Repository: kubernetes-sigs/security-profiles-operator
Pull request #1195 (2022-09-30 07:14:58)

Update sigs.k8s.io/controller-tools from 0.9.2 to 0.10.0 and regenerate bundles

<!--  Thanks for sending a pull request!  Here are some tips for you:

- If this is your first time, please read our contributor guidelines: https://git.k8s.io/community/contributors/guide#your-first-contribution and developer guide https://git.k8s.io/community/contributors/devel/development.md#development-guide
- Please label this pull request according to what type of issue you are addressing, especially if this is a release targeted pull request. For reference on required PR/issue labels, read here:
https://git.k8s.io/community/contributors/devel/sig-release/release.md#issuepr-kind-label
- If you want *faster* PR reviews, read how: https://git.k8s.io/community/contributors/guide/pull-requests.md#best-practices-for-faster-reviews
- If the PR is unfinished, see how to mark it: https://git.k8s.io/community/contributors/guide/pull-requests.md#marking-unfinished-pull-requests
-->

#### What type of PR is this?

<!--
Add one of the following kinds:
/kind bug
/kind cleanup
/kind documentation
/kind feature
/kind design

Optionally add one or more of the following kinds if applicable:
/kind api-change
/kind deprecation
/kind failing-test
/kind flake
/kind regression
-->

#### What this PR does / why we need it:
This is pretty much PR#1181 except I also regenrated the manifests and the bundle to make CI happy.

- build(deps): bump sigs.k8s.io/controller-tools from 0.9.2 to 0.10.0
- update bundle after controller-gen bump

#### Which issue(s) this PR fixes:
None

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or
-->

#### Does this PR have test?
N/A

<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
N/A

#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
NONE
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1195#" title="Author self-approved">jhrozek</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [jhrozek]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
codecov-commenter: # [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/1195?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) Report
> Merging [#1195](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/1195?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (a724553) into [main](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/e2286b3bab16e37b2bf50aa8364fe434642d8520?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (e2286b3) will **not change** coverage.
> The diff coverage is `n/a`.

<details><summary>Additional details and impacted files</summary>


```diff
@@           Coverage Diff           @@
##             main    #1195   +/-   ##
=======================================
  Coverage   47.51%   47.51%           
=======================================
  Files          44       44           
  Lines        4927     4927           
=======================================
  Hits         2341     2341           
  Misses       2487     2487           
  Partials       99       99           
```

