer (leaf and any intermediates).
+
+                                              Using credentialBundlePath lets your Pod's application code make a single
+                                              atomic read that retrieves a consistent key and certificate chain.  If you
+                                              project them to separate files, your application code will need to
+                                              additionally check that the leaf certificate was issued to the key.
+                                            type: string
+                                          keyPath:
+                                            description: |-
+                                              Write the key at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          keyType:
+                                            description: |-
+                                              The type of keypair Kubelet will generate for the pod.
+
+                                              Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                              "ECDSAP521", and "ED25519".
+                                            type: string
+                                          maxExpirationSeconds:
+                                            description: |-
+                                              maxExpirationSeconds is the maximum lifetime permitted for the
+                                              certificate.
+
+                                              Kubelet copies this value verbatim into the PodCertificateRequests it
+                                              generates for this projection.
+
+                                              If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                              will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                              value is 7862400 (91 days).
+
+                                              The signer implementation is then free to issue a certificate with any
+                                              lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                              seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                              `kubernetes.io` signers will never issue certificates with a lifetime
+                                              longer than 24 hours.
+                                            format: int32
+                                            type: integer
+                                          signerName:
+                                            description: Kubelet's generated CSRs
+                                              will be addressed to this signer.
+                                            type: string
+                                        required:
+                                        - keyType
+                                        - signerName
+                                        type: object
                                       secret:
                                         description: secret information about the
                                           secret data to project
@@ -8301,7 +8686,6 @@ spec:
                               description: |-
                                 rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                                 Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
-                                More info: https://examples.k8s.io/volumes/rbd/README.md
                               properties:
                                 fsType:
                                   description: |-
diff --git a/config/crds/v1/resources/stackconfigpolicy.k8s.elastic.co_stackconfigpolicies.yaml b/config/crds/v1/resources/stackconfigpolicy.k8s.elastic.co_stackconfigpolicies.yaml
index e03b34f23..146a6d3ab 100644
--- a/config/crds/v1/resources/stackconfigpolicy.k8s.elastic.co_stackconfigpolicies.yaml
+++ b/config/crds/v1/resources/stackconfigpolicy.k8s.elastic.co_stackconfigpolicies.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: stackconfigpolicies.stackconfigpolicy.k8s.elastic.co
 spec:
   group: stackconfigpolicy.k8s.elastic.co
diff --git a/config/dev/registry.yaml b/config/dev/registry.yaml
index 7ea8bc557..71d472501 100644
--- a/config/dev/registry.yaml
+++ b/config/dev/registry.yaml
@@ -64,7 +64,7 @@ spec:
 
 ---
 
-apiVersion: extensions/v1beta1
+apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: kube-registry-proxy
@@ -95,4 +95,4 @@ spec:
         ports:
         - name: registry
           containerPort: 80
-          hostPort: 5000
\ No newline at end of file
+          hostPort: 5000
diff --git a/config/e2e/helm-monitoring-operator.yaml b/config/e2e/helm-monitoring-operator.yaml
index 306cbf869..e70be2c08 100644
--- a/config/e2e/helm-monitoring-operator.yaml
+++ b/config/e2e/helm-monitoring-operator.yaml
@@ -6,7 +6,7 @@ managedNamespaces: [{{ .E2ENamespace }}]
 
 image:
   repository: docker.elastic.co/eck/eck-operator
-  tag: 3.0.0
+  tag: 3.1.0
 
 podAnnotations:
   co.elastic.metrics/metricsets: collector
diff --git a/config/e2e/monitoring.yaml b/config/e2e/monitoring.yaml
index 6424f04ac..160c6dd8d 100644
--- a/config/e2e/monitoring.yaml
+++ b/config/e2e/monitoring.yaml
@@ -5,7 +5,7 @@ metadata:
   name: e2e-agent
   namespace: {{ .E2ENamespace }}
 spec:
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRefs:
     - secretName: eck-{{ .TestRun }}
   daemonSet:
@@ -111,7 +111,7 @@ spec:
       meta:
         package:
           name: journald
-          version: 1.1.0
+          version: 1.2.1
       data_stream:
         namespace: default
       streams:
@@ -126,7 +126,7 @@ spec:
       meta:
         package:
           name: kubernetes
-          version: 1.49.0
+          version: 1.80.2
       data_stream:
         namespace: k8s
       processors:
@@ -227,7 +227,7 @@ spec:
       meta:
         package:
           name: system
-          version: 9.0.0
+          version: 2.5.1
       data_stream:
         namespace: default
       processors:
diff --git a/config/recipes/apm-server-jaeger/apm-server-jaeger.yaml b/config/recipes/apm-server-jaeger/apm-server-jaeger.yaml
index f6c693c01..9fe40e086 100644
--- a/config/recipes/apm-server-jaeger/apm-server-jaeger.yaml
+++ b/config/recipes/apm-server-jaeger/apm-server-jaeger.yaml
@@ -4,7 +4,7 @@ metadata:
   name: apm-server-quickstart
   namespace: default
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   config:
     name: elastic-apm
diff --git a/config/recipes/associations-rbac/apm_es_kibana_rbac.yaml b/config/recipes/associations-rbac/apm_es_kibana_rbac.yaml
index 4bcff6408..32d76ddc0 100644
--- a/config/recipes/associations-rbac/apm_es_kibana_rbac.yaml
+++ b/config/recipes/associations-rbac/apm_es_kibana_rbac.yaml
@@ -84,7 +84,7 @@ metadata:
   name: elasticsearch-sample
   namespace: elasticsearch-ns
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
     - name: default
       count: 1
@@ -97,7 +97,7 @@ metadata:
   name: kibana-sample
   namespace: kibana-ns
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   config:
     xpack.fleet.packages:
@@ -115,7 +115,7 @@ metadata:
   name: apm-apm-sample
   namespace: apmserver-ns
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: "elasticsearch-sample"
diff --git a/config/recipes/autopilot/elasticsearch.yaml b/config/recipes/autopilot/elasticsearch.yaml
index 5bd50fbe3..2bfe61691 100644
--- a/config/recipes/autopilot/elasticsearch.yaml
+++ b/config/recipes/autopilot/elasticsearch.yaml
@@ -41,7 +41,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 1
diff --git a/config/recipes/autopilot/fleet-kubernetes-integration.yaml b/config/recipes/autopilot/fleet-kubernetes-integration.yaml
index 36671b952..c544780bd 100644
--- a/config/recipes/autopilot/fleet-kubernetes-integration.yaml
+++ b/config/recipes/autopilot/fleet-kubernetes-integration.yaml
@@ -41,7 +41,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 1
@@ -74,7 +74,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
@@ -138,7 +138,7 @@ kind: Agent
 metadata:
   name: fleet-server
 spec:
-  version: 9.0.0
+  version: 9.1.2
   kibanaRef:
     name: kibana
   elasticsearchRefs:
@@ -179,7 +179,7 @@ kind: Agent
 metadata: 
   name: elastic-agent
 spec:
-  version: 9.0.0
+  version: 9.1.2
   kibanaRef:
     name: kibana
   fleetServerRef: 
diff --git a/config/recipes/autopilot/kubernetes-integration.yaml b/config/recipes/autopilot/kubernetes-integration.yaml
index 437e925c9..e07c5289e 100644
--- a/config/recipes/autopilot/kubernetes-integration.yaml
+++ b/config/recipes/autopilot/kubernetes-integration.yaml
@@ -4,7 +4,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
@@ -27,7 +27,7 @@ kind: Agent
 metadata:
   name: elastic-agent
 spec:
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRefs:
   - name: elasticsearch
   daemonSet:
diff --git a/config/recipes/autopilot/metricbeat_hosts.yaml b/config/recipes/autopilot/metricbeat_hosts.yaml
index 5cb5e6e18..f028d30fd 100644
--- a/config/recipes/autopilot/metricbeat_hosts.yaml
+++ b/config/recipes/autopilot/metricbeat_hosts.yaml
@@ -4,7 +4,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
@@ -28,7 +28,7 @@ metadata:
   name: metricbeat
 spec:
   type: metricbeat
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRef:
     name: elasticsearch
   kibanaRef:
diff --git a/config/recipes/autoscaling/elasticsearch.yaml b/config/recipes/autoscaling/elasticsearch.yaml
index 4a7ff1ca6..5b140967f 100644
--- a/config/recipes/autoscaling/elasticsearch.yaml
+++ b/config/recipes/autoscaling/elasticsearch.yaml
@@ -51,7 +51,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch-sample
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
     - name: master
       count: 3
diff --git a/config/recipes/beats/auditbeat_hosts.yaml b/config/recipes/beats/auditbeat_hosts.yaml
index 4c7c338ad..5867c4cbb 100644
--- a/config/recipes/beats/auditbeat_hosts.yaml
+++ b/config/recipes/beats/auditbeat_hosts.yaml
@@ -4,7 +4,7 @@ metadata:
   name: auditbeat
 spec:
   type: auditbeat
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRef:
     name: elasticsearch
   kibanaRef:
@@ -76,7 +76,7 @@ spec:
         #    path: /run
         #initContainers:
         #- name: cos-init
-        #  image: docker.elastic.co/beats/auditbeat:9.0.0
+        #  image: docker.elastic.co/beats/auditbeat:9.1.2
         #  volumeMounts:
         #  - name: run
         #    mountPath: /run
@@ -118,7 +118,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 3
@@ -130,7 +130,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
diff --git a/config/recipes/beats/filebeat_autodiscover.yaml b/config/recipes/beats/filebeat_autodiscover.yaml
index 217cfa203..497401fd0 100644
--- a/config/recipes/beats/filebeat_autodiscover.yaml
+++ b/config/recipes/beats/filebeat_autodiscover.yaml
@@ -4,7 +4,7 @@ metadata:
   name: filebeat
 spec:
   type: filebeat
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRef:
     name: elasticsearch
   kibanaRef:
@@ -122,7 +122,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 3
@@ -134,7 +134,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
diff --git a/config/recipes/beats/filebeat_autodiscover_by_metadata.yaml b/config/recipes/beats/filebeat_autodiscover_by_metadata.yaml
index 4c24587c6..264b80dca 100644
--- a/config/recipes/beats/filebeat_autodiscover_by_metadata.yaml
+++ b/config/recipes/beats/filebeat_autodiscover_by_metadata.yaml
@@ -4,7 +4,7 @@ metadata:
   name: filebeat
 spec:
   type: filebeat
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRef:
     name: elasticsearch
   kibanaRef:
@@ -118,7 +118,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 3
@@ -130,7 +130,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
diff --git a/config/recipes/beats/filebeat_no_autodiscover.yaml b/config/recipes/beats/filebeat_no_autodiscover.yaml
index 5ff3a8d9a..b77da475b 100644
--- a/config/recipes/beats/filebeat_no_autodiscover.yaml
+++ b/config/recipes/beats/filebeat_no_autodiscover.yaml
@@ -4,7 +4,7 @@ metadata:
   name: filebeat
 spec:
   type: filebeat
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRef:
     name: elasticsearch
   kibanaRef:
@@ -60,7 +60,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 3
@@ -72,7 +72,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
diff --git a/config/recipes/beats/heartbeat_es_kb_health.yaml b/config/recipes/beats/heartbeat_es_kb_health.yaml
index 77ea561a4..c9a16d230 100644
--- a/config/recipes/beats/heartbeat_es_kb_health.yaml
+++ b/config/recipes/beats/heartbeat_es_kb_health.yaml
@@ -4,7 +4,7 @@ metadata:
   name: heartbeat
 spec:
   type: heartbeat
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRef:
     name: elasticsearch
   config:
@@ -27,7 +27,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 3
@@ -39,7 +39,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
diff --git a/config/recipes/beats/metricbeat_hosts.yaml b/config/recipes/beats/metricbeat_hosts.yaml
index fe892e1cb..e676b3573 100644
--- a/config/recipes/beats/metricbeat_hosts.yaml
+++ b/config/recipes/beats/metricbeat_hosts.yaml
@@ -4,7 +4,7 @@ metadata:
   name: metricbeat
 spec:
   type: metricbeat
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRef:
     name: elasticsearch
   kibanaRef:
@@ -174,7 +174,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 3
@@ -186,7 +186,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
diff --git a/config/recipes/beats/openshift_monitoring.yaml b/config/recipes/beats/openshift_monitoring.yaml
index d53449fac..bc85773ff 100644
--- a/config/recipes/beats/openshift_monitoring.yaml
+++ b/config/recipes/beats/openshift_monitoring.yaml
@@ -4,7 +4,7 @@ metadata:
   name: metricbeat
 spec:
   type: metricbeat
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRef:
     name: elasticsearch
   kibanaRef:
@@ -221,7 +221,7 @@ metadata:
   name: filebeat
 spec:
   type: filebeat
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRef:
     name: elasticsearch
   kibanaRef:
@@ -324,7 +324,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 3
@@ -336,7 +336,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
diff --git a/config/recipes/beats/packetbeat_dns_http.yaml b/config/recipes/beats/packetbeat_dns_http.yaml
index f406d2227..c0a38b10e 100644
--- a/config/recipes/beats/packetbeat_dns_http.yaml
+++ b/config/recipes/beats/packetbeat_dns_http.yaml
@@ -4,7 +4,7 @@ metadata:
   name: packetbeat
 spec:
   type: packetbeat
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRef:
     name: elasticsearch
   kibanaRef:
@@ -44,7 +44,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 3
@@ -56,7 +56,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
diff --git a/config/recipes/beats/stack_monitoring.yaml b/config/recipes/beats/stack_monitoring.yaml
index 3cd1ecbb9..1bca48909 100644
--- a/config/recipes/beats/stack_monitoring.yaml
+++ b/config/recipes/beats/stack_monitoring.yaml
@@ -6,7 +6,7 @@ metadata:
   name: metricbeat
 spec:
   type: metricbeat
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRef:
     name: elasticsearch-monitoring
   config:
@@ -140,7 +140,7 @@ metadata:
   name: filebeat
 spec:
   type: filebeat
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRef:
     name: elasticsearch-monitoring
   kibanaRef:
@@ -260,7 +260,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 3
@@ -276,7 +276,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
@@ -293,7 +293,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch-monitoring
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 3
@@ -305,7 +305,7 @@ kind: Kibana
 metadata:
   name: kibana-monitoring
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch-monitoring
diff --git a/config/recipes/elastic-agent/README.asciidoc b/config/recipes/elastic-agent/README.asciidoc
index 67991e795..c5ceb57e1 100644
--- a/config/recipes/elastic-agent/README.asciidoc
+++ b/config/recipes/elastic-agent/README.asciidoc
@@ -46,3 +46,7 @@ Deploys single instance Elastic Agent Deployment in Fleet mode with APM integrat
 ===== Synthetic monitoring - `synthetic-monitoring.yaml`
 
 Deploys an Fleet-enrolled Elastic Agent that can be used as for link:https://www.elastic.co/guide/en/observability/current/monitor-uptime-synthetics.html[Synthetic monitoring]. This Elastic Agent uses the `elastic-agent-complete` image. The agent policy still needs to be link:https://www.elastic.co/guide/en/observability/current/synthetics-private-location.html#synthetics-private-location-add[registered as private location] in Kibana.
+
+===== Fleet Server exposed both internally and externally - `fleet-ingress-setup.yaml`
+
+This example shows how to expose the Fleet Server to the outside world using a Kubernetes Ingress resource. The Fleet Server is configured to use custom TLS certificates, and all communications are secured with TLS. The same Fleet Server is also accessible from within the cluster, allowing agents to connect to it regardless of their location. Refer to the comments in the `fleet-ingress-setup.yaml` file for more details on how to set up the Ingress resource and TLS certificates to enable this configuration.
\ No newline at end of file
diff --git a/config/recipes/elastic-agent/fleet-apm-integration.yaml b/config/recipes/elastic-agent/fleet-apm-integration.yaml
index 2509b0c1e..3261cde4c 100644
--- a/config/recipes/elastic-agent/fleet-apm-integration.yaml
+++ b/config/recipes/elastic-agent/fleet-apm-integration.yaml
@@ -3,7 +3,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
@@ -61,7 +61,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 3
@@ -73,7 +73,7 @@ kind: Agent
 metadata:
   name: fleet-server
 spec:
-  version: 9.0.0
+  version: 9.1.2
   kibanaRef:
     name: kibana
   elasticsearchRefs:
@@ -95,7 +95,7 @@ kind: Agent
 metadata: 
   name: elastic-agent
 spec:
-  version: 9.0.0
+  version: 9.1.2
   kibanaRef:
     name: kibana
   fleetServerRef: 
diff --git a/config/recipes/elastic-agent/fleet-custom-logs-integration.yaml b/config/recipes/elastic-agent/fleet-custom-logs-integration.yaml
index 663172d1d..bcaca14e8 100644
--- a/config/recipes/elastic-agent/fleet-custom-logs-integration.yaml
+++ b/config/recipes/elastic-agent/fleet-custom-logs-integration.yaml
@@ -3,7 +3,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
@@ -70,7 +70,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 3
@@ -82,7 +82,7 @@ kind: Agent
 metadata:
   name: fleet-server
 spec:
-  version: 9.0.0
+  version: 9.1.2
   kibanaRef:
     name: kibana
   elasticsearchRefs:
@@ -104,7 +104,7 @@ kind: Agent
 metadata: 
   name: elastic-agent
 spec:
-  version: 9.0.0
+  version: 9.1.2
   kibanaRef:
     name: kibana
   fleetServerRef: 
diff --git a/config/recipes/elastic-agent/fleet-ingress-setup.yaml b/config/recipes/elastic-agent/fleet-ingress-setup.yaml
new file mode 100644
index 000000000..060d956eb
--- /dev/null
+++ b/config/recipes/elastic-agent/fleet-ingress-setup.yaml
@@ -0,0 +1,355 @@
+apiVersion: kibana.k8s.elastic.co/v1
+kind: Kibana
+metadata:
+  name: kibana
+spec:
+  version: 9.1.0
+  count: 1
+  elasticsearchRef:
+    name: elasticsearch
+  config:
+    xpack.fleet.agents.elasticsearch.hosts: ["https://es.example.com:443"]
+    xpack.fleet.agents.fleet_server.hosts: [ "https://fleet.example.com:443"]  
+    xpack.fleet.packages:
+    - name: system
+      version: latest
+    - name: elastic_agent
+      version: latest
+    - name: fleet_server
+      version: latest
+    - name: kubernetes
+      version: latest
+    - name: apm
+      version: latest
+    xpack.fleet.agentPolicies:
+    - name: Fleet Server on ECK policy
+      id: eck-fleet-server
+      namespace: elastic
+      is_managed: true
+      monitoring_enabled:
+      - logs
+      - metrics
+      unenroll_timeout: 900
+      package_policies:
+      - name: fleet_server-1
+        id: fleet_server-1
+        package:
+          name: fleet_server
+    - name: Elastic Agent on ECK policy
+      id: eck-agent
+      namespace: elastic
+      is_managed: true
+      monitoring_enabled:
+      - logs
+      - metrics
+      unenroll_timeout: 900
+      package_policies:
+      - package:
+          name: system
+        name: system-1
+      - package:
+          name: kubernetes
+        name: kubernetes-1
+      
+---
+apiVersion: elasticsearch.k8s.elastic.co/v1
+kind: Elasticsearch
+metadata:
+  name: elasticsearch
+spec:
+  version: 9.1.0
+  nodeSets:
+  - name: default-3
+    count: 3
+    config:
+      node.store.allow_mmap: false
+    volumeClaimTemplates:
+    - metadata:
+        name: elasticsearch-data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 30Gi
+
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: elastic-ingress
+  annotations:
+    # Disable HTTP traffic
+    kubernetes.io/ingress.allow-http: "false"
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+    nginx.ingress.kubernetes.io/proxy-ssl-verify: "off"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    # Depending on the ingress implementation in your environment you may need to specify the ingress class
+    # kubernetes.io/ingress.class: "example"
+spec:
+  # or alternatively use the ingressClassName field. Consult the documentation of your ingress controller.
+  # ingressClassName: example
+  tls:
+    # The assumption here is that these are certificates that are trusted both by agents outside the cluster as well as 
+    # as inside. See the comments in the Agent spec below for more details.
+    - hosts: ["fleet.example.com"]
+      secretName: fleet-server-acme 
+    - hosts: ["es.example.com"]
+      secretName: es-acme
+    - hosts: ["kb.example.com"]
+      secretName: kb-acme
+  rules:
+    - host: "kb.example.com"
+      http:
+        paths:
+        - path: "/"
+          pathType: Prefix
+          backend:
+            service:
+              name: kibana-kb-http
+              port:
+                number: 5601
+    - host: "es.example.com"
+      http:
+        paths:
+        - path: "/"
+          pathType: Prefix
+          backend:
+            service:
+              name: elasticsearch-es-http
+              port:
+                number: 9200
+    - host: "fleet.example.com"
+      http:
+        paths:
+          - path: "/"
+            pathType: Prefix
+            backend:
+              service:
+                name: fleet-server-agent-http
+                port:
+                  number: 8220
+---
+apiVersion: agent.k8s.elastic.co/v1alpha1
+kind: Agent
+metadata:
+  name: fleet-server
+spec:
+  version: 9.1.0
+  http:
+    # Configuring the same certificates used for the ingress here has the effect that 
+    # the CA certificate that is expected in ca.crt inside this secret is propagated to the agents
+    # and configured in the FLEET_CA environment variable. 
+    # Without this the agents would only trust the self-signed certificates generated by ECK.
+    tls:
+      certificate:
+        secretName: fleet-server-acme
+  kibanaRef:
+    name: kibana
+  elasticsearchRefs:
+  - name: elasticsearch
+  mode: fleet
+  fleetServerEnabled: true
+  policyID: eck-fleet-server
+  deployment:
+    replicas: 1
+    podTemplate:
+      spec:
+        containers:
+        - name: agent
+          env:
+          # Force Elastic Agent to bootstrap itself through the public Fleet Server URL
+          # We are asuming here the certificates configured above are only valid for the public URL.
+          - name: FLEET_URL
+            value: https://fleet.example.com:443
+        serviceAccountName: fleet-server
+        automountServiceAccountToken: true
+        securityContext:
+          runAsUser: 0
+---
+apiVersion: agent.k8s.elastic.co/v1alpha1
+kind: Agent
+metadata: 
+  name: elastic-agent
+spec:
+  config:
+    fleet:
+      enabled: true
+    providers.kubernetes:
+      add_resource_metadata:
+        deployment: true
+  version: 9.1.0
+  kibanaRef:
+    name: kibana
+  fleetServerRef:
+    name: fleet-server
+  mode: fleet
+  policyID: eck-agent
+  daemonSet:
+    podTemplate:
+      spec:
+        volumes:
+        - name: fleet-ca
+          secret:
+            secretName: fleet-server-acme
+        containers:
+        - name: agent
+          env:
+          - name: FLEET_URL
+            value: https://fleet.example.com
+          volumeMounts:
+          - name: fleet-ca
+            mountPath: /mnt/extra 
+        serviceAccountName: elastic-agent
+        hostNetwork: true
+        dnsPolicy: ClusterFirstWithHostNet
+        automountServiceAccountToken: true
+        securityContext:
+          runAsUser: 0
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: fleet-server
+rules:
+- apiGroups: [""]
+  resources:
+  - pods
+  - namespaces
+  - nodes
+  verbs:
+  - get
+  - watch
+  - list
+- apiGroups: ["apps"]
+  resources:
+    - replicasets
+  verbs:
+    - get
+    - watch
+    - list
+- apiGroups: ["batch"]
+  resources:
+    - jobs
+  verbs:
+    - get
+    - watch
+    - list
+- apiGroups: ["coordination.k8s.io"]
+  resources:
+  - leases
+  verbs:
+  - get
+  - create
+  - update
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fleet-server
+  namespace: default
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: fleet-server
+subjects:
+- kind: ServiceAccount
+  name: fleet-server
+  namespace: default
+roleRef:
+  kind: ClusterRole
+  name: fleet-server
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: elastic-agent
+rules:
+- apiGroups: [""]
+  resources:
+  - pods
+  - nodes
+  - namespaces
+  - events
+  - services
+  - configmaps
+  verbs:
+  - get
+  - watch
+  - list
+- apiGroups: ["coordination.k8s.io"]
+  resources:
+  - leases
+  verbs:
+  - get
+  - create
+  - update
+- nonResourceURLs:
+  - "/metrics"
+  verbs:
+  - get
+- apiGroups: ["extensions"]
+  resources:
+    - replicasets
+  verbs: 
+  - "get"
+  - "list"
+  - "watch"
+- apiGroups:
+  - "apps"
+  resources:
+  - statefulsets
+  - deployments
+  - replicasets
+  - daemonsets
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+- apiGroups:
+  - ""
+  resources:
+  - nodes/stats
+  verbs:
+  - get
+- nonResourceURLs:
+  - "/metrics"
+  verbs:
+  - get
+- apiGroups:
+  - "batch"
+  resources:
+  - jobs
+  - cronjobs
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+- apiGroups:
+  - "storage.k8s.io"
+  resources:
+  - storageclasses
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: elastic-agent
+  namespace: default
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: elastic-agent
+subjects:
+- kind: ServiceAccount
+  name: elastic-agent
+  namespace: default
+roleRef:
+  kind: ClusterRole
+  name: elastic-agent
+  apiGroup: rbac.authorization.k8s.io
\ No newline at end of file
diff --git a/config/recipes/elastic-agent/fleet-kubernetes-integration-nonroot.yaml b/config/recipes/elastic-agent/fleet-kubernetes-integration-nonroot.yaml
index 081f96104..7fc205a29 100644
--- a/config/recipes/elastic-agent/fleet-kubernetes-integration-nonroot.yaml
+++ b/config/recipes/elastic-agent/fleet-kubernetes-integration-nonroot.yaml
@@ -71,7 +71,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
@@ -129,7 +129,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 3
@@ -141,7 +141,7 @@ kind: Agent
 metadata:
   name: fleet-server
 spec:
-  version: 9.0.0
+  version: 9.1.2
   kibanaRef:
     name: kibana
   elasticsearchRefs:
@@ -161,7 +161,7 @@ kind: Agent
 metadata: 
   name: elastic-agent
 spec:
-  version: 9.0.0
+  version: 9.1.2
   kibanaRef:
     name: kibana
   fleetServerRef: 
diff --git a/config/recipes/elastic-agent/fleet-kubernetes-integration.yaml b/config/recipes/elastic-agent/fleet-kubernetes-integration.yaml
index 7e16e3f9c..c638fc050 100644
--- a/config/recipes/elastic-agent/fleet-kubernetes-integration.yaml
+++ b/config/recipes/elastic-agent/fleet-kubernetes-integration.yaml
@@ -3,7 +3,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
@@ -54,7 +54,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 3
@@ -66,7 +66,7 @@ kind: Agent
 metadata:
   name: fleet-server
 spec:
-  version: 9.0.0
+  version: 9.1.2
   kibanaRef:
     name: kibana
   elasticsearchRefs:
@@ -88,7 +88,7 @@ kind: Agent
 metadata: 
   name: elastic-agent
 spec:
-  version: 9.0.0
+  version: 9.1.2
   kibanaRef:
     name: kibana
   fleetServerRef: 
diff --git a/config/recipes/elastic-agent/ksm-sharding.yaml b/config/recipes/elastic-agent/ksm-sharding.yaml
index 884a146af..71e0bcf0c 100644
--- a/config/recipes/elastic-agent/ksm-sharding.yaml
+++ b/config/recipes/elastic-agent/ksm-sharding.yaml
@@ -3,7 +3,7 @@ kind: Agent
 metadata:
   name: elastic-agent
 spec:
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRefs:
   - name: elasticsearch
   statefulSet:
@@ -450,7 +450,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 3
@@ -462,7 +462,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
diff --git a/config/recipes/elastic-agent/kubernetes-integration.yaml b/config/recipes/elastic-agent/kubernetes-integration.yaml
index 99e10e646..f20cccd37 100644
--- a/config/recipes/elastic-agent/kubernetes-integration.yaml
+++ b/config/recipes/elastic-agent/kubernetes-integration.yaml
@@ -3,7 +3,7 @@ kind: Agent
 metadata:
   name: elastic-agent
 spec:
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRefs:
   - name: elasticsearch
   daemonSet:
@@ -213,7 +213,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 3
@@ -225,7 +225,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
diff --git a/config/recipes/elastic-agent/multi-output.yaml b/config/recipes/elastic-agent/multi-output.yaml
index 6dfbbd4e1..05b5afd25 100644
--- a/config/recipes/elastic-agent/multi-output.yaml
+++ b/config/recipes/elastic-agent/multi-output.yaml
@@ -3,7 +3,7 @@ kind: Agent
 metadata:
   name: elastic-agent
 spec:
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRefs:
   - outputName: default
     name: elasticsearch
@@ -196,7 +196,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 3
@@ -208,7 +208,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
@@ -218,7 +218,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch-mon
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 3
@@ -230,7 +230,7 @@ kind: Kibana
 metadata:
   name: kibana-mon
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch-mon
diff --git a/config/recipes/elastic-agent/system-integration.yaml b/config/recipes/elastic-agent/system-integration.yaml
index c7fc33eeb..e966f2b04 100644
--- a/config/recipes/elastic-agent/system-integration.yaml
+++ b/config/recipes/elastic-agent/system-integration.yaml
@@ -3,7 +3,7 @@ kind: Agent
 metadata:
   name: elastic-agent
 spec:
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRefs:
   - name: elasticsearch
   daemonSet:
@@ -31,7 +31,7 @@ spec:
       meta:
         package:
           name: system
-          version: 9.0.0
+          version: 9.1.2
       data_stream:
         namespace: default
       streams:
@@ -136,7 +136,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 3
@@ -148,7 +148,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
diff --git a/config/recipes/gclb/01-elastic-stack.yaml b/config/recipes/gclb/01-elastic-stack.yaml
index 7c5363ce9..c196c21f5 100644
--- a/config/recipes/gclb/01-elastic-stack.yaml
+++ b/config/recipes/gclb/01-elastic-stack.yaml
@@ -6,7 +6,7 @@ metadata:
   labels:
     app: hulk
 spec:
-  version: 9.0.0
+  version: 9.1.2
   http:
     service:
       metadata:
@@ -45,7 +45,7 @@ metadata:
   labels:
     app: hulk
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   http:
     service:
diff --git a/config/recipes/gclb/99-kibana-path.yaml b/config/recipes/gclb/99-kibana-path.yaml
index a504eb918..f3da59df0 100644
--- a/config/recipes/gclb/99-kibana-path.yaml
+++ b/config/recipes/gclb/99-kibana-path.yaml
@@ -7,7 +7,7 @@ metadata:
   labels:
     app: thor
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   config:
     # Make Kibana aware of the fact that it is behind a proxy
diff --git a/config/recipes/istio-gateway/03-elasticsearch-kibana.yaml b/config/recipes/istio-gateway/03-elasticsearch-kibana.yaml
index 2006fe441..6070e3d8a 100644
--- a/config/recipes/istio-gateway/03-elasticsearch-kibana.yaml
+++ b/config/recipes/istio-gateway/03-elasticsearch-kibana.yaml
@@ -7,7 +7,7 @@ metadata:
   labels:
     app: ekmnt
 spec:
-  version: 9.0.0
+  version: 9.1.2
   http:
     tls:
       selfSignedCertificate:
@@ -82,7 +82,7 @@ metadata:
   labels:
     app: ekmnt
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   http:
     tls:
diff --git a/config/recipes/logstash/logstash-eck.yaml b/config/recipes/logstash/logstash-eck.yaml
index 964c32677..c638aa93d 100644
--- a/config/recipes/logstash/logstash-eck.yaml
+++ b/config/recipes/logstash/logstash-eck.yaml
@@ -4,7 +4,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
     - name: default
       count: 3
@@ -17,7 +17,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
@@ -28,10 +28,11 @@ metadata:
   name: filebeat
 spec:
   type: filebeat
-  version: 9.0.0
+  version: 9.1.2
   config:
     filebeat.inputs:
-      - type: log
+      - type: filestream
+        id: logstash-tutorial
         paths:
           - /data/logstash-tutorial.log
     output.logstash:
@@ -67,7 +68,7 @@ metadata:
   name: logstash
 spec:
   count: 1
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRefs:
     - clusterName: eck
       name: elasticsearch
diff --git a/config/recipes/logstash/logstash-es-role.yaml b/config/recipes/logstash/logstash-es-role.yaml
index e39a1e7e0..1491c9962 100644
--- a/config/recipes/logstash/logstash-es-role.yaml
+++ b/config/recipes/logstash/logstash-es-role.yaml
@@ -15,7 +15,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   auth:
     roles:
       - secretName: my-roles-secret
@@ -31,7 +31,7 @@ metadata:
   name: logstash
 spec:
   count: 1
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRefs:
     - name: elasticsearch
       clusterName: eck
diff --git a/config/recipes/logstash/logstash-monitored.yaml b/config/recipes/logstash/logstash-monitored.yaml
index 4c6d6d70f..94127bee8 100644
--- a/config/recipes/logstash/logstash-monitored.yaml
+++ b/config/recipes/logstash/logstash-monitored.yaml
@@ -4,7 +4,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
     - name: default
       count: 3
@@ -17,7 +17,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
@@ -28,10 +28,11 @@ metadata:
   name: filebeat
 spec:
   type: filebeat
-  version: 9.0.0
+  version: 9.1.2
   config:
     filebeat.inputs:
-      - type: log
+      - type: filestream
+        id: logstash
         paths:
           - /data/logstash-tutorial.log
     output.logstash:
@@ -67,7 +68,7 @@ metadata:
   name: logstash
 spec:
   count: 1
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRefs:
     - clusterName: eck
       name: elasticsearch
@@ -116,7 +117,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch-monitoring
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
     - name: default
       count: 3
@@ -128,7 +129,7 @@ kind: Kibana
 metadata:
   name: kibana-monitoring
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch-monitoring
diff --git a/config/recipes/logstash/logstash-multi.yaml b/config/recipes/logstash/logstash-multi.yaml
index 8d1fffff4..0fbe9ad73 100644
--- a/config/recipes/logstash/logstash-multi.yaml
+++ b/config/recipes/logstash/logstash-multi.yaml
@@ -12,7 +12,7 @@ metadata:
   name: qa
   namespace: qa
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
     - name: default
       count: 3
@@ -25,7 +25,7 @@ kind: Elasticsearch
 metadata:
   name: production
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
     - name: default
       count: 3
@@ -39,10 +39,11 @@ metadata:
   name: filebeat
 spec:
   type: filebeat
-  version: 9.0.0
+  version: 9.1.2
   config:
     filebeat.inputs:
-      - type: log
+      - type: filestream
+        id: logstash-tutorial
         paths:
           - /data/logstash-tutorial.log
     output.logstash:
@@ -78,7 +79,7 @@ metadata:
   name: logstash
 spec:
   count: 1
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRefs:
   - clusterName: prod-es
     name: production
diff --git a/config/recipes/logstash/logstash-pipeline-as-secret.yaml b/config/recipes/logstash/logstash-pipeline-as-secret.yaml
index af59da4a5..f49430292 100644
--- a/config/recipes/logstash/logstash-pipeline-as-secret.yaml
+++ b/config/recipes/logstash/logstash-pipeline-as-secret.yaml
@@ -4,7 +4,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
     - name: default
       count: 3
@@ -17,7 +17,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
@@ -28,10 +28,11 @@ metadata:
   name: filebeat
 spec:
   type: filebeat
-  version: 9.0.0
+  version: 9.1.2
   config:
     filebeat.inputs:
-      - type: log
+      - type: filestream
+        id: logstash-tutorial
         paths:
           - /data/logstash-tutorial.log
     output.logstash:
@@ -67,7 +68,7 @@ metadata:
   name: logstash
 spec:
   count: 1
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRefs:
     - clusterName: eck
       name: elasticsearch
diff --git a/config/recipes/logstash/logstash-pipeline-as-volume.yaml b/config/recipes/logstash/logstash-pipeline-as-volume.yaml
index 0bfa43100..8a8699935 100644
--- a/config/recipes/logstash/logstash-pipeline-as-volume.yaml
+++ b/config/recipes/logstash/logstash-pipeline-as-volume.yaml
@@ -4,7 +4,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
     - name: default
       count: 3
@@ -17,7 +17,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: elasticsearch
@@ -28,10 +28,11 @@ metadata:
   name: filebeat
 spec:
   type: filebeat
-  version: 9.0.0
+  version: 9.1.2
   config:
     filebeat.inputs:
-      - type: log
+      - type: filestream
+        id: logstash-tutorial
         paths:
           - /data/logstash-tutorial.log
     output.logstash:
@@ -67,7 +68,7 @@ metadata:
   name: logstash
 spec:
   count: 1
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRefs:
     - clusterName: eck
       name: elasticsearch
diff --git a/config/recipes/logstash/logstash-volumes.yaml b/config/recipes/logstash/logstash-volumes.yaml
index 0e00d759a..3421c8d66 100644
--- a/config/recipes/logstash/logstash-volumes.yaml
+++ b/config/recipes/logstash/logstash-volumes.yaml
@@ -4,7 +4,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
     - name: default
       count: 3
@@ -18,10 +18,11 @@ metadata:
   name: filebeat
 spec:
   type: filebeat
-  version: 9.0.0
+  version: 9.1.2
   config:
     filebeat.inputs:
-      - type: log
+      - type: filestream
+        id: logstash-tutorial
         paths:
           - /data/logstash-tutorial.log
     output.logstash:
@@ -57,7 +58,7 @@ metadata:
   name: logstash
 spec:
   count: 1
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRefs:
     - clusterName: eck
       name: elasticsearch
diff --git a/config/recipes/maps/01-ems.yaml b/config/recipes/maps/01-ems.yaml
index 253587c5b..fae3e338c 100644
--- a/config/recipes/maps/01-ems.yaml
+++ b/config/recipes/maps/01-ems.yaml
@@ -3,5 +3,5 @@ kind: ElasticMapsServer
 metadata:
   name: ems-sample
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
diff --git a/config/recipes/maps/02-es-kb.yaml b/config/recipes/maps/02-es-kb.yaml
index 4c856311d..54458c542 100644
--- a/config/recipes/maps/02-es-kb.yaml
+++ b/config/recipes/maps/02-es-kb.yaml
@@ -4,7 +4,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
     - name: default
       count: 3
@@ -27,7 +27,7 @@ kind: Kibana
 metadata:
   name: kibana
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   config:
     # Configure this to a domain you control
diff --git a/config/recipes/remoteclusters/elasticsearch.yaml b/config/recipes/remoteclusters/elasticsearch.yaml
index ab330a03a..7409abb4a 100644
--- a/config/recipes/remoteclusters/elasticsearch.yaml
+++ b/config/recipes/remoteclusters/elasticsearch.yaml
@@ -9,7 +9,7 @@ metadata:
   name: cluster1
   namespace: ns1
 spec:
-  version: 9.0.0
+  version: 9.1.2
   remoteClusters:
     - name: to-ns2-cluster2
       elasticsearchRef:
@@ -38,7 +38,7 @@ spec:
 #      spec:
 #        # expose this cluster Service with a LoadBalancer
 #        type: LoadBalancer
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: "cluster1"
@@ -54,7 +54,7 @@ metadata:
   name: cluster2
   namespace: ns2
 spec:
-  version: 9.0.0
+  version: 9.1.2
   ## Required for this cluster to be accessed using remote cluster API keys.
   remoteClusterServer:
     enabled: true
@@ -75,7 +75,7 @@ spec:
 #      spec:
 #        # expose this cluster Service with a LoadBalancer
 #        type: LoadBalancer
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: "cluster2"
\ No newline at end of file
diff --git a/config/recipes/traefik/02-elastic-stack.yaml b/config/recipes/traefik/02-elastic-stack.yaml
index fe79e8644..46a924e07 100644
--- a/config/recipes/traefik/02-elastic-stack.yaml
+++ b/config/recipes/traefik/02-elastic-stack.yaml
@@ -6,7 +6,7 @@ metadata:
   labels:
     app: hulk
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: master
     count: 1
@@ -41,7 +41,7 @@ metadata:
   labels:
     app: hulk
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   config:
     xpack.fleet.packages:
@@ -57,7 +57,7 @@ metadata:
   labels:
     app: hulk
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: hulk
diff --git a/config/samples/apm/apm_es_kibana.yaml b/config/samples/apm/apm_es_kibana.yaml
index aaae96ff6..6189258cc 100644
--- a/config/samples/apm/apm_es_kibana.yaml
+++ b/config/samples/apm/apm_es_kibana.yaml
@@ -5,7 +5,7 @@ kind: Elasticsearch
 metadata:
   name: es-apm-sample
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 3
@@ -19,7 +19,7 @@ kind: Kibana
 metadata:
   name: kb-apm-sample
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: "es-apm-sample"
@@ -33,7 +33,7 @@ kind: ApmServer
 metadata:
   name: apm-apm-sample
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: "es-apm-sample"
diff --git a/config/samples/elasticsearch/elasticsearch.yaml b/config/samples/elasticsearch/elasticsearch.yaml
index fef14ea9f..772ebe697 100644
--- a/config/samples/elasticsearch/elasticsearch.yaml
+++ b/config/samples/elasticsearch/elasticsearch.yaml
@@ -7,7 +7,7 @@ metadata:
   #  eck.k8s.elastic.co/downward-node-labels: "topology.kubernetes.io/zone"
   name: elasticsearch-sample
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     config:
diff --git a/config/samples/enterprisesearch/ent_es.yaml b/config/samples/enterprisesearch/ent_es.yaml
index 988a1df36..90d457874 100644
--- a/config/samples/enterprisesearch/ent_es.yaml
+++ b/config/samples/enterprisesearch/ent_es.yaml
@@ -4,7 +4,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch-sample
 spec:
-  version: 8.18.0
+  version: 8.19.0
   nodeSets:
     - name: default
       count: 1
@@ -23,7 +23,7 @@ kind: Kibana
 metadata:
   name: kibana-sample
 spec:
-  version: 8.18.0
+  version: 8.19.0
   count: 1
   elasticsearchRef:
     name: elasticsearch-sample
@@ -35,7 +35,7 @@ kind: EnterpriseSearch
 metadata:
   name: ent-sample
 spec:
-  version: 8.18.0
+  version: 8.19.0
   count: 1
   elasticsearchRef:
     name: elasticsearch-sample
diff --git a/config/samples/kibana/kibana_es.yaml b/config/samples/kibana/kibana_es.yaml
index 310a474a9..6d394b453 100644
--- a/config/samples/kibana/kibana_es.yaml
+++ b/config/samples/kibana/kibana_es.yaml
@@ -4,7 +4,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch-sample
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
   - name: default
     count: 1
@@ -18,7 +18,7 @@ kind: Kibana
 metadata:
   name: kibana-sample
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 1
   elasticsearchRef:
     name: "elasticsearch-sample"
diff --git a/config/samples/logstash/logstash.yaml b/config/samples/logstash/logstash.yaml
index 82520b31c..b3372885a 100644
--- a/config/samples/logstash/logstash.yaml
+++ b/config/samples/logstash/logstash.yaml
@@ -3,7 +3,7 @@ kind: Logstash
 metadata:
   name: logstash-sample
 spec:
-  version: 9.0.0
+  version: 9.1.2
   count: 3
   config:
     log.level: info
diff --git a/config/samples/logstash/logstash_es.yaml b/config/samples/logstash/logstash_es.yaml
index 8ccaaf230..fe64f7047 100644
--- a/config/samples/logstash/logstash_es.yaml
+++ b/config/samples/logstash/logstash_es.yaml
@@ -3,7 +3,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch-sample
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
     - name: default
       count: 2
@@ -16,7 +16,7 @@ metadata:
   name: logstash-sample
 spec:
   count: 1
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRefs:
     - clusterName: production
       name: elasticsearch-sample
diff --git a/config/samples/logstash/logstash_pv.yaml b/config/samples/logstash/logstash_pv.yaml
index 916b1a5c5..e690d6b8c 100644
--- a/config/samples/logstash/logstash_pv.yaml
+++ b/config/samples/logstash/logstash_pv.yaml
@@ -4,7 +4,7 @@ metadata:
   name: d
 spec:
   count: 1
-  version: 9.0.0
+  version: 9.1.2
   config:
     queue.type: persisted
   pipelines:
diff --git a/config/samples/logstash/logstash_stackmonitor.yaml b/config/samples/logstash/logstash_stackmonitor.yaml
index 1e9ecb030..cdf95a198 100644
--- a/config/samples/logstash/logstash_stackmonitor.yaml
+++ b/config/samples/logstash/logstash_stackmonitor.yaml
@@ -4,7 +4,7 @@ kind: Elasticsearch
 metadata:
   name: monitoring
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
     - name: default
       count: 3
@@ -17,7 +17,7 @@ metadata:
   name: logstash-sample
 spec:
   count: 1
-  version: 9.0.0
+  version: 9.1.2
   config:
     log.level: info
     api.http.host: "0.0.0.0"
@@ -55,7 +55,7 @@ kind: Kibana
 metadata:
   name: kibana-sample
 spec:
-  version: 9.0.0
+  version: 9.1.2
   elasticsearchRef:
     name: monitoring
   count: 1
diff --git a/config/samples/logstash/logstash_svc.yaml b/config/samples/logstash/logstash_svc.yaml
index 19f2132b9..d2b0ba1cd 100644
--- a/config/samples/logstash/logstash_svc.yaml
+++ b/config/samples/logstash/logstash_svc.yaml
@@ -3,7 +3,7 @@ kind: Elasticsearch
 metadata:
   name: elasticsearch-sample
 spec:
-  version: 9.0.0
+  version: 9.1.2
   nodeSets:
     - name: default
       count: 3
@@ -16,7 +16,7 @@ metadata:
   name: logstash-sample
 spec:
   count: 2
-  version: 9.0.0
+  version: 9.1.2
   config:
     log.level: info
     api.http.host: "0.0.0.0"
diff --git a/config/webhook/manifests.yaml b/config/webhook/manifests.yaml
index 3b0275d8b..53187308b 100644
--- a/config/webhook/manifests.yaml
+++ b/config/webhook/manifests.yaml
@@ -6,7 +6,6 @@ metadata:
 webhooks:
 - admissionReviewVersions:
   - v1
-  - v1beta1
   clientConfig:
     service:
       name: webhook-service
@@ -28,7 +27,6 @@ webhooks:
   sideEffects: None
 - admissionReviewVersions:
   - v1
-  - v1beta1
   clientConfig:
     service:
       name: webhook-service
@@ -50,7 +48,6 @@ webhooks:
   sideEffects: None
 - admissionReviewVersions:
   - v1
-  - v1beta1
   clientConfig:
     service:
       name: webhook-service
@@ -72,7 +69,6 @@ webhooks:
   sideEffects: None
 - admissionReviewVersions:
   - v1
-  - v1beta1
   clientConfig:
     service:
       name: webhook-service
@@ -94,7 +90,6 @@ webhooks:
   sideEffects: None
 - admissionReviewVersions:
   - v1
-  - v1beta1
   clientConfig:
     service:
       name: webhook-service
@@ -116,7 +111,6 @@ webhooks:
   sideEffects: None
 - admissionReviewVersions:
   - v1
-  - v1beta1
   clientConfig:
     service:
       name: webhook-service
@@ -138,7 +132,6 @@ webhooks:
   sideEffects: None
 - admissionReviewVersions:
   - v1
-  - v1beta1
   clientConfig:
     service:
       name: webhook-service
@@ -160,7 +153,6 @@ webhooks:
   sideEffects: None
 - admissionReviewVersions:
   - v1
-  - v1beta1
   clientConfig:
     service:
       name: webhook-service
@@ -182,7 +174,6 @@ webhooks:
   sideEffects: None
 - admissionReviewVersions:
   - v1
-  - v1beta1
   clientConfig:
     service:
       name: webhook-service
@@ -204,7 +195,6 @@ webhooks:
   sideEffects: None
 - admissionReviewVersions:
   - v1
-  - v1beta1
   clientConfig:
     service:
       name: webhook-service
@@ -226,7 +216,6 @@ webhooks:
   sideEffects: None
 - admissionReviewVersions:
   - v1
-  - v1beta1
   clientConfig:
     service:
       name: webhook-service
@@ -248,7 +237,6 @@ webhooks:
   sideEffects: None
 - admissionReviewVersions:
   - v1
-  - v1beta1
   clientConfig:
     service:
       name: webhook-service
@@ -270,7 +258,6 @@ webhooks:
   sideEffects: None
 - admissionReviewVersions:
   - v1
-  - v1beta1
   clientConfig:
     service:
       name: webhook-service
@@ -292,7 +279,6 @@ webhooks:
   sideEffects: None
 - admissionReviewVersions:
   - v1
-  - v1beta1
   clientConfig:
     service:
       name: webhook-service
diff --git a/deploy/eck-operator/charts/eck-operator-crds/templates/all-crds.yaml b/deploy/eck-operator/charts/eck-operator-crds/templates/all-crds.yaml
index f394c6130..97707a8ba 100644
--- a/deploy/eck-operator/charts/eck-operator-crds/templates/all-crds.yaml
+++ b/deploy/eck-operator/charts/eck-operator-crds/templates/all-crds.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
     helm.sh/resource-policy: keep
   labels:
     app.kubernetes.io/instance: '{{ .Release.Name }}'
@@ -119,7 +119,7 @@ spec:
                               pod is available (Ready for at least minReadySeconds) the old DaemonSet pod
                               on that node is marked deleted. If the old pod becomes unavailable for any
                               reason (Ready transitions to false, is evicted, or is drained) an updated
-                              pod is immediatedly created on that node without considering surge limits.
+                              pod is immediately created on that node without considering surge limits.
                               Allowing surge implies the possibility that the resources consumed by the
                               daemonset on any given node can double if the readiness check fails, and
                               so resource intensive daemonsets should take into account that they may
@@ -233,7 +233,8 @@ spec:
                     secretName:
                       description: |-
                         SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                        Elastic resource not managed by the operator. The referenced secret must contain the following:
+                        Elastic resource not managed by the operator.
+                        The referenced secret must contain the following:
                         - `url`: the URL to reach the Elastic resource
                         - `username`: the username of the user to be authenticated to the Elastic resource
                         - `password`: the password of the user to be authenticated to the Elastic resource
@@ -257,6 +258,7 @@ spec:
                 description: |-
                   FleetServerRef is a reference to Fleet Server that this Agent should connect to to obtain it's configuration.
                   Don't set unless `mode` is set to `fleet`.
+                  References to Fleet servers running outside the Kubernetes cluster via the `secretName` attribute are not supported.
                 properties:
                   name:
                     description: Name of an existing Kubernetes object corresponding
@@ -269,7 +271,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -720,7 +723,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -1057,15 +1061,13 @@ spec:
                                 volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                 If specified, the CSI driver will create or update the volume with the attributes defined
                                 in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                will be set by the persistentvolume controller if it exists.
+                                it can be changed after the claim is created. An empty string or nil value indicates that no
+                                VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                this field can be reset to its previous value (including nil) to cancel the modification.
                                 If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                 set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                 exists.
                                 More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                               type: string
                             volumeMode:
                               description: |-
@@ -1135,7 +1137,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
     helm.sh/resource-policy: keep
   labels:
     app.kubernetes.io/instance: '{{ .Release.Name }}'
@@ -1220,7 +1222,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -1670,7 +1673,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -2367,7 +2371,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
     helm.sh/resource-policy: keep
   labels:
     app.kubernetes.io/instance: '{{ .Release.Name }}'
@@ -2488,7 +2492,7 @@ spec:
                               pod is available (Ready for at least minReadySeconds) the old DaemonSet pod
                               on that node is marked deleted. If the old pod becomes unavailable for any
                               reason (Ready transitions to false, is evicted, or is drained) an updated
-                              pod is immediatedly created on that node without considering surge limits.
+                              pod is immediately created on that node without considering surge limits.
                               Allowing surge implies the possibility that the resources consumed by the
                               daemonset on any given node can double if the readiness check fails, and
                               so resource intensive daemonsets should take into account that they may
@@ -2598,7 +2602,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -2633,7 +2638,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -2678,7 +2684,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -2719,7 +2726,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -2848,7 +2856,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
     helm.sh/resource-policy: keep
   labels:
     app.kubernetes.io/instance: '{{ .Release.Name }}'
@@ -2945,7 +2953,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -3451,7 +3460,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
     helm.sh/resource-policy: keep
   labels:
     app.kubernetes.io/instance: '{{ .Release.Name }}'
@@ -3809,7 +3818,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
     helm.sh/resource-policy: keep
   labels:
     app.kubernetes.io/instance: '{{ .Release.Name }}'
@@ -4356,7 +4365,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -4397,7 +4407,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -4674,15 +4685,13 @@ spec:
                                   volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                   If specified, the CSI driver will create or update the volume with the attributes defined
                                   in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                  it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                  will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                  If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                  will be set by the persistentvolume controller if it exists.
+                                  it can be changed after the claim is created. An empty string or nil value indicates that no
+                                  VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                  this field can be reset to its previous value (including nil) to cancel the modification.
                                   If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                   set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                   exists.
                                   More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                  (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                 type: string
                               volumeMode:
                                 description: |-
@@ -4703,10 +4712,18 @@ spec:
                 type: array
               podDisruptionBudget:
                 description: |-
-                  PodDisruptionBudget provides access to the default Pod disruption budget for the Elasticsearch cluster.
-                  The default budget doesn't allow any Pod to be removed in case the cluster is not green or if there is only one node of type `data` or `master`.
-                  In all other cases the default PodDisruptionBudget sets `minUnavailable` equal to the total number of nodes minus 1.
-                  To disable, set `PodDisruptionBudget` to the empty value (`{}` in YAML).
+                  PodDisruptionBudget provides access to the default Pod disruption budget(s) for the Elasticsearch cluster.
+                  The behavior depends on the license level.
+                  With a Basic license or if podDisruptionBudget.spec is not empty:
+                    The default budget doesn't allow any Pod to be removed in case the cluster is not green or if there is only one node of type `data` or `master`.
+                    In all other cases the default podDisruptionBudget sets `minUnavailable` equal to the total number of nodes minus 1.
+                  With an Enterprise license and if podDisruptionBudget.spec is empty:
+                    The default budget is split into multiple budgets, each targeting a specific node role type allowing additional disruptions
+                    for certain roles according to the health status of the cluster.
+                      Example:
+                        All data roles (excluding frozen): allows disruptions only when the cluster is green.
+                        All other roles: allows disruptions only when the cluster is yellow or green.
+                  To disable, set `podDisruptionBudget` to the empty value (`{}` in YAML).
                 properties:
                   metadata:
                     description: |-
@@ -6345,15 +6362,13 @@ spec:
                                   volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                   If specified, the CSI driver will create or update the volume with the attributes defined
                                   in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                                  it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                                  will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                                  If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                                  will be set by the persistentvolume controller if it exists.
+                                  it can be changed after the claim is created. An empty string or nil value indicates that no
+                                  VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                  this field can be reset to its previous value (including nil) to cancel the modification.
                                   If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                   set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                   exists.
                                   More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                                  (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                                 type: string
                               volumeMode:
                                 description: |-
@@ -6600,7 +6615,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
     helm.sh/resource-policy: keep
   labels:
     app.kubernetes.io/instance: '{{ .Release.Name }}'
@@ -6696,7 +6711,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -7274,7 +7290,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -7766,7 +7783,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
     helm.sh/resource-policy: keep
   labels:
     app.kubernetes.io/instance: '{{ .Release.Name }}'
@@ -7851,7 +7868,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -7882,7 +7900,8 @@ spec:
                   secretName:
                     description: |-
                       SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                      Elastic resource not managed by the operator. The referenced secret must contain the following:
+                      Elastic resource not managed by the operator.
+                      The referenced secret must contain the following:
                       - `url`: the URL to reach the Elastic resource
                       - `username`: the username of the user to be authenticated to the Elastic resource
                       - `password`: the password of the user to be authenticated to the Elastic resource
@@ -8346,7 +8365,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -8387,7 +8407,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -9078,7 +9099,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
     helm.sh/resource-policy: keep
   labels:
     app.kubernetes.io/instance: '{{ .Release.Name }}'
@@ -9187,7 +9208,8 @@ spec:
                     secretName:
                       description: |-
                         SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                        Elastic resource not managed by the operator. The referenced secret must contain the following:
+                        Elastic resource not managed by the operator.
+                        The referenced secret must contain the following:
                         - `url`: the URL to reach the Elastic resource
                         - `username`: the username of the user to be authenticated to the Elastic resource
                         - `password`: the password of the user to be authenticated to the Elastic resource
@@ -9239,7 +9261,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -9280,7 +9303,8 @@ spec:
                             secretName:
                               description: |-
                                 SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-                                Elastic resource not managed by the operator. The referenced secret must contain the following:
+                                Elastic resource not managed by the operator.
+                                The referenced secret must contain the following:
                                 - `url`: the URL to reach the Elastic resource
                                 - `username`: the username of the user to be authenticated to the Elastic resource
                                 - `password`: the password of the user to be authenticated to the Elastic resource
@@ -10053,15 +10077,13 @@ spec:
                             volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                             If specified, the CSI driver will create or update the volume with the attributes defined
                             in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
-                            it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
-                            will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
-                            If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
-                            will be set by the persistentvolume controller if it exists.
+                            it can be changed after the claim is created. An empty string or nil value indicates that no
+                            VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                            this field can be reset to its previous value (including nil) to cancel the modification.
                             If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                             set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                             exists.
                             More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
-                            (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
                           type: string
                         volumeMode:
                           description: |-
@@ -10224,13 +10246,11 @@ spec:
                           description: |-
                             currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using.
                             When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim
-                            This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                           type: string
                         modifyVolumeStatus:
                           description: |-
                             ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
                             When this is unset, there is no ModifyVolume operation being attempted.
-                            This is a beta field and requires enabling VolumeAttributesClass feature (off by default).
                           properties:
                             status:
                               description: "status is the status of the ControllerModifyVolume
@@ -10320,7 +10340,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.19.0
     helm.sh/resource-policy: keep
   labels:
     app.kubernetes.io/instance: '{{ .Release.Name }}'
diff --git a/deploy/eck-operator/templates/webhook.yaml b/deploy/eck-operator/templates/webhook.yaml
index 8f41e7d06..e31df1656 100644
--- a/deploy/eck-operator/templates/webhook.yaml
+++ b/deploy/eck-operator/templates/webhook.yaml
@@ -30,7 +30,7 @@ webhooks:
 {{- end }}
   name: elastic-agent-validation-v1alpha1.k8s.elastic.co
   matchPolicy: Exact
-  admissionReviewVersions: [v1,v1beta1]
+  admissionReviewVersions: [v1]
   sideEffects: None
   rules:
   - apiGroups:
@@ -52,7 +52,7 @@ webhooks:
       path: /validate-apm-k8s-elastic-co-v1-apmserver
   failurePolicy: {{ .Values.webhook.failurePolicy }}
 {{- with .Values.webhook.namespaceSelector }}
-  namespaceSelector: 
+  namespaceSelector:
     {{- toYaml . | nindent 4 }}
 {{- end }}
 {{- with .Values.webhook.objectSelector }}
@@ -61,7 +61,7 @@ webhooks:
 {{- end }}
   name: elastic-apm-validation-v1.k8s.elastic.co
   matchPolicy: Exact
-  admissionReviewVersions: [v1,v1beta1]
+  admissionReviewVersions: [v1]
   sideEffects: None
   rules:
   - apiGroups:
@@ -83,7 +83,7 @@ webhooks:
       path: /validate-apm-k8s-elastic-co-v1beta1-apmserver
   failurePolicy: {{ .Values.webhook.failurePolicy }}
 {{- with .Values.webhook.namespaceSelector }}
-  namespaceSelector: 
+  namespaceSelector:
     {{- toYaml . | nindent 4 }}
 {{- end }}
 {{- with .Values.webhook.objectSelector }}
@@ -92,7 +92,7 @@ webhooks:
 {{- end }}
   name: elastic-apm-validation-v1beta1.k8s.elastic.co
   matchPolicy: Exact
-  admissionReviewVersions: [v1,v1beta1]
+  admissionReviewVersions: [v1]
   sideEffects: None
   rules:
   - apiGroups:
@@ -114,7 +114,7 @@ webhooks:
       path: /validate-beat-k8s-elastic-co-v1beta1-beat
   failurePolicy: {{ .Values.webhook.failurePolicy }}
 {{- with .Values.webhook.namespaceSelector }}
-  namespaceSelector: 
+  namespaceSelector:
     {{- toYaml . | nindent 4 }}
 {{- end }}
 {{- with .Values.webhook.objectSelector }}
@@ -123,7 +123,7 @@ webhooks:
 {{- end }}
   name: elastic-beat-validation-v1beta1.k8s.elastic.co
   matchPolicy: Exact
-  admissionReviewVersions: [v1,v1beta1]
+  admissionReviewVersions: [v1]
   sideEffects: None
   rules:
   - apiGroups:
@@ -154,7 +154,7 @@ webhooks:
 {{- end }}
   name: elastic-ent-validation-v1.k8s.elastic.co
   matchPolicy: Exact
-  admissionReviewVersions: [v1,v1beta1]
+  admissionReviewVersions: [v1]
   sideEffects: None
   rules:
   - apiGroups:
@@ -176,7 +176,7 @@ webhooks:
       path: /validate-enterprisesearch-k8s-elastic-co-v1beta1-enterprisesearch
   failurePolicy: {{ .Values.webhook.failurePolicy }}
 {{- with .Values.webhook.namespaceSelector }}
-  namespaceSelector: 
+  namespaceSelector:
     {{- toYaml . | nindent 4 }}
 {{- end }}
 {{- with .Values.webhook.objectSelector }}
@@ -185,7 +185,7 @@ webhooks:
 {{- end }}
   name: elastic-ent-validation-v1beta1.k8s.elastic.co
   matchPolicy: Exact
-  admissionReviewVersions: [v1,v1beta1]
+  admissionReviewVersions: [v1]
   sideEffects: None
   rules:
   - apiGroups:
@@ -207,7 +207,7 @@ webhooks:
       path: /validate-elasticsearch-k8s-elastic-co-v1-elasticsearch
   failurePolicy: {{ .Values.webhook.failurePolicy }}
 {{- with .Values.webhook.namespaceSelector }}
-  namespaceSelector: 
+  namespaceSelector:
     {{- toYaml . | nindent 4 }}
 {{- end }}
 {{- with .Values.webhook.objectSelector }}
@@ -216,7 +216,7 @@ webhooks:
 {{- end }}
   name: elastic-es-validation-v1.k8s.elastic.co
   matchPolicy: Exact
-  admissionReviewVersions: [v1,v1beta1]
+  admissionReviewVersions: [v1]
   sideEffects: None
   rules:
   - apiGroups:
@@ -238,7 +238,7 @@ webhooks:
       path: /validate-elasticsearch-k8s-elastic-co-v1beta1-elasticsearch
   failurePolicy: {{ .Values.webhook.failurePolicy }}
 {{- with .Values.webhook.namespaceSelector }}
-  namespaceSelector: 
+  namespaceSelector:
     {{- toYaml . | nindent 4 }}
 {{- end }}
 {{- with .Values.webhook.objectSelector }}
@@ -247,7 +247,7 @@ webhooks:
 {{- end }}
   name: elastic-es-validation-v1beta1.k8s.elastic.co
   matchPolicy: Exact
-  admissionReviewVersions: [v1,v1beta1]
+  admissionReviewVersions: [v1]
   sideEffects: None
   rules:
   - apiGroups:
@@ -278,7 +278,7 @@ webhooks:
 {{- end }}
   name: elastic-ems-validation-v1alpha1.k8s.elastic.co
   matchPolicy: Exact
-  admissionReviewVersions: [v1,v1beta1]
+  admissionReviewVersions: [v1]
   sideEffects: None
   rules:
     - apiGroups:
@@ -300,7 +300,7 @@ webhooks:
       path: /validate-kibana-k8s-elastic-co-v1-kibana
   failurePolicy: {{ .Values.webhook.failurePolicy }}
 {{- with .Values.webhook.namespaceSelector }}
-  namespaceSelector: 
+  namespaceSelector:
     {{- toYaml . | nindent 4 }}
 {{- end }}
 {{- with .Values.webhook.objectSelector }}
@@ -309,7 +309,7 @@ webhooks:
 {{- end }}
   name: elastic-kb-validation-v1.k8s.elastic.co
   matchPolicy: Exact
-  admissionReviewVersions: [v1,v1beta1]
+  admissionReviewVersions: [v1]
   sideEffects: None
   rules:
   - apiGroups:
@@ -331,7 +331,7 @@ webhooks:
       path: /validate-kibana-k8s-elastic-co-v1beta1-kibana
   failurePolicy: {{ .Values.webhook.failurePolicy }}
 {{- with .Values.webhook.namespaceSelector }}
-  namespaceSelector: 
+  namespaceSelector:
     {{- toYaml . | nindent 4 }}
 {{- end }}
 {{- with .Values.webhook.objectSelector }}
@@ -340,7 +340,7 @@ webhooks:
 {{- end }}
   name: elastic-kb-validation-v1beta1.k8s.elastic.co
   matchPolicy: Exact
-  admissionReviewVersions: [v1,v1beta1]
+  admissionReviewVersions: [v1]
   sideEffects: None
   rules:
   - apiGroups:
@@ -371,7 +371,7 @@ webhooks:
 {{- end }}
   name: elastic-esa-validation-v1alpha1.k8s.elastic.co
   matchPolicy: Exact
-  admissionReviewVersions: [v1,v1beta1]
+  admissionReviewVersions: [v1]
   sideEffects: None
   rules:
     - apiGroups:
@@ -402,7 +402,7 @@ webhooks:
 {{- end }}
   name: elastic-scp-validation-v1alpha1.k8s.elastic.co
   matchPolicy: Exact
-  admissionReviewVersions: [v1,v1beta1]
+  admissionReviewVersions: [v1]
   sideEffects: None
   rules:
     - apiGroups:
@@ -433,7 +433,7 @@ webhooks:
 {{- end }}
   name: elastic-logstash-validation-v1alpha1.k8s.elastic.co
   matchPolicy: Exact
-  admissionReviewVersions: [v1,v1beta1]
+  admissionReviewVersions: [v1]
   sideEffects: None
   rules:
     - apiGroups:
diff --git a/deploy/eck-stack/charts/eck-agent/values.yaml b/deploy/eck-stack/charts/eck-agent/values.yaml
index 401adcc20..8a84d00fd 100644
--- a/deploy/eck-stack/charts/eck-agent/values.yaml
+++ b/deploy/eck-stack/charts/eck-agent/values.yaml
@@ -63,6 +63,18 @@ elasticsearchRefs:
   # will be assumed.
   #
   # namespace: default
+  #
+  # Optional secretName referencing an existing Kubernetes secret that contains connection information
+  # for associating an Agent instance to a remote Elasticsearch instance not managed by ECK.
+  # The referenced secret must contain the following:
+  # - `url`: the URL to reach the Elastic resource
+  # - `username`: the username of the user to be authenticated to the Elastic resource
+  # - `password`: the password of the user to be authenticated to the Elastic resource
+  # - `ca.crt`: the CA certificate in PEM format (optional)
+  # - `api-key`: the key to authenticate against the Elastic resource instead of a username and password
+  # This field cannot be used in combination with the other fields name, namespace or serviceName.
+  #
+  # secretName: my-remote-es-credentials
 
