Dependency updates (#785)

* chore: Update to go 1.26.1 Signed-off-by: Jonathan Stacks <jonstacks@users.noreply.github.com> * chore: Run 'go fix ./...' for go 1.26.1 Signed-off-by: Jonathan Stacks <jonstacks@users.noreply.github.com> * chore: Upgrade go modules Signed-off-by: Jonathan Stacks <jonstacks@users.noreply.github.com> * chore: Fix deprecations and linter warnings Signed-off-by: Jonathan Stacks <jonstacks@users.noreply.github.com> --------- Signed-off-by: Jonathan Stacks <jonstacks@users.noreply.github.com>
2026-05-17 16:50:44 +00:00 · 2026-03-23 11:50:43 -05:00
parent d3072e5761
commit aa1781d348
69 changed files with 596 additions and 595 deletions
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM --platform=$BUILDPLATFORM golang:1.25.7 AS builder
+FROM --platform=$BUILDPLATFORM golang:1.26.1 AS builder
 WORKDIR /workspace
 # Copy the Go Modules manifests
@@ -205,7 +205,7 @@ func runAgentController(_ context.Context, opts agentManagerOpts) error {
 		Client:                     mgr.GetClient(),
 		Log:                        ctrl.Log.WithName("controllers").WithName("agentendpoint"),
 		Scheme:                     mgr.GetScheme(),
-		Recorder:                   mgr.GetEventRecorderFor("agentendpoint-controller"),
+		Recorder:                   mgr.GetEventRecorder("agentendpoint-controller"),
 		AgentDriver:                ad,
 		DefaultDomainReclaimPolicy: defaultDomainReclaimPolicy,
 		ControllerLabels:           labels.NewControllerLabelValues(opts.namespace, opts.managerName),
@@ -35,7 +35,6 @@ import (
 	// "main", they are all subcommands
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 	"k8s.io/client-go/rest"
 	"k8s.io/utils/ptr"
 	"github.com/spf13/cobra"
 	"k8s.io/apimachinery/pkg/types"
@@ -343,7 +342,7 @@ func runNormalMode(ctx context.Context, opts apiManagerOpts, k8sClient client.Cl
 	// - orchestrator is passed to KubernetesOperatorReconciler for executing drain
 	drainOrchestrator := drain.NewOrchestrator(drain.OrchestratorConfig{
 		Client:         mgr.GetClient(),
-		Recorder:       mgr.GetEventRecorderFor("drain-orchestrator"),
+		Recorder:       mgr.GetEventRecorder("drain-orchestrator"),
 		Log:            ctrl.Log.WithName("drain"),
 		K8sOpNamespace: opts.namespace,
 		K8sOpName:      opts.releaseName,
@@ -409,7 +408,7 @@ func runNormalMode(ctx context.Context, opts apiManagerOpts, k8sClient client.Cl
 		Client:            mgr.GetClient(),
 		Log:               ctrl.Log.WithName("controllers").WithName("KubernetesOperator"),
 		Scheme:            mgr.GetScheme(),
-		Recorder:          mgr.GetEventRecorderFor("kubernetes-operator-controller"),
+		Recorder:          mgr.GetEventRecorder("kubernetes-operator-controller"),
 		K8sOpNamespace:    opts.namespace,
 		K8sOpName:         opts.releaseName,
 		NgrokClientset:    ngrokClientset,
@@ -490,7 +489,7 @@ func loadNgrokClientset(ctx context.Context, opts apiManagerOpts) (ngrokapi.Clie
 	// by making a dummy request to list API keys
 	// and checking for errors
 	cApiKeys := api_keys.NewClient(ngrokClientConfig)
-	cIter := cApiKeys.List(&ngrok.Paging{Limit: ptr.To("1")})
+	cIter := cApiKeys.List(&ngrok.Paging{Limit: new("1")})
 	cIter.Next(ctx)
 	if cIter.Err() != nil {
 		return nil, fmt.Errorf("Unable to verify API Key: %w", cIter.Err())
@@ -510,7 +509,7 @@ func getK8sResourceDriver(ctx context.Context, mgr manager.Manager, options apiM
 		managerdriver.WithClusterDomain(options.clusterDomain),
 		managerdriver.WithDisableGatewayReferenceGrants(options.disableGatewayReferenceGrants),
 		managerdriver.WithDefaultDomainReclaimPolicy(defaultDomainReclaimPolicy),
-		managerdriver.WithEventRecorder(mgr.GetEventRecorderFor("k8s-resource-driver")),
+		managerdriver.WithEventRecorder(mgr.GetEventRecorder("k8s-resource-driver")),
 		managerdriver.WithDrainState(drainState),
 	}
@@ -561,7 +560,7 @@ func enableIngressFeatureSet(_ context.Context, opts apiManagerOpts, mgr ctrl.Ma
 		Client:     mgr.GetClient(),
 		Log:        ctrl.Log.WithName("controllers").WithName("ingress"),
 		Scheme:     mgr.GetScheme(),
-		Recorder:   mgr.GetEventRecorderFor("ingress-controller"),
+		Recorder:   mgr.GetEventRecorder("ingress-controller"),
 		Namespace:  opts.namespace,
 		Driver:     driver,
 		DrainState: drainState,
@@ -573,7 +572,7 @@ func enableIngressFeatureSet(_ context.Context, opts apiManagerOpts, mgr ctrl.Ma
 		Client:           mgr.GetClient(),
 		Log:              ctrl.Log.WithName("controllers").WithName("service"),
 		Scheme:           mgr.GetScheme(),
-		Recorder:         mgr.GetEventRecorderFor("service-controller"),
+		Recorder:         mgr.GetEventRecorder("service-controller"),
 		ControllerLabels: controllerLabels,
 		ClusterDomain:    opts.clusterDomain,
 		// TODO(stacks): Once we have a way to support unqualified tcp addresses(i.e. 'tcp://') in the Cloud & Agent Endpoint CRs,
@@ -589,7 +588,7 @@ func enableIngressFeatureSet(_ context.Context, opts apiManagerOpts, mgr ctrl.Ma
 		Client:        mgr.GetClient(),
 		Log:           ctrl.Log.WithName("controllers").WithName("domain"),
 		Scheme:        mgr.GetScheme(),
-		Recorder:      mgr.GetEventRecorderFor("domain-controller"),
+		Recorder:      mgr.GetEventRecorder("domain-controller"),
 		DomainsClient: ngrokClientset.Domains(),
 		DrainState:    drainState,
 	}).SetupWithManager(mgr); err != nil {
@@ -601,7 +600,7 @@ func enableIngressFeatureSet(_ context.Context, opts apiManagerOpts, mgr ctrl.Ma
 		Client:              mgr.GetClient(),
 		Log:                 ctrl.Log.WithName("controllers").WithName("ip-policy"),
 		Scheme:              mgr.GetScheme(),
-		Recorder:            mgr.GetEventRecorderFor("ip-policy-controller"),
+		Recorder:            mgr.GetEventRecorder("ip-policy-controller"),
 		IPPoliciesClient:    ngrokClientset.IPPolicies(),
 		IPPolicyRulesClient: ngrokClientset.IPPolicyRules(),
 		DrainState:          drainState,
@@ -614,7 +613,7 @@ func enableIngressFeatureSet(_ context.Context, opts apiManagerOpts, mgr ctrl.Ma
 		Client:   mgr.GetClient(),
 		Log:      ctrl.Log.WithName("controllers").WithName("traffic-policy"),
 		Scheme:   mgr.GetScheme(),
-		Recorder: mgr.GetEventRecorderFor("policy-controller"),
+		Recorder: mgr.GetEventRecorder("policy-controller"),
 		Driver:   driver,
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "TrafficPolicy")
@@ -625,9 +624,9 @@ func enableIngressFeatureSet(_ context.Context, opts apiManagerOpts, mgr ctrl.Ma
 		Client:                     mgr.GetClient(),
 		Log:                        ctrl.Log.WithName("controllers").WithName("cloud-endpoint"),
 		Scheme:                     mgr.GetScheme(),
-		Recorder:                   mgr.GetEventRecorderFor("cloud-endpoint-controller"),
+		Recorder:                   mgr.GetEventRecorder("cloud-endpoint-controller"),
 		NgrokClientset:             ngrokClientset,
-		DefaultDomainReclaimPolicy: ptr.To(defaultDomainReclaimPolicy),
+		DefaultDomainReclaimPolicy: new(defaultDomainReclaimPolicy),
 		ControllerLabels:           controllerLabels,
 		DrainState:                 drainState,
 	}).SetupWithManager(mgr); err != nil {
@@ -644,7 +643,7 @@ func enableGatewayFeatureSet(_ context.Context, opts apiManagerOpts, mgr ctrl.Ma
 		Client:   mgr.GetClient(),
 		Log:      ctrl.Log.WithName("controllers").WithName("GatewayClass"),
 		Scheme:   mgr.GetScheme(),
-		Recorder: mgr.GetEventRecorderFor("gateway-class"),
+		Recorder: mgr.GetEventRecorder("gateway-class"),
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "GatewayClass")
 		os.Exit(1)
@@ -654,7 +653,7 @@ func enableGatewayFeatureSet(_ context.Context, opts apiManagerOpts, mgr ctrl.Ma
 		Client:     mgr.GetClient(),
 		Log:        ctrl.Log.WithName("controllers").WithName("Gateway"),
 		Scheme:     mgr.GetScheme(),
-		Recorder:   mgr.GetEventRecorderFor("gateway-controller"),
+		Recorder:   mgr.GetEventRecorder("gateway-controller"),
 		Driver:     driver,
 		DrainState: drainState,
 	}).SetupWithManager(mgr); err != nil {
@@ -666,7 +665,7 @@ func enableGatewayFeatureSet(_ context.Context, opts apiManagerOpts, mgr ctrl.Ma
 		Client:     mgr.GetClient(),
 		Log:        ctrl.Log.WithName("controllers").WithName("Gateway"),
 		Scheme:     mgr.GetScheme(),
-		Recorder:   mgr.GetEventRecorderFor("gateway-controller"),
+		Recorder:   mgr.GetEventRecorder("gateway-controller"),
 		Driver:     driver,
 		DrainState: drainState,
 	}).SetupWithManager(mgr); err != nil {
@@ -679,7 +678,7 @@ func enableGatewayFeatureSet(_ context.Context, opts apiManagerOpts, mgr ctrl.Ma
 			Client:     mgr.GetClient(),
 			Log:        ctrl.Log.WithName("controllers").WithName("TCPRoute"),
 			Scheme:     mgr.GetScheme(),
-			Recorder:   mgr.GetEventRecorderFor("tcp-route"),
+			Recorder:   mgr.GetEventRecorder("tcp-route"),
 			Driver:     driver,
 			DrainState: drainState,
 		}).SetupWithManager(mgr); err != nil {
@@ -693,7 +692,7 @@ func enableGatewayFeatureSet(_ context.Context, opts apiManagerOpts, mgr ctrl.Ma
 			Client:     mgr.GetClient(),
 			Log:        ctrl.Log.WithName("controllers").WithName("TLSRoute"),
 			Scheme:     mgr.GetScheme(),
-			Recorder:   mgr.GetEventRecorderFor("tls-route"),
+			Recorder:   mgr.GetEventRecorder("tls-route"),
 			Driver:     driver,
 			DrainState: drainState,
 		}).SetupWithManager(mgr); err != nil {
@@ -707,7 +706,7 @@ func enableGatewayFeatureSet(_ context.Context, opts apiManagerOpts, mgr ctrl.Ma
 		Client:   mgr.GetClient(),
 		Log:      ctrl.Log.WithName("controllers").WithName("Gateway"),
 		Scheme:   mgr.GetScheme(),
-		Recorder: mgr.GetEventRecorderFor("gateway-controller"),
+		Recorder: mgr.GetEventRecorder("gateway-controller"),
 		Driver:   driver,
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "Namespace")
@@ -720,7 +719,7 @@ func enableGatewayFeatureSet(_ context.Context, opts apiManagerOpts, mgr ctrl.Ma
 			Client:   mgr.GetClient(),
 			Log:      ctrl.Log.WithName("controllers").WithName("Gateway"),
 			Scheme:   mgr.GetScheme(),
-			Recorder: mgr.GetEventRecorderFor("gateway-controller"),
+			Recorder: mgr.GetEventRecorder("gateway-controller"),
 			Driver:   driver,
 		}).SetupWithManager(mgr); err != nil {
 			setupLog.Error(err, "unable to create controller", "controller", "ReferenceGrant")
@@ -750,7 +749,7 @@ func enableBindingsFeatureSet(_ context.Context, opts apiManagerOpts, mgr ctrl.M
 		Client:        mgr.GetClient(),
 		Scheme:        mgr.GetScheme(),
 		Log:           ctrl.Log.WithName("controllers").WithName("BoundEndpoint"),
-		Recorder:      mgr.GetEventRecorderFor("bindings-controller"),
+		Recorder:      mgr.GetEventRecorder("bindings-controller"),
 		ClusterDomain: opts.clusterDomain,
 		UpstreamServiceLabelSelector: map[string]string{
 			"app.kubernetes.io/component": "bindings-forwarder",
@@ -765,7 +764,7 @@ func enableBindingsFeatureSet(_ context.Context, opts apiManagerOpts, mgr ctrl.M
 	if err := mgr.Add(&bindingscontroller.BoundEndpointPoller{
 		Client:                       mgr.GetClient(),
 		Log:                          ctrl.Log.WithName("controllers").WithName("BoundEndpointPoller"),
-		Recorder:                     mgr.GetEventRecorderFor("endpoint-binding-poller"),
+		Recorder:                     mgr.GetEventRecorder("endpoint-binding-poller"),
 		Namespace:                    opts.namespace,
 		KubernetesOperatorConfigName: opts.releaseName,
 		TargetServiceAnnotations:     targetServiceAnnotations,
@@ -148,7 +148,7 @@ func runController(_ context.Context, opts bindingsForwarderManagerOpts) error {
 		Client:                 mgr.GetClient(),
 		Log:                    ctrl.Log.WithName("controllers").WithName("bindings-forwarder"),
 		Scheme:                 mgr.GetScheme(),
-		Recorder:               mgr.GetEventRecorderFor("bindings-forwarder-controller"),
+		Recorder:               mgr.GetEventRecorder("bindings-forwarder-controller"),
 		BindingsDriver:         bd,
 		KubernetesOperatorName: opts.releaseName,
 		RootCAs:                certPool,
@@ -20,11 +20,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1771892004,
+        "lastModified": 1773628058,
-        "narHash": "sha256-V96pa9awm6hjnf8yGJeoC4uOirYDEPsaBbuU0stROQI=",
+        "narHash": "sha256-hpXH0z3K9xv0fHaje136KY872VT2T5uwxtezlAskQgY=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "5e4522be6bdf1600682a6f383434b057b2d77a37",
+        "rev": "f8573b9c935cfaa162dd62cc9e75ae2db86f85df",
        "type": "github"
      },
      "original": {
@@ -80,7 +80,7 @@
            with pkgs;
            [
              bashInteractive
-              go
+              go_1_26
              go-tools
              golangci-lint
              gotools
@@ -1,105 +1,114 @@
 module github.com/ngrok/ngrok-operator
-go 1.25.7
+go 1.26.1
 require (
-	github.com/docker/docker v28.3.3+incompatible
+	github.com/docker/docker v28.5.2+incompatible
-	github.com/fsnotify/fsnotify v1.7.0
+	github.com/fsnotify/fsnotify v1.9.0
-	github.com/go-logr/logr v1.4.2
+	github.com/go-logr/logr v1.4.3
 	github.com/gobwas/glob v0.2.3
 	github.com/google/uuid v1.6.0
 	github.com/ngrok/ngrok-api-go/v7 v7.8.0
-	github.com/onsi/ginkgo/v2 v2.23.4
+	github.com/onsi/ginkgo/v2 v2.28.0
-	github.com/onsi/gomega v1.36.3
+	github.com/onsi/gomega v1.39.1
 	github.com/segmentio/ksuid v1.0.4
-	github.com/spf13/cobra v1.8.1
+	github.com/spf13/cobra v1.10.2
-	github.com/stretchr/testify v1.10.0
+	github.com/stretchr/testify v1.11.1
 	go.uber.org/mock v0.6.0
-	go.uber.org/zap v1.27.0
+	go.uber.org/zap v1.27.1
 	golang.ngrok.com/ngrok/v2 v2.1.1
-	golang.org/x/sync v0.16.0
+	golang.org/x/sync v0.20.0
-	google.golang.org/protobuf v1.36.5
+	google.golang.org/protobuf v1.36.11
 	gopkg.in/yaml.v2 v2.4.0
-	k8s.io/api v0.32.1
+	k8s.io/api v0.35.3
-	k8s.io/apimachinery v0.32.1
+	k8s.io/apimachinery v0.35.3
-	k8s.io/client-go v0.32.1
+	k8s.io/client-go v0.35.3
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
+	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2
-	sigs.k8s.io/controller-runtime v0.20.2
+	sigs.k8s.io/controller-runtime v0.23.3
 	sigs.k8s.io/gateway-api v1.2.1
 )
 require (
-	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
+	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/emicklei/go-restful/v3 v3.12.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
 	github.com/evanphx/json-patch v5.7.0+incompatible // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
-	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonpointer v0.22.5 // indirect
-	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.21.5 // indirect
-	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/go-openapi/swag v0.25.5 // indirect
 	github.com/go-openapi/swag/cmdutils v0.25.5 // indirect
 	github.com/go-openapi/swag/conv v0.25.5 // indirect
 	github.com/go-openapi/swag/fileutils v0.25.5 // indirect
 	github.com/go-openapi/swag/jsonname v0.25.5 // indirect
 	github.com/go-openapi/swag/jsonutils v0.25.5 // indirect
 	github.com/go-openapi/swag/loading v0.25.5 // indirect
 	github.com/go-openapi/swag/mangling v0.25.5 // indirect
 	github.com/go-openapi/swag/netutils v0.25.5 // indirect
 	github.com/go-openapi/swag/stringutils v0.25.5 // indirect
 	github.com/go-openapi/swag/typeutils v0.25.5 // indirect
 	github.com/go-openapi/swag/yamlutils v0.25.5 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/gnostic v0.6.9 // indirect
-	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/google/gnostic-models v0.7.1 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 // indirect
 	github.com/google/pprof v0.0.0-20250423184734-337e5dd93bb4 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/jpillora/backoff v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-runewidth v0.0.14 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/olekukonko/tablewriter v0.0.5 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_golang v1.19.1 // indirect
+	github.com/prometheus/client_golang v1.23.2 // indirect
-	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.55.0 // indirect
+	github.com/prometheus/common v0.67.5 // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
+	github.com/prometheus/procfs v0.20.1 // indirect
 	github.com/rivo/uniseg v0.4.3 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xlab/treeprint v1.1.0 // indirect
 	go.starlark.net v0.0.0-20230103143115-09991d3a103e // indirect
 	go.uber.org/automaxprocs v1.6.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.ngrok.com/muxado/v2 v2.0.1 // indirect
-	golang.org/x/mod v0.27.0 // indirect
+	golang.org/x/mod v0.33.0 // indirect
-	golang.org/x/net v0.43.0 // indirect
+	golang.org/x/net v0.52.0 // indirect
-	golang.org/x/oauth2 v0.27.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sys v0.35.0 // indirect
+	golang.org/x/sys v0.42.0 // indirect
-	golang.org/x/term v0.34.0 // indirect
+	golang.org/x/term v0.41.0 // indirect
-	golang.org/x/text v0.28.0 // indirect
+	golang.org/x/text v0.35.0 // indirect
-	golang.org/x/time v0.7.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
-	golang.org/x/tools v0.36.0 // indirect
+	golang.org/x/tools v0.42.0 // indirect
-	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
+	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
-	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/apiextensions-apiserver v0.32.1 // indirect
+	k8s.io/apiextensions-apiserver v0.35.3 // indirect
-	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/klog/v2 v2.140.0 // indirect
-	k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f // indirect
+	k8s.io/kube-openapi v0.0.0-20260319004828-5883c5ee87b9 // indirect
-	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/kustomize/api v0.12.1 // indirect
 	sigs.k8s.io/kustomize/cmd/config v0.10.9 // indirect
 	sigs.k8s.io/kustomize/kustomize/v3 v3.10.0 // indirect
 	sigs.k8s.io/kustomize/kyaml v0.13.10 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
 tool (