</details>

Patch:
diff --git a/bundle/manifests/security-profiles-operator.x-k8s.io_profilebindings.yaml b/bundle/manifests/security-profiles-operator.x-k8s.io_profilebindings.yaml
index 3df9064cf..2044bd8b0 100644
--- a/bundle/manifests/security-profiles-operator.x-k8s.io_profilebindings.yaml
+++ b/bundle/manifests/security-profiles-operator.x-k8s.io_profilebindings.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
diff --git a/bundle/manifests/security-profiles-operator.x-k8s.io_profilerecordings.yaml b/bundle/manifests/security-profiles-operator.x-k8s.io_profilerecordings.yaml
index 367991ef7..46a965eac 100644
--- a/bundle/manifests/security-profiles-operator.x-k8s.io_profilerecordings.yaml
+++ b/bundle/manifests/security-profiles-operator.x-k8s.io_profilerecordings.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
diff --git a/bundle/manifests/security-profiles-operator.x-k8s.io_rawselinuxprofiles.yaml b/bundle/manifests/security-profiles-operator.x-k8s.io_rawselinuxprofiles.yaml
index 139d1f18e..45ab66fe7 100644
--- a/bundle/manifests/security-profiles-operator.x-k8s.io_rawselinuxprofiles.yaml
+++ b/bundle/manifests/security-profiles-operator.x-k8s.io_rawselinuxprofiles.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
diff --git a/bundle/manifests/security-profiles-operator.x-k8s.io_seccompprofiles.yaml b/bundle/manifests/security-profiles-operator.x-k8s.io_seccompprofiles.yaml
index 1695266bd..0a2ecddbf 100644
--- a/bundle/manifests/security-profiles-operator.x-k8s.io_seccompprofiles.yaml
+++ b/bundle/manifests/security-profiles-operator.x-k8s.io_seccompprofiles.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
diff --git a/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilenodestatuses.yaml b/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilenodestatuses.yaml
index 16fc71d4d..ae8c64d47 100644
--- a/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilenodestatuses.yaml
+++ b/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilenodestatuses.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
diff --git a/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilesoperatordaemons.yaml b/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilesoperatordaemons.yaml
index dccb9c606..5f33f3306 100644
--- a/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilesoperatordaemons.yaml
+++ b/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilesoperatordaemons.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
diff --git a/bundle/manifests/security-profiles-operator.x-k8s.io_selinuxprofiles.yaml b/bundle/manifests/security-profiles-operator.x-k8s.io_selinuxprofiles.yaml
index 62d03cbcf..ed4be7730 100644
--- a/bundle/manifests/security-profiles-operator.x-k8s.io_selinuxprofiles.yaml
+++ b/bundle/manifests/security-profiles-operator.x-k8s.io_selinuxprofiles.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
diff --git a/deploy/base-crds/crds/profilebinding.yaml b/deploy/base-crds/crds/profilebinding.yaml
index 9c48fdf0c..494dfc2bf 100644
--- a/deploy/base-crds/crds/profilebinding.yaml
+++ b/deploy/base-crds/crds/profilebinding.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   name: profilebindings.security-profiles-operator.x-k8s.io
 spec:
diff --git a/deploy/base-crds/crds/profilerecording.yaml b/deploy/base-crds/crds/profilerecording.yaml
index 07aae0884..ef55b6af3 100644
--- a/deploy/base-crds/crds/profilerecording.yaml
+++ b/deploy/base-crds/crds/profilerecording.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   name: profilerecordings.security-profiles-operator.x-k8s.io
 spec:
diff --git a/deploy/base-crds/crds/seccompprofile.yaml b/deploy/base-crds/crds/seccompprofile.yaml
index c610b52be..eed3dc347 100644
--- a/deploy/base-crds/crds/seccompprofile.yaml
+++ b/deploy/base-crds/crds/seccompprofile.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   name: seccompprofiles.security-profiles-operator.x-k8s.io
 spec:
diff --git a/deploy/base-crds/crds/securityprofilenodestatus.yaml b/deploy/base-crds/crds/securityprofilenodestatus.yaml
index 80a0a5720..3e754fc7f 100644
--- a/deploy/base-crds/crds/securityprofilenodestatus.yaml
+++ b/deploy/base-crds/crds/securityprofilenodestatus.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   name: securityprofilenodestatuses.security-profiles-operator.x-k8s.io
 spec:
diff --git a/deploy/base-crds/crds/securityprofilesoperatordaemon.yaml b/deploy/base-crds/crds/securityprofilesoperatordaemon.yaml
index 131b387f1..82232bd14 100644
--- a/deploy/base-crds/crds/securityprofilesoperatordaemon.yaml
+++ b/deploy/base-crds/crds/securityprofilesoperatordaemon.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   name: securityprofilesoperatordaemons.security-profiles-operator.x-k8s.io
 spec:
diff --git a/deploy/base-crds/crds/selinuxpolicy.yaml b/deploy/base-crds/crds/selinuxpolicy.yaml
index 9a3dbbde7..2a2efe56b 100644
--- a/deploy/base-crds/crds/selinuxpolicy.yaml
+++ b/deploy/base-crds/crds/selinuxpolicy.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   name: rawselinuxprofiles.security-profiles-operator.x-k8s.io
 spec:
@@ -105,7 +105,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   name: selinuxprofiles.security-profiles-operator.x-k8s.io
 spec:
diff --git a/deploy/helm/crds/crds.yaml b/deploy/helm/crds/crds.yaml
index 7f51cd6f8..9b6ab91a1 100644
--- a/deploy/helm/crds/crds.yaml
+++ b/deploy/helm/crds/crds.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -79,7 +79,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -207,7 +207,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -453,7 +453,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -518,7 +518,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -777,7 +777,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -882,7 +882,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
diff --git a/deploy/namespace-operator.yaml b/deploy/namespace-operator.yaml
index d287f9f5e..0b0ec652a 100644
--- a/deploy/namespace-operator.yaml
+++ b/deploy/namespace-operator.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -79,7 +79,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -207,7 +207,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -453,7 +453,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -518,7 +518,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -777,7 +777,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -882,7 +882,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
diff --git a/deploy/openshift-dev.yaml b/deploy/openshift-dev.yaml
index bb07fa49d..77b40ec79 100644
--- a/deploy/openshift-dev.yaml
+++ b/deploy/openshift-dev.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -79,7 +79,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -207,7 +207,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -453,7 +453,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -518,7 +518,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -777,7 +777,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -882,7 +882,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
diff --git a/deploy/operator.yaml b/deploy/operator.yaml
index a7876003e..c58f9d14d 100644
--- a/deploy/operator.yaml
+++ b/deploy/operator.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -79,7 +79,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -207,7 +207,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -453,7 +453,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -518,7 +518,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -777,7 +777,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -882,7 +882,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
diff --git a/deploy/webhook-operator.yaml b/deploy/webhook-operator.yaml
index 9ea4ec2b6..885423e3c 100644
--- a/deploy/webhook-operator.yaml
+++ b/deploy/webhook-operator.yaml
@@ -73,7 +73,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -150,7 +150,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -278,7 +278,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -383,7 +383,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -629,7 +629,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -694,7 +694,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -953,7 +953,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
+    controller-gen.kubebuilder.io/version: v0.10.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
diff --git a/go.mod b/go.mod
index 20cb913d4..9aab91013 100644
--- a/go.mod
+++ b/go.mod
@@ -32,7 +32,7 @@ require (
 	k8s.io/client-go v0.25.2
 	k8s.io/klog/v2 v2.80.1
 	sigs.k8s.io/controller-runtime v0.12.3
-	sigs.k8s.io/controller-tools v0.9.2
+	sigs.k8s.io/controller-tools v0.10.0
 	sigs.k8s.io/mdtoc v1.1.0
 	sigs.k8s.io/release-utils v0.7.3
 	sigs.k8s.io/yaml v1.3.0
diff --git a/go.sum b/go.sum
index 453bcc926..afe323f2a 100644
--- a/go.sum
+++ b/go.sum
@@ -2266,8 +2266,8 @@ sigs.k8s.io/controller-runtime v0.9.6/go.mod h1:q6PpkM5vqQubEKUKOM6qr06oXGzOBcCb
 sigs.k8s.io/controller-runtime v0.12.3 h1:FCM8xeY/FI8hoAfh/V4XbbYMY20gElh9yh+A98usMio=
 sigs.k8s.io/controller-runtime v0.12.3/go.mod h1:qKsk4WE6zW2Hfj0G4v10EnNB2jMG1C+NTb8h+DwCoU0=
 sigs.k8s.io/controller-tools v0.6.2/go.mod h1:oaeGpjXn6+ZSEIQkUe/+3I40PNiDYp9aeawbt3xTgJ8=
-sigs.k8s.io/controller-tools v0.9.2 h1:AkTE3QAdz9LS4iD3EJvHyYxBkg/g9fTbgiYsrcsFCcM=
-sigs.k8s.io/controller-tools v0.9.2/go.mod h1:NUkn8FTV3Sad3wWpSK7dt/145qfuQ8CKJV6j4jHC5rM=
+sigs.k8s.io/controller-tools v0.10.0 h1:0L5DTDTFB67jm9DkfrONgTGmfc/zYow0ZaHyppizU2U=
+sigs.k8s.io/controller-tools v0.10.0/go.mod h1:uvr0EW6IsprfB0jpQq6evtKy+hHyHCXNfdWI5ONPx94=
 sigs.k8s.io/gateway-api v0.4.3 h1:9kdHAcfkyP7jVMSFshc8EYEKNLlFM7hbZL8vCKcMwps=
 sigs.k8s.io/gateway-api v0.4.3/go.mod h1:r3eiNP+0el+NTLwaTfOrCNXy8TukC+dIM3ggc+fbNWk=
 sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6/go.mod h1:p4QtZmO4uMYipTQNzagwnNoseA6OxSUutVw05NhYDRs=
diff --git a/internal/pkg/nodestatus/nodestatus.go b/internal/pkg/nodestatus/nodestatus.go
index dc4d0ab01..65685f2be 100644
--- a/internal/pkg/nodestatus/nodestatus.go
+++ b/internal/pkg/nodestatus/nodestatus.go
@@ -25,6 +25,7 @@ import (
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/validation"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
@@ -33,11 +34,6 @@ import (
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/util"
 )
 
