build(deps): bump codecov/codecov-action from 5.3.1 to 5.4.0 (#13722)

Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5.3.1 to 5.4.0.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@13ce06b...0565863)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

proxy: v2.282.0 (#13683)

Release notes: https://github.com/linkerd/linkerd2-proxy/releases/tag/release/v2.282.0

Signed-off-by: l5d-bot <l5d-bot@users.noreply.github.com>
Co-authored-by: l5d-bot <l5d-bot@users.noreply.github.com>

fix(cli): Don't require gateway CRDs in linkerd install

In #12917 we made the Gateway API CRDs optional in Linkerd and updated the `linkerd check` command to no longer error if these CRDs were not present.  However, we missing making the corresponding change in `linkerd install`.  As a result, `linkerd install` returns an error if the Gateway API CRDs are not installed on the cluster.

We add the corresponding change to `linkerd install` so that it no longer returns an error if the Gateway API CRDs are not installed.

Signed-off-by: Alex Leong <alex@buoyant.io>

proxy: v2.276.0 (#13590)

Release notes: https://github.com/linkerd/linkerd2-proxy/releases/tag/release/v2.276.0

Signed-off-by: l5d-bot <l5d-bot@users.noreply.github.com>
Co-authored-by: l5d-bot <l5d-bot@users.noreply.github.com>

fix(destination): GetProfile requests targeting pods directly should …

…return endpoint data for running (not necessarily ready) pods (#13557)

* fix(destination): GetProfile requests targeting pods directly should return endpoint data for running (not necessarily ready) pods

Requiring Pods to pass readiness checks before allowing Pod to Pod communication disrupts communication in e.g. clustered systems which require Pods to communicate with each other prior to establishing ready state and allowing inbound traffic.

Relaxed the requirement and modified the workload watcher to only require that a Pod exists and is in Running phase.

Reproduced the issue with a test setup described in #13247.

Fixes #13247.

---------

Signed-off-by: Tuomo <tjorri@gmail.com>
Co-authored-by: Alejandro Pedraza <alejandro@buoyant.io>

build(deps): bump kubert from 0.21.2 to 0.22.0 (#13399)

This change introduces a timeout into the kubernetes lease logic so that patches
may not get stuck indefinitely.

This change also modifies our Cargo.tomls so that kubert and its related
dependencies (kube and k8s-openapi) are defined at the workspace-level.

build(deps): bump kubert from 0.21.2 to 0.22.0 (#13399)

This change introduces a timeout into the kubernetes lease logic so that patches
may not get stuck indefinitely.

This change also modifies our Cargo.tomls so that kubert and its related
dependencies (kube and k8s-openapi) are defined at the workspace-level.

build(deps) update go linkerd2-proxy-api to v0.15.0 (#13396)

chore(policy): simplify status controller type matching (#13395)

This change reduces boilerplate when switching between types in the status
controller.

No functional changes.

fix(destination): avoid panic on missing managed fields timestamp (#1…

…3378)

We received a report of a panic:

    runtime error: invalid memory address or nil pointer dereference

    panic({0x1edb860?, 0x37a6050?}
        /usr/local/go/src/runtime/panic.go:785 +0x132

    github.com/linkerd/linkerd2/controller/api/destination/watcher.latestUpdated({0xc0006b2d80?, 0xc00051a540?, 0xc0008fa008?})
        /linkerd-build/vendor/github.com/linkerd/linkerd2/controller/api/destination/watcher/endpoints_watcher.go:1612 +0x125

    github.com/linkerd/linkerd2/controller/api/destination/watcher.(*OpaquePortsWatcher).updateService(0xc0007d5480, {0x21fd160?, 0xc000d71688?}, {0x21fd160, 0xc000d71688})
        /linkerd-build/vendor/github.com/linkerd/linkerd2/controller/api/destination/watcher/opaque_ports_watcher.go:141 +0x68

The `latestUpdated` function does not properly handle the case where a atime is
omitted from a `ManagedFieldsEntry`.

    type ManagedFieldsEntry struct {
        // Time is the timestamp of when the ManagedFields entry was added. The
        // timestamp will also be updated if a field is added, the manager
        // changes any of the owned fields value or removes a field. The
        // timestamp does not update when a field is removed from the entry
        // because another manager took it over.
        // +optional
        Time *Time `json:"time,omitempty" protobuf:"bytes,4,opt,name=time"`

This change adds a check to avoid the nil dereference.