@@ -2,6 +2,8 @@ cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMT
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 github.com/360EntSecGroup-Skylar/excelize v1.4.1/go.mod h1:vnax29X2usfl7HHkBrX5EvSCJcmH3dT9luvxzu8iGAE=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
 github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/OpenPeeDeeP/depguard v1.0.1/go.mod h1:xsIw86fROiiwelg+jB2uM9PiKihMMmUx/1V+TNhjQvM=
 github.com/PuerkitoBio/goquery v1.5.0/go.mod h1:qD2PgZ9lccMbQlc7eEOjaeRlFQON7xY8kdmcsrnKqMg=
@@ -18,8 +20,6 @@ github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kd
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
 github.com/asaskevich/govalidator v0.0.0-20180720115003-f9ffefc3facf/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d h1:Byv0BzEl3/e6D5CLfI0j/7hiIEtvGVFPCZ7Ei2oq8iQ=
 github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -46,7 +46,7 @@ github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7
 github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
 github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
 github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
-github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -55,14 +55,14 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
-github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI=
+github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM=
-github.com/docker/docker v28.3.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-units v0.3.3/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
 github.com/dustmop/soup v1.1.2-0.20190516214245-38228baa104e/go.mod h1:CgNC6SGbT+Xb8wGGvzilttZL1mc5sQ/5KkcxsZttMIk=
-github.com/emicklei/go-restful/v3 v3.12.0 h1:y2DdzBAURM29NFF94q6RaY4vjIH1rtwDapwQtU84iWk=
+github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
-github.com/emicklei/go-restful/v3 v3.12.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
@@ -77,11 +77,17 @@ github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/X
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/flowstack/go-jsonschema v0.1.1/go.mod h1:yL7fNggx1o8rm9RlgXv7hTBWxdBM0rVwpMwimd3F3N0=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
-github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
-github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/gkampitakis/ciinfo v0.3.2 h1:JcuOPk8ZU7nZQjdUhctuhQofk7BGHuIy0c9Ez8BNhXs=
 github.com/gkampitakis/ciinfo v0.3.2/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo=
 github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZdC4M=
 github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6OPYerdAAS9tk=
 github.com/gkampitakis/go-snaps v0.5.15 h1:amyJrvM1D33cPHwVrjo9jQxX8g/7E2wYdZ+01KS3zGE=
 github.com/gkampitakis/go-snaps v0.5.15/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc=
 github.com/globalsign/mgo v0.0.0-20180905125535-1ca0a4f7cbcb/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
 github.com/globalsign/mgo v0.0.0-20181015135952-eeefdecb41b8/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
 github.com/go-critic/go-critic v0.3.5-0.20190904082202-d79a9f0c64db/go.mod h1:+sE8vrLDS2M0pZkBk0wy6+nLdKexVDrl/jBqQOTDThA=
@@ -92,8 +98,8 @@ github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2
 github.com/go-lintpack/lintpack v0.5.2/go.mod h1:NwZuYi2nUHho8XEIZ6SIxihrnPoqBTDqfpXvXAN0sXM=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
 github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
 github.com/go-ole/go-ole v1.2.1/go.mod h1:7FAglXiTm7HKlQRDeOQ6ZNUHidzCWXuZWq/1dTyBNF8=
@@ -109,14 +115,14 @@ github.com/go-openapi/jsonpointer v0.17.0/go.mod h1:cOnomiV+CVVwFLk0A/MExoFMjwds
 github.com/go-openapi/jsonpointer v0.18.0/go.mod h1:cOnomiV+CVVwFLk0A/MExoFMjwdsUdVpsRhURCKh+3M=
 github.com/go-openapi/jsonpointer v0.19.2/go.mod h1:3akKfEdA7DF1sugOqz1dVQHBcuDBPKZGEoHC/NkiQRg=
 github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.22.5 h1:8on/0Yp4uTb9f4XvTrM2+1CPrV05QPZXu+rvu2o9jcA=
-github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/jsonpointer v0.22.5/go.mod h1:gyUR3sCvGSWchA2sUBJGluYMbe1zazrYWIkWPjjMUY0=
 github.com/go-openapi/jsonreference v0.17.0/go.mod h1:g4xxGn04lDIRh0GJb5QlpE3HfopLOL6uZrK/VgnsK9I=
 github.com/go-openapi/jsonreference v0.18.0/go.mod h1:g4xxGn04lDIRh0GJb5QlpE3HfopLOL6uZrK/VgnsK9I=
 github.com/go-openapi/jsonreference v0.19.2/go.mod h1:jMjeRr2HHw6nAVajTXJ4eiUwohSTlpa0o73RUL1owJc=
 github.com/go-openapi/jsonreference v0.19.3/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8=
-github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
+github.com/go-openapi/jsonreference v0.21.5 h1:6uCGVXU/aNF13AQNggxfysJ+5ZcU4nEAe+pJyVWRdiE=
-github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
+github.com/go-openapi/jsonreference v0.21.5/go.mod h1:u25Bw85sX4E2jzFodh1FOKMTZLcfifd1Q+iKKOUxExw=
 github.com/go-openapi/loads v0.17.0/go.mod h1:72tmFy5wsWx89uEVddd0RjRWPZm92WRLhf7AC+0+OOU=
 github.com/go-openapi/loads v0.18.0/go.mod h1:72tmFy5wsWx89uEVddd0RjRWPZm92WRLhf7AC+0+OOU=
 github.com/go-openapi/loads v0.19.0/go.mod h1:72tmFy5wsWx89uEVddd0RjRWPZm92WRLhf7AC+0+OOU=
@@ -139,8 +145,36 @@ github.com/go-openapi/swag v0.17.0/go.mod h1:AByQ+nYG6gQg71GINrmuDXCPWdL640yX49/
 github.com/go-openapi/swag v0.18.0/go.mod h1:AByQ+nYG6gQg71GINrmuDXCPWdL640yX49/kXLo40Tg=
 github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
 github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
-github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
+github.com/go-openapi/swag v0.25.5 h1:pNkwbUEeGwMtcgxDr+2GBPAk4kT+kJ+AaB+TMKAg+TU=
-github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
+github.com/go-openapi/swag v0.25.5/go.mod h1:B3RT6l8q7X803JRxa2e59tHOiZlX1t8viplOcs9CwTA=
 github.com/go-openapi/swag/cmdutils v0.25.5 h1:yh5hHrpgsw4NwM9KAEtaDTXILYzdXh/I8Whhx9hKj7c=
 github.com/go-openapi/swag/cmdutils v0.25.5/go.mod h1:pdae/AFo6WxLl5L0rq87eRzVPm/XRHM3MoYgRMvG4A0=
 github.com/go-openapi/swag/conv v0.25.5 h1:wAXBYEXJjoKwE5+vc9YHhpQOFj2JYBMF2DUi+tGu97g=
 github.com/go-openapi/swag/conv v0.25.5/go.mod h1:CuJ1eWvh1c4ORKx7unQnFGyvBbNlRKbnRyAvDvzWA4k=
 github.com/go-openapi/swag/fileutils v0.25.5 h1:B6JTdOcs2c0dBIs9HnkyTW+5gC+8NIhVBUwERkFhMWk=
 github.com/go-openapi/swag/fileutils v0.25.5/go.mod h1:V3cT9UdMQIaH4WiTrUc9EPtVA4txS0TOmRURmhGF4kc=
 github.com/go-openapi/swag/jsonname v0.25.5 h1:8p150i44rv/Drip4vWI3kGi9+4W9TdI3US3uUYSFhSo=
 github.com/go-openapi/swag/jsonname v0.25.5/go.mod h1:jNqqikyiAK56uS7n8sLkdaNY/uq6+D2m2LANat09pKU=
 github.com/go-openapi/swag/jsonutils v0.25.5 h1:XUZF8awQr75MXeC+/iaw5usY/iM7nXPDwdG3Jbl9vYo=
 github.com/go-openapi/swag/jsonutils v0.25.5/go.mod h1:48FXUaz8YsDAA9s5AnaUvAmry1UcLcNVWUjY42XkrN4=
 github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.5 h1:SX6sE4FrGb4sEnnxbFL/25yZBb5Hcg1inLeErd86Y1U=
 github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.5/go.mod h1:/2KvOTrKWjVA5Xli3DZWdMCZDzz3uV/T7bXwrKWPquo=
 github.com/go-openapi/swag/loading v0.25.5 h1:odQ/umlIZ1ZVRteI6ckSrvP6e2w9UTF5qgNdemJHjuU=
 github.com/go-openapi/swag/loading v0.25.5/go.mod h1:I8A8RaaQ4DApxhPSWLNYWh9NvmX2YKMoB9nwvv6oW6g=
 github.com/go-openapi/swag/mangling v0.25.5 h1:hyrnvbQRS7vKePQPHHDso+k6CGn5ZBs5232UqWZmJZw=
 github.com/go-openapi/swag/mangling v0.25.5/go.mod h1:6hadXM/o312N/h98RwByLg088U61TPGiltQn71Iw0NY=
 github.com/go-openapi/swag/netutils v0.25.5 h1:LZq2Xc2QI8+7838elRAaPCeqJnHODfSyOa7ZGfxDKlU=
 github.com/go-openapi/swag/netutils v0.25.5/go.mod h1:lHbtmj4m57APG/8H7ZcMMSWzNqIQcu0RFiXrPUara14=
 github.com/go-openapi/swag/stringutils v0.25.5 h1:NVkoDOA8YBgtAR/zvCx5rhJKtZF3IzXcDdwOsYzrB6M=
 github.com/go-openapi/swag/stringutils v0.25.5/go.mod h1:PKK8EZdu4QJq8iezt17HM8RXnLAzY7gW0O1KKarrZII=
 github.com/go-openapi/swag/typeutils v0.25.5 h1:EFJ+PCga2HfHGdo8s8VJXEVbeXRCYwzzr9u4rJk7L7E=
 github.com/go-openapi/swag/typeutils v0.25.5/go.mod h1:itmFmScAYE1bSD8C4rS0W+0InZUBrB2xSPbWt6DLGuc=
 github.com/go-openapi/swag/yamlutils v0.25.5 h1:kASCIS+oIeoc55j28T4o8KwlV2S4ZLPT6G0iq2SSbVQ=
 github.com/go-openapi/swag/yamlutils v0.25.5/go.mod h1:Gek1/SjjfbYvM+Iq4QGwa/2lEXde9n2j4a3wI3pNuOQ=
 github.com/go-openapi/testify/enable/yaml/v2 v2.4.0 h1:7SgOMTvJkM8yWrQlU8Jm18VeDPuAvB/xWrdxFJkoFag=
 github.com/go-openapi/testify/enable/yaml/v2 v2.4.0/go.mod h1:14iV8jyyQlinc9StD7w1xVPW3CO3q1Gj04Jy//Kw4VM=
 github.com/go-openapi/testify/v2 v2.4.0 h1:8nsPrHVCWkQ4p8h1EsRVymA2XABB4OT40gcvAu+voFM=
 github.com/go-openapi/testify/v2 v2.4.0/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
 github.com/go-openapi/validate v0.18.0/go.mod h1:Uh4HdOzKt19xGIGm1qHf/ofbX1YQ4Y+MYsct2VUrAJ4=
 github.com/go-openapi/validate v0.19.2/go.mod h1:1tRCw7m3jtI8eNWEEliiAqUIcBztB2KDnRCRMUi7GTA=
 github.com/go-openapi/validate v0.19.8/go.mod h1:8DJv2CVJQ6kGNpFW6eV9N3JviE1C85nY1c2z52x1Gk4=
@@ -163,11 +197,11 @@ github.com/go-toolsmith/typep v1.0.0/go.mod h1:JSQCQMUPdRlMZFswiq3TGpNp1GMktqkR2
 github.com/gobuffalo/here v0.6.0/go.mod h1:wAG085dHOYqUpf+Ap+WOdrPTp5IYcDAs/x7PLa8Y5fM=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
 github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
 github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/gofrs/flock v0.0.0-20190320160742-5135e617513b/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
@@ -207,8 +241,8 @@ github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/google/gnostic v0.6.9 h1:ZK/5VhkoX835RikCHpSUJV9a+S3e1zLh59YnyWeBW+0=
 github.com/google/gnostic v0.6.9/go.mod h1:Nm8234We1lq6iB9OmlgNv3nH91XLLVZHCDayfA3xq+E=
-github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
+github.com/google/gnostic-models v0.7.1 h1:SisTfuFKJSKM5CPZkffwi6coztzzeYUhc3v4yxLWH8c=
-github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
+github.com/google/gnostic-models v0.7.1/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
@@ -217,14 +251,13 @@ github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20250423184734-337e5dd93bb4 h1:gD0vax+4I+mAj+jEChEf25Ia07Jq7kYOFO5PPhAxFl4=
+github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc=
-github.com/google/pprof v0.0.0-20250423184734-337e5dd93bb4/go.mod h1:5hDyRhoBCxViHszMt12TnOpEI4VVi+U8Gm9iphldiMA=
+github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
@@ -255,18 +288,19 @@ github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANyt
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
-github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/joshdk/go-junit v1.0.0 h1:S86cUKIdwBHWwA6xCmFlf3RTLfVXYQfvanM5Uh+K6GE=
-github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/joshdk/go-junit v1.0.0/go.mod h1:TiiV0PqkaNfFXjEiyjWM3XXrhVyCa1K4Zfga6W52ung=
 github.com/jpillora/backoff v1.0.0 h1:uvFg412JmmHBHw7iwprIxkPMI+sGQ4kzOWsMeHnm2EA=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.4.0/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/klauspost/cpuid v0.0.0-20180405133222-e7e905edc00e/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
@@ -281,6 +315,8 @@ github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/logrusorgru/aurora v0.0.0-20181002194514-a7b3b318ed4e/go.mod h1:7rIyQOR62GCctdiQpZ/zOJlFyk6y+94wXzv6RNZgaR4=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
@@ -289,9 +325,9 @@ github.com/mailru/easyjson v0.0.0-20190312143242-1de009706dbe/go.mod h1:C1wdFJiN
 github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7ldAVICs=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/markbates/pkger v0.17.1/go.mod h1:0JoVlrol20BSywW79rN3kdFFsE5xYM+rSCQDXbLhiuI=
 github.com/maruel/natural v1.1.1 h1:Hja7XhhmvEFhcByqDoHz9QZbkWey+COd9xWfCfn1ioo=
 github.com/maruel/natural v1.1.1/go.mod h1:v+Rfd79xlw1AgVBjbO0BEQmptqb5HvL/k9GRHB7ZKEg=
 github.com/matoous/godox v0.0.0-20190911065817-5d6d842e92eb/go.mod h1:1BELzlh859Sh1c6+90blK8lbYy0kwQf1bYlBhBysy1s=
 github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
@@ -301,6 +337,8 @@ github.com/mattn/go-runewidth v0.0.14 h1:+xnbZSEeDbOIg5/mE6JF0w6n9duR1l3/WmbinWV
 github.com/mattn/go-runewidth v0.0.14/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/goveralls v0.0.2/go.mod h1:8d1ZMHsd7fW6IRPKQh46F2WRpyib5/X4FOpevwGNQEw=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mfridman/tparse v0.18.0 h1:wh6dzOKaIwkUGyKgOntDW4liXSo37qg5AXbIhkMV3vE=
 github.com/mfridman/tparse v0.18.0/go.mod h1:gEvqZTuCgEhPbYk/2lS3Kcxg1GmTxxU7kTC8DvP0i/A=
 github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-ps v0.0.0-20190716172923-621e5597135b/go.mod h1:r1VsdOzOPt1ZSrGZWFoNhsAedKnEd6r9Np1+5blZCWk=
@@ -309,8 +347,9 @@ github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
 github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
@@ -328,11 +367,11 @@ github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo/v2 v2.23.4 h1:ktYTpKJAVZnDT4VjxSbiBenUjmlL/5QkBEocaWXiQus=
+github.com/onsi/ginkgo/v2 v2.28.0 h1:Rrf+lVLmtlBIKv6KrIGJCjyY8N36vDVcutbGJkyqjJc=
-github.com/onsi/ginkgo/v2 v2.23.4/go.mod h1:Bt66ApGPBFzHyR+JO10Zbt0Gsp4uWxu5mIOTusL46e8=
+github.com/onsi/ginkgo/v2 v2.28.0/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
 github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
-github.com/onsi/gomega v1.36.3 h1:hID7cr8t3Wp26+cYnfcjR6HpJ00fdogN6dqZ1t6IylU=
+github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
-github.com/onsi/gomega v1.36.3/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
+github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
 github.com/paulmach/orb v0.1.3/go.mod h1:VFlX/8C+IQ1p6FTRRKzKoOPJnvEtA5G0Veuqwbu//Vk=
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
@@ -343,25 +382,23 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
 github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
-github.com/prometheus/client_golang v1.19.1 h1:wZWJDwK+NameRJuPGDhlnFgx8e8HN3XHQeLaYJFJBOE=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
-github.com/prometheus/client_golang v1.19.1/go.mod h1:mP78NwGzrVks5S2H6ab8+ZZGJLZUq1hoULYBAYBw1Ho=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
-github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
 github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
-github.com/prometheus/common v0.55.0 h1:KEi6DK7lXW/m7Ig5i47x0vRzuBsHuvJdi5ee6Y3G1dc=
+github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
-github.com/prometheus/common v0.55.0/go.mod h1:2SECS4xJG1kd8XF9IcM1gMX6510RAEL65zxzNImwdc8=
+github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
-github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
+github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
-github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
+github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
 github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
 github.com/qri-io/starlib v0.4.2-0.20200213133954-ff2e8cd5ef8d/go.mod h1:7DPO4domFU579Ga6E61sB9VFNaniPVwJP5C4bBCu3wA=
 github.com/quasilyte/go-consistent v0.0.0-20190521200055-c6f3937de18c/go.mod h1:5STLWrekHfjyYwxBRVRXNOSewLJ3PWfDJd1VyTS21fI=
@@ -371,8 +408,8 @@ github.com/rivo/uniseg v0.4.3/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUc
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
@@ -396,12 +433,14 @@ github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B
 github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
 github.com/spf13/cobra v1.0.0/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE=
-github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
-github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
 github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE=
 github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
@@ -417,9 +456,17 @@ github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81P
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
 github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
 github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
 github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
 github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/timakin/bodyclose v0.0.0-20190930140734-f7f2e9bca95e/go.mod h1:Qimiffbc6q9tBWlVV6x0P9sat/ao1xEkREYPPj9hphk=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
@@ -443,8 +490,6 @@ github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca/go.mod h1:ce1O1j6Ut
 github.com/xlab/treeprint v1.1.0 h1:G/1DjNkPpfZCFt9CSh6b5/nY4VimlbHF3Rh4obvtzDk=
 github.com/xlab/treeprint v1.1.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yujunz/go-getter v1.5.1-lite.0.20201201013212-6d9c071adddf/go.mod h1:bL0Pr07HEdsMZ1WBqZIxXj96r5LnFsY4LgPaPEGkw1k=
 go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.mongodb.org/mongo-driver v1.0.3/go.mod h1:u7ryQJ+DOzQmeO7zB6MHyr8jkEQvC8vH7qLUO4lqsUM=
@@ -456,8 +501,6 @@ go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0H
 go.starlark.net v0.0.0-20230103143115-09991d3a103e h1:lmqmzBAG2MQVtZHInHQJODrmPQN7I9QRXJLJ02yQDWM=
 go.starlark.net v0.0.0-20230103143115-09991d3a103e/go.mod h1:kIVgS18CjmEC3PqMd5kaJSGEifyV/CeB9x506ZJ1Vbk=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
 go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
@@ -466,8 +509,12 @@ go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
-go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
-go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.ngrok.com/muxado/v2 v2.0.1 h1:jM9i6Pom6GGmnPrHKNR6OJRrUoHFkSZlJ3/S0zqdVpY=
 golang.ngrok.com/muxado/v2 v2.0.1/go.mod h1:wzxJYX4xiAtmwumzL+QsukVwFRXmPNv86vB8RPpOxyM=
 golang.ngrok.com/ngrok/v2 v2.1.1 h1:HhBEBiTx8Rsf1txH3909ky0XS5xCBYWQWABiX1iuSBc=
@@ -480,19 +527,16 @@ golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190617133340-57b3e21c3d56/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
+golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
-golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
+golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
-golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
 golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
 golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