-const (
-	// finalizer name length limit.
-	finalizerNameLenLimit = 63
-)
-
 type StatusClient struct {
 	pol             client.Object
 	nodeName        string
@@ -52,8 +48,8 @@ func NewForProfile(pol client.Object, c client.Client) (*StatusClient, error) {
 		return nil, errors.New("cannot determine node name")
 	}
 	// Make sure the length of finalizer is not longer than 63 characters
-	if len(nodeName)+len("-deleted") > finalizerNameLenLimit {
-		finalizerString = nodeName[:finalizerNameLenLimit-len("-deleted")] + "-deleted"
+	if len(nodeName)+len("-deleted") > validation.DNS1123LabelMaxLength {
+		finalizerString = nodeName[:validation.DNS1123LabelMaxLength-len("-deleted")] + "-deleted"
 	}
 	return &StatusClient{
 		pol:             pol,
diff --git a/internal/pkg/util/names.go b/internal/pkg/util/names.go
index 739011d4c..e58d7f79e 100644
--- a/internal/pkg/util/names.go
+++ b/internal/pkg/util/names.go
@@ -23,6 +23,7 @@ import (
 	"io"
 
 	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/validation"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
@@ -70,12 +71,10 @@ func lengthName(maxLen int, hashPrefix, format string, a ...interface{}) (string
 }
 
 func dnsLengthName(hashPrefix, format string, a ...interface{}) string {
-	const maxDNSLen = 63
-
 	//nolint:errcheck // (jhrozek): I think it makes sense to make the utility
 	// 					  function return error, but here I think it's OK to
 	// 					  just ignore
-	name, _ := lengthName(maxDNSLen, hashPrefix, format, a...)
+	name, _ := lengthName(validation.DNS1123LabelMaxLength, hashPrefix, format, a...)
 	return name
 }
 
