Without this, dependabot would separate all the dependencies in
different PRs.
This is inefficient: The only group of PRs that need to be
separate, is kubernetes: We only want to bump them for a new
release.
On top of that, those kubernetes dependencies also need to be
bumped together.
This fixes the dependabot config to match that use case.
Signed-off-by: Jean-Philippe Evrard <open-source@a.spamming.party>
We have historically decided to support AND TEST 3 versions
of kubernetes. For that, we lagged behind in terms of client versions.
Lagging behind one version allowed us, thanks to kubernetes client version skew,
to support 3 versions at relatively low cost.
However, maintaining 3 versions has always been a pain.
For that, we pinned old versions of kubernetes clients/api and test tooling.
In december 2025 community meeting, we decided to only maintain two
versions: the most current one, and the previous one.
This allows us to bump more regularly and be more secure.
We can also more easily use dependabot this way.
Signed-off-by: Jean-Philippe Evrard <open-source@a.spamming.party>
Without this patch, dependabot will still try to bump some k8s
dependencies.
This is a problem, as we need to bump them together, manually.
This should fix it by removing them all from dependabot.
Without this patch, we'll get kubernetes updates.
This is not necessary, and could be even a problem on merge:
those kubernetes updates are done separately, knowingly,
to respect the life cycle of the kubernetes we need
(and stay one version below latest to have a larger coverage
of versions).
We could keep dependabot to update those on a lower frequency,
but that sounds clunky and not great. Instead disable them all,
and rely on the team to do this regular maintenance work.
Jean-Philippe Evrard
Daniel Holbach