 golang.org/x/net v0.0.0-20180218175443-cbe0f9307d01/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -512,26 +556,22 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
+golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
+golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
 golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -554,23 +594,23 @@ golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20220526004731-065cf7ba2467/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
+golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
-golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
+golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
+golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.7.0 h1:ntUhktv3OPE6TgYxXWv9vKvUSJyIFJlyohwbkEwPrKQ=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
-golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -592,16 +632,13 @@ golang.org/x/tools v0.0.0-20190910044552-dd2b5c81c578/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20190930201159-7c411dea38b0/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191010075000-0337d82405ff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
-golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
 golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
 golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
+gomodules.xyz/jsonpatch/v2 v2.5.0 h1:JELs8RLM12qJGXU4u/TO3V25KW8GreMKl9pdkk14RM0=
-gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
+gomodules.xyz/jsonpatch/v2 v2.5.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
@@ -629,8 +666,8 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -639,8 +676,8 @@ gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
+gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
-gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
@@ -663,29 +700,29 @@ gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
-k8s.io/api v0.32.1 h1:f562zw9cy+GvXzXf0CKlVQ7yHJVYzLfL6JAS4kOAaOc=
+k8s.io/api v0.35.3 h1:pA2fiBc6+N9PDf7SAiluKGEBuScsTzd2uYBkA5RzNWQ=
-k8s.io/api v0.32.1/go.mod h1:/Yi/BqkuueW1BgpoePYBRdDYfjPF5sgTr5+YqDZra5k=
+k8s.io/api v0.35.3/go.mod h1:9Y9tkBcFwKNq2sxwZTQh1Njh9qHl81D0As56tu42GA4=
-k8s.io/apiextensions-apiserver v0.32.1 h1:hjkALhRUeCariC8DiVmb5jj0VjIc1N0DREP32+6UXZw=
+k8s.io/apiextensions-apiserver v0.35.3 h1:2fQUhEO7P17sijylbdwt0nBdXP0TvHrHj0KeqHD8FiU=
-k8s.io/apiextensions-apiserver v0.32.1/go.mod h1:sxWIGuGiYov7Io1fAS2X06NjMIk5CbRHc2StSmbaQto=
+k8s.io/apiextensions-apiserver v0.35.3/go.mod h1:tK4Kz58ykRpwAEkXUb634HD1ZAegEElktz/B3jgETd8=
-k8s.io/apimachinery v0.32.1 h1:683ENpaCBjma4CYqsmZyhEzrGz6cjn1MY/X2jB2hkZs=
+k8s.io/apimachinery v0.35.3 h1:MeaUwQCV3tjKP4bcwWGgZ/cp/vpsRnQzqO6J6tJyoF8=
-k8s.io/apimachinery v0.32.1/go.mod h1:GpHVgxoKlTxClKcteaeuF1Ul/lDVb74KpZcxcmLDElE=
+k8s.io/apimachinery v0.35.3/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
-k8s.io/client-go v0.32.1 h1:otM0AxdhdBIaQh7l1Q0jQpmo7WOFIk5FFa4bg6YMdUU=
+k8s.io/client-go v0.35.3 h1:s1lZbpN4uI6IxeTM2cpdtrwHcSOBML1ODNTCCfsP1pg=
-k8s.io/client-go v0.32.1/go.mod h1:aTTKZY7MdxUaJ/KiUs8D+GssR9zJZi77ZqtzcGXIiDg=
+k8s.io/client-go v0.35.3/go.mod h1:RzoXkc0mzpWIDvBrRnD+VlfXP+lRzqQjCmKtiwZ8Q9c=
-k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
+k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
-k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
-k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f h1:GA7//TjRY9yWGy1poLzYYJJ4JRdzg3+O6e8I+e+8T5Y=
+k8s.io/kube-openapi v0.0.0-20260319004828-5883c5ee87b9 h1:Sztf7ESG9tAXRW/ACJZjrj5jhdOUqS2KFRQT+CTvu78=
-k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f/go.mod h1:R/HEjbvWI0qdfb8viZUeVZm0X6IZnxAydC7YU42CMw4=
+k8s.io/kube-openapi v0.0.0-20260319004828-5883c5ee87b9/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
+k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
 mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed/go.mod h1:Xkxe497xwlCKkIaQYRfC7CSLworTXY9RMqwhhCm+8Nc=
 mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b/go.mod h1:2odslEg/xrtNQqCYg2/jCoyKnw3vv5biOc3JnIcYfL4=
 mvdan.cc/unparam v0.0.0-20190720180237-d51796306d8f/go.mod h1:4G1h5nDURzA3bwVMZIVpwbkw+04kSxk3rAtzlimaUJw=
-sigs.k8s.io/controller-runtime v0.20.2 h1:/439OZVxoEc02psi1h4QO3bHzTgu49bb347Xp4gW1pc=
+sigs.k8s.io/controller-runtime v0.23.3 h1:VjB/vhoPoA9l1kEKZHBMnQF33tdCLQKJtydy4iqwZ80=
-sigs.k8s.io/controller-runtime v0.20.2/go.mod h1:xg2XB0K5ShQzAgsoujxuKN4LNXR2LfwwHsPj7Iaw+XY=
+sigs.k8s.io/controller-runtime v0.23.3/go.mod h1:B6COOxKptp+YaUT5q4l6LqUJTRpizbgf9KSRNdQGns0=
 sigs.k8s.io/gateway-api v1.2.1 h1:fZZ/+RyRb+Y5tGkwxFKuYuSRQHu9dZtbjenblleOLHM=
 sigs.k8s.io/gateway-api v1.2.1/go.mod h1:EpNfEXNjiYfUJypf0eZ0P5iXA9ekSGWaS1WgPaM42X0=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/kustomize/api v0.8.0/go.mod h1:Ih6Y6bOErR70EdapDtWitBzPG9HewyemRY6sFaQyugU=
 sigs.k8s.io/kustomize/api v0.12.1 h1:7YM7gW3kYBwtKvoY216ZzY+8hM+lV53LUayghNRJ0vM=
 sigs.k8s.io/kustomize/api v0.12.1/go.mod h1:y3JUhimkZkR6sbLNwfJHxvo1TCLwuwm14sCYnkH6S1s=
@@ -697,9 +734,11 @@ sigs.k8s.io/kustomize/kustomize/v3 v3.10.0/go.mod h1:spVXMybMUUCzxzdS3TUxJU6s3kX
 sigs.k8s.io/kustomize/kyaml v0.10.9/go.mod h1:K9yg1k/HB/6xNOf5VH3LhTo1DK9/5ykSZO5uIv+Y/1k=
 sigs.k8s.io/kustomize/kyaml v0.13.10 h1:htPMvrk7ZDfTDyrgXIm/2mfmcYJHEmRb6s+yCLgtNms=
 sigs.k8s.io/kustomize/kyaml v0.13.10/go.mod h1:PzDV8gSaY8mwdd7nR9zg7Pw5yh9fu8G+ElAXoQVzBq8=
-sigs.k8s.io/structured-merge-diff/v4 v4.4.2 h1:MdmvkGuXi/8io6ixD5wud3vOLwc1rj0aNqRlpuvjmwA=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
-sigs.k8s.io/structured-merge-diff/v4 v4.4.2/go.mod h1:N8f93tFZh9U6vpxwRArLiikrE5/2tiu1w1AGfACIGE4=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
 sigs.k8s.io/structured-merge-diff/v6 v6.3.2 h1:kwVWMx5yS1CrnFWA/2QHyRVJ8jM6dBA80uLmm0wJkk8=
 sigs.k8s.io/structured-merge-diff/v6 v6.3.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
 sourcegraph.com/sqs/pbtypes v0.0.0-20180604144634-d3ebe8f20ae4/go.mod h1:ketZ/q3QxT9HOBeFhu6RdvsftgpsbFHBF5Cas6cDKZ0=
@@ -25,7 +25,6 @@ import (
 	"github.com/stretchr/testify/require"
 	networking "k8s.io/api/networking/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/utils/ptr"
 )
 func TestExtractNgrokTrafficPolicyFromAnnotations(t *testing.T) {
@@ -94,7 +93,7 @@ func TestExtractUseEndpointPooling(t *testing.T) {
 			annotations: map[string]string{
 				"k8s.ngrok.com/pooling-enabled": "true",
 			},
-			expected:    ptr.To(true),
+			expected:    new(true),
 			expectedErr: nil,
 		},
 		{
@@ -102,7 +101,7 @@ func TestExtractUseEndpointPooling(t *testing.T) {
 			annotations: map[string]string{
 				"k8s.ngrok.com/pooling-enabled": "false",
 			},
-			expected:    ptr.To(false),
+			expected:    new(false),
 			expectedErr: nil,
 		},
 		{
@@ -110,7 +109,7 @@ func TestExtractUseEndpointPooling(t *testing.T) {
 			annotations: map[string]string{
 				"k8s.ngrok.com/pooling-enabled": "foo",
 			},
-			expected:    ptr.To(false),
+			expected:    new(false),
 			expectedErr: nil,
 		},
 		{
@@ -38,7 +38,7 @@ var (
 // Annotation has a method to parse annotations located in client.Object
 type Annotation interface {
-	Parse(obj client.Object) (interface{}, error)
+	Parse(obj client.Object) (any, error)
 }
 type annotations map[string]string
@@ -78,7 +78,7 @@ func (a annotations) parseStringSlice(name string) ([]string, error) {
 		// Remove spaces around each element
 		values := []string{}
-		for _, v := range strings.Split(s, ",") {
+		for v := range strings.SplitSeq(s, ",") {
 			values = append(values, strings.TrimSpace(v))
 		}
@@ -205,7 +205,7 @@ func GetAnnotationWithPrefix(suffix string) string {
 func normalizeString(input string) string {
 	trimmedContent := []string{}
-	for _, line := range strings.Split(input, "\n") {
+	for line := range strings.SplitSeq(input, "\n") {
 		trimmedContent = append(trimmedContent, strings.TrimSpace(line))
 	}
@@ -42,7 +42,7 @@ import (
 	"github.com/ngrok/ngrok-operator/pkg/agent"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -90,7 +90,7 @@ type AgentEndpointReconciler struct {
 	Log         logr.Logger
 	Scheme      *runtime.Scheme
-	Recorder    record.EventRecorder
+	Recorder    events.EventRecorder
 	AgentDriver agent.Driver
 	controller *controller.BaseController[*ngrokv1alpha1.AgentEndpoint]
@@ -152,7 +152,7 @@ func (r *AgentEndpointReconciler) SetupWithManagerNamed(mgr ctrl.Manager, contro
 				return ctrl.Result{RequeueAfter: 10 * time.Second}, nil
 			}
 			if errors.Is(err, ErrInvalidTrafficPolicyConfig) {
-				r.Recorder.Event(cr, v1.EventTypeWarning, "ConfigError", err.Error())
+				r.Recorder.Eventf(cr, nil, v1.EventTypeWarning, "ConfigError", "Reconcile", err.Error())
 				r.Log.Error(err, "invalid TrafficPolicy configuration", "name", cr.Name, "namespace", cr.Namespace)
 				return ctrl.Result{}, nil // Do not requeue
 			}
@@ -432,7 +432,7 @@ func (r *AgentEndpointReconciler) getClientCerts(ctx context.Context, aep *ngrok
 		// Attempt to get the Secret from the API server
 		certSecret := &v1.Secret{}
 		if err := r.Client.Get(ctx, key, certSecret); err != nil {
-			r.Recorder.Event(certSecret, v1.EventTypeWarning, "SecretNotFound", fmt.Sprintf("Failed to find Secret %s", clientCertRef.Name))
+			r.Recorder.Eventf(certSecret, nil, v1.EventTypeWarning, "SecretNotFound", "Reconcile", fmt.Sprintf("Failed to find Secret %s", clientCertRef.Name))
 			return nil, err
 		}
@@ -465,7 +465,7 @@ func (r *AgentEndpointReconciler) findTrafficPolicyByName(ctx context.Context, t
 	// Attempt to get the TrafficPolicy from the API server
 	if err := r.Client.Get(ctx, key, tp); err != nil {
-		r.Recorder.Event(tp, v1.EventTypeWarning, "TrafficPolicyNotFound", fmt.Sprintf("Failed to find TrafficPolicy %s", tpName))
+		r.Recorder.Eventf(tp, nil, v1.EventTypeWarning, "TrafficPolicyNotFound", "Reconcile", fmt.Sprintf("Failed to find TrafficPolicy %s", tpName))
 		return "", err
 	}
@@ -40,7 +40,6 @@ import (
 	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
@@ -1350,7 +1349,7 @@ cCzFoVcb6XWg4MpPeZ25v+xA
 					Status: ngrokv1alpha1.AgentEndpointStatus{
 						DomainRef: &ngrokv1alpha1.K8sObjectRefOptionalNamespace{
 							Name:      staleDomain.GetName(),
-							Namespace: ptr.To(staleDomain.GetNamespace()),
+							Namespace: new(staleDomain.GetNamespace()),
 						},
 					},
 				}
@@ -1520,7 +1519,7 @@ cCzFoVcb6XWg4MpPeZ25v+xA
 				latestDomain := &ingressv1alpha1.Domain{}
 				g.Expect(k8sClient.Get(ctx, client.ObjectKeyFromObject(domain), latestDomain)).To(Succeed())
 				latestDomain.Status.ID = "dom_456"
-				latestDomain.Status.CNAMETarget = ptr.To("test.ngrok-cname.com")
+				latestDomain.Status.CNAMETarget = new("test.ngrok-cname.com")
 				latestDomain.Status.Conditions = []metav1.Condition{
 					{
 						Type:               "Ready",
@@ -1590,7 +1589,7 @@ cCzFoVcb6XWg4MpPeZ25v+xA
 				g.Expect(k8sClient.Get(ctx, client.ObjectKeyFromObject(agentEndpoint), obj)).To(Succeed())
 				obj.Status.DomainRef = &ngrokv1alpha1.K8sObjectRefOptionalNamespace{
 					Name:      "stale-example-com",
-					Namespace: ptr.To(namespace),
+					Namespace: new(namespace),
 				}
 				g.Expect(k8sClient.Status().Update(ctx, obj)).To(Succeed())
 			}, timeout, interval).Should(Succeed())
@@ -1664,7 +1663,7 @@ cCzFoVcb6XWg4MpPeZ25v+xA
 				g.Expect(k8sClient.Get(ctx, client.ObjectKeyFromObject(agentEndpoint), obj)).To(Succeed())
 				obj.Status.DomainRef = &ngrokv1alpha1.K8sObjectRefOptionalNamespace{
 					Name:      staleDomain.Name,
-					Namespace: ptr.To(namespace),
+					Namespace: new(namespace),
 				}
 				g.Expect(k8sClient.Status().Update(ctx, obj)).To(Succeed())
 			}, timeout, interval).Should(Succeed())
@@ -100,7 +100,7 @@ var _ = BeforeSuite(func() {
 		Client:           envMgr.GetClient(),
 		Log:              logf.Log.WithName("env-agent-endpoint-controller"),
 		Scheme:           envMgr.GetScheme(),
-		Recorder:         envMgr.GetEventRecorderFor("env-agent-endpoint-controller"),
+		Recorder:         envMgr.GetEventRecorder("env-agent-endpoint-controller"),
 		AgentDriver:      envMockDriver,
 		ControllerLabels: labels.NewControllerLabelValues(controllerNamespace, controllerName),
 	}
@@ -163,7 +163,7 @@ var _ = BeforeSuite(func() {
 		Client:           nsMgr.GetClient(),
 		Log:              logf.Log.WithName("ns-filter-test-controller"),
 		Scheme:           nsMgr.GetScheme(),
-		Recorder:         nsMgr.GetEventRecorderFor("ns-filter-test-controller"),
+		Recorder:         nsMgr.GetEventRecorder("ns-filter-test-controller"),
 		AgentDriver:      nsMockDriver,
 		ControllerLabels: labels.NewControllerLabelValues(controllerNamespace, controllerName),
 	}
@@ -13,7 +13,7 @@ import (
 	"github.com/ngrok/ngrok-operator/internal/ngrokapi"
 	"github.com/ngrok/ngrok-operator/internal/util"
 	v1 "k8s.io/api/core/v1"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/handler"
@@ -50,7 +50,7 @@ type BaseController[T client.Object] struct {
 	Log logr.Logger
 	// Recorder is the event recorder for the controller
-	Recorder record.EventRecorder
+	Recorder events.EventRecorder
 	// Namespace is optional for controllers
 	Namespace *string
@@ -95,32 +95,32 @@ func (self *BaseController[T]) Reconcile(ctx context.Context, req ctrl.Request,
 		}
 		if self.StatusID != nil && self.StatusID(obj) == "" {
-			self.Recorder.Event(obj, v1.EventTypeNormal, "Creating", fmt.Sprintf("Creating %s", objName))
+			self.Recorder.Eventf(obj, nil, v1.EventTypeNormal, "Creating", "Create", fmt.Sprintf("Creating %s", objName))
 			if err := self.Create(ctx, obj); err != nil {
-				self.Recorder.Event(obj, v1.EventTypeWarning, "CreateError", fmt.Sprintf("Failed to Create %s: %s", objName, err.Error()))
+				self.Recorder.Eventf(obj, nil, v1.EventTypeWarning, "CreateError", "Create", fmt.Sprintf("Failed to Create %s: %s", objName, err.Error()))
 				return self.handleErr(CreateOp, obj, err)
 			}
-			self.Recorder.Event(obj, v1.EventTypeNormal, "Created", fmt.Sprintf("Created %s", objName))
+			self.Recorder.Eventf(obj, nil, v1.EventTypeNormal, "Created", "Create", fmt.Sprintf("Created %s", objName))
 		} else {
-			self.Recorder.Event(obj, v1.EventTypeNormal, "Updating", fmt.Sprintf("Updating %s", objName))
+			self.Recorder.Eventf(obj, nil, v1.EventTypeNormal, "Updating", "Update", fmt.Sprintf("Updating %s", objName))
 			if err := self.Update(ctx, obj); err != nil {
-				self.Recorder.Event(obj, v1.EventTypeWarning, "UpdateError", fmt.Sprintf("Failed to update %s: %s", objName, err.Error()))
+				self.Recorder.Eventf(obj, nil, v1.EventTypeWarning, "UpdateError", "Update", fmt.Sprintf("Failed to update %s: %s", objName, err.Error()))
 				return self.handleErr(UpdateOp, obj, err)
 			}
-			self.Recorder.Event(obj, v1.EventTypeNormal, "Updated", fmt.Sprintf("Updated %s", objName))
+			self.Recorder.Eventf(obj, nil, v1.EventTypeNormal, "Updated", "Update", fmt.Sprintf("Updated %s", objName))
 		}
 	} else if util.HasFinalizer(obj) {
 		if self.StatusID != nil && self.StatusID(obj) != "" {
 			sid := self.StatusID(obj)
-			self.Recorder.Event(obj, v1.EventTypeNormal, "Deleting", fmt.Sprintf("Deleting %s", objName))
+			self.Recorder.Eventf(obj, nil, v1.EventTypeNormal, "Deleting", "Delete", fmt.Sprintf("Deleting %s", objName))
 			if err := self.Delete(ctx, obj); err != nil {
 				if !ngrok.IsNotFound(err) {
-					self.Recorder.Event(obj, v1.EventTypeWarning, "DeleteError", fmt.Sprintf("Failed to delete %s: %s", objName, err.Error()))
+					self.Recorder.Eventf(obj, nil, v1.EventTypeWarning, "DeleteError", "Delete", fmt.Sprintf("Failed to delete %s: %s", objName, err.Error()))
 					return self.handleErr(DeleteOp, obj, err)
 				}
 				log.Info(fmt.Sprintf("%s not found, assuming it was already deleted", objFullName), "ID", sid)
 			}
-			self.Recorder.Event(obj, v1.EventTypeNormal, "Deleted", fmt.Sprintf("Deleted %s", objName))
+			self.Recorder.Eventf(obj, nil, v1.EventTypeNormal, "Deleted", "Delete", fmt.Sprintf("Deleted %s", objName))
 		}
 		if err := util.RemoveAndSyncFinalizer(ctx, self.Kube, obj); err != nil {
@@ -157,12 +157,12 @@ func (self *BaseController[T]) ReconcileStatus(ctx context.Context, obj T, origE
 	log := ctrl.LoggerFrom(ctx).WithValues("originalError", origErr)
 	if err := self.Kube.Status().Update(ctx, obj); err != nil {
-		self.Recorder.Event(obj, v1.EventTypeWarning, "StatusError", fmt.Sprintf("Failed to reconcile status: %s", err.Error()))
+		self.Recorder.Eventf(obj, nil, v1.EventTypeWarning, "StatusError", "UpdateStatus", fmt.Sprintf("Failed to reconcile status: %s", err.Error()))
 		log.V(1).Error(err, "Failed to update status")
 		return StatusError{origErr, err}
 	}
-	self.Recorder.Event(obj, v1.EventTypeNormal, "Status", "Successfully reconciled status")
+	self.Recorder.Eventf(obj, nil, v1.EventTypeNormal, "Status", "UpdateStatus", "Successfully reconciled status")
 	log.V(1).Info("Successfully updated status")
 	return origErr
 }
@@ -42,7 +42,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/kubernetes/scheme"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 )
@@ -57,7 +57,7 @@ func TestBaseController_Reconcile_ObjectNotFound(t *testing.T) {
 	bc := &BaseController[*netv1.Ingress]{
 		Kube:     c,
 		Log:      logr.Discard(),
-		Recorder: record.NewFakeRecorder(10),
+		Recorder: events.NewFakeRecorder(10),
 		StatusID: func(_ *netv1.Ingress) string { return "" },
 	}
@@ -87,7 +87,7 @@ func TestBaseController_Reconcile_DrainState(t *testing.T) {
 	bc := &BaseController[*netv1.Ingress]{
 		Kube:       c,
 		Log:        logr.Discard(),
-		Recorder:   record.NewFakeRecorder(10),
+		Recorder:   events.NewFakeRecorder(10),
 		DrainState: drain.AlwaysDraining{},
 		StatusID:   func(_ *netv1.Ingress) string { return "" },
 		Create: func(_ context.Context, _ *netv1.Ingress) error {
@@ -126,7 +126,7 @@ func TestBaseController_Reconcile_DrainState_AllowsDelete(t *testing.T) {