 # Reference to ECK-managed Fleet Server instance.
 #
@@ -108,7 +120,7 @@ fleetServerEnabled: false
 
 # policyID determines into which Agent Policy this Agent will be enrolled.
 # policyID: eck-agent
-  
+
 # DaemonSet, StatefulSet, or Deployment specification for Agent.
 # At least one is required of [daemonSet, deployment, statefulSet].
 # No default is currently set, refer to https://github.com/elastic/cloud-on-k8s/issues/7429.
@@ -201,7 +213,7 @@ clusterRole:
   - apiGroups: ["extensions"]
     resources:
       - replicasets
-    verbs: 
+    verbs:
     - "get"
     - "list"
     - "watch"
diff --git a/deploy/eck-stack/charts/eck-apm-server/values.yaml b/deploy/eck-stack/charts/eck-apm-server/values.yaml
index 3d6189e2d..450b8c2c8 100644
--- a/deploy/eck-stack/charts/eck-apm-server/values.yaml
+++ b/deploy/eck-stack/charts/eck-apm-server/values.yaml
@@ -69,9 +69,20 @@ elasticsearchRef: {}
   # will be assumed.
   #
   # namespace: default
+  #
+  # Optional secretName referencing an existing Kubernetes secret that contains connection information
+  # for associating an APM Server instance to a remote Elasticsearch instance not managed by ECK.
+  # The referenced secret must contain the following:
+  # - `url`: the URL to reach the Elastic resource
+  # - `username`: the username of the user to be authenticated to the Elastic resource
+  # - `password`: the password of the user to be authenticated to the Elastic resource
+  # - `ca.crt`: the CA certificate in PEM format (optional)
+  # This field cannot be used in combination with the other fields name, namespace or serviceName.
+  #
+  # secretName: my-remote-es-credentials
 
 # Optional reference to ECK-managed Kibana resource which allows ECK to
-# automatically configure the Kibana endpoint as described in 
+# automatically configure the Kibana endpoint as described in
 # https://www.elastic.co/guide/en/apm/server/current/setup-kibana-endpoint.html
 #
 # kibanaRef:
diff --git a/deploy/eck-stack/charts/eck-beats/values.yaml b/deploy/eck-stack/charts/eck-beats/values.yaml
index e751a1252..7a49b62a7 100644
--- a/deploy/eck-stack/charts/eck-beats/values.yaml
+++ b/deploy/eck-stack/charts/eck-beats/values.yaml
@@ -72,6 +72,18 @@ elasticsearchRef: {}
   # will be assumed.
   #
   # namespace: default
+  #
+  # Optional secretName referencing an existing Kubernetes secret that contains connection information
+  # for associating a Beat instance to a remote Elasticsearch instance not managed by ECK.
+  # The referenced secret must contain the following:
+  # - `url`: the URL to reach the Elastic resource
+  # - `username`: the username of the user to be authenticated to the Elastic resource
+  # - `password`: the password of the user to be authenticated to the Elastic resource
+  # - `ca.crt`: the CA certificate in PEM format (optional)
+  # - `api-key`: the key to authenticate against the Elastic resource instead of a username and password
+  # This field cannot be used in combination with the other fields name, namespace or serviceName.
+  #
+  # secretName: my-remote-es-credentials
 
 # Daemonset, or Deployment specification for the type of Beat specified.
 # At least one is required of [daemonSet, deployment].
diff --git a/deploy/eck-stack/charts/eck-enterprise-search/values.yaml b/deploy/eck-stack/charts/eck-enterprise-search/values.yaml
index a83c98711..16d3aaa76 100644
--- a/deploy/eck-stack/charts/eck-enterprise-search/values.yaml
+++ b/deploy/eck-stack/charts/eck-enterprise-search/values.yaml
@@ -76,6 +76,17 @@ elasticsearchRef: {}
   # will be assumed.
   #
   # namespace: default
+  #
+  # Optional secretName referencing an existing Kubernetes secret that contains connection information
+  # for associating an Enterprise Search instance to a remote Elasticsearch instance not managed by ECK.
+  # The referenced secret must contain the following:
+  # - `url`: the URL to reach the Elastic resource
+  # - `username`: the username of the user to be authenticated to the Elastic resource
+  # - `password`: the password of the user to be authenticated to the Elastic resource
+  # - `ca.crt`: the CA certificate in PEM format (optional)
+  # This field cannot be used in combination with the other fields name, namespace or serviceName.
+  #
+  # secretName: my-remote-es-credentials
 
 # Set podTemplate to customize the pod used by Enterprise Search
 # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-customize-pods.html
diff --git a/deploy/eck-stack/charts/eck-fleet-server/values.yaml b/deploy/eck-stack/charts/eck-fleet-server/values.yaml
index 261a55400..23c3ce09c 100644
--- a/deploy/eck-stack/charts/eck-fleet-server/values.yaml
+++ b/deploy/eck-stack/charts/eck-fleet-server/values.yaml
@@ -65,6 +65,18 @@ elasticsearchRefs: []
   # will be assumed.
   #
   # namespace: default
+  #
+  # Optional secretName referencing an existing Kubernetes secret that contains connection information
+  # for associating a Fleet Server instance to a remote Elasticsearch instance not managed by ECK.
+  # The referenced secret must contain the following:
+  # - `url`: the URL to reach the Elastic resource
+  # - `username`: the username of the user to be authenticated to the Elastic resource
+  # - `password`: the password of the user to be authenticated to the Elastic resource
+  # - `ca.crt`: the CA certificate in PEM format (optional)
+  # - `api-key`: the key to authenticate against the Elastic resource instead of a username and password
+  # This field cannot be used in combination with the other fields name, namespace or serviceName.
+  #
+  # secretName: my-remote-es-credentials
 
 # policyID determines into which Agent Policy this Fleet Server will be enrolled.
 policyID: eck-fleet-server
diff --git a/deploy/eck-stack/charts/eck-kibana/templates/kibana.yaml b/deploy/eck-stack/charts/eck-kibana/templates/kibana.yaml
index 2d07efaa2..0d925001d 100644
--- a/deploy/eck-stack/charts/eck-kibana/templates/kibana.yaml
+++ b/deploy/eck-stack/charts/eck-kibana/templates/kibana.yaml
@@ -12,8 +12,8 @@ metadata:
     {{- end }}
 spec:
   version: {{ required "A Kibana version is required" .Values.version }}
-  {{- /* 
-    The following templates with 'or' are to allow both .spec.field and .field to be set for backwards 
+  {{- /*
+    The following templates with 'or' are to allow both .spec.field and .field to be set for backwards
     compatibility purposes. See https://github.com/elastic/cloud-on-k8s/pull/8192 for details.
   */ -}}
   {{- with or ((.Values.spec).image) (.Values.image) }}
@@ -23,8 +23,8 @@ spec:
   count: {{ . }}
   {{- end }}
   {{- $esRef := or ((.Values.spec).elasticsearchRef) (.Values.elasticsearchRef) }}
-  {{- if not ($esRef).name }}
-  {{ fail "An elasticsearchRef is required" }}
+{{- if not (or ($esRef).name ($esRef).secretName) }}
+  {{ fail "An elasticsearchRef name or secretName is required" }}
   {{- end }}
   elasticsearchRef:
   {{- toYaml $esRef | nindent 4 }}
diff --git a/deploy/eck-stack/charts/eck-kibana/values.yaml b/deploy/eck-stack/charts/eck-kibana/values.yaml
index 0cf783af2..663d95b75 100644
--- a/deploy/eck-stack/charts/eck-kibana/values.yaml
+++ b/deploy/eck-stack/charts/eck-kibana/values.yaml
@@ -54,6 +54,17 @@ elasticsearchRef: {}
   # will be assumed.
   #
   # namespace: default
+  #
+  # Optional secretName referencing an existing Kubernetes secret that contains connection information
+  # for associating a Kibana instance to a remote Elasticsearch instance not managed by ECK.
+  # The referenced secret must contain the following:
+  # - `url`: the URL to reach the Elastic resource
+  # - `username`: the username of the user to be authenticated to the Elastic resource
+  # - `password`: the password of the user to be authenticated to the Elastic resource
+  # - `ca.crt`: the CA certificate in PEM format (optional)
+  # This field cannot be used in combination with the other fields name, namespace or serviceName.
+  #
+  # secretName: my-remote-es-credentials
 
 # Reference to an EnterpriseSearch running in the same Kubernetes cluster
 #
diff --git a/deploy/eck-stack/examples/logstash/basic-eck.yaml b/deploy/eck-stack/examples/logstash/basic-eck.yaml
index 38255b0af..8c2afa222 100644
--- a/deploy/eck-stack/examples/logstash/basic-eck.yaml
+++ b/deploy/eck-stack/examples/logstash/basic-eck.yaml
@@ -56,7 +56,8 @@ eck-beats:
   type: filebeat
   config:
     filebeat.inputs:
-    - type: log
+    - type: filestream
+      id: logstash-tutorial
       paths:
         - /data/logstash-tutorial.log
     processors:
diff --git a/docs/reference/api-reference/main.md b/docs/reference/api-reference/main.md
index 4fa23902f..6e9c95059 100644
--- a/docs/reference/api-reference/main.md
+++ b/docs/reference/api-reference/main.md
@@ -92,7 +92,7 @@ AgentSpec defines the desired state of the Agent
 | *`fleetServerEnabled`* __boolean__ | FleetServerEnabled determines whether this Agent will launch Fleet Server. Don't set unless `mode` is set to `fleet`. |
 | *`policyID`* __string__ | PolicyID determines into which Agent Policy this Agent will be enrolled.<br>This field will become mandatory in a future release, default policies are deprecated since 8.1.0. |
 | *`kibanaRef`* __[ObjectSelector](#objectselector)__ | KibanaRef is a reference to Kibana where Fleet should be set up and this Agent should be enrolled. Don't set<br>unless `mode` is set to `fleet`. |
-| *`fleetServerRef`* __[ObjectSelector](#objectselector)__ | FleetServerRef is a reference to Fleet Server that this Agent should connect to to obtain it's configuration.<br>Don't set unless `mode` is set to `fleet`. |
+| *`fleetServerRef`* __[ObjectSelector](#objectselector)__ | FleetServerRef is a reference to Fleet Server that this Agent should connect to to obtain it's configuration.<br>Don't set unless `mode` is set to `fleet`.<br>References to Fleet servers running outside the Kubernetes cluster via the `secretName` attribute are not supported. |
 
 
 ### DaemonSetSpec  [#daemonsetspec]
@@ -588,7 +588,7 @@ or a Secret describing an external Elastic resource not managed by the operator.
 | *`namespace`* __string__ | Namespace of the Kubernetes object. If empty, defaults to the current namespace. |
 | *`name`* __string__ | Name of an existing Kubernetes object corresponding to an Elastic resource managed by ECK. |
 | *`serviceName`* __string__ | ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced<br>object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of<br>the referenced resource is used. |
-| *`secretName`* __string__ | SecretName is the name of an existing Kubernetes secret that contains connection information for associating an<br>Elastic resource not managed by the operator. The referenced secret must contain the following:<br>- `url`: the URL to reach the Elastic resource<br>- `username`: the username of the user to be authenticated to the Elastic resource<br>- `password`: the password of the user to be authenticated to the Elastic resource<br>- `ca.crt`: the CA certificate in PEM format (optional)<br>- `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec)<br>This field cannot be used in combination with the other fields name, namespace or serviceName. |
+| *`secretName`* __string__ | SecretName is the name of an existing Kubernetes secret that contains connection information for associating an<br>Elastic resource not managed by the operator.<br>The referenced secret must contain the following:<br>- `url`: the URL to reach the Elastic resource<br>- `username`: the username of the user to be authenticated to the Elastic resource<br>- `password`: the password of the user to be authenticated to the Elastic resource<br>- `ca.crt`: the CA certificate in PEM format (optional)<br>- `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec)<br>This field cannot be used in combination with the other fields name, namespace or serviceName. |
 
 
 ### PodDisruptionBudgetTemplate  [#poddisruptionbudgettemplate]
@@ -1093,7 +1093,7 @@ ElasticsearchSpec holds the specification of an Elasticsearch cluster.
 | *`transport`* __[TransportConfig](#transportconfig)__ | Transport holds transport layer settings for Elasticsearch. |
 | *`nodeSets`* __[NodeSet](#nodeset) array__ | NodeSets allow specifying groups of Elasticsearch nodes sharing the same configuration and Pod templates. |
 | *`updateStrategy`* __[UpdateStrategy](#updatestrategy)__ | UpdateStrategy specifies how updates to the cluster should be performed. |
-| *`podDisruptionBudget`* __[PodDisruptionBudgetTemplate](#poddisruptionbudgettemplate)__ | PodDisruptionBudget provides access to the default Pod disruption budget for the Elasticsearch cluster.<br>The default budget doesn't allow any Pod to be removed in case the cluster is not green or if there is only one node of type `data` or `master`.<br>In all other cases the default PodDisruptionBudget sets `minUnavailable` equal to the total number of nodes minus 1.<br>To disable, set `PodDisruptionBudget` to the empty value (`{}` in YAML). |
+| *`podDisruptionBudget`* __[PodDisruptionBudgetTemplate](#poddisruptionbudgettemplate)__ | PodDisruptionBudget provides access to the default Pod disruption budget(s) for the Elasticsearch cluster.<br>The behavior depends on the license level.<br>With a Basic license or if podDisruptionBudget.spec is not empty:<br>  The default budget doesn't allow any Pod to be removed in case the cluster is not green or if there is only one node of type `data` or `master`.<br>  In all other cases the default podDisruptionBudget sets `minUnavailable` equal to the total number of nodes minus 1.<br>With an Enterprise license and if podDisruptionBudget.spec is empty:<br>  The default budget is split into multiple budgets, each targeting a specific node role type allowing additional disruptions<br>  for certain roles according to the health status of the cluster.<br>    Example:<br>      All data roles (excluding frozen): allows disruptions only when the cluster is green.<br>      All other roles: allows disruptions only when the cluster is yellow or green.<br>To disable, set `podDisruptionBudget` to the empty value (`{}` in YAML). |
 | *`auth`* __[Auth](#auth)__ | Auth contains user authentication and authorization security settings for Elasticsearch. |
 | *`secureSettings`* __[SecretSource](#secretsource) array__ | SecureSettings is a list of references to Kubernetes secrets containing sensitive configuration options for Elasticsearch. |
 | *`serviceAccountName`* __string__ | ServiceAccountName is used to check access from the current resource to a resource (for ex. a remote Elasticsearch cluster) in a different namespace.<br>Can only be used if ECK is enforcing RBAC on references. |
diff --git a/docs/reference/third-party-dependencies/main.md b/docs/reference/third-party-dependencies/main.md
index ff975edef..9ecb0bf49 100644
--- a/docs/reference/third-party-dependencies/main.md
+++ b/docs/reference/third-party-dependencies/main.md
@@ -17,12 +17,13 @@ This page lists the third-party dependencies used to build {{eck}} from the main
 | Name | Version | Licence |
 | --- | --- | --- |
 | [dario.cat/mergo](https://dario.cat/mergo) | v1.0.2 | BSD-3-Clause |
+| [github.com/KimMachineGun/automemlimit](https://github.com/KimMachineGun/automemlimit) | v0.7.4 | MIT |
 | [github.com/Masterminds/sprig/v3](https://github.com/Masterminds/sprig) | v3.3.0 | MIT |
 | [github.com/blang/semver/v4](https://github.com/blang/semver) | v4.0.0 | MIT |
 | [github.com/davecgh/go-spew](https://github.com/davecgh/go-spew) | v1.1.2-0.20180830191138-d8f796af33cc | ISC |
 | [github.com/elastic/go-ucfg](https://github.com/elastic/go-ucfg) | v0.8.9-0.20250307075119-2a22403faaea | Apache-2.0 |
 | [github.com/ghodss/yaml](https://github.com/ghodss/yaml) | v1.0.0 | MIT |
-| [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps) | v0.5.13 | MIT |
+| [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps) | v0.5.14 | MIT |
 | [github.com/go-logr/logr](https://github.com/go-logr/logr) | v1.4.3 | Apache-2.0 |
 | [github.com/go-test/deep](https://github.com/go-test/deep) | v1.1.1 | MIT |
 | [github.com/gobuffalo/flect](https://github.com/gobuffalo/flect) | v1.0.3 | MIT |
@@ -31,40 +32,40 @@ This page lists the third-party dependencies used to build {{eck}} from the main
 | [github.com/google/uuid](https://github.com/google/uuid) | v1.6.0 | BSD-3-Clause |
 | [github.com/hashicorp/go-multierror](https://github.com/hashicorp/go-multierror) | v1.1.1 | MPL-2.0 |
 | [github.com/hashicorp/golang-lru/v2](https://github.com/hashicorp/golang-lru) | v2.0.7 | MPL-2.0 |
-| [github.com/hashicorp/vault/api](https://github.com/hashicorp/vault) | v1.20.0 | MPL-2.0 |
+| [github.com/hashicorp/vault/api](https://github.com/hashicorp/vault) | v1.21.0 | MPL-2.0 |
 | [github.com/magiconair/properties](https://github.com/magiconair/properties) | v1.8.10 | BSD-2-Clause |
 | [github.com/pkg/errors](https://github.com/pkg/errors) | v0.9.1 | BSD-2-Clause |
 | [github.com/pmezard/go-difflib](https://github.com/pmezard/go-difflib) | v1.0.1-0.20181226105442-5d4384ee4fb2 | BSD-3-Clause |
-| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | v1.22.0 | Apache-2.0 |
-| [github.com/prometheus/common](https://github.com/prometheus/common) | v0.65.0 | Apache-2.0 |
+| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | v1.23.2 | Apache-2.0 |
+| [github.com/prometheus/common](https://github.com/prometheus/common) | v0.66.1 | Apache-2.0 |
 | [github.com/sethvargo/go-password](https://github.com/sethvargo/go-password) | v0.3.1 | MIT |
-| [github.com/spf13/cobra](https://github.com/spf13/cobra) | v1.9.1 | Apache-2.0 |
-| [github.com/spf13/pflag](https://github.com/spf13/pflag) | v1.0.7 | BSD-3-Clause |
-| [github.com/spf13/viper](https://github.com/spf13/viper) | v1.20.1 | MIT |
-| [github.com/stretchr/testify](https://github.com/stretchr/testify) | v1.10.0 | MIT |
+| [github.com/spf13/cobra](https://github.com/spf13/cobra) | v1.10.1 | Apache-2.0 |
+| [github.com/spf13/pflag](https://github.com/spf13/pflag) | v1.0.10 | BSD-3-Clause |
+| [github.com/spf13/viper](https://github.com/spf13/viper) | v1.21.0 | MIT |
+| [github.com/stretchr/testify](https://github.com/stretchr/testify) | v1.11.1 | MIT |
 | [go.elastic.co/apm/module/apmelasticsearch/v2](https://go.elastic.co/apm/module/apmelasticsearch/v2) | v2.7.1 | Apache-2.0 |
 | [go.elastic.co/apm/module/apmhttp/v2](https://go.elastic.co/apm/module/apmhttp/v2) | v2.7.1 | Apache-2.0 |
 | [go.elastic.co/apm/module/apmzap/v2](https://go.elastic.co/apm/module/apmzap/v2) | v2.7.1 | Apache-2.0 |
 | [go.elastic.co/apm/v2](https://go.elastic.co/apm/v2) | v2.7.1 | Apache-2.0 |
 | [go.uber.org/automaxprocs](https://go.uber.org/automaxprocs) | v1.6.0 | MIT |
 | [go.uber.org/zap](https://go.uber.org/zap) | v1.27.0 | MIT |
-| [golang.org/x/crypto](https://golang.org/x/crypto) | v0.40.0 | BSD-3-Clause |
+| [golang.org/x/crypto](https://golang.org/x/crypto) | v0.42.0 | BSD-3-Clause |
 | [golang.org/x/exp](https://golang.org/x/exp) | v0.0.0-20240808152545-0cdaa3abc0fa | BSD-3-Clause |
 | [gopkg.in/yaml.v3](https://gopkg.in/yaml.v3) | v3.0.1 | MIT |
-| [k8s.io/api](https://github.com/kubernetes/api) | v0.33.3 | Apache-2.0 |
-| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | v0.33.3 | Apache-2.0 |
-| [k8s.io/client-go](https://github.com/kubernetes/client-go) | v0.33.3 | Apache-2.0 |
+| [k8s.io/api](https://github.com/kubernetes/api) | v0.34.1 | Apache-2.0 |
+| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | v0.34.1 | Apache-2.0 |
+| [k8s.io/client-go](https://github.com/kubernetes/client-go) | v0.34.1 | Apache-2.0 |
 | [k8s.io/klog/v2](https://github.com/kubernetes/klog) | v2.130.1 | Apache-2.0 |
-| [k8s.io/utils](https://github.com/kubernetes/utils) | v0.0.0-20241104100929-3ea5e8cea738 | Apache-2.0 |
-| [sigs.k8s.io/controller-runtime](https://sigs.k8s.io/controller-runtime) | v0.21.0 | Apache-2.0 |
-| [sigs.k8s.io/controller-tools](https://sigs.k8s.io/controller-tools) | v0.18.0 | Apache-2.0 |
+| [k8s.io/utils](https://github.com/kubernetes/utils) | v0.0.0-20250604170112-4c0f3b243397 | Apache-2.0 |
+| [sigs.k8s.io/controller-runtime](https://sigs.k8s.io/controller-runtime) | v0.22.1 | Apache-2.0 |
+| [sigs.k8s.io/controller-tools](https://sigs.k8s.io/controller-tools) | v0.19.0 | Apache-2.0 |
 
 
 ##  Indirect dependencies [k8s-dependencies-indirect]
 
 | Name | Version | Licence |
 | --- | --- | --- |
-| [cel.dev/expr](https://cel.dev/expr) | v0.19.1 | Apache-2.0 |
+| [cel.dev/expr](https://cel.dev/expr) | v0.24.0 | Apache-2.0 |
 | [github.com/Masterminds/goutils](https://github.com/Masterminds/goutils) | v1.1.1 | Apache-2.0 |
 | [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver) | v3.3.0 | MIT |
 | [github.com/antlr4-go/antlr/v4](https://github.com/antlr4-go/antlr) | v4.13.0 | BSD-3-Clause |
@@ -79,42 +80,42 @@ This page lists the third-party dependencies used to build {{eck}} from the main
 | [github.com/docker/docker-credential-helpers](https://github.com/docker/docker-credential-helpers) | v0.9.3 | MIT |
 | [github.com/elastic/go-sysinfo](https://github.com/elastic/go-sysinfo) | v1.15.2 | Apache-2.0 |
 | [github.com/elastic/go-windows](https://github.com/elastic/go-windows) | v1.0.2 | Apache-2.0 |
-| [github.com/emicklei/go-restful/v3](https://github.com/emicklei/go-restful) | v3.12.1 | MIT |
+| [github.com/emicklei/go-restful/v3](https://github.com/emicklei/go-restful) | v3.12.2 | MIT |
 | [github.com/evanphx/json-patch](https://github.com/evanphx/json-patch) | v5.6.0+incompatible | BSD-3-Clause |
 | [github.com/evanphx/json-patch/v5](https://github.com/evanphx/json-patch) | v5.9.11 | BSD-3-Clause |
 | [github.com/fatih/color](https://github.com/fatih/color) | v1.18.0 | MIT |
 | [github.com/felixge/httpsnoop](https://github.com/felixge/httpsnoop) | v1.0.4 | MIT |
 | [github.com/frankban/quicktest](https://github.com/frankban/quicktest) | v1.14.6 | MIT |
-| [github.com/fsnotify/fsnotify](https://github.com/fsnotify/fsnotify) | v1.8.0 | BSD-3-Clause |
-| [github.com/fxamacker/cbor/v2](https://github.com/fxamacker/cbor) | v2.7.0 | MIT |
+| [github.com/fsnotify/fsnotify](https://github.com/fsnotify/fsnotify) | v1.9.0 | BSD-3-Clause |
+| [github.com/fxamacker/cbor/v2](https://github.com/fxamacker/cbor) | v2.9.0 | MIT |
 | [github.com/gkampitakis/ciinfo](https://github.com/gkampitakis/ciinfo) | v0.3.2 | MIT |
 | [github.com/gkampitakis/go-diff](https://github.com/gkampitakis/go-diff) | v1.3.2 | MIT |
-| [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | v4.0.5 | Apache-2.0 |
+| [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | v4.1.1 | Apache-2.0 |
 | [github.com/go-logr/stdr](https://github.com/go-logr/stdr) | v1.2.2 | Apache-2.0 |
 | [github.com/go-logr/zapr](https://github.com/go-logr/zapr) | v1.3.0 | Apache-2.0 |
 | [github.com/go-openapi/jsonpointer](https://github.com/go-openapi/jsonpointer) | v0.21.0 | Apache-2.0 |
 | [github.com/go-openapi/jsonreference](https://github.com/go-openapi/jsonreference) | v0.21.0 | Apache-2.0 |
 | [github.com/go-openapi/swag](https://github.com/go-openapi/swag) | v0.23.0 | Apache-2.0 |
 | [github.com/go-task/slim-sprig/v3](https://github.com/go-task/slim-sprig) | v3.0.0 | MIT |
-| [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure) | v2.3.0 | MIT |
+| [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure) | v2.4.0 | MIT |
 | [github.com/goccy/go-yaml](https://github.com/goccy/go-yaml) | v1.18.0 | MIT |
 | [github.com/gogo/protobuf](https://github.com/gogo/protobuf) | v1.3.2 | BSD-3-Clause |
 | [github.com/golang/protobuf](https://github.com/golang/protobuf) | v1.5.4 | BSD-3-Clause |
 | [github.com/google/btree](https://github.com/google/btree) | v1.1.3 | Apache-2.0 |
-| [github.com/google/cel-go](https://github.com/google/cel-go) | v0.23.2 | Apache-2.0 |
-| [github.com/google/gnostic-models](https://github.com/google/gnostic-models) | v0.6.9 | Apache-2.0 |
+| [github.com/google/cel-go](https://github.com/google/cel-go) | v0.26.0 | Apache-2.0 |
+| [github.com/google/gnostic-models](https://github.com/google/gnostic-models) | v0.7.0 | Apache-2.0 |
 | [github.com/google/gofuzz](https://github.com/google/gofuzz) | v1.2.0 | Apache-2.0 |
 | [github.com/google/pprof](https://github.com/google/pprof) | v0.0.0-20241029153458-d1b30febd7db | Apache-2.0 |
 | [github.com/gorilla/websocket](https://github.com/gorilla/websocket) | v1.5.4-0.20250319132907-e064f32e3674 | BSD-2-Clause |
-| [github.com/grpc-ecosystem/grpc-gateway/v2](https://github.com/grpc-ecosystem/grpc-gateway) | v2.24.0 | BSD-3-Clause |
+| [github.com/grpc-ecosystem/grpc-gateway/v2](https://github.com/grpc-ecosystem/grpc-gateway) | v2.26.3 | BSD-3-Clause |
 | [github.com/hashicorp/errwrap](https://github.com/hashicorp/errwrap) | v1.1.0 | MPL-2.0 |
 | [github.com/hashicorp/go-cleanhttp](https://github.com/hashicorp/go-cleanhttp) | v0.5.2 | MPL-2.0 |
 | [github.com/hashicorp/go-hclog](https://github.com/hashicorp/go-hclog) | v1.6.3 | MIT |
-| [github.com/hashicorp/go-retryablehttp](https://github.com/hashicorp/go-retryablehttp) | v0.7.7 | MPL-2.0 |
+| [github.com/hashicorp/go-retryablehttp](https://github.com/hashicorp/go-retryablehttp) | v0.7.8 | MPL-2.0 |
 | [github.com/hashicorp/go-rootcerts](https://github.com/hashicorp/go-rootcerts) | v1.0.2 | MPL-2.0 |
-| [github.com/hashicorp/go-secure-stdlib/parseutil](https://github.com/hashicorp/go-secure-stdlib) | v0.1.6 | MPL-2.0 |
+| [github.com/hashicorp/go-secure-stdlib/parseutil](https://github.com/hashicorp/go-secure-stdlib) | v0.2.0 | MPL-2.0 |
 | [github.com/hashicorp/go-secure-stdlib/strutil](https://github.com/hashicorp/go-secure-stdlib) | v0.1.2 | MPL-2.0 |
-| [github.com/hashicorp/go-sockaddr](https://github.com/hashicorp/go-sockaddr) | v1.0.2 | MPL-2.0 |
+| [github.com/hashicorp/go-sockaddr](https://github.com/hashicorp/go-sockaddr) | v1.0.7 | MPL-2.0 |
 | [github.com/hashicorp/hcl](https://github.com/hashicorp/hcl) | v1.0.1-vault-7 | MPL-2.0 |
 | [github.com/huandu/xstrings](https://github.com/huandu/xstrings) | v1.5.0 | MIT |
 | [github.com/inconshreveable/mousetrap](https://github.com/inconshreveable/mousetrap) | v1.1.0 | Apache-2.0 |
@@ -126,7 +127,7 @@ This page lists the third-party dependencies used to build {{eck}} from the main
 | [github.com/kylelemons/godebug](https://github.com/kylelemons/godebug) | v1.1.0 | Apache-2.0 |
 | [github.com/mailru/easyjson](https://github.com/mailru/easyjson) | v0.7.7 | MIT |
 | [github.com/maruel/natural](https://github.com/maruel/natural) | v1.1.1 | Apache-2.0 |
-| [github.com/mattn/go-colorable](https://github.com/mattn/go-colorable) | v0.1.13 | MIT |
+| [github.com/mattn/go-colorable](https://github.com/mattn/go-colorable) | v0.1.14 | MIT |
 | [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) | v0.0.20 | MIT |
 | [github.com/mitchellh/copystructure](https://github.com/mitchellh/copystructure) | v1.2.0 | MIT |
 | [github.com/mitchellh/go-homedir](https://github.com/mitchellh/go-homedir) | v1.1.0 | MIT |
@@ -134,27 +135,28 @@ This page lists the third-party dependencies used to build {{eck}} from the main
 | [github.com/mitchellh/reflectwalk](https://github.com/mitchellh/reflectwalk) | v1.0.2 | MIT |
 | [github.com/moby/spdystream](https://github.com/moby/spdystream) | v0.5.0 | Apache-2.0 |
 | [github.com/modern-go/concurrent](https://github.com/modern-go/concurrent) | v0.0.0-20180306012644-bacd9c7ef1dd | Apache-2.0 |
-| [github.com/modern-go/reflect2](https://github.com/modern-go/reflect2) | v1.0.2 | Apache-2.0 |
+| [github.com/modern-go/reflect2](https://github.com/modern-go/reflect2) | v1.0.3-0.20250322232337-35a7c28c31ee | Apache-2.0 |
 | [github.com/munnerz/goautoneg](https://github.com/munnerz/goautoneg) | v0.0.0-20191010083416-a7dc8b61c822 | BSD-3-Clause |
 | [github.com/mxk/go-flowrate](https://github.com/mxk/go-flowrate) | v0.0.0-20140419014527-cca7078d478f | BSD-3-Clause |
 | [github.com/nxadm/tail](https://github.com/nxadm/tail) | v1.4.8 | MIT |
 | [github.com/onsi/ginkgo](https://github.com/onsi/ginkgo) | v1.16.5 | MIT |
 | [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) | v2.22.0 | MIT |
-| [github.com/onsi/gomega](https://github.com/onsi/gomega) | v1.37.0 | MIT |
+| [github.com/onsi/gomega](https://github.com/onsi/gomega) | v1.38.1 | MIT |
 | [github.com/opencontainers/go-digest](https://github.com/opencontainers/go-digest) | v1.0.0 | Apache-2.0 |
 | [github.com/opencontainers/image-spec](https://github.com/opencontainers/image-spec) | v1.1.1 | Apache-2.0 |
-| [github.com/pelletier/go-toml/v2](https://github.com/pelletier/go-toml) | v2.2.3 | MIT |
+| [github.com/pbnjay/memory](https://github.com/pbnjay/memory) | v0.0.0-20210728143218-7b4eea64cf58 | BSD-3-Clause |
+| [github.com/pelletier/go-toml/v2](https://github.com/pelletier/go-toml) | v2.2.4 | MIT |
 | [github.com/prashantv/gostub](https://github.com/prashantv/gostub) | v1.1.0 | MIT |
 | [github.com/prometheus/client_model](https://github.com/prometheus/client_model) | v0.6.2 | Apache-2.0 |
-| [github.com/prometheus/procfs](https://github.com/prometheus/procfs) | v0.16.0 | Apache-2.0 |
+| [github.com/prometheus/procfs](https://github.com/prometheus/procfs) | v0.16.1 | Apache-2.0 |
 | [github.com/rogpeppe/go-internal](https://github.com/rogpeppe/go-internal) | v1.13.1 | BSD-3-Clause |
 | [github.com/ryanuber/go-glob](https://github.com/ryanuber/go-glob) | v1.0.0 | MIT |
-| [github.com/sagikazarmark/locafero](https://github.com/sagikazarmark/locafero) | v0.7.0 | MIT |
+| [github.com/sagikazarmark/locafero](https://github.com/sagikazarmark/locafero) | v0.11.0 | MIT |
 | [github.com/shopspring/decimal](https://github.com/shopspring/decimal) | v1.4.0 | MIT |
 | [github.com/sirupsen/logrus](https://github.com/sirupsen/logrus) | v1.9.3 | MIT |
-| [github.com/sourcegraph/conc](https://github.com/sourcegraph/conc) | v0.3.0 | MIT |
-| [github.com/spf13/afero](https://github.com/spf13/afero) | v1.12.0 | Apache-2.0 |
-| [github.com/spf13/cast](https://github.com/spf13/cast) | v1.7.1 | MIT |
+| [github.com/sourcegraph/conc](https://github.com/sourcegraph/conc) | v0.3.1-0.20240121214520-5f936abd7ae8 | MIT |
+| [github.com/spf13/afero](https://github.com/spf13/afero) | v1.15.0 | Apache-2.0 |
+| [github.com/spf13/cast](https://github.com/spf13/cast) | v1.10.0 | MIT |
 | [github.com/stoewer/go-strcase](https://github.com/stoewer/go-strcase) | v1.3.0 | MIT |
 | [github.com/stretchr/objx](https://github.com/stretchr/objx) | v0.5.2 | MIT |
 | [github.com/subosito/gotenv](https://github.com/subosito/gotenv) | v1.6.0 | MIT |
@@ -168,29 +170,33 @@ This page lists the third-party dependencies used to build {{eck}} from the main
 | [go.opentelemetry.io/auto/sdk](https://go.opentelemetry.io/auto/sdk) | v1.1.0 | Apache-2.0 |
 | [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp) | v0.61.0 | Apache-2.0 |
 | [go.opentelemetry.io/otel](https://go.opentelemetry.io/otel) | v1.36.0 | Apache-2.0 |
-| [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://go.opentelemetry.io/otel/exporters/otlp/otlptrace) | v1.33.0 | Apache-2.0 |
-| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc) | v1.33.0 | Apache-2.0 |
+| [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://go.opentelemetry.io/otel/exporters/otlp/otlptrace) | v1.34.0 | Apache-2.0 |
+| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc) | v1.34.0 | Apache-2.0 |
 | [go.opentelemetry.io/otel/metric](https://go.opentelemetry.io/otel/metric) | v1.36.0 | Apache-2.0 |
 | [go.opentelemetry.io/otel/sdk](https://go.opentelemetry.io/otel/sdk) | v1.36.0 | Apache-2.0 |
 | [go.opentelemetry.io/otel/sdk/metric](https://go.opentelemetry.io/otel/sdk/metric) | v1.36.0 | Apache-2.0 |
 | [go.opentelemetry.io/otel/trace](https://go.opentelemetry.io/otel/trace) | v1.36.0 | Apache-2.0 |
-| [go.opentelemetry.io/proto/otlp](https://go.opentelemetry.io/proto/otlp) | v1.4.0 | Apache-2.0 |
+| [go.opentelemetry.io/proto/otlp](https://go.opentelemetry.io/proto/otlp) | v1.5.0 | Apache-2.0 |
 | [go.uber.org/goleak](https://go.uber.org/goleak) | v1.3.0 | MIT |
 | [go.uber.org/multierr](https://go.uber.org/multierr) | v1.11.0 | MIT |
-| [golang.org/x/mod](https://golang.org/x/mod) | v0.25.0 | BSD-3-Clause |
-| [golang.org/x/net](https://golang.org/x/net) | v0.41.0 | BSD-3-Clause |
+| [go.yaml.in/yaml/v2](https://go.yaml.in/yaml/v2) | v2.4.2 | Apache-2.0 |
+| [go.yaml.in/yaml/v3](https://go.yaml.in/yaml/v3) | v3.0.4 | MIT |
+| [golang.org/x/mod](https://golang.org/x/mod) | v0.27.0 | BSD-3-Clause |
+| [golang.org/x/net](https://golang.org/x/net) | v0.43.0 | BSD-3-Clause |
 | [golang.org/x/oauth2](https://golang.org/x/oauth2) | v0.30.0 | BSD-3-Clause |
-| [golang.org/x/sync](https://golang.org/x/sync) | v0.16.0 | BSD-3-Clause |
-| [golang.org/x/sys](https://golang.org/x/sys) | v0.34.0 | BSD-3-Clause |
-| [golang.org/x/term](https://golang.org/x/term) | v0.33.0 | BSD-3-Clause |
-| [golang.org/x/text](https://golang.org/x/text) | v0.27.0 | BSD-3-Clause |
-| [golang.org/x/time](https://golang.org/x/time) | v0.9.0 | BSD-3-Clause |
-| [golang.org/x/tools](https://golang.org/x/tools) | v0.34.0 | BSD-3-Clause |
+| [golang.org/x/sync](https://golang.org/x/sync) | v0.17.0 | BSD-3-Clause |
+| [golang.org/x/sys](https://golang.org/x/sys) | v0.36.0 | BSD-3-Clause |
+| [golang.org/x/term](https://golang.org/x/term) | v0.35.0 | BSD-3-Clause |
+| [golang.org/x/text](https://golang.org/x/text) | v0.29.0 | BSD-3-Clause |
+| [golang.org/x/time](https://golang.org/x/time) | v0.12.0 | BSD-3-Clause |
+| [golang.org/x/tools](https://golang.org/x/tools) | v0.36.0 | BSD-3-Clause |
+| [golang.org/x/tools/go/expect](https://golang.org/x/tools/go/expect) | v0.1.0-deprecated | BSD-3-Clause |
+| [golang.org/x/tools/go/packages/packagestest](https://golang.org/x/tools/go/packages/packagestest) | v0.1.1-deprecated | BSD-3-Clause |
 | [gomodules.xyz/jsonpatch/v2](https://gomodules.xyz/jsonpatch/v2) | v2.4.0 | Apache-2.0 |
-| [google.golang.org/genproto/googleapis/api](https://google.golang.org/genproto/googleapis/api) | v0.0.0-20241209162323-e6fa225c2576 | Apache-2.0 |
-| [google.golang.org/genproto/googleapis/rpc](https://google.golang.org/genproto/googleapis/rpc) | v0.0.0-20241223144023-3abc09e42ca8 | Apache-2.0 |
-| [google.golang.org/grpc](https://google.golang.org/grpc) | v1.68.1 | Apache-2.0 |
-| [google.golang.org/protobuf](https://google.golang.org/protobuf) | v1.36.6 | BSD-3-Clause |
+| [google.golang.org/genproto/googleapis/api](https://google.golang.org/genproto/googleapis/api) | v0.0.0-20250303144028-a0af3efb3deb | Apache-2.0 |
+| [google.golang.org/genproto/googleapis/rpc](https://google.golang.org/genproto/googleapis/rpc) | v0.0.0-20250303144028-a0af3efb3deb | Apache-2.0 |
+| [google.golang.org/grpc](https://google.golang.org/grpc) | v1.72.1 | Apache-2.0 |
+| [google.golang.org/protobuf](https://google.golang.org/protobuf) | v1.36.8 | BSD-3-Clause |
 | [gopkg.in/check.v1](https://gopkg.in/check.v1) | v1.0.0-20201130134442-10cb98267c6c | BSD-2-Clause |
 | [gopkg.in/evanphx/json-patch.v4](https://gopkg.in/evanphx/json-patch.v4) | v4.12.0 | BSD-3-Clause |
 | [gopkg.in/inf.v0](https://gopkg.in/inf.v0) | v0.9.1 | BSD-3-Clause |
@@ -198,15 +204,15 @@ This page lists the third-party dependencies used to build {{eck}} from the main
 | [gopkg.in/yaml.v2](https://gopkg.in/yaml.v2) | v2.4.0 | Apache-2.0 |
 | [gotest.tools/v3](https://gotest.tools/v3) | v3.0.3 | Apache-2.0 |
 | [howett.net/plist](https://gitlab.howett.net/go/plist) | v1.0.1 | BSD-2-Clause |
-| [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) | v0.33.0 | Apache-2.0 |
-| [k8s.io/apiserver](https://github.com/kubernetes/apiserver) | v0.33.0 | Apache-2.0 |
-| [k8s.io/code-generator](https://github.com/kubernetes/code-generator) | v0.33.0 | Apache-2.0 |
-| [k8s.io/component-base](https://github.com/kubernetes/component-base) | v0.33.0 | Apache-2.0 |
-| [k8s.io/gengo/v2](https://github.com/kubernetes/gengo) | v2.0.0-20250207200755-1244d31929d7 | Apache-2.0 |
-| [k8s.io/kube-openapi](https://github.com/kubernetes/kube-openapi) | v0.0.0-20250318190949-c8a335a9a2ff | Apache-2.0 |
+| [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) | v0.34.0 | Apache-2.0 |
+| [k8s.io/apiserver](https://github.com/kubernetes/apiserver) | v0.34.0 | Apache-2.0 |
+| [k8s.io/code-generator](https://github.com/kubernetes/code-generator) | v0.34.0 | Apache-2.0 |
+| [k8s.io/component-base](https://github.com/kubernetes/component-base) | v0.34.0 | Apache-2.0 |
+| [k8s.io/gengo/v2](https://github.com/kubernetes/gengo) | v2.0.0-20250604051438-85fd79dbfd9f | Apache-2.0 |
+| [k8s.io/kube-openapi](https://github.com/kubernetes/kube-openapi) | v0.0.0-20250710124328-f3f2b991d03b | Apache-2.0 |
 | [sigs.k8s.io/apiserver-network-proxy/konnectivity-client](https://sigs.k8s.io/apiserver-network-proxy/konnectivity-client) | v0.31.2 | Apache-2.0 |
-| [sigs.k8s.io/json](https://sigs.k8s.io/json) | v0.0.0-20241010143419-9aa6b5e7a4b3 | Apache-2.0 |
+| [sigs.k8s.io/json](https://sigs.k8s.io/json) | v0.0.0-20241014173422-cfa47c3a1cc8 | Apache-2.0 |
 | [sigs.k8s.io/randfill](https://sigs.k8s.io/randfill) | v1.0.0 | Apache-2.0 |
-| [sigs.k8s.io/structured-merge-diff/v4](https://sigs.k8s.io/structured-merge-diff/v4) | v4.6.0 | Apache-2.0 |
-| [sigs.k8s.io/yaml](https://sigs.k8s.io/yaml) | v1.4.0 | Apache-2.0 |
+| [sigs.k8s.io/structured-merge-diff/v6](https://sigs.k8s.io/structured-merge-diff/v6) | v6.3.0 | Apache-2.0 |
+| [sigs.k8s.io/yaml](https://sigs.k8s.io/yaml) | v1.6.0 | Apache-2.0 |
 
diff --git a/docs/release-notes/index.md b/docs/release-notes/index.md
index 05bcd9442..975f1220e 100644
--- a/docs/release-notes/index.md
+++ b/docs/release-notes/index.md
@@ -34,6 +34,7 @@ To reduce the attack surface and improve overall security UBI images are now bas
 - Add automated workaround for 9.0.0 maps issue [#8665](https://github.com/elastic/cloud-on-k8s/pull/8665) (issue: [#8655](https://github.com/elastic/cloud-on-k8s/issues/8655))
 - Bump go.mod to v3 [#8609](https://github.com/elastic/cloud-on-k8s/pull/8609)
 - Helm: Add support for missing `remoteClusterServer` value [#8612](https://github.com/elastic/cloud-on-k8s/pull/8612)
+- Add logs volume for Filebeat and Metricbeat in stack monitoring [#8606](https://github.com/elastic/cloud-on-k8s/pull/8606) (issue: [#8605](https://github.com/elastic/cloud-on-k8s/issues/8605))
 
