chore: backport changes from kubefleet 08/27/2025

.github/workflows/chart.yml

@@ -18,7 +18,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           submodules: true
           fetch-depth: 0

.github/workflows/ci.yml

@@ -13,7 +13,7 @@ on:
     paths-ignore: [docs/**, "**.md", "**.mdx", "**.png", "**.jpg"]
 
 env:
-  GO_VERSION: '1.24.4'
+  GO_VERSION: '1.24.6'
 
 jobs:
   detect-noop:
@@ -40,7 +40,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Ginkgo CLI
         run: |
@@ -70,7 +70,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Kind
         # Before updating the kind version to use, verify that the current kind image
@@ -89,12 +89,16 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        customized-settings: [default, joinleave, custom]
+        customized-settings: [default, resourceplacement, joinleave, custom]
         include:
           - customized-settings: default
             # to shorten the test duration, set the resource snapshot creation interval to 0
             resource-snapshot-creation-minimum-interval: 0m
             resource-changes-collection-duration: 0m
+          - customized-settings: resourceplacement
+            # to shorten the test duration, set the resource snapshot creation interval to 0
+            resource-snapshot-creation-minimum-interval: 0m
+            resource-changes-collection-duration: 0m
           - customized-settings: joinleave
             # to shorten the test duration, set the resource snapshot creation interval to 0
             resource-snapshot-creation-minimum-interval: 0m
@@ -121,7 +125,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Ginkgo CLI
         run: |
@@ -136,7 +140,9 @@ jobs:
       - name: Run e2e tests
         run: |
           if [ "${{ matrix.customized-settings }}" = "default" ]; then
-            make e2e-tests LABEL_FILTER="!custom && !joinleave"
+            make e2e-tests LABEL_FILTER="!custom && !joinleave && !resourceplacement"
+          elif [ "${{ matrix.customized-settings }}" = "resourceplacement" ]; then
+            make e2e-tests LABEL_FILTER="!custom && resourceplacement"
           elif [ "${{ matrix.customized-settings }}" = "joinleave" ]; then
             make e2e-tests LABEL_FILTER="!custom && joinleave"
           else

.github/workflows/code-lint.yml

@@ -14,7 +14,7 @@ on:
 
 env:
   # Common versions
-  GO_VERSION: '1.24.4'
+  GO_VERSION: '1.24.6'
 
 jobs:
 
@@ -43,7 +43,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           submodules: true
 
@@ -64,7 +64,7 @@ jobs:
         go-version: ${{ env.GO_VERSION }}
 
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: golangci-lint
       run: make lint

.github/workflows/codeql-analysis.yml

@@ -38,7 +38,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/codespell.yml

@@ -16,7 +16,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v4.1.7
       - uses: codespell-project/actions-codespell@406322ec52dd7b488e48c1c4b82e2a8b3a1bf630 # master
         with:
           check_filenames: true

.github/workflows/markdown-lint.yml

@@ -10,7 +10,7 @@ jobs:
   markdown-link-check:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - uses: tcort/github-action-markdown-link-check@v1
       with:
         # this will only show errors in the output

.github/workflows/trivy.yml

@@ -18,7 +18,7 @@ env:
   MEMBER_AGENT_IMAGE_NAME: member-agent
   REFRESH_TOKEN_IMAGE_NAME: refresh-token
 
-  GO_VERSION: '1.24.4'
+  GO_VERSION: '1.24.6'
 
 jobs:
   export-registry:
@@ -44,10 +44,10 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Login to ${{ env.REGISTRY }}
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}

.github/workflows/upgrade.yml

@@ -17,7 +17,7 @@ on:
     paths-ignore: [docs/**, "**.md", "**.mdx", "**.png", "**.jpg"]
 
 env:
-  GO_VERSION: '1.24.4'
+  GO_VERSION: '1.24.6'
 
 jobs:
   detect-noop:
@@ -44,7 +44,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           # Fetch the history of all branches and tags.
           # This is needed for the test suite to switch between releases.
@@ -127,7 +127,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           # Fetch the history of all branches and tags.
           # This is needed for the test suite to switch between releases.
@@ -210,7 +210,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           # Fetch the history of all branches and tags.
           # This is needed for the test suite to switch between releases.

