From 01fff9b60a79ae0d838f49a23e791070e471d287 Mon Sep 17 00:00:00 2001
From: Tom Alexander <tom@fizz.buzz>
Date: Sat, 30 May 2026 19:35:06 -0400
Subject: [PATCH] Update kubernetes packages and update to gateway API 1.5.1.

---
 nix/kubernetes/flake.lock                     | 12 +++++------
 .../keys/package/bootstrap-script/package.nix | 21 ++++++++++---------
 nix/kubernetes/roles/kubernetes/default.nix   |  2 +-
 3 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/nix/kubernetes/flake.lock b/nix/kubernetes/flake.lock
index 28ca666..2824a29 100644
--- a/nix/kubernetes/flake.lock
+++ b/nix/kubernetes/flake.lock
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769524058,
-        "narHash": "sha256-zygdD6X1PcVNR2PsyK4ptzrVEiAdbMqLos7utrMDEWE=",
+        "lastModified": 1780290312,
+        "narHash": "sha256-eTAlX0CwgB84Ts3GaBd944A3DRXVMzgA0EqroZBISUo=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "71a3fc97d80881e91710fe721f1158d3b96ae14d",
+        "rev": "115e5211780054d8a890b41f0b7734cafad54dfe",
         "type": "github"
       },
       "original": {
@@ -164,11 +164,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1770197578,
-        "narHash": "sha256-AYqlWrX09+HvGs8zM6ebZ1pwUqjkfpnv8mewYwAo+iM=",
+        "lastModified": 1780243769,
+        "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "00c21e4c93d963c50d4c0c89bfa84ed6e0694df2",
+        "rev": "331800de5053fcebacf6813adb5db9c9dca22a0c",
         "type": "github"
       },
       "original": {
diff --git a/nix/kubernetes/keys/package/bootstrap-script/package.nix b/nix/kubernetes/keys/package/bootstrap-script/package.nix
index c8d4cd9..2e050b9 100644
--- a/nix/kubernetes/keys/package/bootstrap-script/package.nix
+++ b/nix/kubernetes/keys/package/bootstrap-script/package.nix
@@ -54,22 +54,23 @@ let
   gateway_crds_repo = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "gateway-api";
-    rev = "v1.4.1";
-    sha256 = "sha256-/GHyikcC2QGDN0ndpY6/xvSEEnpSsLrNU+lFElCKBs8=";
+    rev = "v1.5.1";
+    sha256 = "sha256-mWMvJG6esOqDBSbhExvt7L3ZTiQUOfeRBohew/m67A0=";
   };
   gateway_crds = [
     "${gateway_crds_repo}/config/crd/experimental/gateway.networking.k8s.io_backendtlspolicies.yaml"
-    "${gateway_crds_repo}/config/crd/experimental/gateway.networking.k8s.io_referencegrants.yaml"
-    "${gateway_crds_repo}/config/crd/experimental/gateway.networking.x-k8s.io_xmeshes.yaml"
     "${gateway_crds_repo}/config/crd/experimental/gateway.networking.k8s.io_gatewayclasses.yaml"
-    "${gateway_crds_repo}/config/crd/experimental/gateway.networking.k8s.io_udproutes.yaml"
-    "${gateway_crds_repo}/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml"
-    "${gateway_crds_repo}/config/crd/experimental/gateway.networking.x-k8s.io_xbackendtrafficpolicies.yaml"
     "${gateway_crds_repo}/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml"
-    "${gateway_crds_repo}/config/crd/experimental/gateway.networking.x-k8s.io_xlistenersets.yaml"
-    "${gateway_crds_repo}/config/crd/experimental/gateway.networking.k8s.io_tcproutes.yaml"
-    "${gateway_crds_repo}/config/crd/experimental/gateway.networking.k8s.io_httproutes.yaml"
     "${gateway_crds_repo}/config/crd/experimental/gateway.networking.k8s.io_grpcroutes.yaml"
+    "${gateway_crds_repo}/config/crd/experimental/gateway.networking.k8s.io_httproutes.yaml"
+    "${gateway_crds_repo}/config/crd/experimental/gateway.networking.k8s.io_listenersets.yaml"
+    "${gateway_crds_repo}/config/crd/experimental/gateway.networking.k8s.io_referencegrants.yaml"
+    "${gateway_crds_repo}/config/crd/experimental/gateway.networking.k8s.io_tcproutes.yaml"
+    "${gateway_crds_repo}/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml"
+    "${gateway_crds_repo}/config/crd/experimental/gateway.networking.k8s.io_udproutes.yaml"
+    "${gateway_crds_repo}/config/crd/experimental/gateway.networking.k8s.io_vap_safeupgrades.yaml"
+    "${gateway_crds_repo}/config/crd/experimental/gateway.networking.x-k8s.io_xbackendtrafficpolicies.yaml"
+    "${gateway_crds_repo}/config/crd/experimental/gateway.networking.x-k8s.io_xmeshes.yaml"
   ];
 in
 stdenv.mkDerivation (finalAttrs: {
diff --git a/nix/kubernetes/roles/kubernetes/default.nix b/nix/kubernetes/roles/kubernetes/default.nix
index f4d70f1..0f268d8 100644
--- a/nix/kubernetes/roles/kubernetes/default.nix
+++ b/nix/kubernetes/roles/kubernetes/default.nix
@@ -21,7 +21,7 @@
     assertions = [
       {
         # Kubernetes should only upgrade 1 minor version at a time, so this assert is here to prevent unwittingly jumping versions.
-        assertion = lib.hasPrefix "1.35." pkgs.kubernetes.version;
+        assertion = lib.hasPrefix "1.36." pkgs.kubernetes.version;
         message = "Unexpected Kubernetes package version: ${pkgs.kubernetes.version}";
       }
     ];