[bot] Bump openshift/prometheus-operator to v0.88.0

.custom-gcl.yaml

@@ -1,4 +1,4 @@
-version: v2.6.1
+version: v2.7.2
 name: golangci-kube-api-linter
 destination: ./tmp/bin/
 plugins:

.github/PULL_REQUEST_TEMPLATE.md

@@ -2,9 +2,11 @@
 
 _Describe the big picture of your changes here to communicate to the maintainers why we should accept this pull request._
 
-_If it fixes an existing issue (bug or feature), use the following keyword:_
+<!-- If it fixes an existing issue (bug or feature), use the following keyword -->
 
-_Closes: #ISSUE-NUMBER_
+Closes: #ISSUE-NUMBER
+
+If you're contributing for the first-time, check our [contribution guidelines](../CONTRIBUTING.md).
 
 ## Type of change
 

.github/env

@@ -1,4 +1,4 @@
-golang-version=1.24
+golang-version=1.25
 kind-version=v0.30.0
-kind-image=kindest/node:v1.34.0
-golangci-lint-version=v2.7.0
+kind-image=kindest/node:v1.34.2
+golangci-lint-version=v2.7.2

.github/workflows/actionlint.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Download actionlint
         id: get_actionlint
         run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/v1.7.4/scripts/download-actionlint.bash)

.github/workflows/changed-files.yaml

@@ -16,7 +16,7 @@ jobs:
     steps:
     - name: checkout repo
       id: checkout
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
       with:
         fetch-depth: 0
     - name: get changed files

.github/workflows/checks.yaml

@@ -22,7 +22,7 @@ jobs:
           - ubuntu-latest
     name: Generate and format
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
     - name: Import environment variables from file
       run: cat ".github/env" >> "$GITHUB_ENV"
     - uses: actions/setup-go@v6
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Check Documentation formatting and links
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
     - name: Import environment variables from file
       run: cat ".github/env" >> "$GITHUB_ENV"
     - uses: actions/setup-go@v6
@@ -52,7 +52,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Golang linter
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Import environment variables from file
         run: cat ".github/env" >> "$GITHUB_ENV"
       - uses: actions/setup-go@v6
@@ -62,7 +62,7 @@ jobs:
       - name: Check go.mod
         run: make tidy && git diff --exit-code
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v9.0.0
+        uses: golangci/golangci-lint-action@v9.2.0
         with:
           version: '${{ env.golangci-lint-version }}'
           args: --timeout 10m0s
@@ -74,7 +74,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Check prometheus metrics
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
     - name: Import environment variables from file
       run: cat ".github/env" >> "$GITHUB_ENV"
     - uses: actions/setup-go@v6
@@ -92,7 +92,7 @@ jobs:
           - ubuntu-latest
     name: Build operator binary
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
     - name: Import environment variables from file
       run: cat ".github/env" >> "$GITHUB_ENV"
     - uses: actions/setup-go@v6
@@ -105,7 +105,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Build Prometheus Operator rule config map to rule file CRDs CLI tool
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
     - name: Import environment variables from file
       run: cat ".github/env" >> "$GITHUB_ENV"
     - uses: actions/setup-go@v6

.github/workflows/cspell.json

@@ -419,6 +419,7 @@
     "finalizer",
     "selfsigned",
     "FIPS",
-    "FIPSSTS"
+    "FIPSSTS",
+    "checkmark"
   ]
 }

.github/workflows/e2e-feature-gated.yaml

@@ -22,7 +22,7 @@ jobs:
     if: ${{ needs.changed-files.outputs.non-markdown-files }}
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
 
     - name: Setup E2E environment
       uses: ./.github/actions/setup-e2e  # composite action with your setup steps
@@ -34,7 +34,7 @@ jobs:
         make test-e2e-feature-gates
     - name: Upload diagnostics artifact
       if: ${{ failure() }}
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v6
       with:
         name: cluster-state
         path: ${{ env.E2E_DIAGNOSTIC_DIRECTORY }}

.github/workflows/e2e-prometheus-v2.yaml

@@ -27,7 +27,7 @@ jobs:
           - suite: operatorUpgrade
             target: test-e2e-operator-upgrade
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
 
     - name: Setup E2E environment
       uses: ./.github/actions/setup-e2e  # composite action with your setup steps

.github/workflows/e2e.yaml

@@ -37,7 +37,7 @@ jobs:
           - suite: operatorUpgrade
             target: test-e2e-operator-upgrade
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
 
     - name: Setup E2E environment
       uses: ./.github/actions/setup-e2e  # composite action with your setup steps
@@ -49,7 +49,7 @@ jobs:
         make ${{ matrix.target }}
     - name: Upload diagnostics artifact
       if: ${{ failure() }}
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v6
       with:
         name: cluster-state
         path: ${{ env.E2E_DIAGNOSTIC_DIRECTORY }}

.github/workflows/publish.yaml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Import environment variables from file
         run: cat ".github/env" >> "$GITHUB_ENV"
       - name: Reclaim disk space

