Update Terraform kubernetes to v3

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
kubernetes (source)	required_provider	major	2.38.0 → 3.2.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

hashicorp/terraform-provider-kubernetes (kubernetes)

v3.2.0

Compare Source

ENHANCEMENTS:

• Added linux/s390x build target for IBM Z platform [GH-2897]

NOTES:

• Upgrade Go to 1.26.3 [GH-2896]

v3.1.0

Compare Source

FEATURES:

• kubernetes: Add kubernetes_endpoint_slice_v1 data source [GH-2847]

v3.0.1

Compare Source

HOTFIX:

• Fix missing ip_mode attribute in kubernetes_service_v1 data source. [GH-2807]

v3.0.0

Compare Source

ENHANCEMENTS:

• • Add support for sidecar containers via restart_policy field in init_container spec [GH-2786]
• Add ip_mode attribute to service status [GH-2784]
• Add support for ValidatingAdmissionPolicy [GH-2794]
• Bump Kubernetes dependencies to v1.33 [GH-2774]

DEPRECATIONS:

• Data Sources

• kubernetes_config_map → use kubernetes_config_map_v1
• kubernetes_namespace → use kubernetes_namespace_v1
• kubernetes_secret → use kubernetes_secret_v1
• kubernetes_service → use kubernetes_service_v1
• kubernetes_pod → use kubernetes_pod_v1
• kubernetes_service_account → use kubernetes_service_account_v1
• kubernetes_persistent_volume_claim → use kubernetes_persistent_volume_claim_v1
• kubernetes_storage_class → use kubernetes_storage_class_v1
• kubernetes_ingress → use kubernetes_ingress_v1

Resources

• kubernetes_namespace → use kubernetes_namespace_v1
• kubernetes_service → use kubernetes_service_v1
• kubernetes_service_account → use kubernetes_service_account_v1
• kubernetes_default_service_account → use kubernetes_default_service_account_v1
• kubernetes_config_map → use kubernetes_config_map_v1
• kubernetes_secret → use kubernetes_secret_v1
• kubernetes_pod → use kubernetes_pod_v1
• kubernetes_endpoints → use kubernetes_endpoints_v1
• kubernetes_limit_range → use kubernetes_limit_range_v1
• kubernetes_persistent_volume → use kubernetes_persistent_volume_v1
• kubernetes_persistent_volume_claim → use kubernetes_persistent_volume_claim_v1
• kubernetes_replication_controller → use kubernetes_replication_controller_v1
• kubernetes_resource_quota → use kubernetes_resource_quota_v1
• kubernetes_api_service → use kubernetes_api_service_v1
• kubernetes_deployment → use kubernetes_deployment_v1
• kubernetes_daemonset → use kubernetes_daemon_set_v1
• kubernetes_stateful_set → use kubernetes_stateful_set_v1
• kubernetes_job → use kubernetes_job_v1
• kubernetes_cron_job → use kubernetes_cron_job_v1
• kubernetes_horizontal_pod_autoscaler → use kubernetes_horizontal_pod_autoscaler_v1 or kubernetes_horizontal_pod_autoscaler_v2
• kubernetes_certificate_signing_request → use kubernetes_certificate_signing_request_v1
• kubernetes_role → use kubernetes_role_v1
• kubernetes_role_binding → use kubernetes_role_binding_v1
• kubernetes_cluster_role → use kubernetes_cluster_role_v1
• kubernetes_cluster_role_binding → use kubernetes_cluster_role_binding_v1
• kubernetes_ingress → use kubernetes_ingress_v1
• kubernetes_ingress_class → use kubernetes_ingress_class_v1
• kubernetes_network_policy → use kubernetes_network_policy_v1
• kubernetes_pod_disruption_budget → use kubernetes_pod_disruption_budget_v1
• kubernetes_pod_security_policy → removed upstream; use Pod Security Admission instead
• kubernetes_priority_class → use kubernetes_priority_class_v1
• kubernetes_validating_webhook_configuration → use kubernetes_validating_webhook_configuration_v1
• kubernetes_mutating_webhook_configuration → use kubernetes_mutating_webhook_configuration_v1
• kubernetes_storage_class → use kubernetes_storage_class_v1
• kubernetes_csi_driver → use kubernetes_csi_driver_v1 [GH-2770]

BUG FIXES:

• Environment variables should not override configuration when using kubernetes_manifest. [GH-2788]
• resource/kubernetes_daemon_set_v1: fix an issue with the provider not waiting for rollout with wait_for_rollout = true. [GH-2789]

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

OpenTofu Format and Style 🖌success

OpenTofu Initialization ⚙️success

OpenTofu Validation 🤖success

Validation Output

Warning: Deprecated Resource

  with kubernetes_secret.cluster-autoscaler,
  on main.tf line 173, in resource "kubernetes_secret" "cluster-autoscaler":
 173: resource "kubernetes_secret" "cluster-autoscaler" {

Deprecated; use kubernetes_secret_v1.

(and 2 more similar warnings elsewhere)
Success! The configuration is valid, but there were some validation warnings
as shown above.