 	bc := &BaseController[*netv1.Ingress]{
 		Kube:       c,
 		Log:        logr.Discard(),
-		Recorder:   record.NewFakeRecorder(10),
+		Recorder:   events.NewFakeRecorder(10),
 		DrainState: drain.AlwaysDraining{},
 		StatusID:   func(_ *netv1.Ingress) string { return "existing-id" },
 		Delete: func(_ context.Context, _ *netv1.Ingress) error {
@@ -162,7 +162,7 @@ func TestBaseController_Reconcile_Create(t *testing.T) {
 	bc := &BaseController[*netv1.Ingress]{
 		Kube:     c,
 		Log:      logr.Discard(),
-		Recorder: record.NewFakeRecorder(10),
+		Recorder: events.NewFakeRecorder(10),
 		StatusID: func(_ *netv1.Ingress) string { return "" },
 		Create: func(_ context.Context, _ *netv1.Ingress) error {
 			createCalled = true
@@ -201,7 +201,7 @@ func TestBaseController_Reconcile_Update(t *testing.T) {
 	bc := &BaseController[*netv1.Ingress]{
 		Kube:     c,
 		Log:      logr.Discard(),
-		Recorder: record.NewFakeRecorder(10),
+		Recorder: events.NewFakeRecorder(10),
 		StatusID: func(_ *netv1.Ingress) string { return "existing-id" },
 		Create: func(_ context.Context, _ *netv1.Ingress) error {
 			t.Error("Create should not be called")
@@ -243,7 +243,7 @@ func TestBaseController_Reconcile_Delete(t *testing.T) {
 	bc := &BaseController[*netv1.Ingress]{
 		Kube:     c,
 		Log:      logr.Discard(),
-		Recorder: record.NewFakeRecorder(10),
+		Recorder: events.NewFakeRecorder(10),
 		StatusID: func(_ *netv1.Ingress) string { return "existing-id" },
 		Delete: func(_ context.Context, _ *netv1.Ingress) error {
 			deleteCalled = true
@@ -280,7 +280,7 @@ func TestBaseController_Reconcile_Delete_NotFound(t *testing.T) {
 	bc := &BaseController[*netv1.Ingress]{
 		Kube:     c,
 		Log:      logr.Discard(),
-		Recorder: record.NewFakeRecorder(10),
+		Recorder: events.NewFakeRecorder(10),
 		StatusID: func(_ *netv1.Ingress) string { return "existing-id" },
 		Delete: func(_ context.Context, _ *netv1.Ingress) error {
 			return &ngrok.Error{
@@ -438,7 +438,7 @@ func TestBaseController_Reconcile_CreateError(t *testing.T) {
 	bc := &BaseController[*netv1.Ingress]{
 		Kube:     c,
 		Log:      logr.Discard(),
-		Recorder: record.NewFakeRecorder(10),
+		Recorder: events.NewFakeRecorder(10),
 		StatusID: func(_ *netv1.Ingress) string { return "" },
 		Create: func(_ context.Context, _ *netv1.Ingress) error {
 			return createErr
@@ -471,7 +471,7 @@ func TestBaseController_Reconcile_UpdateError(t *testing.T) {
 	bc := &BaseController[*netv1.Ingress]{
 		Kube:     c,
 		Log:      logr.Discard(),
-		Recorder: record.NewFakeRecorder(10),
+		Recorder: events.NewFakeRecorder(10),
 		StatusID: func(_ *netv1.Ingress) string { return "existing-id" },
 		Update: func(_ context.Context, _ *netv1.Ingress) error {
 			return updateErr
@@ -504,7 +504,7 @@ func TestBaseController_Reconcile_CustomErrResult(t *testing.T) {
 	bc := &BaseController[*netv1.Ingress]{
 		Kube:     c,
 		Log:      logr.Discard(),
-		Recorder: record.NewFakeRecorder(10),
+		Recorder: events.NewFakeRecorder(10),
 		StatusID: func(_ *netv1.Ingress) string { return "" },
 		Create: func(_ context.Context, _ *netv1.Ingress) error {
 			return errors.New("some error")
@@ -38,7 +38,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/intstr"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
@@ -79,7 +79,7 @@ type BoundEndpointReconciler struct {
 	controller *controller.BaseController[*bindingsv1alpha1.BoundEndpoint]
 	Log      logr.Logger
-	Recorder record.EventRecorder
+	Recorder events.EventRecorder
 	// ClusterDomain is the last part of the FQDN for Service DNS in-cluster
 	ClusterDomain string
@@ -206,7 +206,7 @@ func (r *BoundEndpointReconciler) createTargetService(ctx context.Context, owner
 	log := ctrl.LoggerFrom(ctx)
 	if err := r.Client.Create(ctx, service); err != nil {
-		r.Recorder.Event(owner, v1.EventTypeWarning, "Created", "Failed to create Target Service")
+		r.Recorder.Eventf(owner, nil, v1.EventTypeWarning, "Created", "Create", "Failed to create Target Service")
 		log.Error(err, "Failed to create Target Service")
 		ngrokErr := ngrokapi.NewNgrokError(err, ngrokapi.NgrokOpErrFailedToCreateTargetService, "Failed to create Target Service")
@@ -215,8 +215,7 @@ func (r *BoundEndpointReconciler) createTargetService(ctx context.Context, owner
 		return ngrokErr
 	}
-	r.Recorder.Event(service, v1.EventTypeNormal, "Created", "Created Target Service")
+	r.Recorder.Eventf(owner, service, v1.EventTypeNormal, "Created", "Create", "Created Target Service")
 	r.Recorder.Event(owner, v1.EventTypeNormal, "Created", "Created Target Service")
 	log.Info("Created Target Service", "service", service.Name)
 	return nil
 }
@@ -225,7 +224,7 @@ func (r *BoundEndpointReconciler) createUpstreamService(ctx context.Context, own
 	log := ctrl.LoggerFrom(ctx)
 	if err := r.Client.Create(ctx, service); err != nil {
-		r.Recorder.Event(owner, v1.EventTypeWarning, "Created", "Failed to create Upstream Service")
+		r.Recorder.Eventf(owner, nil, v1.EventTypeWarning, "Created", "Create", "Failed to create Upstream Service")
 		log.Error(err, "Failed to create Upstream Service")
 		ngrokErr := ngrokapi.NewNgrokError(err, ngrokapi.NgrokOpErrFailedToCreateUpstreamService, "Failed to create Upstream Service")
@@ -234,8 +233,7 @@ func (r *BoundEndpointReconciler) createUpstreamService(ctx context.Context, own
 		return ngrokErr
 	}
-	r.Recorder.Event(service, v1.EventTypeNormal, "Created", "Created Upstream Service")
+	r.Recorder.Eventf(owner, service, v1.EventTypeNormal, "Created", "Create", "Created Upstream Service")
 	r.Recorder.Event(owner, v1.EventTypeNormal, "Created", "Created Upstream Service")
 	log.Info("Created Upstream Service", "service", service.Name)
 	return nil
@@ -271,12 +269,12 @@ func (r *BoundEndpointReconciler) update(ctx context.Context, cr *bindingsv1alph
 		// don't update status
 		if err := r.Client.Update(ctx, &existingUpstreamService); err != nil {
-			r.Recorder.Event(&existingUpstreamService, v1.EventTypeWarning, "UpdateFailed", "Failed to update Upstream Service")
+			r.Recorder.Eventf(&existingUpstreamService, nil, v1.EventTypeWarning, "UpdateFailed", "Update", "Failed to update Upstream Service")
-			r.Recorder.Event(cr, v1.EventTypeWarning, "UpdateFailed", "Failed to update Upstream Service")
+			r.Recorder.Eventf(cr, nil, v1.EventTypeWarning, "UpdateFailed", "Update", "Failed to update Upstream Service")
 			log.Error(err, "Failed to update Upstream Service")
 			return r.updateStatus(ctx, cr, err)
 		}
-		r.Recorder.Event(&existingUpstreamService, v1.EventTypeNormal, "Updated", "Updated Upstream Service")
+		r.Recorder.Eventf(&existingUpstreamService, nil, v1.EventTypeNormal, "Updated", "Update", "Updated Upstream Service")
 	}
 	// target service
@@ -301,12 +299,12 @@ func (r *BoundEndpointReconciler) update(ctx context.Context, cr *bindingsv1alph
 		// don't update status
 		if err := r.Client.Update(ctx, &existingTargetService); err != nil {
-			r.Recorder.Event(&existingTargetService, v1.EventTypeWarning, "UpdateFailed", "Failed to update Target Service")
+			r.Recorder.Eventf(&existingTargetService, nil, v1.EventTypeWarning, "UpdateFailed", "Update", "Failed to update Target Service")
-			r.Recorder.Event(cr, v1.EventTypeWarning, "UpdateFailed", "Failed to update Target Service")
+			r.Recorder.Eventf(cr, nil, v1.EventTypeWarning, "UpdateFailed", "Update", "Failed to update Target Service")
 			log.Error(err, "Failed to update Target Service")
 			return r.updateStatus(ctx, cr, err)
 		}
-		r.Recorder.Event(&existingTargetService, v1.EventTypeNormal, "Updated", "Updated Target Service")
+		r.Recorder.Eventf(&existingTargetService, nil, v1.EventTypeNormal, "Updated", "Update", "Updated Target Service")
 	}
 	// Both services exist and are up to date
@@ -320,7 +318,7 @@ func (r *BoundEndpointReconciler) update(ctx context.Context, cr *bindingsv1alph
 	err = r.testBoundEndpointConnectivity(timeoutCtx, cr)
 	r.setConnectivityStatus(cr, err)
-	r.Recorder.Event(cr, v1.EventTypeNormal, "Updated", "Updated Services")
+	r.Recorder.Eventf(cr, nil, v1.EventTypeNormal, "Updated", "Update", "Updated Services")
 	return r.updateStatus(ctx, cr, nil)
 }
@@ -348,7 +346,7 @@ func (r *BoundEndpointReconciler) deleteBoundEndpointServices(ctx context.Contex
 			if client.IgnoreNotFound(err) == nil {
 				return nil
 			}
-			r.Recorder.Event(cr, v1.EventTypeWarning, "Delete", "Failed to delete Target Service")
+			r.Recorder.Eventf(cr, nil, v1.EventTypeWarning, "Delete", "Delete", "Failed to delete Target Service")
 			log.Error(err, "Failed to delete Target Service")
 			return err
 		}
@@ -356,7 +354,7 @@ func (r *BoundEndpointReconciler) deleteBoundEndpointServices(ctx context.Contex
 	if err := r.Client.Delete(ctx, upstreamService); err != nil {
 		if client.IgnoreNotFound(err) != nil {
-			r.Recorder.Event(cr, v1.EventTypeWarning, "Delete", "Failed to delete Upstream Service")
+			r.Recorder.Eventf(cr, nil, v1.EventTypeWarning, "Delete", "Delete", "Failed to delete Upstream Service")
 			log.Error(err, "Failed to delete Upstream Service")
 			return err
 		}
@@ -15,7 +15,7 @@ import (
 	"github.com/ngrok/ngrok-operator/internal/ngrokapi"
 	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
@@ -37,7 +37,7 @@ type DrainState = drain.State
 type BoundEndpointPoller struct {
 	client.Client
 	Log      logr.Logger
-	Recorder record.EventRecorder
+	Recorder events.EventRecorder
 	// Namespace is the namespace to manage for BoundEndpoints
 	Namespace string
@@ -413,7 +413,7 @@ func (r *BoundEndpointPoller) createBinding(ctx context.Context, desired binding
 	if err := r.Create(ctx, toCreate); err != nil {
 		if client.IgnoreAlreadyExists(err) != nil {
 			log.Error(err, "Failed to create BoundEndpoint", "name", name, "url", toCreate.Spec.GetEndpointURL())
-			r.Recorder.Event(toCreate, v1.EventTypeWarning, "Created", fmt.Sprintf("Failed to create BoundEndpoint: %v", err))
+			r.Recorder.Eventf(toCreate, nil, v1.EventTypeWarning, "Created", "Create", fmt.Sprintf("Failed to create BoundEndpoint: %v", err))
 			return err
 		}
@@ -456,7 +456,7 @@ func (r *BoundEndpointPoller) createBinding(ctx context.Context, desired binding
 		return err
 	}
-	r.Recorder.Event(toCreate, v1.EventTypeNormal, "Created", "BoundEndpoint created successfully")
+	r.Recorder.Eventf(toCreate, nil, v1.EventTypeNormal, "Created", "Create", "BoundEndpoint created successfully")
 	return nil
 }
@@ -498,7 +498,7 @@ func (r *BoundEndpointPoller) updateBinding(ctx context.Context, desired binding
 	log.Info("Updating BoundEndpoint", "name", toUpdate.Name, "url", toUpdate.Spec.GetEndpointURL())
 	if err := r.Update(ctx, toUpdate); err != nil {
 		log.Error(err, "Failed updating BoundEndpoint", "name", toUpdate.Name, "url", toUpdate.Spec.GetEndpointURL())
-		r.Recorder.Event(toUpdate, v1.EventTypeWarning, "Updated", fmt.Sprintf("Failed to update BoundEndpoint: %v", err))
+		r.Recorder.Eventf(toUpdate, nil, v1.EventTypeWarning, "Updated", "Update", fmt.Sprintf("Failed to update BoundEndpoint: %v", err))
 		return err
 	}
@@ -525,7 +525,7 @@ func (r *BoundEndpointPoller) updateBinding(ctx context.Context, desired binding
 		return err
 	}
-	r.Recorder.Event(toUpdate, v1.EventTypeNormal, "Updated", "BoundEndpoint updated successfully")
+	r.Recorder.Eventf(toUpdate, nil, v1.EventTypeNormal, "Updated", "Update", "BoundEndpoint updated successfully")
 	return nil
 }
@@ -355,7 +355,7 @@ func Test_BoundEndpointPoller_hashURL(t *testing.T) {
 	endpointURL := "http://service.namespace:8080"
 	// hash must be consistent
-	for i := 0; i < 100; i++ {
+	for range 100 {
 		hashed := hashURL(endpointURL)
 		// ensure hashed name meets k8s DNS naming requirements
@@ -48,8 +48,7 @@ import (
 	"golang.org/x/sync/errgroup"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	"k8s.io/utils/ptr"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	controllerruntime "sigs.k8s.io/controller-runtime/pkg/controller"
@@ -65,7 +64,7 @@ type ForwarderReconciler struct {
 	controller *controller.BaseController[*bindingsv1alpha1.BoundEndpoint]
 	Log        logr.Logger
 	Scheme     *runtime.Scheme
-	Recorder   record.EventRecorder
+	Recorder   events.EventRecorder
 	BindingsDriver         *bindingsdriver.BindingsDriver
 	KubernetesOperatorName string
@@ -96,12 +95,12 @@ func (r *ForwarderReconciler) SetupWithManager(mgr ctrl.Manager) (err error) {
 		StatusID: r.statusID,
 	}
-	cont, err := controllerruntime.NewUnmanaged("bindings-forwarder-controller", mgr, controllerruntime.Options{
+	cont, err := controllerruntime.NewUnmanaged("bindings-forwarder-controller", controllerruntime.Options{
 		Reconciler: r,
 		LogConstructor: func(_ *reconcile.Request) logr.Logger {
 			return r.Log
 		},
-		NeedLeaderElection: ptr.To(false),
+		NeedLeaderElection: new(false),
 	})
 	if err != nil {
 		return
@@ -133,7 +133,7 @@ var _ = BeforeSuite(func() {
 		Client:        k8sManager.GetClient(),
 		Scheme:        k8sManager.GetScheme(),
 		Log:           logf.Log.WithName("boundendpoint-controller"),
-		Recorder:      k8sManager.GetEventRecorderFor("boundendpoint-controller"),
+		Recorder:      k8sManager.GetEventRecorder("boundendpoint-controller"),
 		ClusterDomain: "cluster.local",
 	}
 	err = controllerReconciler.SetupWithManager(k8sManager)
@@ -144,7 +144,7 @@ var _ = BeforeSuite(func() {
 		Client:                 k8sManager.GetClient(),
 		Scheme:                 k8sManager.GetScheme(),
 		Log:                    logf.Log.WithName("forwarder-controller"),
-		Recorder:               k8sManager.GetEventRecorderFor("forwarder-controller"),
+		Recorder:               k8sManager.GetEventRecorder("forwarder-controller"),
 		BindingsDriver:         bindingsdriver.New(),
 		KubernetesOperatorName: "test-op",
 	}
@@ -155,7 +155,7 @@ var _ = BeforeSuite(func() {
 	pollerController = &BoundEndpointPoller{
 		Client:                       k8sManager.GetClient(),
 		Log:                          logf.Log.WithName("boundendpoint-poller"),
-		Recorder:                     k8sManager.GetEventRecorderFor("boundendpoint-poller"),
+		Recorder:                     k8sManager.GetEventRecorder("boundendpoint-poller"),
 		Namespace:                    "ngrok-op",
 		KubernetesOperatorConfigName: "test-k8sop",
 		NgrokClientset:               mockClientset,
@@ -34,7 +34,7 @@ import (
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	"k8s.io/client-go/util/retry"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -59,7 +59,7 @@ type GatewayReconciler struct {
 	Log      logr.Logger
 	Scheme   *runtime.Scheme
-	Recorder record.EventRecorder
+	Recorder events.EventRecorder
 	Driver   *managerdriver.Driver
 	// DrainState is used to check if the operator is draining.
 	// If draining, non-delete reconciles are skipped to prevent new finalizers.
@@ -67,7 +67,7 @@ var _ = Describe("Gateway controller", Ordered, func() {
 					gw.Spec.Listeners = []gatewayv1.Listener{
 						{
 							Name:     gatewayv1.SectionName(testutils.RandomName("listener")),
-							Hostname: ptr.To(gatewayv1.Hostname(domain)),
+							Hostname: new(gatewayv1.Hostname(domain)),
 							Port:     443,
 							Protocol: gatewayv1.HTTPSProtocolType,
 						},
@@ -93,7 +93,7 @@ var _ = Describe("Gateway controller", Ordered, func() {
 					gw.Spec.Listeners = []gatewayv1.Listener{
 						{
 							Name:     gatewayv1.SectionName(testutils.RandomName("listener")),
-							Hostname: ptr.To(gatewayv1.Hostname(domain)),
+							Hostname: new(gatewayv1.Hostname(domain)),
 							Port:     443,
 							Protocol: gatewayv1.HTTPSProtocolType,
 						},
@@ -30,7 +30,7 @@ import (
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -47,7 +47,7 @@ type GatewayClassReconciler struct {
 	Log      logr.Logger
 	Scheme   *runtime.Scheme
-	Recorder record.EventRecorder
+	Recorder events.EventRecorder
 }
 // +kubebuilder:rbac:groups=gateway.networking.k8s.io,resources=gatewayclasses,verbs=get;list;watch;patch;update
@@ -41,7 +41,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	"k8s.io/utils/ptr"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/builder"
@@ -58,7 +58,7 @@ type HTTPRouteReconciler struct {
 	Log      logr.Logger
 	Scheme   *runtime.Scheme
-	Recorder record.EventRecorder
+	Recorder events.EventRecorder
 	Driver   *managerdriver.Driver
 	// DrainState is used to check if the operator is draining.
 	// If draining, non-delete reconciles are skipped to prevent new finalizers.
@@ -292,7 +292,7 @@ var _ = Describe("HTTPRoute controller", Ordered, func() {
 								{
 									Kind:      ptr.To(gatewayv1.Kind("Service")),
 									Group:     ptr.To(gatewayv1.Group("")),
-									Namespace: ptr.To(gatewayv1.Namespace(service.Namespace)),
+									Namespace: new(gatewayv1.Namespace(service.Namespace)),
 									Name:      gatewayv1.ObjectName(service.Name),
 								},
 							},
@@ -29,7 +29,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
@@ -44,7 +44,7 @@ type NamespaceReconciler struct {
 	Log      logr.Logger
 	Scheme   *runtime.Scheme
-	Recorder record.EventRecorder
+	Recorder events.EventRecorder
 	Driver   *managerdriver.Driver
 }
@@ -28,7 +28,7 @@ import (
 	"context"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
@@ -44,7 +44,7 @@ type ReferenceGrantReconciler struct {
 	Log      logr.Logger
 	Scheme   *runtime.Scheme
-	Recorder record.EventRecorder
+	Recorder events.EventRecorder
 	Driver   *managerdriver.Driver
 }
@@ -110,7 +110,7 @@ var _ = Describe("routeReferencesNgrokGateway", Ordered, func() {
 			refs := []gatewayv1.ParentReference{
 				{
 					Name:      gatewayv1.ObjectName(gw.Name),
-					Namespace: ptr.To(gatewayv1.Namespace(gw.Namespace)),
+					Namespace: new(gatewayv1.Namespace(gw.Namespace)),
 				},
 			}
 			// Pass a different default namespace to confirm the explicit ref namespace takes precedence.