.github/workflows/release.yaml

@@ -10,7 +10,7 @@ jobs:
     name: Upload release assets
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Import environment variables from file
         run: cat ".github/env" >> "$GITHUB_ENV"
       - name: Install Go

.github/workflows/spell-check.yaml

@@ -13,9 +13,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Run cSpell
-        uses: streetsidesoftware/cspell-action@76c6f6d52abd57f4bcab5f3fde1bbd4f19a99eb0
+        uses: streetsidesoftware/cspell-action@24fa8d3096a314ce263f39578744e9d9f8d80acf
         with:
           incremental_files_only: false
           files:  "**/*.{md,yaml,yml}"

.github/workflows/test-prom-version-upgrade.yaml

@@ -15,7 +15,7 @@ jobs:
         docker image prune --force --all
         sudo rm -rf /usr/share/dotnet
         sudo rm -rf /usr/local/lib/android
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
     - name: Import environment variables from file
       run: |
         cat ".github/env" >> "$GITHUB_ENV"
@@ -49,7 +49,7 @@ jobs:
         make test-e2e-prometheus-upgrade
     - name: Upload diagnostics artifact
       if: ${{ failure() }}
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v6
       with:
         name: cluster-state
         path: ${{ env.E2E_DIAGNOSTIC_DIRECTORY }}

.github/workflows/unit.yaml

@@ -21,7 +21,7 @@ jobs:
     needs: changed-files
     if: ${{ needs.changed-files.outputs.non-markdown-files }}
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
     - name: Import environment variables from file
       run: cat ".github/env" >> "$GITHUB_ENV"
     - uses: actions/setup-go@v6
@@ -35,7 +35,7 @@ jobs:
     needs: changed-files
     if: ${{ needs.changed-files.outputs.non-markdown-files }}
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
     - name: Import environment variables from file
       run: cat ".github/env" >> "$GITHUB_ENV"
     - uses: actions/setup-go@v6

.golangci-kal.yml

@@ -6,7 +6,7 @@
 # https://github.com/kubernetes-sigs/kube-api-linter/blob/main/docs/linters.md
 version: "2"
 run:
-  go: "1.24"
+  go: "1.25"
   allow-parallel-runners: true
 linters:
   default: none
@@ -23,6 +23,7 @@ linters:
             # Whenever a new linter is added, it should not break the backward
             # compatibility of existing APIs (at least for v1 APIs).
             enable:
+              - "nobools"
               - "commentstart"
               - "conflictingmarkers"
               - "duplicatemarkers"
@@ -34,6 +35,8 @@ linters:
               - "statusoptional"
               - "nophase"
               - "nonullable"
+              - "forbiddenmarkers"
+              - "nomaps"
             disable:
               - "*"
           lintersConfig:
@@ -44,7 +47,14 @@ linters:
                   - ["default", "kubebuilder:default"]
                   - ["required", "kubebuilder:validation:Required", "k8s:required"]
                 description: "A field with a default value cannot be required"
-
+            forbiddenmarkers:
+              markers:
+                - identifier: "+kubebuilder:pruning:PreserveUnknownFields"
+                - identifier: "+kubebuilder:validation:XPreserveUnknownFields"
+                - identifier: "+kubebuilder:validation:items:XPreserveUnknownFields"
+                - identifier: "+kubebuilder:validation:EmbeddedResource"
+                - identifier: "+kubebuilder:validation:XEmbeddedResource"
+                - identifier: "+kubebuilder:validation:items:XEmbeddedResource"
   exclusions:
     generated: strict
     paths:
@@ -55,4 +65,4 @@ linters:
     # KAL only validates the API folders.
     - path-except: pkg/apis/monitoring/
       linters:
-        - kubeapilinter
+        - kubeapilinter

.golangci.yml

@@ -1,6 +1,6 @@
 version: "2"
 run:
-  go: "1.24"
+  go: "1.25"
   timeout: 10m
   modules-download-mode: readonly
   allow-parallel-runners: true