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 82a4563f3..036b64094 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1164,8 +1164,8 @@ sigs.k8s.io/controller-runtime/pkg/webhook
 sigs.k8s.io/controller-runtime/pkg/webhook/admission
 sigs.k8s.io/controller-runtime/pkg/webhook/conversion
 sigs.k8s.io/controller-runtime/pkg/webhook/internal/metrics
-# sigs.k8s.io/controller-tools v0.9.2
-## explicit; go 1.17
+# sigs.k8s.io/controller-tools v0.10.0
+## explicit; go 1.19
 sigs.k8s.io/controller-tools/cmd/controller-gen
 sigs.k8s.io/controller-tools/pkg/crd
 sigs.k8s.io/controller-tools/pkg/crd/markers
diff --git a/vendor/sigs.k8s.io/controller-tools/cmd/controller-gen/main.go b/vendor/sigs.k8s.io/controller-tools/cmd/controller-gen/main.go
index 692b26c8d..c27bcda42 100644
--- a/vendor/sigs.k8s.io/controller-tools/cmd/controller-gen/main.go
+++ b/vendor/sigs.k8s.io/controller-tools/cmd/controller-gen/main.go
@@ -5,7 +5,7 @@ Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
-    http://www.apache.org/licenses/LICENSE-2.0
+	http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/crd/doc.go b/vendor/sigs.k8s.io/controller-tools/pkg/crd/doc.go
index fd48e44ae..914af94d9 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/crd/doc.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/crd/doc.go
@@ -17,14 +17,14 @@ limitations under the License.
 // Package crd contains utilities for generating CustomResourceDefinitions and
 // their corresponding OpenAPI validation schemata.
 //
-// Markers
+// # Markers
 //
 // Markers live under the markers subpackage.  Two types of markers exist:
 // those that modify schema generation (for validation), and those that modify
 // the rest of the CRD.  See the subpackage for more information and all
 // supported markers.
 //
-// Collecting Types and Generating CRDs
+// # Collecting Types and Generating CRDs
 //
 // The Parser is the entrypoint for collecting the information required to
 // generate CRDs.  Like loader and collector, its methods are idemptotent, not
@@ -40,13 +40,13 @@ limitations under the License.
 // Errors are generally attached directly to the relevant Package with
 // AddError.
 //
-// Known Packages
+// # Known Packages
 //
 // There are a few types from Kubernetes that have special meaning, but don't
 // have validation markers attached.  Those specific types have overrides
 // listed in KnownPackages that can be added as overrides to any parser.
 //
-// Flattening
+// # Flattening
 //
 // Once schemata are generated, they can be used directly by external tooling
 // (like JSONSchema validators), but must first be "flattened" to not contain
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/crd/flatten.go b/vendor/sigs.k8s.io/controller-tools/pkg/crd/flatten.go
index 2500971c0..9224c26b2 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/crd/flatten.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/crd/flatten.go
@@ -143,6 +143,8 @@ func flattenAllOfInto(dst *apiext.JSONSchemaProps, src apiext.JSONSchemaProps, e
 				dstProps.Schema = &apiext.JSONSchemaProps{}
 			}
 			flattenAllOfInto(dstProps.Schema, *srcProps.Schema, errRec)
+		case "XPreserveUnknownFields":
+			dstField.Set(srcField)
 		case "XMapType":
 			dstField.Set(srcField)
 		// NB(directxman12): no need to explicitly handle nullable -- false is considered to be the zero value
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/crd/known_types.go b/vendor/sigs.k8s.io/controller-tools/pkg/crd/known_types.go
index 7e862cfb1..9e8decb28 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/crd/known_types.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/crd/known_types.go
@@ -5,7 +5,7 @@ Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
-    http://www.apache.org/licenses/LICENSE-2.0
+	http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
@@ -74,7 +74,8 @@ var KnownPackages = map[string]PackageOverride{
 	"k8s.io/apimachinery/pkg/runtime": func(p *Parser, pkg *loader.Package) {
 		p.Schemata[TypeIdent{Name: "RawExtension", Package: pkg}] = apiext.JSONSchemaProps{
 			// TODO(directxman12): regexp validation for this (or get kube to support it as a format value)
-			Type: "object",
+			Type:                   "object",
+			XPreserveUnknownFields: boolPtr(true),
 		}
 		p.AddPackage(pkg) // get the rest of the types
 	},
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/crd/markers/doc.go b/vendor/sigs.k8s.io/controller-tools/pkg/crd/markers/doc.go
index 48736401c..995af44b3 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/crd/markers/doc.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/crd/markers/doc.go
@@ -19,7 +19,7 @@ limitations under the License.
 //
 // All markers related to CRD generation live in AllDefinitions.
 //
-// Validation Markers
+// # Validation Markers
 //
 // Validation markers have values that implement ApplyToSchema
 // (crd.SchemaMarker).  Any marker implementing this will automatically
@@ -31,7 +31,7 @@ limitations under the License.
 // All validation markers start with "+kubebuilder:validation", and
 // have the same name as their type name.
 //
-// CRD Markers
+// # CRD Markers
 //
 // Markers that modify anything in the CRD itself *except* for the schema
 // implement ApplyToCRD (crd.CRDMarker).  They are expected to detect whether
@@ -39,7 +39,7 @@ limitations under the License.
 // them), or to the root-level CRD for legacy cases.  They are applied *after*
 // the rest of the CRD is computed.
 //
-// Misc
+// # Misc
 //
 // This package also defines the "+groupName" and "+versionName" package-level
 // markers, for defining package<->group-version mappings.
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/crd/markers/topology.go b/vendor/sigs.k8s.io/controller-tools/pkg/crd/markers/topology.go
index 45f8e7e58..a92995c80 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/crd/markers/topology.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/crd/markers/topology.go
@@ -55,15 +55,15 @@ func init() {
 //
 // Possible data-structure types of a list are:
 //
-// - "map": it needs to have a key field, which will be used to build an
-//   associative list. A typical example is a the pod container list,
-//   which is indexed by the container name.
+//   - "map": it needs to have a key field, which will be used to build an
+//     associative list. A typical example is a the pod container list,
+//     which is indexed by the container name.
 //
-// - "set": Fields need to be "scalar", and there can be only one
-//   occurrence of each.
+//   - "set": Fields need to be "scalar", and there can be only one
+//     occurrence of each.
 //
-// - "atomic": All the fields in the list are treated as a single value,
-//   are typically manipulated together by the same actor.
+//   - "atomic": All the fields in the list are treated as a single value,
+//     are typically manipulated together by the same actor.
 type ListType string
 
 // +controllertools:marker:generateHelp:category="CRD processing"
@@ -83,12 +83,12 @@ type ListMapKey string
 //
 // Possible values:
 //
-// - "granular": items in the map are independent of each other,
-//   and can be manipulated by different actors.
-//   This is the default behavior.
+//   - "granular": items in the map are independent of each other,
+//     and can be manipulated by different actors.
+//     This is the default behavior.
 //
-// - "atomic": all fields are treated as one unit.
-//   Any changes have to replace the entire map.
+//   - "atomic": all fields are treated as one unit.
+//     Any changes have to replace the entire map.
 type MapType string
 