 ### Documentation improvements [elastic-cloud-kubernetes-310-documentation-improvements]
 
diff --git a/go.mod b/go.mod
index 84c34cce0..8dec8abf5 100644
--- a/go.mod
+++ b/go.mod
@@ -4,12 +4,13 @@ go 1.24.5
 
 require (
 	dario.cat/mergo v1.0.2
+	github.com/KimMachineGun/automemlimit v0.7.4
 	github.com/Masterminds/sprig/v3 v3.3.0
 	github.com/blang/semver/v4 v4.0.0
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
 	github.com/elastic/go-ucfg v0.8.9-0.20250307075119-2a22403faaea
 	github.com/ghodss/yaml v1.0.0
-	github.com/gkampitakis/go-snaps v0.5.13
+	github.com/gkampitakis/go-snaps v0.5.14
 	github.com/go-logr/logr v1.4.3
 	github.com/go-test/deep v1.1.1
 	github.com/gobuffalo/flect v1.0.3
@@ -18,37 +19,37 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hashicorp/golang-lru/v2 v2.0.7
-	github.com/hashicorp/vault/api v1.20.0
+	github.com/hashicorp/vault/api v1.21.0
 	github.com/magiconair/properties v1.8.10
 	github.com/pkg/errors v0.9.1
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
-	github.com/prometheus/client_golang v1.22.0
-	github.com/prometheus/common v0.65.0
+	github.com/prometheus/client_golang v1.23.2
+	github.com/prometheus/common v0.66.1
 	github.com/sethvargo/go-password v0.3.1
-	github.com/spf13/cobra v1.9.1
-	github.com/spf13/pflag v1.0.7
-	github.com/spf13/viper v1.20.1
-	github.com/stretchr/testify v1.10.0
+	github.com/spf13/cobra v1.10.1
+	github.com/spf13/pflag v1.0.10
+	github.com/spf13/viper v1.21.0
+	github.com/stretchr/testify v1.11.1
 	go.elastic.co/apm/module/apmelasticsearch/v2 v2.7.1
 	go.elastic.co/apm/module/apmhttp/v2 v2.7.1
 	go.elastic.co/apm/module/apmzap/v2 v2.7.1
 	go.elastic.co/apm/v2 v2.7.1
 	go.uber.org/automaxprocs v1.6.0
 	go.uber.org/zap v1.27.0
-	golang.org/x/crypto v0.40.0
+	golang.org/x/crypto v0.42.0
 	golang.org/x/exp v0.0.0-20240808152545-0cdaa3abc0fa
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/api v0.33.3
-	k8s.io/apimachinery v0.33.3
-	k8s.io/client-go v0.33.3
+	k8s.io/api v0.34.1
+	k8s.io/apimachinery v0.34.1
+	k8s.io/client-go v0.34.1
 	k8s.io/klog/v2 v2.130.1
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
-	sigs.k8s.io/controller-runtime v0.21.0
-	sigs.k8s.io/controller-tools v0.18.0
+	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397
+	sigs.k8s.io/controller-runtime v0.22.1
+	sigs.k8s.io/controller-tools v0.19.0
 )
 
 require (
-	cel.dev/expr v0.19.1 // indirect
+	cel.dev/expr v0.24.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.3.0 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
@@ -62,36 +63,36 @@ require (
 	github.com/docker/docker-credential-helpers v0.9.3 // indirect
 	github.com/elastic/go-sysinfo v1.15.2 // indirect
 	github.com/elastic/go-windows v1.0.2 // indirect
-	github.com/emicklei/go-restful/v3 v3.12.1 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/evanphx/json-patch v5.6.0+incompatible // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fsnotify/fsnotify v1.8.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/gkampitakis/ciinfo v0.3.2 // indirect
 	github.com/gkampitakis/go-diff v1.3.2 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.1 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.3.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/goccy/go-yaml v1.18.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/google/btree v1.1.3 // indirect
-	github.com/google/cel-go v0.23.2 // indirect
-	github.com/google/gnostic-models v0.6.9 // indirect
+	github.com/google/cel-go v0.26.0 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
-	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 // indirect
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
-	github.com/hashicorp/go-sockaddr v1.0.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
 	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
@@ -102,7 +103,7 @@ require (
 	github.com/kr/text v0.2.0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/maruel/natural v1.1.1 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
@@ -110,22 +111,23 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/spdystream v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
+	github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/procfs v0.16.0 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/rogpeppe/go-internal v1.13.1 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
-	github.com/sagikazarmark/locafero v0.7.0 // indirect
+	github.com/sagikazarmark/locafero v0.11.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/sourcegraph/conc v0.3.0 // indirect
-	github.com/spf13/afero v1.12.0 // indirect
-	github.com/spf13/cast v1.7.1 // indirect
+	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
+	github.com/spf13/cast v1.10.0 // indirect
 	github.com/stoewer/go-strcase v1.3.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/tidwall/gjson v1.18.0 // indirect
@@ -138,42 +140,44 @@ require (
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
 	go.opentelemetry.io/otel v1.36.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 // indirect
 	go.opentelemetry.io/otel/metric v1.36.0 // indirect
 	go.opentelemetry.io/otel/sdk v1.36.0 // indirect
 	go.opentelemetry.io/otel/trace v1.36.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.4.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/mod v0.25.0 // indirect
-	golang.org/x/net v0.41.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/mod v0.27.0 // indirect
+	golang.org/x/net v0.43.0 // indirect
 	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/sync v0.16.0 // indirect
-	golang.org/x/sys v0.34.0 // indirect
-	golang.org/x/term v0.33.0 // indirect
-	golang.org/x/text v0.27.0 // indirect
-	golang.org/x/time v0.9.0 // indirect
-	golang.org/x/tools v0.34.0 // indirect
+	golang.org/x/sync v0.17.0 // indirect
+	golang.org/x/sys v0.36.0 // indirect
+	golang.org/x/term v0.35.0 // indirect
+	golang.org/x/text v0.29.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
+	golang.org/x/tools v0.36.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241223144023-3abc09e42ca8 // indirect
-	google.golang.org/grpc v1.68.1 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb // indirect
+	google.golang.org/grpc v1.72.1 // indirect
+	google.golang.org/protobuf v1.36.8 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	howett.net/plist v1.0.1 // indirect
-	k8s.io/apiextensions-apiserver v0.33.0 // indirect
-	k8s.io/apiserver v0.33.0 // indirect
-	k8s.io/code-generator v0.33.0 // indirect
-	k8s.io/component-base v0.33.0 // indirect
-	k8s.io/gengo/v2 v2.0.0-20250207200755-1244d31929d7 // indirect
-	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
+	k8s.io/apiextensions-apiserver v0.34.0 // indirect
+	k8s.io/apiserver v0.34.0 // indirect
+	k8s.io/code-generator v0.34.0 // indirect
+	k8s.io/component-base v0.34.0 // indirect
+	k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f // indirect
+	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
-	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )
 
 // both of these dependencies are used by vegeta, but the version they use is older and did not include a licence. we require the licence and so pin both of these
diff --git a/go.sum b/go.sum
index 727ac48c2..d994cc2c1 100644
--- a/go.sum
+++ b/go.sum
@@ -1,7 +1,9 @@
-cel.dev/expr v0.19.1 h1:NciYrtDRIR0lNCnH1LFJegdjspNx9fI59O7TWcua/W4=
-cel.dev/expr v0.19.1/go.mod h1:MrpN08Q+lEBs+bGYdLxxHkZoUSsCp0nSKTs0nTymJgw=
+cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
+cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
+github.com/KimMachineGun/automemlimit v0.7.4 h1:UY7QYOIfrr3wjjOAqahFmC3IaQCLWvur9nmfIn6LnWk=
+github.com/KimMachineGun/automemlimit v0.7.4/go.mod h1:QZxpHaGOQoYvFhv/r4u3U0JTC2ZcOwbSr11UZF46UBM=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver/v3 v3.3.0 h1:B8LGeaivUe71a5qox1ICM/JLl0NqZSW5CHyL+hmvYS0=
@@ -10,14 +12,12 @@ github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe
 github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
 github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
 github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g=
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
@@ -44,33 +44,32 @@ github.com/elastic/go-ucfg v0.8.9-0.20250307075119-2a22403faaea h1:SX+ZnuBacMQVu
 github.com/elastic/go-ucfg v0.8.9-0.20250307075119-2a22403faaea/go.mod h1:4E8mPOLSUV9hQ7sgLEJ4bvt0KhMuDJa8joDT2QGAEKA=
 github.com/elastic/go-windows v1.0.2 h1:yoLLsAsV5cfg9FLhZ9EXZ2n2sQFKeDYrHenkcivY4vI=
 github.com/elastic/go-windows v1.0.2/go.mod h1:bGcDpBzXgYSqM0Gx3DM4+UxFj300SZLixie9u9ixLM8=
-github.com/emicklei/go-restful/v3 v3.12.1 h1:PJMDIM/ak7btuL8Ex0iYET9hxM3CI2sjZtzpL63nKAU=
-github.com/emicklei/go-restful/v3 v3.12.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
+github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/evanphx/json-patch v5.6.0+incompatible h1:jBYDEEiFBPxA0v50tFdvOzQQTCvpL6mnFh5mB2/l16U=
 github.com/evanphx/json-patch v5.6.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
 github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
-github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
-github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/gkampitakis/ciinfo v0.3.2 h1:JcuOPk8ZU7nZQjdUhctuhQofk7BGHuIy0c9Ez8BNhXs=
 github.com/gkampitakis/ciinfo v0.3.2/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo=
 github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZdC4M=
 github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6OPYerdAAS9tk=
-github.com/gkampitakis/go-snaps v0.5.13 h1:Hhjmvv1WboSCxkR9iU2mj5PQ8tsz/y8ECGrIbjjPF8Q=
-github.com/gkampitakis/go-snaps v0.5.13/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc=
-github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
-github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
+github.com/gkampitakis/go-snaps v0.5.14 h1:3fAqdB6BCPKHDMHAKRwtPUwYexKtGrNuw8HX/T/4neo=
+github.com/gkampitakis/go-snaps v0.5.14/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc=
+github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
+github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -88,8 +87,8 @@ github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1v
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/go-viper/mapstructure/v2 v2.3.0 h1:27XbWsHIqhbdR5TIC911OfYvgSaW93HM+dX7970Q7jk=
-github.com/go-viper/mapstructure/v2 v2.3.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/gobuffalo/flect v1.0.3 h1:xeWBM2nui+qnVvNM4S3foBhCAL2XgPU+a7FdpelbTq4=
 github.com/gobuffalo/flect v1.0.3/go.mod h1:A5msMlrHtLqh9umBSnvabjsMrCcCpAyzglnDvkbYKHs=
 github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
@@ -100,11 +99,10 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
-github.com/google/cel-go v0.23.2 h1:UdEe3CvQh3Nv+E/j9r1Y//WO0K0cSyD7/y0bzyLIMI4=
-github.com/google/cel-go v0.23.2/go.mod h1:52Pb6QsDbC5kvgxvZhiL9QX1oZEkcUF/ZqaPx1J5Wwo=
-github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
-github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/cel-go v0.26.0 h1:DPGjXackMpJWH680oGY4lZhYjIameYmR+/6RBdDGmaI=
+github.com/google/cel-go v0.26.0/go.mod h1:A9O8OU9rdvrK5MQyrqfIxo1a0u4g3sF8KB6PUIaryMM=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-containerregistry v0.20.6 h1:cvWX87UxxLgaH76b4hIvya6Dzz9qHB31qAwjAohdSTU=
@@ -118,8 +116,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 h1:TmHmbvxPmaegwhDubVz0lICL0J5Ka2vwTzhoePEXsGE=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0/go.mod h1:qztMSjm835F2bXf+5HKAPIS5qsmQDqZna/PgVt4rWtI=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -127,26 +125,24 @@ github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9n
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
 github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
-github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 h1:om4Al8Oy7kCm/B86rLCLah4Dt5Aa0Fr5rYBG60OzwHQ=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 h1:U+kC2dOhMFQctRfhK0gRctKAPTloZdMU5ZJxaesJ/VM=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
-github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
-github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
+github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
+github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
 github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
-github.com/hashicorp/vault/api v1.20.0 h1:KQMHElgudOsr+IbJgmbjHnCTxEpKs9LnozA1D3nozU4=
-github.com/hashicorp/vault/api v1.20.0/go.mod h1:GZ4pcjfzoOWpkJ3ijHNpEoAxKEsBJnVljyTe3jM2Sms=
+github.com/hashicorp/vault/api v1.21.0 h1:Xej4LJETV/spWRdjreb2vzQhEZt4+B5yxHAObfQVDOs=
+github.com/hashicorp/vault/api v1.21.0/go.mod h1:IUZA2cDvr4Ok3+NtK2Oq/r+lJeXkeCrHRmqdyWfpmGM=
 github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
 github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
@@ -174,20 +170,14 @@ github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/maruel/natural v1.1.1 h1:Hja7XhhmvEFhcByqDoHz9QZbkWey+COd9xWfCfn1ioo=
 github.com/maruel/natural v1.1.1/go.mod h1:v+Rfd79xlw1AgVBjbO0BEQmptqb5HvL/k9GRHB7ZKEg=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
-github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
@@ -197,8 +187,9 @@ github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVO
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
@@ -210,59 +201,59 @@ github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
 github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
 github.com/onsi/ginkgo/v2 v2.22.0 h1:Yed107/8DjTr0lKCNt7Dn8yQ6ybuDRQoMGrNFKzMfHg=
 github.com/onsi/ginkgo/v2 v2.22.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
-github.com/onsi/gomega v1.37.0 h1:CdEG8g0S133B4OswTDC/5XPSzE1OeP29QOioj2PID2Y=
-github.com/onsi/gomega v1.37.0/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
+github.com/onsi/gomega v1.38.1 h1:FaLA8GlcpXDwsb7m0h2A9ew2aTk3vnZMlzFgg5tz/pk=
+github.com/onsi/gomega v1.38.1/go.mod h1:LfcV8wZLvwcYRwPiJysphKAEsmcFnLMK/9c+PjvlX8g=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
-github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
-github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
+github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58 h1:onHthvaw9LFnH4t2DcNVpwGmV9E1BkGknEliJkfwQj0=
+github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58/go.mod h1:DXv8WO4yhMYhSNPKjeNKa5WY9YCIEBRbNzFFPJbWO6Y=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
 github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
 github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
-github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
-github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
-github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
-github.com/prometheus/procfs v0.16.0 h1:xh6oHhKwnOJKMYiYBDWmkHqQPyiY40sny36Cmx2bbsM=
-github.com/prometheus/procfs v0.16.0/go.mod h1:8veyXUu3nGP7oaCxhX6yeaM5u4stL2FeMXnCqhDthZg=
+github.com/prometheus/common v0.66.1 h1:h5E0h5/Y8niHc5DlaLlWLArTQI7tMrsfQjHV+d9ZoGs=
+github.com/prometheus/common v0.66.1/go.mod h1:gcaUsgf3KfRSwHY4dIMXLPV0K/Wg1oZ8+SbZk/HH/dA=
+github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
+github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
 github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
-github.com/sagikazarmark/locafero v0.7.0 h1:5MqpDsTGNDhY8sGp0Aowyf0qKsPrhewaLSsFaodPcyo=
-github.com/sagikazarmark/locafero v0.7.0/go.mod h1:2za3Cg5rMaTMoG/2Ulr9AwtFaIppKXTRYnozin4aB5k=
+github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
+github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
 github.com/sethvargo/go-password v0.3.1 h1:WqrLTjo7X6AcVYfC6R7GtSyuUQR9hGyAj/f1PYQZCJU=
 github.com/sethvargo/go-password v0.3.1/go.mod h1:rXofC1zT54N7R8K/h1WDUdkf9BOx5OptoxrMBcrXzvs=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
-github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
-github.com/spf13/afero v1.12.0 h1:UcOPyRBYczmFn6yvphxkn9ZEOY65cpwGKb5mL36mrqs=
-github.com/spf13/afero v1.12.0/go.mod h1:ZTlWwG4/ahT8W7T0WQ5uYmjI9duaLQGy3Q2OAl4sk/4=
-github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
-github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
-github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
-github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
-github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.20.1 h1:ZMi+z/lvLyPSCoNtFCpqjy0S4kPbirhpTMwl8BkW9X4=
-github.com/spf13/viper v1.20.1/go.mod h1:P9Mdzt1zoHIG8m2eZQinpiBjo6kCmZSKBClNNqjJvu4=
+github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 h1:+jumHNA0Wrelhe64i8F6HNlS8pkoyMv5sreGx2Ry5Rw=
+github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8/go.mod h1:3n1Cwaq1E1/1lhQhtRK2ts/ZwZEhjcQeJQ1RuC6Q/8U=
+github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
+github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
+github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
+github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
+github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s=
+github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
+github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
 github.com/stoewer/go-strcase v1.3.0 h1:g0eASXYtp+yvN9fK8sH94oCIk0fau9uV1/ZdJ0AVEzs=
 github.com/stoewer/go-strcase v1.3.0/go.mod h1:fAH5hQ5pehh+j3nZfvwdk2RgEgQjAoM8wodgtPmh1xo=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -276,8 +267,8 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
@@ -312,10 +303,10 @@ go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6h
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
 go.opentelemetry.io/otel v1.36.0 h1:UumtzIklRBY6cI/lllNZlALOF5nNIzJVb16APdvgTXg=
 go.opentelemetry.io/otel v1.36.0/go.mod h1:/TcFMXYjyRNh8khOAO9ybYkqaDBb/70aVwkNML4pP8E=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 h1:Vh5HayB/0HHfOQA7Ctx69E/Y/DcQSMPpKANYVMQ7fBA=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0/go.mod h1:cpgtDBaqD/6ok/UG0jT15/uKjAY8mRA53diogHBg3UI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0 h1:5pojmb1U1AogINhN3SurB+zm/nIcusopeBNp42f45QM=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0/go.mod h1:57gTHJSE5S1tqg+EKsLPlTWhpHMsWlVmer+LA926XiA=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 h1:OeNbIYk/2C15ckl7glBlOBp5+WlYsOElzTNmiPW/x60=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0/go.mod h1:7Bept48yIeqxP2OZ9/AqIpYS94h2or0aB4FypJTc8ZM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 h1:tgJ0uaNS4c98WRNUEx5U3aDlrDOI5Rs+1Vifcw4DJ8U=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0/go.mod h1:U7HYyW0zt/a9x5J1Kjs+r1f/d4ZHnYFclhYY2+YbeoE=
 go.opentelemetry.io/otel/metric v1.36.0 h1:MoWPKVhQvJ+eeXWHFBOPoBOi20jh6Iq2CcCREuTYufE=
 go.opentelemetry.io/otel/metric v1.36.0/go.mod h1:zC7Ks+yeyJt4xig9DEw9kuUFe5C3zLbVjV2PzT6qzbs=
 go.opentelemetry.io/otel/sdk v1.36.0 h1:b6SYIuLRs88ztox4EyrvRti80uXIFy+Sqzoh9kFULbs=
@@ -324,8 +315,8 @@ go.opentelemetry.io/otel/sdk/metric v1.36.0 h1:r0ntwwGosWGaa0CrSt8cuNuTcccMXERFw
 go.opentelemetry.io/otel/sdk/metric v1.36.0/go.mod h1:qTNOhFDfKRwX0yXOqJYegL5WRaW376QbB7P4Pb0qva4=
 go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKrsNd4w=
 go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA=
-go.opentelemetry.io/proto/otlp v1.4.0 h1:TA9WRvW6zMwP+Ssb6fLoUIuirti1gGbP28GcKG1jgeg=
-go.opentelemetry.io/proto/otlp v1.4.0/go.mod h1:PPBWZIP98o2ElSqI35IHfu7hIhSwvc5N38Jw8pXuGFY=
+go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
+go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
 go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
 go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
@@ -334,67 +325,73 @@ go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
-golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
+golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
 golang.org/x/exp v0.0.0-20240808152545-0cdaa3abc0fa h1:ELnwvuAXPNtPk1TJRuGkI9fDTwym6AYBu0qzT8AcHdI=
 golang.org/x/exp v0.0.0-20240808152545-0cdaa3abc0fa/go.mod h1:akd2r19cwCdwSwWeIdzYQGa/EZZyqcOdwWiwj5L5eKQ=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w=
-golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
+golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
-golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
+golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
+golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
 golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
 golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
-golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
-golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.33.0 h1:NuFncQrRcaRvVmgRkvM3j/F00gWIAlcmlB8ACEKmGIg=
-golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0=
+golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
+golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ=
+golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
-golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
-golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
-golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
+golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
-golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
+golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
+golang.org/x/tools/go/expect v0.1.0-deprecated h1:jY2C5HGYR5lqex3gEniOQL0r7Dq5+VGVgY1nudX5lXY=
+golang.org/x/tools/go/expect v0.1.0-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
 gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
-google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 h1:CkkIfIt50+lT6NHAVoRYEyAvQGFM7xEwXUUywFvEb3Q=
-google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576/go.mod h1:1R3kvZ1dtP3+4p4d3G8uJ8rFk/fWlScl38vanWACI08=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241223144023-3abc09e42ca8 h1:TqExAhdPaB60Ux47Cn0oLV07rGnxZzIsaRhQaqS666A=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241223144023-3abc09e42ca8/go.mod h1:lcTa1sDdWEIHMWlITnIczmw5w60CF9ffkb8Z+DVmmjA=
-google.golang.org/grpc v1.68.1 h1:oI5oTa11+ng8r8XMMN7jAOmWfPZWbYpCFaMUTACxkM0=
-google.golang.org/grpc v1.68.1/go.mod h1:+q1XYFJjShcqn0QZHvCyeR4CXPA+llXIeUIfIe00waw=
-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb h1:p31xT4yrYrSM/G4Sn2+TNUkVhFCbG9y8itM2S6Th950=
+google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:jbe3Bkdp+Dh2IrslsFCklNhweNTBgSYanP1UXhJDhKg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb h1:TLPQVbx1GJ8VKZxz52VAxl1EBgKXXbTiU9Fc5fZeLn4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:LuRYeWDFV6WOn90g357N17oMCaxpgCnbi/44qJvDn2I=
+google.golang.org/grpc v1.72.1 h1:HR03wO6eyZ7lknl75XlxABNVLLFc2PAb6mHlYh756mA=
+google.golang.org/grpc v1.72.1/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
@@ -418,40 +415,39 @@ gotest.tools/v3 v3.0.3 h1:4AuOwCGf4lLR9u3YOe2awrHygurzhO/HeQ6laiA6Sx0=
 gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
 howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=
 howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
-k8s.io/api v0.33.3 h1:SRd5t//hhkI1buzxb288fy2xvjubstenEKL9K51KBI8=
-k8s.io/api v0.33.3/go.mod h1:01Y/iLUjNBM3TAvypct7DIj0M0NIZc+PzAHCIo0CYGE=
-k8s.io/apiextensions-apiserver v0.33.0 h1:d2qpYL7Mngbsc1taA4IjJPRJ9ilnsXIrndH+r9IimOs=
-k8s.io/apiextensions-apiserver v0.33.0/go.mod h1:VeJ8u9dEEN+tbETo+lFkwaaZPg6uFKLGj5vyNEwwSzc=
-k8s.io/apimachinery v0.33.3 h1:4ZSrmNa0c/ZpZJhAgRdcsFcZOw1PQU1bALVQ0B3I5LA=
-k8s.io/apimachinery v0.33.3/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
-k8s.io/apiserver v0.33.0 h1:QqcM6c+qEEjkOODHppFXRiw/cE2zP85704YrQ9YaBbc=
-k8s.io/apiserver v0.33.0/go.mod h1:EixYOit0YTxt8zrO2kBU7ixAtxFce9gKGq367nFmqI8=
-k8s.io/client-go v0.33.3 h1:M5AfDnKfYmVJif92ngN532gFqakcGi6RvaOF16efrpA=
-k8s.io/client-go v0.33.3/go.mod h1:luqKBQggEf3shbxHY4uVENAxrDISLOarxpTKMiUuujg=
-k8s.io/code-generator v0.33.0 h1:B212FVl6EFqNmlgdOZYWNi77yBv+ed3QgQsMR8YQCw4=
-k8s.io/code-generator v0.33.0/go.mod h1:KnJRokGxjvbBQkSJkbVuBbu6z4B0rC7ynkpY5Aw6m9o=
-k8s.io/component-base v0.33.0 h1:Ot4PyJI+0JAD9covDhwLp9UNkUja209OzsJ4FzScBNk=
-k8s.io/component-base v0.33.0/go.mod h1:aXYZLbw3kihdkOPMDhWbjGCO6sg+luw554KP51t8qCU=
-k8s.io/gengo/v2 v2.0.0-20250207200755-1244d31929d7 h1:2OX19X59HxDprNCVrWi6jb7LW1PoqTlYqEq5H2oetog=
-k8s.io/gengo/v2 v2.0.0-20250207200755-1244d31929d7/go.mod h1:EJykeLsmFC60UQbYJezXkEsG2FLrt0GPNkU5iK5GWxU=
+k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
+k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
+k8s.io/apiextensions-apiserver v0.34.0 h1:B3hiB32jV7BcyKcMU5fDaDxk882YrJ1KU+ZSkA9Qxoc=
+k8s.io/apiextensions-apiserver v0.34.0/go.mod h1:hLI4GxE1BDBy9adJKxUxCEHBGZtGfIg98Q+JmTD7+g0=
+k8s.io/apimachinery v0.34.1 h1:dTlxFls/eikpJxmAC7MVE8oOeP1zryV7iRyIjB0gky4=
+k8s.io/apimachinery v0.34.1/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
+k8s.io/apiserver v0.34.0 h1:Z51fw1iGMqN7uJ1kEaynf2Aec1Y774PqU+FVWCFV3Jg=
+k8s.io/apiserver v0.34.0/go.mod h1:52ti5YhxAvewmmpVRqlASvaqxt0gKJxvCeW7ZrwgazQ=
+k8s.io/client-go v0.34.1 h1:ZUPJKgXsnKwVwmKKdPfw4tB58+7/Ik3CrjOEhsiZ7mY=
+k8s.io/client-go v0.34.1/go.mod h1:kA8v0FP+tk6sZA0yKLRG67LWjqufAoSHA2xVGKw9Of8=
+k8s.io/code-generator v0.34.0 h1:Ze2i1QsvUprIlX3oHiGv09BFQRLCz+StA8qKwwFzees=
+k8s.io/code-generator v0.34.0/go.mod h1:Py2+4w2HXItL8CGhks8uI/wS3Y93wPKO/9mBQUYNua0=
+k8s.io/component-base v0.34.0 h1:bS8Ua3zlJzapklsB1dZgjEJuJEeHjj8yTu1gxE2zQX8=
+k8s.io/component-base v0.34.0/go.mod h1:RSCqUdvIjjrEm81epPcjQ/DS+49fADvGSCkIP3IC6vg=
+k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f h1:SLb+kxmzfA87x4E4brQzB33VBbT2+x7Zq9ROIHmGn9Q=
+k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f/go.mod h1:EJykeLsmFC60UQbYJezXkEsG2FLrt0GPNkU5iK5GWxU=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUyGcf03XZEP0ZIKgKj35LS4=
-k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b h1:MloQ9/bdJyIu9lb1PzujOPolHyvO06MXG5TUIj2mNAA=
+k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b/go.mod h1:UZ2yyWbFTpuhSbFhv24aGNOdoRdJZgsIObGBUaYVsts=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 h1:jpcvIRr3GLoUoEKRkHKSmGjxb6lWwrBlJsXc+eUYQHM=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
-sigs.k8s.io/controller-runtime v0.21.0 h1:CYfjpEuicjUecRk+KAeyYh+ouUBn4llGyDYytIGcJS8=
-sigs.k8s.io/controller-runtime v0.21.0/go.mod h1:OSg14+F65eWqIu4DceX7k/+QRAbTTvxeQSNSOQpukWM=
-sigs.k8s.io/controller-tools v0.18.0 h1:rGxGZCZTV2wJreeRgqVoWab/mfcumTMmSwKzoM9xrsE=
-sigs.k8s.io/controller-tools v0.18.0/go.mod h1:gLKoiGBriyNh+x1rWtUQnakUYEujErjXs9pf+x/8n1U=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
-sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/controller-runtime v0.22.1 h1:Ah1T7I+0A7ize291nJZdS1CabF/lB4E++WizgV24Eqg=
+sigs.k8s.io/controller-runtime v0.22.1/go.mod h1:FwiwRjkRPbiN+zp2QRp7wlTCzbUXxZ/D4OzuQUDwBHY=
+sigs.k8s.io/controller-tools v0.19.0 h1:OU7jrPPiZusryu6YK0jYSjPqg8Vhf8cAzluP9XGI5uk=
+sigs.k8s.io/controller-tools v0.19.0/go.mod h1:y5HY/iNDFkmFla2CfQoVb2AQXMsBk4ad84iR1PLANB0=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v4 v4.6.0 h1:IUA9nvMmnKWcj5jl84xn+T5MnlZKThmUW1TdblaLVAc=
-sigs.k8s.io/structured-merge-diff/v4 v4.6.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/hack/config-extractor/go.mod b/hack/config-extractor/go.mod
index be3ed5fd0..a40d4798c 100644
--- a/hack/config-extractor/go.mod
+++ b/hack/config-extractor/go.mod
@@ -3,31 +3,32 @@ module github.com/elastic/cloud-on-k8s/v3/hack/config-extractor
 go 1.24.5
 
 require (
-	k8s.io/api v0.33.3
-	k8s.io/apiextensions-apiserver v0.33.3
-	k8s.io/apimachinery v0.33.3
-	k8s.io/kubectl v0.33.3
+	k8s.io/api v0.34.1
+	k8s.io/apiextensions-apiserver v0.34.1
+	k8s.io/apimachinery v0.34.1
+	k8s.io/kubectl v0.34.1
 )
 
 require (
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/x448/float16 v0.8.4 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	golang.org/x/net v0.38.0 // indirect
 	golang.org/x/text v0.23.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	k8s.io/client-go v0.33.3 // indirect
+	k8s.io/client-go v0.34.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
-	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
+	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )
 
 exclude github.com/miekg/dns v1.0.14
diff --git a/hack/config-extractor/go.sum b/hack/config-extractor/go.sum
index 202c27ce0..0673ef565 100644
--- a/hack/config-extractor/go.sum
+++ b/hack/config-extractor/go.sum
@@ -2,13 +2,12 @@ github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ3
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
-github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -23,14 +22,15 @@ github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
 github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
@@ -39,6 +39,10 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -75,26 +79,25 @@ gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.33.3 h1:SRd5t//hhkI1buzxb288fy2xvjubstenEKL9K51KBI8=
-k8s.io/api v0.33.3/go.mod h1:01Y/iLUjNBM3TAvypct7DIj0M0NIZc+PzAHCIo0CYGE=
-k8s.io/apiextensions-apiserver v0.33.3 h1:qmOcAHN6DjfD0v9kxL5udB27SRP6SG/MTopmge3MwEs=
-k8s.io/apiextensions-apiserver v0.33.3/go.mod h1:oROuctgo27mUsyp9+Obahos6CWcMISSAPzQ77CAQGz8=
-k8s.io/apimachinery v0.33.3 h1:4ZSrmNa0c/ZpZJhAgRdcsFcZOw1PQU1bALVQ0B3I5LA=
-k8s.io/apimachinery v0.33.3/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
-k8s.io/client-go v0.33.3 h1:M5AfDnKfYmVJif92ngN532gFqakcGi6RvaOF16efrpA=
-k8s.io/client-go v0.33.3/go.mod h1:luqKBQggEf3shbxHY4uVENAxrDISLOarxpTKMiUuujg=
+k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
+k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
+k8s.io/apiextensions-apiserver v0.34.1 h1:NNPBva8FNAPt1iSVwIE0FsdrVriRXMsaWFMqJbII2CI=
+k8s.io/apiextensions-apiserver v0.34.1/go.mod h1:hP9Rld3zF5Ay2Of3BeEpLAToP+l4s5UlxiHfqRaRcMc=
+k8s.io/apimachinery v0.34.1 h1:dTlxFls/eikpJxmAC7MVE8oOeP1zryV7iRyIjB0gky4=
+k8s.io/apimachinery v0.34.1/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
+k8s.io/client-go v0.34.1 h1:ZUPJKgXsnKwVwmKKdPfw4tB58+7/Ik3CrjOEhsiZ7mY=
+k8s.io/client-go v0.34.1/go.mod h1:kA8v0FP+tk6sZA0yKLRG67LWjqufAoSHA2xVGKw9Of8=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kubectl v0.33.3 h1:r/phHvH1iU7gO/l7tTjQk2K01ER7/OAJi8uFHHyWSac=
-k8s.io/kubectl v0.33.3/go.mod h1:euj2bG56L6kUGOE/ckZbCoudPwuj4Kud7BR0GzyNiT0=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
-sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+k8s.io/kubectl v0.34.1 h1:1qP1oqT5Xc93K+H8J7ecpBjaz511gan89KO9Vbsh/OI=
+k8s.io/kubectl v0.34.1/go.mod h1:JRYlhJpGPyk3dEmJ+BuBiOB9/dAvnrALJEiY/C5qa6A=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v4 v4.6.0 h1:IUA9nvMmnKWcj5jl84xn+T5MnlZKThmUW1TdblaLVAc=
-sigs.k8s.io/structured-merge-diff/v4 v4.6.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/hack/deployer/README.md b/hack/deployer/README.md
index 6e23942e5..b939ff45f 100644
--- a/hack/deployer/README.md
+++ b/hack/deployer/README.md
@@ -38,6 +38,16 @@ Deployer is the provisioning tool that aims to be the interface to multiple Kube
 
   * This will give you a working Kind cluster based on default values. See [Advanced usage](#advanced-usage) on how to tweak these configuration defaults if the need arises. Relevant parameters for Kind are: `client_version` which is the version of Kind to use. Make sure to check the [Kind release notes](https://github.com/kubernetes-sigs/kind/releases) when changing the client version and make sure `kubernetesVersion` and `client_version` are compatible. `kind.nodeImage` allows you to use a specific Kind node image matching your chosen Kind version. Again, the [Kind release notes](https://github.com/kubernetes-sigs/kind/releases) list the compatible pre-built node images for each version. `kind.ipFamily` allows you to switch between either an IPv4 or IPv6 network setup.
 