.mdox.validate.yaml

@@ -6,51 +6,12 @@ random_delay: 1s
 explicitLocalValidators: true
 
 validators:
-  # Skip localhost examples.
-  - regex: 'localhost'
-    type: "ignore"
-  # docs.github.com returns 403 if not in browser. Cannot curl as well.
-  - regex: 'docs\.github\.com'
-    type: "ignore"
-  # Cloudflare protection, so returns 503 if not in browser. Cannot curl as well.
-  - regex: 'wise\.com'
-    type: "ignore"
-  # Adopters example link.
-  - regex: "our-link"
-    type: "ignore"
-  # 301 errors even when curl-ed.
-  - regex: "envoyproxy"
-    type: "ignore"
-  # Ignore release links.
-  - regex: 'https:\/\/github\.com\/prometheus-operator\/prometheus-operator\/releases'
-    type: "ignore"
-  # Ignore GitHub container packages link as it returns 404 in curl, but works in browser
-  - regex: 'https://github.com/prometheus-operator/prometheus-operator/pkgs/container/prometheus-operator'
+  # Ignore all external URLs because of rate-limiting protections which make the tests very flaky.
+  - regex: '^http(s)?://.+'
     type: "ignore"
   # Ignore links to /img/ because the generated content will resolve them correctly.
   - regex: '/img/.+'
     type: ignore
-  # Twitter changed their policy and now returns 403 if not authenticated. We can guarantee this link since we own the account.
-  - regex: 'https:\/\/twitter.com\/PromOperator'
-    type: ignore
   # Ignore anchor links pointing to the API documentation which are HTML <a> tags and not supported by mdox.
   - regex: 'api\.md#monitoring\.coreos\.com/v1\.(BasicAuth|PrometheusSpec|StorageSpec)$'
     type: ignore
-  # Ignore dead links from Ambassador (soon to be removed).
-  - regex: 'getambassador'
-    type: ignore
-  # Ignore all github.com URLs because of rate limiting.
-  # TODO: find an alternative way to check these URLs avoiding the rate limiting.
-  - regex: 'github.com'
-    type: ignore
-  # Ignore all istio.io URLs because of http request timeout.
-  - regex: 'istio.io'
-    type: ignore
-  # Medium rejects bot's requests.
-  - regex: 'medium.com'
-    type: ignore
-  # Use the githubPullsIssues validator to avoid rate-limiting.
-  - regex: '(^http[s]?:\/\/)(www\.)?(github\.com\/)prometheus-operator\/prometheus-operator(\/pull\/|\/issues\/)'
-    type: githubPullsIssues
-    # The GitHub actions running mdox configure the GITHUB_TOKEN environment variable.
-    token: '$(GITHUB_TOKEN)'

CHANGELOG.md

@@ -1,3 +1,29 @@
+## 0.88.0 / 2026-01-09
+
+* [CHANGE] Use narrower selectors for StatefulSet informers in `Alertmanager` and `ThanosRuler` controllers. It is recommended to upgrade from `v0.85.0` (at least). #8246
+* [CHANGE] Reject `EC2/Lightsail` SD for Prometheus >= 3.8.0 in `ScrapeConfig` CRD. #8175
+* [FEATURE] Add `podManagementPolicy` field to `Prometheus`, `PrometheusAgent`, `Alertmanager` and `ThanosRuler` CRDs. #8119
+* [FEATURE] Add `updateStrategy` field to `Prometheus`, `PrometheusAgent`, `Alertmanager` and `ThanosRuler` CRDs. #8202
+* [FEATURE] Add `scrapeNativeHistograms` field to `Prometheus`, `PrometheusAgent`, `ServiceMonitor`, `PodMonitor`, `Probe` and `ScrapeConfig` CRDs. #8102
+* [FEATURE] Add `scope` field to `AzureAD` remote write configuration. #8240
+* [FEATURE] Add `workloadIdentity` field to `AzureAD` remote write configuration. #7998
+* [FEATURE] Add support for PrometheusRule fields `groupLabels` and `queryOffset` in `ThanosRuler`. #8137
+* [FEATURE] Add `slackAppToken` and `slackAppUrl` fields to Alertmanager global config for Slack App support. #8238
+* [FEATURE] Add `incident.io` receiver support to `Alertmanager` config secret. #8190 #8245 #8228
+* [FEATURE] Add `Mattermost` receiver support to `Alertmanager` config secret. #8188
+* [FEATURE] Add `apiType` field to `Jira` receiver in `Alertmanager` config secret. #8218
+* [FEATURE] Add `timeout` field to `PagerDuty` receiver in `AlertmanagerConfig` CRD. #8162
+* [FEATURE] Add `timeout` field to `Slack` receiver in `AlertmanagerConfig` CRD. #8161
+* [ENHANCEMENT] Use `minReadySeconds` to set `--dispatch.start-delay` in `Alertmanager`. #8177 #8201
+* [ENHANCEMENT] Expose native histograms in operator metrics. #8194
+* [ENHANCEMENT] Add `NoSelectedResources` reason to status conditions. #8124
+* [ENHANCEMENT] Add `enableHttp2` and `followRedirects` fields to HTTP configuration for `Probe` CRD. #8112
+* [ENHANCEMENT] Add CEL validations for `DaemonSet` mode in `PrometheusAgent` CRD (requires the `PrometheusAgentDaemonSetFeature` featuregate). #7881
+* [ENHANCEMENT] Improve validation for `Pushover`, `PagerDuty` and `VictorOps` receivers in `AlertmanagerConfig` CRD. #8239 #8113 #8220
+* [ENHANCEMENT] Add `apiURL` validation for `WeChat`, `OpsGenie` and `Telegram` receivers in `AlertmanagerConfig` CRD. #8196 #8206 #8199
+* [ENHANCEMENT] Validate URL fields in `AlertmanagerConfig` receivers (`MSTeams`, `Webhook`). #8231 #8125
+* [ENHANCEMENT] Validate URL fields in `Alertmanager` configuration secret (`WeChat`, `Telegram`, `Pushover` receivers). #7977 #8233 #8232
+
 ## 0.87.1 / 2025-12-10
 
 * [BUGFIX] Fix the generated Alertmanager configuration for `html` and `monospace` fields of `pushoverConfig` receiver in AlertmanagerConfig CRD. #8153