vendor: update system-validators to v1.12.1

Includes an update to the cgroups validator to throw
an error if v1 is detected on the host.

Also includes a KubeletVersion field to determine
to show a warning or an error.

go.mod

@@ -115,7 +115,7 @@ require (
 	k8s.io/mount-utils v0.0.0
 	k8s.io/pod-security-admission v0.0.0
 	k8s.io/sample-apiserver v0.0.0
-	k8s.io/system-validators v1.11.1
+	k8s.io/system-validators v1.12.1
 	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730
 	sigs.k8s.io/knftables v0.0.17

go.sum

@@ -485,8 +485,8 @@ k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE=
 k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
-k8s.io/system-validators v1.11.1 h1:m/bX/WCgHTT+1YlwtTZfOFZ4NNx/LQJXPWfw3mGf+Lc=
-k8s.io/system-validators v1.11.1/go.mod h1:awfSS706v9R12VC7u7K89FKfqVy44G+E0L1A0FX9Wmw=
+k8s.io/system-validators v1.12.1 h1:AY1+COTLJN/Sj0w9QzH1H0yvyF3Kl6CguMnh32WlcUU=
+k8s.io/system-validators v1.12.1/go.mod h1:awfSS706v9R12VC7u7K89FKfqVy44G+E0L1A0FX9Wmw=
 k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
 k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 h1:jpcvIRr3GLoUoEKRkHKSmGjxb6lWwrBlJsXc+eUYQHM=

vendor/k8s.io/system-validators/validators/cgroup_validator_linux.go

@@ -26,13 +26,16 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+
+	"github.com/blang/semver/v4"
 )
 
 var _ Validator = &CgroupsValidator{}
 
 // CgroupsValidator validates cgroup configuration.
 type CgroupsValidator struct {
-	Reporter Reporter
+	Reporter       Reporter
+	KubeletVersion string
 }
 
 // Name is part of the system.Validator interface.
@@ -114,7 +117,22 @@ func (c *CgroupsValidator) Validate(spec SysSpec) (warns, errs []error) {
 		requiredCgroupSpec = spec.CgroupsV2
 		optionalCgroupSpec = spec.CgroupsV2Optional
 	} else {
-		warns = append(warns, errors.New("cgroups v1 support is in maintenance mode, please migrate to cgroups v2"))
+		v1DisabledInKubelet, err := c.isCgroupsV1DisabledInKubelet()
+		if err != nil {
+			return nil, []error{err}
+		}
+
+		v1Error := errors.New("cgroups v1 support is deprecated and will be removed in a future release. " +
+			"Please migrate to cgroups v2. To explicitly enable cgroups v1 support for kubelet v1.35 or newer, " +
+			"you must set the kubelet configuration option 'FailCgroupV1' to 'false'. You must also explicitly " +
+			"skip this validation. For more information, see https://git.k8s.io/enhancements/keps/sig-node/5573-remove-cgroup-v1")
+
+		if v1DisabledInKubelet {
+			errs = append(errs, v1Error)
+		} else {
+			warns = append(warns, v1Error)
+		}
+
 		subsystems, err = c.getCgroupV1Subsystems()
 		if err != nil {
 			return nil, []error{fmt.Errorf("failed to get cgroups v1 subsystems: %w", err)}
@@ -229,3 +247,24 @@ func checkCgroupV2Freeze(unifiedMountpoint string) (isCgroupfs bool, warn error)
 	isCgroupfs = true
 	return
 }
+
+// isCgroupsV1DisabledInKubelet checks the KubeletVersion and determines if that version
+// disabled cgroups v1 support by default:
+// - If the version is newer than 1.35 pre-release, return true.
+// - If the version is not defined or older than pre-release 1.35, return false.
+func (c *CgroupsValidator) isCgroupsV1DisabledInKubelet() (bool, error) {
+	if c.KubeletVersion == "" {
+		return false, nil
+	}
+
+	kv, err := semver.Parse(c.KubeletVersion)
+	if err != nil {
+		return false, fmt.Errorf("malformed KubeletVersion in CgroupsValidator: %w", err)
+	}
+
+	if kv.Compare(semver.MustParse("1.35.0-0")) > -1 {
+		return true, nil
+	}
+
+	return false, nil
+}

vendor/k8s.io/system-validators/validators/cgroup_validator_other.go

@@ -27,7 +27,8 @@ const mountsFilePath = ""
 
 // CgroupsValidator validates cgroup configuration.
 type CgroupsValidator struct {
-	Reporter Reporter
+	Reporter       Reporter
+	KubeletVersion string
 }
 
 // Validate is part of the system.Validator interface.

vendor/modules.txt

@@ -1163,7 +1163,7 @@ k8s.io/kube-openapi/pkg/validation/validate
 ## explicit; go 1.25.0
 # k8s.io/sample-apiserver v0.0.0 => ./staging/src/k8s.io/sample-apiserver
 ## explicit; go 1.25.0
-# k8s.io/system-validators v1.11.1
+# k8s.io/system-validators v1.12.1
 ## explicit; go 1.16
 k8s.io/system-validators/validators
 # k8s.io/utils v0.0.0-20250604170112-4c0f3b243397