+* K3d
+  * No need to install the K3d CLI. Deployer will do that for you and run K3d inside a Docker container without changing the host system.
+  * Run from the [project root](/):
+
+    ```bash
+    make switch-k3d bootstrap-cloud
+    ```
+
+  * This will give you a working K3d cluster based on default values. See [Advanced usage](#advanced-usage) on how to tweak these configuration defaults if the need arises. Relevant parameters for K3d are: `clientImage` which is the version of K3d to use and `nodeImage` which is the version of `k3s` that runs on the nodes, which also defines the Kubernetes version. Make sure to check the [K3d release notes](https://github.com/k3d-io/k3d/releases) when changing the client image and make sure `nodeImage` and `clientImage` are compatible.
+
 ### Deprovision
 
 ```bash
diff --git a/hack/deployer/clients/ocp/Dockerfile b/hack/deployer/clients/ocp/Dockerfile
index 251764e44..a49bd6705 100644
--- a/hack/deployer/clients/ocp/Dockerfile
+++ b/hack/deployer/clients/ocp/Dockerfile
@@ -12,6 +12,6 @@ RUN curl -fsSLO https://mirror.openshift.com/pub/openshift-v4/clients/ocp/${CLIE
     mv oc /usr/local/bin/oc && \
     rm openshift-client-linux-${CLIENT_VERSION}.tar.gz
 
-FROM registry.access.redhat.com/ubi9/ubi-minimal:9.6-1752587672
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.6-1755695350
 COPY --from=builder /usr/local/bin/openshift-install .
 COPY --from=builder /usr/local/bin/oc .
diff --git a/hack/deployer/cmd/create.go b/hack/deployer/cmd/create.go
index 8babc6cfa..72b23a7f6 100644
--- a/hack/deployer/cmd/create.go
+++ b/hack/deployer/cmd/create.go
@@ -30,6 +30,12 @@ func CreateCommand() *cobra.Command {
 			if err != nil {
 				return err
 			}
+
+			// Truncate username to ensure clusterName (%s-dev-cluster) doesn't exceed 32 chars
+			if len(user) > 20 {
+				user = user[:20]
+			}
+
 			var cfgData string
 			switch provider {
 			case runner.GKEDriverID:
@@ -61,6 +67,8 @@ func CreateCommand() *cobra.Command {
 				cfgData = fmt.Sprintf(runner.DefaultEKSRunConfigTemplate, user, vaultAddr, token)
 			case runner.KindDriverID:
 				cfgData = fmt.Sprintf(runner.DefaultKindRunConfigTemplate, user)
+			case runner.K3dDriverID:
+				cfgData = fmt.Sprintf(runner.DefaultK3dRunConfigTemplate, user)
 			default:
 				return fmt.Errorf("unknown provider %s", provider)
 			}
diff --git a/hack/deployer/config/local-disks/ssd-provisioner.yaml b/hack/deployer/config/local-disks/ssd-provisioner.yaml
index 5dfb44904..a2e544f6b 100644
--- a/hack/deployer/config/local-disks/ssd-provisioner.yaml
+++ b/hack/deployer/config/local-disks/ssd-provisioner.yaml
@@ -33,7 +33,7 @@ data:
     set -o pipefail
 
     # TODO custom docker image
-    apt-get update && apt-get -y install nvme-cli
+    apt-get update && apt-get -y install nvme-cli e2fsprogs
 
     SSD_NVME_DEVICE_LIST=($(nvme list | grep "Amazon EC2 NVMe Instance Storage" | cut -d " " -f 1 || true))
     SSD_NVME_DEVICE_COUNT=${#SSD_NVME_DEVICE_LIST[@]}
diff --git a/hack/deployer/config/plans.yml b/hack/deployer/config/plans.yml
index 931c688fa..0865f3ae2 100644
--- a/hack/deployer/config/plans.yml
+++ b/hack/deployer/config/plans.yml
@@ -171,3 +171,19 @@ plans:
     nodeCount: 3
     nodeImage: kindest/node:v1.33.1@sha256:050072256b9a903bd914c0b2866828150cb229cea0efe5892e2b644d5dd3b34f
     ipFamily: ipv4
+- id: k3d-dev
+  operation: create
+  clusterName: eck
+  provider: k3d
+  kubernetesVersion: 1.33.3
+  k3d:
+    clientImage: ghcr.io/k3d-io/k3d:5.8.3
+    nodeImage: rancher/k3s:v1.33.3-k3s1
+- id: k3d-ci
+  operation: create
+  clusterName: k3d-ci
+  provider: k3d
+  kubernetesVersion: 1.33.3
+  k3d:
+    clientImage: ghcr.io/k3d-io/k3d:5.8.3
+    nodeImage: rancher/k3s:v1.33.3-k3s1
diff --git a/hack/deployer/runner/docker.go b/hack/deployer/runner/docker.go
new file mode 100644
index 000000000..bc5938a71
--- /dev/null
+++ b/hack/deployer/runner/docker.go
@@ -0,0 +1,28 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License 2.0;
+// you may not use this file except in compliance with the Elastic License 2.0.
+
+package runner
+
+import (
+	"os"
+	"runtime"
+)
+
+const defaultDockerSocket = "/var/run/docker.sock"
+
+func getDockerSocket() (string, error) {
+	_, err := os.Stat(defaultDockerSocket)
+	if err != nil {
+		if os.IsNotExist(err) {
+			// If we are on macOS and the docker socket does not exist, fall back
+			if runtime.GOOS == "darwin" {
+				return "$HOME/.docker/run/docker.sock", nil
+			}
+		} else {
+			// Handle other errors
+			return "", err
+		}
+	}
+	return defaultDockerSocket, nil
+}
diff --git a/hack/deployer/runner/k3d.go b/hack/deployer/runner/k3d.go
new file mode 100644
index 000000000..037b92e73
--- /dev/null
+++ b/hack/deployer/runner/k3d.go
@@ -0,0 +1,199 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License 2.0;
+// you may not use this file except in compliance with the Elastic License 2.0.
+
+package runner
+
+import (
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/elastic/cloud-on-k8s/v3/hack/deployer/exec"
+	"github.com/elastic/cloud-on-k8s/v3/hack/deployer/runner/env"
+	"github.com/elastic/cloud-on-k8s/v3/pkg/utils/vault"
+)
+
+const (
+	K3dDriverID = "k3d"
+
+	DefaultK3dRunConfigTemplate = `id: k3d-dev
+overrides:
+  clusterName: %s-dev-cluster
+`
+)
+
+func init() {
+	drivers[K3dDriverID] = &K3dDriverFactory{}
+}
+
+type K3dDriverFactory struct{}
+
+var _ DriverFactory = &K3dDriverFactory{}
+
+func (k K3dDriverFactory) Create(plan Plan) (Driver, error) {
+	dockerSocket, err := getDockerSocket()
+	if err != nil {
+		return nil, err
+	}
+	return &K3dDriver{
+		plan:         plan,
+		vaultClient:  vault.NewClientProvider(),
+		clientImage:  plan.K3d.ClientImage,
+		nodeImage:    plan.K3d.NodeImage,
+		dockerSocket: dockerSocket,
+	}, nil
+}
+
+type K3dDriver struct {
+	plan         Plan
+	clientImage  string
+	vaultClient  vault.ClientProvider
+	nodeImage    string
+	dockerSocket string
+}
+
+func (k *K3dDriver) Execute() error {
+	switch k.plan.Operation {
+	case CreateAction:
+		return k.create()
+	case DeleteAction:
+		return k.delete()
+	}
+	return nil
+}
+
+func (k *K3dDriver) create() error {
+	// Do not have k3d modify the kubeconfig by default, as it ends up owned by the root user.
+	cmd := k.cmd("cluster", "create", "--image", k.plan.K3d.NodeImage, "--kubeconfig-update-default=false", "--kubeconfig-switch-context=false")
+	if cmd == nil {
+		return fmt.Errorf("failed to create k3d cluster")
+	}
+	err := cmd.Run()
+	if err != nil {
+		return err
+	}
+
+	// Get kubeconfig from k3d
+	kubeCfg, err := k.getKubeConfig()
+	if err != nil {
+		return err
+	}
+	defer os.Remove(kubeCfg.Name())
+
+	clusterName := fmt.Sprintf("%s-%s", "k3d", k.plan.ClusterName)
+	userName := fmt.Sprintf("admin@%s", clusterName)
+	// First try to remove any existing kubeconfig entries to ensure a clean merge
+	if err := removeKubeconfig(clusterName, clusterName, userName); err != nil {
+		return err
+	}
+
+	// Call mergeKubeconfig to properly merge the kubeconfig without incorrectly overwriting ownership.
+	if err := mergeKubeconfig(kubeCfg.Name()); err != nil {
+		return err
+	}
+
+	// Activate the kubeconfig context to replicate the behavior of the other runners.
+	if err := activateKubeconfig(clusterName); err != nil {
+		return err
+	}
+
+	tmpStorageClass, err := k.createTmpStorageClass()
+	if err != nil {
+		return err
+	}
+
+	defer os.Remove(tmpStorageClass)
+
+	return kubectl("--kubeconfig", kubeCfg.Name(), "apply", "-f", tmpStorageClass)
+}
+
+func (k *K3dDriver) delete() error {
+	// The cluster delete operation will not properly remove the kubeconfig entry
+	// as the /home directory isn't mounted in the k3d flow.
+	cmd := k.cmd("cluster", "delete")
+	if cmd == nil {
+		return fmt.Errorf("failed to create k3d cluster")
+	}
+	if err := cmd.Run(); err != nil {
+		return err
+	}
+	// Manually remove the kubeconfig entry.
+	clusterName := fmt.Sprintf("%s-%s", "k3d", k.plan.ClusterName)
+	userName := fmt.Sprintf("admin@%s", clusterName)
+	// ignore errors when removing clusters/users/contexts using k3d
+	_ = removeKubeconfig(clusterName, clusterName, userName)
+	return nil
+}
+
+func (k *K3dDriver) cmd(args ...string) *exec.Command {
+	params := map[string]interface{}{
+		"ClusterName":    k.plan.ClusterName,
+		"SharedVolume":   env.SharedVolumeName(),
+		"K3dClientImage": k.clientImage,
+		"K3dNodeImage":   k.nodeImage,
+		"Args":           args,
+	}
+
+	// We need the docker socket so that k3d can bootstrap
+	// --userns=host to support Docker daemon host configured to run containers only in user namespaces
+	command := `docker run --rm \
+		--userns=host \
+		-v /var/run/docker.sock:` + k.dockerSocket + ` \
+		-e HOME=/home \
+		-e PATH=/ \
+		{{.K3dClientImage}} \
+		{{Join .Args " "}} {{.ClusterName}}`
+	return exec.NewCommand(command).AsTemplate(params)
+}
+
+func (k *K3dDriver) getKubeConfig() (*os.File, error) {
+	// Get kubeconfig from k3d binary
+	output, err := k.cmd("kubeconfig", "get", k.plan.ClusterName).WithoutStreaming().Output()
+	if err != nil {
+		return nil, err
+	}
+
+	// Replace host.docker.internal with 127.0.0.1 only if not running inside the CI container
+	// and on macOS.
+	if os.Getenv("CI") != "true" && runtime.GOOS == "darwin" {
+		output = strings.ReplaceAll(output, "host.docker.internal", "127.0.0.1")
+	}
+
+	// Persist kubeconfig for reliability in following kubectl commands
+	kubeCfg, err := os.CreateTemp("", "kubeconfig")
+	if err != nil {
+		return nil, err
+	}
+
+	_, err = kubeCfg.Write([]byte(output))
+	if err != nil {
+		return nil, err
+	}
+	return kubeCfg, nil
+}
+
+func (k *K3dDriver) GetCredentials() error {
+	config, err := k.getKubeConfig()
+	if err != nil {
+		return err
+	}
+	defer os.Remove(config.Name())
+	return mergeKubeconfig(config.Name())
+}
+
+func (k *K3dDriver) createTmpStorageClass() (string, error) {
+	tmpFile := filepath.Join(os.TempDir(), storageClassFileName)
+	err := os.WriteFile(tmpFile, []byte(storageClass), fs.ModePerm)
+	return tmpFile, err
+}
+
+func (k *K3dDriver) Cleanup(string, time.Duration) error {
+	return fmt.Errorf("unimplemented")
+}
+
+var _ Driver = &K3dDriver{}
diff --git a/hack/deployer/runner/kind.go b/hack/deployer/runner/kind.go
index 7e2b4806a..dc403c1a9 100644
--- a/hack/deployer/runner/kind.go
+++ b/hack/deployer/runner/kind.go
@@ -10,7 +10,6 @@ import (
 	"log"
 	"os"
 	"path/filepath"
-	"runtime"
 	"strconv"
 	"strings"
 	"text/template"
@@ -70,16 +69,22 @@ type KindDriverFactory struct{}
 var _ DriverFactory = &KindDriverFactory{}
 
 func (k KindDriverFactory) Create(plan Plan) (Driver, error) {
+	dockerSocket, err := getDockerSocket()
+	if err != nil {
+		return nil, err
+	}
 	return &KindDriver{
-		plan:        plan,
-		vaultClient: vault.NewClientProvider(),
+		plan:         plan,
+		vaultClient:  vault.NewClientProvider(),
+		dockerSocket: dockerSocket,
 	}, nil
 }
 
 type KindDriver struct {
-	plan        Plan
-	clientImage string
-	vaultClient vault.ClientProvider
+	plan         Plan
+	clientImage  string
+	vaultClient  vault.ClientProvider
+	dockerSocket string
 }
 
 func (k *KindDriver) Execute() error {
@@ -132,6 +137,8 @@ func (k *KindDriver) create() error {
 		return err
 	}
 
+	defer os.Remove(tmpStorageClass)
+
 	if k.plan.EnforceSecurityPolicies {
 		if err := kyverno.Install("--kubeconfig", kubeCfg.Name()); err != nil {
 			return err
@@ -205,17 +212,12 @@ func (k *KindDriver) cmd(args ...string) *exec.Command {
 		"Args":            args,
 	}
 
-	// on macOS, the docker socket is located in $HOME
-	dockerSocket := "/var/run/docker.sock"
-	if runtime.GOOS == "darwin" {
-		dockerSocket = "$HOME/.docker/run/docker.sock"
-	}
 	// We need the docker socket so that kind can bootstrap
 	// --userns=host to support Docker daemon host configured to run containers only in user namespaces
 	cmd := exec.NewCommand(`docker run --rm \
 		--userns=host \
 		-v {{.SharedVolume}}:/home \
-		-v /var/run/docker.sock:` + dockerSocket + ` \
+		-v /var/run/docker.sock:` + k.dockerSocket + ` \
 		-e HOME=/home \
 		-e PATH=/ \
 		{{.KindClientImage}} \
@@ -266,7 +268,7 @@ func (k *KindDriver) GetCredentials() error {
 }
 
 func (k *KindDriver) createTmpStorageClass() (string, error) {
-	tmpFile := filepath.Join(os.Getenv("HOME"), storageClassFileName)
+	tmpFile := filepath.Join(os.TempDir(), storageClassFileName)
 	err := os.WriteFile(tmpFile, []byte(storageClass), fs.ModePerm)
 	return tmpFile, err
 }
diff --git a/hack/deployer/runner/kubeconfig.go b/hack/deployer/runner/kubeconfig.go
index a48cc4530..5cd279c34 100644
--- a/hack/deployer/runner/kubeconfig.go
+++ b/hack/deployer/runner/kubeconfig.go
@@ -70,3 +70,11 @@ func copyFile(src, tgt string) error {
 	cmd := fmt.Sprintf("cp %s %s", src, tgt)
 	return exec.NewCommand(cmd).WithoutStreaming().WithLog("Copying kubeconfig").Run()
 }
+
+// activateKubeconfig activates the kubeconfig for the given cluster.
+// Intended to be run after merging of the kubeconfig has already happened.
+// Currently only used in the k3d runner, as it doesn't properly handle kubeconfig operations.
+func activateKubeconfig(clusterName string) error {
+	return exec.NewCommand("kubectl config use-context " + clusterName).
+		Run()
+}
diff --git a/hack/deployer/runner/settings.go b/hack/deployer/runner/settings.go
index e29f95693..f7468af2c 100644
--- a/hack/deployer/runner/settings.go
+++ b/hack/deployer/runner/settings.go
@@ -32,6 +32,7 @@ type Plan struct {
 	Ocp                     *OCPSettings  `yaml:"ocp,omitempty"`
 	Eks                     *EKSSettings  `yaml:"eks,omitempty"`
 	Kind                    *KindSettings `yaml:"kind,omitempty"`
+	K3d                     *K3dSettings  `yaml:"k3d,omitempty"`
 	ServiceAccount          bool          `yaml:"serviceAccount"`
 	EnforceSecurityPolicies bool          `yaml:"enforceSecurityPolicies"`
 	DiskSetup               string        `yaml:"diskSetup"`
@@ -86,6 +87,11 @@ type KindSettings struct {
 	IPFamily  string `yaml:"ipFamily"`
 }
 
+type K3dSettings struct {
+	ClientImage string `yaml:"clientImage"`
+	NodeImage   string `yaml:"nodeImage"`
+}
+
 // RunConfig encapsulates Id used to choose a plan and a map of overrides to apply to the plan, expected to map to a file
 type RunConfig struct {
 	Id        string                 `yaml:"id"` //nolint:revive
diff --git a/hack/dev/minikube-cluster.sh b/hack/dev/minikube-cluster.sh
index b3aa950c7..49d5ea24c 100755
--- a/hack/dev/minikube-cluster.sh
+++ b/hack/dev/minikube-cluster.sh
@@ -16,7 +16,7 @@ set -eu
 
 if [[ "$(minikube status --format '{{.ApiServer}}')" != "Running" ]]; then
     echo "Starting minikube..."
-    minikube start --kubernetes-version ${MINIKUBE_KUBERNETES_VERSION} --memory ${MINIKUBE_MEMORY} --cpus ${MINIKUBE_CPUS}
+    minikube start --kubernetes-version "${MINIKUBE_KUBERNETES_VERSION}" --memory "${MINIKUBE_MEMORY}" --cpus "${MINIKUBE_CPUS}"
 else
     echo "Minikube already started."
 fi
diff --git a/hack/helm/release/go.mod b/hack/helm/release/go.mod
index 5ae9bf7b4..992f405e7 100644
--- a/hack/helm/release/go.mod
+++ b/hack/helm/release/go.mod
@@ -3,14 +3,14 @@ module github.com/elastic/cloud-on-k8s/hack/helm/release
 go 1.24.5
 
 require (
-	cloud.google.com/go/storage v1.56.0
-	github.com/elastic/cloud-on-k8s/v3 v3.0.0
+	cloud.google.com/go/storage v1.56.1
+	github.com/elastic/cloud-on-k8s/v3 v3.1.0
 	github.com/google/go-cmp v0.7.0
-	github.com/spf13/cobra v1.9.1
-	github.com/spf13/viper v1.20.1
-	google.golang.org/api v0.243.0
+	github.com/spf13/cobra v1.10.1
+	github.com/spf13/viper v1.21.0
+	google.golang.org/api v0.249.0
 	gopkg.in/yaml.v3 v3.0.1
-	helm.sh/helm/v3 v3.18.4
+	helm.sh/helm/v3 v3.19.0
 )
 
 replace github.com/elastic/cloud-on-k8s/v3 => ../../..
@@ -21,21 +21,21 @@ exclude github.com/docker/docker v24.0.0+incompatible
 
 require (
 	cel.dev/expr v0.24.0 // indirect
-	cloud.google.com/go v0.121.4 // indirect
-	cloud.google.com/go/auth v0.16.3 // indirect
+	cloud.google.com/go v0.121.6 // indirect
+	cloud.google.com/go/auth v0.16.5 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
-	cloud.google.com/go/compute/metadata v0.7.0 // indirect
+	cloud.google.com/go/compute/metadata v0.8.0 // indirect
 	cloud.google.com/go/iam v1.5.2 // indirect
 	cloud.google.com/go/monitoring v1.24.2 // indirect
 	dario.cat/mergo v1.0.2 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/BurntSushi/toml v1.5.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 // indirect
 	github.com/MakeNowJust/heredoc v1.0.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.3.0 // indirect
+	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
 	github.com/Masterminds/squirrel v1.5.4 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
@@ -44,36 +44,35 @@ require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chai2010/gettext-go v1.0.2 // indirect
 	github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 // indirect
-	github.com/containerd/containerd v1.7.27 // indirect
+	github.com/containerd/containerd v1.7.28 // indirect
 	github.com/containerd/errdefs v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
 	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/emicklei/go-restful/v3 v3.12.1 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
 	github.com/evanphx/json-patch v5.9.11+incompatible // indirect
 	github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fsnotify/fsnotify v1.8.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-gorp/gorp/v3 v3.1.0 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.1 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.3.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/google/btree v1.1.3 // indirect
-	github.com/google/gnostic-models v0.6.9 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
-	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
 	github.com/googleapis/gax-go/v2 v2.15.0 // indirect
@@ -83,13 +82,13 @@ require (
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
-	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 // indirect
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
-	github.com/hashicorp/go-sockaddr v1.0.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
 	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
-	github.com/hashicorp/vault/api v1.20.0 // indirect
+	github.com/hashicorp/vault/api v1.21.0 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jmoiron/sqlx v1.4.0 // indirect
@@ -101,7 +100,7 @@ require (
 	github.com/lib/pq v1.10.9 // indirect
 	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.9 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
@@ -112,75 +111,75 @@ require (
 	github.com/moby/spdystream v0.5.0 // indirect
 	github.com/moby/term v0.5.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/rubenv/sql-migrate v1.8.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
-	github.com/sagikazarmark/locafero v0.7.0 // indirect
+	github.com/sagikazarmark/locafero v0.11.0 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/sourcegraph/conc v0.3.0 // indirect
-	github.com/spf13/afero v1.12.0 // indirect
-	github.com/spf13/cast v1.7.1 // indirect
-	github.com/spf13/pflag v1.0.7 // indirect
+	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
+	github.com/spf13/cast v1.10.0 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
-	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
-	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	github.com/zeebo/errs v1.4.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/contrib/detectors/gcp v1.36.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
-	go.opentelemetry.io/otel v1.36.0 // indirect
-	go.opentelemetry.io/otel/metric v1.36.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.36.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.36.0 // indirect
-	go.opentelemetry.io/otel/trace v1.36.0 // indirect
-	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/crypto v0.40.0 // indirect
-	golang.org/x/net v0.42.0 // indirect
+	go.opentelemetry.io/otel v1.37.0 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/trace v1.37.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/crypto v0.42.0 // indirect
+	golang.org/x/net v0.43.0 // indirect
 	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/sync v0.16.0 // indirect
-	golang.org/x/sys v0.34.0 // indirect
-	golang.org/x/term v0.33.0 // indirect
-	golang.org/x/text v0.27.0 // indirect
+	golang.org/x/sync v0.17.0 // indirect
+	golang.org/x/sys v0.36.0 // indirect
+	golang.org/x/term v0.35.0 // indirect
+	golang.org/x/text v0.29.0 // indirect
 	golang.org/x/time v0.12.0 // indirect
 	google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250721164621-a45f3dfb1074 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250721164621-a45f3dfb1074 // indirect
-	google.golang.org/grpc v1.74.2 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c // indirect
+	google.golang.org/grpc v1.75.0 // indirect
+	google.golang.org/protobuf v1.36.8 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	k8s.io/api v0.33.3 // indirect
-	k8s.io/apiextensions-apiserver v0.33.2 // indirect
-	k8s.io/apimachinery v0.33.3 // indirect
-	k8s.io/apiserver v0.33.2 // indirect
-	k8s.io/cli-runtime v0.33.2 // indirect
-	k8s.io/client-go v0.33.3 // indirect
-	k8s.io/component-base v0.33.2 // indirect
+	k8s.io/api v0.34.1 // indirect
+	k8s.io/apiextensions-apiserver v0.34.0 // indirect
+	k8s.io/apimachinery v0.34.1 // indirect
+	k8s.io/apiserver v0.34.0 // indirect
+	k8s.io/cli-runtime v0.34.0 // indirect
+	k8s.io/client-go v0.34.1 // indirect
+	k8s.io/component-base v0.34.0 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
-	k8s.io/kubectl v0.33.2 // indirect
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
+	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
+	k8s.io/kubectl v0.34.0 // indirect
+	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
 	oras.land/oras-go/v2 v2.6.0 // indirect
-	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
-	sigs.k8s.io/kustomize/api v0.19.0 // indirect
-	sigs.k8s.io/kustomize/kyaml v0.19.0 // indirect
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
+	sigs.k8s.io/kustomize/api v0.20.1 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.20.1 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )
diff --git a/hack/helm/release/go.sum b/hack/helm/release/go.sum
index 2dacbe84e..fb598728e 100644
--- a/hack/helm/release/go.sum
+++ b/hack/helm/release/go.sum
@@ -1,13 +1,13 @@
 cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
 cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
-cloud.google.com/go v0.121.4 h1:cVvUiY0sX0xwyxPwdSU2KsF9knOVmtRyAMt8xou0iTs=
-cloud.google.com/go v0.121.4/go.mod h1:XEBchUiHFJbz4lKBZwYBDHV/rSyfFktk737TLDU089s=
-cloud.google.com/go/auth v0.16.3 h1:kabzoQ9/bobUmnseYnBO6qQG7q4a/CffFRlJSxv2wCc=
-cloud.google.com/go/auth v0.16.3/go.mod h1:NucRGjaXfzP1ltpcQ7On/VTZ0H4kWB5Jy+Y9Dnm76fA=
+cloud.google.com/go v0.121.6 h1:waZiuajrI28iAf40cWgycWNgaXPO06dupuS+sgibK6c=
+cloud.google.com/go v0.121.6/go.mod h1:coChdst4Ea5vUpiALcYKXEpR1S9ZgXbhEzzMcMR66vI=
+cloud.google.com/go/auth v0.16.5 h1:mFWNQ2FEVWAliEQWpAdH80omXFokmrnbDhUS9cBywsI=
+cloud.google.com/go/auth v0.16.5/go.mod h1:utzRfHMP+Vv0mpOkTRQoWD2q3BatTOoWbA7gCc2dUhQ=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
-cloud.google.com/go/compute/metadata v0.7.0 h1:PBWF+iiAerVNe8UCHxdOt6eHLVc3ydFeOCw78U8ytSU=
-cloud.google.com/go/compute/metadata v0.7.0/go.mod h1:j5MvL9PprKL39t166CoB1uVHfQMs4tFQZZcKwksXUjo=
+cloud.google.com/go/compute/metadata v0.8.0 h1:HxMRIbao8w17ZX6wBnjhcDkW6lTFpgcaobyVfZWqRLA=
+cloud.google.com/go/compute/metadata v0.8.0/go.mod h1:sYOGTp851OV9bOFJ9CH7elVvyzopvWQFNNghtDQ/Biw=
 cloud.google.com/go/iam v1.5.2 h1:qgFRAGEmd8z6dJ/qyEchAuL9jpswyODjA2lS+w234g8=
 cloud.google.com/go/iam v1.5.2/go.mod h1:SE1vg0N81zQqLzQEwxL2WI6yhetBdbNQuTvIKCSkUHE=
 cloud.google.com/go/logging v1.13.0 h1:7j0HgAp0B94o1YRDqiqm26w4q1rDMH7XNRU34lJXHYc=
@@ -16,8 +16,8 @@ cloud.google.com/go/longrunning v0.6.7 h1:IGtfDWHhQCgCjwQjV9iiLnUta9LBCo8R9QmAFs
 cloud.google.com/go/longrunning v0.6.7/go.mod h1:EAFV3IZAKmM56TyiE6VAP3VoTzhZzySwI/YI1s/nRsY=
 cloud.google.com/go/monitoring v1.24.2 h1:5OTsoJ1dXYIiMiuL+sYscLc9BumrL3CarVLL7dd7lHM=
 cloud.google.com/go/monitoring v1.24.2/go.mod h1:x7yzPWcgDRnPEv3sI+jJGBkwl5qINf+6qY4eq0I9B4U=
-cloud.google.com/go/storage v1.56.0 h1:iixmq2Fse2tqxMbWhLWC9HfBj1qdxqAmiK8/eqtsLxI=
-cloud.google.com/go/storage v1.56.0/go.mod h1:Tpuj6t4NweCLzlNbw9Z9iwxEkrSem20AetIeH/shgVU=
+cloud.google.com/go/storage v1.56.1 h1:n6gy+yLnHn0hTwBFzNn8zJ1kqWfR91wzdM8hjRF4wP0=
+cloud.google.com/go/storage v1.56.1/go.mod h1:C9xuCZgFl3buo2HZU/1FncgvvOgTAs/rnh4gF4lMg0s=
 cloud.google.com/go/trace v1.11.6 h1:2O2zjPzqPYAHrn3OKl029qlqG6W8ZdYaOWRyr8NgMT4=
 cloud.google.com/go/trace v1.11.6/go.mod h1:GA855OeDEBiBMzcckLPE2kDunIpC72N+Pq8WFieFjnI=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
@@ -32,8 +32,8 @@ github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg
 github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU=
 github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0 h1:ErKg/3iS1AKcTkf3yixlZ54f9U1rljCkQyEXWUnIUxc=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0/go.mod h1:yAZHSGnqScoU556rBOVkwLze6WP5N+U11RHuWaGVxwY=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 h1:UQUsRi8WTzhZntp5313l+CHIAT95ojUI2lpP/ExlZa4=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0/go.mod h1:Cz6ft6Dkn3Et6l2v2a9/RpN7epQ1GtDlO6lj8bEcOvw=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 h1:owcC2UnmsZycprQ5RfRgjydWhuoxg71LUfyiQdijZuM=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0/go.mod h1:ZPpqegjbE99EPKsu3iUWV22A04wzGPcAY/ziSIQEEgs=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.53.0 h1:4LP6hvB4I5ouTbGgWtixJhgED6xdf67twf9PoY96Tbg=
@@ -44,20 +44,18 @@ github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ
 github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver/v3 v3.3.0 h1:B8LGeaivUe71a5qox1ICM/JLl0NqZSW5CHyL+hmvYS0=
-github.com/Masterminds/semver/v3 v3.3.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
 github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
 github.com/Masterminds/squirrel v1.5.4 h1:uUcX/aBc8O7Fg9kaISIUsHXdKuqehiXAMQTYX8afzqM=
 github.com/Masterminds/squirrel v1.5.4/go.mod h1:NNaOrjSoIDfDA40n7sr2tPNZRfjzjA400rg+riTZj10=
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
 github.com/bshuster-repo/logrus-logstash-hook v1.0.0 h1:e+C0SB5R1pu//O4MQ3f9cFuPGoOVeF2fE4Og9otCc70=
@@ -70,8 +68,8 @@ github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNS
 github.com/chai2010/gettext-go v1.0.2/go.mod h1:y+wnP2cHYaVj19NZhYKAwEMH2CI1gNHeQQ+5AjwawxA=
 github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv1aFbZMiM9vblcSArJRf2Irls=
 github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
-github.com/containerd/containerd v1.7.27 h1:yFyEyojddO3MIGVER2xJLWoCIn+Up4GaHFquP7hsFII=
-github.com/containerd/containerd v1.7.27/go.mod h1:xZmPnl75Vc+BLGt4MIfu6bp+fy03gdHAn9bz+FreFR0=
+github.com/containerd/containerd v1.7.28 h1:Nsgm1AtcmEh4AHAJ4gGlNSaKgXiNccU270Dnf81FQ3c=
+github.com/containerd/containerd v1.7.28/go.mod h1:azUkWcOvHrWvaiUjSQH0fjzuHIwSPg1WL5PshGP4Szs=
 github.com/containerd/errdefs v0.3.0 h1:FSZgGOeK4yuT/+DnF07/Olde/q4KBoMsaamhXxIMDp4=
 github.com/containerd/errdefs v0.3.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
@@ -95,14 +93,16 @@ github.com/distribution/distribution/v3 v3.0.0 h1:q4R8wemdRQDClzoNNStftB2ZAfqOiN
 github.com/distribution/distribution/v3 v3.0.0/go.mod h1:tRNuFoZsUdyRVegq8xGNeds4KLjwLCRin/tTo6i1DhU=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
+github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
 github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
 github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
-github.com/emicklei/go-restful/v3 v3.12.1 h1:PJMDIM/ak7btuL8Ex0iYET9hxM3CI2sjZtzpL63nKAU=
-github.com/emicklei/go-restful/v3 v3.12.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
+github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/envoyproxy/go-control-plane v0.13.4 h1:zEqyPVyku6IvWCFwux4x9RxkLOMUL+1vC9xUFv5l2/M=
 github.com/envoyproxy/go-control-plane v0.13.4/go.mod h1:kDfuBlDVsSj2MjrLEtRWtHlsWIFcGyB2RMO44Dc5GZA=
 github.com/envoyproxy/go-control-plane/envoy v1.32.4 h1:jb83lalDRZSpPWW2Z7Mck/8kXZ5CQAFYVjQcdVIr83A=
@@ -115,7 +115,6 @@ github.com/evanphx/json-patch v5.9.11+incompatible h1:ixHHqfcGvxhWkniF1tWxBHA0yb
 github.com/evanphx/json-patch v5.9.11+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f h1:Wl78ApPPB2Wvf/TIe2xdyJxTlb6obmF18d8QdkxNDu4=
 github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f/go.mod h1:OSYXu++VVOHnXeitef/D8n/6y4QV8uLHSFXX4NeXMGc=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
@@ -124,16 +123,16 @@ github.com/foxcpp/go-mockdns v1.1.0 h1:jI0rD8M0wuYAxL7r/ynTrCQQq0BVqfB99Vgk7Dlme
 github.com/foxcpp/go-mockdns v1.1.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
-github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
-github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
 github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-gorp/gorp/v3 v3.1.0 h1:ItKF/Vbuj31dmV4jxA1qblpSwkl9g1typ24xoe70IGs=
 github.com/go-gorp/gorp/v3 v3.1.0/go.mod h1:dLEjIyyRNiXvNZ8PSmzpt1GsWAUK8kjVhEpjH8TixEw=
-github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
-github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
+github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
+github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -151,8 +150,8 @@ github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1v
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/go-viper/mapstructure/v2 v2.3.0 h1:27XbWsHIqhbdR5TIC911OfYvgSaW93HM+dX7970Q7jk=
-github.com/go-viper/mapstructure/v2 v2.3.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
@@ -161,9 +160,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
-github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
-github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -173,8 +171,6 @@ github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgY
 github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
-github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
-github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/enterprise-certificate-proxy v0.3.6 h1:GW/XbdyBFQ8Qe+YAmFU9uHLo7OnF5tL52HFAgMmyrf4=
@@ -191,9 +187,8 @@ github.com/gosuri/uitable v0.0.4 h1:IG2xLKRvErL3uhY6e1BylFzG+aJiwQviDDTfOKeKTpY=
 github.com/gosuri/uitable v0.0.4/go.mod h1:tKR86bXuXPZazfOTG1FIzvjIdXzd0mo4Vtn16vt0PJo=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 h1:TmHmbvxPmaegwhDubVz0lICL0J5Ka2vwTzhoePEXsGE=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0/go.mod h1:qztMSjm835F2bXf+5HKAPIS5qsmQDqZna/PgVt4rWtI=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -201,28 +196,26 @@ github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9n
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
 github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
-github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 h1:om4Al8Oy7kCm/B86rLCLah4Dt5Aa0Fr5rYBG60OzwHQ=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 h1:U+kC2dOhMFQctRfhK0gRctKAPTloZdMU5ZJxaesJ/VM=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
-github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
-github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
+github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
+github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
 github.com/hashicorp/golang-lru/arc/v2 v2.0.5 h1:l2zaLDubNhW4XO3LnliVj0GXO3+/CGNJAg1dcN2Fpfw=
 github.com/hashicorp/golang-lru/arc/v2 v2.0.5/go.mod h1:ny6zBSQZi2JxIeYcv7kt2sH2PXJtirBN7RDhRpxPkxU=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
 github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
-github.com/hashicorp/vault/api v1.20.0 h1:KQMHElgudOsr+IbJgmbjHnCTxEpKs9LnozA1D3nozU4=
-github.com/hashicorp/vault/api v1.20.0/go.mod h1:GZ4pcjfzoOWpkJ3ijHNpEoAxKEsBJnVljyTe3jM2Sms=
+github.com/hashicorp/vault/api v1.21.0 h1:Xej4LJETV/spWRdjreb2vzQhEZt4+B5yxHAObfQVDOs=
+github.com/hashicorp/vault/api v1.21.0/go.mod h1:IUZA2cDvr4Ok3+NtK2Oq/r+lJeXkeCrHRmqdyWfpmGM=
 github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
 github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
@@ -251,11 +244,8 @@ github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhn
 github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.9 h1:Lm995f3rfxdpd6TSmuVCHVb/QhupuXlYr8sCI/QdE+0=
@@ -264,15 +254,12 @@ github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/miekg/dns v1.1.57 h1:Jzi7ApEIzwEPLHWRcafCN9LZSBbqQpxjt/wpgvg7wcM=
 github.com/miekg/dns v1.1.57/go.mod h1:uqRjCRUuEAA6qsOiJvDd+CFo/vW+y5WR6SNmHE55hZk=
-github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
 github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
 github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
-github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
@@ -284,8 +271,9 @@ github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFL
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
@@ -300,8 +288,8 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
-github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
-github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
 github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5 h1:Ii+DKncOVM8Cu1Hc+ETb5K+23HdAMvESYE3ZJ5b5cMI=
@@ -313,17 +301,16 @@ github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
 github.com/poy/onpar v1.1.2 h1:QaNrNiZx0+Nar5dLgTVp5mXkyoVFIbepjyEoGSnhbAY=
 github.com/poy/onpar v1.1.2/go.mod h1:6X8FLNoxyr9kkmnlqpK6LSoiOtrO6MICtWwEuWkLjzg=
-github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
-github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
-github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
-github.com/prometheus/procfs v0.16.0 h1:xh6oHhKwnOJKMYiYBDWmkHqQPyiY40sny36Cmx2bbsM=
-github.com/prometheus/procfs v0.16.0/go.mod h1:8veyXUu3nGP7oaCxhX6yeaM5u4stL2FeMXnCqhDthZg=
+github.com/prometheus/common v0.66.1 h1:h5E0h5/Y8niHc5DlaLlWLArTQI7tMrsfQjHV+d9ZoGs=
+github.com/prometheus/common v0.66.1/go.mod h1:gcaUsgf3KfRSwHY4dIMXLPV0K/Wg1oZ8+SbZk/HH/dA=
+github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
+github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
 github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 h1:EaDatTxkdHG+U3Bk4EUr+DZ7fOGwTfezUiUJMaIcaho=
 github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5/go.mod h1:fyalQWdtzDBECAQFBJuQe5bzQ02jGd5Qcbgb97Flm7U=
 github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 h1:EfpWLLCyXw8PSM2/XNJLjI3Pb27yVE+gIAfeqp8LUCc=
@@ -336,30 +323,31 @@ github.com/rubenv/sql-migrate v1.8.0 h1:dXnYiJk9k3wetp7GfQbKJcPHjVJL6YK19tKj8t2N
 github.com/rubenv/sql-migrate v1.8.0/go.mod h1:F2bGFBwCU+pnmbtNYDeKvSuvL6lBVtXDXUUv5t+u1qw=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
-github.com/sagikazarmark/locafero v0.7.0 h1:5MqpDsTGNDhY8sGp0Aowyf0qKsPrhewaLSsFaodPcyo=
-github.com/sagikazarmark/locafero v0.7.0/go.mod h1:2za3Cg5rMaTMoG/2Ulr9AwtFaIppKXTRYnozin4aB5k=
+github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
+github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
-github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
-github.com/spf13/afero v1.12.0 h1:UcOPyRBYczmFn6yvphxkn9ZEOY65cpwGKb5mL36mrqs=
-github.com/spf13/afero v1.12.0/go.mod h1:ZTlWwG4/ahT8W7T0WQ5uYmjI9duaLQGy3Q2OAl4sk/4=
-github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
-github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
-github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
-github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
-github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.20.1 h1:ZMi+z/lvLyPSCoNtFCpqjy0S4kPbirhpTMwl8BkW9X4=
-github.com/spf13/viper v1.20.1/go.mod h1:P9Mdzt1zoHIG8m2eZQinpiBjo6kCmZSKBClNNqjJvu4=
+github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 h1:+jumHNA0Wrelhe64i8F6HNlS8pkoyMv5sreGx2Ry5Rw=
+github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8/go.mod h1:3n1Cwaq1E1/1lhQhtRK2ts/ZwZEhjcQeJQ1RuC6Q/8U=
+github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
+github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
+github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
+github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
+github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s=
+github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
+github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
 github.com/spiffe/go-spiffe/v2 v2.5.0 h1:N2I01KCUkv1FAjZXJMwh95KK1ZIQLYbPfhaxw8WS0hE=
 github.com/spiffe/go-spiffe/v2 v2.5.0/go.mod h1:P+NxobPc6wXhVtINNtFjNWGBTreew1GBUCwT2wPmb7g=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -369,19 +357,12 @@ github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXf
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
-github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
-github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
-github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
-github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
-github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
-github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
-github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
 github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -400,8 +381,8 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.6
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
-go.opentelemetry.io/otel v1.36.0 h1:UumtzIklRBY6cI/lllNZlALOF5nNIzJVb16APdvgTXg=
-go.opentelemetry.io/otel v1.36.0/go.mod h1:/TcFMXYjyRNh8khOAO9ybYkqaDBb/70aVwkNML4pP8E=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0 h1:WzNab7hOOLzdDF/EoWCt4glhrbMPVMOO5JYTmpz36Ls=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0/go.mod h1:hKvJwTzJdp90Vh7p6q/9PAOd55dI6WA6sWj62a/JvSs=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.8.0 h1:S+LdBGiQXtJdowoJoQPEtI52syEP/JYBUpjO49EQhV8=
@@ -410,10 +391,10 @@ go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.32.0 h1:j7Z
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.32.0/go.mod h1:WXbYJTUaZXAbYd8lbgGuvih0yuCfOFC5RJoYnoLcGz8=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.32.0 h1:t/Qur3vKSkUCcDVaSumWF2PKHt85pc7fRvFuoVT8qFU=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.32.0/go.mod h1:Rl61tySSdcOJWoEgYZVtmnKdA0GeKrSqkHC1t+91CH8=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 h1:Vh5HayB/0HHfOQA7Ctx69E/Y/DcQSMPpKANYVMQ7fBA=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0/go.mod h1:cpgtDBaqD/6ok/UG0jT15/uKjAY8mRA53diogHBg3UI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0 h1:5pojmb1U1AogINhN3SurB+zm/nIcusopeBNp42f45QM=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0/go.mod h1:57gTHJSE5S1tqg+EKsLPlTWhpHMsWlVmer+LA926XiA=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 h1:OeNbIYk/2C15ckl7glBlOBp5+WlYsOElzTNmiPW/x60=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0/go.mod h1:7Bept48yIeqxP2OZ9/AqIpYS94h2or0aB4FypJTc8ZM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 h1:tgJ0uaNS4c98WRNUEx5U3aDlrDOI5Rs+1Vifcw4DJ8U=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0/go.mod h1:U7HYyW0zt/a9x5J1Kjs+r1f/d4ZHnYFclhYY2+YbeoE=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.32.0 h1:cMyu9O88joYEaI47CnQkxO1XZdpoTF9fEnW2duIddhw=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.32.0/go.mod h1:6Am3rn7P9TVVeXYG+wtcGE7IE1tsQ+bP3AuWcKt/gOI=
 go.opentelemetry.io/otel/exporters/prometheus v0.54.0 h1:rFwzp68QMgtzu9PgP3jm9XaMICI6TsofWWPcBDKwlsU=
@@ -426,84 +407,86 @@ go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.32.0 h1:cC2yDI3IQd0Udsu
 go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.32.0/go.mod h1:2PD5Ex6z8CFzDbTdOlwyNIUywRr1DN0ospafJM1wJ+s=
 go.opentelemetry.io/otel/log v0.8.0 h1:egZ8vV5atrUWUbnSsHn6vB8R21G2wrKqNiDt3iWertk=
 go.opentelemetry.io/otel/log v0.8.0/go.mod h1:M9qvDdUTRCopJcGRKg57+JSQ9LgLBrwwfC32epk5NX8=
-go.opentelemetry.io/otel/metric v1.36.0 h1:MoWPKVhQvJ+eeXWHFBOPoBOi20jh6Iq2CcCREuTYufE=
-go.opentelemetry.io/otel/metric v1.36.0/go.mod h1:zC7Ks+yeyJt4xig9DEw9kuUFe5C3zLbVjV2PzT6qzbs=
-go.opentelemetry.io/otel/sdk v1.36.0 h1:b6SYIuLRs88ztox4EyrvRti80uXIFy+Sqzoh9kFULbs=
-go.opentelemetry.io/otel/sdk v1.36.0/go.mod h1:+lC+mTgD+MUWfjJubi2vvXWcVxyr9rmlshZni72pXeY=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
 go.opentelemetry.io/otel/sdk/log v0.8.0 h1:zg7GUYXqxk1jnGF/dTdLPrK06xJdrXgqgFLnI4Crxvs=
 go.opentelemetry.io/otel/sdk/log v0.8.0/go.mod h1:50iXr0UVwQrYS45KbruFrEt4LvAdCaWWgIrsN3ZQggo=
-go.opentelemetry.io/otel/sdk/metric v1.36.0 h1:r0ntwwGosWGaa0CrSt8cuNuTcccMXERFwHX4dThiPis=
-go.opentelemetry.io/otel/sdk/metric v1.36.0/go.mod h1:qTNOhFDfKRwX0yXOqJYegL5WRaW376QbB7P4Pb0qva4=
-go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKrsNd4w=
-go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA=
-go.opentelemetry.io/proto/otlp v1.4.0 h1:TA9WRvW6zMwP+Ssb6fLoUIuirti1gGbP28GcKG1jgeg=
-go.opentelemetry.io/proto/otlp v1.4.0/go.mod h1:PPBWZIP98o2ElSqI35IHfu7hIhSwvc5N38Jw8pXuGFY=
+go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc=
+go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
+go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
-go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
-golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
+golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w=
-golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
+golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
-golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
+golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
 golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
 golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
-golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
-golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.33.0 h1:NuFncQrRcaRvVmgRkvM3j/F00gWIAlcmlB8ACEKmGIg=
-golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0=
+golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
+golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ=
+golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
-golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
+golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
 golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
 golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
-golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
+golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.243.0 h1:sw+ESIJ4BVnlJcWu9S+p2Z6Qq1PjG77T8IJ1xtp4jZQ=
-google.golang.org/api v0.243.0/go.mod h1:GE4QtYfaybx1KmeHMdBnNnyLzBZCVihGBXAmJu/uUr8=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+google.golang.org/api v0.249.0 h1:0VrsWAKzIZi058aeq+I86uIXbNhm9GxSHpbmZ92a38w=
+google.golang.org/api v0.249.0/go.mod h1:dGk9qyI0UYPwO/cjt2q06LG/EhUpwZGdAbYF14wHHrQ=
 google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=
 google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s=
-google.golang.org/genproto/googleapis/api v0.0.0-20250721164621-a45f3dfb1074 h1:mVXdvnmR3S3BQOqHECm9NGMjYiRtEvDYcqAqedTXY6s=
-google.golang.org/genproto/googleapis/api v0.0.0-20250721164621-a45f3dfb1074/go.mod h1:vYFwMYFbmA8vl6Z/krj/h7+U/AqpHknwJX4Uqgfyc7I=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250721164621-a45f3dfb1074 h1:qJW29YvkiJmXOYMu5Tf8lyrTp3dOS+K4z6IixtLaCf8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250721164621-a45f3dfb1074/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
-google.golang.org/grpc v1.74.2 h1:WoosgB65DlWVC9FqI82dGsZhWFNBSLjQ84bjROOpMu4=
-google.golang.org/grpc v1.74.2/go.mod h1:CtQ+BGjaAIXHs/5YS3i473GqwBBa1zGQNevxdeBEXrM=
-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c h1:AtEkQdl5b6zsybXcbz00j1LwNodDuH6hVifIaNqk7NQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c/go.mod h1:ea2MjsO70ssTfCjiwHgI0ZFqcw45Ksuk2ckf9G468GA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c h1:qXWI/sQtv5UKboZ/zUk7h+mrf/lXORyI+n9DKDAusdg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c/go.mod h1:gw1tLEfykwDz2ET4a12jcXt4couGAm7IwsVaTy0Sflo=
+google.golang.org/grpc v1.75.0 h1:+TW+dqTd2Biwe6KKfhE5JpiYIBWq865PhKGSXiivqt4=
+google.golang.org/grpc v1.75.0/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -516,42 +499,41 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-helm.sh/helm/v3 v3.18.4 h1:pNhnHM3nAmDrxz6/UC+hfjDY4yeDATQCka2/87hkZXQ=
-helm.sh/helm/v3 v3.18.4/go.mod h1:WVnwKARAw01iEdjpEkP7Ii1tT1pTPYfM1HsakFKM3LI=
-k8s.io/api v0.33.3 h1:SRd5t//hhkI1buzxb288fy2xvjubstenEKL9K51KBI8=
-k8s.io/api v0.33.3/go.mod h1:01Y/iLUjNBM3TAvypct7DIj0M0NIZc+PzAHCIo0CYGE=
-k8s.io/apiextensions-apiserver v0.33.2 h1:6gnkIbngnaUflR3XwE1mCefN3YS8yTD631JXQhsU6M8=
-k8s.io/apiextensions-apiserver v0.33.2/go.mod h1:IvVanieYsEHJImTKXGP6XCOjTwv2LUMos0YWc9O+QP8=
-k8s.io/apimachinery v0.33.3 h1:4ZSrmNa0c/ZpZJhAgRdcsFcZOw1PQU1bALVQ0B3I5LA=
-k8s.io/apimachinery v0.33.3/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
-k8s.io/apiserver v0.33.2 h1:KGTRbxn2wJagJowo29kKBp4TchpO1DRO3g+dB/KOJN4=
-k8s.io/apiserver v0.33.2/go.mod h1:9qday04wEAMLPWWo9AwqCZSiIn3OYSZacDyu/AcoM/M=
-k8s.io/cli-runtime v0.33.2 h1:koNYQKSDdq5AExa/RDudXMhhtFasEg48KLS2KSAU74Y=
-k8s.io/cli-runtime v0.33.2/go.mod h1:gnhsAWpovqf1Zj5YRRBBU7PFsRc6NkEkwYNQE+mXL88=
-k8s.io/client-go v0.33.3 h1:M5AfDnKfYmVJif92ngN532gFqakcGi6RvaOF16efrpA=
-k8s.io/client-go v0.33.3/go.mod h1:luqKBQggEf3shbxHY4uVENAxrDISLOarxpTKMiUuujg=
-k8s.io/component-base v0.33.2 h1:sCCsn9s/dG3ZrQTX/Us0/Sx2R0G5kwa0wbZFYoVp/+0=
-k8s.io/component-base v0.33.2/go.mod h1:/41uw9wKzuelhN+u+/C59ixxf4tYQKW7p32ddkYNe2k=
+helm.sh/helm/v3 v3.19.0 h1:krVyCGa8fa/wzTZgqw0DUiXuRT5BPdeqE/sQXujQ22k=
+helm.sh/helm/v3 v3.19.0/go.mod h1:Lk/SfzN0w3a3C3o+TdAKrLwJ0wcZ//t1/SDXAvfgDdc=
+k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
+k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
+k8s.io/apiextensions-apiserver v0.34.0 h1:B3hiB32jV7BcyKcMU5fDaDxk882YrJ1KU+ZSkA9Qxoc=
+k8s.io/apiextensions-apiserver v0.34.0/go.mod h1:hLI4GxE1BDBy9adJKxUxCEHBGZtGfIg98Q+JmTD7+g0=
+k8s.io/apimachinery v0.34.1 h1:dTlxFls/eikpJxmAC7MVE8oOeP1zryV7iRyIjB0gky4=
+k8s.io/apimachinery v0.34.1/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
+k8s.io/apiserver v0.34.0 h1:Z51fw1iGMqN7uJ1kEaynf2Aec1Y774PqU+FVWCFV3Jg=
+k8s.io/apiserver v0.34.0/go.mod h1:52ti5YhxAvewmmpVRqlASvaqxt0gKJxvCeW7ZrwgazQ=
+k8s.io/cli-runtime v0.34.0 h1:N2/rUlJg6TMEBgtQ3SDRJwa8XyKUizwjlOknT1mB2Cw=
+k8s.io/cli-runtime v0.34.0/go.mod h1:t/skRecS73Piv+J+FmWIQA2N2/rDjdYSQzEE67LUUs8=
+k8s.io/client-go v0.34.1 h1:ZUPJKgXsnKwVwmKKdPfw4tB58+7/Ik3CrjOEhsiZ7mY=
+k8s.io/client-go v0.34.1/go.mod h1:kA8v0FP+tk6sZA0yKLRG67LWjqufAoSHA2xVGKw9Of8=
+k8s.io/component-base v0.34.0 h1:bS8Ua3zlJzapklsB1dZgjEJuJEeHjj8yTu1gxE2zQX8=
+k8s.io/component-base v0.34.0/go.mod h1:RSCqUdvIjjrEm81epPcjQ/DS+49fADvGSCkIP3IC6vg=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUyGcf03XZEP0ZIKgKj35LS4=
-k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
-k8s.io/kubectl v0.33.2 h1:7XKZ6DYCklu5MZQzJe+CkCjoGZwD1wWl7t/FxzhMz7Y=
-k8s.io/kubectl v0.33.2/go.mod h1:8rC67FB8tVTYraovAGNi/idWIK90z2CHFNMmGJZJ3KI=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b h1:MloQ9/bdJyIu9lb1PzujOPolHyvO06MXG5TUIj2mNAA=
+k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b/go.mod h1:UZ2yyWbFTpuhSbFhv24aGNOdoRdJZgsIObGBUaYVsts=
+k8s.io/kubectl v0.34.0 h1:NcXz4TPTaUwhiX4LU+6r6udrlm0NsVnSkP3R9t0dmxs=
+k8s.io/kubectl v0.34.0/go.mod h1:bmd0W5i+HuG7/p5sqicr0Li0rR2iIhXL0oUyLF3OjR4=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
 oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
-sigs.k8s.io/kustomize/api v0.19.0 h1:F+2HB2mU1MSiR9Hp1NEgoU2q9ItNOaBJl0I4Dlus5SQ=
-sigs.k8s.io/kustomize/api v0.19.0/go.mod h1:/BbwnivGVcBh1r+8m3tH1VNxJmHSk1PzP5fkP6lbL1o=
-sigs.k8s.io/kustomize/kyaml v0.19.0 h1:RFge5qsO1uHhwJsu3ipV7RNolC7Uozc0jUBC/61XSlA=
-sigs.k8s.io/kustomize/kyaml v0.19.0/go.mod h1:FeKD5jEOH+FbZPpqUghBP8mrLjJ3+zD3/rf9NNu1cwY=
-sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/kustomize/api v0.20.1 h1:iWP1Ydh3/lmldBnH/S5RXgT98vWYMaTUL1ADcr+Sv7I=
+sigs.k8s.io/kustomize/api v0.20.1/go.mod h1:t6hUFxO+Ph0VxIk1sKp1WS0dOjbPCtLJ4p8aADLwqjM=
+sigs.k8s.io/kustomize/kyaml v0.20.1 h1:PCMnA2mrVbRP3NIB6v9kYCAc38uvFLVs8j/CD567A78=
+sigs.k8s.io/kustomize/kyaml v0.20.1/go.mod h1:0EmkQHRUsJxY8Ug9Niig1pUMSCGHxQ5RklbpV/Ri6po=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v4 v4.6.0 h1:IUA9nvMmnKWcj5jl84xn+T5MnlZKThmUW1TdblaLVAc=
-sigs.k8s.io/structured-merge-diff/v4 v4.6.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/hack/manifest-gen/Dockerfile b/hack/manifest-gen/Dockerfile
index 204832449..5477769c6 100644
--- a/hack/manifest-gen/Dockerfile
+++ b/hack/manifest-gen/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.elastic.co/wolfi/go:1.24.5-r2@sha256:8b8d98d34d7c0892abead1f9be7cd3581587a556a26496553bb8b91e7520ae3e as builder
+FROM docker.elastic.co/wolfi/go:1.25.1@sha256:ebfb6455d2f211f5883fc890b3e015407b5001016447a7427942ad2bd327c68a as builder
 ADD . /manifest-gen
 WORKDIR /manifest-gen
 ENV GO111MODULE=on CGO_ENABLED=0 GOOS=linux 
diff --git a/hack/manifest-gen/go.mod b/hack/manifest-gen/go.mod
index 9d8b2975b..f14e7e552 100644
--- a/hack/manifest-gen/go.mod
+++ b/hack/manifest-gen/go.mod
@@ -2,11 +2,11 @@ module github.com/elastic/cloud-on-k8s/v3/hack/manifest-gen
 
 go 1.24.0
 
-toolchain go1.24.5
+toolchain go1.25.1
 
 require (
-	github.com/spf13/cobra v1.9.1
-	helm.sh/helm/v3 v3.18.4
+	github.com/spf13/cobra v1.10.1
+	helm.sh/helm/v3 v3.19.0
 	sigs.k8s.io/kustomize/kyaml v0.20.1
 )
 
@@ -16,23 +16,23 @@ require (
 	github.com/BurntSushi/toml v1.5.0 // indirect
 	github.com/MakeNowJust/heredoc v1.0.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.3.0 // indirect
+	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
 	github.com/Masterminds/squirrel v1.5.4 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
 	github.com/chai2010/gettext-go v1.0.2 // indirect
-	github.com/containerd/containerd v1.7.27 // indirect
+	github.com/containerd/containerd v1.7.28 // indirect
 	github.com/containerd/errdefs v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
 	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/evanphx/json-patch v5.9.11+incompatible // indirect
 	github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
 	github.com/fatih/color v1.13.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-gorp/gorp/v3 v3.1.0 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
@@ -42,9 +42,8 @@ require (
 	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/google/btree v1.1.3 // indirect
-	github.com/google/gnostic-models v0.6.9 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/gosuri/uitable v0.0.4 // indirect
@@ -71,7 +70,7 @@ require (
 	github.com/moby/spdystream v0.5.0 // indirect
 	github.com/moby/term v0.5.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
@@ -79,48 +78,47 @@ require (
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/rubenv/sql-migrate v1.8.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/spf13/cast v1.7.0 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/spf13/pflag v1.0.9 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
-	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
-	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	go.yaml.in/yaml/v3 v3.0.3 // indirect
-	golang.org/x/crypto v0.39.0 // indirect
-	golang.org/x/net v0.40.0 // indirect
-	golang.org/x/oauth2 v0.28.0 // indirect
-	golang.org/x/sync v0.15.0 // indirect
-	golang.org/x/sys v0.33.0 // indirect
-	golang.org/x/term v0.32.0 // indirect
-	golang.org/x/text v0.26.0 // indirect
-	golang.org/x/time v0.9.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
-	google.golang.org/grpc v1.68.1 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/crypto v0.41.0 // indirect
+	golang.org/x/net v0.42.0 // indirect
+	golang.org/x/oauth2 v0.30.0 // indirect
+	golang.org/x/sync v0.16.0 // indirect
+	golang.org/x/sys v0.35.0 // indirect
+	golang.org/x/term v0.34.0 // indirect
+	golang.org/x/text v0.28.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb // indirect
+	google.golang.org/grpc v1.72.1 // indirect
 	google.golang.org/protobuf v1.36.5 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/api v0.33.2 // indirect
-	k8s.io/apiextensions-apiserver v0.33.2 // indirect
-	k8s.io/apimachinery v0.33.2 // indirect
-	k8s.io/apiserver v0.33.2 // indirect
-	k8s.io/cli-runtime v0.33.2 // indirect
-	k8s.io/client-go v0.33.2 // indirect
-	k8s.io/component-base v0.33.2 // indirect
+	k8s.io/api v0.34.0 // indirect
+	k8s.io/apiextensions-apiserver v0.34.0 // indirect
+	k8s.io/apimachinery v0.34.0 // indirect
+	k8s.io/apiserver v0.34.0 // indirect
+	k8s.io/cli-runtime v0.34.0 // indirect
+	k8s.io/client-go v0.34.0 // indirect
+	k8s.io/component-base v0.34.0 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
-	k8s.io/kubectl v0.33.2 // indirect
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
+	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
+	k8s.io/kubectl v0.34.0 // indirect
+	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
