feat(deps)!: remove legacy istio-operator ingress + unblock update-go-deps CI; bump k8s v0.36.1 / controller-runtime v0.24.1 / helm v3.21.0

[amuraru]

Summary

The weekly update-go-deps CI job has been failing every run since 2026-05-18. Unblocking it requires upgrading to k8s v0.36, which is incompatible with the vendored banzaicloud istio-operator API. This PR removes that legacy istio ingress backend, fixes the Makefile root cause, and ships the resulting dependency bump.

Warning

Breaking change: the istioingress external-listener backend and its KafkaCluster API fields are removed (see below). envoy (default), contour, and nodeport remain.

1. Remove legacy banzaicloud istio-operator ingress

The vendored github.com/banzaicloud/istio-operator API is EOL/unmaintained and fundamentally incompatible with k8s >= 0.35: k8s dropped the proto.Message method set (ProtoMessage()) from core types, so the istio types' proto.Clone / jsonpb codepaths panic on any message embedding a k8s type (e.g. *corev1.LocalObjectReference). This is the hard blocker for upgrading the k8s dependencies — patching the vendored gen files proved infeasible, so the backend is removed entirely.

Deleted:

• pkg/resources/istioingress, pkg/util/istioingress
• vendored third_party istio-operator + istio-client-go modules
• istio CRD test fixtures, the istioingress controller test, the istio sample

KafkaCluster API removals (breaking):

• istioingress value from the ingressController enum
• spec.istioControlPlane field
• IstioIngressConfig, IstioControlPlaneReference

Also removed the istio scheme registrations, RBAC markers, reconciler wiring, and the istio branch of GetIngressConfigs / external-listener status. Regenerated CRDs, RBAC and zz_generated.deepcopy; go mod tidy drops the istio modules. Removed the stale istio-operator entry from .licensei.toml and the istio CRD names from the e2e cleanup list.

Migration: clusters using ingressController: istioingress must switch to envoy (default), contour, or nodeport.

2. Fix the update-go-deps CI root cause

The update-module-deps Makefile macro ran go get -u on each direct dep sequentially. When controller-runtime was upgraded it pulled k8s.io/api to v0.36, but k8s.io/kubectl (indirect, via helm) stayed at v0.35. kubectl v0.35 still imports k8s.io/api/scheduling/v1alpha1, which was removed in v0.36 → go mod tidy aborted with a missing-package error.

Makefile (update-module-deps):

• After the per-module go get -u loop, explicitly pin k8s.io/kubectl and k8s.io/cli-runtime to the same minor version as k8s.io/api so the whole k8s ecosystem stays in lockstep.
• Exclude .claude/worktrees from make tidy's find scan (local-only fix); add it to .gitignore.

3. Dependency bump (make update-go-deps)

Module	Before	After
k8s.io/*	v0.34.3	v0.36.1 (all in lockstep, incl. kubectl/cli-runtime)
helm.sh/helm/v3	v3.19.4	v3.21.0
sigs.k8s.io/controller-runtime	v0.22.4	v0.24.1
google.golang.org/grpc	v1.72.1	v1.81.1
Various leaf deps	—	bumped across all modules

Source migrations required by the bump:

• controller-runtime v0.24 (breaking): NewWebhookManagedBy is now generic — ctrl.NewWebhookManagedBy(mgr, &T{}), the .For() call is removed. Validator[T] now uses concrete typed params: ValidateCreate/Update/Delete in KafkaClusterValidator / KafkaTopicValidator change from runtime.Object to *KafkaCluster / *KafkaTopic. Added Apply() to mock SubResourceClient; added CreateACLs() to mockClusterAdmin.
• k8s v0.36: k8s-objectmatcher tests migrate autoscaling/v2beta1 → autoscaling/v2 (package removed).
• SA1019 deprecations (golangci-lint v2.12.2): scheme.Builder → runtime.NewSchemeBuilder in api/v1alpha1,v1beta1 (removes controller-runtime from the api module imports); cmmeta.ObjectReference → IssuerReference; corev1.ServiceExternalTrafficPolicyType → ServiceExternalTrafficPolicy; kafkaclient CreateACL → CreateACLs (batched per resource); terratest kubectl/helm helpers → Context variants in tests/e2e.

Test plan

• make update-go-deps exits 0 (verified locally)
• make tidy exits 0 (verified locally)
• go build ./... clean (verified locally)
• go vet ./... clean (verified locally)
• CI unit tests pass
• Re-run the Update Go Dependencies workflow on master after merge to confirm the fix is self-sustaining

🤖 Generated with Claude Code