fix(deps): update elastic-deps

[elastic-renovate-prod]

This PR contains the following updates:

Package	Type	Update	Change
github.com/elastic/cloud-on-k8s/v3	require	minor	v3.1.0 -> v3.2.0
github.com/elastic/go-ucfg	require	digest	2a22403 -> 3520930

---

Release Notes

elastic/cloud-on-k8s (github.com/elastic/cloud-on-k8s/v3)

v3.2.0

Compare Source

Elastic Cloud on Kubernetes 3.2.0

• Quickstart guide

Release Highlights

Automatic pod disruption budget (Enterprise feature)

ECK now offers better out-of-the-box PodDisruptionBudgets that automatically keep your cluster available as Pods move across nodes. The new policy calculates the number of Pods per tier that can sustain replacement and automatically generates a PodDisruptionBudget for each tier, enabling the Elasticsearch cluster to vacate Kubernetes nodes more quickly, while considering cluster health, without interruption.

User Password Generation (Enterprise feature)

ECK will now generate longer passwords by default for the administrative user of each Elasticsearch cluster. The password is 24 characters in length by default (can be configured to a maximum of 72 characters), incorporating alphabetic and numeric characters, to make password complexity stronger.

Features and enhancements

• Enable certificate reloading for stack monitoring Beats #​8833 (issue: #​5448)
• Allow configuration of file-based password character set and length #​8817 (issues: #​2795, #​8693)
• Automatically set GOMEMLIMIT based on cgroups memory limits #​8814 (issue: #​8790)
• Introduce granular PodDisruptionBudgets based on node roles #​8780 (issue: #​2936)

Fixes

• Gate advanced Fleet config logic to Agent v8.13 and later #​8869
• Ensure Agent configuration and state persist across restarts in Fleet mode #​8856 (issue: #​8819)
• Do not set credentials label on Kibana config secret #​8852 (issue: #​8839)
• Allow elasticsearchRef.secretName in Kibana helm validation #​8822 (issue: #​8816)

Documentation improvements

• Update Logstash recipes from to filestream input #​8801
• Recipe for exposing Fleet server to outside of the Kubernetes cluster #​8788
• Clarify secretName restrictions #​8782
• Update ES_JAVA_OPTS comments and explain auto-heap behavior #​8753

Dependency updates

• github.com/gkampitakis/go-snaps v0.5.13 => v0.5.15
• github.com/hashicorp/vault/api v1.20.0 => v1.22.0
• github.com/KimMachineGun/automemlimit => v0.7.4
• github.com/prometheus/client_golang v1.22.0 => v1.23.2
• github.com/prometheus/common v0.65.0 => v0.67.1
• github.com/sethvargo/go-password v0.3.1 => REMOVED
• github.com/spf13/cobra v1.9.1 => v1.10.1
• github.com/spf13/pflag v1.0.6 => v1.0.10
• github.com/spf13/viper v1.20.1 => v1.21.0
• github.com/stretchr/testify v1.10.0 => v1.11.1
• golang.org/x/crypto v0.40.0 => v0.43.0
• k8s.io/api v0.33.2 => v0.34.1
• k8s.io/apimachinery v0.33.2 => v0.34.1
• k8s.io/client-go v0.33.2 => v0.34.1
• k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 => v0.0.0-20250604170112-4c0f3b243397
• sigs.k8s.io/controller-runtime v0.21.0 => v0.22.2
• sigs.k8s.io/controller-tools v0.18.0 => v0.19.0

---

Configuration

📅 Schedule: Branch creation - "after 1am on monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[elastic-renovate-prod]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

---

• Branch has one or more failed status checks

[prodsecmachine]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Licenses	0	0	0	0	0 issues
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔍 Preview links for changed docs

• docs/reference/third-party-dependencies/main.md

[elastic-renovate-prod]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.