 	oras.land/oras-go/v2 v2.6.0 // indirect
-	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
-	sigs.k8s.io/kustomize/api v0.19.0 // indirect
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
+	sigs.k8s.io/kustomize/api v0.20.1 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
-	sigs.k8s.io/yaml v1.5.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )
diff --git a/hack/manifest-gen/go.sum b/hack/manifest-gen/go.sum
index f190c28a8..bbb359a6b 100644
--- a/hack/manifest-gen/go.sum
+++ b/hack/manifest-gen/go.sum
@@ -14,8 +14,8 @@ github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ
 github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver/v3 v3.3.0 h1:B8LGeaivUe71a5qox1ICM/JLl0NqZSW5CHyL+hmvYS0=
-github.com/Masterminds/semver/v3 v3.3.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
 github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
 github.com/Masterminds/squirrel v1.5.4 h1:uUcX/aBc8O7Fg9kaISIUsHXdKuqehiXAMQTYX8afzqM=
@@ -36,8 +36,8 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNSjIRk=
 github.com/chai2010/gettext-go v1.0.2/go.mod h1:y+wnP2cHYaVj19NZhYKAwEMH2CI1gNHeQQ+5AjwawxA=
-github.com/containerd/containerd v1.7.27 h1:yFyEyojddO3MIGVER2xJLWoCIn+Up4GaHFquP7hsFII=
-github.com/containerd/containerd v1.7.27/go.mod h1:xZmPnl75Vc+BLGt4MIfu6bp+fy03gdHAn9bz+FreFR0=
+github.com/containerd/containerd v1.7.28 h1:Nsgm1AtcmEh4AHAJ4gGlNSaKgXiNccU270Dnf81FQ3c=
+github.com/containerd/containerd v1.7.28/go.mod h1:azUkWcOvHrWvaiUjSQH0fjzuHIwSPg1WL5PshGP4Szs=
 github.com/containerd/errdefs v0.3.0 h1:FSZgGOeK4yuT/+DnF07/Olde/q4KBoMsaamhXxIMDp4=
 github.com/containerd/errdefs v0.3.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
@@ -62,14 +62,16 @@ github.com/distribution/distribution/v3 v3.0.0 h1:q4R8wemdRQDClzoNNStftB2ZAfqOiN
 github.com/distribution/distribution/v3 v3.0.0/go.mod h1:tRNuFoZsUdyRVegq8xGNeds4KLjwLCRin/tTo6i1DhU=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
+github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
 github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
 github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
-github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
-github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
+github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/evanphx/json-patch v5.9.11+incompatible h1:ixHHqfcGvxhWkniF1tWxBHA0yb4Z+d1UQi45df52xW8=
 github.com/evanphx/json-patch v5.9.11+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f h1:Wl78ApPPB2Wvf/TIe2xdyJxTlb6obmF18d8QdkxNDu4=
@@ -82,8 +84,8 @@ github.com/foxcpp/go-mockdns v1.1.0 h1:jI0rD8M0wuYAxL7r/ynTrCQQq0BVqfB99Vgk7Dlme
 github.com/foxcpp/go-mockdns v1.1.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
-github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
 github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-gorp/gorp/v3 v3.1.0 h1:ItKF/Vbuj31dmV4jxA1qblpSwkl9g1typ24xoe70IGs=
@@ -112,16 +114,13 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
-github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
-github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
 github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
-github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
-github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
@@ -134,9 +133,8 @@ github.com/gosuri/uitable v0.0.4 h1:IG2xLKRvErL3uhY6e1BylFzG+aJiwQviDDTfOKeKTpY=
 github.com/gosuri/uitable v0.0.4/go.mod h1:tKR86bXuXPZazfOTG1FIzvjIdXzd0mo4Vtn16vt0PJo=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 h1:TmHmbvxPmaegwhDubVz0lICL0J5Ka2vwTzhoePEXsGE=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0/go.mod h1:qztMSjm835F2bXf+5HKAPIS5qsmQDqZna/PgVt4rWtI=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -204,8 +202,9 @@ github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFL
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
@@ -251,6 +250,8 @@ github.com/rubenv/sql-migrate v1.8.0 h1:dXnYiJk9k3wetp7GfQbKJcPHjVJL6YK19tKj8t2N
 github.com/rubenv/sql-migrate v1.8.0/go.mod h1:F2bGFBwCU+pnmbtNYDeKvSuvL6lBVtXDXUUv5t+u1qw=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
@@ -259,10 +260,10 @@ github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=
 github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
-github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
-github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
-github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s=
+github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0=
+github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
@@ -275,17 +276,10 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
-github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
-github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
-github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
-github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
-github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
-github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
-github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
 github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -298,8 +292,8 @@ go.opentelemetry.io/contrib/exporters/autoexport v0.57.0 h1:jmTVJ86dP60C01K3slFQ
 go.opentelemetry.io/contrib/exporters/autoexport v0.57.0/go.mod h1:EJBheUMttD/lABFyLXhce47Wr6DPWYReCzaZiXadH7g=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 h1:yd02MEjBdJkG3uabWP9apV+OuWRIXGDuJEUJbOHmCFU=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0/go.mod h1:umTcuxiv1n/s/S6/c2AT/g2CQ7u5C59sHDNmfSwgz7Q=
-go.opentelemetry.io/otel v1.33.0 h1:/FerN9bax5LoK51X/sI0SVYrjSE0/yUL7DpxW4K3FWw=
-go.opentelemetry.io/otel v1.33.0/go.mod h1:SUUkR6csvUQl+yjReHu5uM3EtVV7MBm5FHKRlNx4I8I=
+go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
+go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0 h1:WzNab7hOOLzdDF/EoWCt4glhrbMPVMOO5JYTmpz36Ls=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0/go.mod h1:hKvJwTzJdp90Vh7p6q/9PAOd55dI6WA6sWj62a/JvSs=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.8.0 h1:S+LdBGiQXtJdowoJoQPEtI52syEP/JYBUpjO49EQhV8=
@@ -308,10 +302,10 @@ go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.32.0 h1:j7Z
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.32.0/go.mod h1:WXbYJTUaZXAbYd8lbgGuvih0yuCfOFC5RJoYnoLcGz8=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.32.0 h1:t/Qur3vKSkUCcDVaSumWF2PKHt85pc7fRvFuoVT8qFU=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.32.0/go.mod h1:Rl61tySSdcOJWoEgYZVtmnKdA0GeKrSqkHC1t+91CH8=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 h1:Vh5HayB/0HHfOQA7Ctx69E/Y/DcQSMPpKANYVMQ7fBA=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0/go.mod h1:cpgtDBaqD/6ok/UG0jT15/uKjAY8mRA53diogHBg3UI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0 h1:5pojmb1U1AogINhN3SurB+zm/nIcusopeBNp42f45QM=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0/go.mod h1:57gTHJSE5S1tqg+EKsLPlTWhpHMsWlVmer+LA926XiA=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 h1:OeNbIYk/2C15ckl7glBlOBp5+WlYsOElzTNmiPW/x60=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0/go.mod h1:7Bept48yIeqxP2OZ9/AqIpYS94h2or0aB4FypJTc8ZM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 h1:tgJ0uaNS4c98WRNUEx5U3aDlrDOI5Rs+1Vifcw4DJ8U=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0/go.mod h1:U7HYyW0zt/a9x5J1Kjs+r1f/d4ZHnYFclhYY2+YbeoE=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.32.0 h1:cMyu9O88joYEaI47CnQkxO1XZdpoTF9fEnW2duIddhw=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.32.0/go.mod h1:6Am3rn7P9TVVeXYG+wtcGE7IE1tsQ+bP3AuWcKt/gOI=
 go.opentelemetry.io/otel/exporters/prometheus v0.54.0 h1:rFwzp68QMgtzu9PgP3jm9XaMICI6TsofWWPcBDKwlsU=
@@ -324,46 +318,46 @@ go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.32.0 h1:cC2yDI3IQd0Udsu
 go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.32.0/go.mod h1:2PD5Ex6z8CFzDbTdOlwyNIUywRr1DN0ospafJM1wJ+s=
 go.opentelemetry.io/otel/log v0.8.0 h1:egZ8vV5atrUWUbnSsHn6vB8R21G2wrKqNiDt3iWertk=
 go.opentelemetry.io/otel/log v0.8.0/go.mod h1:M9qvDdUTRCopJcGRKg57+JSQ9LgLBrwwfC32epk5NX8=
-go.opentelemetry.io/otel/metric v1.33.0 h1:r+JOocAyeRVXD8lZpjdQjzMadVZp2M4WmQ+5WtEnklQ=
-go.opentelemetry.io/otel/metric v1.33.0/go.mod h1:L9+Fyctbp6HFTddIxClbQkjtubW6O9QS3Ann/M82u6M=
-go.opentelemetry.io/otel/sdk v1.33.0 h1:iax7M131HuAm9QkZotNHEfstof92xM+N8sr3uHXc2IM=
-go.opentelemetry.io/otel/sdk v1.33.0/go.mod h1:A1Q5oi7/9XaMlIWzPSxLRWOI8nG3FnzHJNbiENQuihM=
+go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
+go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
+go.opentelemetry.io/otel/sdk v1.34.0 h1:95zS4k/2GOy069d321O8jWgYsW3MzVV+KuSPKp7Wr1A=
+go.opentelemetry.io/otel/sdk v1.34.0/go.mod h1:0e/pNiaMAqaykJGKbi+tSjWfNNHMTxoC9qANsCzbyxU=
 go.opentelemetry.io/otel/sdk/log v0.8.0 h1:zg7GUYXqxk1jnGF/dTdLPrK06xJdrXgqgFLnI4Crxvs=
 go.opentelemetry.io/otel/sdk/log v0.8.0/go.mod h1:50iXr0UVwQrYS45KbruFrEt4LvAdCaWWgIrsN3ZQggo=
-go.opentelemetry.io/otel/sdk/metric v1.32.0 h1:rZvFnvmvawYb0alrYkjraqJq0Z4ZUJAiyYCU9snn1CU=
-go.opentelemetry.io/otel/sdk/metric v1.32.0/go.mod h1:PWeZlq0zt9YkYAp3gjKZ0eicRYvOh1Gd+X99x6GHpCQ=
-go.opentelemetry.io/otel/trace v1.33.0 h1:cCJuF7LRjUFso9LPnEAHJDB2pqzp+hbO8eu1qqW2d/s=
-go.opentelemetry.io/otel/trace v1.33.0/go.mod h1:uIcdVUZMpTAmz0tI1z04GoVSezK37CbGV4fr1f2nBck=
-go.opentelemetry.io/proto/otlp v1.4.0 h1:TA9WRvW6zMwP+Ssb6fLoUIuirti1gGbP28GcKG1jgeg=
-go.opentelemetry.io/proto/otlp v1.4.0/go.mod h1:PPBWZIP98o2ElSqI35IHfu7hIhSwvc5N38Jw8pXuGFY=
+go.opentelemetry.io/otel/sdk/metric v1.34.0 h1:5CeK9ujjbFVL5c1PhLuStg1wxA7vQv7ce1EK0Gyvahk=
+go.opentelemetry.io/otel/sdk/metric v1.34.0/go.mod h1:jQ/r8Ze28zRKoNRdkjCZxfs6YvBTG1+YIqyFVFYec5w=
+go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
+go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
+go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
+go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
 go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
-go.yaml.in/yaml/v3 v3.0.3 h1:bXOww4E/J3f66rav3pX3m8w6jDE4knZjGOw8b5Y6iNE=
-go.yaml.in/yaml/v3 v3.0.3/go.mod h1:tBHosrYAkRZjRAOREWbDnBXUf08JOwYq++0QNwQiWzI=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
-golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
+golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
+golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w=
-golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.26.0 h1:EGMPT//Ezu+ylkCijjPc+f4Aih7sZvaAr+O3EHBxvZg=
+golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
-golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
-golang.org/x/oauth2 v0.28.0 h1:CrgCKl8PPAVtLnU3c+EDw6x11699EWlsDeWNWKdIOkc=
-golang.org/x/oauth2 v0.28.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
+golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
-golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -373,33 +367,33 @@ golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
-golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg=
-golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
+golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.26.0 h1:P42AVeLghgTYr4+xUnTRKDMqpar+PtX7KWuNQL21L8M=
-golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA=
-golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
-golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.33.0 h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc=
-golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI=
+golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0=
+golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80 h1:KAeGQVN3M9nD0/bQXnr/ClcEMJ968gUXJQ9pwfSynuQ=
-google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 h1:CkkIfIt50+lT6NHAVoRYEyAvQGFM7xEwXUUywFvEb3Q=
-google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576/go.mod h1:1R3kvZ1dtP3+4p4d3G8uJ8rFk/fWlScl38vanWACI08=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:8ZmaLZE4XWrtU3MyClkYqqtl6Oegr3235h7jxsDyqCY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
-google.golang.org/grpc v1.68.1 h1:oI5oTa11+ng8r8XMMN7jAOmWfPZWbYpCFaMUTACxkM0=
-google.golang.org/grpc v1.68.1/go.mod h1:+q1XYFJjShcqn0QZHvCyeR4CXPA+llXIeUIfIe00waw=
+google.golang.org/genproto v0.0.0-20231211222908-989df2bf70f3 h1:1hfbdAfFbkmpg41000wDVqr7jUpK/Yo+LPnIxxGzmkg=
+google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb h1:p31xT4yrYrSM/G4Sn2+TNUkVhFCbG9y8itM2S6Th950=
+google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:jbe3Bkdp+Dh2IrslsFCklNhweNTBgSYanP1UXhJDhKg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb h1:TLPQVbx1GJ8VKZxz52VAxl1EBgKXXbTiU9Fc5fZeLn4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:LuRYeWDFV6WOn90g357N17oMCaxpgCnbi/44qJvDn2I=
+google.golang.org/grpc v1.72.1 h1:HR03wO6eyZ7lknl75XlxABNVLLFc2PAb6mHlYh756mA=
+google.golang.org/grpc v1.72.1/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
 google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
 google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -414,43 +408,41 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-helm.sh/helm/v3 v3.18.4 h1:pNhnHM3nAmDrxz6/UC+hfjDY4yeDATQCka2/87hkZXQ=
-helm.sh/helm/v3 v3.18.4/go.mod h1:WVnwKARAw01iEdjpEkP7Ii1tT1pTPYfM1HsakFKM3LI=
-k8s.io/api v0.33.2 h1:YgwIS5jKfA+BZg//OQhkJNIfie/kmRsO0BmNaVSimvY=
-k8s.io/api v0.33.2/go.mod h1:fhrbphQJSM2cXzCWgqU29xLDuks4mu7ti9vveEnpSXs=
-k8s.io/apiextensions-apiserver v0.33.2 h1:6gnkIbngnaUflR3XwE1mCefN3YS8yTD631JXQhsU6M8=
-k8s.io/apiextensions-apiserver v0.33.2/go.mod h1:IvVanieYsEHJImTKXGP6XCOjTwv2LUMos0YWc9O+QP8=
-k8s.io/apimachinery v0.33.2 h1:IHFVhqg59mb8PJWTLi8m1mAoepkUNYmptHsV+Z1m5jY=
-k8s.io/apimachinery v0.33.2/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
-k8s.io/apiserver v0.33.2 h1:KGTRbxn2wJagJowo29kKBp4TchpO1DRO3g+dB/KOJN4=
-k8s.io/apiserver v0.33.2/go.mod h1:9qday04wEAMLPWWo9AwqCZSiIn3OYSZacDyu/AcoM/M=
-k8s.io/cli-runtime v0.33.2 h1:koNYQKSDdq5AExa/RDudXMhhtFasEg48KLS2KSAU74Y=
-k8s.io/cli-runtime v0.33.2/go.mod h1:gnhsAWpovqf1Zj5YRRBBU7PFsRc6NkEkwYNQE+mXL88=
-k8s.io/client-go v0.33.2 h1:z8CIcc0P581x/J1ZYf4CNzRKxRvQAwoAolYPbtQes+E=
-k8s.io/client-go v0.33.2/go.mod h1:9mCgT4wROvL948w6f6ArJNb7yQd7QsvqavDeZHvNmHo=
-k8s.io/component-base v0.33.2 h1:sCCsn9s/dG3ZrQTX/Us0/Sx2R0G5kwa0wbZFYoVp/+0=
-k8s.io/component-base v0.33.2/go.mod h1:/41uw9wKzuelhN+u+/C59ixxf4tYQKW7p32ddkYNe2k=
+helm.sh/helm/v3 v3.19.0 h1:krVyCGa8fa/wzTZgqw0DUiXuRT5BPdeqE/sQXujQ22k=
+helm.sh/helm/v3 v3.19.0/go.mod h1:Lk/SfzN0w3a3C3o+TdAKrLwJ0wcZ//t1/SDXAvfgDdc=
+k8s.io/api v0.34.0 h1:L+JtP2wDbEYPUeNGbeSa/5GwFtIA662EmT2YSLOkAVE=
+k8s.io/api v0.34.0/go.mod h1:YzgkIzOOlhl9uwWCZNqpw6RJy9L2FK4dlJeayUoydug=
+k8s.io/apiextensions-apiserver v0.34.0 h1:B3hiB32jV7BcyKcMU5fDaDxk882YrJ1KU+ZSkA9Qxoc=
+k8s.io/apiextensions-apiserver v0.34.0/go.mod h1:hLI4GxE1BDBy9adJKxUxCEHBGZtGfIg98Q+JmTD7+g0=
+k8s.io/apimachinery v0.34.0 h1:eR1WO5fo0HyoQZt1wdISpFDffnWOvFLOOeJ7MgIv4z0=
+k8s.io/apimachinery v0.34.0/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
+k8s.io/apiserver v0.34.0 h1:Z51fw1iGMqN7uJ1kEaynf2Aec1Y774PqU+FVWCFV3Jg=
+k8s.io/apiserver v0.34.0/go.mod h1:52ti5YhxAvewmmpVRqlASvaqxt0gKJxvCeW7ZrwgazQ=
+k8s.io/cli-runtime v0.34.0 h1:N2/rUlJg6TMEBgtQ3SDRJwa8XyKUizwjlOknT1mB2Cw=
+k8s.io/cli-runtime v0.34.0/go.mod h1:t/skRecS73Piv+J+FmWIQA2N2/rDjdYSQzEE67LUUs8=
+k8s.io/client-go v0.34.0 h1:YoWv5r7bsBfb0Hs2jh8SOvFbKzzxyNo0nSb0zC19KZo=
+k8s.io/client-go v0.34.0/go.mod h1:ozgMnEKXkRjeMvBZdV1AijMHLTh3pbACPvK7zFR+QQY=
+k8s.io/component-base v0.34.0 h1:bS8Ua3zlJzapklsB1dZgjEJuJEeHjj8yTu1gxE2zQX8=
+k8s.io/component-base v0.34.0/go.mod h1:RSCqUdvIjjrEm81epPcjQ/DS+49fADvGSCkIP3IC6vg=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUyGcf03XZEP0ZIKgKj35LS4=
-k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
-k8s.io/kubectl v0.33.2 h1:7XKZ6DYCklu5MZQzJe+CkCjoGZwD1wWl7t/FxzhMz7Y=
-k8s.io/kubectl v0.33.2/go.mod h1:8rC67FB8tVTYraovAGNi/idWIK90z2CHFNMmGJZJ3KI=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b h1:MloQ9/bdJyIu9lb1PzujOPolHyvO06MXG5TUIj2mNAA=
+k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b/go.mod h1:UZ2yyWbFTpuhSbFhv24aGNOdoRdJZgsIObGBUaYVsts=
+k8s.io/kubectl v0.34.0 h1:NcXz4TPTaUwhiX4LU+6r6udrlm0NsVnSkP3R9t0dmxs=
+k8s.io/kubectl v0.34.0/go.mod h1:bmd0W5i+HuG7/p5sqicr0Li0rR2iIhXL0oUyLF3OjR4=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
 oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
-sigs.k8s.io/kustomize/api v0.19.0 h1:F+2HB2mU1MSiR9Hp1NEgoU2q9ItNOaBJl0I4Dlus5SQ=
-sigs.k8s.io/kustomize/api v0.19.0/go.mod h1:/BbwnivGVcBh1r+8m3tH1VNxJmHSk1PzP5fkP6lbL1o=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/kustomize/api v0.20.1 h1:iWP1Ydh3/lmldBnH/S5RXgT98vWYMaTUL1ADcr+Sv7I=
+sigs.k8s.io/kustomize/api v0.20.1/go.mod h1:t6hUFxO+Ph0VxIk1sKp1WS0dOjbPCtLJ4p8aADLwqjM=
 sigs.k8s.io/kustomize/kyaml v0.20.1 h1:PCMnA2mrVbRP3NIB6v9kYCAc38uvFLVs8j/CD567A78=
 sigs.k8s.io/kustomize/kyaml v0.20.1/go.mod h1:0EmkQHRUsJxY8Ug9Niig1pUMSCGHxQ5RklbpV/Ri6po=
-sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v4 v4.6.0 h1:IUA9nvMmnKWcj5jl84xn+T5MnlZKThmUW1TdblaLVAc=
-sigs.k8s.io/structured-merge-diff/v4 v4.6.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
-sigs.k8s.io/yaml v1.5.0 h1:M10b2U7aEUY6hRtU870n2VTPgR5RZiL/I6Lcc2F4NUQ=
-sigs.k8s.io/yaml v1.5.0/go.mod h1:wZs27Rbxoai4C0f8/9urLZtZtF3avA3gKvGyPdDqTO4=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/hack/manifest-gen/manifest-gen.sh b/hack/manifest-gen/manifest-gen.sh
index 448d33306..e3cb3e363 100755
--- a/hack/manifest-gen/manifest-gen.sh
+++ b/hack/manifest-gen/manifest-gen.sh
@@ -37,10 +37,12 @@ update_chart() {
     "$SED" -E "s#version: [0-9]+\.[0-9]+\.[0-9]+.*#version: $VERSION#" "${CRD_CHART_DIR}/Chart.yaml"
 }
 
+# shellcheck disable=SC2329
 sed_gnu() {
     sed -i "$@"
 }
 
+# shellcheck disable=SC2329
 sed_bsd() {
     sed -i '' "$@"
 }
diff --git a/hack/operatorhub/go.mod b/hack/operatorhub/go.mod
index 66d51a385..8c734ca1c 100644
--- a/hack/operatorhub/go.mod
+++ b/hack/operatorhub/go.mod
@@ -7,14 +7,14 @@ require (
 	github.com/ghodss/yaml v1.0.0
 	github.com/go-git/go-git/v5 v5.16.2
 	github.com/google/go-containerregistry v0.20.6
-	github.com/hashicorp/vault/api v1.20.0
+	github.com/hashicorp/vault/api v1.21.0
 	github.com/otiai10/copy v1.14.1
-	github.com/spf13/cobra v1.9.1
-	github.com/spf13/viper v1.20.1
-	k8s.io/api v0.33.3
-	k8s.io/apiextensions-apiserver v0.33.3
-	k8s.io/apimachinery v0.33.3
-	k8s.io/kubectl v0.33.3
+	github.com/spf13/cobra v1.10.1
+	github.com/spf13/viper v1.21.0
+	k8s.io/api v0.34.1
+	k8s.io/apiextensions-apiserver v0.34.1
+	k8s.io/apimachinery v0.34.1
+	k8s.io/kubectl v0.34.1
 )
 
 require (
@@ -23,19 +23,21 @@ require (
 	github.com/cloudflare/circl v1.6.1 // indirect
 	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/docker/cli v28.2.2+incompatible // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
-	github.com/go-viper/mapstructure/v2 v2.3.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.1 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pjbgf/sha1cd v0.3.2 // indirect
-	github.com/sagikazarmark/locafero v0.7.0 // indirect
+	github.com/sagikazarmark/locafero v0.11.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/skeema/knownhosts v1.3.1 // indirect
-	github.com/sourcegraph/conc v0.3.0 // indirect
+	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	go.uber.org/multierr v1.11.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	gotest.tools/v3 v3.4.0 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
 )
 
 require (
@@ -47,7 +49,7 @@ require (
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.3 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
-	github.com/fsnotify/fsnotify v1.8.0 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.6.2 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
@@ -57,11 +59,11 @@ require (
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
-	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 // indirect
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
-	github.com/hashicorp/go-sockaddr v1.0.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
 	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
@@ -74,34 +76,32 @@ require (
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
-	github.com/spf13/afero v1.12.0 // indirect
-	github.com/spf13/cast v1.7.1 // indirect
-	github.com/spf13/pflag v1.0.7
+	github.com/spf13/afero v1.15.0 // indirect
+	github.com/spf13/cast v1.10.0 // indirect
+	github.com/spf13/pflag v1.0.10
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/vbatts/tar-split v0.12.1 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
-	golang.org/x/crypto v0.37.0 // indirect
-	golang.org/x/net v0.39.0 // indirect
-	golang.org/x/sync v0.15.0 // indirect
-	golang.org/x/sys v0.33.0 // indirect
-	golang.org/x/text v0.24.0 // indirect
-	golang.org/x/time v0.9.0 // indirect
+	golang.org/x/crypto v0.40.0 // indirect
+	golang.org/x/net v0.42.0 // indirect
+	golang.org/x/sync v0.16.0 // indirect
+	golang.org/x/sys v0.34.0 // indirect
+	golang.org/x/text v0.28.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/client-go v0.33.3 // indirect
+	k8s.io/client-go v0.34.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
-	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )
diff --git a/hack/operatorhub/go.sum b/hack/operatorhub/go.sum
index 3a4f91dbb..dae080b25 100644
--- a/hack/operatorhub/go.sum
+++ b/hack/operatorhub/go.sum
@@ -13,10 +13,8 @@ github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNx
 github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
@@ -39,15 +37,14 @@ github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o
 github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
-github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
-github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
-github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
@@ -60,20 +57,19 @@ github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMj
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
 github.com/go-git/go-git/v5 v5.16.2 h1:fT6ZIOjE5iEnkzKyxTHK1W4HGAsPhqEqiSAssSO77hM=
 github.com/go-git/go-git/v5 v5.16.2/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8=
-github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
-github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
+github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
+github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-test/deep v1.0.2 h1:onZX1rnHT3Wv6cqNgYyFOOlgVKJrksuCMCRvJStbMYw=
-github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/go-viper/mapstructure/v2 v2.3.0 h1:27XbWsHIqhbdR5TIC911OfYvgSaW93HM+dX7970Q7jk=
-github.com/go-viper/mapstructure/v2 v2.3.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-containerregistry v0.20.6 h1:cvWX87UxxLgaH76b4hIvya6Dzz9qHB31qAwjAohdSTU=
@@ -88,24 +84,22 @@ github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9n
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
 github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
-github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 h1:om4Al8Oy7kCm/B86rLCLah4Dt5Aa0Fr5rYBG60OzwHQ=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 h1:U+kC2dOhMFQctRfhK0gRctKAPTloZdMU5ZJxaesJ/VM=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
-github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
-github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
+github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
+github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
 github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
 github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
-github.com/hashicorp/vault/api v1.20.0 h1:KQMHElgudOsr+IbJgmbjHnCTxEpKs9LnozA1D3nozU4=
-github.com/hashicorp/vault/api v1.20.0/go.mod h1:GZ4pcjfzoOWpkJ3ijHNpEoAxKEsBJnVljyTe3jM2Sms=
+github.com/hashicorp/vault/api v1.21.0 h1:Xej4LJETV/spWRdjreb2vzQhEZt4+B5yxHAObfQVDOs=
+github.com/hashicorp/vault/api v1.21.0/go.mod h1:IUZA2cDvr4Ok3+NtK2Oq/r+lJeXkeCrHRmqdyWfpmGM=
 github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
 github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
@@ -127,19 +121,14 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
-github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
@@ -147,8 +136,9 @@ github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/onsi/gomega v1.35.1 h1:Cwbd75ZBPxFSuZ6T+rN/WCb/gOc6YgFBXLlZLhC7Ds4=
 github.com/onsi/gomega v1.35.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -159,23 +149,21 @@ github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
 github.com/otiai10/mint v1.6.3/go.mod h1:MJm72SBthJjz8qhefc4z1PYEieWmy8Bku7CjcAqyUSM=
-github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
-github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
 github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
-github.com/sagikazarmark/locafero v0.7.0 h1:5MqpDsTGNDhY8sGp0Aowyf0qKsPrhewaLSsFaodPcyo=
-github.com/sagikazarmark/locafero v0.7.0/go.mod h1:2za3Cg5rMaTMoG/2Ulr9AwtFaIppKXTRYnozin4aB5k=
+github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
+github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
@@ -185,26 +173,26 @@ github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
 github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
-github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
-github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
-github.com/spf13/afero v1.12.0 h1:UcOPyRBYczmFn6yvphxkn9ZEOY65cpwGKb5mL36mrqs=
-github.com/spf13/afero v1.12.0/go.mod h1:ZTlWwG4/ahT8W7T0WQ5uYmjI9duaLQGy3Q2OAl4sk/4=
-github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
-github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
-github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
-github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
-github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.20.1 h1:ZMi+z/lvLyPSCoNtFCpqjy0S4kPbirhpTMwl8BkW9X4=
-github.com/spf13/viper v1.20.1/go.mod h1:P9Mdzt1zoHIG8m2eZQinpiBjo6kCmZSKBClNNqjJvu4=
+github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 h1:+jumHNA0Wrelhe64i8F6HNlS8pkoyMv5sreGx2Ry5Rw=
+github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8/go.mod h1:3n1Cwaq1E1/1lhQhtRK2ts/ZwZEhjcQeJQ1RuC6Q/8U=
+github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
+github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
+github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
+github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
+github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s=
+github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
+github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 github.com/vbatts/tar-split v0.12.1 h1:CqKoORW7BUWBe7UL/iqTVvkTBOF8UvOMKOIZykxnnbo=
@@ -215,14 +203,16 @@ github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM
 github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
-go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
-golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
+golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
+golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -230,14 +220,13 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
-golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
+golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
-golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -248,18 +237,18 @@ golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
-golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.31.0 h1:erwDkOK1Msy6offm1mOgvspSkslFnIGsFnxOKoufg3o=
-golang.org/x/term v0.31.0/go.mod h1:R4BeIy7D95HzImkxGkTW1UQTtP54tio2RyHz7PwK0aw=
+golang.org/x/term v0.33.0 h1:NuFncQrRcaRvVmgRkvM3j/F00gWIAlcmlB8ACEKmGIg=
+golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
-golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
-golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
-golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
@@ -285,26 +274,25 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
 gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
-k8s.io/api v0.33.3 h1:SRd5t//hhkI1buzxb288fy2xvjubstenEKL9K51KBI8=
-k8s.io/api v0.33.3/go.mod h1:01Y/iLUjNBM3TAvypct7DIj0M0NIZc+PzAHCIo0CYGE=
-k8s.io/apiextensions-apiserver v0.33.3 h1:qmOcAHN6DjfD0v9kxL5udB27SRP6SG/MTopmge3MwEs=
-k8s.io/apiextensions-apiserver v0.33.3/go.mod h1:oROuctgo27mUsyp9+Obahos6CWcMISSAPzQ77CAQGz8=
-k8s.io/apimachinery v0.33.3 h1:4ZSrmNa0c/ZpZJhAgRdcsFcZOw1PQU1bALVQ0B3I5LA=
-k8s.io/apimachinery v0.33.3/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
-k8s.io/client-go v0.33.3 h1:M5AfDnKfYmVJif92ngN532gFqakcGi6RvaOF16efrpA=
-k8s.io/client-go v0.33.3/go.mod h1:luqKBQggEf3shbxHY4uVENAxrDISLOarxpTKMiUuujg=
+k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
+k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
+k8s.io/apiextensions-apiserver v0.34.1 h1:NNPBva8FNAPt1iSVwIE0FsdrVriRXMsaWFMqJbII2CI=
+k8s.io/apiextensions-apiserver v0.34.1/go.mod h1:hP9Rld3zF5Ay2Of3BeEpLAToP+l4s5UlxiHfqRaRcMc=
+k8s.io/apimachinery v0.34.1 h1:dTlxFls/eikpJxmAC7MVE8oOeP1zryV7iRyIjB0gky4=
+k8s.io/apimachinery v0.34.1/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
+k8s.io/client-go v0.34.1 h1:ZUPJKgXsnKwVwmKKdPfw4tB58+7/Ik3CrjOEhsiZ7mY=
+k8s.io/client-go v0.34.1/go.mod h1:kA8v0FP+tk6sZA0yKLRG67LWjqufAoSHA2xVGKw9Of8=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kubectl v0.33.3 h1:r/phHvH1iU7gO/l7tTjQk2K01ER7/OAJi8uFHHyWSac=
-k8s.io/kubectl v0.33.3/go.mod h1:euj2bG56L6kUGOE/ckZbCoudPwuj4Kud7BR0GzyNiT0=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
-sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+k8s.io/kubectl v0.34.1 h1:1qP1oqT5Xc93K+H8J7ecpBjaz511gan89KO9Vbsh/OI=
+k8s.io/kubectl v0.34.1/go.mod h1:JRYlhJpGPyk3dEmJ+BuBiOB9/dAvnrALJEiY/C5qa6A=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v4 v4.6.0 h1:IUA9nvMmnKWcj5jl84xn+T5MnlZKThmUW1TdblaLVAc=
-sigs.k8s.io/structured-merge-diff/v4 v4.6.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/hack/release-notes/go.mod b/hack/release-notes/go.mod
index 70d958ec0..3078b4105 100644
--- a/hack/release-notes/go.mod
+++ b/hack/release-notes/go.mod
@@ -1,13 +1,13 @@
 module github.com/elastic/cloud-on-k8s/v3/hack/release-notes
 
-go 1.23.0
+go 1.24.0
 
-toolchain go1.24.5
+toolchain go1.25.1
 
 require (
-	github.com/stretchr/testify v1.10.0
-	golang.org/x/net v0.42.0
-	golang.org/x/oauth2 v0.30.0
+	github.com/stretchr/testify v1.11.1
+	golang.org/x/net v0.44.0
+	golang.org/x/oauth2 v0.31.0
 )
 
 require (
diff --git a/hack/release-notes/go.sum b/hack/release-notes/go.sum
index e1482baa4..c9482f512 100644
--- a/hack/release-notes/go.sum
+++ b/hack/release-notes/go.sum
@@ -2,12 +2,12 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
-golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
-golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
-golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+golang.org/x/net v0.44.0 h1:evd8IRDyfNBMBTTY5XRF1vaZlD+EmWx6x8PkhR04H/I=
+golang.org/x/net v0.44.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
+golang.org/x/oauth2 v0.31.0 h1:8Fq0yVZLh4j4YA47vHKFTa9Ew5XIrCP8LC6UeNZnLxo=
+golang.org/x/oauth2 v0.31.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
diff --git a/hack/upgrade-test-harness/go.mod b/hack/upgrade-test-harness/go.mod
index f0a569744..807d5c752 100644
--- a/hack/upgrade-test-harness/go.mod
+++ b/hack/upgrade-test-harness/go.mod
@@ -7,14 +7,14 @@ require (
 	github.com/ghodss/yaml v1.0.0
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/jonboulle/clockwork v0.5.0
-	github.com/spf13/cobra v1.9.1
+	github.com/spf13/cobra v1.10.1
 	go.uber.org/zap v1.27.0
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/api v0.33.3
-	k8s.io/apimachinery v0.33.3
-	k8s.io/cli-runtime v0.33.3
-	k8s.io/client-go v0.33.3
-	k8s.io/kubectl v0.33.3
+	k8s.io/api v0.34.1
+	k8s.io/apimachinery v0.34.1
+	k8s.io/cli-runtime v0.34.1
+	k8s.io/client-go v0.34.1
+	k8s.io/kubectl v0.34.1
 )
 
 require (
@@ -22,10 +22,10 @@ require (
 	github.com/MakeNowJust/heredoc v1.0.0 // indirect
 	github.com/chai2010/gettext-go v1.0.2 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
 	github.com/fatih/camelcase v1.0.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
@@ -33,9 +33,8 @@ require (
 	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/google/btree v1.1.3 // indirect
-	github.com/google/gnostic-models v0.6.9 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
@@ -49,17 +48,20 @@ require (
 	github.com/moby/spdystream v0.5.0 // indirect
 	github.com/moby/term v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/spf13/pflag v1.0.9 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/net v0.38.0 // indirect
 	golang.org/x/oauth2 v0.27.0 // indirect
 	golang.org/x/sync v0.12.0 // indirect
@@ -71,15 +73,15 @@ require (
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	k8s.io/component-base v0.33.3 // indirect
-	k8s.io/component-helpers v0.33.3 // indirect
+	k8s.io/component-base v0.34.1 // indirect
+	k8s.io/component-helpers v0.34.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
-	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
-	sigs.k8s.io/kustomize/api v0.19.0 // indirect
-	sigs.k8s.io/kustomize/kyaml v0.19.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
+	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
+	sigs.k8s.io/kustomize/api v0.20.1 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.20.1 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )
diff --git a/hack/upgrade-test-harness/go.sum b/hack/upgrade-test-harness/go.sum
index 2c2c7c4d4..460664f2a 100644
--- a/hack/upgrade-test-harness/go.sum
+++ b/hack/upgrade-test-harness/go.sum
@@ -16,14 +16,14 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
-github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
+github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f h1:Wl78ApPPB2Wvf/TIe2xdyJxTlb6obmF18d8QdkxNDu4=
 github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f/go.mod h1:OSYXu++VVOHnXeitef/D8n/6y4QV8uLHSFXX4NeXMGc=
 github.com/fatih/camelcase v1.0.0 h1:hxNvNX/xYBp0ovncs8WyWZrOrpBNub/JfaMvbURyft8=
 github.com/fatih/camelcase v1.0.0/go.mod h1:yN2Sb0lFhZJUdVvtELVWefmrXpuZESvPmqwoZc+/fpc=
-github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
-github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
@@ -44,16 +44,13 @@ github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
-github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
-github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
 github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
-github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
-github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
@@ -96,8 +93,9 @@ github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
@@ -120,10 +118,10 @@ github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
-github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
-github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s=
+github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0=
+github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
@@ -149,6 +147,10 @@ go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -205,36 +207,35 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.33.3 h1:SRd5t//hhkI1buzxb288fy2xvjubstenEKL9K51KBI8=
-k8s.io/api v0.33.3/go.mod h1:01Y/iLUjNBM3TAvypct7DIj0M0NIZc+PzAHCIo0CYGE=
-k8s.io/apimachinery v0.33.3 h1:4ZSrmNa0c/ZpZJhAgRdcsFcZOw1PQU1bALVQ0B3I5LA=
-k8s.io/apimachinery v0.33.3/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
-k8s.io/cli-runtime v0.33.3 h1:Dgy4vPjNIu8LMJBSvs8W0LcdV0PX/8aGG1DA1W8lklA=
-k8s.io/cli-runtime v0.33.3/go.mod h1:yklhLklD4vLS8HNGgC9wGiuHWze4g7x6XQZ+8edsKEo=
-k8s.io/client-go v0.33.3 h1:M5AfDnKfYmVJif92ngN532gFqakcGi6RvaOF16efrpA=
-k8s.io/client-go v0.33.3/go.mod h1:luqKBQggEf3shbxHY4uVENAxrDISLOarxpTKMiUuujg=
-k8s.io/component-base v0.33.3 h1:mlAuyJqyPlKZM7FyaoM/LcunZaaY353RXiOd2+B5tGA=
-k8s.io/component-base v0.33.3/go.mod h1:ktBVsBzkI3imDuxYXmVxZ2zxJnYTZ4HAsVj9iF09qp4=
-k8s.io/component-helpers v0.33.3 h1:fjWVORSQfI0WKzPeIFSju/gMD9sybwXBJ7oPbqQu6eM=
-k8s.io/component-helpers v0.33.3/go.mod h1:7iwv+Y9Guw6X4RrnNQOyQlXcvJrVjPveHVqUA5dm31c=
+k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
+k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
+k8s.io/apimachinery v0.34.1 h1:dTlxFls/eikpJxmAC7MVE8oOeP1zryV7iRyIjB0gky4=
+k8s.io/apimachinery v0.34.1/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
+k8s.io/cli-runtime v0.34.1 h1:btlgAgTrYd4sk8vJTRG6zVtqBKt9ZMDeQZo2PIzbL7M=
+k8s.io/cli-runtime v0.34.1/go.mod h1:aVA65c+f0MZiMUPbseU/M9l1Wo2byeaGwUuQEQVVveE=
+k8s.io/client-go v0.34.1 h1:ZUPJKgXsnKwVwmKKdPfw4tB58+7/Ik3CrjOEhsiZ7mY=
+k8s.io/client-go v0.34.1/go.mod h1:kA8v0FP+tk6sZA0yKLRG67LWjqufAoSHA2xVGKw9Of8=
+k8s.io/component-base v0.34.1 h1:v7xFgG+ONhytZNFpIz5/kecwD+sUhVE6HU7qQUiRM4A=
+k8s.io/component-base v0.34.1/go.mod h1:mknCpLlTSKHzAQJJnnHVKqjxR7gBeHRv0rPXA7gdtQ0=
+k8s.io/component-helpers v0.34.1 h1:gWhH3CCdwAx5P3oJqZKb4Lg5FYZTWVbdWtOI8n9U4XY=
+k8s.io/component-helpers v0.34.1/go.mod h1:4VgnUH7UA/shuBur+OWoQC0xfb69sy/93ss0ybZqm3c=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUyGcf03XZEP0ZIKgKj35LS4=
-k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
-k8s.io/kubectl v0.33.3 h1:r/phHvH1iU7gO/l7tTjQk2K01ER7/OAJi8uFHHyWSac=
-k8s.io/kubectl v0.33.3/go.mod h1:euj2bG56L6kUGOE/ckZbCoudPwuj4Kud7BR0GzyNiT0=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
-sigs.k8s.io/kustomize/api v0.19.0 h1:F+2HB2mU1MSiR9Hp1NEgoU2q9ItNOaBJl0I4Dlus5SQ=
-sigs.k8s.io/kustomize/api v0.19.0/go.mod h1:/BbwnivGVcBh1r+8m3tH1VNxJmHSk1PzP5fkP6lbL1o=
-sigs.k8s.io/kustomize/kyaml v0.19.0 h1:RFge5qsO1uHhwJsu3ipV7RNolC7Uozc0jUBC/61XSlA=
-sigs.k8s.io/kustomize/kyaml v0.19.0/go.mod h1:FeKD5jEOH+FbZPpqUghBP8mrLjJ3+zD3/rf9NNu1cwY=
-sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b h1:MloQ9/bdJyIu9lb1PzujOPolHyvO06MXG5TUIj2mNAA=
+k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b/go.mod h1:UZ2yyWbFTpuhSbFhv24aGNOdoRdJZgsIObGBUaYVsts=
+k8s.io/kubectl v0.34.1 h1:1qP1oqT5Xc93K+H8J7ecpBjaz511gan89KO9Vbsh/OI=
+k8s.io/kubectl v0.34.1/go.mod h1:JRYlhJpGPyk3dEmJ+BuBiOB9/dAvnrALJEiY/C5qa6A=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/kustomize/api v0.20.1 h1:iWP1Ydh3/lmldBnH/S5RXgT98vWYMaTUL1ADcr+Sv7I=
+sigs.k8s.io/kustomize/api v0.20.1/go.mod h1:t6hUFxO+Ph0VxIk1sKp1WS0dOjbPCtLJ4p8aADLwqjM=
+sigs.k8s.io/kustomize/kyaml v0.20.1 h1:PCMnA2mrVbRP3NIB6v9kYCAc38uvFLVs8j/CD567A78=
+sigs.k8s.io/kustomize/kyaml v0.20.1/go.mod h1:0EmkQHRUsJxY8Ug9Niig1pUMSCGHxQ5RklbpV/Ri6po=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v4 v4.6.0 h1:IUA9nvMmnKWcj5jl84xn+T5MnlZKThmUW1TdblaLVAc=
-sigs.k8s.io/structured-merge-diff/v4 v4.6.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/pkg/apis/agent/v1alpha1/agent_types.go b/pkg/apis/agent/v1alpha1/agent_types.go
index 3d20837f0..f6fb7d4ac 100644
--- a/pkg/apis/agent/v1alpha1/agent_types.go
+++ b/pkg/apis/agent/v1alpha1/agent_types.go
@@ -106,6 +106,7 @@ type AgentSpec struct {
 
 	// FleetServerRef is a reference to Fleet Server that this Agent should connect to to obtain it's configuration.
 	// Don't set unless `mode` is set to `fleet`.
+	// References to Fleet servers running outside the Kubernetes cluster via the `secretName` attribute are not supported.
 	// +kubebuilder:validation:Optional
 	FleetServerRef commonv1.ObjectSelector `json:"fleetServerRef,omitempty"`
 }
diff --git a/pkg/apis/agent/v1alpha1/webhook.go b/pkg/apis/agent/v1alpha1/webhook.go
index 86a1cc35b..73b8ea25e 100644
--- a/pkg/apis/agent/v1alpha1/webhook.go
+++ b/pkg/apis/agent/v1alpha1/webhook.go
@@ -29,7 +29,7 @@ var (
 	validationLog = ulog.Log.WithName("agent-v1alpha1-validation")
 )
 
-// +kubebuilder:webhook:path=/validate-agent-k8s-elastic-co-v1alpha1-agent,mutating=false,failurePolicy=ignore,groups=agent.k8s.elastic.co,resources=agents,verbs=create;update,versions=v1alpha1,name=elastic-agent-validation-v1alpha1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1;v1beta1,matchPolicy=Exact
+// +kubebuilder:webhook:path=/validate-agent-k8s-elastic-co-v1alpha1-agent,mutating=false,failurePolicy=ignore,groups=agent.k8s.elastic.co,resources=agents,verbs=create;update,versions=v1alpha1,name=elastic-agent-validation-v1alpha1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1,matchPolicy=Exact
 
 var _ admission.Validator = &Agent{}
 
diff --git a/pkg/apis/apm/v1/webhook.go b/pkg/apis/apm/v1/webhook.go
index 07fc17d7c..b3caf0be8 100644
--- a/pkg/apis/apm/v1/webhook.go
+++ b/pkg/apis/apm/v1/webhook.go
@@ -44,7 +44,7 @@ var (
 	}
 )
 
-// +kubebuilder:webhook:path=/validate-apm-k8s-elastic-co-v1-apmserver,mutating=false,failurePolicy=ignore,groups=apm.k8s.elastic.co,resources=apmservers,verbs=create;update,versions=v1,name=elastic-apm-validation-v1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1;v1beta1,matchPolicy=Exact
+// +kubebuilder:webhook:path=/validate-apm-k8s-elastic-co-v1-apmserver,mutating=false,failurePolicy=ignore,groups=apm.k8s.elastic.co,resources=apmservers,verbs=create;update,versions=v1,name=elastic-apm-validation-v1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1,matchPolicy=Exact
 
 var _ admission.Validator = &ApmServer{}
 
diff --git a/pkg/apis/apm/v1beta1/webhook.go b/pkg/apis/apm/v1beta1/webhook.go
index aa8443183..6f520e147 100644
--- a/pkg/apis/apm/v1beta1/webhook.go
+++ b/pkg/apis/apm/v1beta1/webhook.go
@@ -38,7 +38,7 @@ var (
 	}
 )
 
-// +kubebuilder:webhook:path=/validate-apm-k8s-elastic-co-v1beta1-apmserver,mutating=false,failurePolicy=ignore,groups=apm.k8s.elastic.co,resources=apmservers,verbs=create;update,versions=v1beta1,name=elastic-apm-validation-v1beta1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1;v1beta1,matchPolicy=Exact
+// +kubebuilder:webhook:path=/validate-apm-k8s-elastic-co-v1beta1-apmserver,mutating=false,failurePolicy=ignore,groups=apm.k8s.elastic.co,resources=apmservers,verbs=create;update,versions=v1beta1,name=elastic-apm-validation-v1beta1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1,matchPolicy=Exact
 
 var _ admission.Validator = &ApmServer{}
 
diff --git a/pkg/apis/beat/v1beta1/webhook.go b/pkg/apis/beat/v1beta1/webhook.go
index a4662e437..3f050539f 100644
--- a/pkg/apis/beat/v1beta1/webhook.go
+++ b/pkg/apis/beat/v1beta1/webhook.go
@@ -26,7 +26,7 @@ var (
 	validationLog = ulog.Log.WithName("beat-v1beta1-validation")
 )
 
-// +kubebuilder:webhook:path=/validate-beat-k8s-elastic-co-v1beta1-beat,mutating=false,failurePolicy=ignore,groups=beat.k8s.elastic.co,resources=beats,verbs=create;update,versions=v1beta1,name=elastic-beat-validation-v1beta1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1;v1beta1,matchPolicy=Exact
+// +kubebuilder:webhook:path=/validate-beat-k8s-elastic-co-v1beta1-beat,mutating=false,failurePolicy=ignore,groups=beat.k8s.elastic.co,resources=beats,verbs=create;update,versions=v1beta1,name=elastic-beat-validation-v1beta1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1,matchPolicy=Exact
 
 var _ admission.Validator = &Beat{}
 
diff --git a/pkg/apis/common/v1/common.go b/pkg/apis/common/v1/common.go
index e2fc6bc29..509bad65e 100644
--- a/pkg/apis/common/v1/common.go
+++ b/pkg/apis/common/v1/common.go
@@ -115,7 +115,8 @@ type ObjectSelector struct {
 	ServiceName string `json:"serviceName,omitempty"`
 
 	// SecretName is the name of an existing Kubernetes secret that contains connection information for associating an
-	// Elastic resource not managed by the operator. The referenced secret must contain the following:
+	// Elastic resource not managed by the operator.
+	// The referenced secret must contain the following:
 	// - `url`: the URL to reach the Elastic resource
 	// - `username`: the username of the user to be authenticated to the Elastic resource
 	// - `password`: the password of the user to be authenticated to the Elastic resource
@@ -275,6 +276,14 @@ func (p *PodDisruptionBudgetTemplate) IsDisabled() bool {
 	return reflect.DeepEqual(p, &PodDisruptionBudgetTemplate{})
 }
 
+// IsSpecified returns true if the PodDisruptionBudget is specified (not nil, and has a non-empty spec).
+func (p *PodDisruptionBudgetTemplate) IsSpecified() bool {
+	return p != nil && (p.Spec.Selector != nil ||
+		p.Spec.MinAvailable != nil ||
+		p.Spec.MaxUnavailable != nil ||
+		p.Spec.UnhealthyPodEvictionPolicy != nil)
+}
+
 // NamespacedSecretSource defines a data source based on a Kubernetes Secret in a given namespace.
 type NamespacedSecretSource struct {
 	// Namespace is the namespace of the secret.
diff --git a/pkg/apis/elasticsearch/v1/elasticsearch_config.go b/pkg/apis/elasticsearch/v1/elasticsearch_config.go
index 52a39dbe6..be7c0f356 100644
--- a/pkg/apis/elasticsearch/v1/elasticsearch_config.go
+++ b/pkg/apis/elasticsearch/v1/elasticsearch_config.go
@@ -16,6 +16,7 @@ import (
 type NodeRole string
 
 const (
+	CoordinatingRole        NodeRole = ""
 	DataColdRole            NodeRole = "data_cold"
 	DataContentRole         NodeRole = "data_content"
 	DataFrozenRole          NodeRole = "data_frozen"
@@ -129,6 +130,8 @@ func (n *Node) IsConfiguredWithRole(role NodeRole) bool {
 		return ptr.Deref(n.Transform, n.IsConfiguredWithRole(DataRole))
 	case VotingOnlyRole:
 		return ptr.Deref(n.VotingOnly, false)
+	case CoordinatingRole:
+		return n.Roles != nil && len(n.Roles) == 0
 	}
 
 	// This point should never be reached. The default is to assume that a node has all roles except voting_only.
diff --git a/pkg/apis/elasticsearch/v1/elasticsearch_types.go b/pkg/apis/elasticsearch/v1/elasticsearch_types.go
index 7744c589b..edb148e04 100644
--- a/pkg/apis/elasticsearch/v1/elasticsearch_types.go
+++ b/pkg/apis/elasticsearch/v1/elasticsearch_types.go
@@ -103,10 +103,18 @@ type ElasticsearchSpec struct {
 	// +kubebuilder:validation:Optional
 	UpdateStrategy UpdateStrategy `json:"updateStrategy,omitempty"`
 
-	// PodDisruptionBudget provides access to the default Pod disruption budget for the Elasticsearch cluster.
-	// The default budget doesn't allow any Pod to be removed in case the cluster is not green or if there is only one node of type `data` or `master`.
-	// In all other cases the default PodDisruptionBudget sets `minUnavailable` equal to the total number of nodes minus 1.
-	// To disable, set `PodDisruptionBudget` to the empty value (`{}` in YAML).
+	// PodDisruptionBudget provides access to the default Pod disruption budget(s) for the Elasticsearch cluster.
+	// The behavior depends on the license level.
+	// With a Basic license or if podDisruptionBudget.spec is not empty:
+	//   The default budget doesn't allow any Pod to be removed in case the cluster is not green or if there is only one node of type `data` or `master`.
+	//   In all other cases the default podDisruptionBudget sets `minUnavailable` equal to the total number of nodes minus 1.
+	// With an Enterprise license and if podDisruptionBudget.spec is empty:
+	//   The default budget is split into multiple budgets, each targeting a specific node role type allowing additional disruptions
+	//   for certain roles according to the health status of the cluster.
+	//     Example:
+	//       All data roles (excluding frozen): allows disruptions only when the cluster is green.
+	//       All other roles: allows disruptions only when the cluster is yellow or green.
+	// To disable, set `podDisruptionBudget` to the empty value (`{}` in YAML).
 	// +kubebuilder:validation:Optional
 	PodDisruptionBudget *commonv1.PodDisruptionBudgetTemplate `json:"podDisruptionBudget,omitempty"`
 
diff --git a/pkg/apis/elasticsearch/v1/name.go b/pkg/apis/elasticsearch/v1/name.go
index c7f729097..772964e75 100644
--- a/pkg/apis/elasticsearch/v1/name.go
+++ b/pkg/apis/elasticsearch/v1/name.go
@@ -200,3 +200,12 @@ func StackConfigAdditionalSecretName(esName string, secretName string) string {
 	secretNameHash := hash.HashObject(secretName)
 	return ESNamer.Suffix(esName, "scp", secretNameHash)
 }
+
+// PodDisruptionBudgetNameForRole returns the name of the PodDisruptionBudget for a given Elasticsearch cluster name and role.
+func PodDisruptionBudgetNameForRole(esName string, role string) string {
+	// For coordinating nodes (no roles), append "coordinating" to the name
+	if role == "" {
+		role = "coordinating"
+	}
+	return ESNamer.Suffix(esName, defaultPodDisruptionBudget, role)
+}
diff --git a/pkg/apis/elasticsearch/v1beta1/webhook.go b/pkg/apis/elasticsearch/v1beta1/webhook.go
index 7184cc3f3..6787d60d0 100644
--- a/pkg/apis/elasticsearch/v1beta1/webhook.go
+++ b/pkg/apis/elasticsearch/v1beta1/webhook.go
@@ -21,7 +21,7 @@ const (
 	webhookPath = "/validate-elasticsearch-k8s-elastic-co-v1beta1-elasticsearch"
 )
 
-// +kubebuilder:webhook:path=/validate-elasticsearch-k8s-elastic-co-v1beta1-elasticsearch,mutating=false,failurePolicy=ignore,groups=elasticsearch.k8s.elastic.co,resources=elasticsearches,verbs=create;update,versions=v1beta1,name=elastic-es-validation-v1beta1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1;v1beta1,matchPolicy=Exact
+// +kubebuilder:webhook:path=/validate-elasticsearch-k8s-elastic-co-v1beta1-elasticsearch,mutating=false,failurePolicy=ignore,groups=elasticsearch.k8s.elastic.co,resources=elasticsearches,verbs=create;update,versions=v1beta1,name=elastic-es-validation-v1beta1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1,matchPolicy=Exact
 
 var eslog = ulog.Log.WithName("es-validation")
 
diff --git a/pkg/apis/enterprisesearch/v1/webhook.go b/pkg/apis/enterprisesearch/v1/webhook.go
index 1a9292b29..b914772e9 100644
--- a/pkg/apis/enterprisesearch/v1/webhook.go
+++ b/pkg/apis/enterprisesearch/v1/webhook.go
@@ -39,7 +39,7 @@ var (
 	}
 )
 
-// +kubebuilder:webhook:path=/validate-enterprisesearch-k8s-elastic-co-v1-enterprisesearch,mutating=false,failurePolicy=ignore,groups=enterprisesearch.k8s.elastic.co,resources=enterprisesearches,verbs=create;update,versions=v1,name=elastic-ent-validation-v1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1;v1beta1,matchPolicy=Exact
+// +kubebuilder:webhook:path=/validate-enterprisesearch-k8s-elastic-co-v1-enterprisesearch,mutating=false,failurePolicy=ignore,groups=enterprisesearch.k8s.elastic.co,resources=enterprisesearches,verbs=create;update,versions=v1,name=elastic-ent-validation-v1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1,matchPolicy=Exact
 
 var _ admission.Validator = &EnterpriseSearch{}
 
diff --git a/pkg/apis/enterprisesearch/v1beta1/webhook.go b/pkg/apis/enterprisesearch/v1beta1/webhook.go
index 1157bd1e5..5e1b8b2f2 100644
--- a/pkg/apis/enterprisesearch/v1beta1/webhook.go
+++ b/pkg/apis/enterprisesearch/v1beta1/webhook.go
@@ -38,7 +38,7 @@ var (
 	}
 )
 
-// +kubebuilder:webhook:path=/validate-enterprisesearch-k8s-elastic-co-v1beta1-enterprisesearch,mutating=false,failurePolicy=ignore,groups=enterprisesearch.k8s.elastic.co,resources=enterprisesearches,verbs=create;update,versions=v1beta1,name=elastic-ent-validation-v1beta1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1;v1beta1,matchPolicy=Exact
+// +kubebuilder:webhook:path=/validate-enterprisesearch-k8s-elastic-co-v1beta1-enterprisesearch,mutating=false,failurePolicy=ignore,groups=enterprisesearch.k8s.elastic.co,resources=enterprisesearches,verbs=create;update,versions=v1beta1,name=elastic-ent-validation-v1beta1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1,matchPolicy=Exact
 
 var _ admission.Validator = &EnterpriseSearch{}
 
diff --git a/pkg/apis/kibana/v1/webhook.go b/pkg/apis/kibana/v1/webhook.go
index 60a0e2044..82e2f5959 100644
--- a/pkg/apis/kibana/v1/webhook.go
+++ b/pkg/apis/kibana/v1/webhook.go
@@ -42,7 +42,7 @@ var (
 	}
 )
 
-// +kubebuilder:webhook:path=/validate-kibana-k8s-elastic-co-v1-kibana,mutating=false,failurePolicy=ignore,groups=kibana.k8s.elastic.co,resources=kibanas,verbs=create;update,versions=v1,name=elastic-kb-validation-v1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1;v1beta1,matchPolicy=Exact
+// +kubebuilder:webhook:path=/validate-kibana-k8s-elastic-co-v1-kibana,mutating=false,failurePolicy=ignore,groups=kibana.k8s.elastic.co,resources=kibanas,verbs=create;update,versions=v1,name=elastic-kb-validation-v1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1,matchPolicy=Exact
 
 var _ admission.Validator = &Kibana{}
 
diff --git a/pkg/apis/kibana/v1beta1/webhook.go b/pkg/apis/kibana/v1beta1/webhook.go
index bc56fb780..787737feb 100644
--- a/pkg/apis/kibana/v1beta1/webhook.go
+++ b/pkg/apis/kibana/v1beta1/webhook.go
@@ -38,7 +38,7 @@ var (
 	}
 )
 
-// +kubebuilder:webhook:path=/validate-kibana-k8s-elastic-co-v1beta1-kibana,mutating=false,failurePolicy=ignore,groups=kibana.k8s.elastic.co,resources=kibanas,verbs=create;update,versions=v1beta1,name=elastic-kb-validation-v1beta1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1;v1beta1,matchPolicy=Exact
+// +kubebuilder:webhook:path=/validate-kibana-k8s-elastic-co-v1beta1-kibana,mutating=false,failurePolicy=ignore,groups=kibana.k8s.elastic.co,resources=kibanas,verbs=create;update,versions=v1beta1,name=elastic-kb-validation-v1beta1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1,matchPolicy=Exact
 
 var _ admission.Validator = &Kibana{}
 