.golangci.yml

@@ -1,6 +1,6 @@
 run:
   timeout: 15m
-  go: '1.24.4'
+  go: '1.24.6'
 
 linters-settings:
   stylecheck:

CLAUDE.md

@@ -159,11 +159,16 @@ cmd/memberagent/        # Member agent main and setup
 ## Testing Patterns
 
 ### Unit Tests
-- Use `testify` for assertions
+- Avoid the use of ‘assert’ libraries.
 - Controllers use `envtest` for integration testing with real etcd
 - Mock external dependencies with `gomock`
 - Unit test files: `<go_file>_test.go` in same directory
 - Table-driven test style preferred
+- Use cmp.Equal for equality comparison and cmp.Diff to obtain a human-readable diff between objects.
+- Test outputs should output the actual value that the function returned before printing the value that was expected. A usual format for printing test outputs is “YourFunc(%v) = %v, want %v”.
+- If your function returns a struct, don’t write test code that performs an individual comparison for each field of the struct. Instead, construct the struct that you’re expecting your function to return, and compare in one shot using diffs or deep comparisons. The same rule applies to arrays and maps.
+- If your struct needs to be compared for approximate equality or some other kind of semantic equality, or it contains fields that cannot be compared for equality (e.g. if one of the fields is an io.Reader), tweaking a cmp.Diff or cmp.Equal comparison with cmpopts options such as cmpopts.IgnoreInterfaces may meet your needs (example); otherwise, this technique just won’t work, so do whatever works.
+- If your function returns multiple return values, you don’t need to wrap those in a struct before comparing them. Just compare the return values individually and print them.
 
 ### Integration Tests  
 - Located in `test/integration/` and `test/scheduler/`
@@ -181,6 +186,9 @@ cmd/memberagent/        # Member agent main and setup
 
 ### Test Coding Style
 - Use `want` or `wanted` instead of `expect` or `expected` when creating the desired state
+- Comments that are complete sentences should be capitalized and punctuated like standard English sentences. (As an exception, it is okay to begin a sentence with an uncapitalized identifier name if it is otherwise clear. Such cases are probably best done only at the beginning of a paragraph.)
+- Comments that are sentence fragments have no such requirements for punctuation or capitalization.
+- Documentation comments should always be complete sentences, and as such should always be capitalized and punctuated. Simple end-of-line comments (especially for struct fields) can be simple phrases that assume the field name is the subject.
 
 ## Key Patterns
 

Makefile

@@ -139,13 +139,14 @@ test: manifests generate fmt vet local-unit-test integration-test ## Run tests.
 
 ##
 ## workaround to bypass the pkg/controllers/workv1alpha1 tests failure
+## rollout controller tests need a bit longer to complete, so we increase the timeout
 ##
 .PHONY: local-unit-test
 local-unit-test: $(ENVTEST) ## Run tests.
 	export CGO_ENABLED=1 && \
 	export KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)" && \
 	go test ./pkg/controllers/workv1alpha1 -race -coverprofile=ut-coverage.xml -covermode=atomic -v && \
-	go test `go list ./pkg/... ./cmd/... | grep -v pkg/controllers/workv1alpha1` -race -coverpkg=./...  -coverprofile=ut-coverage.xml -covermode=atomic -v
+	go test `go list ./pkg/... ./cmd/... | grep -v pkg/controllers/workv1alpha1` -race -coverpkg=./...  -coverprofile=ut-coverage.xml -covermode=atomic -v -timeout=20m
 
 .PHONY: integration-test
 integration-test: $(ENVTEST) ## Run tests.