@@ -155,7 +155,7 @@ var _ = BeforeSuite(func() {
 	err = (&ingress.DomainReconciler{
 		Client:        k8sManager.GetClient(),
 		Log:           logf.Log.WithName("controllers").WithName("Domain"),
-		Recorder:      k8sManager.GetEventRecorderFor("domain-controller"),
+		Recorder:      k8sManager.GetEventRecorder("domain-controller"),
 		Scheme:        k8sManager.GetScheme(),
 		DomainsClient: domainClient,
 	}).SetupWithManager(k8sManager)
@@ -164,7 +164,7 @@ var _ = BeforeSuite(func() {
 	err = (&GatewayClassReconciler{
 		Client:   k8sManager.GetClient(),
 		Log:      logf.Log.WithName("controllers").WithName("GatewayClass"),
-		Recorder: k8sManager.GetEventRecorderFor("gatewayclass-controller"),
+		Recorder: k8sManager.GetEventRecorder("gatewayclass-controller"),
 		Scheme:   k8sManager.GetScheme(),
 	}).SetupWithManager(k8sManager)
 	Expect(err).NotTo(HaveOccurred())
@@ -173,7 +173,7 @@ var _ = BeforeSuite(func() {
 		Client:   k8sManager.GetClient(),
 		Log:      logf.Log.WithName("controllers").WithName("Gateway"),
 		Scheme:   k8sManager.GetScheme(),
-		Recorder: k8sManager.GetEventRecorderFor("gateway-controller"),
+		Recorder: k8sManager.GetEventRecorder("gateway-controller"),
 		Driver:   driver,
 	}).SetupWithManager(k8sManager)
 	Expect(err).NotTo(HaveOccurred())
@@ -182,7 +182,7 @@ var _ = BeforeSuite(func() {
 		Client:   k8sManager.GetClient(),
 		Log:      logf.Log.WithName("controllers").WithName("HTTPRoute"),
 		Scheme:   k8sManager.GetScheme(),
-		Recorder: k8sManager.GetEventRecorderFor("httproute-controller"),
+		Recorder: k8sManager.GetEventRecorder("httproute-controller"),
 		Driver:   driver,
 	}).SetupWithManager(k8sManager)
 	Expect(err).NotTo(HaveOccurred())
@@ -190,7 +190,7 @@ var _ = BeforeSuite(func() {
 	err = (&TCPRouteReconciler{
 		Client:   k8sManager.GetClient(),
 		Log:      logf.Log.WithName("controllers").WithName("TCPRoute"),
-		Recorder: k8sManager.GetEventRecorderFor("tcproute-controller"),
+		Recorder: k8sManager.GetEventRecorder("tcproute-controller"),
 		Scheme:   k8sManager.GetScheme(),
 		Driver:   driver,
 	}).SetupWithManager(k8sManager)
@@ -199,7 +199,7 @@ var _ = BeforeSuite(func() {
 	err = (&TLSRouteReconciler{
 		Client:   k8sManager.GetClient(),
 		Log:      logf.Log.WithName("controllers").WithName("TLSRoute"),
-		Recorder: k8sManager.GetEventRecorderFor("tlsroute-controller"),
+		Recorder: k8sManager.GetEventRecorder("tlsroute-controller"),
 		Scheme:   k8sManager.GetScheme(),
 		Driver:   driver,
 	}).SetupWithManager(k8sManager)
@@ -28,7 +28,7 @@ import (
 	"context"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	gatewayv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
@@ -45,7 +45,7 @@ type TCPRouteReconciler struct {
 	Log      logr.Logger
 	Scheme   *runtime.Scheme
-	Recorder record.EventRecorder
+	Recorder events.EventRecorder
 	Driver   *managerdriver.Driver
 	// DrainState is used to check if the operator is draining.
 	// If draining, non-delete reconciles are skipped to prevent new finalizers.
@@ -28,7 +28,7 @@ import (
 	"context"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	gatewayv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
@@ -45,7 +45,7 @@ type TLSRouteReconciler struct {
 	Log      logr.Logger
 	Scheme   *runtime.Scheme
-	Recorder record.EventRecorder
+	Recorder events.EventRecorder
 	Driver   *managerdriver.Driver
 	// DrainState is used to check if the operator is draining.
 	// If draining, non-delete reconciles are skipped to prevent new finalizers.
@@ -32,7 +32,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	"k8s.io/client-go/util/workqueue"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -54,7 +54,7 @@ type DomainReconciler struct {
 	Log           logr.Logger
 	Scheme        *runtime.Scheme
-	Recorder      record.EventRecorder
+	Recorder      events.EventRecorder
 	DomainsClient ngrokapi.DomainClient
 	DrainState    basecontroller.DrainState
@@ -13,7 +13,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	netv1 "k8s.io/api/networking/v1"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
@@ -24,7 +24,7 @@ type IngressReconciler struct {
 	client.Client
 	Log       logr.Logger
 	Scheme    *runtime.Scheme
-	Recorder  record.EventRecorder
+	Recorder  events.EventRecorder
 	Namespace string
 	Driver    *managerdriver.Driver
 	// DrainState is used to check if the operator is draining.
@@ -97,13 +97,13 @@ func (r *IngressReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
 		log.Info("Ingress is not of type ngrok so skipping it")
 		return ctrl.Result{}, nil
 	case internalerrors.IsErrorNoDefaultIngressClassFound(err):
-		r.Recorder.Event(originalFoundIngress, "Warning", "NoDefaultIngressClassFound", "No ingress class found for this controller")
+		r.Recorder.Eventf(originalFoundIngress, nil, "Warning", "NoDefaultIngressClassFound", "Reconcile", "No ingress class found for this controller")
 		return ctrl.Result{}, nil
 	case internalerrors.IsErrInvalidIngressSpec(err):
-		r.Recorder.Eventf(originalFoundIngress, "Warning", "InvalidIngressSpec", "Ingress is not valid so skipping it: %v", err)
+		r.Recorder.Eventf(originalFoundIngress, nil, "Warning", "InvalidIngressSpec", "Reconcile", "Ingress is not valid so skipping it: %v", err)
 		return ctrl.Result{}, nil
 	default:
-		r.Recorder.Event(originalFoundIngress, "Warning", "FailedGetIngress", "Failed to get ingress from store")
+		r.Recorder.Eventf(originalFoundIngress, nil, "Warning", "FailedGetIngress", "Reconcile", "Failed to get ingress from store: %v", err)
 		return ctrl.Result{}, err
 	}
@@ -31,8 +31,7 @@ import (
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	"k8s.io/utils/ptr"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -54,7 +53,7 @@ type IPPolicyReconciler struct {
 	Log      logr.Logger
 	Scheme   *runtime.Scheme
-	Recorder record.EventRecorder
+	Recorder events.EventRecorder
 	IPPoliciesClient    ngrokapi.IPPoliciesClient
 	IPPolicyRulesClient ngrokapi.IPPolicyRulesClient
@@ -142,17 +141,17 @@ func (r *IPPolicyReconciler) update(ctx context.Context, policy *ingressv1alpha1
 	if remotePolicy.Description != policy.Spec.Description ||
 		remotePolicy.Metadata != policy.Spec.Metadata {
-		r.Recorder.Event(policy, v1.EventTypeNormal, "Updating", fmt.Sprintf("Updating IPPolicy %s", policy.Name))
+		r.Recorder.Eventf(policy, nil, v1.EventTypeNormal, "Updating", "Update", fmt.Sprintf("Updating IPPolicy %s", policy.Name))
 		_, err := r.IPPoliciesClient.Update(ctx, &ngrok.IPPolicyUpdate{
 			ID:          policy.Status.ID,
-			Description: ptr.To(policy.Spec.Description),
+			Description: new(policy.Spec.Description),
-			Metadata:    ptr.To(policy.Spec.Metadata),
+			Metadata:    new(policy.Spec.Metadata),
 		})
 		if err != nil {
 			setIPPolicyReadyCondition(policy, false, ReasonIPPolicyCreationFailed, err.Error())
 			return err
 		}
-		r.Recorder.Event(policy, v1.EventTypeNormal, "Updated", fmt.Sprintf("Updated IPPolicy %s", policy.Name))
+		r.Recorder.Eventf(policy, nil, v1.EventTypeNormal, "Updated", "Update", fmt.Sprintf("Updated IPPolicy %s", policy.Name))
 	}
 	err = r.createOrUpdateIPPolicyRules(ctx, policy)
@@ -402,7 +401,7 @@ func (d *IPPolicyDiff) createRule(rule ingressv1alpha1.IPPolicyRule) *ngrok.IPPo
 	return &ngrok.IPPolicyRuleCreate{
 		IPPolicyID:  d.policyID,
 		CIDR:        rule.CIDR,
-		Action:      ptr.To(rule.Action),
+		Action:      new(rule.Action),
 		Metadata:    rule.Metadata,
 		Description: rule.Description,
 	}
@@ -418,8 +417,8 @@ func (d *IPPolicyDiff) addUpdateIfNeeded(rule ingressv1alpha1.IPPolicyRule, remo
 	d.updates = append(d.updates, &ngrok.IPPolicyRuleUpdate{
 		ID:          remoteRule.ID,
-		Metadata:    ptr.To(rule.Metadata),
+		Metadata:    new(rule.Metadata),
-		Description: ptr.To(rule.Description),
+		Description: new(rule.Description),
-		CIDR:        ptr.To(rule.CIDR),
+		CIDR:        new(rule.CIDR),
 	})
 }
@@ -9,7 +9,6 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
@@ -219,22 +218,22 @@ var _ = Describe("IPPolicyDiff", func() {
 		Expect(diff.Next()).To(BeTrue())
 		Expect(diff.NeedsDelete()).To(BeEmpty())
 		Expect(diff.NeedsUpdate()).To(BeEmpty())
-		Expect(diff.NeedsCreate()).To(Equal([]*ngrok.IPPolicyRuleCreate{{IPPolicyID: "test", CIDR: specRules[2].CIDR, Action: ptr.To(IPPolicyRuleActionDeny)}}))
+		Expect(diff.NeedsCreate()).To(Equal([]*ngrok.IPPolicyRuleCreate{{IPPolicyID: "test", CIDR: specRules[2].CIDR, Action: new(IPPolicyRuleActionDeny)}}))
 		Expect(diff.Next()).To(BeTrue())
 		Expect(diff.NeedsUpdate()).To(BeEmpty())
 		Expect(diff.NeedsDelete()).To(Equal([]*ngrok.IPPolicyRule{remoteRules[0]}))
-		Expect(diff.NeedsCreate()).To(Equal([]*ngrok.IPPolicyRuleCreate{{IPPolicyID: "test", CIDR: specRules[0].CIDR, Action: ptr.To(IPPolicyRuleActionDeny)}}))
+		Expect(diff.NeedsCreate()).To(Equal([]*ngrok.IPPolicyRuleCreate{{IPPolicyID: "test", CIDR: specRules[0].CIDR, Action: new(IPPolicyRuleActionDeny)}}))
 		Expect(diff.Next()).To(BeTrue())
 		Expect(diff.NeedsUpdate()).To(BeEmpty())
 		Expect(diff.NeedsDelete()).To(Equal([]*ngrok.IPPolicyRule{remoteRules[1]}))
-		Expect(diff.NeedsCreate()).To(Equal([]*ngrok.IPPolicyRuleCreate{{IPPolicyID: "test", CIDR: specRules[1].CIDR, Action: ptr.To(IPPolicyRuleActionAllow)}}))
+		Expect(diff.NeedsCreate()).To(Equal([]*ngrok.IPPolicyRuleCreate{{IPPolicyID: "test", CIDR: specRules[1].CIDR, Action: new(IPPolicyRuleActionAllow)}}))
 		Expect(diff.Next()).To(BeTrue())
 		Expect(diff.NeedsUpdate()).To(BeEmpty())
 		Expect(diff.NeedsDelete()).To(BeEmpty())
-		Expect(diff.NeedsCreate()).To(Equal([]*ngrok.IPPolicyRuleCreate{{IPPolicyID: "test", CIDR: specRules[3].CIDR, Action: ptr.To(IPPolicyRuleActionAllow)}}))
+		Expect(diff.NeedsCreate()).To(Equal([]*ngrok.IPPolicyRuleCreate{{IPPolicyID: "test", CIDR: specRules[3].CIDR, Action: new(IPPolicyRuleActionAllow)}}))
 		Expect(diff.Next()).To(BeTrue())
 		Expect(diff.NeedsUpdate()).To(BeEmpty())
@@ -244,7 +243,7 @@ var _ = Describe("IPPolicyDiff", func() {
 		Expect(diff.Next()).To(BeTrue())
 		Expect(diff.NeedsDelete()).To(BeEmpty())
 		Expect(diff.NeedsCreate()).To(BeEmpty())
-		Expect(diff.NeedsUpdate()).To(Equal([]*ngrok.IPPolicyRuleUpdate{{ID: "5", CIDR: ptr.To("172.19.0.0/16"), Description: ptr.To("b"), Metadata: ptr.To("")}}))
+		Expect(diff.NeedsUpdate()).To(Equal([]*ngrok.IPPolicyRuleUpdate{{ID: "5", CIDR: new("172.19.0.0/16"), Description: new("b"), Metadata: new("")}}))
 		Expect(diff.Next()).To(BeFalse())
 	})
@@ -143,7 +143,7 @@ var _ = BeforeSuite(func() {
 	err = (&DomainReconciler{
 		Client:        k8sManager.GetClient(),
 		Log:           logf.Log.WithName("controllers").WithName("Domain"),
-		Recorder:      k8sManager.GetEventRecorderFor("domain-controller"),
+		Recorder:      k8sManager.GetEventRecorder("domain-controller"),
 		Scheme:        k8sManager.GetScheme(),
 		DomainsClient: domainClient,
 	}).SetupWithManager(k8sManager)
@@ -156,7 +156,7 @@ var _ = BeforeSuite(func() {
 	err = (&IPPolicyReconciler{
 		Client:              k8sManager.GetClient(),
 		Log:                 logf.Log.WithName("controllers").WithName("IPPolicy"),
-		Recorder:            k8sManager.GetEventRecorderFor("ippolicy-controller"),
+		Recorder:            k8sManager.GetEventRecorder("ippolicy-controller"),
 		Scheme:              k8sManager.GetScheme(),
 		IPPoliciesClient:    ipPolicyClient,
 		IPPolicyRulesClient: ipPolicyRuleClient,
@@ -32,7 +32,7 @@ import (
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -60,7 +60,7 @@ type CloudEndpointReconciler struct {
 	controller *controller.BaseController[*ngrokv1alpha1.CloudEndpoint]
 	Log            logr.Logger
-	Recorder       record.EventRecorder
+	Recorder       events.EventRecorder
 	NgrokClientset ngrokapi.Clientset
 	DrainState     controller.DrainState
@@ -133,7 +133,7 @@ func (r *CloudEndpointReconciler) SetupWithManager(mgr ctrl.Manager) error {
 				return ctrl.Result{RequeueAfter: 10 * time.Second}, nil
 			}
 			if errors.Is(err, ErrInvalidTrafficPolicyConfig) {
-				r.Recorder.Event(cr, v1.EventTypeWarning, "ConfigError", err.Error())
+				r.Recorder.Eventf(cr, nil, v1.EventTypeWarning, "ConfigError", "Reconcile", err.Error())
 				r.Log.Error(err, "invalid TrafficPolicy configuration", "name", cr.Name, "namespace", cr.Namespace)
 				return ctrl.Result{}, nil // Do not requeue
 			}
@@ -245,7 +245,7 @@ func (r *CloudEndpointReconciler) update(ctx context.Context, clep *ngrokv1alpha
 	ngrokClep, err := r.NgrokClientset.Endpoints().Update(ctx, updateParams)
 	if ngrok.IsNotFound(err) {
 		// Couldn't find endpoint by ID to update, so blank it out and create a new one
-		r.Recorder.Event(clep, v1.EventTypeWarning, "EndpointNotFound", fmt.Sprintf("Failed to update endpoint %s by ID because it was not found. Creating a new one", clep.Status.ID))
+		r.Recorder.Eventf(clep, nil, v1.EventTypeWarning, "EndpointNotFound", "Reconcile", fmt.Sprintf("Failed to update endpoint %s by ID because it was not found. Creating a new one", clep.Status.ID))
 		clep.Status.ID = ""
 		_ = r.Client.Status().Update(ctx, clep)
 		return r.create(ctx, clep)
@@ -380,7 +380,7 @@ func (r *CloudEndpointReconciler) findTrafficPolicyByName(ctx context.Context, t
 	// Attempt to get the TrafficPolicy from the API server
 	if err := r.Client.Get(ctx, key, tp); err != nil {
-		r.Recorder.Event(tp, v1.EventTypeWarning, "TrafficPolicyNotFound", fmt.Sprintf("Failed to find TrafficPolicy %s", tpName))
+		r.Recorder.Eventf(tp, nil, v1.EventTypeWarning, "TrafficPolicyNotFound", "Reconcile", fmt.Sprintf("Failed to find TrafficPolicy %s", tpName))
 		return "", err
 	}
@@ -41,8 +41,7 @@ import (
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	"k8s.io/utils/ptr"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
@@ -73,7 +72,7 @@ type KubernetesOperatorReconciler struct {
 	controller *controller.BaseController[*ngrokv1alpha1.KubernetesOperator]
 	Log            logr.Logger
-	Recorder       record.EventRecorder
+	Recorder       events.EventRecorder
 	NgrokClientset ngrokapi.Clientset
 	// K8sOpNamespace where the ngrok-operator is managing its resources
@@ -320,10 +319,10 @@ func (r *KubernetesOperatorReconciler) _update(ctx context.Context, ko *ngrokv1a
 	// Update the KubernetesOperator in the ngrok API
 	updateParams := &ngrok.KubernetesOperatorUpdate{
 		ID:              ngrokKo.ID,
-		Description:     ptr.To(ko.Spec.Description),
+		Description:     new(ko.Spec.Description),
-		Metadata:        ptr.To(r.tryMergeMetadata(ctx, ko)),
+		Metadata:        new(r.tryMergeMetadata(ctx, ko)),
 		EnabledFeatures: calculateFeaturesEnabled(ko),
-		Region:          ptr.To(ko.Spec.Region),
+		Region:          new(ko.Spec.Region),
 		Deployment:      deployment,
 	}
@@ -338,7 +337,7 @@ func (r *KubernetesOperatorReconciler) _update(ctx context.Context, ko *ngrokv1a
 		updateParams.Binding = &ngrok.KubernetesOperatorBindingUpdate{
 			EndpointSelectors: ko.Spec.Binding.EndpointSelectors,
-			CSR:               ptr.To(string(tlsSecret.Data["tls.csr"])),
+			CSR:               new(string(tlsSecret.Data["tls.csr"])),
 		}
 	}
@@ -29,24 +29,28 @@ import (
 	"github.com/go-logr/logr"
 	ngrokv1alpha1 "github.com/ngrok/ngrok-operator/api/ngrok/v1alpha1"
 	"github.com/ngrok/ngrok-operator/internal/events"
 	"github.com/ngrok/ngrok-operator/internal/util"
 	"github.com/ngrok/ngrok-operator/pkg/managerdriver"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 )
 const (
 	EventPolicyDeprecation        = "PolicyDeprecation"
 	EventTrafficPolicyParseFailed = "TrafficPolicyParseFailed"
 )
 // NgrokTrafficPolicyReconciler reconciles a NgrokTrafficPolicy object
 type NgrokTrafficPolicyReconciler struct {
 	client.Client
 	Log      logr.Logger
 	Scheme   *runtime.Scheme
-	Recorder record.EventRecorder
+	Recorder events.EventRecorder
 	Driver   *managerdriver.Driver
 }
@@ -73,16 +77,16 @@ func (r *NgrokTrafficPolicyReconciler) Reconcile(ctx context.Context, req ctrl.R
 	parsedTrafficPolicy, err := util.NewTrafficPolicyFromJson(policy.Spec.Policy)
 	if err != nil {
-		r.Recorder.Eventf(policy, v1.EventTypeWarning, events.TrafficPolicyParseFailed, "Failed to parse Traffic Policy, possibly malformed.")
+		r.Recorder.Eventf(policy, nil, v1.EventTypeWarning, EventTrafficPolicyParseFailed, "Validate", "Failed to parse Traffic Policy, possibly malformed.")
 		return ctrl.Result{}, err
 	}
 	if parsedTrafficPolicy.IsLegacyPolicy() {
-		r.Recorder.Eventf(policy, v1.EventTypeWarning, events.PolicyDeprecation, "Traffic Policy is using legacy directions: ['inbound', 'outbound']. Update to new phases: ['on_tcp_connect', 'on_http_request', 'on_http_response']")
+		r.Recorder.Eventf(policy, nil, v1.EventTypeWarning, EventPolicyDeprecation, "Validate", "Traffic Policy is using legacy directions: ['inbound', 'outbound']. Update to new phases: ['on_tcp_connect', 'on_http_request', 'on_http_response']")
 	}
 	if parsedTrafficPolicy.Enabled() != nil {
-		r.Recorder.Eventf(policy, v1.EventTypeWarning, events.PolicyDeprecation, "Traffic Policy has 'enabled' set. This is a legacy option that will stop being supported soon.")
