Pin kubernetes

[AAraKKe]

What does this PR do?

Adds kubernetes to the dependency update exclude list, so the automated dependency PRs stop proposing 36.x and we stay on 35.0.0.

Motivation

kubernetes 36 folded the kubernetes_asyncio project into the package as kubernetes.aio and made aiohttp a hard requirement. Measured against the Agent's static quality gates, the bump costs +24.5 MiB on disk (wheel contents, with ELF stripping accounted for):

package	old -> new	disk
kubernetes	35.0.0 -> 36.0.3	+21.76 M
aiohttp + yarl + multidict + propcache + frozenlist + aiosignal + aiohappyeyeballs	new	+2.47 M
rest of the bump PR (cryptography, redis, clickhouse-connect, ...)		+0.26 M

Of that, kubernetes/aio/ alone is 18.77 MiB across 855 files, since the async client is a full duplicate of the generated sync client.

That broke 16 static quality gates in https://gitlab.ddbuild.io/DataDog/datadog-agent/-/jobs/1944467427, triggered from #24817:

Agent DEB (AMD64)           FAIL  784.0/764.5 MB   -19.5 MB
Agent RPM (ARM64)           FAIL  761.0/736.5 MB   -24.4 MB
Docker Agent (JMX) (AMD64)  FAIL 1033.5/1010.8 MB  -22.7 MB
...

Every gate that embeds Python failed on the on-disk dimension. The Agent ratchets those limits down to current+1 MiB on each main commit, so there is no room to absorb a bump of this size without an approved size exception.

Nothing in this repo imports kubernetes.aio. The three consumers (datadog_checks_base's kube leader election, kubevirt_api, kueue) all use the sync client, and upstream's own changelog marks the asyncio package as experimental. Holding at 35.0.0 also does not freeze the security-relevant transitive dependencies: 35 and 36 constrain urllib3, requests and certifi identically and loosely, and we pin those ourselves in agent_requirements.in.

This is a hold, not a resolution. Taking 36 eventually needs either pruning kubernetes/aio at build time (which brings the bump down to about +3 M) or an approved quality gate exception, and that is tracked separately.

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Add qa/required if this PR needs QA validation, or qa/skip-qa if it does not. Exactly one of the two is required.
• If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

[dd-octo-sts]

Validation Report

All 21 validations passed.

Show details

Validation	Description	Status
agent-reqs	Verify check versions match the Agent requirements file	✅
ci	Validate CI configuration and code coverage settings	✅
codeowners	Validate every integration has a CODEOWNERS entry	✅
config	Validate default configuration files against spec.yaml	✅
dep	Verify dependency pins are consistent and Agent-compatible	✅
http	Validate integrations use the HTTP wrapper correctly	✅
imports	Validate check imports do not use deprecated modules	✅
integration-style	Validate check code style conventions	✅
jmx-metrics	Validate JMX metrics definition files and config	✅
labeler	Validate PR labeler config matches integration directories	✅
legacy-signature	Validate no integration uses the legacy Agent check signature	✅
license-headers	Validate Python files have proper license headers	✅
licenses	Validate third-party license attribution list	✅
metadata	Validate metadata.csv metric definitions	✅
models	Validate configuration data models match spec.yaml	✅
openmetrics	Validate OpenMetrics integrations disable the metric limit	✅
package	Validate Python package metadata and naming	✅
qa-label	Validate the pull request declares whether it needs QA for the next Agent release	✅
readmes	Validate README files have required sections	✅
saved-views	Validate saved view JSON file structure and fields	✅
version	Validate version consistency between package and changelog	✅

View full run

[cit-pr-commenter-54b7da]

evalya-impact-summary

evalya impact analysis

Impact analysis: 0 selected, 0 skipped (of 0 test tasks)
Publish tasks:   0 (always emitted)
Diff (1 file):
  .ddev/config.toml

Debug a specific task: evalya plan impact --path <path> --task <task>

Learn more about CI impact filtering