apis/placement/v1/override_types.go

@@ -42,11 +42,13 @@ type ClusterResourceOverride struct {
 // The ClusterResourceOverride create or update will fail when the resource has been selected by the existing ClusterResourceOverride.
 // If the resource is selected by both ClusterResourceOverride and ResourceOverride, ResourceOverride will win when resolving
 // conflicts.
+// +kubebuilder:validation:XValidation:rule="(has(oldSelf.placement) && has(self.placement) && oldSelf.placement == self.placement) || (!has(oldSelf.placement) && !has(self.placement))",message="The placement field is immutable"
 type ClusterResourceOverrideSpec struct {
 	// Placement defines whether the override is applied to a specific placement or not.
 	// If set, the override will trigger the placement rollout immediately when the rollout strategy type is RollingUpdate.
 	// Otherwise, it will be applied to the next rollout.
 	// The recommended way is to set the placement so that the override can be rolled out immediately.
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="The placement field is immutable"
 	// +optional
 	Placement *PlacementRef `json:"placement,omitempty"`
 
@@ -66,12 +68,32 @@ type ClusterResourceOverrideSpec struct {
 	Policy *OverridePolicy `json:"policy"`
 }
 
+// ResourceScope defines the scope of placement reference.
+type ResourceScope string
+
+const (
+	// ClusterScoped indicates placement is cluster-scoped.
+	ClusterScoped ResourceScope = "Cluster"
+
+	// NamespaceScoped indicates placement is namespace-scoped.
+	NamespaceScoped ResourceScope = "Namespaced"
+)
+
 // PlacementRef is the reference to a placement.
 // For now, we only support ClusterResourcePlacement.
 type PlacementRef struct {
 	// Name is the reference to the name of placement.
 	// +required
+
 	Name string `json:"name"`
+	// Scope defines the scope of the placement.
+	// A clusterResourceOverride can only reference a clusterResourcePlacement (cluster-scoped),
+	// and a resourceOverride can reference either a clusterResourcePlacement or resourcePlacement (namespaced).
+	// The referenced resourcePlacement must be in the same namespace as the resourceOverride.
+	// +kubebuilder:validation:Enum=Cluster;Namespaced
+	// +kubebuilder:default=Cluster
+	// +optional
+	Scope ResourceScope `json:"scope,omitempty"`
 }
 
 // OverridePolicy defines how to override the selected resources on the target clusters.
@@ -144,6 +166,7 @@ type ResourceOverride struct {
 // The ResourceOverride create or update will fail when the resource has been selected by the existing ResourceOverride.
 // If the resource is selected by both ClusterResourceOverride and ResourceOverride, ResourceOverride will win when resolving
 // conflicts.
+// +kubebuilder:validation:XValidation:rule="(has(oldSelf.placement) && has(self.placement) && oldSelf.placement == self.placement) || (!has(oldSelf.placement) && !has(self.placement))",message="The placement field is immutable"
 type ResourceOverrideSpec struct {
 	// Placement defines whether the override is applied to a specific placement or not.
 	// If set, the override will trigger the placement rollout immediately when the rollout strategy type is RollingUpdate.

apis/placement/v1alpha1/override_types.go

@@ -62,7 +62,7 @@ type ClusterResourceOverrideSpec struct {
 	// +kubebuilder:validation:MinItems=1
 	// +kubebuilder:validation:MaxItems=20
 	// +required
-	ClusterResourceSelectors []placementv1beta1.ClusterResourceSelector `json:"clusterResourceSelectors"`
+	ClusterResourceSelectors []placementv1beta1.ResourceSelectorTerm `json:"clusterResourceSelectors"`
 
 	// Policy defines how to override the selected resources on the target clusters.
 	// +required

apis/placement/v1beta1/binding_types.go

@@ -28,7 +28,7 @@ const (
 	// SchedulerBindingCleanupFinalizer is a finalizer added to bindings to ensure we can look up the
 	// corresponding CRP name for deleting bindings to trigger a new scheduling cycle.
 	// TODO: migrate the finalizer to the new name "scheduler-binding-cleanup" in the future.
-	SchedulerBindingCleanupFinalizer = fleetPrefix + "scheduler-crb-cleanup"
+	SchedulerBindingCleanupFinalizer = FleetPrefix + "scheduler-crb-cleanup"
 )
 
 // make sure the BindingObj and BindingObjList interfaces are implemented by the