diff --git a/pkg/apis/maps/v1alpha1/webhook.go b/pkg/apis/maps/v1alpha1/webhook.go
index 56c59a74d..b8dc7d220 100644
--- a/pkg/apis/maps/v1alpha1/webhook.go
+++ b/pkg/apis/maps/v1alpha1/webhook.go
@@ -33,7 +33,7 @@ var (
 	}
 )
 
-// +kubebuilder:webhook:path=/validate-ems-k8s-elastic-co-v1alpha1-mapsservers,mutating=false,failurePolicy=ignore,groups=maps.k8s.elastic.co,resources=mapsservers,verbs=create;update,versions=v1alpha1,name=elastic-ems-validation-v1alpha1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1;v1beta1,matchPolicy=Exact
+// +kubebuilder:webhook:path=/validate-ems-k8s-elastic-co-v1alpha1-mapsservers,mutating=false,failurePolicy=ignore,groups=maps.k8s.elastic.co,resources=mapsservers,verbs=create;update,versions=v1alpha1,name=elastic-ems-validation-v1alpha1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1,matchPolicy=Exact
 
 var _ admission.Validator = &ElasticMapsServer{}
 
diff --git a/pkg/apis/stackconfigpolicy/v1alpha1/webhook.go b/pkg/apis/stackconfigpolicy/v1alpha1/webhook.go
index 0c16d6a1b..ea71b06fa 100644
--- a/pkg/apis/stackconfigpolicy/v1alpha1/webhook.go
+++ b/pkg/apis/stackconfigpolicy/v1alpha1/webhook.go
@@ -34,7 +34,7 @@ var (
 	}
 )
 
-// +kubebuilder:webhook:path=/validate-scp-k8s-elastic-co-v1alpha1-stackconfigpolicies,mutating=false,failurePolicy=ignore,groups=stackconfigpolicy.k8s.elastic.co,resources=stackconfigpolicies,verbs=create;update,versions=v1alpha1,name=elastic-scp-validation-v1alpha1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1;v1beta1,matchPolicy=Exact
+// +kubebuilder:webhook:path=/validate-scp-k8s-elastic-co-v1alpha1-stackconfigpolicies,mutating=false,failurePolicy=ignore,groups=stackconfigpolicy.k8s.elastic.co,resources=stackconfigpolicies,verbs=create;update,versions=v1alpha1,name=elastic-scp-validation-v1alpha1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1,matchPolicy=Exact
 
 var _ admission.Validator = &StackConfigPolicy{}
 
diff --git a/pkg/controller/autoscaling/elasticsearch/validation/webhook.go b/pkg/controller/autoscaling/elasticsearch/validation/webhook.go
index 65b3e467d..5bf70f619 100644
--- a/pkg/controller/autoscaling/elasticsearch/validation/webhook.go
+++ b/pkg/controller/autoscaling/elasticsearch/validation/webhook.go
@@ -23,7 +23,7 @@ import (
 	"github.com/elastic/cloud-on-k8s/v3/pkg/utils/set"
 )
 
-// +kubebuilder:webhook:path=/validate-autoscaling-k8s-elastic-co-v1alpha1-elasticsearchautoscaler,mutating=false,failurePolicy=ignore,groups=autoscaling.k8s.elastic.co,resources=elasticsearchautoscalers,verbs=create;update,versions=v1alpha1,name=elastic-esa-validation-v1alpha1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1;v1beta1,matchPolicy=Exact
+// +kubebuilder:webhook:path=/validate-autoscaling-k8s-elastic-co-v1alpha1-elasticsearchautoscaler,mutating=false,failurePolicy=ignore,groups=autoscaling.k8s.elastic.co,resources=elasticsearchautoscalers,verbs=create;update,versions=v1alpha1,name=elastic-esa-validation-v1alpha1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1,matchPolicy=Exact
 
 const (
 	webhookPath = "/validate-autoscaling-k8s-elastic-co-v1alpha1-elasticsearchautoscaler"
diff --git a/pkg/controller/common/statefulset/fixtures.go b/pkg/controller/common/statefulset/fixtures.go
index 9fb85d1dc..987232aa8 100644
--- a/pkg/controller/common/statefulset/fixtures.go
+++ b/pkg/controller/common/statefulset/fixtures.go
@@ -16,16 +16,24 @@ import (
 )
 
 type TestSset struct {
-	Namespace       string
-	Name            string
-	ClusterName     string
-	Version         string
-	Replicas        int32
-	Master          bool
-	Data            bool
-	Ingest          bool
-	Status          appsv1.StatefulSetStatus
-	ResourceVersion string
+	Namespace           string
+	Name                string
+	ClusterName         string
+	Version             string
+	Replicas            int32
+	Master              bool
+	Data                bool
+	Ingest              bool
+	ML                  bool
+	Transform           bool
+	RemoteClusterClient bool
+	DataHot             bool
+	DataWarm            bool
+	DataCold            bool
+	DataContent         bool
+	DataFrozen          bool
+	Status              appsv1.StatefulSetStatus
+	ResourceVersion     string
 }
 
 func (t TestSset) Pods() []client.Object {
@@ -54,6 +62,14 @@ func (t TestSset) Build() appsv1.StatefulSet {
 	label.NodeTypesMasterLabelName.Set(t.Master, labels)
 	label.NodeTypesDataLabelName.Set(t.Data, labels)
 	label.NodeTypesIngestLabelName.Set(t.Ingest, labels)
+	label.NodeTypesMLLabelName.Set(t.ML, labels)
+	label.NodeTypesTransformLabelName.Set(t.Transform, labels)
+	label.NodeTypesRemoteClusterClientLabelName.Set(t.RemoteClusterClient, labels)
+	label.NodeTypesDataHotLabelName.Set(t.DataHot, labels)
+	label.NodeTypesDataWarmLabelName.Set(t.DataWarm, labels)
+	label.NodeTypesDataColdLabelName.Set(t.DataCold, labels)
+	label.NodeTypesDataContentLabelName.Set(t.DataContent, labels)
+	label.NodeTypesDataFrozenLabelName.Set(t.DataFrozen, labels)
 	statefulSet := appsv1.StatefulSet{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      t.Name,
@@ -86,19 +102,27 @@ func (t TestSset) BuildPtr() *appsv1.StatefulSet {
 }
 
 type TestPod struct {
-	Namespace       string
-	Name            string
-	ClusterName     string
-	StatefulSetName string
-	Version         string
-	Revision        string
-	Master          bool
-	Data            bool
-	Ingest          bool
-	Ready           bool
-	RestartCount    int32
-	Phase           corev1.PodPhase
-	ResourceVersion string
+	Namespace           string
+	Name                string
+	ClusterName         string
+	StatefulSetName     string
+	Version             string
+	Revision            string
+	Master              bool
+	Data                bool
+	Ingest              bool
+	ML                  bool
+	Transform           bool
+	RemoteClusterClient bool
+	DataHot             bool
+	DataWarm            bool
+	DataCold            bool
+	DataContent         bool
+	DataFrozen          bool
+	Ready               bool
+	RestartCount        int32
+	Phase               corev1.PodPhase
+	ResourceVersion     string
 }
 
 func (t TestPod) Build() corev1.Pod {
@@ -111,6 +135,14 @@ func (t TestPod) Build() corev1.Pod {
 	label.NodeTypesMasterLabelName.Set(t.Master, labels)
 	label.NodeTypesDataLabelName.Set(t.Data, labels)
 	label.NodeTypesIngestLabelName.Set(t.Ingest, labels)
+	label.NodeTypesMLLabelName.Set(t.ML, labels)
+	label.NodeTypesTransformLabelName.Set(t.Transform, labels)
+	label.NodeTypesRemoteClusterClientLabelName.Set(t.RemoteClusterClient, labels)
+	label.NodeTypesDataHotLabelName.Set(t.DataHot, labels)
+	label.NodeTypesDataWarmLabelName.Set(t.DataWarm, labels)
+	label.NodeTypesDataColdLabelName.Set(t.DataCold, labels)
+	label.NodeTypesDataContentLabelName.Set(t.DataContent, labels)
+	label.NodeTypesDataFrozenLabelName.Set(t.DataFrozen, labels)
 
 	status := corev1.PodStatus{
 		// assume Running by default
diff --git a/pkg/controller/common/volume/pvc_expansion.go b/pkg/controller/common/volume/pvc_expansion.go
index 5d1ec101e..aab39e908 100644
--- a/pkg/controller/common/volume/pvc_expansion.go
+++ b/pkg/controller/common/volume/pvc_expansion.go
@@ -18,6 +18,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/kubernetes/scheme"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/apiutil"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
 	sset "github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/statefulset"
@@ -26,7 +27,7 @@ import (
 	ulog "github.com/elastic/cloud-on-k8s/v3/pkg/utils/log"
 )
 
-// handleVolumeExpansion works around the immutability of VolumeClaimTemplates in StatefulSets by:
+// HandleVolumeExpansion works around the immutability of VolumeClaimTemplates in StatefulSets by:
 // 1. updating storage requests in PVCs whose storage class supports volume expansion
 // 2. scheduling the StatefulSet for recreation with the new storage spec
 // It returns a boolean indicating whether the StatefulSet needs to be recreated.
@@ -37,7 +38,6 @@ func HandleVolumeExpansion(
 	ctx context.Context,
 	k8sClient k8s.Client,
 	owner client.Object,
-	ownerKind string,
 	expectedSset appsv1.StatefulSet,
 	actualSset appsv1.StatefulSet,
 	validateStorageClass bool,
@@ -60,7 +60,7 @@ func HandleVolumeExpansion(
 
 	// schedule the StatefulSet for recreation if needed
 	if needsRecreate(expectedSset, actualSset) {
-		return true, annotateForRecreation(ctx, k8sClient, owner, ownerKind, actualSset, expectedSset.Spec.VolumeClaimTemplates)
+		return true, annotateForRecreation(ctx, k8sClient, owner, actualSset, expectedSset.Spec.VolumeClaimTemplates)
 	}
 
 	return false, nil
@@ -117,7 +117,6 @@ func annotateForRecreation(
 	ctx context.Context,
 	k8sClient k8s.Client,
 	owner client.Object,
-	ownerKind string,
 	actualSset appsv1.StatefulSet,
 	expectedClaims []corev1.PersistentVolumeClaim,
 ) error {
@@ -128,10 +127,15 @@ func annotateForRecreation(
 
 	actualSset.Spec.VolumeClaimTemplates = expectedClaims
 	asJSON, err := json.Marshal(actualSset)
+	if err != nil {
+		return err
+	}
 
+	gvk, err := apiutil.GVKForObject(owner, scheme.Scheme)
 	if err != nil {
 		return err
 	}
+	ownerKind := gvk.Kind
 
 	err = setAnnotation(owner, getRecreateStatefulSetAnnotationKey(ownerKind, actualSset.Name), string(asJSON))
 	if err != nil {
@@ -165,7 +169,12 @@ func needsRecreate(expectedSset appsv1.StatefulSet, actualSset appsv1.StatefulSe
 //  3. An annotation specifies StatefulSet Foo needs to be recreated. That StatefulSet does not exist: create it.
 //  4. An annotation specifies StatefulSet Foo needs to be recreated. That StatefulSet actually exists, but with
 //     a different UID: the re-creation is over, remove the annotation.
-func RecreateStatefulSets(ctx context.Context, k8sClient k8s.Client, owner client.Object, ownerKind string) (int, error) {
+func RecreateStatefulSets(ctx context.Context, k8sClient k8s.Client, owner client.Object) (int, error) {
+	gvk, err := apiutil.GVKForObject(owner, scheme.Scheme)
+	if err != nil {
+		return 0, err
+	}
+	ownerKind := gvk.Kind
 	log := ulog.FromContext(ctx)
 	recreateList, err := ssetsToRecreate(owner, ownerKind)
 	if err != nil {
diff --git a/pkg/controller/elasticsearch/driver/nodes.go b/pkg/controller/elasticsearch/driver/nodes.go
index 4252bee69..65199fc48 100644
--- a/pkg/controller/elasticsearch/driver/nodes.go
+++ b/pkg/controller/elasticsearch/driver/nodes.go
@@ -133,7 +133,7 @@ func (d *defaultDriver) reconcileNodeSpecs(
 	}
 
 	// Update PDB to account for new replicas.
-	if err := pdb.Reconcile(ctx, d.Client, d.ES, actualStatefulSets, meta); err != nil {
+	if err := pdb.Reconcile(ctx, d.Client, d.ES, d.OperatorParameters.OperatorNamespace, actualStatefulSets, meta); err != nil {
 		return results.WithError(err)
 	}
 
diff --git a/pkg/controller/elasticsearch/driver/pvc_expansion.go b/pkg/controller/elasticsearch/driver/pvc_expansion.go
index 53726e2cf..7cbba634d 100644
--- a/pkg/controller/elasticsearch/driver/pvc_expansion.go
+++ b/pkg/controller/elasticsearch/driver/pvc_expansion.go
@@ -15,11 +15,10 @@ import (
 )
 
 func recreateStatefulSets(ctx context.Context, k8sclient k8s.Client, es esv1.Elasticsearch) (int, error) {
-	return volume.RecreateStatefulSets(ctx, k8sclient, &es, es.Kind)
+	return volume.RecreateStatefulSets(ctx, k8sclient, &es)
 }
 
 func handleVolumeExpansion(ctx context.Context, k8sClient k8s.Client, es esv1.Elasticsearch, expectedSset appsv1.StatefulSet,
 	actualSset appsv1.StatefulSet, validateStorageClass bool) (bool, error) {
-	return volume.HandleVolumeExpansion(ctx, k8sClient, &es, es.Kind, expectedSset, actualSset,
-		validateStorageClass)
+	return volume.HandleVolumeExpansion(ctx, k8sClient, &es, expectedSset, actualSset, validateStorageClass)
 }
diff --git a/pkg/controller/elasticsearch/elasticsearch_controller.go b/pkg/controller/elasticsearch/elasticsearch_controller.go
index 33ccffa7a..2cb0d1e81 100644
--- a/pkg/controller/elasticsearch/elasticsearch_controller.go
+++ b/pkg/controller/elasticsearch/elasticsearch_controller.go
@@ -13,6 +13,7 @@ import (
 	"go.elastic.co/apm/v2"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
+	policyv1 "k8s.io/api/policy/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/tools/record"
@@ -108,6 +109,12 @@ func addWatches(mgr manager.Manager, c controller.Controller, r *ReconcileElasti
 		return err
 	}
 
+	// Watch PodDisruptionBudgets
+	if err := c.Watch(
+		source.Kind(mgr.GetCache(), &policyv1.PodDisruptionBudget{}, handler.TypedEnqueueRequestForOwner[*policyv1.PodDisruptionBudget](mgr.GetScheme(), mgr.GetRESTMapper(), &esv1.Elasticsearch{}, handler.OnlyControllerOwner()))); err != nil {
+		return err
+	}
+
 	// Watch owned and soft-owned secrets
 	if err := c.Watch(source.Kind(mgr.GetCache(), &corev1.Secret{}, r.dynamicWatches.Secrets)); err != nil {
 		return err
diff --git a/pkg/controller/elasticsearch/label/label.go b/pkg/controller/elasticsearch/label/label.go
index 25912449f..055858b39 100644
--- a/pkg/controller/elasticsearch/label/label.go
+++ b/pkg/controller/elasticsearch/label/label.go
@@ -59,6 +59,28 @@ const (
 	Type = "elasticsearch"
 )
 
+// RoleMapping is a struct that maps a label name to a node role.
+// This is used when creating PDBs for each node role.
+type RoleMapping struct {
+	LabelName string
+	Role      esv1.NodeRole
+}
+
+// RoleMappings is the definitive list of labels to node roles.
+var RoleMappings = []RoleMapping{
+	{string(NodeTypesMasterLabelName), esv1.MasterRole},
+	{string(NodeTypesDataLabelName), esv1.DataRole},
+	{string(NodeTypesIngestLabelName), esv1.IngestRole},
+	{string(NodeTypesMLLabelName), esv1.MLRole},
+	{string(NodeTypesTransformLabelName), esv1.TransformRole},
+	{string(NodeTypesRemoteClusterClientLabelName), esv1.RemoteClusterClientRole},
+	{string(NodeTypesDataHotLabelName), esv1.DataHotRole},
+	{string(NodeTypesDataWarmLabelName), esv1.DataWarmRole},
+	{string(NodeTypesDataColdLabelName), esv1.DataColdRole},
+	{string(NodeTypesDataContentLabelName), esv1.DataContentRole},
+	{string(NodeTypesDataFrozenLabelName), esv1.DataFrozenRole},
+}
+
 // NonMasterRoles are all Elasticsearch node roles except master or voting-only.
 var NonMasterRoles = []labels.TrueFalseLabel{
 	NodeTypesDataLabelName,
@@ -85,7 +107,11 @@ func IsMasterNodeSet(statefulSet appsv1.StatefulSet) bool {
 
 // IsDataNodeSet returns true if the given StatefulSet specifies data nodes.
 func IsDataNodeSet(statefulSet appsv1.StatefulSet) bool {
-	return NodeTypesDataLabelName.HasValue(true, statefulSet.Spec.Template.Labels)
+	return NodeTypesDataLabelName.HasValue(true, statefulSet.Spec.Template.Labels) ||
+		NodeTypesDataHotLabelName.HasValue(true, statefulSet.Spec.Template.Labels) ||
+		NodeTypesDataColdLabelName.HasValue(true, statefulSet.Spec.Template.Labels) ||
+		NodeTypesDataContentLabelName.HasValue(true, statefulSet.Spec.Template.Labels) ||
+		NodeTypesDataWarmLabelName.HasValue(true, statefulSet.Spec.Template.Labels)
 }
 
 // IsIngestNodeSet returns true if the given StatefulSet specifies ingest nodes.
diff --git a/pkg/controller/elasticsearch/nodespec/__snapshots__/podspec_test.snap b/pkg/controller/elasticsearch/nodespec/__snapshots__/podspec_test.snap
index e8f343d8d..c9ab4877e 100755
--- a/pkg/controller/elasticsearch/nodespec/__snapshots__/podspec_test.snap
+++ b/pkg/controller/elasticsearch/nodespec/__snapshots__/podspec_test.snap
@@ -8,7 +8,6 @@
    "pod-template-annotation-name": "pod-template-annotation-value",
    "policy.k8s.elastic.co/elasticsearch-config-mounts-hash": "2095567618"
   },
-  "creationTimestamp": null,
   "labels": {
    "common.k8s.elastic.co/type": "elasticsearch",
    "elasticsearch.k8s.elastic.co/cluster-name": "name",
@@ -986,7 +985,6 @@
    "elasticsearch.k8s.elastic.co/config-hash": "2170302367",
    "pod-template-annotation-name": "pod-template-annotation-value"
   },
-  "creationTimestamp": null,
   "labels": {
    "common.k8s.elastic.co/type": "elasticsearch",
    "elasticsearch.k8s.elastic.co/cluster-name": "name",
@@ -1842,9 +1840,7 @@
 
 [TestBuildPodTemplateSpec/failing_client - 1]
 {
- "metadata": {
-  "creationTimestamp": null
- },
+ "metadata": {},
  "spec": {
   "containers": null
  }
diff --git a/pkg/controller/elasticsearch/pdb/fixtures.go b/pkg/controller/elasticsearch/pdb/fixtures.go
new file mode 100644
index 000000000..7a00cdef6
--- /dev/null
+++ b/pkg/controller/elasticsearch/pdb/fixtures.go
@@ -0,0 +1,201 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License 2.0;
+// you may not use this file except in compliance with the Elastic License 2.0.
+
+package pdb
+
+import (
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	v1 "github.com/elastic/cloud-on-k8s/v3/pkg/apis/common/v1"
+	esv1 "github.com/elastic/cloud-on-k8s/v3/pkg/apis/elasticsearch/v1"
+	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/statefulset"
+	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/version"
+	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/elasticsearch/nodespec"
+	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/elasticsearch/settings"
+	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/elasticsearch/sset"
+)
+
+// Builder helps create test fixtures for the Elasticsearch PDB tests.
+type Builder struct {
+	Elasticsearch esv1.Elasticsearch
+	StatefulSets  []appsv1.StatefulSet
+}
+
+// NewBuilder creates a new Builder with default values.
+func NewBuilder(name string) Builder {
+	return Builder{
+		Elasticsearch: esv1.Elasticsearch{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      name,
+				Namespace: "default",
+			},
+			Spec: esv1.ElasticsearchSpec{
+				Version:  "9.0.1",
+				NodeSets: []esv1.NodeSet{},
+			},
+		},
+		StatefulSets: []appsv1.StatefulSet{},
+	}
+}
+
+// WithNamespace sets the namespace for the Elasticsearch resource.
+func (b Builder) WithNamespace(namespace string) Builder {
+	b.Elasticsearch.Namespace = namespace
+	return b
+}
+
+// WithVersion sets the version for the Elasticsearch resource.
+func (b Builder) WithVersion(version string) Builder {
+	b.Elasticsearch.Spec.Version = version
+	return b
+}
+
+// WithNodeSet adds a NodeSet to the Elasticsearch spec.
+func (b Builder) WithNodeSet(name string, count int32, nodeTypes ...esv1.NodeRole) Builder {
+	config := map[string]any{}
+
+	// Only set node.Roles if the first role is not "all_roles"
+	// to properly handle no roles set to equal having all roles assigned.
+	if !(len(nodeTypes) == 1 && nodeTypes[0] == "all_roles") {
+		// This handles the 'coordinating' role properly.
+		config["node.roles"] = []esv1.NodeRole{}
+		for _, nodeType := range nodeTypes {
+			if string(nodeType) != "" {
+				config["node.roles"] = append(config["node.roles"].([]esv1.NodeRole), nodeType) //nolint:forcetypeassert
+			}
+		}
+	}
+
+	nodeset := esv1.NodeSet{
+		Name:  name,
+		Count: count,
+		Config: &v1.Config{
+			Data: config,
+		},
+	}
+
+	b.Elasticsearch.Spec.NodeSets = append(b.Elasticsearch.Spec.NodeSets, nodeset)
+
+	// Create a corresponding StatefulSet
+	sset := b.buildStatefulSet(name, count, nodeTypes)
+	b.StatefulSets = append(b.StatefulSets, sset)
+
+	return b
+}
+
+// buildStatefulSet creates a StatefulSet based on the given parameters.
+func (b Builder) buildStatefulSet(name string, replicas int32, nodeRoles []esv1.NodeRole) appsv1.StatefulSet {
+	sset := statefulset.TestSset{
+		Namespace:   b.Elasticsearch.Namespace,
+		Name:        name,
+		ClusterName: b.Elasticsearch.Name,
+		Version:     b.Elasticsearch.Spec.Version,
+		Replicas:    replicas,
+	}
+
+	// Set node roles based on nodeRoles
+	for _, nodeRole := range nodeRoles {
+		switch nodeRole {
+		case esv1.MasterRole:
+			sset.Master = true
+		case esv1.DataRole:
+			sset.Data = true
+		case esv1.IngestRole:
+			sset.Ingest = true
+		case esv1.MLRole:
+			sset.ML = true
+		case esv1.TransformRole:
+			sset.Transform = true
+		case esv1.RemoteClusterClientRole:
+			sset.RemoteClusterClient = true
+		case esv1.DataHotRole:
+			sset.DataHot = true
+		case esv1.DataWarmRole:
+			sset.DataWarm = true
+		case esv1.DataColdRole:
+			sset.DataCold = true
+		case esv1.DataContentRole:
+			sset.DataContent = true
+		case esv1.DataFrozenRole:
+			sset.DataFrozen = true
+		case esv1.CoordinatingRole:
+			continue
+		case esv1.VotingOnlyRole:
+			continue
+		}
+	}
+
+	// If no roles are specified (not empty, but nil)
+	// this implies all roles, which is handled by
+	// 'all_roles' in the tests.
+	if len(nodeRoles) == 1 && nodeRoles[0] == "all_roles" {
+		sset.Master = true
+		sset.Data = true
+		sset.Ingest = true
+		sset.ML = true
+		sset.Transform = true
+		sset.RemoteClusterClient = true
+		sset.DataHot = true
+		sset.DataWarm = true
+		sset.DataCold = true
+		sset.DataContent = true
+		sset.DataFrozen = true
+	}
+
+	return sset.Build()
+}
+
+// WithStatefulSet adds a custom StatefulSet to the builder.
+func (b Builder) WithStatefulSet(sset appsv1.StatefulSet) Builder {
+	b.StatefulSets = append(b.StatefulSets, sset)
+	return b
+}
+
+// BuildResourcesList generates a nodespec.ResourcesList from the builder data.
+// This allows the tests to properly unpack the Config object for a nodeSet
+// and use the Node.Roles directly.
+func (b Builder) BuildResourcesList() (nodespec.ResourcesList, error) {
+	v, err := version.Parse(b.Elasticsearch.Spec.Version)
+	if err != nil {
+		return nil, err
+	}
+
+	resourcesList := make(nodespec.ResourcesList, 0, len(b.StatefulSets))
+
+	for i, sset := range b.StatefulSets {
+		// Create config based on the nodeset if available
+		config := &v1.Config{Data: map[string]interface{}{}}
+		if i < len(b.Elasticsearch.Spec.NodeSets) {
+			config = b.Elasticsearch.Spec.NodeSets[i].Config
+		}
+
+		cfg, err := settings.NewMergedESConfig(
+			b.Elasticsearch.Name,
+			v,
+			corev1.IPv4Protocol,
+			b.Elasticsearch.Spec.HTTP,
+			*config,
+			nil,
+			false,
+			false,
+		)
+		if err != nil {
+			return nil, err
+		}
+
+		resourcesList = append(resourcesList, nodespec.Resources{
+			NodeSet:     sset.Name,
+			StatefulSet: sset,
+			Config:      cfg,
+		})
+	}
+
+	return resourcesList, nil
+}
+
+func (b Builder) GetStatefulSets() sset.StatefulSetList {
+	return b.StatefulSets
+}
diff --git a/pkg/controller/elasticsearch/pdb/reconcile.go b/pkg/controller/elasticsearch/pdb/reconcile_default.go
similarity index 62%
rename from pkg/controller/elasticsearch/pdb/reconcile.go
rename to pkg/controller/elasticsearch/pdb/reconcile_default.go
index b335af0e1..1e1fc91e7 100644
--- a/pkg/controller/elasticsearch/pdb/reconcile.go
+++ b/pkg/controller/elasticsearch/pdb/reconcile_default.go
@@ -6,19 +6,19 @@ package pdb
 
 import (
 	"context"
+	"fmt"
 
 	policyv1 "k8s.io/api/policy/v1"
-	policyv1beta1 "k8s.io/api/policy/v1beta1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"k8s.io/client-go/kubernetes/scheme"
-	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
 	commonv1 "github.com/elastic/cloud-on-k8s/v3/pkg/apis/common/v1"
 	esv1 "github.com/elastic/cloud-on-k8s/v3/pkg/apis/elasticsearch/v1"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/hash"
+	lic "github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/license"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/metadata"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/reconciler"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/elasticsearch/label"
@@ -26,60 +26,82 @@ import (
 	"github.com/elastic/cloud-on-k8s/v3/pkg/utils/k8s"
 )
 
-// Reconcile ensures that a PodDisruptionBudget exists for this cluster, inheriting the spec content.
-// The default PDB we setup dynamically adapts MinAvailable to the number of nodes in the cluster.
+// Reconcile ensures that PodDisruptionBudget(s) exists for this cluster, inheriting the spec content.
+//  1. Without an enterprise license: The default PDB we setup dynamically adapts MinAvailable to the number of nodes in the cluster.
+//  2. With an enterprise license: We optimize the PDBs that we setup to speed up Kubernetes cluster operations such as upgrades as much
+//     as safely possible by grouping statefulSets by associated Elasticsearch node roles into the same PDB, and then dynamically setting
+//     maxUnavailable according to whatever cluster health is optimal for the set of roles.
+//  3. In the case of an expired enterprise license, the PDBs will revert back to a single PDB that covers the whole cluster.
+//
 // If the spec has disabled the default PDB, it will ensure none exist.
-func Reconcile(ctx context.Context, k8sClient k8s.Client, es esv1.Elasticsearch, statefulSets sset.StatefulSetList, meta metadata.Metadata) error {
+func Reconcile(
+	ctx context.Context,
+	k8sClient k8s.Client,
+	es esv1.Elasticsearch,
+	operatorNamespace string,
+	statefulSets sset.StatefulSetList,
+	meta metadata.Metadata) error {
+	licenseChecker := lic.NewLicenseChecker(k8sClient, operatorNamespace)
+	enterpriseEnabled, err := licenseChecker.EnterpriseFeaturesEnabled(ctx)
+	if err != nil {
+		return fmt.Errorf("while checking license during pdb reconciliation: %w", err)
+	}
+	// Only reconcile role specific PDBs if an enterprise license is enabled and the default PDB is not specified.
+	// If the PDB is specified in the spec, we will reconcile the default PDB, which will simply use the specified PDB.
+	if enterpriseEnabled && !es.Spec.PodDisruptionBudget.IsSpecified() {
+		return reconcileRoleSpecificPDBs(ctx, k8sClient, es, statefulSets, meta)
+	}
+
+	return reconcileDefaultPDB(ctx, k8sClient, es, statefulSets, meta)
+}
+
+// reconcileDefaultPDB reconciles the default PDB for non-enterprise users.
+func reconcileDefaultPDB(
+	ctx context.Context,
+	k8sClient k8s.Client,
+	es esv1.Elasticsearch,
+	statefulSets sset.StatefulSetList,
+	meta metadata.Metadata,
+) error {
 	expected, err := expectedPDB(es, statefulSets, meta)
 	if err != nil {
 		return err
 	}
+	// in the case of downgrading to basic, we should ensure that the
+	// role-specific PDBs are deleted when attempting to create
+	// the default PDB.
+	if err := deleteAllRoleSpecificPDBs(ctx, k8sClient, es); err != nil {
+		return fmt.Errorf("while deleting role-specific PDBs: %w", err)
+	}
 	if expected == nil {
 		return deleteDefaultPDB(ctx, k8sClient, es)
 	}
+	return reconcilePDB(ctx, k8sClient, es, expected)
+}
 
+// reconcilePDB reconciles a single PDB.
+func reconcilePDB(
+	ctx context.Context,
+	k8sClient k8s.Client,
+	es esv1.Elasticsearch,
+	expected *policyv1.PodDisruptionBudget,
+) error {
 	// label the PDB with a hash of its content, for comparison purposes
 	expected.Labels = hash.SetTemplateHashLabel(expected.Labels, expected)
 
-	v1Available, err := isPDBV1Available(k8sClient)
-	if err != nil {
-		return err
-	}
-
-	if v1Available {
-		reconciled := &policyv1.PodDisruptionBudget{}
-		return reconciler.ReconcileResource(
-			reconciler.Params{
-				Context:    ctx,
-				Client:     k8sClient,
-				Owner:      &es,
-				Expected:   expected,
-				Reconciled: reconciled,
-				NeedsUpdate: func() bool {
-					return hash.GetTemplateHashLabel(expected.Labels) != hash.GetTemplateHashLabel(reconciled.Labels)
-				},
-				UpdateReconciled: func() {
-					expected.DeepCopyInto(reconciled)
-				},
-			},
-		)
-	}
-
-	// Fall back to v1beta1
-	reconciled := &policyv1beta1.PodDisruptionBudget{}
-	converted := convert(expected)
+	reconciled := &policyv1.PodDisruptionBudget{}
 	return reconciler.ReconcileResource(
 		reconciler.Params{
 			Context:    ctx,
 			Client:     k8sClient,
 			Owner:      &es,
-			Expected:   converted,
+			Expected:   expected,
 			Reconciled: reconciled,
 			NeedsUpdate: func() bool {
-				return hash.GetTemplateHashLabel(converted.Labels) != hash.GetTemplateHashLabel(reconciled.Labels)
+				return hash.GetTemplateHashLabel(expected.Labels) != hash.GetTemplateHashLabel(reconciled.Labels)
 			},
 			UpdateReconciled: func() {
-				converted.DeepCopyInto(reconciled)
+				expected.DeepCopyInto(reconciled)
 			},
 		},
 	)
@@ -87,30 +109,16 @@ func Reconcile(ctx context.Context, k8sClient k8s.Client, es esv1.Elasticsearch,
 
 // deleteDefaultPDB deletes the default pdb if it exists.
 func deleteDefaultPDB(ctx context.Context, k8sClient k8s.Client, es esv1.Elasticsearch) error {
-	// we do this by getting first because that is a local cache read,
-	// versus a Delete call, which would hit the API.
-
-	v1Available, err := isPDBV1Available(k8sClient)
-	if err != nil {
-		return err
-	}
-	var pdb client.Object
-	if v1Available {
-		pdb = &policyv1.PodDisruptionBudget{
-			ObjectMeta: metav1.ObjectMeta{
-				Namespace: es.Namespace,
-				Name:      esv1.DefaultPodDisruptionBudget(es.Name),
-			},
-		}
-	} else {
-		pdb = &policyv1beta1.PodDisruptionBudget{
-			ObjectMeta: metav1.ObjectMeta{
-				Namespace: es.Namespace,
-				Name:      esv1.DefaultPodDisruptionBudget(es.Name),
-			},
-		}
+	pdb := &policyv1.PodDisruptionBudget{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: es.Namespace,
+			Name:      esv1.DefaultPodDisruptionBudget(es.Name),
+		},
 	}
+	return deletePDB(ctx, k8sClient, pdb)
+}
 
+func deletePDB(ctx context.Context, k8sClient k8s.Client, pdb *policyv1.PodDisruptionBudget) error {
 	if err := k8sClient.Get(ctx, k8s.ExtractNamespacedName(pdb), pdb); err != nil && !apierrors.IsNotFound(err) {
 		return err
 	} else if apierrors.IsNotFound(err) {
@@ -153,7 +161,7 @@ func expectedPDB(es esv1.Elasticsearch, statefulSets sset.StatefulSetList, meta
 		return nil, err
 	}
 
-	if template.Spec.Selector != nil || template.Spec.MaxUnavailable != nil || template.Spec.MinAvailable != nil {
+	if template.IsSpecified() {
 		// use the user-defined spec
 		expected.Spec = template.Spec
 	} else {
@@ -170,7 +178,7 @@ func buildPDBSpec(es esv1.Elasticsearch, statefulSets sset.StatefulSetList) poli
 	// compute MinAvailable based on the maximum number of Pods we're supposed to have
 	nodeCount := statefulSets.ExpectedNodeCount()
 	// maybe allow some Pods to be disrupted
-	minAvailable := nodeCount - allowedDisruptions(es, statefulSets)
+	minAvailable := nodeCount - allowedDisruptionsForSinglePDB(es, statefulSets)
 
 	minAvailableIntStr := intstr.IntOrString{Type: intstr.Int, IntVal: minAvailable}
 
@@ -188,8 +196,9 @@ func buildPDBSpec(es esv1.Elasticsearch, statefulSets sset.StatefulSetList) poli
 	}
 }
 
-// allowedDisruptions returns the number of Pods that we allow to be disrupted while keeping the cluster healthy.
-func allowedDisruptions(es esv1.Elasticsearch, actualSsets sset.StatefulSetList) int32 {
+// allowedDisruptionsForSinglePDB returns the number of Pods that we allow to be disrupted while keeping the cluster healthy
+// when there is a single PodDisruptionBudget that encompasses a whole Elasticsearch cluster.
+func allowedDisruptionsForSinglePDB(es esv1.Elasticsearch, actualSsets sset.StatefulSetList) int32 {
 	if actualSsets.ExpectedNodeCount() == 1 {
 		// single node cluster (not highly-available)
 		// allow the node to be disrupted to ensure K8s nodes operations can be performed
diff --git a/pkg/controller/elasticsearch/pdb/reconcile_with_roles.go b/pkg/controller/elasticsearch/pdb/reconcile_with_roles.go
new file mode 100644
index 000000000..84ecdf35f
--- /dev/null
+++ b/pkg/controller/elasticsearch/pdb/reconcile_with_roles.go
@@ -0,0 +1,441 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License 2.0;
+// you may not use this file except in compliance with the Elastic License 2.0.
+
+package pdb
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"sort"
+
+	appsv1 "k8s.io/api/apps/v1"
+	policyv1 "k8s.io/api/policy/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/client-go/kubernetes/scheme"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+
+	esv1 "github.com/elastic/cloud-on-k8s/v3/pkg/apis/elasticsearch/v1"
+	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/metadata"
+	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/elasticsearch/label"
+	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/elasticsearch/sset"
+	ulog "github.com/elastic/cloud-on-k8s/v3/pkg/utils/log"
+
+	"github.com/elastic/cloud-on-k8s/v3/pkg/utils/k8s"
+	"github.com/elastic/cloud-on-k8s/v3/pkg/utils/set"
+)
+
+var (
+	// group the statefulsets by the priority of their roles.
+	// master, data_*, ingest, ml, transform, coordinating, and we ignore remote_cluster_client as it has no impact on availability
+	priority = []esv1.NodeRole{esv1.DataRole, esv1.MasterRole, esv1.DataFrozenRole, esv1.IngestRole, esv1.MLRole, esv1.TransformRole, esv1.CoordinatingRole}
+	// All data role variants should be treated as a generic data role for PDB purposes
+	dataRoles = []esv1.NodeRole{
+		esv1.DataRole,
+		esv1.DataHotRole,
+		esv1.DataWarmRole,
+		esv1.DataColdRole,
+		esv1.DataContentRole,
+		// Note: DataFrozenRole is excluded as it can be disrupted even when cluster health is yellow.
+	}
+)
+
+// toGenericDataRole returns the normalized form of a role where any data role
+// is normalized to the same data role.
+func toGenericDataRole(role esv1.NodeRole) esv1.NodeRole {
+	if slices.Contains(dataRoles, role) {
+		return esv1.DataRole
+	}
+	return role
+}
+
+// reconcileRoleSpecificPDBs creates and reconciles PodDisruptionBudgets per nodeSet roles for enterprise-licensed clusters.
+func reconcileRoleSpecificPDBs(
+	ctx context.Context,
+	k8sClient k8s.Client,
+	es esv1.Elasticsearch,
+	statefulSets sset.StatefulSetList,
+	meta metadata.Metadata,
+) error {
+	// Check if PDB is disabled in the ES spec, and if so delete all existing PDBs (both default and role-specific)
+	// that have a proper owner reference.
+	if es.Spec.PodDisruptionBudget != nil && es.Spec.PodDisruptionBudget.IsDisabled() {
+		if err := deleteDefaultPDB(ctx, k8sClient, es); err != nil {
+			return err
+		}
+		return deleteAllRoleSpecificPDBs(ctx, k8sClient, es)
+	}
+
+	// Retrieve the expected list of PDBs.
+	pdbs, err := expectedRolePDBs(ctx, es, statefulSets, meta)
+	if err != nil {
+		return fmt.Errorf("while retrieving expected role-specific PDBs: %w", err)
+	}
+
+	// Reconcile and delete unnecessary role-specific PDBs that could have been created
+	// by a previous reconciliation with a different set of StatefulSets.
+	if err := reconcileAndDeleteUnnecessaryPDBs(ctx, k8sClient, es, pdbs); err != nil {
+		return err
+	}
+
+	// Always ensure any existing default PDB is removed.
+	if err := deleteDefaultPDB(ctx, k8sClient, es); err != nil {
+		return fmt.Errorf("while deleting the default PDB: %w", err)
+	}
+
+	return nil
+}
+
+// expectedRolePDBs returns a slice of PDBs to reconcile based on statefulSet roles.
+func expectedRolePDBs(
+	ctx context.Context,
+	es esv1.Elasticsearch,
+	statefulSets sset.StatefulSetList,
+	meta metadata.Metadata,
+) ([]*policyv1.PodDisruptionBudget, error) {
+	pdbs := make([]*policyv1.PodDisruptionBudget, 0, len(statefulSets))
+
+	// Group StatefulSets by their connected roles.
+	groups, err := groupBySharedRoles(statefulSets)
+	if err != nil {
+		return nil, err
+	}
+
+	// Create one PDB per group
+	// Maps order isn't guaranteed so process in order of defined priority.
+	for _, roleName := range priority {
+		group, ok := groups[roleName]
+		if !ok {
+			continue
+		}
+		if len(group) == 0 {
+			continue
+		}
+
+		pdb, err := createPDBForStatefulSets(ctx, es, roleName, group, statefulSets, meta)
+		if err != nil {
+			return nil, err
+		}
+		if pdb != nil {
+			pdbs = append(pdbs, pdb)
+		}
+	}
+
+	return pdbs, nil
+}
+
+func groupBySharedRoles(statefulSets sset.StatefulSetList) (map[esv1.NodeRole][]appsv1.StatefulSet, error) {
+	n := len(statefulSets)
+	if n == 0 {
+		return map[esv1.NodeRole][]appsv1.StatefulSet{}, nil
+	}
+
+	rolesToIndices := make(map[esv1.NodeRole][]int)
+	indicesToRoles := make(map[int]set.StringSet)
+	for i, sset := range statefulSets {
+		// A statefulSet may not be found within the expected resources,
+		// as it could have been recently deleted/renamed
+		// within the spec so we must retrieve the roles from the
+		// labels in the statefulSet, not the expected configuration.
+		roles, err := getRolesFromStatefulSet(sset)
+		if err != nil {
+			return nil, err
+		}
+
+		for _, role := range roles {
+			// Ensure that the data* roles are grouped together.
+			normalizedRole := toGenericDataRole(role)
+			rolesToIndices[normalizedRole] = append(rolesToIndices[normalizedRole], i)
+			if _, ok := indicesToRoles[i]; !ok {
+				indicesToRoles[i] = set.Make()
+			}
+			indicesToRoles[i].Add(string(normalizedRole))
+		}
+	}
+
+	// This keeps track of which roles have been assigned to a PDB to avoid assigning the same role to multiple PDBs.
+	roleToTargetPDB := map[esv1.NodeRole]esv1.NodeRole{}
+	grouped := map[esv1.NodeRole][]int{}
+	visited := make([]bool, n)
+	for _, role := range priority {
+		indices, ok := rolesToIndices[role]
+		if !ok {
+			continue
+		}
+		for _, idx := range indices {
+			if visited[idx] {
+				continue
+			}
+			targetPDBRole := role
+			// if we already assigned a PDB for this role, use that instead
+			if target, ok := roleToTargetPDB[role]; ok {
+				targetPDBRole = target
+			}
+			grouped[targetPDBRole] = append(grouped[targetPDBRole], idx)
+			for _, r := range indicesToRoles[idx].AsSlice() {
+				roleToTargetPDB[esv1.NodeRole(r)] = targetPDBRole
+			}
+			visited[idx] = true
+		}
+	}
+	// transform into the expected format
+	res := make(map[esv1.NodeRole][]appsv1.StatefulSet)
+	for role, indices := range grouped {
+		group := make([]appsv1.StatefulSet, 0, len(indices))
+		for _, idx := range indices {
+			group = append(group, statefulSets[idx])
+		}
+		res[role] = group
+	}
+	return res, nil
+}
+
+// getRolesFromStatefulSet extracts the roles from a StatefulSet's labels.
+func getRolesFromStatefulSet(statefulSet appsv1.StatefulSet) ([]esv1.NodeRole, error) {
+	roles := make([]esv1.NodeRole, 0, len(label.RoleMappings))
+	labels := statefulSet.Spec.Template.Labels
+	if labels == nil {
+		return nil, fmt.Errorf("statefulSet %s/%s has no labels", statefulSet.Namespace, statefulSet.Name)
+	}
+	// if the statefulset is a coordinating role none of the labels are set to true
+	// so we can initially assume it is, and then check for any labels that are set to true
+	// to invalidate the assumption.
+	isCoordinating := true
+
+	// Check each label-role mapping
+	for _, mapping := range label.RoleMappings {
+		if val, exists := labels[mapping.LabelName]; exists && val == "true" {
+			isCoordinating = false
+			roles = append(roles, mapping.Role)
+		}
+	}
+
+	if isCoordinating {
+		return []esv1.NodeRole{esv1.CoordinatingRole}, nil
+	}
+	return roles, nil
+}
+
+// createPDBForStatefulSets creates a PDB for a group of StatefulSets with shared roles.
+func createPDBForStatefulSets(
+	ctx context.Context,
+	es esv1.Elasticsearch,
+	// role is the role used to determine the maxUnavailable value.
+	role esv1.NodeRole,
+	// statefulSets are the statefulSets grouped into this pdb.
+	statefulSets []appsv1.StatefulSet,
+	// allStatefulSets are all statefulSets in the whole ES cluster.
+	allStatefulSets sset.StatefulSetList,
+	meta metadata.Metadata,
+) (*policyv1.PodDisruptionBudget, error) {
+	if len(statefulSets) == 0 {
+		return nil, nil
+	}
+
+	pdb := &policyv1.PodDisruptionBudget{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      esv1.PodDisruptionBudgetNameForRole(es.Name, string(role)),
+			Namespace: es.Namespace,
+		},
+		Spec: buildRoleSpecificPDBSpec(ctx, es, role, statefulSets, allStatefulSets),
+	}
+
+	if es.Spec.PodDisruptionBudget != nil {
+		// Copy not done prior to assignment here as maps.Clone is used in the metadata.Merge call.
+		pdb.Annotations = es.Spec.PodDisruptionBudget.ObjectMeta.Annotations
+		pdb.Labels = es.Spec.PodDisruptionBudget.ObjectMeta.Labels
+	}
+
+	mergedMeta := meta.Merge(metadata.Metadata{
+		Labels:      pdb.Labels,
+		Annotations: pdb.Annotations,
+	})
+	pdb.Labels = mergedMeta.Labels
+	pdb.Annotations = mergedMeta.Annotations
+
+	// Set owner reference
+	if err := controllerutil.SetControllerReference(&es, pdb, scheme.Scheme); err != nil {
+		return nil, err
+	}
+
+	return pdb, nil
+}
+
+// buildRoleSpecificPDBSpec returns a policyv1.PodDisruptionBudgetSpec for a specific node role.
+func buildRoleSpecificPDBSpec(
+	ctx context.Context,
+	es esv1.Elasticsearch,
+	role esv1.NodeRole,
+	// statefulSets are the statefulSets grouped into this pdb.
+	statefulSets sset.StatefulSetList,
+	// allStatefulSets are all statefulSets in the whole ES cluster.
+	allStatefulSets sset.StatefulSetList,
+) policyv1.PodDisruptionBudgetSpec {
+	// Get the allowed disruptions for this role based on cluster health and role type
+	allowedDisruptions := allowedDisruptionsForRole(ctx, es, role, allStatefulSets)
+
+	spec := policyv1.PodDisruptionBudgetSpec{
+		MaxUnavailable: &intstr.IntOrString{Type: intstr.Int, IntVal: allowedDisruptions},
+	}
+
+	// Get StatefulSet names for the selector
+	ssetNames := make([]string, 0, len(statefulSets))
+	for _, sset := range statefulSets {
+		ssetNames = append(ssetNames, sset.Name)
+	}
+
+	// Sort for consistency
+	sort.Strings(ssetNames)
+
+	spec.Selector = selectorForStatefulSets(es, ssetNames)
+	return spec
+}
+
+// allowedDisruptionsForRole returns the maximum number of pods that can be disrupted for a given role.
+// Notes:
+//   - Disruptions are never allowed when the cluster health is unknown, empty or red, even if the
+//     cluster is not a highly available cluster. This is to ensure no further damage can be done
+//     to a cluster which is already unhealthy for an unknown reason.
+//   - In a single node cluster (not highly-available) always allow 1 disruption
+//     to ensure K8s nodes operations can be performed when the cluster health is not unknown or red.
+//   - For data roles, allow 1 disruption if health is green.
+//   - For any other roles, excluding frozen which should have been filtered in groupBySharedRoles,
+//     allow one disruption if health is green.
+func allowedDisruptionsForRole(
+	ctx context.Context,
+	es esv1.Elasticsearch,
+	role esv1.NodeRole,
+	allStatefulSets sset.StatefulSetList,
+) int32 {
+	// Disallow disruptions when health is unknown, empty or red.
+	if es.Status.Health == esv1.ElasticsearchUnknownHealth ||
+		es.Status.Health == esv1.ElasticsearchHealth("") ||
+		es.Status.Health == esv1.ElasticsearchRedHealth {
+		ulog.FromContext(ctx).Info("Disruptions not allowed due to health status", "health", es.Status.Health)
+		return 0
+	}
+
+	// In a single node cluster (not highly-available) always allow 1 disruption
+	// to ensure K8s nodes operations can be performed.
+	if allStatefulSets.ExpectedNodeCount() == 1 {
+		return 1
+	}
+
+	// Allow 1 disruption for data roles only if health is green.
+	if role == esv1.DataRole {
+		if es.Status.Health == esv1.ElasticsearchGreenHealth {
+			return 1
+		}
+		ulog.FromContext(ctx).Info("Disruptions not allowed for data roles due to health not being green", "health", es.Status.Health)
+		return 0
+	}
+
+	// Allow a single disruption for non-data roles when health is green or yellow.
+	if es.Status.Health == esv1.ElasticsearchGreenHealth || es.Status.Health == esv1.ElasticsearchYellowHealth {
+		return 1
+	}
+
+	// In all other cases, we want to allow no disruptions.
+	ulog.FromContext(ctx).Info("Disruptions not allowed by default", "role", role, "health", es.Status.Health)
+	return 0
+}
+
+// selectorForStatefulSets returns a label selector that matches pods from specific StatefulSets.
+func selectorForStatefulSets(es esv1.Elasticsearch, ssetNames []string) *metav1.LabelSelector {
+	// For simplicity both single and multi-statefulsets use matchExpressions with In operator
+	return &metav1.LabelSelector{
+		MatchExpressions: []metav1.LabelSelectorRequirement{
+			{
+				Key:      label.ClusterNameLabelName,
+				Operator: metav1.LabelSelectorOpIn,
+				Values:   []string{es.Name},
+			},
+			{
+				Key:      label.StatefulSetNameLabelName,
+				Operator: metav1.LabelSelectorOpIn,
+				Values:   ssetNames,
+			},
+		},
+	}
+}
+
+// reconcileAndDeleteUnnecessaryPDBs reconciles the PDBs that are expected to exist and deletes any that exist but are not expected.
+func reconcileAndDeleteUnnecessaryPDBs(ctx context.Context, k8sClient k8s.Client, es esv1.Elasticsearch, expectedPDBs []*policyv1.PodDisruptionBudget) error {
+	existingPDBs, err := listAllRoleSpecificPDBs(ctx, k8sClient, es)
+	if err != nil {
+		return fmt.Errorf("while listing existing role-specific PDBs: %w", err)
+	}
+
+	toDelete := make(map[string]policyv1.PodDisruptionBudget)
+
+	// Populate the toDelete map with existing PDBs
+	for _, pdb := range existingPDBs {
+		toDelete[pdb.GetName()] = pdb
+	}
+
+	// Remove expected PDBs from the toDelete map
+	for _, pdb := range expectedPDBs {
+		delete(toDelete, pdb.Name)
+		// Ensure that the expected PDB is reconciled.
+		if err := reconcilePDB(ctx, k8sClient, es, pdb); err != nil {
+			return fmt.Errorf("while reconciling role-specific PDB %s: %w", pdb.Name, err)
+		}
+	}
+
+	// Delete unnecessary PDBs
+	for name, pdb := range toDelete {
+		if err := deletePDB(ctx, k8sClient, &pdb); err != nil {
+			return fmt.Errorf("while deleting role-specific PDB %s: %w", name, err)
+		}
+	}
+
+	return nil
+}
+
+// listAllRoleSpecificPDBs lists all role-specific PDBs for the cluster by retrieving
+// all PDBs in the namespace with the cluster label and verifying the owner reference.
+func listAllRoleSpecificPDBs(ctx context.Context, k8sClient k8s.Client, es esv1.Elasticsearch) ([]policyv1.PodDisruptionBudget, error) {
+	// List all PDBs in the namespace with the cluster label
+	pdbList := &policyv1.PodDisruptionBudgetList{}
+
+	if err := k8sClient.List(ctx, pdbList, client.InNamespace(es.Namespace), client.MatchingLabels{
+		label.ClusterNameLabelName: es.Name,
+	}); err != nil {
+		return nil, err
+	}
+
+	// Filter only PDBs that are owned by this Elasticsearch controller
+	var roleSpecificPDBs []policyv1.PodDisruptionBudget
+	for _, pdb := range pdbList.Items {
+		// Check if this PDB is owned by the Elasticsearch resource
+		if k8s.HasOwner(&pdb, &es) {
+			roleSpecificPDBs = append(roleSpecificPDBs, pdb)
+		}
+	}
+	return roleSpecificPDBs, nil
+}
+
+// deleteAllRoleSpecificPDBs deletes all existing role-specific PDBs for the cluster by retrieving
+// all PDBs in the namespace with the cluster label and verifying the owner reference.
+func deleteAllRoleSpecificPDBs(ctx context.Context, k8sClient k8s.Client, es esv1.Elasticsearch) error {
+	pdbList, err := listAllRoleSpecificPDBs(ctx, k8sClient, es)
+	if err != nil {
+		return err
+	}
+
+	// Delete PDBs owned by this Elasticsearch resource
+	for _, pdb := range pdbList {
+		// Ensure we do not delete the default PDB if it exists.
+		if k8s.HasOwner(&pdb, &es) && pdb.GetName() != esv1.DefaultPodDisruptionBudget(es.Name) {
+			if err := k8sClient.Delete(ctx, &pdb); err != nil && !apierrors.IsNotFound(err) {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/pkg/controller/elasticsearch/pdb/version.go b/pkg/controller/elasticsearch/pdb/version.go
deleted file mode 100644
index d493b9304..000000000
--- a/pkg/controller/elasticsearch/pdb/version.go
+++ /dev/null
@@ -1,67 +0,0 @@
-// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
-// or more contributor license agreements. Licensed under the Elastic License 2.0;
-// you may not use this file except in compliance with the Elastic License 2.0.
-
-package pdb
-
-import (
-	"reflect"
-	"sync"
-
-	policyv1 "k8s.io/api/policy/v1"
-	policyv1beta1 "k8s.io/api/policy/v1beta1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/utils/ptr"
-
-	"github.com/elastic/cloud-on-k8s/v3/pkg/utils/k8s"
-)
-
-var (
-	pdbVersionMutex sync.RWMutex
-	pdbV1Available  *bool
-)
-
-// convert converts v1 version of the PodDisruptionBudget resource to v1beta1
-func convert(toConvert *policyv1.PodDisruptionBudget) *policyv1beta1.PodDisruptionBudget {
-	v1beta1 := &policyv1beta1.PodDisruptionBudget{}
-	v1beta1.ObjectMeta = toConvert.ObjectMeta
-	v1beta1.Spec.MinAvailable = toConvert.Spec.MinAvailable
-	v1beta1.Spec.Selector = toConvert.Spec.Selector
-	v1beta1.Spec.MaxUnavailable = toConvert.Spec.MaxUnavailable
-	return v1beta1
-}
-
-func isPDBV1Available(k8sClient k8s.Client) (bool, error) {
-	isPDBV1Available := getPDBV1Available()
-	if isPDBV1Available != nil {
-		return *isPDBV1Available, nil
-	}
-	return initPDBV1Available(k8sClient)
-}
-
-func getPDBV1Available() *bool {
-	pdbVersionMutex.RLock()
-	defer pdbVersionMutex.RUnlock()
-	return pdbV1Available
-}
-
-func initPDBV1Available(k8sClient k8s.Client) (bool, error) {
-	pdbVersionMutex.Lock()
-	defer pdbVersionMutex.Unlock()
-	if pdbV1Available != nil {
-		return *pdbV1Available, nil
-	}
-	t := reflect.TypeOf(&policyv1.PodDisruptionBudget{})
-	gk := schema.GroupKind{
-		Group: policyv1.GroupName,
-		Kind:  t.Elem().Name(),
-	}
-	preferredMapping, err := k8sClient.RESTMapper().RESTMapping(gk)
-	if err != nil {
-		return false, err
-	}
-
-	// Rely on v1 as soon as v1beta1 is not the preferred version anymore.
-	pdbV1Available = ptr.To[bool](preferredMapping.Resource.Version != "v1beta1")
-	return *pdbV1Available, nil
-}
diff --git a/pkg/controller/elasticsearch/stackmon/__snapshots__/sidecar_test.snap b/pkg/controller/elasticsearch/stackmon/__snapshots__/sidecar_test.snap
index 5cd89d5e9..c83f4c0ed 100755
--- a/pkg/controller/elasticsearch/stackmon/__snapshots__/sidecar_test.snap
+++ b/pkg/controller/elasticsearch/stackmon/__snapshots__/sidecar_test.snap
@@ -190,9 +190,7 @@ setup.template.settings:
 
 [TestWithMonitoring/without_monitoring - 1]
 {
- "metadata": {
-  "creationTimestamp": null
- },
+ "metadata": {},
  "spec": {
   "automountServiceAccountToken": false,
   "containers": [
@@ -210,8 +208,7 @@ setup.template.settings:
  "metadata": {
   "annotations": {
    "elasticsearch.k8s.elastic.co/monitoring-config-hash": "421654492"
-  },
-  "creationTimestamp": null
+  }
  },
  "spec": {
   "automountServiceAccountToken": false,
@@ -344,8 +341,7 @@ setup.template.settings:
  "metadata": {
   "annotations": {
    "elasticsearch.k8s.elastic.co/monitoring-config-hash": "3392808927"
-  },
-  "creationTimestamp": null
+  }
  },
  "spec": {
   "automountServiceAccountToken": false,
@@ -476,8 +472,7 @@ setup.template.settings:
  "metadata": {
   "annotations": {
    "elasticsearch.k8s.elastic.co/monitoring-config-hash": "1805099278"
-  },
-  "creationTimestamp": null
+  }
  },
  "spec": {
   "automountServiceAccountToken": false,
@@ -713,8 +708,7 @@ setup.template.settings:
  "metadata": {
   "annotations": {
    "elasticsearch.k8s.elastic.co/monitoring-config-hash": "1086800329"
-  },
-  "creationTimestamp": null
+  }
  },
  "spec": {
   "automountServiceAccountToken": false,
diff --git a/pkg/controller/elasticsearch/validation/webhook.go b/pkg/controller/elasticsearch/validation/webhook.go
index 2cfaf16dd..16db67ec6 100644
--- a/pkg/controller/elasticsearch/validation/webhook.go
+++ b/pkg/controller/elasticsearch/validation/webhook.go
@@ -23,7 +23,7 @@ import (
 	"github.com/elastic/cloud-on-k8s/v3/pkg/utils/set"
 )
 
-// +kubebuilder:webhook:path=/validate-elasticsearch-k8s-elastic-co-v1-elasticsearch,mutating=false,failurePolicy=ignore,groups=elasticsearch.k8s.elastic.co,resources=elasticsearches,verbs=create;update,versions=v1,name=elastic-es-validation-v1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1;v1beta1,matchPolicy=Exact
+// +kubebuilder:webhook:path=/validate-elasticsearch-k8s-elastic-co-v1-elasticsearch,mutating=false,failurePolicy=ignore,groups=elasticsearch.k8s.elastic.co,resources=elasticsearches,verbs=create;update,versions=v1,name=elastic-es-validation-v1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1,matchPolicy=Exact
 
 const (
 	webhookPath = "/validate-elasticsearch-k8s-elastic-co-v1-elasticsearch"
diff --git a/pkg/controller/kibana/stackmon/__snapshots__/sidecar_test.snap b/pkg/controller/kibana/stackmon/__snapshots__/sidecar_test.snap
index 4afd125e8..868717631 100755
--- a/pkg/controller/kibana/stackmon/__snapshots__/sidecar_test.snap
+++ b/pkg/controller/kibana/stackmon/__snapshots__/sidecar_test.snap
@@ -1,9 +1,7 @@
 
 [TestWithMonitoring/without_monitoring - 1]
 {
- "metadata": {
-  "creationTimestamp": null
- },
+ "metadata": {},
  "spec": {
   "automountServiceAccountToken": false,
   "containers": [
@@ -21,8 +19,7 @@
  "metadata": {
   "annotations": {
    "kibana.k8s.elastic.co/monitoring-config-hash": "1132877422"
-  },
-  "creationTimestamp": null
+  }
  },
  "spec": {
   "automountServiceAccountToken": false,
@@ -145,8 +142,7 @@
  "metadata": {
   "annotations": {
    "kibana.k8s.elastic.co/monitoring-config-hash": "95064241"
-  },
-  "creationTimestamp": null
+  }
  },
  "spec": {
   "automountServiceAccountToken": false,
@@ -271,8 +267,7 @@
  "metadata": {
   "annotations": {
    "kibana.k8s.elastic.co/monitoring-config-hash": "1633666673"
-  },
-  "creationTimestamp": null
+  }
  },
  "spec": {
   "automountServiceAccountToken": false,
@@ -492,8 +487,7 @@
  "metadata": {
   "annotations": {
    "kibana.k8s.elastic.co/monitoring-config-hash": "1902028541"
-  },
-  "creationTimestamp": null
+  }
  },
  "spec": {