+		r.Recorder.Eventf(policy, nil, v1.EventTypeWarning, EventPolicyDeprecation, "Validate", "Traffic Policy has 'enabled' set. This is a legacy option that will stop being supported soon.")
 	}
 	return managerdriver.HandleSyncResult(r.Driver.SyncEndpoints(ctx, r.Client))
@@ -114,7 +114,7 @@ var _ = BeforeSuite(func() {
 		Client:         k8sManager.GetClient(),
 		Scheme:         k8sManager.GetScheme(),
 		Log:            logf.Log.WithName("cloudendpoint-controller"),
-		Recorder:       k8sManager.GetEventRecorderFor("cloudendpoint-controller"),
+		Recorder:       k8sManager.GetEventRecorder("cloudendpoint-controller"),
 		NgrokClientset: mockClientset,
 		// Let SetupWithManager create the default domain manager
 		// We'll use internal domains in tests to bypass actual domain creation
@@ -53,7 +53,7 @@ import (
 	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	"k8s.io/utils/ptr"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/builder"
@@ -79,7 +79,7 @@ type ServiceReconciler struct {
 	client.Client
 	Log      logr.Logger
 	Scheme   *runtime.Scheme
-	Recorder record.EventRecorder
+	Recorder events.EventRecorder
 	ControllerLabels labels.ControllerLabelValues
@@ -281,7 +281,7 @@ func (r *ServiceReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
 	}
 	if len(svc.Spec.Ports) < 1 {
-		r.Recorder.Event(svc, corev1.EventTypeWarning, "NoPorts", "Unable to handle service with no ports")
+		r.Recorder.Eventf(svc, nil, corev1.EventTypeWarning, "NoPorts", "Reconcile", "Unable to handle service with no ports")
 		return ctrl.Result{}, nil
 	}
@@ -297,13 +297,13 @@ func (r *ServiceReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
 	// is not fatal, so just log it and an event and continue
 	if err != nil {
 		log.Error(err, "Failed to get mapping strategy annotation")
-		r.Recorder.Event(svc, corev1.EventTypeWarning, "FailedToGetMappingStrategy", err.Error())
+		r.Recorder.Eventf(svc, nil, corev1.EventTypeWarning, "FailedToGetMappingStrategy", "Reconcile", err.Error())
 	}
 	desired, err = r.buildEndpoints(ctx, svc, mappingStrategy)
 	if err != nil {
 		log.Error(err, "Failed to build desired endpoints")
-		r.Recorder.Event(svc, corev1.EventTypeWarning, "FailedToBuildEndpoints", err.Error())
+		r.Recorder.Eventf(svc, nil, corev1.EventTypeWarning, "FailedToBuildEndpoints", "Reconcile", err.Error())
 		return ctrl.Result{}, err
 	}
@@ -330,7 +330,7 @@ func (r *ServiceReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
 		return ctrl.Result{}, fmt.Errorf("failed to update service status: %w", err)
 	}
-	r.Recorder.Event(svc, corev1.EventTypeNormal, "Reconciled", "Successfully reconciled service and its ngrok resources")
+	r.Recorder.Eventf(svc, nil, corev1.EventTypeNormal, "Reconciled", "Reconcile", "Successfully reconciled service and its ngrok resources")
 	return ctrl.Result{}, nil
 }
@@ -450,7 +450,7 @@ func (r *ServiceReconciler) buildEndpoints(ctx context.Context, svc *corev1.Serv
 	listenerEndpointURL, err := r.getListenerURL(svc)
 	if err != nil {
-		r.Recorder.Event(svc, corev1.EventTypeWarning, "FailedToGetListenerURL", err.Error())
+		r.Recorder.Eventf(svc, nil, corev1.EventTypeWarning, "FailedToGetListenerURL", "Reconcile", err.Error())
 		return objects, err
 	}
@@ -472,7 +472,7 @@ func (r *ServiceReconciler) buildEndpoints(ctx context.Context, svc *corev1.Serv
 				Metadata:    fmt.Sprintf(`{"namespace":"%s","name":"%s"}`, svc.Namespace, svc.Name),
 			})
 			if err != nil {
-				r.Recorder.Event(svc, corev1.EventTypeWarning, "FailedToReserveTCPAddr", err.Error())
+				r.Recorder.Eventf(svc, nil, corev1.EventTypeWarning, "FailedToReserveTCPAddr", "Reconcile", err.Error())
 				return objects, err
 			}
@@ -487,7 +487,7 @@ func (r *ServiceReconciler) buildEndpoints(ctx context.Context, svc *corev1.Serv
 			// verifying that it exists.
 			parsedURL, parseErr := url.Parse(computedEndpointURL)
 			if parseErr != nil {
-				r.Recorder.Event(svc, corev1.EventTypeWarning, "FailedToParseComputedURL", parseErr.Error())
+				r.Recorder.Eventf(svc, nil, corev1.EventTypeWarning, "FailedToParseComputedURL", "Reconcile", parseErr.Error())
 				// If we can't parse the URL, we need to clear the computed URL annotation
 				if err := r.clearComputedURLAnnotation(ctx, svc); err != nil {
 					return objects, err
@@ -502,7 +502,7 @@ func (r *ServiceReconciler) buildEndpoints(ctx context.Context, svc *corev1.Serv
 					return objects, err
 				}
 				if !reserved {
-					r.Recorder.Event(svc, corev1.EventTypeWarning, "TCPAddrNotReserved", "The computed TCP address is not reserved, recomputing")
+					r.Recorder.Eventf(svc, nil, corev1.EventTypeWarning, "TCPAddrNotReserved", "Reconcile", "The computed TCP address is not reserved, recomputing")
 					if err := r.clearComputedURLAnnotation(ctx, svc); err != nil {
 						return objects, err
 					}
@@ -671,7 +671,6 @@ func (r serviceSubresourceReconcilers) GetOwnedResources(ctx context.Context, c
 func (r serviceSubresourceReconcilers) Reconcile(ctx context.Context, c client.Client, objects []client.Object) error {
 	g, gctx := errgroup.WithContext(ctx)
 	for _, srr := range r {
 		srr := srr
 		g.Go(func() error {
 			return srr.Reconcile(gctx, c, objects)
 		})
@@ -682,7 +681,6 @@ func (r serviceSubresourceReconcilers) Reconcile(ctx context.Context, c client.C
 func (r serviceSubresourceReconcilers) UpdateServiceStatus(ctx context.Context, c client.Client, svc *corev1.Service, o client.Object) error {
 	g, gctx := errgroup.WithContext(ctx)
 	for _, srr := range r {
 		srr := srr
 		g.Go(func() error {
 			return srr.UpdateServiceStatus(gctx, c, svc, o)
 		})
@@ -98,7 +98,7 @@ func SetServiceType(svcType corev1.ServiceType) ServiceModifier {
 func SetLoadBalancerClass(lbClass string) ServiceModifier {
 	return func(svc *corev1.Service) {
-		svc.Spec.LoadBalancerClass = ptr.To(lbClass)
+		svc.Spec.LoadBalancerClass = new(lbClass)
 	}
 }
@@ -627,7 +627,7 @@ var _ = Describe("ServiceController", func() {
 						fetchedAep := &aeps.Items[0]
 						fetchedAep.Status.DomainRef = &ngrokv1alpha1.K8sObjectRefOptionalNamespace{
 							Name:      domainName,
-							Namespace: ptr.To(namespace),
+							Namespace: new(namespace),
 						}
 						return k8sClient.Status().Update(ctx, fetchedAep)
 					}, timeout, interval).Should(Succeed())
@@ -740,7 +740,7 @@ var _ = Describe("ServiceController", func() {
 						fetchedClep := &cleps.Items[0]
 						fetchedClep.Status.DomainRef = &ngrokv1alpha1.K8sObjectRefOptionalNamespace{
 							Name:      domainName,
-							Namespace: ptr.To(namespace),
+							Namespace: new(namespace),
 						}
 						return k8sClient.Status().Update(ctx, fetchedClep)
 					}, timeout, interval).Should(Succeed())
@@ -859,7 +859,7 @@ var _ = Describe("ServiceController", func() {
 									Kind:       "Service",
 									Name:       fetched.Name,
 									UID:        fetched.UID,
-									Controller: ptr.To(true),
+									Controller: new(true),
 								},
 							},
 						},
@@ -124,7 +124,7 @@ var _ = BeforeSuite(func() {
 	err = (&ServiceReconciler{
 		Client:           k8sManager.GetClient(),
 		Log:              logf.Log.WithName("controllers").WithName("Service"),
-		Recorder:         k8sManager.GetEventRecorderFor("service-controller"),
+		Recorder:         k8sManager.GetEventRecorder("service-controller"),
 		Scheme:           k8sManager.GetScheme(),
 		TCPAddresses:     tcpAddrsClient,
 		ControllerLabels: labels.NewControllerLabelValues(controllerLabelNamespace, controllerLabelName),
@@ -26,6 +26,8 @@ SOFTWARE.
 package controller
 import (
 	"maps"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
@@ -50,9 +52,7 @@ func AddAnnotations(o client.Object, annotations map[string]string) {
 		existing = make(map[string]string)
 	}
-	for k, v := range annotations {
+	maps.Copy(existing, annotations)
 		existing[k] = v
 	}
 	o.SetAnnotations(existing)
 }
@@ -9,7 +9,7 @@ import (
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	"k8s.io/client-go/util/retry"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -72,12 +72,12 @@ func WithControllerLabels(clv labels.ControllerLabelValues) ManagerOption {
 // Manager handles domain creation and condition management
 type Manager struct {
 	Client                     client.Client
-	Recorder                   record.EventRecorder
+	Recorder                   events.EventRecorder
 	defaultDomainReclaimPolicy *ingressv1alpha1.DomainReclaimPolicy
 	controllerLabels           *labels.ControllerLabelValues
 }
-func NewManager(client client.Client, recorder record.EventRecorder, opts ...ManagerOption) (*Manager, error) {
+func NewManager(client client.Client, recorder events.EventRecorder, opts ...ManagerOption) (*Manager, error) {
 	m := &Manager{
 		Client:   client,
 		Recorder: recorder,
@@ -9,7 +9,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
@@ -31,7 +31,7 @@ func newTestManager(t *testing.T, objs ...client.Object) (*Manager, client.Clien
 	t.Helper()
 	scheme := setupScheme()
 	c := fake.NewClientBuilder().WithScheme(scheme).WithObjects(objs...).Build()
-	m, err := NewManager(c, record.NewFakeRecorder(10),
+	m, err := NewManager(c, events.NewFakeRecorder(10),
 		WithControllerLabels(
 			labels.ControllerLabelValues{
 				Namespace: "test-namespace",
@@ -32,7 +32,7 @@ import (
 	"github.com/go-logr/logr"
 	ngrokv1alpha1 "github.com/ngrok/ngrok-operator/api/ngrok/v1alpha1"
 	v1 "k8s.io/api/core/v1"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
@@ -54,7 +54,7 @@ type OrchestratorConfig struct {
 	// respects cache.Options.DefaultNamespaces if configured)
 	Client client.Client
 	// Recorder is the event recorder for drain-related events
-	Recorder record.EventRecorder
+	Recorder events.EventRecorder
 	// Log is the logger for drain operations
 	Log logr.Logger
 	// K8sOpNamespace is the operator's namespace (used for StateChecker)
@@ -68,7 +68,7 @@ type OrchestratorConfig struct {
 // the drain workflow and the KubernetesOperator lifecycle management.
 type Orchestrator struct {
 	client       client.Client
-	recorder     record.EventRecorder
+	recorder     events.EventRecorder
 	log          logr.Logger
 	stateChecker *StateChecker
 }
@@ -118,7 +118,7 @@ func (o *Orchestrator) HandleDrain(ctx context.Context, ko *ngrokv1alpha1.Kubern
 	time.Sleep(2 * time.Second)
 	log.Info("Running drain process")
-	o.recorder.Event(ko, v1.EventTypeNormal, "DrainStarted", "Starting drain of all managed resources")
+	o.recorder.Eventf(ko, nil, v1.EventTypeNormal, "DrainStarted", "Drain", "Starting drain of all managed resources")
 	// Create and run the drainer
 	drainer := &Drainer{
@@ -135,7 +135,7 @@ func (o *Orchestrator) HandleDrain(ctx context.Context, ko *ngrokv1alpha1.Kubern
 		if statusErr := o.client.Status().Update(ctx, ko); statusErr != nil {
 			log.Error(statusErr, "Failed to update drain status after error")
 		}
-		o.recorder.Event(ko, v1.EventTypeWarning, "DrainFailed", fmt.Sprintf("Drain failed: %v", err))
+		o.recorder.Eventf(ko, nil, v1.EventTypeWarning, "DrainFailed", "Drain", fmt.Sprintf("Drain failed: %v", err))
 		return OutcomeFailed, err
 	}
@@ -162,7 +162,7 @@ func (o *Orchestrator) HandleDrain(ctx context.Context, ko *ngrokv1alpha1.Kubern
 	if err := o.client.Status().Update(ctx, ko); err != nil {
 		return OutcomeFailed, fmt.Errorf("failed to update drain completed status: %w", err)
 	}
-	o.recorder.Event(ko, v1.EventTypeNormal, "DrainCompleted", "All managed resources have been drained")
+	o.recorder.Eventf(ko, nil, v1.EventTypeNormal, "DrainCompleted", "Drain", "All managed resources have been drained")
 	log.Info("Drain completed successfully", "progress", result.Progress())
 	return OutcomeComplete, nil
@@ -39,7 +39,7 @@ import (
 	netv1 "k8s.io/api/networking/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
@@ -68,7 +68,7 @@ func TestOrchestrator_State(t *testing.T) {
 	orchestrator := NewOrchestrator(OrchestratorConfig{
 		Client:         client,
-		Recorder:       record.NewFakeRecorder(10),
+		Recorder:       events.NewFakeRecorder(10),
 		Log:            logr.Discard(),
 		K8sOpNamespace: "ngrok-operator",
 		K8sOpName:      "my-release",
@@ -103,7 +103,7 @@ func TestOrchestrator_HandleDrain_CompletesSuccessfully(t *testing.T) {
 		WithStatusSubresource(ko).
 		Build()
-	recorder := record.NewFakeRecorder(10)
+	recorder := events.NewFakeRecorder(10)
 	orchestrator := NewOrchestrator(OrchestratorConfig{
 		Client:         client,
 		Recorder:       recorder,
@@ -143,7 +143,7 @@ func TestOrchestrator_HandleDrain_SetsStatusToDraining(t *testing.T) {
 		WithStatusSubresource(ko).
 		Build()
-	recorder := record.NewFakeRecorder(10)
+	recorder := events.NewFakeRecorder(10)
 	orchestrator := NewOrchestrator(OrchestratorConfig{
 		Client:         client,
 		Recorder:       recorder,
@@ -185,7 +185,7 @@ func TestOrchestrator_HandleDrain_AlreadyCompleted(t *testing.T) {
 		WithStatusSubresource(ko).
 		Build()
-	recorder := record.NewFakeRecorder(10)
+	recorder := events.NewFakeRecorder(10)
 	orchestrator := NewOrchestrator(OrchestratorConfig{
 		Client:         fakeClient,
 		Recorder:       recorder,
@@ -233,7 +233,7 @@ func TestOrchestrator_HandleDrain_TransientErrors_OutcomeRetry(t *testing.T) {
 		Client: fakeClient,
 	}
-	recorder := record.NewFakeRecorder(10)
+	recorder := events.NewFakeRecorder(10)
 	orchestrator := NewOrchestrator(OrchestratorConfig{
 		Client:         errClient,
 		Recorder:       recorder,
@@ -279,7 +279,7 @@ func TestOrchestrator_HandleDrain_ListError_OutcomeRetry(t *testing.T) {
 	errClient := &listErrorClient{Client: fakeClient}
-	recorder := record.NewFakeRecorder(10)
+	recorder := events.NewFakeRecorder(10)
 	orchestrator := NewOrchestrator(OrchestratorConfig{
 		Client:         errClient,
 		Recorder:       recorder,
@@ -39,7 +39,7 @@ func NewInvalidAnnotationConfiguration(name string, reason string) error {
 }
 // NewInvalidAnnotationContent returns a new InvalidContent error
-func NewInvalidAnnotationContent(name string, val interface{}) error {
+func NewInvalidAnnotationContent(name string, val any) error {
 	return InvalidContent{
 		Name: fmt.Sprintf("the annotation %v does not contain a valid value (%v)", name, val),
 	}
@@ -99,6 +99,6 @@ func New(m string) error {
 // Errorf formats according to a format specifier and returns the string
 // as a value that satisfies error.
-func Errorf(format string, args ...interface{}) error {
+func Errorf(format string, args ...any) error {
 	return fmt.Errorf(format, args...)
 }
@@ -1,31 +0,0 @@
 /*
 MIT License
 Copyright (c) 2024 ngrok, Inc.
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 */
 package events
 // Policy/Traffic Policy event reason list
 const (
 	PolicyDeprecation        = "PolicyDeprecation"
 	TrafficPolicyParseFailed = "TrafficPolicyParseFailed"
 )
@@ -2,7 +2,9 @@ package ir
 import (
 	"fmt"
 	"slices"
 	"sort"
 	"strings"
 	common "github.com/ngrok/ngrok-operator/api/common/v1alpha1"
 	"github.com/ngrok/ngrok-operator/internal/trafficpolicy"
@@ -271,14 +273,15 @@ const (
 type IRServiceKey string
 func (s IRService) Key() IRServiceKey {
-	key := fmt.Sprintf("%s/%s/%s/%d", s.UID, s.Namespace, s.Name, s.Port)
+	var key strings.Builder
 	key.WriteString(fmt.Sprintf("%s/%s/%s/%d", s.UID, s.Namespace, s.Name, s.Port))
 	if s.Protocol != nil {
-		key += fmt.Sprintf("/%s", *s.Protocol)
+		key.WriteString(fmt.Sprintf("/%s", *s.Protocol))
 	}
 	for _, clientCertRef := range s.ClientCertRefs {
-		key += fmt.Sprintf("/%s.%s", clientCertRef.Name, clientCertRef.Namespace)
+		key.WriteString(fmt.Sprintf("/%s.%s", clientCertRef.Name, clientCertRef.Namespace))
 	}
-	return IRServiceKey(key)
+	return IRServiceKey(key.String())
 }
 type IRObjectRef struct {
@@ -432,11 +435,11 @@ func headersToString(headers []IRHeaderMatch) string {
 		}
 		return hCopy[i].Value < hCopy[j].Value
 	})
-	s := ""
+	var s strings.Builder
 	for _, h := range hCopy {
-		s += h.Name + ":" + string(h.ValueType) + ":" + h.Value + ";"
+		s.WriteString(h.Name + ":" + string(h.ValueType) + ":" + h.Value + ";")
 	}
-	return s
+	return s.String()
 }
 // queryParamsToString produces a normalized string representation for query parameter matchers.