 // +controllertools:marker:generateHelp:category="CRD processing"
@@ -99,12 +99,12 @@ type MapType string
 //
 // Possible values:
 //
-// - "granular": fields in the struct are independent of each other,
-//   and can be manipulated by different actors.
-//   This is the default behavior.
+//   - "granular": fields in the struct are independent of each other,
+//     and can be manipulated by different actors.
+//     This is the default behavior.
 //
-// - "atomic": all fields are treated as one unit.
-//   Any changes have to replace the entire struct.
+//   - "atomic": all fields are treated as one unit.
+//     Any changes have to replace the entire struct.
 type StructType string
 
 func (l ListType) ApplyToSchema(schema *apiext.JSONSchemaProps) error {
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/crd/spec.go b/vendor/sigs.k8s.io/controller-tools/pkg/crd/spec.go
index fc0099528..d7c1e4c28 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/crd/spec.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/crd/spec.go
@@ -5,7 +5,7 @@ Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
-    http://www.apache.org/licenses/LICENSE-2.0
+	http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/genall/doc.go b/vendor/sigs.k8s.io/controller-tools/pkg/genall/doc.go
index df8dd7138..af67402e6 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/genall/doc.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/genall/doc.go
@@ -17,14 +17,14 @@ limitations under the License.
 // Package genall defines entrypoints for generation tools to hook into and
 // share the same set of parsing, typechecking, and marker information.
 //
-// Generators
+// # Generators
 //
 // Each Generator knows how to register its markers into a central Registry,
 // and then how to generate output using a Collector and some root packages.
 // Each generator can be considered to be the output type of a marker, for easy
 // command line parsing.
 //
-// Output and Input
+// # Output and Input
 //
 // Generators output artifacts via an OutputRule.  OutputRules know how to
 // write output for different package-associated (code) files, as well as
@@ -40,7 +40,7 @@ limitations under the License.
 // InputRule defines custom input loading, but its shared across all
 // Generators.  There's currently only a filesystem implementation.
 //
-// Runtime and Context
+// # Runtime and Context
 //
 // Runtime maps together Generators, and constructs "contexts" which provide
 // the common collector and roots, plus the output rule for that generator, and
@@ -50,7 +50,7 @@ limitations under the License.
 // skipping type-checking errors (since those are commonly caused by the
 // partial type-checking of loader.TypeChecker).
 //
-// Options
+// # Options
 //
 // The FromOptions (and associated helpers) function makes it easy to use generators
 // and output rules as markers that can be parsed from the command line, producing
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/genall/help/pretty/doc.go b/vendor/sigs.k8s.io/controller-tools/pkg/genall/help/pretty/doc.go
index 06622db74..bc99e9ba9 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/genall/help/pretty/doc.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/genall/help/pretty/doc.go
@@ -17,13 +17,13 @@ limitations under the License.
 // Package pretty contains utilities for formatting terminal help output,
 // and a use of those to display marker help.
 //
-// Terminal Output
+// # Terminal Output
 //
 // The Span interface and Table struct allow you to construct tables with
 // colored formatting, without causing ANSI formatting characters to mess up width
 // calculations.
 //
-// Marker Help
+// # Marker Help
 //
 // The MarkersSummary prints a summary table for marker help, while the MarkersDetails
 // prints out more detailed information, with explainations of the individual marker fields.
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/genall/options.go b/vendor/sigs.k8s.io/controller-tools/pkg/genall/options.go
index 45e3bc41f..836b1617e 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/genall/options.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/genall/options.go
@@ -30,6 +30,8 @@ var (
 // +controllertools:marker:generateHelp:category=""
 
 // InputPaths represents paths and go-style path patterns to use as package roots.
+//
+// Multiple paths can be specified using "{path1, path2, path3}".
 type InputPaths []string
 