   "automountServiceAccountToken": false,
diff --git a/pkg/controller/logstash/stackmon/__snapshots__/sidecar_test.snap b/pkg/controller/logstash/stackmon/__snapshots__/sidecar_test.snap
index f73305e8f..41ed731b5 100755
--- a/pkg/controller/logstash/stackmon/__snapshots__/sidecar_test.snap
+++ b/pkg/controller/logstash/stackmon/__snapshots__/sidecar_test.snap
@@ -144,9 +144,7 @@ processors:
 
 [TestWithMonitoring/without_monitoring - 1]
 {
- "metadata": {
-  "creationTimestamp": null
- },
+ "metadata": {},
  "spec": {
   "automountServiceAccountToken": false,
   "containers": [
@@ -164,8 +162,7 @@ processors:
  "metadata": {
   "annotations": {
    "logstash.k8s.elastic.co/monitoring-config-hash": "625208580"
-  },
-  "creationTimestamp": null
+  }
  },
  "spec": {
   "automountServiceAccountToken": false,
@@ -276,8 +273,7 @@ processors:
  "metadata": {
   "annotations": {
    "logstash.k8s.elastic.co/monitoring-config-hash": "2320787694"
-  },
-  "creationTimestamp": null
+  }
  },
  "spec": {
   "automountServiceAccountToken": false,
@@ -400,8 +396,7 @@ processors:
  "metadata": {
   "annotations": {
    "logstash.k8s.elastic.co/monitoring-config-hash": "983125293"
-  },
-  "creationTimestamp": null
+  }
  },
  "spec": {
   "automountServiceAccountToken": false,
@@ -522,8 +517,7 @@ processors:
  "metadata": {
   "annotations": {
    "logstash.k8s.elastic.co/monitoring-config-hash": "808554888"
-  },
-  "creationTimestamp": null
+  }
  },
  "spec": {
   "automountServiceAccountToken": false,
@@ -727,8 +721,7 @@ processors:
  "metadata": {
   "annotations": {
    "logstash.k8s.elastic.co/monitoring-config-hash": "2399876695"
-  },
-  "creationTimestamp": null
+  }
  },
  "spec": {
   "automountServiceAccountToken": false,
@@ -939,8 +932,7 @@ processors:
  "metadata": {
   "annotations": {
    "logstash.k8s.elastic.co/monitoring-config-hash": "808554888"
-  },
-  "creationTimestamp": null
+  }
  },
  "spec": {
   "automountServiceAccountToken": false,
diff --git a/pkg/controller/logstash/validation/webhook.go b/pkg/controller/logstash/validation/webhook.go
index ec16a5827..257ab7952 100644
--- a/pkg/controller/logstash/validation/webhook.go
+++ b/pkg/controller/logstash/validation/webhook.go
@@ -22,7 +22,7 @@ import (
 	"github.com/elastic/cloud-on-k8s/v3/pkg/utils/set"
 )
 
-// +kubebuilder:webhook:path=/validate-logstash-k8s-elastic-co-v1alpha1-logstash,mutating=false,failurePolicy=ignore,groups=logstash.k8s.elastic.co,resources=logstashes,verbs=create;update,versions=v1alpha1,name=elastic-logstash-validation-v1alpha1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1;v1beta1,matchPolicy=Exact
+// +kubebuilder:webhook:path=/validate-logstash-k8s-elastic-co-v1alpha1-logstash,mutating=false,failurePolicy=ignore,groups=logstash.k8s.elastic.co,resources=logstashes,verbs=create;update,versions=v1alpha1,name=elastic-logstash-validation-v1alpha1.k8s.elastic.co,sideEffects=None,admissionReviewVersions=v1,matchPolicy=Exact
 
 const (
 	webhookPath = "/validate-logstash-k8s-elastic-co-v1alpha1-logstash"
diff --git a/pkg/controller/logstash/volume/pvc_expansion.go b/pkg/controller/logstash/volume/pvc_expansion.go
index 4f3e64f47..c79f53b5e 100644
--- a/pkg/controller/logstash/volume/pvc_expansion.go
+++ b/pkg/controller/logstash/volume/pvc_expansion.go
@@ -15,12 +15,11 @@ import (
 )
 
 func RecreateStatefulSets(ctx context.Context, k8sclient k8s.Client, ls logstashv1alpha1.Logstash) (int, error) {
-	return commonvolume.RecreateStatefulSets(ctx, k8sclient, &ls, ls.Kind)
+	return commonvolume.RecreateStatefulSets(ctx, k8sclient, &ls)
 }
 
 func HandleVolumeExpansion(ctx context.Context, k8sClient k8s.Client, ls logstashv1alpha1.Logstash,
 	expectedSset appsv1.StatefulSet, actualSset appsv1.StatefulSet,
 	validateStorageClass bool) (bool, error) {
-	return commonvolume.HandleVolumeExpansion(ctx, k8sClient, &ls, ls.Kind, expectedSset,
-		actualSset, validateStorageClass)
+	return commonvolume.HandleVolumeExpansion(ctx, k8sClient, &ls, expectedSset, actualSset, validateStorageClass)
 }
diff --git a/pkg/controller/webhook/admission_registration.go b/pkg/controller/webhook/admission_registration.go
index cb60e730c..59bea32b0 100644
--- a/pkg/controller/webhook/admission_registration.go
+++ b/pkg/controller/webhook/admission_registration.go
@@ -8,14 +8,10 @@ import (
 	"context"
 
 	v1 "k8s.io/api/admissionregistration/v1"
-	"k8s.io/api/admissionregistration/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/kubernetes"
 	"sigs.k8s.io/controller-runtime/pkg/client"
-
-	ulog "github.com/elastic/cloud-on-k8s/v3/pkg/utils/log"
 )
 
 type webhook struct {
@@ -37,22 +33,6 @@ type AdmissionControllerInterface interface {
 }
 
 func (w *Params) NewAdmissionControllerInterface(ctx context.Context, clientset kubernetes.Interface) (AdmissionControllerInterface, error) {
-	log := ulog.FromContext(ctx)
-	// Detect if V1 is available
-	_, err := clientset.Discovery().ServerResourcesForGroupVersion(v1.SchemeGroupVersion.String())
-	if errors.IsNotFound(err) { // Presumably a K8S cluster older than 1.16
-		log.V(1).Info("admissionregistration.k8s.io/v1 is not available, using v1beta1 for webhook configuration")
-		webhookConfiguration, err := clientset.AdmissionregistrationV1beta1().ValidatingWebhookConfigurations().Get(ctx, w.Name, metav1.GetOptions{})
-		if err != nil {
-			// 404 is also considered as an error, webhook configuration is expected to be created before the operator is started
-			return nil, err
-		}
-		return &v1beta1webhookHandler{ctx: ctx, clientset: clientset, webhookConfiguration: webhookConfiguration}, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	log.V(1).Info("using admissionregistration.k8s.io/v1 for webhook configuration")
 	webhookConfiguration, err := clientset.AdmissionregistrationV1().ValidatingWebhookConfigurations().Get(ctx, w.Name, metav1.GetOptions{})
 	if err != nil {
 		// 404 is also considered as an error, webhook configuration is expected to be created before the operator is started
@@ -112,54 +92,3 @@ func (v1w *v1webhookHandler) updateCABundle(caCert []byte) error {
 		Update(v1w.ctx, v1w.webhookConfiguration, metav1.UpdateOptions{})
 	return err
 }
-
-// - admissionregistration.k8s.io/v1beta1 implementation
-
-var _ AdmissionControllerInterface = &v1beta1webhookHandler{}
-
-type v1beta1webhookHandler struct {
-	clientset            kubernetes.Interface
-	ctx                  context.Context
-	webhookConfiguration *v1beta1.ValidatingWebhookConfiguration
-}
-
-func (*v1beta1webhookHandler) getType() client.Object {
-	return &v1beta1.ValidatingWebhookConfiguration{}
-}
-
-func (v1beta1w *v1beta1webhookHandler) webhooks() []webhook {
-	webhooks := make([]webhook, 0, len(v1beta1w.webhookConfiguration.Webhooks))
-	for _, wh := range v1beta1w.webhookConfiguration.Webhooks {
-		webhook := webhook{
-			webhookConfigurationName: v1beta1w.webhookConfiguration.Name,
-			caBundle:                 wh.ClientConfig.CABundle,
-		}
-		webhooks = append(webhooks, webhook)
-	}
-	return webhooks
-}
-
-func (v1beta1w *v1beta1webhookHandler) services() Services {
-	services := make(map[types.NamespacedName]struct{})
-	for _, wh := range v1beta1w.webhookConfiguration.Webhooks {
-		if wh.ClientConfig.Service == nil {
-			continue
-		}
-		services[types.NamespacedName{
-			Namespace: wh.ClientConfig.Service.Namespace,
-			Name:      wh.ClientConfig.Service.Name,
-		}] = struct{}{}
-	}
-	return services
-}
-
-func (v1beta1w *v1beta1webhookHandler) updateCABundle(caCert []byte) error {
-	for i := range v1beta1w.webhookConfiguration.Webhooks {
-		v1beta1w.webhookConfiguration.Webhooks[i].ClientConfig.CABundle = caCert
-	}
-	_, err := v1beta1w.clientset.
-		AdmissionregistrationV1beta1().
-		ValidatingWebhookConfigurations().
-		Update(v1beta1w.ctx, v1beta1w.webhookConfiguration, metav1.UpdateOptions{})
-	return err
-}
diff --git a/pkg/utils/k8s/fake.go b/pkg/utils/k8s/fake.go
index ab8836075..b0649c13a 100644
--- a/pkg/utils/k8s/fake.go
+++ b/pkg/utils/k8s/fake.go
@@ -33,6 +33,10 @@ type failingSubClient struct {
 	err error
 }
 
+func (fc failingClient) Apply(_ context.Context, _ runtime.ApplyConfiguration, _ ...client.ApplyOption) error {
+	return fc.err
+}
+
 func (fc failingSubClient) Create(_ context.Context, _ client.Object, _ client.Object, _ ...client.SubResourceCreateOption) error {
 	return fc.err
 }



Test patch:
diff --git a/.buildkite/scripts/test/set-deployer-config.sh b/.buildkite/scripts/test/set-deployer-config.sh
index 4cbd55e14..07c7d64b5 100755
--- a/.buildkite/scripts/test/set-deployer-config.sh
+++ b/.buildkite/scripts/test/set-deployer-config.sh
@@ -25,7 +25,7 @@ ROOT="$WD/../../.."
 
 w()  { echo "$@" >> "$ROOT/deployer-config.yml"; }
 
-write_deployer_config() { 
+write_deployer_config() {
     :> "$ROOT/deployer-config.yml"
 
     w "id: ${E2E_PROVIDER}-ci"
@@ -36,7 +36,7 @@ write_deployer_config() {
     w "  operation: ${DEPLOYER_OPERATION:-create}"
     w "  clusterName: ${CLUSTER_NAME}"
 
-    # k8s version for ocp, kind    
+    # k8s version for ocp, kind
     if [[ "${DEPLOYER_CLIENT_VERSION:-}" != "" ]]; then
     w '  clientVersion: "'"${DEPLOYER_CLIENT_VERSION}"'"'
     fi
@@ -58,6 +58,11 @@ write_deployer_config() {
     w "    nodeImage: ${DEPLOYER_KIND_NODE_IMAGE}"
     w "    ipFamily: ${DEPLOYER_KIND_IP_FAMILY:-ipv4}"
     fi
+
+    if [[ "${DEPLOYER_K3D_NODE_IMAGE:-}" ]]; then
+    w "  k3d:"
+    w "    nodeImage: ${DEPLOYER_K3D_NODE_IMAGE}"
+    fi
 }
 
 write_deployer_config
diff --git a/deploy/eck-stack/charts/eck-kibana/templates/tests/kibana_test.yaml b/deploy/eck-stack/charts/eck-kibana/templates/tests/kibana_test.yaml
index 35e25ad72..17263337a 100644
--- a/deploy/eck-stack/charts/eck-kibana/templates/tests/kibana_test.yaml
+++ b/deploy/eck-stack/charts/eck-kibana/templates/tests/kibana_test.yaml
@@ -128,7 +128,21 @@ tests:
   - it: not setting elasticsearchRef should fail
     asserts:
       - failedTemplate:
-          errorMessage: "An elasticsearchRef is required"
+          errorMessage: "An elasticsearchRef name or secretName is required"
+  - it: setting elasticsearchRef.secretName should not fail
+    set:
+      spec:
+        elasticsearchRef:
+          secretName: remote-es-credentials
+    release:
+      name: quickstart
+    asserts:
+      - isKind:
+          of: Kibana
+      - equal:
+          path: spec.elasticsearchRef
+          value:
+            secretName: remote-es-credentials
   - it: values.spec.config should render properly
     set:
       spec:
diff --git a/pkg/apis/apm/v1/webhook_test.go b/pkg/apis/apm/v1/webhook_test.go
index 58c2c4cff..8e84cdd38 100644
--- a/pkg/apis/apm/v1/webhook_test.go
+++ b/pkg/apis/apm/v1/webhook_test.go
@@ -10,7 +10,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
-	admissionv1beta1 "k8s.io/api/admission/v1beta1"
+	admissionv1 "k8s.io/api/admission/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -24,7 +24,7 @@ func TestWebhook(t *testing.T) {
 	testCases := []test.ValidationWebhookTestCase{
 		{
 			Name:      "create-valid",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -34,7 +34,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unknown-field",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -49,7 +49,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "long-name",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -62,7 +62,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "invalid-version",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -75,7 +75,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unsupported-version-lower",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -88,7 +88,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unsupported-version-higher",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -101,7 +101,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unsupported-version-for-kibana-ref",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -115,7 +115,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "support-74-if-kibana-ref-not-set",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -128,7 +128,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "update-valid",
-			Operation: admissionv1beta1.Update,
+			Operation: admissionv1.Update,
 			OldObject: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -145,7 +145,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "version-downgrade",
-			Operation: admissionv1beta1.Update,
+			Operation: admissionv1.Update,
 			OldObject: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -164,7 +164,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "version-downgrade with override",
-			Operation: admissionv1beta1.Update,
+			Operation: admissionv1.Update,
 			OldObject: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -184,7 +184,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "named-es-kibana-ref",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -196,7 +196,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "secret-named-kibana-ref",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -208,7 +208,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "invalid-secret-kibana-ref-with-name",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -221,7 +221,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "invalid-secret-es-ref-with-namespace",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
diff --git a/pkg/apis/apm/v1beta1/webhook_test.go b/pkg/apis/apm/v1beta1/webhook_test.go
index 5949228bf..c8c0033ca 100644
--- a/pkg/apis/apm/v1beta1/webhook_test.go
+++ b/pkg/apis/apm/v1beta1/webhook_test.go
@@ -10,7 +10,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
-	admissionv1beta1 "k8s.io/api/admission/v1beta1"
+	admissionv1 "k8s.io/api/admission/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -24,7 +24,7 @@ func TestWebhook(t *testing.T) {
 	testCases := []test.ValidationWebhookTestCase{
 		{
 			Name:      "create-valid",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -34,7 +34,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unknown-field",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -49,7 +49,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "long-name",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -62,7 +62,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "invalid-version",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -75,7 +75,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unsupported-version-lower",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -88,7 +88,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unsupported-version-higher",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -101,7 +101,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "update-valid",
-			Operation: admissionv1beta1.Update,
+			Operation: admissionv1.Update,
 			OldObject: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -118,7 +118,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "version-downgrade",
-			Operation: admissionv1beta1.Update,
+			Operation: admissionv1.Update,
 			OldObject: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -137,7 +137,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "deprecated version",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
@@ -150,7 +150,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "version-downgrade with override",
-			Operation: admissionv1beta1.Update,
+			Operation: admissionv1.Update,
 			OldObject: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				apm := mkApmServer(uid)
diff --git a/pkg/apis/enterprisesearch/v1/webhook_test.go b/pkg/apis/enterprisesearch/v1/webhook_test.go
index 6cbe70be1..876f5cbc4 100644
--- a/pkg/apis/enterprisesearch/v1/webhook_test.go
+++ b/pkg/apis/enterprisesearch/v1/webhook_test.go
@@ -10,7 +10,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
-	admissionv1beta1 "k8s.io/api/admission/v1beta1"
+	admissionv1 "k8s.io/api/admission/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -24,7 +24,7 @@ func TestWebhook(t *testing.T) {
 	testCases := []test.ValidationWebhookTestCase{
 		{
 			Name:      "create-valid",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -34,7 +34,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unknown-field",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -49,7 +49,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "long-name",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -62,7 +62,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "invalid-version",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -75,7 +75,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unsupported-version-lower",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -88,7 +88,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "deprecated-version",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -101,7 +101,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unsupported-version-higher",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -114,7 +114,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "update-valid",
-			Operation: admissionv1beta1.Update,
+			Operation: admissionv1.Update,
 			OldObject: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -131,7 +131,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "version-downgrade",
-			Operation: admissionv1beta1.Update,
+			Operation: admissionv1.Update,
 			OldObject: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -150,7 +150,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "version-downgrade-with-override",
-			Operation: admissionv1beta1.Update,
+			Operation: admissionv1.Update,
 			OldObject: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -170,7 +170,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "named-es-ref",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -181,7 +181,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "secret-named-es-ref",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -192,7 +192,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "invalid-secret-es-ref-with-name",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -205,7 +205,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "invalid-secret-es-ref-with-namespace",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -218,7 +218,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "invalid-secret-es-ref-with-service",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
diff --git a/pkg/apis/enterprisesearch/v1beta1/webhook_test.go b/pkg/apis/enterprisesearch/v1beta1/webhook_test.go
index 6dc30667f..087b2030f 100644
--- a/pkg/apis/enterprisesearch/v1beta1/webhook_test.go
+++ b/pkg/apis/enterprisesearch/v1beta1/webhook_test.go
@@ -10,7 +10,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
-	admissionv1beta1 "k8s.io/api/admission/v1beta1"
+	admissionv1 "k8s.io/api/admission/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -24,7 +24,7 @@ func TestWebhook(t *testing.T) {
 	testCases := []test.ValidationWebhookTestCase{
 		{
 			Name:      "create-valid",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -34,7 +34,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unknown-field",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -49,7 +49,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "long-name",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -62,7 +62,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "invalid-version",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -75,7 +75,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unsupported-version-lower",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -88,7 +88,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unsupported-version-higher",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -101,7 +101,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "deprecated-version",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -114,7 +114,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "update-valid",
-			Operation: admissionv1beta1.Update,
+			Operation: admissionv1.Update,
 			OldObject: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -131,7 +131,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "version-downgrade",
-			Operation: admissionv1beta1.Update,
+			Operation: admissionv1.Update,
 			OldObject: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
@@ -150,7 +150,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "version-downgrade-with-override",
-			Operation: admissionv1beta1.Update,
+			Operation: admissionv1.Update,
 			OldObject: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkEnterpriseSearch(uid)
diff --git a/pkg/apis/kibana/v1/webhook_test.go b/pkg/apis/kibana/v1/webhook_test.go
index 40697d694..f8b151c57 100644
--- a/pkg/apis/kibana/v1/webhook_test.go
+++ b/pkg/apis/kibana/v1/webhook_test.go
@@ -10,7 +10,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
-	admissionv1beta1 "k8s.io/api/admission/v1beta1"
+	admissionv1 "k8s.io/api/admission/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -24,7 +24,7 @@ func TestWebhook(t *testing.T) {
 	testCases := []test.ValidationWebhookTestCase{
 		{
 			Name:      "create-valid",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				k := mkKibana(uid)
@@ -34,7 +34,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unknown-field",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				k := mkKibana(uid)
@@ -49,7 +49,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "long-name",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				k := mkKibana(uid)
@@ -62,7 +62,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "invalid-version",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				k := mkKibana(uid)
@@ -75,7 +75,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "deprecated-version",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				k := mkKibana(uid)
@@ -88,7 +88,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unsupported-version-lower",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				k := mkKibana(uid)
@@ -101,7 +101,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unsupported-version-higher",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				k := mkKibana(uid)
@@ -114,7 +114,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "update-valid",
-			Operation: admissionv1beta1.Update,
+			Operation: admissionv1.Update,
 			OldObject: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				k := mkKibana(uid)
@@ -131,7 +131,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "version-downgrade",
-			Operation: admissionv1beta1.Update,
+			Operation: admissionv1.Update,
 			OldObject: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				k := mkKibana(uid)
@@ -150,7 +150,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "version-downgrade-with-override",
-			Operation: admissionv1beta1.Update,
+			Operation: admissionv1.Update,
 			OldObject: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				k := mkKibana(uid)
@@ -170,7 +170,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "named-es-ref",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkKibana(uid)
@@ -181,7 +181,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "named-es-ref-with-namesapce",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkKibana(uid)
@@ -192,7 +192,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "named-es-ref-with-servicename",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkKibana(uid)
@@ -203,7 +203,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "secret-es-ref",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkKibana(uid)
@@ -214,7 +214,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "invalid-secret-es-ref-secret-and-name",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				kb := mkKibana(uid)
@@ -227,7 +227,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "invalid-secret-es-ref-secret-and-namespace",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				kb := mkKibana(uid)
@@ -240,7 +240,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "invalid-secret-es-ref-secret-and-service",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				kb := mkKibana(uid)
@@ -253,7 +253,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "simple-stackmon-ref",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkKibana(uid)
@@ -266,7 +266,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "multiple-stackmon-ref",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkKibana(uid)
@@ -282,7 +282,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "invalid-version-for-stackmon",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkKibana(uid)
@@ -297,7 +297,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "invalid-stackmon-ref-with-name",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkKibana(uid)
@@ -315,7 +315,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "invalid-stackmon-ref-with-service-name",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				ent := mkKibana(uid)
diff --git a/pkg/apis/kibana/v1beta1/webhook_test.go b/pkg/apis/kibana/v1beta1/webhook_test.go
index 6ff320f54..fab9253cd 100644
--- a/pkg/apis/kibana/v1beta1/webhook_test.go
+++ b/pkg/apis/kibana/v1beta1/webhook_test.go
@@ -10,7 +10,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
-	admissionv1beta1 "k8s.io/api/admission/v1beta1"
+	admissionv1 "k8s.io/api/admission/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -24,7 +24,7 @@ func TestWebhook(t *testing.T) {
 	testCases := []test.ValidationWebhookTestCase{
 		{
 			Name:      "create-valid",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				k := mkKibana(uid)
@@ -34,7 +34,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unknown-field",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				k := mkKibana(uid)
@@ -49,7 +49,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "long-name",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				k := mkKibana(uid)
@@ -62,7 +62,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "invalid-version",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				k := mkKibana(uid)
@@ -75,7 +75,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "deprecated-version",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				k := mkKibana(uid)
@@ -88,7 +88,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unsupported-version-lower",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				k := mkKibana(uid)
@@ -101,7 +101,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unsupported-version-higher",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				k := mkKibana(uid)
@@ -114,7 +114,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "update-valid",
-			Operation: admissionv1beta1.Update,
+			Operation: admissionv1.Update,
 			OldObject: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				k := mkKibana(uid)
@@ -131,7 +131,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "version-downgrade",
-			Operation: admissionv1beta1.Update,
+			Operation: admissionv1.Update,
 			OldObject: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				k := mkKibana(uid)
@@ -150,7 +150,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "version-downgrade-with-override",
-			Operation: admissionv1beta1.Update,
+			Operation: admissionv1.Update,
 			OldObject: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				k := mkKibana(uid)
diff --git a/pkg/apis/maps/v1alpha1/webhook_test.go b/pkg/apis/maps/v1alpha1/webhook_test.go
index dbeb4a1f5..a870975c6 100644
--- a/pkg/apis/maps/v1alpha1/webhook_test.go
+++ b/pkg/apis/maps/v1alpha1/webhook_test.go
@@ -10,7 +10,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
-	admissionv1beta1 "k8s.io/api/admission/v1beta1"
+	admissionv1 "k8s.io/api/admission/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -24,7 +24,7 @@ func TestWebhook(t *testing.T) {
 	testCases := []test.ValidationWebhookTestCase{
 		{
 			Name:      "create-valid",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				m := mkMaps(uid)
@@ -34,7 +34,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unknown-field",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				m := mkMaps(uid)
@@ -49,7 +49,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "long-name",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				m := mkMaps(uid)
@@ -62,7 +62,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "invalid-version",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				m := mkMaps(uid)
@@ -75,7 +75,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "deprecated-version",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				m := mkMaps(uid)
@@ -88,7 +88,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unsupported-version-lower",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				m := mkMaps(uid)
@@ -101,7 +101,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unsupported-version-higher",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				m := mkMaps(uid)
@@ -114,7 +114,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "named-es-ref",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				m := mkMaps(uid)
@@ -126,7 +126,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "secret-es-ref",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				m := mkMaps(uid)
@@ -138,7 +138,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "invalid-secret-es-ref-name",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				m := mkMaps(uid)
@@ -152,7 +152,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "invalid-secret-es-ref-namespace",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				m := mkMaps(uid)
diff --git a/pkg/apis/stackconfigpolicy/v1alpha1/webhook_test.go b/pkg/apis/stackconfigpolicy/v1alpha1/webhook_test.go
index 59dbcebb6..8aae68bbd 100644
--- a/pkg/apis/stackconfigpolicy/v1alpha1/webhook_test.go
+++ b/pkg/apis/stackconfigpolicy/v1alpha1/webhook_test.go
@@ -10,7 +10,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
-	admissionv1beta1 "k8s.io/api/admission/v1beta1"
+	admissionv1 "k8s.io/api/admission/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -24,7 +24,7 @@ func TestWebhook(t *testing.T) {
 	testCases := []test.ValidationWebhookTestCase{
 		{
 			Name:      "create-valid",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				m := mkStackConfigPolicy(uid)
@@ -44,7 +44,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "create-valid-kibana",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				m := mkStackConfigPolicy(uid)
@@ -58,7 +58,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "unknown-field",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				m := mkStackConfigPolicy(uid)
@@ -76,7 +76,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "long-name",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				m := mkStackConfigPolicy(uid)
@@ -89,7 +89,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "no-settings",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				m := mkStackConfigPolicy(uid)
@@ -106,7 +106,7 @@ func TestWebhook(t *testing.T) {
 		},
 		{
 			Name:      "create-duplicate-mountpaths",
-			Operation: admissionv1beta1.Create,
+			Operation: admissionv1.Create,
 			Object: func(t *testing.T, uid string) []byte {
 				t.Helper()
 				m := mkStackConfigPolicy(uid)
diff --git a/pkg/controller/autoscaling/elasticsearch/validation/webhook_test.go b/pkg/controller/autoscaling/elasticsearch/validation/webhook_test.go
index e33b4e101..e426a61d9 100644
--- a/pkg/controller/autoscaling/elasticsearch/validation/webhook_test.go
+++ b/pkg/controller/autoscaling/elasticsearch/validation/webhook_test.go
@@ -139,7 +139,7 @@ func TestValidateElasticsearchAutoscaler(t *testing.T) {
 				},
 				checker: yesCheck,
 			},
-			wantValidationError: ptr.To[string]("Invalid value: []string{\"ml\"}: roles must be used in at least one nodeSet"),
+			wantValidationError: ptr.To[string]("Invalid value: [\"ml\"]: roles must be used in at least one nodeSet"),
 		},
 		{
 			name: "Policy name is duplicated",
@@ -505,7 +505,7 @@ func TestValidateElasticsearchAutoscaler(t *testing.T) {
 				},
 				checker: yesCheck,
 			},
-			wantValidationError: ptr.To[string]("ElasticsearchAutoscaler.autoscaling.k8s.elastic.co \"esa\" is invalid: Elasticsearch.spec.nodeSets[0]: Invalid value: []string{\"volume1\", \"volume2\"}: autoscaling supports only one volume claim"),
+			wantValidationError: ptr.To[string]("ElasticsearchAutoscaler.autoscaling.k8s.elastic.co \"esa\" is invalid: Elasticsearch.spec.nodeSets[0]: Invalid value: [\"volume1\",\"volume2\"]: autoscaling supports only one volume claim"),
 		},
 		{
 			name: "ML policy with roles [ml, remote_cluster_client] succeeds",
diff --git a/pkg/controller/common/volume/pvc_expansion_test.go b/pkg/controller/common/volume/pvc_expansion_test.go
index bc63ab5e8..9eec0885b 100644
--- a/pkg/controller/common/volume/pvc_expansion_test.go
+++ b/pkg/controller/common/volume/pvc_expansion_test.go
@@ -17,8 +17,10 @@ import (
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes/scheme"
+	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/apiutil"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
 	esv1 "github.com/elastic/cloud-on-k8s/v3/pkg/apis/elasticsearch/v1"
@@ -198,7 +200,7 @@ func Test_handleVolumeExpansionElasticsearch(t *testing.T) {
 			}
 
 			k8sClient := k8s.NewFakeClient(append(tt.runtimeObjs, &es)...)
-			recreate, err := HandleVolumeExpansion(context.Background(), k8sClient, &es, es.Kind,
+			recreate, err := HandleVolumeExpansion(context.Background(), k8sClient, &es,
 				tt.args.expectedSset, tt.args.actualSset, tt.args.validateStorageClass)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("handleVolumeExpansion() error = %v, wantErr %v", err, tt.wantErr)
@@ -225,7 +227,11 @@ func Test_handleVolumeExpansionElasticsearch(t *testing.T) {
 				wantUpdatedSset.Spec.VolumeClaimTemplates = tt.args.expectedSset.Spec.VolumeClaimTemplates
 
 				// test ssetsToRecreate along the way
-				toRecreate, err := ssetsToRecreate(&retrievedES, retrievedES.Kind)
+				gvk, err := apiutil.GVKForObject(&retrievedES, clientgoscheme.Scheme)
+				if err != nil {
+					t.Fatal(err)
+				}
+				toRecreate, err := ssetsToRecreate(&retrievedES, gvk.Kind)
 				require.NoError(t, err)
 				require.Equal(t,
 					map[string]appsv1.StatefulSet{
@@ -365,7 +371,7 @@ func Test_handleVolumeExpansionLogstash(t *testing.T) {
 				ObjectMeta: metav1.ObjectMeta{Namespace: "ns", Name: "ls"},
 				TypeMeta:   metav1.TypeMeta{Kind: logstashv1alpha1.Kind}}
 			k8sClient := k8s.NewFakeClient(append(tt.runtimeObjs, &ls)...)
-			recreate, err := HandleVolumeExpansion(context.Background(), k8sClient, &ls, ls.Kind,
+			recreate, err := HandleVolumeExpansion(context.Background(), k8sClient, &ls,
 				tt.args.expectedSset, tt.args.actualSset, tt.args.validateStorageClass)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("handleVolumeExpansion() error = %v, wantErr %v", err, tt.wantErr)
@@ -392,7 +398,11 @@ func Test_handleVolumeExpansionLogstash(t *testing.T) {
 				wantUpdatedSset.Spec.VolumeClaimTemplates = tt.args.expectedSset.Spec.VolumeClaimTemplates
 
 				// test ssetsToRecreate along the way
-				toRecreate, err := ssetsToRecreate(&retrievedLS, retrievedLS.Kind)
+				gvk, err := apiutil.GVKForObject(&retrievedLS, clientgoscheme.Scheme)
+				if err != nil {
+					t.Fatal(err)
+				}
+				toRecreate, err := ssetsToRecreate(&retrievedLS, gvk.Kind)
 				require.NoError(t, err)
 				require.Equal(t,
 					map[string]appsv1.StatefulSet{
@@ -568,7 +578,7 @@ func Test_recreateStatefulSets(t *testing.T) {
 			es := tt.args.es
 			k8sClient := k8s.NewFakeClient(append(tt.args.runtimeObjs, &es)...)
 
-			got, err := RecreateStatefulSets(context.Background(), k8sClient, &es, es.Kind)
+			got, err := RecreateStatefulSets(context.Background(), k8sClient, &es)
 			require.NoError(t, err)
 			require.Equal(t, tt.wantRecreations, got)
 
diff --git a/pkg/controller/elasticsearch/driver/upscale_test.go b/pkg/controller/elasticsearch/driver/upscale_test.go
index 383348f69..7120fea7e 100644
--- a/pkg/controller/elasticsearch/driver/upscale_test.go
+++ b/pkg/controller/elasticsearch/driver/upscale_test.go
@@ -323,6 +323,8 @@ func TestHandleUpscaleAndSpecChanges_PVCResize(t *testing.T) {
 	require.True(t, res.Requeue)
 	require.NoError(t, k8sClient.Get(context.Background(), k8s.ExtractNamespacedName(&es.ObjectMeta), &es))
 	require.Len(t, es.Annotations, 2) // initial master nodes + sset to recreate
+	_, hasRecreateAnnotationForSset2 := es.Annotations["elasticsearch.k8s.elastic.co/recreate-sset2"]
+	require.True(t, hasRecreateAnnotationForSset2)
 }
 
 func Test_adjustStatefulSetReplicas(t *testing.T) {
diff --git a/pkg/controller/elasticsearch/pdb/reconcile_test.go b/pkg/controller/elasticsearch/pdb/reconcile_default_test.go
similarity index 77%
rename from pkg/controller/elasticsearch/pdb/reconcile_test.go
rename to pkg/controller/elasticsearch/pdb/reconcile_default_test.go
index 426d0ffb7..272b47507 100644
--- a/pkg/controller/elasticsearch/pdb/reconcile_test.go
+++ b/pkg/controller/elasticsearch/pdb/reconcile_default_test.go
@@ -32,30 +32,31 @@ import (
 	es_sset "github.com/elastic/cloud-on-k8s/v3/pkg/controller/elasticsearch/sset"
 )
 
-func TestReconcile(t *testing.T) {
-	defaultPDB := func() *policyv1.PodDisruptionBudget {
-		return &policyv1.PodDisruptionBudget{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      esv1.DefaultPodDisruptionBudget("cluster"),
-				Namespace: "ns",
-				Labels:    map[string]string{label.ClusterNameLabelName: "cluster", commonv1.TypeLabelName: label.Type},
-			},
-			Spec: policyv1.PodDisruptionBudgetSpec{
-				MinAvailable: intStrPtr(intstr.FromInt(3)),
-				Selector: &metav1.LabelSelector{
-					MatchLabels: map[string]string{
-						label.ClusterNameLabelName: "cluster",
-					},
+func defaultPDB() *policyv1.PodDisruptionBudget {
+	return &policyv1.PodDisruptionBudget{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      esv1.DefaultPodDisruptionBudget("cluster"),
+			Namespace: "ns",
+			Labels:    map[string]string{label.ClusterNameLabelName: "cluster", commonv1.TypeLabelName: label.Type},
+		},
+		Spec: policyv1.PodDisruptionBudgetSpec{
+			MinAvailable: intStrPtr(intstr.FromInt(3)),
+			Selector: &metav1.LabelSelector{
+				MatchLabels: map[string]string{
+					label.ClusterNameLabelName: "cluster",
 				},
-				MaxUnavailable: nil,
 			},
-		}
+			MaxUnavailable: nil,
+		},
 	}
-	defaultEs := esv1.Elasticsearch{ObjectMeta: metav1.ObjectMeta{Name: "cluster", Namespace: "ns"}}
+}
+
+func TestReconcile(t *testing.T) {
+	defaultEs := esv1.Elasticsearch{ObjectMeta: metav1.ObjectMeta{Name: "cluster", Namespace: "ns"}, Spec: esv1.ElasticsearchSpec{Version: "9.0.1"}}
 	type args struct {
-		initObjs     []client.Object
-		es           esv1.Elasticsearch
-		statefulSets es_sset.StatefulSetList
+		initObjs []client.Object
+		es       esv1.Elasticsearch
+		builder  Builder
 	}
 	tests := []struct {
 		name    string
@@ -65,26 +66,35 @@ func TestReconcile(t *testing.T) {
 		{
 			name: "no existing pdb: should create one",
 			args: args{
-				es:           defaultEs,
-				statefulSets: es_sset.StatefulSetList{sset.TestSset{Replicas: 3, Master: true, Data: true}.Build()},
+				es: defaultEs,
+				builder: NewBuilder("cluster").
+					WithNamespace("ns").
+					WithVersion("9.0.1").
+					WithNodeSet("master-data", 3, esv1.MasterRole, esv1.DataRole),
 			},
 			wantPDB: defaultPDB(),
 		},
 		{
 			name: "pdb already exists: should remain unmodified",
 			args: args{
-				initObjs:     []client.Object{withHashLabel(withOwnerRef(defaultPDB(), defaultEs))},
-				es:           defaultEs,
-				statefulSets: es_sset.StatefulSetList{sset.TestSset{Replicas: 3, Master: true, Data: true}.Build()},
+				initObjs: []client.Object{withHashLabel(withOwnerRef(defaultPDB(), defaultEs))},
+				es:       defaultEs,
+				builder: NewBuilder("cluster").
+					WithNamespace("ns").
+					WithVersion("9.0.1").
+					WithNodeSet("master-data", 3, esv1.MasterRole, esv1.DataRole),
 			},
 			wantPDB: defaultPDB(),
 		},
 		{
 			name: "pdb needs a MinAvailable update",
 			args: args{
-				initObjs:     []client.Object{defaultPDB()},
-				es:           defaultEs,
-				statefulSets: es_sset.StatefulSetList{sset.TestSset{Replicas: 5, Master: true, Data: true}.Build()},
+				initObjs: []client.Object{defaultPDB()},
+				es:       defaultEs,
+				builder: NewBuilder("cluster").
+					WithNamespace("ns").
+					WithVersion("9.0.1").
+					WithNodeSet("master-data", 5, esv1.MasterRole, esv1.DataRole),
 			},
 			wantPDB: &policyv1.PodDisruptionBudget{
 				ObjectMeta: metav1.ObjectMeta{
@@ -111,7 +121,10 @@ func TestReconcile(t *testing.T) {
 					ObjectMeta: metav1.ObjectMeta{Name: "cluster", Namespace: "ns"},
 					Spec:       esv1.ElasticsearchSpec{PodDisruptionBudget: &commonv1.PodDisruptionBudgetTemplate{}},
 				},
-				statefulSets: es_sset.StatefulSetList{sset.TestSset{Replicas: 3, Master: true, Data: true}.Build()},
+				builder: NewBuilder("cluster").
+					WithNamespace("ns").
+					WithVersion("9.0.1").
+					WithNodeSet("master-data", 3, esv1.MasterRole, esv1.DataRole),
 			},
 			wantPDB: nil,
 		},
@@ -133,7 +146,9 @@ func TestReconcile(t *testing.T) {
 				WithRESTMapper(restMapper).
 				WithObjects(tt.args.initObjs...).Build()
 
-			err := Reconcile(context.Background(), k8sClient, tt.args.es, tt.args.statefulSets, metadata.Propagate(&tt.args.es, metadata.Metadata{Labels: tt.args.es.GetIdentityLabels()}))
+			statefulSets := tt.args.builder.GetStatefulSets()
+
+			err := Reconcile(context.Background(), k8sClient, tt.args.es, "test_ns", statefulSets, metadata.Propagate(&tt.args.es, metadata.Metadata{Labels: tt.args.es.GetIdentityLabels()}))
 			require.NoError(t, err)
 			pdbNsn := types.NamespacedName{Namespace: tt.args.es.Namespace, Name: esv1.DefaultPodDisruptionBudget(tt.args.es.Name)}
 			var retrieved policyv1.PodDisruptionBudget
@@ -168,8 +183,8 @@ func intStrPtr(intStr intstr.IntOrString) *intstr.IntOrString {
 
 func Test_expectedPDB(t *testing.T) {
 	type args struct {
-		es           esv1.Elasticsearch
-		statefulSets es_sset.StatefulSetList
+		es      esv1.Elasticsearch
+		builder Builder
 	}
 	tests := []struct {
 		name string
@@ -179,16 +194,22 @@ func Test_expectedPDB(t *testing.T) {
 		{
 			name: "PDB disabled in the spec",
 			args: args{
-				es:           esv1.Elasticsearch{Spec: esv1.ElasticsearchSpec{PodDisruptionBudget: &commonv1.PodDisruptionBudgetTemplate{}}},
-				statefulSets: es_sset.StatefulSetList{sset.TestSset{Replicas: 3, Master: true, Data: true}.Build()},
+				es: esv1.Elasticsearch{Spec: esv1.ElasticsearchSpec{PodDisruptionBudget: &commonv1.PodDisruptionBudgetTemplate{}}},
+				builder: NewBuilder("cluster").
+					WithNamespace("ns").
+					WithVersion("9.0.1").
+					WithNodeSet("master-data", 3, esv1.MasterRole, esv1.DataRole),
 			},
 			want: nil,
 		},
 		{
 			name: "Build default PDB",
 			args: args{
-				es:           esv1.Elasticsearch{ObjectMeta: metav1.ObjectMeta{Name: "cluster", Namespace: "ns"}},
-				statefulSets: es_sset.StatefulSetList{sset.TestSset{Replicas: 3, Master: true, Data: true}.Build()},
+				es: esv1.Elasticsearch{ObjectMeta: metav1.ObjectMeta{Name: "cluster", Namespace: "ns"}},
+				builder: NewBuilder("cluster").
+					WithNamespace("ns").
+					WithVersion("9.0.1").
+					WithNodeSet("master-data", 3, esv1.MasterRole, esv1.DataRole),
 			},
 			want: &policyv1.PodDisruptionBudget{
 				ObjectMeta: metav1.ObjectMeta{
@@ -219,7 +240,10 @@ func Test_expectedPDB(t *testing.T) {
 							}},
 					},
 				},
-				statefulSets: es_sset.StatefulSetList{sset.TestSset{Replicas: 3, Master: true, Data: true}.Build()},
+				builder: NewBuilder("cluster").
+					WithNamespace("ns").
+					WithVersion("9.0.1").
+					WithNodeSet("master-data", 3, esv1.MasterRole, esv1.DataRole),
 			},
 			want: &policyv1.PodDisruptionBudget{
 				ObjectMeta: metav1.ObjectMeta{
@@ -248,7 +272,10 @@ func Test_expectedPDB(t *testing.T) {
 							Spec: policyv1.PodDisruptionBudgetSpec{MinAvailable: intStrPtr(intstr.FromInt(42))}},
 					},
 				},
-				statefulSets: es_sset.StatefulSetList{sset.TestSset{Replicas: 3, Master: true, Data: true}.Build()},
+				builder: NewBuilder("cluster").
+					WithNamespace("ns").
+					WithVersion("9.0.1").
+					WithNodeSet("master-data", 3, esv1.MasterRole, esv1.DataRole),
 			},
 			want: &policyv1.PodDisruptionBudget{
 				ObjectMeta: metav1.ObjectMeta{
@@ -268,7 +295,8 @@ func Test_expectedPDB(t *testing.T) {
 				// set owner ref
 				tt.want = withOwnerRef(tt.want, tt.args.es)
 			}
-			got, err := expectedPDB(tt.args.es, tt.args.statefulSets, metadata.Propagate(&tt.args.es, metadata.Metadata{Labels: tt.args.es.GetIdentityLabels()}))
+			statefulSets := tt.args.builder.GetStatefulSets()
+			got, err := expectedPDB(tt.args.es, statefulSets, metadata.Propagate(&tt.args.es, metadata.Metadata{Labels: tt.args.es.GetIdentityLabels()}))
 			require.NoError(t, err)
 			if !reflect.DeepEqual(got, tt.want) {
 				t.Errorf("expectedPDB() got = %v, want %v", got, tt.want)
@@ -277,7 +305,7 @@ func Test_expectedPDB(t *testing.T) {
 	}
 }
 
-func Test_allowedDisruptions(t *testing.T) {
+func Test_allowedDisruptionsForSinglePDB(t *testing.T) {
 	type args struct {
 		es          esv1.Elasticsearch
 		actualSsets es_sset.StatefulSetList
@@ -336,7 +364,7 @@ func Test_allowedDisruptions(t *testing.T) {
 			want: 1,
 		},
 		{
-			name: "green health but only 1 master: 0 disruption allowed",
+			name: "green health but only 1 master: no disruption allowed",
 			args: args{
 				es: esv1.Elasticsearch{Status: esv1.ElasticsearchStatus{Health: esv1.ElasticsearchGreenHealth}},
 				actualSsets: es_sset.StatefulSetList{
@@ -347,7 +375,7 @@ func Test_allowedDisruptions(t *testing.T) {
 			want: 0,
 		},
 		{
-			name: "green health but only 1 data node: 0 disruption allowed",
+			name: "green health but only 1 data node: no disruption allowed",
 			args: args{
 				es: esv1.Elasticsearch{Status: esv1.ElasticsearchStatus{Health: esv1.ElasticsearchGreenHealth}},
 				actualSsets: es_sset.StatefulSetList{
@@ -371,7 +399,7 @@ func Test_allowedDisruptions(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if got := allowedDisruptions(tt.args.es, tt.args.actualSsets); got != tt.want {
+			if got := allowedDisruptionsForSinglePDB(tt.args.es, tt.args.actualSsets); got != tt.want {
 				t.Errorf("allowedDisruptions() = %v, want %v", got, tt.want)
 			}
 		})
diff --git a/pkg/controller/elasticsearch/pdb/reconcile_with_roles_test.go b/pkg/controller/elasticsearch/pdb/reconcile_with_roles_test.go
new file mode 100644
index 000000000..5f74e3409
--- /dev/null
+++ b/pkg/controller/elasticsearch/pdb/reconcile_with_roles_test.go
@@ -0,0 +1,1375 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License 2.0;
+// you may not use this file except in compliance with the Elastic License 2.0.
+
+package pdb
+
+import (
+	"context"
+	"reflect"
+	"slices"
+	"sort"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	appsv1 "k8s.io/api/apps/v1"
+	_ "k8s.io/api/core/v1"
+	policyv1 "k8s.io/api/policy/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/utils/ptr"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	commonv1 "github.com/elastic/cloud-on-k8s/v3/pkg/apis/common/v1"
+	esv1 "github.com/elastic/cloud-on-k8s/v3/pkg/apis/elasticsearch/v1"
+	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/metadata"
+	ssetfixtures "github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/statefulset"
+	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/elasticsearch/label"
+	_ "github.com/elastic/cloud-on-k8s/v3/pkg/controller/elasticsearch/settings"
+	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/elasticsearch/sset"
+)
+
+func TestReconcileRoleSpecificPDBs(t *testing.T) {
+	rolePDB := func(esName, namespace string, role esv1.NodeRole, statefulSetNames []string, maxUnavailable int32) *policyv1.PodDisruptionBudget {
+		pdb := &policyv1.PodDisruptionBudget{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      esv1.PodDisruptionBudgetNameForRole(esName, string(role)),
+				Namespace: namespace,
+				Labels:    map[string]string{label.ClusterNameLabelName: esName},
+			},
+			Spec: policyv1.PodDisruptionBudgetSpec{
+				MaxUnavailable: &intstr.IntOrString{Type: intstr.Int, IntVal: maxUnavailable},
+			},
+		}
+
+		// Sort for consistent test comparison
+		sorted := make([]string, len(statefulSetNames))
+		copy(sorted, statefulSetNames)
+		slices.Sort(sorted)
+
+		pdb.Spec.Selector = &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{
+				{
+					Key:      label.ClusterNameLabelName,
+					Operator: metav1.LabelSelectorOpIn,
+					Values:   []string{esName},
+				},
+				{
+					Key:      label.StatefulSetNameLabelName,
+					Operator: metav1.LabelSelectorOpIn,
+					Values:   sorted,
+				},
+			},
+		}
+
+		return pdb
+	}
+
+	defaultEs := esv1.Elasticsearch{
+		ObjectMeta: metav1.ObjectMeta{Name: "cluster", Namespace: "ns"},
+		Spec: esv1.ElasticsearchSpec{
+			Version: "9.0.1",
+		},
+	}
+
+	defaultHealthyES := defaultEs.DeepCopy()
+	defaultHealthyES.Status.Health = esv1.ElasticsearchGreenHealth
+
+	type args struct {
+		initObjs []client.Object
+		es       esv1.Elasticsearch
+		stss     sset.StatefulSetList
+		builder  Builder
+	}
+	tests := []struct {
+		name       string
+		args       args
+		wantedPDBs []*policyv1.PodDisruptionBudget
+	}{
+		{
+			name: "no existing PDBs: should create role-specific PDBs",
+			args: args{
+				es: defaultEs,
+				builder: NewBuilder("cluster").
+					WithNamespace("ns").
+					WithNodeSet("master1", 1, esv1.MasterRole).
+					WithNodeSet("data1", 1, esv1.DataRole),
+			},
+			wantedPDBs: []*policyv1.PodDisruptionBudget{
+				// Unhealthy es cluster; 0 disruptions allowed
+				rolePDB("cluster", "ns", esv1.MasterRole, []string{"master1"}, 0),
+				rolePDB("cluster", "ns", esv1.DataRole, []string{"data1"}, 0),
+			},
+		},
+		{
+			name: "no existing PDBs: should create role-specific PDBs and deduce roles from sts labels where sts is not listed as expected",
+			args: args{
+				es: defaultEs,
+				stss: sset.StatefulSetList{
+					ssetfixtures.TestSset{Name: "master1", Namespace: "ns", Master: true}.Build(),
+					ssetfixtures.TestSset{Name: "data1", Namespace: "ns", Data: true}.Build(),
+					// This additional sts is within the cluster, but not listed as "expected"
+					// It's roles should be deduced from it's labels. This replicates the case
+					// where an sts was recently deleted or renamed within the cluster.
+					ssetfixtures.TestSset{Name: "frozen1", Namespace: "ns", DataFrozen: true}.Build(),
+				},
+				builder: NewBuilder("cluster").
+					WithNamespace("ns").
+					WithNodeSet("master1", 1, esv1.MasterRole).
+					WithNodeSet("data1", 1, esv1.DataRole),
+			},
+			wantedPDBs: []*policyv1.PodDisruptionBudget{
+				// Unhealthy es cluster; 0 disruptions allowed
+				rolePDB("cluster", "ns", esv1.MasterRole, []string{"master1"}, 0),
+				rolePDB("cluster", "ns", esv1.DataRole, []string{"data1"}, 0),
+				rolePDB("cluster", "ns", esv1.DataFrozenRole, []string{"frozen1"}, 0),
+			},
+		},
+		{
+			name: "no existing PDBs: should create role-specific PDBs with data roles grouped",
+			args: args{
+				es: *defaultHealthyES,
+				builder: NewBuilder("cluster").
+					WithNamespace("ns").
+					WithNodeSet("master-data1", 2, esv1.MasterRole, esv1.DataRole).
+					WithNodeSet("data2", 2, esv1.DataHotRole),
+			},
+			wantedPDBs: []*policyv1.PodDisruptionBudget{
+				rolePDB("cluster", "ns", esv1.DataRole, []string{"data2", "master-data1"}, 1),
+			},
+		},
+		{
+			name: "no existing PDBs: should create role-specific PDBs with data roles grouped, allowing 1 disruption because single master node",
+			args: args{
+				es: *defaultHealthyES,
+				builder: NewBuilder("cluster").
+					WithNamespace("ns").
+					WithNodeSet("master-data1", 1, esv1.MasterRole, esv1.DataRole).
+					WithNodeSet("data2", 2, esv1.DataHotRole),
+			},
+			wantedPDBs: []*policyv1.PodDisruptionBudget{
+				rolePDB("cluster", "ns", esv1.DataRole, []string{"data2", "master-data1"}, 1),
+			},
+		},
+		{
+			name: "existing default PDB: should delete it and create role-specific PDBs",
+			args: args{
+				initObjs: []client.Object{
+					defaultPDB(),
+				},
+				es: *defaultHealthyES,
+				builder: NewBuilder("cluster").
+					WithNamespace("ns").
+					WithNodeSet("master1", 1, esv1.MasterRole),
+			},
+			wantedPDBs: []*policyv1.PodDisruptionBudget{
+				// single node cluster should allow 1 pod to be unavailable when cluster is healthy.
+				rolePDB("cluster", "ns", esv1.MasterRole, []string{"master1"}, 1),
+			},
+		},
+		{
+			name: "create pdb with coordinating nodes: no existing PDBs",
+			args: args{
+				es: defaultEs,
+				builder: NewBuilder("cluster").
+					WithNamespace("ns").
+					WithNodeSet("coord1", 1, "").
+					WithNodeSet("coord2", 1, "").
+					WithNodeSet("master1", 1, esv1.MasterRole),
+			},
+			wantedPDBs: []*policyv1.PodDisruptionBudget{