@@ -454,29 +457,25 @@ func queryParamsToString(qps []IRQueryParamMatch) string {
 		}
 		return qpCopy[i].Value < qpCopy[j].Value
 	})
-	s := ""
+	var s strings.Builder
 	for _, qp := range qpCopy {
-		s += qp.Name + ":" + string(qp.ValueType) + ":" + qp.Value + ";"
+		s.WriteString(qp.Name + ":" + string(qp.ValueType) + ":" + qp.Value + ";")
 	}
-	return s
+	return s.String()
 }
 // addOwningIngress will append a new namespaced name to the list of owning ingresses for a virtual host
 func (h *IRVirtualHost) AddOwningResource(new OwningResource) {
-	for _, current := range h.OwningResources {
+	if slices.Contains(h.OwningResources, new) {
-		if current == new {
+		return
 			return
 		}
 	}
 	h.OwningResources = append(h.OwningResources, new)
 }
 // addOwningIngress will append a new namespaced name to the list of owning ingresses for an upstream
 func (h *IRUpstream) AddOwningResource(new OwningResource) {
-	for _, current := range h.OwningResources {
+	if slices.Contains(h.OwningResources, new) {
-		if current == new {
+		return
 			return
 		}
 	}
 	h.OwningResources = append(h.OwningResources, new)
 }
@@ -4,7 +4,6 @@ import (
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"k8s.io/utils/ptr"
 )
 func TestSortRoutes(t *testing.T) {
@@ -18,28 +17,28 @@ func TestSortRoutes(t *testing.T) {
 			routes: []*IRRoute{
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/foo"),
+						Path:     new("/foo"),
-						PathType: ptr.To(IRPathType_Prefix),
+						PathType: new(IRPathType_Prefix),
 					},
 				},
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/bar"),
+						Path:     new("/bar"),
-						PathType: ptr.To(IRPathType_Exact),
+						PathType: new(IRPathType_Exact),
 					},
 				},
 			},
 			expectedOrder: []*IRRoute{
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/bar"),
+						Path:     new("/bar"),
-						PathType: ptr.To(IRPathType_Exact),
+						PathType: new(IRPathType_Exact),
 					},
 				},
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/foo"),
+						Path:     new("/foo"),
-						PathType: ptr.To(IRPathType_Prefix),
+						PathType: new(IRPathType_Prefix),
 					},
 				},
 			},
@@ -49,28 +48,28 @@ func TestSortRoutes(t *testing.T) {
 			routes: []*IRRoute{
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/longer"),
+						Path:     new("/longer"),
-						PathType: ptr.To(IRPathType_Exact),
+						PathType: new(IRPathType_Exact),
 					},
 				},
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/short"),
+						Path:     new("/short"),
-						PathType: ptr.To(IRPathType_Exact),
+						PathType: new(IRPathType_Exact),
 					},
 				},
 			},
 			expectedOrder: []*IRRoute{
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/longer"),
+						Path:     new("/longer"),
-						PathType: ptr.To(IRPathType_Exact),
+						PathType: new(IRPathType_Exact),
 					},
 				},
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/short"),
+						Path:     new("/short"),
-						PathType: ptr.To(IRPathType_Exact),
+						PathType: new(IRPathType_Exact),
 					},
 				},
 			},
@@ -80,28 +79,28 @@ func TestSortRoutes(t *testing.T) {
 			routes: []*IRRoute{
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/b"),
+						Path:     new("/b"),
-						PathType: ptr.To(IRPathType_Exact),
+						PathType: new(IRPathType_Exact),
 					},
 				},
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/a"),
+						Path:     new("/a"),
-						PathType: ptr.To(IRPathType_Exact),
+						PathType: new(IRPathType_Exact),
 					},
 				},
 			},
 			expectedOrder: []*IRRoute{
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/a"),
+						Path:     new("/a"),
-						PathType: ptr.To(IRPathType_Exact),
+						PathType: new(IRPathType_Exact),
 					},
 				},
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/b"),
+						Path:     new("/b"),
-						PathType: ptr.To(IRPathType_Exact),
+						PathType: new(IRPathType_Exact),
 					},
 				},
 			},
@@ -165,7 +164,7 @@ func TestSortRoutes(t *testing.T) {
 			routes: []*IRRoute{
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Method: ptr.To(IRMethodMatch_Get),
+						Method: new(IRMethodMatch_Get),
 					},
 				},
 				{
@@ -175,7 +174,7 @@ func TestSortRoutes(t *testing.T) {
 			expectedOrder: []*IRRoute{
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Method: ptr.To(IRMethodMatch_Get),
+						Method: new(IRMethodMatch_Get),
 					},
 				},
 				{
@@ -189,15 +188,15 @@ func TestSortRoutes(t *testing.T) {
 				// Route A: has path "/a", exact, no headers, no query, no method.
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/a"),
+						Path:     new("/a"),
-						PathType: ptr.To(IRPathType_Exact),
+						PathType: new(IRPathType_Exact),
 					},
 				},
 				// Route B: has path "/a", exact, with headers.
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/a"),
+						Path:     new("/a"),
-						PathType: ptr.To(IRPathType_Exact),
+						PathType: new(IRPathType_Exact),
 						Headers: []IRHeaderMatch{
 							{Name: "X", Value: "1", ValueType: IRStringValueType_Exact},
 						},
@@ -214,7 +213,7 @@ func TestSortRoutes(t *testing.T) {
 				// Route D: no path, no headers, with method.
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Method: ptr.To(IRMethodMatch_Get),
+						Method: new(IRMethodMatch_Get),
 					},
 				},
 				// Route E: no path, no headers, no method.
@@ -231,8 +230,8 @@ func TestSortRoutes(t *testing.T) {
 				// Route B: has path "/a", exact, with headers.
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/a"),
+						Path:     new("/a"),
-						PathType: ptr.To(IRPathType_Exact),
+						PathType: new(IRPathType_Exact),
 						Headers: []IRHeaderMatch{
 							{Name: "X", Value: "1", ValueType: IRStringValueType_Exact},
 						},
@@ -241,8 +240,8 @@ func TestSortRoutes(t *testing.T) {
 				// Route A: has path "/a", exact, no headers.
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/a"),
+						Path:     new("/a"),
-						PathType: ptr.To(IRPathType_Exact),
+						PathType: new(IRPathType_Exact),
 					},
 				},
 				// Then, among routes with no path, route with headers (C)
@@ -256,7 +255,7 @@ func TestSortRoutes(t *testing.T) {
 				// Then, route with method (D)
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Method: ptr.To(IRMethodMatch_Get),
+						Method: new(IRMethodMatch_Get),
 					},
 				},
 				// Then, route with nothing (E)
@@ -274,16 +273,16 @@ func TestSortRoutes(t *testing.T) {
 				},
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/test"),
+						Path:     new("/test"),
-						PathType: ptr.To(IRPathType_Exact),
+						PathType: new(IRPathType_Exact),
 					},
 				},
 			},
 			expectedOrder: []*IRRoute{
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/test"),
+						Path:     new("/test"),
-						PathType: ptr.To(IRPathType_Exact),
+						PathType: new(IRPathType_Exact),
 					},
 				},
 				{
@@ -296,8 +295,8 @@ func TestSortRoutes(t *testing.T) {
 			routes: []*IRRoute{
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/test"),
+						Path:     new("/test"),
-						PathType: ptr.To(IRPathType_Exact),
+						PathType: new(IRPathType_Exact),
 					},
 				},
 				{
@@ -307,8 +306,8 @@ func TestSortRoutes(t *testing.T) {
 			expectedOrder: []*IRRoute{
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/test"),
+						Path:     new("/test"),
-						PathType: ptr.To(IRPathType_Exact),
+						PathType: new(IRPathType_Exact),
 					},
 				},
 				{
@@ -327,16 +326,16 @@ func TestSortRoutes(t *testing.T) {
 				},
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/test"),
+						Path:     new("/test"),
-						PathType: ptr.To(IRPathType_Exact),
+						PathType: new(IRPathType_Exact),
 					},
 				},
 			},
 			expectedOrder: []*IRRoute{
 				{
 					HTTPMatchCriteria: &IRHTTPMatch{
-						Path:     ptr.To("/test"),
+						Path:     new("/test"),
-						PathType: ptr.To(IRPathType_Exact),
+						PathType: new(IRPathType_Exact),
 					},
 				},
 				{
@@ -435,7 +434,6 @@ func TestAddOwningResource(t *testing.T) {
 	}
 	for _, tc := range testCases {
 		tc := tc
 		t.Run("IRVirtualHost/"+tc.name, func(t *testing.T) {
 			host := &IRVirtualHost{OwningResources: tc.initial}
 			host.AddOwningResource(tc.newResource)
@@ -277,8 +277,8 @@ var _ = Describe("DomainClient", func() {
 			BeforeEach(func() {
 				domainUpdate = &ngrok.ReservedDomainUpdate{
 					ID:          createdDomain.ID,
-					Metadata:    ngrok.String("new-metadata"),
+					Metadata:    new("new-metadata"),
-					Description: ngrok.String("new-description"),
+					Description: new("new-description"),
 				}
 			})
@@ -295,8 +295,8 @@ var _ = Describe("DomainClient", func() {
 			BeforeEach(func() {
 				domainUpdate = &ngrok.ReservedDomainUpdate{
 					ID:          "non-existing-id",
-					Metadata:    ngrok.String("new-metadata"),
+					Metadata:    new("new-metadata"),
-					Description: ngrok.String("new-description"),
+					Description: new("new-description"),
 				}
 			})
@@ -7,7 +7,6 @@ import (
 	"github.com/ngrok/ngrok-operator/internal/mocks/nmockapi"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	"k8s.io/utils/ptr"
 )
 var _ = Describe("EndpointsClient", func() {
@@ -37,7 +36,7 @@ var _ = Describe("EndpointsClient", func() {
 		When("the endpoint exists", func() {
 			BeforeEach(func() {
 				endpoint, err := endpointsClient.Create(ctx, &ngrok.EndpointCreate{
-					Description: ptr.To("test-endpoint"),
+					Description: new("test-endpoint"),
 				})
 				Expect(err).NotTo(HaveOccurred())
 				id = endpoint.ID
@@ -81,12 +80,12 @@ var _ = Describe("EndpointsClient", func() {
 			BeforeEach(func() {
 				_, err := endpointsClient.Create(ctx, &ngrok.EndpointCreate{
 					URL:         "http://example1.com",
-					Description: ptr.To("test-endpoint-1"),
+					Description: new("test-endpoint-1"),
 				})
 				Expect(err).NotTo(HaveOccurred())
 				_, err = endpointsClient.Create(ctx, &ngrok.EndpointCreate{
 					URL:         "http://example2.com",
-					Description: ptr.To("test-endpoint-2"),
+					Description: new("test-endpoint-2"),
 				})
 				Expect(err).NotTo(HaveOccurred())
 			})
@@ -120,7 +119,7 @@ var _ = Describe("EndpointsClient", func() {
 			BeforeEach(func() {
 				endpointCreate = &ngrok.EndpointCreate{
 					URL:         "http://example.com",
-					Description: ptr.To("valid-endpoint"),
+					Description: new("valid-endpoint"),
 				}
 			})
@@ -136,7 +135,7 @@ var _ = Describe("EndpointsClient", func() {
 			BeforeEach(func(ctx SpecContext) {
 				endpointCreate = &ngrok.EndpointCreate{
 					URL:         "http://example.com",
-					Description: ptr.To("endpoint-1"),
+					Description: new("endpoint-1"),
 				}
 				_, err := endpointsClient.Create(ctx, endpointCreate)
 				Expect(err).NotTo(HaveOccurred())
@@ -161,7 +160,7 @@ var _ = Describe("EndpointsClient", func() {
 		When("the endpoint exists", func() {
 			BeforeEach(func() {
 				endpoint, err := endpointsClient.Create(ctx, &ngrok.EndpointCreate{
-					Description: ptr.To("endpoint-to-delete"),
+					Description: new("endpoint-to-delete"),
 				})
 				Expect(err).NotTo(HaveOccurred())
 				id = endpoint.ID
@@ -334,7 +334,7 @@ func file_agent_conn_header_proto_init() {
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			GoPackagePath: reflect.TypeFor[x]().PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_agent_conn_header_proto_rawDesc), len(file_agent_conn_header_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   5,
@@ -86,7 +86,7 @@ func NewCacheStores(logger logr.Logger) CacheStores {
 	}
 }
-func keyFunc(obj interface{}) (string, error) {
+func keyFunc(obj any) (string, error) {
 	v := reflect.Indirect(reflect.ValueOf(obj))
 	name := v.FieldByName("Name")
 	namespace := v.FieldByName("Namespace")
@@ -97,14 +97,14 @@ func getKey(name, namespace string) string {
 	return namespace + "/" + name
 }
-func clusterResourceKeyFunc(obj interface{}) (string, error) {
+func clusterResourceKeyFunc(obj any) (string, error) {
 	v := reflect.Indirect(reflect.ValueOf(obj))
 	return v.FieldByName("Name").String(), nil
 }
 // Get checks whether or not there's already some version of the provided object present in the cache.
 // The CacheStore must be initialized (see NewCacheStores()) or this will panic.
-func (c CacheStores) Get(obj runtime.Object) (item interface{}, exists bool, err error) {
+func (c CacheStores) Get(obj runtime.Object) (item any, exists bool, err error) {
 	c.l.RLock()
 	defer c.l.RUnlock()
@@ -112,7 +112,7 @@ func New(cs CacheStores, controllerName string, logger logr.Logger, opts ...Stor
 }
 // Get proxies the call to the underlying store.
-func (s Store) Get(obj runtime.Object) (interface{}, bool, error) {
+func (s Store) Get(obj runtime.Object) (any, bool, error) {
 	return s.stores.Get(obj)
 }
@@ -229,7 +229,7 @@ func NewHTTPRoute(name string, namespace string) gatewayv1.HTTPRoute {
 						{
 							Path: &gatewayv1.HTTPPathMatch{
 								Type:  ptr.To(gatewayv1.PathMatchPathPrefix),
-								Value: ptr.To("/"),
+								Value: new("/"),
 							},
 						},
 					},
@@ -53,7 +53,7 @@ func TestTrafficPolicy(t *testing.T) {
 			Expressions: []string{"[1,2,3].all(x, x > 0)"},
 			Actions: []Action{
 				NewRestricIPsActionFromIPPolicies([]string{"ipp_123", "ipp_456"}),
-				NewTerminateTLSAction(TLSTerminationConfig{MinVersion: ptr.To("1.2")}),
+				NewTerminateTLSAction(TLSTerminationConfig{MinVersion: new("1.2")}),
 			},
 		},
 	)
@@ -265,7 +265,6 @@ func TestTrafficPolicyDeepCopy(t *testing.T) {
 	}
 	for _, tc := range testCases {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			copy, err := tc.original.DeepCopy()
 			require.NoError(t, err, "DeepCopy should not return an error")
@@ -1,12 +1,12 @@
 package util
 import maps0 "maps"
 // MergeMaps merges multiple maps into a single map giving precedence to the last map in the list
 func MergeMaps[K comparable, V any](maps ...map[K]V) map[K]V {
 	result := make(map[K]V)
 	for _, m := range maps {
-		for k, v := range m {
+		maps0.Copy(result, m)
 			result[k] = v
 		}
 	}
 	return result
 }
@@ -4,9 +4,11 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
 	"maps"
 	"reflect"
 	"strings"
 	"sync"
 	"time"
 	"github.com/go-logr/logr"
 	"golang.org/x/sync/errgroup"
@@ -17,7 +19,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/tools/events"
 	"k8s.io/client-go/util/retry"
 	"k8s.io/utils/ptr"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -65,7 +67,7 @@ type Driver struct {
 	defaultDomainReclaimPolicy *ingressv1alpha1.DomainReclaimPolicy
-	recorder record.EventRecorder
+	recorder events.EventRecorder
 	// drainState is used to check if the operator is draining.
 	// If draining, Sync() returns early to prevent creating new resources.
@@ -125,7 +127,7 @@ func WithDefaultDomainReclaimPolicy(policy ingressv1alpha1.DomainReclaimPolicy)
 	}
 }
-func WithEventRecorder(recorder record.EventRecorder) DriverOpt {
+func WithEventRecorder(recorder events.EventRecorder) DriverOpt {
 	return func(d *Driver) {
 		d.recorder = recorder
 	}
@@ -191,9 +193,7 @@ func (d *Driver) GetStore() store.Storer {
 func (d *Driver) setNgrokMetadataOwner(owner string, customNgrokMetadata map[string]string) (string, error) {
 	metaData := make(map[string]string)
-	for k, v := range customNgrokMetadata {
+	maps.Copy(metaData, customNgrokMetadata)
 		metaData[k] = v
 	}
 	if _, ok := metaData["owned-by"]; !ok {
 		metaData["owned-by"] = owner
 	}
@@ -205,7 +205,7 @@ func (d *Driver) setNgrokMetadataOwner(owner string, customNgrokMetadata map[str
 	return string(jsonString), nil
 }
-func listObjectsForType(ctx context.Context, client client.Reader, v interface{}, listOpts ...client.ListOption) ([]client.Object, error) {
+func listObjectsForType(ctx context.Context, client client.Reader, v any, listOpts ...client.ListOption) ([]client.Object, error) {
 	switch v.(type) {
 	// ----------------------------------------------------------------------------
@@ -310,7 +310,7 @@ func listObjectsForType(ctx context.Context, client client.Reader, v interface{}
 // - CloudEndpoints
 // When the sync method becomes a background process, this likely won't be needed anymore
 func (d *Driver) Seed(ctx context.Context, c client.Reader, listOpts ...client.ListOption) error {
-	typesToSeed := []interface{}{
+	typesToSeed := []any{
 		&netv1.Ingress{},
 		&netv1.IngressClass{},
 		&corev1.Service{},
@@ -559,18 +559,23 @@ func (d *Driver) syncStart(partial bool) (bool, func(ctx context.Context) error)
 // ErrSyncRequeue is a sentinel returned by the sync debouncer to indicate that
 // a sync completed while the caller was waiting, and the caller should requeue
 // to ensure its store changes are captured in a subsequent sync. This is not a
-// real error — reconcilers should convert it to ctrl.Result{Requeue: true}
+// real error — reconcilers should convert it to ctrl.Result{RequeueAfter: syncRequeueDelay}
 // using HandleSyncResult.
 var ErrSyncRequeue = errors.New("sync requeue requested")
 // syncRequeueDelay is the duration used by HandleSyncResult when requeueing
 // after a debounced sync. A short delay avoids tight retry loops while still
 // processing missed state changes promptly.
 const syncRequeueDelay = 100 * time.Millisecond
 // HandleSyncResult converts a Sync or SyncEndpoints error into a
 // controller-runtime reconcile result. If the error is ErrSyncRequeue it
-// returns ctrl.Result{Requeue: true} with a nil error so controller-runtime
+// returns ctrl.Result{RequeueAfter: syncRequeueDelay} with a nil error so
-// requeues without logging an error or applying exponential backoff. Real
+// controller-runtime requeues without logging an error or applying exponential
-// errors are passed through unchanged.
+// backoff. Real errors are passed through unchanged.
 func HandleSyncResult(err error) (ctrl.Result, error) {
 	if err == ErrSyncRequeue {
-		return ctrl.Result{Requeue: true}, nil
+		return ctrl.Result{RequeueAfter: syncRequeueDelay}, nil
 	}
 	return ctrl.Result{}, err
 }
@@ -770,8 +775,10 @@ func (d *Driver) recordDomainEventsForIngress(ingress *netv1.Ingress, domains ma
 		if readyCondition.Status == metav1.ConditionFalse {
 			d.recorder.Eventf(
 				ingress,
 				nil,
 				corev1.EventTypeWarning,
 				"DomainNotReady",
 				"Reconcile",
 				"Domain %q is not ready: %s",
 				rule.Host,
 				readyCondition.Message,
@@ -1120,9 +1127,7 @@ func (d *Driver) handleHTTPHeaderFilterAdd(headersToAdd []gatewayv1.HTTPHeader,
 	}
 	if requestRedirectHeaders != nil {
-		for k, v := range config.Headers {
+		maps.Copy(requestRedirectHeaders, config.Headers)
 			requestRedirectHeaders[k] = v
 		}
 	}
 	addHeaders, err := json.Marshal(config)
@@ -14,7 +14,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/tools/record"
 	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
@@ -22,6 +21,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/intstr"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	"k8s.io/client-go/tools/events"
 	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
 	common "github.com/ngrok/ngrok-operator/api/common/v1alpha1"
@@ -350,7 +350,7 @@ var _ = Describe("Driver", func() {
 			When("The appProtocol is unknown", func() {
 				BeforeEach(func() {
 					// Set an unknown appProtocol on the httpService
-					httpService.Spec.Ports[0].AppProtocol = ptr.To("unknown")
+					httpService.Spec.Ports[0].AppProtocol = new("unknown")
 					// Modify the ingress to include the httpService
 					setIngressTargetService(ingress, httpService)
 				})
@@ -370,7 +370,7 @@ var _ = Describe("Driver", func() {
 			When("The appProtocol is http", func() {
 				BeforeEach(func() {
 					// Set the appProtocol on the httpService
-					httpService.Spec.Ports[0].AppProtocol = ptr.To("http")
+					httpService.Spec.Ports[0].AppProtocol = new("http")
 					// Modify the ingress to include the httpService
 					setIngressTargetService(ingress, httpService)
 				})
@@ -389,7 +389,7 @@ var _ = Describe("Driver", func() {
 			When("The appProtocol is k8s.ngrok.com/http2", func() {
 				BeforeEach(func() {
 					// Set the appProtocol on the httpService
-					httpsService.Spec.Ports[0].AppProtocol = ptr.To("k8s.ngrok.com/http2")
+					httpsService.Spec.Ports[0].AppProtocol = new("k8s.ngrok.com/http2")
 					// Modify the ingress to include the httpsService
 					setIngressTargetService(ingress, httpsService)
@@ -409,7 +409,7 @@ var _ = Describe("Driver", func() {
 			When("The appProtocol is kubernetes.io/h2c", func() {
 				BeforeEach(func() {
 					// Set the appProtocol on the httpService
-					httpsService.Spec.Ports[0].AppProtocol = ptr.To("kubernetes.io/h2c")
+					httpsService.Spec.Ports[0].AppProtocol = new("kubernetes.io/h2c")
 					// Modify the ingress to include the httpsService
 					setIngressTargetService(ingress, httpsService)
@@ -564,7 +564,7 @@ var _ = Describe("Driver", func() {
 								Actions: []trafficpolicy.Action{
 									{
 										Type:   "compress-response",
-										Config: map[string]interface{}{},
+										Config: map[string]any{},
 									},
 								},
 							},
@@ -599,7 +599,7 @@ var _ = Describe("Driver", func() {
 								Actions: []trafficpolicy.Action{
 									{
 										Type:   "compress-response",
-										Config: map[string]interface{}{},
+										Config: map[string]any{},
 									},
 								},
 							},
@@ -1253,20 +1253,20 @@ var _ = Describe("Driver", func() {
 		It("HandleSyncResult converts ErrSyncRequeue to Requeue", func() {
 			result, err := HandleSyncResult(ErrSyncRequeue)
 			Expect(err).To(BeNil())
-			Expect(result.Requeue).To(BeTrue())
+			Expect(result.RequeueAfter).To(BeNumerically(">", 0))
 		})
 		It("HandleSyncResult passes through real errors", func() {
 			realErr := errors.New("something went wrong")
 			result, err := HandleSyncResult(realErr)
 			Expect(err).To(Equal(realErr))
-			Expect(result.Requeue).To(BeFalse())
+			Expect(result.RequeueAfter).To(BeZero())
 		})
 		It("HandleSyncResult passes through nil", func() {
 			result, err := HandleSyncResult(nil)
 			Expect(err).To(BeNil())
-			Expect(result.Requeue).To(BeFalse())
+			Expect(result.RequeueAfter).To(BeZero())
 		})
 	})
@@ -1698,14 +1698,14 @@ func TestExtractPolicy(t *testing.T) {
 var _ = Describe("RecordDomainEventsForIngress", func() {
 	var driver *Driver
-	var fakeRecorder *record.FakeRecorder
+	var fakeRecorder *events.FakeRecorder
 	var scheme = runtime.NewScheme()
 	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
 	utilruntime.Must(ingressv1alpha1.AddToScheme(scheme))
 	BeforeEach(func() {
-		fakeRecorder = record.NewFakeRecorder(10)
+		fakeRecorder = events.NewFakeRecorder(10)
 		driver = NewDriver(
 			GinkgoLogr,
 			scheme,
@@ -1773,7 +1773,7 @@ var _ = Describe("RecordDomainEventsForIngress", func() {
 		driver.recordDomainEventsForIngress(ingress, domains)
 		var events []string
-		for i := 0; i < 2; i++ {
+		for range 2 {
 			var event string
 			Expect(fakeRecorder.Events).To(Receive(&event))
 			events = append(events, event)
@@ -83,11 +83,11 @@ func TestSyncDebouncer(t *testing.T) {
 	// how many requested a requeue vs succeeded without one.
