The new `secretVolumes` option allows to mount workload secrets as a volume.
This is useful, e.g. for GCP service account credentials.

Issue: team#633

chore(deps): update terraform gitlab.com/gitlab-com/vault-ephemeral-secret-wrapper/vault to v1.0.4

See merge request !1192

feat(runway-base): Allow specifying secret volume mounts.

See merge request !1196

chore(deps): update terraform-provider-google to v6.49.2

See merge request !1025

chore(deps): update tflint plugin terraform-linters/tflint-ruleset-google to v0.35.0

See merge request !1059

chore(deps): update terraform googlecloudplatform/lb-http/google to v13

See merge request !1112

We previously allowed to configure a "starup" probe, but then actually created
a "readiness" probe in Kubernetes. That means that "liveness" probes were
started immediately, not after the first successful startup probe. This change
fixes this by actually creating a startup probe on Kubernetes.

This change also implements "readiness" probes, which were already present in
our schema but not implemented in the Helm chart.

This should help us configure AI Gateway more correctly: because the container
takes quite long to start up, using an actual startup probe is the right thing
to do. Emitting a readiness probe instead was shutting down the container too
early due to the liveness probes failing.

Issue: team#500

golangci-lint migrate --config .golangci.yaml

chore(deps): update golangci-lint-major to v2 (major)

See merge request !903

chore(deps): update golang-minor to v1.25.1 (minor)

See merge request !1146

Using `` is invalid, because the empty string is not a valid JSON expression.

```
2025-09-04T16:37:49+02:00 ERR github.com/kyverno/kyverno/cmd/cli/kubectl-kyverno/commands/apply/command.go:397 > policy validation error error="policy contains invalid variables: variable substitution failed for rule require-service-deployment-probes: failed to resolve element.startupProbe.httpGet.path || `` at path /validate/foreach/0/deny/conditions/any/1/key: invalid JMESPath query element.startupProbe.httpGet.path || ``: unexpected end of JSON input" logger=kubectl-kyverno
```

Co-authored-by: Sahand Abbasi <sabbasi@gitlab.com>

fix(runway-base): Implement "startup" and "readiness" probes.

See merge request !1197

We have _Horizontal Pod Autoscaler_ set up to control the number of pods based
on CPU limits. Limit VPA to only adapt the memory request (and limit) so that
the two systems don't fight with each other.

Issue: team#627

This avoids VPA evicting Pods to resize their resource requriements.

Issue: team#627

This is to limit the maximum amount of memory per pod, e.g. for Java based
applications that will consume all available memory.

chore(deps): update registry.gitlab.com/gitlab-org/cli docker tag to v1.68.0

See merge request !1199

chore(deps): update dependency goreleaser/goreleaser to v2.12

See merge request !1202

chore(deps): update otel/opentelemetry-collector-contrib docker tag to v0.134.1

See merge request !1203

fix(deps): update module cloud.google.com/go/compute to v1.45.0

See merge request !1204

fix(deps): update module github.com/prometheus/common to v0.66.1

See merge request !1205

fix(deps): update module github.com/spf13/cobra to v1.10.1

See merge request !1206

chore(deps): update dependency checkov to v3.2.469

See merge request !1201

chore(deps): update terraform vault to v5.2.1

See merge request !1074

chore(deps): update terraform docker to v3.6.2

See merge request !1013

chore(deps): update terraform cloudflare to v4.52.2

See merge request !1097

chore(deps): update dependency terraform to v1.13.1

See merge request !1186

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.91

See merge request !1189

fix(runway-base): Only control memory using Vertical Pod Autoscaler.

See merge request !1198