+				// Unhealthy es cluster; 0 disruptions allowed
+				rolePDB("cluster", "ns", "", []string{"coord1", "coord2"}, 0),
+				rolePDB("cluster", "ns", esv1.MasterRole, []string{"master1"}, 0),
+			},
+		},
+		{
+			name: "mixed roles: should group StatefulSets sharing roles",
+			args: args{
+				es: defaultEs,
+				builder: NewBuilder("cluster").
+					WithNamespace("ns").
+					WithNodeSet("master-data1", 1, esv1.MasterRole, esv1.DataRole).
+					WithNodeSet("data-ingest1", 1, esv1.DataRole, esv1.IngestRole).
+					WithNodeSet("ml1", 1, esv1.MLRole),
+			},
+			wantedPDBs: []*policyv1.PodDisruptionBudget{
+				// Unhealthy es cluster; 0 disruptions allowed
+				rolePDB("cluster", "ns", esv1.DataRole, []string{"master-data1", "data-ingest1"}, 0),
+				rolePDB("cluster", "ns", esv1.MLRole, []string{"ml1"}, 0),
+			},
+		},
+		{
+			name: "PDB disabled in ES spec: should delete existing PDBs and not create new ones",
+			args: func() args {
+				es := esv1.Elasticsearch{
+					ObjectMeta: metav1.ObjectMeta{Name: "cluster", Namespace: "ns"},
+					Spec: esv1.ElasticsearchSpec{
+						PodDisruptionBudget: &commonv1.PodDisruptionBudgetTemplate{},
+					},
+				}
+				return args{
+					initObjs: []client.Object{
+						withOwnerRef(defaultPDB(), es),
+						withOwnerRef(rolePDB("cluster", "ns", esv1.MasterRole, []string{"master1"}, 0), es),
+					},
+					es: es,
+					builder: NewBuilder("cluster").
+						WithNamespace("ns").
+						WithNodeSet("master1", 1, esv1.MasterRole),
+				}
+			}(),
+			wantedPDBs: []*policyv1.PodDisruptionBudget{},
+		},
+		{
+			name: "update existing role-specific PDBs",
+			args: args{
+				initObjs: []client.Object{
+					// Existing PDB with different configuration
+					&policyv1.PodDisruptionBudget{
+						ObjectMeta: metav1.ObjectMeta{
+							Name:      esv1.PodDisruptionBudgetNameForRole("cluster", string(esv1.MasterRole)),
+							Namespace: "ns",
+							Labels:    map[string]string{label.ClusterNameLabelName: "cluster"},
+						},
+						Spec: policyv1.PodDisruptionBudgetSpec{
+							MaxUnavailable: &intstr.IntOrString{Type: intstr.Int, IntVal: 2}, // Wrong value
+							Selector: &metav1.LabelSelector{
+								MatchLabels: map[string]string{
+									label.ClusterNameLabelName:     "cluster",
+									label.StatefulSetNameLabelName: "old-master", // Wrong StatefulSet
+								},
+							},
+						},
+					},
+				},
+				es: defaultEs,
+				builder: NewBuilder("cluster").
+					WithNamespace("ns").
+					WithNodeSet("master1", 1, esv1.MasterRole),
+			},
+			wantedPDBs: []*policyv1.PodDisruptionBudget{
+				// Unhealthy es cluster; 0 disruptions allowed
+				rolePDB("cluster", "ns", esv1.MasterRole, []string{"master1"}, 0),
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c := fake.NewClientBuilder().
+				WithScheme(clientgoscheme.Scheme).
+				WithObjects(tt.args.initObjs...).
+				Build()
+
+			// Create metadata
+			meta := metadata.Propagate(&tt.args.es, metadata.Metadata{Labels: tt.args.es.GetIdentityLabels()})
+
+			statefulSets := tt.args.stss
+			// allow for more control over the args to the function by
+			// allowing for a custom stateful set list.
+			if statefulSets == nil {
+				statefulSets = tt.args.builder.GetStatefulSets()
+			}
+
+			err := reconcileRoleSpecificPDBs(context.Background(), c, tt.args.es, statefulSets, meta)
+			require.NoError(t, err)
+
+			var retrievedPDBs policyv1.PodDisruptionBudgetList
+			err = c.List(context.Background(), &retrievedPDBs, client.InNamespace(tt.args.es.Namespace))
+			require.NoError(t, err)
+
+			require.Equal(t, len(tt.wantedPDBs), len(retrievedPDBs.Items), "Expected %d PDBs, got %d", len(tt.wantedPDBs), len(retrievedPDBs.Items))
+
+			for _, expectedPDB := range tt.wantedPDBs {
+				// Find the matching PDB in the retrieved list
+				idx := slices.IndexFunc(retrievedPDBs.Items, func(pdb policyv1.PodDisruptionBudget) bool {
+					return pdb.Name == expectedPDB.Name
+				})
+				require.NotEqual(t, -1, idx, "Expected PDB %s should exist, found: %+v", expectedPDB.Name, retrievedPDBs.Items)
+				actualPDB := &retrievedPDBs.Items[idx]
+
+				// Verify key fields match (ignore metadata like resourceVersion, etc.)
+				require.Equal(t, expectedPDB.Spec.MaxUnavailable, actualPDB.Spec.MaxUnavailable, "MaxUnavailable should match for PDB %s", expectedPDB.Name)
+				require.Equal(t, expectedPDB.Spec.Selector, actualPDB.Spec.Selector, "Selector should match for PDB %s", expectedPDB.Name)
+				require.Equal(t, expectedPDB.Labels[label.ClusterNameLabelName], actualPDB.Labels[label.ClusterNameLabelName], "Cluster label should match for PDB %s", expectedPDB.Name)
+			}
+		})
+	}
+}
+
+func TestExpectedRolePDBs(t *testing.T) {
+	defaultUnhealthyES := esv1.Elasticsearch{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-es",
+			Namespace: "ns",
+		},
+		Spec: esv1.ElasticsearchSpec{
+			Version: "8.0.0",
+		},
+		Status: esv1.ElasticsearchStatus{
+			Health: esv1.ElasticsearchUnknownHealth,
+		},
+	}
+
+	defaultHealthyES := defaultUnhealthyES.DeepCopy()
+	defaultHealthyES.Status.Health = esv1.ElasticsearchGreenHealth
+
+	defaultHealthyESWithPDBSpecified := defaultHealthyES.DeepCopy()
+	defaultHealthyESWithPDBSpecified.Spec.PodDisruptionBudget = &commonv1.PodDisruptionBudgetTemplate{
+		ObjectMeta: metav1.ObjectMeta{
+			Labels: map[string]string{
+				"mykey": "myvalue",
+			},
+		},
+	}
+
+	defaultMeta := metadata.Metadata{
+		Labels: map[string]string{
+			"elasticsearch.k8s.elastic.co/cluster-name": "test-es",
+		},
+	}
+
+	tests := []struct {
+		name     string
+		es       esv1.Elasticsearch
+		builder  Builder
+		meta     metadata.Metadata
+		expected []*policyv1.PodDisruptionBudget
+	}{
+		{
+			name:     "empty input",
+			es:       *defaultHealthyES,
+			builder:  NewBuilder("test-es").WithNamespace("ns").WithVersion("8.0.0"),
+			meta:     defaultMeta,
+			expected: []*policyv1.PodDisruptionBudget{},
+		},
+		{
+			name: "single node cluster; role doesn't matter; 1 disruption with custom metadata",
+			es:   *defaultHealthyES,
+			builder: NewBuilder("test-es").
+				WithNamespace("ns").
+				WithVersion("8.0.0").
+				WithNodeSet("master1", 1, esv1.MasterRole),
+			meta: defaultMeta.Merge(metadata.Metadata{Annotations: map[string]string{"custom": "annotation"}}),
+			expected: []*policyv1.PodDisruptionBudget{
+				{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "test-es-es-default-master",
+						Namespace: "ns",
+						Annotations: map[string]string{
+							"custom": "annotation",
+						},
+						Labels: map[string]string{
+							label.ClusterNameLabelName: "test-es",
+						},
+						OwnerReferences: []metav1.OwnerReference{
+							{
+								APIVersion:         "elasticsearch.k8s.elastic.co/v1",
+								Kind:               "Elasticsearch",
+								Name:               "test-es",
+								Controller:         ptr.To[bool](true),
+								BlockOwnerDeletion: ptr.To[bool](true),
+							},
+						},
+					},
+					Spec: policyv1.PodDisruptionBudgetSpec{
+						Selector: &metav1.LabelSelector{
+							MatchExpressions: []metav1.LabelSelectorRequirement{
+								{
+									Key:      label.ClusterNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"test-es"},
+								},
+								{
+									Key:      label.StatefulSetNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"master1"},
+								},
+							},
+						},
+						MaxUnavailable: &intstr.IntOrString{Type: intstr.Int, IntVal: 1},
+					},
+				},
+			},
+		},
+		{
+			name: "single node cluster; role doesn't matter; 1 disruption with custom metadata in the pdb which is merged into the pdb",
+			es:   *defaultHealthyESWithPDBSpecified,
+			builder: NewBuilder("test-es").
+				WithNamespace("ns").
+				WithVersion("8.0.0").
+				WithNodeSet("master1", 1, esv1.MasterRole),
+			meta: defaultMeta.Merge(metadata.Metadata{Annotations: map[string]string{"custom": "annotation"}}),
+			expected: []*policyv1.PodDisruptionBudget{
+				{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "test-es-es-default-master",
+						Namespace: "ns",
+						Annotations: map[string]string{
+							"custom": "annotation",
+						},
+						Labels: map[string]string{
+							"mykey":                    "myvalue",
+							label.ClusterNameLabelName: "test-es",
+						},
+						OwnerReferences: []metav1.OwnerReference{
+							{
+								APIVersion:         "elasticsearch.k8s.elastic.co/v1",
+								Kind:               "Elasticsearch",
+								Name:               "test-es",
+								Controller:         ptr.To[bool](true),
+								BlockOwnerDeletion: ptr.To[bool](true),
+							},
+						},
+					},
+					Spec: policyv1.PodDisruptionBudgetSpec{
+						Selector: &metav1.LabelSelector{
+							MatchExpressions: []metav1.LabelSelectorRequirement{
+								{
+									Key:      label.ClusterNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"test-es"},
+								},
+								{
+									Key:      label.StatefulSetNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"master1"},
+								},
+							},
+						},
+						MaxUnavailable: &intstr.IntOrString{Type: intstr.Int, IntVal: 1},
+					},
+				},
+			},
+		},
+		{
+			name: "multiple coordinating nodes; healthy es; 1 disruption allowed",
+			es:   *defaultHealthyES,
+			builder: NewBuilder("test-es").
+				WithNamespace("ns").
+				WithVersion("8.0.0").
+				WithNodeSet("coord1", 2, esv1.CoordinatingRole),
+			meta: defaultMeta,
+			expected: []*policyv1.PodDisruptionBudget{
+				{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "test-es-es-default-coordinating",
+						Namespace: "ns",
+						Labels: map[string]string{
+							label.ClusterNameLabelName: "test-es",
+						},
+						OwnerReferences: []metav1.OwnerReference{
+							{
+								APIVersion:         "elasticsearch.k8s.elastic.co/v1",
+								Kind:               "Elasticsearch",
+								Name:               "test-es",
+								Controller:         ptr.To[bool](true),
+								BlockOwnerDeletion: ptr.To[bool](true),
+							},
+						},
+					},
+					Spec: policyv1.PodDisruptionBudgetSpec{
+						Selector: &metav1.LabelSelector{
+							MatchExpressions: []metav1.LabelSelectorRequirement{
+								{
+									Key:      label.ClusterNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"test-es"},
+								},
+								{
+									Key:      label.StatefulSetNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"coord1"},
+								},
+							},
+						},
+						MaxUnavailable: &intstr.IntOrString{Type: intstr.Int, IntVal: 1},
+					},
+				},
+			},
+		},
+		{
+			name: "separate roles - no shared roles",
+			es:   defaultUnhealthyES,
+			builder: NewBuilder("test-es").
+				WithNamespace("ns").
+				WithVersion("8.0.0").
+				WithNodeSet("master1", 1, esv1.MasterRole).
+				WithNodeSet("data1", 1, esv1.DataRole).
+				WithNodeSet("ingest1", 1, esv1.IngestRole),
+			meta: defaultMeta,
+			expected: []*policyv1.PodDisruptionBudget{
+				{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "test-es-es-default-data",
+						Namespace: "ns",
+						Labels: map[string]string{
+							label.ClusterNameLabelName: "test-es",
+						},
+						OwnerReferences: []metav1.OwnerReference{
+							{
+								APIVersion:         "elasticsearch.k8s.elastic.co/v1",
+								Kind:               "Elasticsearch",
+								Name:               "test-es",
+								Controller:         ptr.To[bool](true),
+								BlockOwnerDeletion: ptr.To[bool](true),
+							},
+						},
+					},
+					Spec: policyv1.PodDisruptionBudgetSpec{
+						Selector: &metav1.LabelSelector{
+							MatchExpressions: []metav1.LabelSelectorRequirement{
+								{
+									Key:      label.ClusterNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"test-es"},
+								},
+								{
+									Key:      label.StatefulSetNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"data1"},
+								},
+							},
+						},
+						MaxUnavailable: &intstr.IntOrString{Type: intstr.Int, IntVal: 0},
+					},
+				},
+				{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "test-es-es-default-master",
+						Namespace: "ns",
+						Labels: map[string]string{
+							label.ClusterNameLabelName: "test-es",
+						},
+						OwnerReferences: []metav1.OwnerReference{
+							{
+								APIVersion:         "elasticsearch.k8s.elastic.co/v1",
+								Kind:               "Elasticsearch",
+								Name:               "test-es",
+								Controller:         ptr.To[bool](true),
+								BlockOwnerDeletion: ptr.To[bool](true),
+							},
+						},
+					},
+					Spec: policyv1.PodDisruptionBudgetSpec{
+						Selector: &metav1.LabelSelector{
+							MatchExpressions: []metav1.LabelSelectorRequirement{
+								{
+									Key:      label.ClusterNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"test-es"},
+								},
+								{
+									Key:      label.StatefulSetNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"master1"},
+								},
+							},
+						},
+						MaxUnavailable: &intstr.IntOrString{Type: intstr.Int, IntVal: 0},
+					},
+				},
+				{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "test-es-es-default-ingest",
+						Namespace: "ns",
+						Labels: map[string]string{
+							label.ClusterNameLabelName: "test-es",
+						},
+						OwnerReferences: []metav1.OwnerReference{
+							{
+								APIVersion:         "elasticsearch.k8s.elastic.co/v1",
+								Kind:               "Elasticsearch",
+								Name:               "test-es",
+								Controller:         ptr.To[bool](true),
+								BlockOwnerDeletion: ptr.To[bool](true),
+							},
+						},
+					},
+					Spec: policyv1.PodDisruptionBudgetSpec{
+						Selector: &metav1.LabelSelector{
+							MatchExpressions: []metav1.LabelSelectorRequirement{
+								{
+									Key:      label.ClusterNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"test-es"},
+								},
+								{
+									Key:      label.StatefulSetNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"ingest1"},
+								},
+							},
+						},
+						MaxUnavailable: &intstr.IntOrString{Type: intstr.Int, IntVal: 0},
+					},
+				},
+			},
+		},
+		{
+			name: "master with a single node but unhealthy cluster should disallow disruptions",
+			es:   defaultUnhealthyES,
+			builder: NewBuilder("test-es").
+				WithNamespace("ns").
+				WithVersion("8.0.0").
+				WithNodeSet("master1", 1, esv1.MasterRole),
+			meta: defaultMeta,
+			expected: []*policyv1.PodDisruptionBudget{
+				{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "test-es-es-default-master",
+						Namespace: "ns",
+						Labels: map[string]string{
+							label.ClusterNameLabelName: "test-es",
+						},
+						OwnerReferences: []metav1.OwnerReference{
+							{
+								APIVersion:         "elasticsearch.k8s.elastic.co/v1",
+								Kind:               "Elasticsearch",
+								Name:               "test-es",
+								Controller:         ptr.To[bool](true),
+								BlockOwnerDeletion: ptr.To[bool](true),
+							},
+						},
+					},
+					Spec: policyv1.PodDisruptionBudgetSpec{
+						Selector: &metav1.LabelSelector{
+							MatchExpressions: []metav1.LabelSelectorRequirement{
+								{
+									Key:      label.ClusterNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"test-es"},
+								},
+								{
+									Key:      label.StatefulSetNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"master1"},
+								},
+							},
+						},
+						MaxUnavailable: &intstr.IntOrString{Type: intstr.Int, IntVal: 0},
+					},
+				},
+			},
+		},
+		{
+			name: "multiple coordinating nodeSets",
+			es:   defaultUnhealthyES,
+			builder: NewBuilder("test-es").
+				WithNamespace("ns").
+				WithVersion("8.0.0").
+				WithNodeSet("coord1", 1, esv1.CoordinatingRole).
+				WithNodeSet("coord2", 1, esv1.CoordinatingRole).
+				WithNodeSet("coord3", 1, esv1.CoordinatingRole),
+			meta: defaultMeta,
+			expected: []*policyv1.PodDisruptionBudget{
+				{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "test-es-es-default-coordinating",
+						Namespace: "ns",
+						Labels: map[string]string{
+							label.ClusterNameLabelName: "test-es",
+						},
+						OwnerReferences: []metav1.OwnerReference{
+							{
+								APIVersion:         "elasticsearch.k8s.elastic.co/v1",
+								Kind:               "Elasticsearch",
+								Name:               "test-es",
+								Controller:         ptr.To[bool](true),
+								BlockOwnerDeletion: ptr.To[bool](true),
+							},
+						},
+					},
+					Spec: policyv1.PodDisruptionBudgetSpec{
+						Selector: &metav1.LabelSelector{
+							MatchExpressions: []metav1.LabelSelectorRequirement{
+								{
+									Key:      label.ClusterNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"test-es"},
+								},
+								{
+									Key:      label.StatefulSetNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"coord1", "coord2", "coord3"},
+								},
+							},
+						},
+						MaxUnavailable: &intstr.IntOrString{Type: intstr.Int, IntVal: 0},
+					},
+				},
+			},
+		},
+		{
+			name: "shared roles - should be grouped",
+			es:   defaultUnhealthyES,
+			builder: NewBuilder("test-es").
+				WithNamespace("ns").
+				WithVersion("8.0.0").
+				WithNodeSet("master-data1", 1, esv1.MasterRole, esv1.DataRole).
+				WithNodeSet("data-ingest1", 1, esv1.DataRole, esv1.IngestRole).
+				WithNodeSet("ml1", 1, esv1.MLRole),
+			meta: defaultMeta,
+			expected: []*policyv1.PodDisruptionBudget{
+				{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "test-es-es-default-data",
+						Namespace: "ns",
+						Labels: map[string]string{
+							label.ClusterNameLabelName: "test-es",
+						},
+						OwnerReferences: []metav1.OwnerReference{
+							{
+								APIVersion:         "elasticsearch.k8s.elastic.co/v1",
+								Kind:               "Elasticsearch",
+								Name:               "test-es",
+								Controller:         ptr.To[bool](true),
+								BlockOwnerDeletion: ptr.To[bool](true),
+							},
+						},
+					},
+					Spec: policyv1.PodDisruptionBudgetSpec{
+						Selector: &metav1.LabelSelector{
+							MatchExpressions: []metav1.LabelSelectorRequirement{
+								{
+									Key:      label.ClusterNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"test-es"},
+								},
+								{
+									Key:      label.StatefulSetNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"data-ingest1", "master-data1"},
+								},
+							},
+						},
+						MaxUnavailable: &intstr.IntOrString{Type: intstr.Int, IntVal: 0},
+					},
+				},
+				{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "test-es-es-default-ml",
+						Namespace: "ns",
+						Labels: map[string]string{
+							label.ClusterNameLabelName: "test-es",
+						},
+						OwnerReferences: []metav1.OwnerReference{
+							{
+								APIVersion:         "elasticsearch.k8s.elastic.co/v1",
+								Kind:               "Elasticsearch",
+								Name:               "test-es",
+								Controller:         ptr.To[bool](true),
+								BlockOwnerDeletion: ptr.To[bool](true),
+							},
+						},
+					},
+					Spec: policyv1.PodDisruptionBudgetSpec{
+						Selector: &metav1.LabelSelector{
+							MatchExpressions: []metav1.LabelSelectorRequirement{
+								{
+									Key:      label.ClusterNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"test-es"},
+								},
+								{
+									Key:      label.StatefulSetNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"ml1"},
+								},
+							},
+						},
+						MaxUnavailable: &intstr.IntOrString{Type: intstr.Int, IntVal: 0},
+					},
+				},
+			},
+		},
+		{
+			name: "multiple coordinating nodeSets",
+			es:   defaultUnhealthyES,
+			builder: NewBuilder("test-es").
+				WithNamespace("ns").
+				WithVersion("8.0.0").
+				WithNodeSet("coord1", 1, esv1.CoordinatingRole).
+				WithNodeSet("coord2", 1, esv1.CoordinatingRole).
+				WithNodeSet("coord3", 1, esv1.CoordinatingRole),
+			meta: defaultMeta,
+			expected: []*policyv1.PodDisruptionBudget{
+				{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "test-es-es-default-coordinating",
+						Namespace: "ns",
+						Labels: map[string]string{
+							label.ClusterNameLabelName: "test-es",
+						},
+						OwnerReferences: []metav1.OwnerReference{
+							{
+								APIVersion:         "elasticsearch.k8s.elastic.co/v1",
+								Kind:               "Elasticsearch",
+								Name:               "test-es",
+								Controller:         ptr.To[bool](true),
+								BlockOwnerDeletion: ptr.To[bool](true),
+							},
+						},
+					},
+					Spec: policyv1.PodDisruptionBudgetSpec{
+						Selector: &metav1.LabelSelector{
+							MatchExpressions: []metav1.LabelSelectorRequirement{
+								{
+									Key:      label.ClusterNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"test-es"},
+								},
+								{
+									Key:      label.StatefulSetNameLabelName,
+									Operator: metav1.LabelSelectorOpIn,
+									Values:   []string{"coord1", "coord2", "coord3"},
+								},
+							},
+						},
+						MaxUnavailable: &intstr.IntOrString{Type: intstr.Int, IntVal: 0},
+					},
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			statefulSetList := tt.builder.GetStatefulSets()
+
+			pdbs, err := expectedRolePDBs(context.Background(), tt.es, statefulSetList, tt.meta)
+			if err != nil {
+				t.Fatalf("expectedRolePDBs: %v", err)
+			}
+
+			if !cmp.Equal(tt.expected, pdbs) {
+				t.Errorf("expectedRolePDBs: PDBs do not match expected:\n%s", cmp.Diff(tt.expected, pdbs))
+			}
+		})
+	}
+}
+
+func Test_allowedDisruptionsForRole(t *testing.T) {
+	type args struct {
+		es              esv1.Elasticsearch
+		role            []esv1.NodeRole
+		allStatefulSets sset.StatefulSetList
+	}
+	tests := []struct {
+		name string
+		args args
+		want int32
+	}{
+		{
+			name: "no health reported: 0 disruptions allowed for any role",
+			args: args{
+				es:              esv1.Elasticsearch{Status: esv1.ElasticsearchStatus{}},
+				role:            []esv1.NodeRole{esv1.MasterRole, esv1.IngestRole, esv1.TransformRole, esv1.MLRole, esv1.DataFrozenRole},
+				allStatefulSets: sset.StatefulSetList{ssetfixtures.TestSset{Replicas: 3}.Build()},
+			},
+			want: 0,
+		},
+		{
+			name: "Unknown health reported: 0 disruptions allowed for any role",
+			args: args{
+				es:              esv1.Elasticsearch{Status: esv1.ElasticsearchStatus{Health: esv1.ElasticsearchUnknownHealth}},
+				role:            []esv1.NodeRole{esv1.MasterRole, esv1.IngestRole, esv1.TransformRole, esv1.MLRole, esv1.DataFrozenRole},
+				allStatefulSets: sset.StatefulSetList{ssetfixtures.TestSset{Replicas: 3}.Build()},
+			},
+			want: 0,
+		},
+		{
+			name: "yellow health: 0 disruptions allowed for data nodes",
+			args: args{
+				es:              esv1.Elasticsearch{Status: esv1.ElasticsearchStatus{Health: esv1.ElasticsearchYellowHealth}},
+				role:            []esv1.NodeRole{esv1.DataRole},
+				allStatefulSets: sset.StatefulSetList{ssetfixtures.TestSset{Replicas: 3}.Build()},
+			},
+			want: 0,
+		},
+		{
+			name: "green health: 1 disruption allowed for data sts that is not HA",
+			args: args{
+				es:              esv1.Elasticsearch{Status: esv1.ElasticsearchStatus{Health: esv1.ElasticsearchGreenHealth}},
+				role:            []esv1.NodeRole{esv1.DataRole},
+				allStatefulSets: sset.StatefulSetList{ssetfixtures.TestSset{Replicas: 1}.Build()},
+			},
+			want: 1,
+		},
+		{
+			name: "green health: 1 disruption allowed for data sts that is HA",
+			args: args{
+				es:              esv1.Elasticsearch{Status: esv1.ElasticsearchStatus{Health: esv1.ElasticsearchGreenHealth}},
+				role:            []esv1.NodeRole{esv1.DataRole},
+				allStatefulSets: sset.StatefulSetList{ssetfixtures.TestSset{Replicas: 2}.Build()},
+			},
+			want: 1,
+		},
+		{
+			name: "yellow health: 1 disruption allowed for master/ingest/transform/ml/data_frozen",
+			args: args{
+				es:              esv1.Elasticsearch{Status: esv1.ElasticsearchStatus{Health: esv1.ElasticsearchYellowHealth}},
+				role:            []esv1.NodeRole{esv1.MasterRole, esv1.IngestRole, esv1.TransformRole, esv1.MLRole, esv1.DataFrozenRole},
+				allStatefulSets: sset.StatefulSetList{ssetfixtures.TestSset{Replicas: 3}.Build()},
+			},
+			want: 1,
+		},
+		{
+			name: "red health: 0 disruptions allowed for any role",
+			args: args{
+				es:              esv1.Elasticsearch{Status: esv1.ElasticsearchStatus{Health: esv1.ElasticsearchRedHealth}},
+				role:            []esv1.NodeRole{esv1.MasterRole, esv1.IngestRole, esv1.TransformRole, esv1.MLRole, esv1.DataFrozenRole, esv1.DataRole},
+				allStatefulSets: sset.StatefulSetList{ssetfixtures.TestSset{Replicas: 3, Master: true, Data: true}.Build()},
+			},
+			want: 0,
+		},
+		{
+			name: "green health: 1 disruption allowed for any role",
+			args: args{
+				es:              esv1.Elasticsearch{Status: esv1.ElasticsearchStatus{Health: esv1.ElasticsearchGreenHealth}},
+				role:            []esv1.NodeRole{esv1.MasterRole, esv1.IngestRole, esv1.TransformRole, esv1.MLRole, esv1.DataFrozenRole, esv1.DataRole},
+				allStatefulSets: sset.StatefulSetList{ssetfixtures.TestSset{Replicas: 3, Master: true, Data: true}.Build()},
+			},
+			want: 1,
+		},
+		{
+			name: "single-node cluster (not high-available): 1 disruption allowed for master role when the cluster is green.",
+			args: args{
+				es:              esv1.Elasticsearch{Status: esv1.ElasticsearchStatus{Health: esv1.ElasticsearchGreenHealth}},
+				role:            []esv1.NodeRole{esv1.MasterRole},
+				allStatefulSets: sset.StatefulSetList{ssetfixtures.TestSset{Replicas: 1, Master: true, Data: true}.Build()},
+			},
+			want: 1,
+		},
+		{
+			name: "single-node cluster (not high-available): 1 disruption allowed for master role when the cluster is yellow.",
+			args: args{
+				es:              esv1.Elasticsearch{Status: esv1.ElasticsearchStatus{Health: esv1.ElasticsearchYellowHealth}},
+				role:            []esv1.NodeRole{esv1.MasterRole},
+				allStatefulSets: sset.StatefulSetList{ssetfixtures.TestSset{Replicas: 1, Master: true, Data: true}.Build()},
+			},
+			want: 1,
+		},
+		{
+			name: "green health with HA data tier: 1 disruption allowed for data role",
+			args: args{
+				es:   esv1.Elasticsearch{Status: esv1.ElasticsearchStatus{Health: esv1.ElasticsearchGreenHealth}},
+				role: []esv1.NodeRole{esv1.DataRole},
+				allStatefulSets: sset.StatefulSetList{
+					ssetfixtures.TestSset{Replicas: 1, Master: true, Data: false}.Build(),
+					ssetfixtures.TestSset{Replicas: 3, Master: false, Data: true}.Build(),
+					ssetfixtures.TestSset{Replicas: 2, Ingest: true}.Build(),
+				},
+			},
+			want: 1,
+		},
+		{
+			name: "green health and only 1 data node: 1 disruption allowed for data role",
+			args: args{
+				es:   esv1.Elasticsearch{Status: esv1.ElasticsearchStatus{Health: esv1.ElasticsearchGreenHealth}},
+				role: []esv1.NodeRole{esv1.DataRole},
+				allStatefulSets: sset.StatefulSetList{
+					ssetfixtures.TestSset{Replicas: 3, Master: true, Data: false}.Build(),
+					ssetfixtures.TestSset{Replicas: 1, Master: false, Data: true}.Build(),
+				},
+			},
+			want: 1,
+		},
+		{
+			name: "yellow health and only 1 data node: 0 disruption allowed for data role",
+			args: args{
+				es:   esv1.Elasticsearch{Status: esv1.ElasticsearchStatus{Health: esv1.ElasticsearchYellowHealth}},
+				role: []esv1.NodeRole{esv1.DataRole},
+				allStatefulSets: sset.StatefulSetList{
+					ssetfixtures.TestSset{Replicas: 3, Master: true, Data: false}.Build(),
+					ssetfixtures.TestSset{Replicas: 1, Master: false, Data: true}.Build(),
+				},
+			},
+			want: 0,
+		},
+		{
+			name: "green health but only 1 ingest node: 1 disruptions allowed for ingest role",
+			args: args{
+				es:   esv1.Elasticsearch{Status: esv1.ElasticsearchStatus{Health: esv1.ElasticsearchGreenHealth}},
+				role: []esv1.NodeRole{esv1.IngestRole},
+				allStatefulSets: sset.StatefulSetList{
+					ssetfixtures.TestSset{Replicas: 3, Master: true, Data: true, Ingest: false}.Build(),
+					ssetfixtures.TestSset{Replicas: 1, Ingest: true, Data: true}.Build(),
+					ssetfixtures.TestSset{Replicas: 1, DataFrozen: true}.Build(),
+				},
+			},
+			want: 1,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			for _, role := range tt.args.role {
+				if got := allowedDisruptionsForRole(context.Background(), tt.args.es, role, tt.args.allStatefulSets); got != tt.want {
+					t.Errorf("allowedDisruptionsForRole() = %v, want %v for role: %s", got, tt.want, role)
+				}
+			}
+		})
+	}
+}
+
+func TestGetRolesFromStatefulSet(t *testing.T) {
+	type args struct {
+		statefulSetName string
+		builder         Builder
+		statefulSet     *appsv1.StatefulSet
+		version         string
+	}
+	tests := []struct {
+		name    string
+		args    args
+		want    []esv1.NodeRole
+		wantErr bool
+	}{
+		{
+			name: "unspecified roles (nil) - should represent all roles excluding coordinating",
+			args: args{
+				statefulSetName: "all-roles",
+				builder: NewBuilder("test-es").
+					WithNamespace("ns").
+					WithVersion("8.0.0").
+					WithNodeSet("all-roles", 3, "all_roles"),
+				version: "8.0.0",
+			},
+			want: []esv1.NodeRole{
+				esv1.MasterRole,
+				esv1.DataRole,
+				esv1.IngestRole,
+				esv1.MLRole,
+				esv1.TransformRole,
+				esv1.RemoteClusterClientRole,
+				esv1.DataHotRole,
+				esv1.DataWarmRole,
+				esv1.DataColdRole,
+				esv1.DataContentRole,
+				esv1.DataFrozenRole,
+			},
+			wantErr: false,
+		},
+		{
+			name: "master only",
+			args: args{
+				statefulSetName: "master-only",
+				builder: NewBuilder("test-es").
+					WithNamespace("ns").
+					WithVersion("8.0.0").
+					WithNodeSet("master-only", 3, esv1.MasterRole),
+				version: "8.0.0",
+			},
+			want:    []esv1.NodeRole{esv1.MasterRole},
+			wantErr: false,
+		},
+		{
+			name: "data only",
+			args: args{
+				statefulSetName: "data-only",
+				builder: NewBuilder("test-es").
+					WithNamespace("ns").
+					WithVersion("8.0.0").
+					WithNodeSet("data-only", 3, esv1.DataRole),
+				version: "8.0.0",
+			},
+			want:    []esv1.NodeRole{esv1.DataRole},
+			wantErr: false,
+		},
+		{
+			name: "multiple roles",
+			args: args{
+				statefulSetName: "master-data",
+				builder: NewBuilder("test-es").
+					WithNamespace("ns").
+					WithVersion("8.0.0").
+					WithNodeSet("master-data", 3, esv1.MasterRole, esv1.DataRole),
+				version: "8.0.0",
+			},
+			want:    []esv1.NodeRole{esv1.MasterRole, esv1.DataRole},
+			wantErr: false,
+		},
+		{
+			name: "coordinating node (empty roles slice)",
+			args: args{
+				statefulSetName: "coordinating",
+				builder: NewBuilder("test-es").
+					WithNamespace("ns").
+					WithVersion("8.0.0").
+					WithNodeSet("coordinating", 2, esv1.CoordinatingRole),
+				version: "8.0.0",
+			},
+			want:    []esv1.NodeRole{esv1.CoordinatingRole},
+			wantErr: false,
+		},
+		{
+			name: "data tier roles",
+			args: args{
+				statefulSetName: "data-hot-warm",
+				builder: NewBuilder("test-es").
+					WithNamespace("ns").
+					WithVersion("8.0.0").
+					WithNodeSet("data-hot-warm", 3, esv1.DataHotRole, esv1.DataWarmRole),
+				version: "8.0.0",
+			},
+			want:    []esv1.NodeRole{esv1.DataHotRole, esv1.DataWarmRole},
+			wantErr: false,
+		},
+		{
+			name: "sts with no labels returns an error",
+			args: args{
+				statefulSetName: "no-labels",
+				statefulSet: &appsv1.StatefulSet{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "no-labels",
+						Namespace: "ns",
+					},
+				},
+				version: "8.0.0",
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var statefulSet appsv1.StatefulSet
+			var found bool
+			// This allows overriding the statefulset for conditions such as error testing.
+			if tt.args.statefulSet == nil {
+				statefulSet, found = tt.args.builder.GetStatefulSets().GetByName(tt.args.statefulSetName)
+			} else {
+				statefulSet = *tt.args.statefulSet
+				found = true
+			}
+
+			if !found && !tt.wantErr {
+				t.Fatalf("StatefulSet %s not found in test fixtures", tt.args.statefulSetName)
+			}
+
+			got, err := getRolesFromStatefulSet(statefulSet)
+			if err != nil && !tt.wantErr {
+				t.Errorf("getRolesFromStatefulSet() error = %v", err)
+				return
+			}
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("getRolesForStatefulSet() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestGroupBySharedRoles(t *testing.T) {
+	tests := []struct {
+		name    string
+		builder Builder
+		want    map[esv1.NodeRole][]appsv1.StatefulSet
+	}{
+		{
+			name:    "empty statefulsets",
+			builder: NewBuilder("test-es"),
+			want:    map[esv1.NodeRole][]appsv1.StatefulSet{},
+		},
+		{
+			name: "single statefulset with no roles",
+			builder: NewBuilder("test-es").
+				WithVersion("9.0.1").
+				WithNodeSet("coordinating", 1, esv1.CoordinatingRole),
+			want: map[esv1.NodeRole][]appsv1.StatefulSet{
+				esv1.CoordinatingRole: {
+					ssetfixtures.TestSset{Name: "coordinating", ClusterName: "test-es", Version: "9.0.1"}.Build(),
+				},
+			},
+		},
+		{
+			name: "all statefulsets with different roles",
+			builder: NewBuilder("test-es").
+				WithVersion("9.0.1").
+				WithNodeSet("master", 1, esv1.MasterRole).
+				WithNodeSet("ingest", 1, esv1.IngestRole),
+			want: map[esv1.NodeRole][]appsv1.StatefulSet{
+				esv1.MasterRole: {
+					ssetfixtures.TestSset{Name: "master", Master: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+				},
+				esv1.IngestRole: {
+					ssetfixtures.TestSset{Name: "ingest", Ingest: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+				},
+			},
+		},
+		{
+			name: "statefulsets with shared roles are grouped properly",
+			builder: NewBuilder("test-es").
+				WithVersion("9.0.1").
+				WithNodeSet("master", 1, esv1.MasterRole, esv1.DataRole).
+				WithNodeSet("data", 1, esv1.DataRole).
+				WithNodeSet("ingest", 1, esv1.IngestRole),
+			want: map[esv1.NodeRole][]appsv1.StatefulSet{
+				esv1.DataRole: {
+					ssetfixtures.TestSset{Name: "master", Master: true, Data: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+					ssetfixtures.TestSset{Name: "data", Data: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+				},
+				esv1.IngestRole: {
+					ssetfixtures.TestSset{Name: "ingest", Ingest: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+				},
+			},
+		},
+		{
+			name: "statefulsets with multiple shared roles in multiple groups, and data* roles are grouped properly",
+			builder: NewBuilder("test-es").
+				WithVersion("9.0.1").
+				WithNodeSet("master", 1, esv1.MasterRole, esv1.DataRole).
+				WithNodeSet("data", 1, esv1.DataRole).
+				WithNodeSet("data_hot", 1, esv1.DataHotRole).
+				WithNodeSet("data_warm", 1, esv1.DataWarmRole).
+				WithNodeSet("data_cold", 1, esv1.DataColdRole).
+				WithNodeSet("data_frozen", 1, esv1.DataFrozenRole).
+				WithNodeSet("ingest", 1, esv1.IngestRole, esv1.MLRole).
+				WithNodeSet("ml", 1, esv1.MLRole),
+			want: map[esv1.NodeRole][]appsv1.StatefulSet{
+				esv1.DataRole: {
+					ssetfixtures.TestSset{Name: "master", Master: true, Data: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+					ssetfixtures.TestSset{Name: "data", Data: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+					ssetfixtures.TestSset{Name: "data_hot", DataHot: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+					ssetfixtures.TestSset{Name: "data_warm", DataWarm: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+					ssetfixtures.TestSset{Name: "data_cold", DataCold: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+				},
+				esv1.DataFrozenRole: {
+					ssetfixtures.TestSset{Name: "data_frozen", DataFrozen: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+				},
+				esv1.IngestRole: {
+					ssetfixtures.TestSset{Name: "ingest", Ingest: true, ML: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+					ssetfixtures.TestSset{Name: "ml", ML: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+				},
+			},
+		},
+		{
+			name: "coordinating nodes (no roles) in separate group",
+			builder: NewBuilder("test-es").
+				WithVersion("9.0.1").
+				WithNodeSet("data", 1, esv1.DataRole).
+				WithNodeSet("coordinating1", 1, esv1.CoordinatingRole).
+				WithNodeSet("coordinating2", 1, esv1.CoordinatingRole),
+			want: map[esv1.NodeRole][]appsv1.StatefulSet{
+				esv1.DataRole: {
+					ssetfixtures.TestSset{Name: "data", Data: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+				},
+				esv1.CoordinatingRole: {
+					ssetfixtures.TestSset{Name: "coordinating1", Version: "9.0.1", ClusterName: "test-es"}.Build(),
+					ssetfixtures.TestSset{Name: "coordinating2", Version: "9.0.1", ClusterName: "test-es"}.Build(),
+				},
+			},
+		},
+		{
+			name: "statefulsets with multiple roles respect priority order",
+			builder: NewBuilder("test-es").
+				WithVersion("9.0.1").
+				WithNodeSet("master-data-ingest", 1, esv1.MasterRole, esv1.DataRole, esv1.IngestRole).
+				WithNodeSet("data-ingest", 1, esv1.DataRole, esv1.IngestRole).
+				WithNodeSet("ingest-only", 1, esv1.IngestRole),
+			want: map[esv1.NodeRole][]appsv1.StatefulSet{
+				esv1.DataRole: {
+					ssetfixtures.TestSset{Name: "master-data-ingest", Master: true, Data: true, Ingest: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+					ssetfixtures.TestSset{Name: "data-ingest", Data: true, Ingest: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+					ssetfixtures.TestSset{Name: "ingest-only", Ingest: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+				},
+			},
+		},
+		{
+			name: "mixed data role types are properly collapsed even with generic data role existing",
+			builder: NewBuilder("test-es").
+				WithVersion("9.0.1").
+				WithNodeSet("data", 1, esv1.DataRole).
+				WithNodeSet("data_hot", 1, esv1.DataHotRole).
+				WithNodeSet("data_content", 1, esv1.DataContentRole).
+				WithNodeSet("master", 1, esv1.MasterRole),
+			want: map[esv1.NodeRole][]appsv1.StatefulSet{
+				esv1.MasterRole: {
+					ssetfixtures.TestSset{Name: "master", Master: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+				},
+				esv1.DataRole: {
+					ssetfixtures.TestSset{Name: "data", Data: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+					ssetfixtures.TestSset{Name: "data_hot", DataHot: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+					ssetfixtures.TestSset{Name: "data_content", DataContent: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+				},
+			},
+		},
+		{
+			name: "data roles without generic data role do not maintain separate groups",
+			builder: NewBuilder("test-es").
+				WithVersion("9.0.1").
+				WithNodeSet("data_hot", 1, esv1.DataHotRole).
+				WithNodeSet("data_cold", 1, esv1.DataColdRole).
+				WithNodeSet("master", 1, esv1.MasterRole),
+			want: map[esv1.NodeRole][]appsv1.StatefulSet{
+				esv1.MasterRole: {
+					ssetfixtures.TestSset{Name: "master", Master: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+				},
+				esv1.DataRole: {
+					ssetfixtures.TestSset{Name: "data_hot", DataHot: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+					ssetfixtures.TestSset{Name: "data_cold", DataCold: true, Version: "9.0.1", ClusterName: "test-es"}.Build(),
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			stss := tt.builder.GetStatefulSets()
+
+			got, err := groupBySharedRoles(stss)
+			// There's only one path to an error here, which is a statefulset
+			// with no labels, which currently this test doesn't have the ability to create.
+			// There is a test in the underlying getRolesFromStatefulSet func that tests this condition.
+			if err != nil {
+				t.Errorf("groupBySharedRoles() error = %v", err)
+				return
+			}
+
+			// Check that the number of groups matches
+			assert.Equal(t, len(tt.want), len(got), "Expected %d groups, got %d", len(tt.want), len(got))
+
+			// Check each expected group
+			for role, expectedSsets := range tt.want {
+				gotSsets, exists := got[role]
+				assert.True(t, exists, "Expected group for role %s not found", role)
+				if !exists {
+					continue
+				}
+
+				// Sort both slices for consistent comparison
+				sort.Slice(expectedSsets, func(i, j int) bool {
+					return expectedSsets[i].Name < expectedSsets[j].Name
+				})
+				sort.Slice(gotSsets, func(i, j int) bool {
+					return gotSsets[i].Name < gotSsets[j].Name
+				})
+
+				assert.Equal(t, len(expectedSsets), len(gotSsets), "Group %s has wrong size", role)
+
+				// Check if all StatefulSets in the group match
+				for i := 0; i < len(expectedSsets); i++ {
+					if i >= len(gotSsets) {
+						t.Errorf("Missing StatefulSet at index %d in group %s", i, role)
+						continue
+					}
+
+					assert.Equal(t, expectedSsets[i].Name, gotSsets[i].Name,
+						"StatefulSet names do not match in group %s", role)
+					assert.Equal(t, expectedSsets[i].Spec.Template.Labels, gotSsets[i].Spec.Template.Labels,
+						"StatefulSet labels do not match in group %s", role)
+				}
+			}
+
+			// Check if there are any unexpected groups
+			for role := range got {
+				_, exists := tt.want[role]
+				assert.True(t, exists, "Unexpected group found: %s", role)
+			}
+		})
+	}
+}
diff --git a/pkg/utils/test/webhook.go b/pkg/utils/test/webhook.go
index c3d0d9683..982a008c2 100644
--- a/pkg/utils/test/webhook.go
+++ b/pkg/utils/test/webhook.go
@@ -17,7 +17,7 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/require"
-	admissionv1beta1 "k8s.io/api/admission/v1beta1"
+	admissionv1 "k8s.io/api/admission/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/serializer"
@@ -32,22 +32,22 @@ import (
 
 // ValidationWebhookTestCase represents a test case for testing a validation webhook
 type ValidationWebhookTestCase struct {
-	Name      string                                                           // Name of the test
-	Operation admissionv1beta1.Operation                                       // Operation type (Create, Update, or Delete)
-	Object    func(t *testing.T, uid string) []byte                            // Object to check
-	OldObject func(t *testing.T, uid string) []byte                            // Old object (for updates)
-	Check     func(t *testing.T, response *admissionv1beta1.AdmissionResponse) // Logic to check the response
+	Name      string                                                      // Name of the test
+	Operation admissionv1.Operation                                       // Operation type (Create, Update, or Delete)
+	Object    func(t *testing.T, uid string) []byte                       // Object to check
+	OldObject func(t *testing.T, uid string) []byte                       // Old object (for updates)
+	Check     func(t *testing.T, response *admissionv1.AdmissionResponse) // Logic to check the response
 }
 
 // ValidationWebhookSucceeded is a helper function to verify that the validation webhook accepted the request.
-func ValidationWebhookSucceeded(t *testing.T, response *admissionv1beta1.AdmissionResponse) {
+func ValidationWebhookSucceeded(t *testing.T, response *admissionv1.AdmissionResponse) {
 	t.Helper()
 	require.True(t, response.Allowed, "Request denied: %s", response.Result.Reason)
 }
 
 // ValidationWebhookFailed is a helper function to verify that the validation webhook rejected the request.
-func ValidationWebhookFailed(causeRegexes ...string) func(*testing.T, *admissionv1beta1.AdmissionResponse) {
-	return func(t *testing.T, response *admissionv1beta1.AdmissionResponse) {
+func ValidationWebhookFailed(causeRegexes ...string) func(*testing.T, *admissionv1.AdmissionResponse) {
+	return func(t *testing.T, response *admissionv1.AdmissionResponse) {
 		t.Helper()
 		require.False(t, response.Allowed)
 
@@ -74,8 +74,8 @@ func ValidationWebhookFailed(causeRegexes ...string) func(*testing.T, *admission
 	}
 }
 
-func ValidationWebhookSucceededWithWarnings(warningsRegexes ...string) func(*testing.T, *admissionv1beta1.AdmissionResponse) {
-	return func(t *testing.T, response *admissionv1beta1.AdmissionResponse) {
+func ValidationWebhookSucceededWithWarnings(warningsRegexes ...string) func(*testing.T, *admissionv1.AdmissionResponse) {
+	return func(t *testing.T, response *admissionv1.AdmissionResponse) {
 		t.Helper()
 		require.True(t, response.Allowed, "Request denied: %s", response.Result.Reason)
 		for _, wr := range warningsRegexes {
@@ -112,9 +112,9 @@ func RunValidationWebhookTests(t *testing.T, gvk metav1.GroupVersionKind, valida
 		tc := tt
 		t.Run(tc.Name, func(t *testing.T) {
 			uid := tc.Name
-			payload := &admissionv1beta1.AdmissionReview{
+			payload := &admissionv1.AdmissionReview{
 				TypeMeta: metav1.TypeMeta{Kind: "AdmissionReview"},
-				Request: &admissionv1beta1.AdmissionRequest{
+				Request: &admissionv1.AdmissionRequest{
 					UID:       types.UID(uid),
 					Kind:      gvk,
 					Resource:  metav1.GroupVersionResource{Group: gvk.Group, Version: gvk.Version, Resource: gvk.Kind},
@@ -123,7 +123,7 @@ func RunValidationWebhookTests(t *testing.T, gvk metav1.GroupVersionKind, valida
 				},
 			}
 
-			if tc.Operation == admissionv1beta1.Update {
+			if tc.Operation == admissionv1.Update {
 				payload.Request.OldObject = runtime.RawExtension{Raw: tc.OldObject(t, uid)}
 			}
 
@@ -152,13 +152,13 @@ func RunValidationWebhookTests(t *testing.T, gvk metav1.GroupVersionKind, valida
 	}
 }
 
-func decodeResponse(t *testing.T, decoder runtime.Decoder, body io.Reader) *admissionv1beta1.AdmissionResponse {
+func decodeResponse(t *testing.T, decoder runtime.Decoder, body io.Reader) *admissionv1.AdmissionResponse {
 	t.Helper()
 
 	responseBytes, err := io.ReadAll(body)
 	require.NoError(t, err, "Failed to read response body")
 
-	response := &admissionv1beta1.AdmissionReview{}
+	response := &admissionv1.AdmissionReview{}
 	_, _, err = decoder.Decode(responseBytes, nil, response)
 	require.NoError(t, err, "Failed to decode response")
 
diff --git a/test/e2e/agent/recipes_test.go b/test/e2e/agent/recipes_test.go
index 138cc774e..ab201fdb9 100644
--- a/test/e2e/agent/recipes_test.go
+++ b/test/e2e/agent/recipes_test.go
@@ -132,6 +132,16 @@ func TestFleetKubernetesNonRootIntegrationRecipe(t *testing.T) {
 		t.SkipNow()
 	}
 
+	if (v.GE(version.MinFor(9, 0, 1)) && v.LE(version.MinFor(9, 0, 4))) ||
+		(v.EQ(version.From(9, 1, 0))) {
+		t.Skipf("Skipped as version %s is affected by https://github.com/elastic/kibana/pull/230211", v)
+	}
+
+	// TODO: see https://github.com/elastic/cloud-on-k8s/issues/8820
+	if v.GE(version.From(9, 1, 0)) {
+		t.Skipf("Skipped as version %s is affected by https://github.com/elastic/kibana/issues/233780", v)
+	}
+
 	// The recipe does not work fully within an openshift cluster without modifications.
 	if test.Ctx().OcpCluster {
 		t.SkipNow()
@@ -225,17 +235,17 @@ func runAgentRecipe(
 
 		// TODO: remove once https://github.com/elastic/cloud-on-k8s/issues/4092 is resolved
 		if test.Ctx().HasTag("ipv6") {
-			t.SkipNow()
+			t.Skipf("Test skipped on IPv6")
 		}
 
 		if isStackIncompatible(agentBuilder.Agent) {
-			t.SkipNow()
+			t.Skipf("Agent version %s is not compatible with stack %s", agentBuilder.Agent.Spec.Version, test.Ctx().ElasticStackVersion)
 		}
 
 		// OpenShift requires different securityContext than provided in the recipe.
 		// Skipping it altogether to reduce maintenance burden.
 		if strings.HasPrefix(test.Ctx().Provider, "ocp") {
-			t.SkipNow()
+			t.Skipf("Test skipped on OpenShift clusters")
 		}
 
 		agentBuilder.Suffix = suffix
diff --git a/test/e2e/beat/config_test.go b/test/e2e/beat/config_test.go
index 2d78c58a7..96e8b1dfc 100644
--- a/test/e2e/beat/config_test.go
+++ b/test/e2e/beat/config_test.go
@@ -310,8 +310,8 @@ processors:
 }
 
 func TestAuditbeatConfig(t *testing.T) {
-	if test.Ctx().Provider == "kind" {
-		// kind doesn't support configuring required settings
+	if test.Ctx().Provider == "kind" || test.Ctx().Provider == "k3d" {
+		// both kind and k3d do not support configuring required settings
 		// see https://github.com/elastic/cloud-on-k8s/issues/3328 for more context
 		t.SkipNow()
 	}
diff --git a/test/e2e/beat/recipes_test.go b/test/e2e/beat/recipes_test.go
index c55464bc1..849228985 100644
--- a/test/e2e/beat/recipes_test.go
+++ b/test/e2e/beat/recipes_test.go
@@ -188,9 +188,9 @@ func TestHeartbeatEsKbHealthRecipe(t *testing.T) {
 
 func TestAuditbeatHostsRecipe(t *testing.T) {
 
-	if test.Ctx().Provider == "kind" || test.Ctx().HasTag(test.ArchARMTag) {
+	if test.Ctx().Provider == "kind" || test.Ctx().Provider == "k3d" || test.Ctx().HasTag(test.ArchARMTag) {
 		// Skipping test because recipe relies on syscall audit rules unavailable on arm64
-		// Also: kind doesn't support configuring required settings
+		// Also: both kind and k3d do not support configuring required settings
 		// see https://github.com/elastic/cloud-on-k8s/issues/3328 for more context
 		t.SkipNow()
 	}
diff --git a/test/e2e/cmd/run/run.go b/test/e2e/cmd/run/run.go
index 61235fad3..60044ccb1 100644
--- a/test/e2e/cmd/run/run.go
+++ b/test/e2e/cmd/run/run.go
@@ -832,7 +832,8 @@ func (h *helper) dumpEventLog() {
 
 func (h *helper) runECKDiagnostics() {
 	operatorNS := h.testContext.Operator.Namespace
-	otherNS := append([]string{h.testContext.E2ENamespace}, h.testContext.Operator.ManagedNamespaces...)
+	// include the default namespace to have diagnostics on the local disk provisioner used in some environments
+	otherNS := append([]string{h.testContext.E2ENamespace, "default"}, h.testContext.Operator.ManagedNamespaces...)
 	cmd := exec.Command("eck-diagnostics", "-o", operatorNS, "-r", strings.Join(otherNS, ","), "--run-agent-diagnostics")
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
diff --git a/test/e2e/test/diagnostics.go b/test/e2e/test/diagnostics.go
index 59aff2090..19f8f0ac7 100644
--- a/test/e2e/test/diagnostics.go
+++ b/test/e2e/test/diagnostics.go
@@ -45,7 +45,8 @@ func maybeRunECKDiagnostics(ctx context.Context, testName string, step Step) {
 	}
 	log.Info("Running eck-diagnostics", "cluster", testCtx.ClusterName, "test", testName, "step", step.Name)
 
-	otherNS := append([]string{testCtx.E2ENamespace}, testCtx.Operator.ManagedNamespaces...)
+	// include the default namespace to have diagnostics on the local disk provisioner used in some environments
+	otherNS := append([]string{testCtx.E2ENamespace, "default"}, testCtx.Operator.ManagedNamespaces...)
 	// The following appends the clustername, test name, and it's sub-test names together with a '-'.
 	// The cluster name is added to the eck-diagnostics file name to avoid conflicts at the last step
 	// of the e2e tests where all diagnostics are downloaded locally to the same directory, and uploaded to buildkite as artifacts.
diff --git a/test/e2e/test/helper/yaml.go b/test/e2e/test/helper/yaml.go
index 032769f32..984e4f03f 100644
--- a/test/e2e/test/helper/yaml.go
+++ b/test/e2e/test/helper/yaml.go
@@ -249,6 +249,7 @@ func transformToE2E(namespace, fullTestName, suffix string, transformers []Build
 			b := elasticsearch.NewBuilderWithoutSuffix(decodedObj.Name)
 			b.Elasticsearch = *decodedObj
 			b = b.WithNamespace(namespace).
+				WithVersion(test.Ctx().ElasticStackVersion).
 				WithSuffix(suffix).
 				WithRestrictedSecurityContext().
 				WithLabel(run.TestNameLabel, fullTestName).
@@ -265,6 +266,7 @@ func transformToE2E(namespace, fullTestName, suffix string, transformers []Build
 			b := kibana.NewBuilderWithoutSuffix(decodedObj.Name)
 			b.Kibana = *decodedObj
 			builder = b.WithNamespace(namespace).
+				WithVersion(test.Ctx().ElasticStackVersion).
 				WithSuffix(suffix).
 				WithElasticsearchRef(tweakServiceRef(b.Kibana.Spec.ElasticsearchRef, suffix)).
 				WithRestrictedSecurityContext().
@@ -275,6 +277,7 @@ func transformToE2E(namespace, fullTestName, suffix string, transformers []Build
 			b := apmserver.NewBuilderWithoutSuffix(decodedObj.Name)
 			b.ApmServer = *decodedObj
 			builder = b.WithNamespace(namespace).
+				WithVersion(test.Ctx().ElasticStackVersion).
 				WithSuffix(suffix).
 				WithElasticsearchRef(tweakServiceRef(b.ApmServer.Spec.ElasticsearchRef, suffix)).
 				WithKibanaRef(tweakServiceRef(b.ApmServer.Spec.KibanaRef, suffix)).
@@ -285,6 +288,7 @@ func transformToE2E(namespace, fullTestName, suffix string, transformers []Build
 		case *beatv1beta1.Beat:
 			b := beat.NewBuilderFromBeat(decodedObj)
 			b = b.WithNamespace(namespace).
+				WithVersion(test.Ctx().ElasticStackVersion).
 				WithSuffix(suffix).
 				WithElasticsearchRef(tweakServiceRef(b.Beat.Spec.ElasticsearchRef, suffix)).
 				WithLabel(run.TestNameLabel, fullTestName).
@@ -301,6 +305,7 @@ func transformToE2E(namespace, fullTestName, suffix string, transformers []Build
 			b := enterprisesearch.NewBuilderWithoutSuffix(decodedObj.Name)
 			b.EnterpriseSearch = *decodedObj
 			builder = b.WithNamespace(namespace).
+				WithVersion(test.Ctx().ElasticStackVersion).
 				WithSuffix(suffix).
 				WithElasticsearchRef(tweakServiceRef(b.EnterpriseSearch.Spec.ElasticsearchRef, suffix)).
 				WithRestrictedSecurityContext().
@@ -309,6 +314,7 @@ func transformToE2E(namespace, fullTestName, suffix string, transformers []Build
 		case *agentv1alpha1.Agent:
 			b := agent.NewBuilderFromAgent(decodedObj)
 			b = b.WithNamespace(namespace).
+				WithVersion(test.Ctx().ElasticStackVersion).
 				WithSuffix(suffix).
 				WithElasticsearchRefs(tweakOutputRefs(b.Agent.Spec.ElasticsearchRefs, suffix)...).
 				WithLabel(run.TestNameLabel, fullTestName).