 	collectResults := func(t *testing.T, ch <-chan reconcileResult, n int) (requeues, successes int) {
 		t.Helper()
-		for i := 0; i < n; i++ {
+		for i := range n {
 			select {
 			case res := <-ch:
 				require.NoError(t, res.err, "reconcile %d returned unexpected error", i)
-				if res.result.Requeue {
+				if res.result.RequeueAfter > 0 {
 					requeues++
 				} else {
 					successes++
@@ -103,10 +103,10 @@ func TestSyncDebouncer(t *testing.T) {
 		t.Parallel()
 		d := newDriver()
-		for i := 0; i < 5; i++ {
+		for i := range 5 {
 			result, err := reconcileSync(d, context.Background())
 			require.NoError(t, err)
-			assert.False(t, result.Requeue, "iteration %d", i)
+			assert.Zero(t, result.RequeueAfter, "iteration %d", i)
 		}
 	})
@@ -124,7 +124,7 @@ func TestSyncDebouncer(t *testing.T) {
 		var ready sync.WaitGroup
 		ready.Add(N)
-		for i := 0; i < N; i++ {
+		for range N {
 			go func() {
 				ready.Done()
 				r, e := reconcileSync(d, ctx)
@@ -162,12 +162,12 @@ func TestSyncDebouncer(t *testing.T) {
 		// The waiter should get a requeue.
 		res := <-resCh
 		require.NoError(t, res.err)
-		require.True(t, res.result.Requeue)
+		require.Greater(t, res.result.RequeueAfter, time.Duration(0))
 		// On retry, the debouncer is idle — sync runs to completion.
 		result, err := reconcileSync(d, ctx)
 		require.NoError(t, err)
-		assert.False(t, result.Requeue)
+		assert.Zero(t, result.RequeueAfter)
 	})
 	t.Run("SyncEndpoints shares the debouncer with Sync", func(t *testing.T) {
@@ -190,7 +190,7 @@ func TestSyncDebouncer(t *testing.T) {
 		res := <-resCh
 		require.NoError(t, res.err)
-		assert.True(t, res.result.Requeue, "SyncEndpoints waiter should be requeued")
+		assert.Greater(t, res.result.RequeueAfter, time.Duration(0), "SyncEndpoints waiter should be requeued")
 	})
 	t.Run("context cancellation releases waiting reconciler", func(t *testing.T) {
@@ -237,7 +237,7 @@ func TestSyncDebouncer(t *testing.T) {
 		var ready sync.WaitGroup
 		ready.Add(N)
-		for i := 0; i < N; i++ {
+		for range N {
 			go func() {
 				ready.Done()
 				r, e := HandleSyncResult(d.Sync(ctx, c))
@@ -867,13 +867,13 @@ func gwapiRequestHeaderFilterToTrafficPolicy(filter gatewayv1.HTTPRouteFilter) (
 		Actions: []trafficpolicy.Action{
 			{
 				Type: trafficpolicy.ActionType_RemoveHeaders,
-				Config: map[string]interface{}{
+				Config: map[string]any{
 					"headers": headersToRemove,
 				},
 			},
 			{
 				Type: trafficpolicy.ActionType_AddHeaders,
-				Config: map[string]interface{}{
+				Config: map[string]any{
 					"headers": headersToAdd,
 				},
 			},
@@ -913,13 +913,13 @@ func gwapiResponseHeaderFilterToTrafficPolicy(filter gatewayv1.HTTPRouteFilter)
 		Actions: []trafficpolicy.Action{
 			{
 				Type: trafficpolicy.ActionType_RemoveHeaders,
-				Config: map[string]interface{}{
+				Config: map[string]any{
 					"headers": headersToRemove,
 				},
 			},
 			{
 				Type: trafficpolicy.ActionType_AddHeaders,
-				Config: map[string]interface{}{
+				Config: map[string]any{
 					"headers": headersToAdd,
 				},
 			},
@@ -1003,7 +1003,7 @@ func gwapiRedirectFilterToTrafficPolicy(filter gatewayv1.HTTPRouteFilter, matchC
 		Actions: []trafficpolicy.Action{
 			{
 				Type: trafficpolicy.ActionType_Redirect,
-				Config: map[string]interface{}{
+				Config: map[string]any{
 					"from": from,
 					"to": fmt.Sprintf("%s%s%s%s%s",
 						toScheme,
@@ -1074,7 +1074,7 @@ func gwapiURLRewriteFilterToTrafficPolicy(filter gatewayv1.HTTPRouteFilter, matc
 		Actions: []trafficpolicy.Action{
 			{
 				Type: trafficpolicy.ActionType_URLRewrite,
-				Config: map[string]interface{}{
+				Config: map[string]any{
 					"from": from,
 					"to": fmt.Sprintf("%s%s%s%s%s",
 						toScheme,
@@ -189,7 +189,7 @@ func (t *translator) IRToEndpoints(irVHosts []*ir.IRVirtualHost) (cloudEndpoints
 		}
 		if irTLSCfg := irVHost.TLSTermination; irTLSCfg != nil {
-			tlsCfg := map[string]interface{}{}
+			tlsCfg := map[string]any{}
 			if len(irTLSCfg.MutualTLSCertificateAuthorities) > 0 {
 				tlsCfg["mutual_tls_certificate_authorities"] = irTLSCfg.MutualTLSCertificateAuthorities
@@ -372,8 +372,8 @@ func (t *translator) buildRoutingPolicy(irVHost *ir.IRVirtualHost, agentEndpoint
 			Name: "Capture-Original-Request-Data",
 			Actions: []trafficpolicy.Action{{
 				Type: trafficpolicy.ActionType_SetVars,
-				Config: map[string]interface{}{
+				Config: map[string]any{
-					"vars": []map[string]interface{}{{
+					"vars": []map[string]any{{
 						"original_path": "${req.url.path}",
 					}, {
 						"original_headers": "${req.headers.encodeJson()}",
@@ -435,8 +435,8 @@ func (t *translator) buildRoutingPolicy(irVHost *ir.IRVirtualHost, agentEndpoint
 			}
 			// Make sure the weighted routes set-vars action that stores a random number doesn't erase our captured request data
-			setvarWeightCfg := map[string]interface{}{
+			setvarWeightCfg := map[string]any{
-				"vars": []map[string]interface{}{{
+				"vars": []map[string]any{{
 					"weighted_route_random_num": fmt.Sprintf("${rand.int(0,%d)}", routeTotalWeight-1),
 				}},
 			}
@@ -666,7 +666,7 @@ func buildEndpointServiceRouteRule(name string, url string) trafficpolicy.Rule {
 		Actions: []trafficpolicy.Action{
 			{
 				Type: trafficpolicy.ActionType_ForwardInternal,
-				Config: map[string]interface{}{
+				Config: map[string]any{
 					"url": url,
 				},
 			},
@@ -684,8 +684,8 @@ func buildRouteLocallyVarRule(name string, value bool) trafficpolicy.Rule {
 		Actions: []trafficpolicy.Action{
 			{
 				Type: trafficpolicy.ActionType_SetVars,
-				Config: map[string]interface{}{
+				Config: map[string]any{
-					"vars": []map[string]interface{}{{
+					"vars": []map[string]any{{
 						"request_matched_local_svc": value,
 					}},
 				},
@@ -883,7 +883,7 @@ func buildDefault404TPRule() trafficpolicy.Rule {
 			{
 				// Basic text for now, but we can add styling/branding later
 				Type: trafficpolicy.ActionType_CustomResponse,
-				Config: map[string]interface{}{
+				Config: map[string]any{
 					"status_code": 404,
 					"content":     "No route was found for this ngrok Endpoint",
 					"headers": map[string]string{
@@ -127,7 +127,6 @@ func TestBuildInternalAgentEndpoint(t *testing.T) {
 	}
 	for _, tc := range testCases {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			result, err := buildAgentEndpoint(tc.irVirtualHost, tc.irService, tc.clusterDomain, tc.metadata)
 			require.NoError(t, err)
@@ -186,7 +185,7 @@ func TestBuildCloudEndpoint(t *testing.T) {
 				Bindings:               []string{"public"},
 				Namespace:              "foo",
 				Metadata:               "test-metadata",
-				EndpointPoolingEnabled: ptr.To(true),
+				EndpointPoolingEnabled: new(true),
 				LabelsToAdd:            map[string]string{"test-label": "test-label-val"},
 				AnnotationsToAdd:       map[string]string{"test-annotations": "test-annotation-val"},
 				Listener: ir.IRListener{
@@ -201,10 +200,10 @@ func TestBuildCloudEndpoint(t *testing.T) {
 			testName: "Name prefix",
 			irVHost: &ir.IRVirtualHost{
 				Bindings:               []string{"public"},
-				NamePrefix:             ptr.To("prefix"),
+				NamePrefix:             new("prefix"),
 				Namespace:              "foo",
 				Metadata:               "test-metadata",
-				EndpointPoolingEnabled: ptr.To(true),
+				EndpointPoolingEnabled: new(true),
 				LabelsToAdd:            map[string]string{"test-label": "test-label-val"},
 				AnnotationsToAdd:       map[string]string{"test-annotations": "test-annotation-val"},
 				Listener: ir.IRListener{
@@ -218,7 +217,6 @@ func TestBuildCloudEndpoint(t *testing.T) {
 	}
 	for _, tc := range testCases {
 		tc := tc
 		t.Run(tc.testName, func(t *testing.T) {
 			result, err := buildCloudEndpoint(tc.irVHost)
 			require.NoError(t, err)
@@ -260,7 +258,7 @@ func TestBuildDefaultDestinationPolicy(t *testing.T) {
 									Actions: []trafficpolicy.Action{
 										{
 											Type: "custom-response",
-											Config: map[string]interface{}{
+											Config: map[string]any{
 												"content": "Fallback 404 page",
 												"headers": map[string]string{
 													"content-type": "text/plain",
@@ -282,7 +280,7 @@ func TestBuildDefaultDestinationPolicy(t *testing.T) {
 						Actions: []trafficpolicy.Action{
 							{
 								Type: "custom-response",
-								Config: map[string]interface{}{
+								Config: map[string]any{
 									"content": "Fallback 404 page",
 									"headers": map[string]string{
 										"content-type": "text/plain",
@@ -327,7 +325,7 @@ func TestBuildDefaultDestinationPolicy(t *testing.T) {
 						Actions: []trafficpolicy.Action{
 							{
 								Type: "forward-internal",
-								Config: map[string]interface{}{
+								Config: map[string]any{
 									"url": "https://62d2f-test-service-default-cluster-local-8080.internal",
 								},
 							},
@@ -344,7 +342,6 @@ func TestBuildDefaultDestinationPolicy(t *testing.T) {
 	}
 	for _, tc := range testCases {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			translator := &translator{
 				clusterDomain:          "cluster.local",
@@ -424,7 +421,6 @@ func TestGatewayMethodToIR(t *testing.T) {
 	}
 	for _, tc := range testCases {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			result := gatewayMethodToIR(tc.input)
 			if tc.expected == nil {
@@ -441,24 +437,24 @@ func TestGatewayMethodToIR(t *testing.T) {
 // with regular yaml marshalling so we need to be a little creative about how we process them.
 type TranslatorRawTestCase struct {
 	Input struct {
-		GatewayClasses  []map[string]interface{} `yaml:"gatewayClasses"`
+		GatewayClasses  []map[string]any `yaml:"gatewayClasses"`
-		Gateways        []map[string]interface{} `yaml:"gateways"`
+		Gateways        []map[string]any `yaml:"gateways"`
-		HTTPRoutes      []map[string]interface{} `yaml:"httpRoutes"`
+		HTTPRoutes      []map[string]any `yaml:"httpRoutes"`
-		TCPRoutes       []map[string]interface{} `yaml:"tcpRoutes"`
+		TCPRoutes       []map[string]any `yaml:"tcpRoutes"`
-		TLSRoutes       []map[string]interface{} `yaml:"tlsRoutes"`
+		TLSRoutes       []map[string]any `yaml:"tlsRoutes"`
-		IngressClasses  []map[string]interface{} `yaml:"ingressClasses"`
+		IngressClasses  []map[string]any `yaml:"ingressClasses"`
-		Ingresses       []map[string]interface{} `yaml:"ingresses"`
+		Ingresses       []map[string]any `yaml:"ingresses"`
-		TrafficPolicies []map[string]interface{} `yaml:"trafficPolicies"`
+		TrafficPolicies []map[string]any `yaml:"trafficPolicies"`
-		Services        []map[string]interface{} `yaml:"services"`
+		Services        []map[string]any `yaml:"services"`
-		Secrets         []map[string]interface{} `yaml:"secrets"`
+		Secrets         []map[string]any `yaml:"secrets"`
-		Configmaps      []map[string]interface{} `yaml:"configMaps"`
+		Configmaps      []map[string]any `yaml:"configMaps"`
-		Namespaces      []map[string]interface{} `yaml:"namespaces"`
+		Namespaces      []map[string]any `yaml:"namespaces"`
-		ReferenceGrants []map[string]interface{} `yaml:"referenceGrants"`
+		ReferenceGrants []map[string]any `yaml:"referenceGrants"`
 	} `yaml:"input"`
 	Expected struct {
-		CloudEndpoints []map[string]interface{} `yaml:"cloudEndpoints"`
+		CloudEndpoints []map[string]any `yaml:"cloudEndpoints"`
-		AgentEndpoints []map[string]interface{} `yaml:"agentEndpoints"`
+		AgentEndpoints []map[string]any `yaml:"agentEndpoints"`
 	} `yaml:"expected"`
 }
@@ -911,7 +907,7 @@ func loadTranslatorTestCase(t *testing.T, file string, sch *runtime.Scheme) Tran
 }
 // decodeViaScheme helps us decode raw objects loaded from test data yaml files into proper objects that can then be typecast
-func decodeViaScheme(s *runtime.Scheme, rawObj map[string]interface{}) (runtime.Object, error) {
+func decodeViaScheme(s *runtime.Scheme, rawObj map[string]any) (runtime.Object, error) {
 	// Convert map to YAML
 	y, err := yaml.Marshal(rawObj)
 	if err != nil {
@@ -17,7 +17,6 @@ import (
 	"github.com/ngrok/ngrok-operator/internal/util"
 	corev1 "k8s.io/api/core/v1"
 	netv1 "k8s.io/api/networking/v1"
 	"k8s.io/utils/ptr"
 )
 // internalAgentEndpointName builds a string for the name of an internal AgentEndpoint
@@ -30,12 +29,12 @@ func internalAgentEndpointName(serviceUID, serviceName, namespace, clusterDomain
 	// This is an unlikely but valid use-case
 	tlsSuffix := ""
 	if len(clientCertRefs) > 0 {
-		tlsStr := ""
+		var tlsStr strings.Builder
 		for _, certRef := range clientCertRefs {
-			tlsStr += fmt.Sprintf("%s.%s", certRef.Name, certRef.Namespace)
+			tlsStr.WriteString(fmt.Sprintf("%s.%s", certRef.Name, certRef.Namespace))
 		}
-		tlsHash := sha256.Sum256([]byte(tlsStr))
+		tlsHash := sha256.Sum256([]byte(tlsStr.String()))
 		tlsHashHex := hex.EncodeToString(tlsHash[:])
 		tlsSuffix = fmt.Sprintf("mtls-%s", tlsHashHex[:5])
 	}
@@ -79,12 +78,12 @@ func buildInternalEndpointURL(protocol ir.IRProtocol, serviceUID, serviceName, n
 	tlsSuffix := ""
 	if len(clientCertRefs) > 0 {
-		tlsStr := ""
+		var tlsStr strings.Builder
 		for _, certRef := range clientCertRefs {
-			tlsStr += fmt.Sprintf("%s.%s", certRef.Name, certRef.Namespace)
+			tlsStr.WriteString(fmt.Sprintf("%s.%s", certRef.Name, certRef.Namespace))
 		}
-		tlsHash := sha256.Sum256([]byte(tlsStr))
+		tlsHash := sha256.Sum256([]byte(tlsStr.String()))
 		tlsHashHex := hex.EncodeToString(tlsHash[:])
 		tlsSuffix = fmt.Sprintf("mtls-%s", tlsHashHex[:5])
 	}
@@ -199,7 +198,7 @@ func getPortAppProtocol(log logr.Logger, service *corev1.Service, port *corev1.S
 	proto := *port.AppProtocol
 	if knownProto, ok := knownApplicationProtocols[proto]; ok {
-		return ptr.To(knownProto)
+		return new(knownProto)
 	}
 	log.WithValues(
@@ -8,7 +8,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	netv1 "k8s.io/api/networking/v1"
 	"k8s.io/utils/ptr"
 )
 func TestSanitizeStringForURL(t *testing.T) {
@@ -65,7 +64,6 @@ func TestSanitizeStringForURL(t *testing.T) {
 	}
 	for _, tc := range testCases {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			actual := sanitizeStringForURL(tc.input)
 			assert.Equal(t, tc.expected, actual)
@@ -178,12 +176,11 @@ func TestBuildInternalEndpointURL(t *testing.T) {
 			port:          8080,
 			serviceUID:    "1234",
 			protocol:      "invalid",
-			expectedErr:   ptr.To("unable to get scheme for protocol \"invalid\", expected HTTP/HTTPS/TCP/TLS"),
+			expectedErr:   new("unable to get scheme for protocol \"invalid\", expected HTTP/HTTPS/TCP/TLS"),
 		},
 	}
 	for _, tc := range testCases {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			result, err := buildInternalEndpointURL(tc.protocol, tc.serviceUID, tc.serviceName, tc.namespace, tc.clusterDomain, tc.port, tc.upstreamClientCertRefs)
 			if tc.expectedErr != nil {
@@ -277,7 +274,6 @@ func TestNetv1PathTypeToIR(t *testing.T) {
 	}
 	for _, tc := range testCases {
 		tc := tc // capture range variable
 		t.Run(tc.name, func(t *testing.T) {
 			logger := logr.New(logr.Discard().GetSink())
 			result := netv1PathTypeToIR(logger, tc.pathType)
@@ -4,8 +4,8 @@ set -eu -o pipefail
 GOVERSION="$(go env GOVERSION || echo "not installed")"
-if ! [[ "$GOVERSION" == "go1.25" ||  "$GOVERSION" = "go1.25."* ]]; then
+if ! [[ "$GOVERSION" == "go1.26" ||  "$GOVERSION" = "go1.26."* ]]; then
-  echo "Detected go version $GOVERSION, but 1.25 is required"
+  echo "Detected go version $GOVERSION, but 1.26 is required"
  exit 1
 fi