 // RegisterOptionsMarkers registers "mandatory" options markers for FromOptions into the given registry.
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/genall/zz_generated.markerhelp.go b/vendor/sigs.k8s.io/controller-tools/pkg/genall/zz_generated.markerhelp.go
index cc9ae7b80..6428f0ce2 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/genall/zz_generated.markerhelp.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/genall/zz_generated.markerhelp.go
@@ -29,8 +29,8 @@ func (InputPaths) Help() *markers.DefinitionHelp {
 	return &markers.DefinitionHelp{
 		Category: "",
 		DetailedHelp: markers.DetailedHelp{
-			Summary: "represents paths and go-style path patterns to use as package roots.",
-			Details: "",
+			Summary: "represents paths and go-style path patterns to use as package roots. ",
+			Details: "Multiple paths can be specified using \"{path1, path2, path3}\".",
 		},
 		FieldHelp: map[string]markers.DetailedHelp{},
 	}
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/loader/doc.go b/vendor/sigs.k8s.io/controller-tools/pkg/loader/doc.go
index a80065ec7..6853c062f 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/loader/doc.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/loader/doc.go
@@ -22,7 +22,7 @@ limitations under the License.
 // Because it uses go/packages, it's modules-aware, and works in both modules-
 // and non-modules environments.
 //
-// Loading
+// # Loading
 //
 // The main entrypoint for loading is LoadRoots, which traverse the package
 // graph starting at the given patterns (file, package, path, or ...-wildcard,
@@ -33,7 +33,7 @@ limitations under the License.
 // Packages are suitable for comparison, as each unique package only ever has
 // one *Package object returned.
 //
-// Syntax and TypeChecking
+// # Syntax and TypeChecking
 //
 // ASTs and type-checking information can be loaded with NeedSyntax and
 // NeedTypesInfo, respectively.  Both are idempotent -- repeated calls will
@@ -41,14 +41,14 @@ limitations under the License.
 // check the current package -- if you want to type-check imports as well,
 // you'll need to type-check them first.
 //
-// Reference Pruning and Recursive Checking
+// # Reference Pruning and Recursive Checking
 //
 // In order to type-check using only the packages you care about, you can use a
 // TypeChecker.  TypeChecker will visit each top-level type declaration,
 // collect (optionally filtered) references, and type-check references
 // packages.
 //
-// Errors
+// # Errors
 //
 // Errors can be added to each package.  Use ErrFromNode to create an error
 // from an AST node.  Errors can then be printed (complete with file and
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/loader/loader.go b/vendor/sigs.k8s.io/controller-tools/pkg/loader/loader.go
index 77a6f5624..b81acab2d 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/loader/loader.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/loader/loader.go
@@ -338,34 +338,34 @@ func LoadRoots(roots ...string) ([]*Package, error) {
 // supports roots that are filesystem paths. For more information, please
 // refer to the high-level outline of this function's logic:
 //
-//     1. If no roots are provided then load the working directory and return
-//        early.
+//  1. If no roots are provided then load the working directory and return
+//     early.
 //
-//     2. Otherwise sort the provided roots into two, distinct buckets:
+//  2. Otherwise sort the provided roots into two, distinct buckets:
 //
-//            a. package/module names
-//            b. filesystem paths
+//     a. package/module names
+//     b. filesystem paths
 //
-//        A filesystem path is distinguished from a Go package/module name by
-//        the same rules as followed by the "go" command. At a high level, a
-//        root is a filesystem path IFF it meets ANY of the following criteria:
+//     A filesystem path is distinguished from a Go package/module name by
+//     the same rules as followed by the "go" command. At a high level, a
+//     root is a filesystem path IFF it meets ANY of the following criteria:
 //
-//            * is absolute
-//            * begins with .
-//            * begins with ..
+//     * is absolute
+//     * begins with .
+//     * begins with ..
 //
-//        For more information please refer to the output of the command
-//        "go help packages".
+//     For more information please refer to the output of the command
+//     "go help packages".
 //
-//     3. Load the package/module roots as a single call to packages.Load. If
-//        there are no filesystem path roots then return early.
+//  3. Load the package/module roots as a single call to packages.Load. If
+//     there are no filesystem path roots then return early.
 //
-//     4. For filesystem path roots ending with "...", check to see if its
-//        descendants include any nested, Go modules. If so, add the directory
-//        that contains the nested Go module to the filesystem path roots.
+//  4. For filesystem path roots ending with "...", check to see if its
+//     descendants include any nested, Go modules. If so, add the directory
+//     that contains the nested Go module to the filesystem path roots.
 //
-//     5. Load the filesystem path roots and return the load packages for the
-//        package/module roots AND the filesystem path roots.
+//  5. Load the filesystem path roots and return the load packages for the
+//     package/module roots AND the filesystem path roots.
 func LoadRootsWithConfig(cfg *packages.Config, roots ...string) ([]*Package, error) {
 	l := &loader{
 		cfg:      cfg,
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/markers/collect.go b/vendor/sigs.k8s.io/controller-tools/pkg/markers/collect.go
index c5ea2345f..b2f821991 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/markers/collect.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/markers/collect.go
@@ -65,13 +65,13 @@ func (c *Collector) init() {
 //
 // - it's in the Godoc for that AST node
 //
-// - it's in the closest non-godoc comment group above that node,
-//   *and* that node is a type or field node, *and* [it's either
-//   registered as type-level *or* it's not registered as being
-//   package-level]
+//   - it's in the closest non-godoc comment group above that node,
+//     *and* that node is a type or field node, *and* [it's either
+//     registered as type-level *or* it's not registered as being
+//     package-level]
 //
-// - it's not in the Godoc of a node, doesn't meet the above criteria, and
-//   isn't in a struct definition (in which case it's package-level)
+//   - it's not in the Godoc of a node, doesn't meet the above criteria, and
+//     isn't in a struct definition (in which case it's package-level)
 func (c *Collector) MarkersInPackage(pkg *loader.Package) (map[ast.Node]MarkerValues, error) {
 	c.mu.Lock()
 	c.init()
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/markers/doc.go b/vendor/sigs.k8s.io/controller-tools/pkg/markers/doc.go
index 707036de8..ab6947cca 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/markers/doc.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/markers/doc.go
@@ -19,7 +19,7 @@ limitations under the License.
 // avoid confusing with struct tags).  Parsed result (output) values take the
 // form of Go values, much like the "encoding/json" package.
 //
-// Definitions and Parsing
+// # Definitions and Parsing
 //
 // Markers are defined as structured Definitions which can be used to
 // consistently parse marker comments.  A Definition contains an concrete
@@ -29,20 +29,20 @@ limitations under the License.
 //
 // Markers take the general form
 //
-//  +path:to:marker=val
+//	+path:to:marker=val
 //
-//  +path:to:marker:arg1=val,arg2=val2
+//	+path:to:marker:arg1=val,arg2=val2
 //
-//  +path:to:marker
+//	+path:to:marker
 //
 // Arguments may be ints, bools, strings, and slices.  Ints and bool take their
 // standard form from Go.  Strings may take any of their standard forms, or any
 // sequence of unquoted characters up until a `,` or `;` is encountered.  Lists
 // take either of the following forms:
 //
-//  val;val;val
+//	val;val;val
 //
-//  {val, val, val}
+//	{val, val, val}
 //
 // Note that the first form will not properly parse nested slices, but is
 // generally convenient and is the form used in many existing markers.
@@ -61,7 +61,7 @@ limitations under the License.
 // non-optional fields aren't mentioned, an error will be raised unless
 // `Strict` is set to false.
 //
-// Registries and Lookup
+// # Registries and Lookup
 //
 // Definitions can be added to registries to facilitate lookups.  Each
 // definition is marked as either describing a type, struct field, or package
@@ -69,7 +69,7 @@ limitations under the License.
 // long as each describes a different construct (type, field, or package).
 // Definitions can then be looked up by passing unparsed markers.
 //
-// Collection and Extraction
+// # Collection and Extraction
 //
 // Markers can be collected from a loader.Package using a Collector.  The
 // Collector will read from a given Registry, collecting comments that look
@@ -85,7 +85,7 @@ limitations under the License.
 // Like loader.Package, Collector's methods are idempotent and will not
 // reperform work.
 //
-// Traversal
+// # Traversal
 //
 // EachType function iterates over each type in a Package, providing
 // conveniently structured type and field information with marker values
@@ -93,14 +93,14 @@ limitations under the License.
 //
 // PackageMarkers can be used to fetch just package-level markers.
 //
-// Help
+// # Help
 //
 // Help can be defined for each marker using the DefinitionHelp struct.  It's
 // mostly intended to be generated off of godocs using cmd/helpgen, which takes
 // the first line as summary (removing the type/field name), and considers the
 // rest as details.  It looks for the
 //
-//   +controllertools:generateHelp[:category=<string>]
+//	+controllertools:generateHelp[:category=<string>]
 //
 // marker to start generation.
 //
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/markers/reg.go b/vendor/sigs.k8s.io/controller-tools/pkg/markers/reg.go
index b0124630f..7dcd45899 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/markers/reg.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/markers/reg.go
@@ -52,7 +52,8 @@ func (r *Registry) init() {
 