OpenTofu Plan 📖success

Show Plan

tofu
civo_object_store_credential.cloudnativenow-backup: Refreshing state... [id=2085a5d9-2c85-4412-9153-6592a6daa8c0]
civo_network.cloudnativenow: Refreshing state... [id=2307557a-b07f-4d7c-9c38-b5ebee2f59c7]
civo_object_store.cloudnativenow-backup: Refreshing state... [id=923e220e-cc49-4616-83ef-684682f621bd]
civo_firewall.cloudnativenow: Refreshing state... [id=5ba41838-5fc3-4da0-9dae-3b7d8d16ef09]
civo_database.cloudnativenow: Refreshing state... [id=5eee285c-486b-469c-8b79-3dc66dff0185]
civo_kubernetes_cluster.cloudnativenow: Refreshing state... [id=371c04de-235e-4fa2-bd53-8ba42bc460d3]
flux_bootstrap_git.cloudnativenow: Refreshing state... [id=flux-system]
kubernetes_secret.ghost-backup-creds: Refreshing state... [id=ghost/ghost-backup-creds]
kubernetes_secret.ghost-database-password: Refreshing state... [id=ghost/ghost-database]
kubernetes_secret.cluster-autoscaler: Refreshing state... [id=kube-system/cluster-autoscaler-civo]

Note: Objects have changed outside of OpenTofu

OpenTofu detected the following changes made outside of OpenTofu since the
last "tofu apply" which may have affected this plan:

  # civo_kubernetes_cluster.cloudnativenow has changed
  ~ resource "civo_kubernetes_cluster" "cloudnativenow" {
        id                     = "371c04de-235e-4fa2-bd53-8ba42bc460d3"
      ~ kubeconfig             = (sensitive value)
        name                   = "CloudNative.now"
        # (16 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place (current -> planned)

OpenTofu will perform the following actions:

  # civo_firewall.cloudnativenow will be updated in-place
  ~ resource "civo_firewall" "cloudnativenow" {
        id                   = "5ba41838-5fc3-4da0-9dae-3b7d8d16ef09"
        name                 = "cloudnativenow-firewall"
        # (3 unchanged attributes hidden)

      - ingress_rule {
          - action   = "allow" -> null
          - cidr     = [
              - "0.0.0.0/0",
            ] -> null
          - id       = "8c6f464e-7e4b-4772-b901-b7c809df07eb" -> null
          - label    = "ping" -> null
          - protocol = "icmp" -> null
        }
      - ingress_rule {
          - action     = "allow" -> null
          - cidr       = [
              - "88.97.212.179/32",
            ] -> null
          - id         = "6e338ee3-41c3-4b8f-ab37-86f0ac291890" -> null
          - label      = "local" -> null
          - port_range = "3306" -> null
          - protocol   = "tcp" -> null
        }
      + ingress_rule {
          + action   = "allow"
          + cidr     = [
              + "0.0.0.0/0",
            ]
          + id       = "8c6f464e-7e4b-4772-b901-b7c809df07eb"
          + label    = "ping"
          + protocol = "icmp"
        }
      + ingress_rule {
          + action     = "allow"
          + cidr       = [
              + "88.97.210.216/32",
            ]
          + id         = (known after apply)
          + label      = "local"
          + port_range = "3306"
          + protocol   = "tcp"
        }

        # (11 unchanged blocks hidden)
    }

  # civo_kubernetes_cluster.cloudnativenow will be updated in-place
  ~ resource "civo_kubernetes_cluster" "cloudnativenow" {
        id                     = "371c04de-235e-4fa2-bd53-8ba42bc460d3"
      ~ kubernetes_version     = "1.35.0-k3s1" -> "1.30.5-k3s1"
        name                   = "CloudNative.now"
        # (16 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # flux_bootstrap_git.cloudnativenow will be updated in-place
  ~ resource "flux_bootstrap_git" "cloudnativenow" {
        id                   = "flux-system"
      ~ repository_files     = {
          ~ "flux/flux-system/gotk-sync.yaml"       = <<-EOT
              - 
              + # This manifest was generated by flux. DO NOT EDIT.
              + ---
              + apiVersion: source.toolkit.fluxcd.io/v1
              + kind: GitRepository
              + metadata:
              +   name: flux-system
              +   namespace: flux-system
              + spec:
              +   interval: 1m0s
              +   ref:
              +     branch: main
              +   secretRef:
              +     name: flux-system
              +   url: https://github.com/NamelessPlanet/CloudNativeNow-Gitops.git
              + ---
              + apiVersion: kustomize.toolkit.fluxcd.io/v1
              + kind: Kustomization
              + metadata:
              +   name: flux-system
              +   namespace: flux-system
              + spec:
              +   interval: 10m0s
              +   path: ./flux
              +   prune: true
              +   sourceRef:
              +     kind: GitRepository
              +     name: flux-system
            EOT
            # (2 unchanged elements hidden)
        }
      ~ version              = "v2.5.1" -> "v2.8.8"
        # (13 unchanged attributes hidden)
    }

Plan: 0 to add, 3 to change, 0 to destroy.

Changes to Outputs:
  ~ kubernetes_kubeconfig   = (sensitive value)

Warning: Flux resources GitRepository and Kustomization in flux-system namespace are not ready and Flux will be redeployed

  with flux_bootstrap_git.cloudnativenow,
  on main.tf line 168, in resource "flux_bootstrap_git" "cloudnativenow":
 168: resource "flux_bootstrap_git" "cloudnativenow" {

Kustomization/flux-system:
CustomResourceDefinition/ocirepositories.source.toolkit.fluxcd.io dry-run
failed (Invalid): CustomResourceDefinition.apiextensions.k8s.io
"ocirepositories.source.toolkit.fluxcd.io" is invalid:
status.storedVersions[0]: Invalid value: "v1beta2": missing from
spec.versions; v1beta2 was previously a storage version, and must remain in
spec.versions until a storage migration ensures no data remains persisted in
v1beta2 and removes v1beta2 from status.storedVersions


Warning: Deprecated Resource

  with kubernetes_secret.cluster-autoscaler,
  on main.tf line 173, in resource "kubernetes_secret" "cluster-autoscaler":
 173: resource "kubernetes_secret" "cluster-autoscaler" {

Deprecated; use kubernetes_secret_v1.

(and 5 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run "tofu apply" now.