 // Define defines a new marker with the given name, target, and output type.
 // It's a shortcut around
-//  r.Register(MakeDefinition(name, target, obj))
+//
+//	r.Register(MakeDefinition(name, target, obj))
 func (r *Registry) Define(name string, target TargetType, obj interface{}) error {
 	def, err := MakeDefinition(name, target, obj)
 	if err != nil {
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/markers/zip.go b/vendor/sigs.k8s.io/controller-tools/pkg/markers/zip.go
index 0ef1fb133..b352ededc 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/markers/zip.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/markers/zip.go
@@ -149,11 +149,11 @@ type TypeCallback func(info *TypeInfo)
 // EachType collects all markers, then calls the given callback for each type declaration in a package.
 // Each individual spec is considered separate, so
 //
-//  type (
-//      Foo string
-//      Bar int
-//      Baz struct{}
-//  )
+//	type (
+//	    Foo string
+//	    Bar int
+//	    Baz struct{}
+//	)
 //
 // yields three calls to the callback.
 func EachType(col *Collector, pkg *loader.Package, cb TypeCallback) error {
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/rbac/parser.go b/vendor/sigs.k8s.io/controller-tools/pkg/rbac/parser.go
index 3bbf11fd4..c2a24f471 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/rbac/parser.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/rbac/parser.go
@@ -19,7 +19,7 @@ limitations under the License.
 //
 // The markers take the form:
 //
-//  +kubebuilder:rbac:groups=<groups>,resources=<resources>,resourceNames=<resource names>,verbs=<verbs>,urls=<non resource urls>
+//	+kubebuilder:rbac:groups=<groups>,resources=<resources>,resourceNames=<resource names>,verbs=<verbs>,urls=<non resource urls>
 package rbac
 
 import (
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/schemapatcher/gen.go b/vendor/sigs.k8s.io/controller-tools/pkg/schemapatcher/gen.go
index 583ba1be0..e33ec11ff 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/schemapatcher/gen.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/schemapatcher/gen.go
@@ -358,12 +358,16 @@ func crdsFromDirectory(ctx *genall.GenerationContext, dir string) (map[schema.Gr
 		if err := kyaml.Unmarshal(rawContent, &typeMeta); err != nil {
 			continue
 		}
+
+		if typeMeta.APIVersion == "" || typeMeta.Kind != "CustomResourceDefinition" {
+			// If there's no API version this file probably isn't a CRD.
+			// Likewise we don't need to care if the Kind isn't CustomResourceDefinition.
+			continue
+		}
+
 		if !isSupportedAPIExtGroupVer(typeMeta.APIVersion) {
 			return nil, fmt.Errorf("load %q: apiVersion %q not supported", filepath.Join(dir, fileInfo.Name()), typeMeta.APIVersion)
 		}
-		if typeMeta.Kind != "CustomResourceDefinition" {
-			continue
-		}
 
 		// collect the group-kind and versions from the actual structured form
 		var actualCRD crdIsh
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/version/version.go b/vendor/sigs.k8s.io/controller-tools/pkg/version/version.go
index 99f383c2e..09c8efcf4 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/version/version.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/version/version.go
@@ -5,7 +5,7 @@ Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
-    http://www.apache.org/licenses/LICENSE-2.0
+	http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
@@ -36,10 +36,10 @@ func Version() string {
 //
 // - "Version: v0.2.1" when the program has been compiled with:
 //
-//   $ go get github.com/controller-tools/cmd/controller-gen@v0.2.1
+//	$ go get github.com/controller-tools/cmd/controller-gen@v0.2.1
 //
-//   Note: go modules requires the usage of semver compatible tags starting with
-//        'v' to have nice human-readable versions.
+//	Note: go modules requires the usage of semver compatible tags starting with
+//	     'v' to have nice human-readable versions.
 //
 // - "Version: (devel)" when the program is compiled from a local git checkout.
 //
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/webhook/parser.go b/vendor/sigs.k8s.io/controller-tools/pkg/webhook/parser.go
index 392acfc77..a76dcdcbb 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/webhook/parser.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/webhook/parser.go
@@ -19,7 +19,7 @@ limitations under the License.
 //
 // The markers take the form:
 //
-//  +kubebuilder:webhook:webhookVersions=<[]string>,failurePolicy=<string>,matchPolicy=<string>,groups=<[]string>,resources=<[]string>,verbs=<[]string>,versions=<[]string>,name=<string>,path=<string>,mutating=<bool>,sideEffects=<string>,admissionReviewVersions=<[]string>
+//	+kubebuilder:webhook:webhookVersions=<[]string>,failurePolicy=<string>,matchPolicy=<string>,groups=<[]string>,resources=<[]string>,verbs=<[]string>,versions=<[]string>,name=<string>,path=<string>,mutating=<bool>,sideEffects=<string>,admissionReviewVersions=<[]string>,reinvocationPolicy=<string>
 package webhook
 
 import (
@@ -111,6 +111,14 @@ type Config struct {
 	// AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`
 	// versions the Webhook expects.
 	AdmissionReviewVersions []string `marker:"admissionReviewVersions"`
+
+	// ReinvocationPolicy allows mutating webhooks to request reinvocation after other mutations
+	//
+	// To allow mutating admission plugins to observe changes made by other plugins,
+	// built-in mutating admission plugins are re-run if a mutating webhook modifies
+	// an object, and mutating webhooks can specify a reinvocationPolicy to control
+	// whether they are reinvoked as well.
+	ReinvocationPolicy string `marker:"reinvocationPolicy,optional"`
 }
 
 // verbToAPIVariant converts a marker's verb to the proper value for the API.
@@ -151,6 +159,7 @@ func (c Config) ToMutatingWebhook() (admissionregv1.MutatingWebhook, error) {
 		ClientConfig:            c.clientConfig(),
 		SideEffects:             c.sideEffects(),
 		AdmissionReviewVersions: c.AdmissionReviewVersions,
+		ReinvocationPolicy:      c.reinvocationPolicy(),
 	}, nil
 }
 
@@ -263,6 +272,20 @@ func (c Config) sideEffects() *admissionregv1.SideEffectClass {
 	return &sideEffects
 }
 
+// reinvocationPolicy returns the reinvocationPolicy config for a mutating webhook.
+func (c Config) reinvocationPolicy() *admissionregv1.ReinvocationPolicyType {
+	var reinvocationPolicy admissionregv1.ReinvocationPolicyType
+	switch strings.ToLower(c.ReinvocationPolicy) {
+	case strings.ToLower(string(admissionregv1.NeverReinvocationPolicy)):
+		reinvocationPolicy = admissionregv1.NeverReinvocationPolicy
+	case strings.ToLower(string(admissionregv1.IfNeededReinvocationPolicy)):
+		reinvocationPolicy = admissionregv1.IfNeededReinvocationPolicy
+	default:
+		return nil
+	}
+	return &reinvocationPolicy
+}
+
 // webhookVersions returns the target API versions of the {Mutating,Validating}WebhookConfiguration objects for a webhook.
 func (c Config) webhookVersions() ([]string, error) {
 	// If WebhookVersions is not specified, we default it to `v1`.
diff --git a/vendor/sigs.k8s.io/controller-tools/pkg/webhook/zz_generated.markerhelp.go b/vendor/sigs.k8s.io/controller-tools/pkg/webhook/zz_generated.markerhelp.go
index 2a34608e8..411c58e17 100644
--- a/vendor/sigs.k8s.io/controller-tools/pkg/webhook/zz_generated.markerhelp.go
+++ b/vendor/sigs.k8s.io/controller-tools/pkg/webhook/zz_generated.markerhelp.go
@@ -81,6 +81,10 @@ func (Config) Help() *markers.DefinitionHelp {
 				Summary: "is an ordered list of preferred `AdmissionReview` versions the Webhook expects.",
 				Details: "",
 			},
+			"ReinvocationPolicy": {
+				Summary: "allows mutating webhooks to request reinvocation after other mutations ",
+				Details: "To allow mutating admission plugins to observe changes made by other plugins, built-in mutating admission plugins are re-run if a mutating webhook modifies an object, and mutating webhooks can specify a reinvocationPolicy to control whether they are reinvoked as well.",
+			},
 		},
 	}
 }


Test patch:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 1ec59d382..7f5e3052f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -29,11 +29,11 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v3
-      - uses: github/codeql-action/init@86f3159a697a097a813ad9bfa0002412d97690a4
+      - uses: github/codeql-action/init@e0e5ded33cabb451ae0a9768fc7b0410bad9ad44
         with:
           languages: go
-      - uses: github/codeql-action/autobuild@86f3159a697a097a813ad9bfa0002412d97690a4
-      - uses: github/codeql-action/analyze@86f3159a697a097a813ad9bfa0002412d97690a4
+      - uses: github/codeql-action/autobuild@e0e5ded33cabb451ae0a9768fc7b0410bad9ad44
+      - uses: github/codeql-action/analyze@e0e5ded33cabb451ae0a9768fc7b0410bad9ad44
 
   coverage:
     runs-on: ubuntu-22.04