Merge https://github.com/kubernetes-sigs/cluster-api:v1.12.0 (b52de69) into master

.github/ISSUE_TEMPLATE/kubernetes_bump.md

@@ -25,6 +25,8 @@ changes should be cherry-picked to all release series that will support the new
 * [ ] Modify CAPD to use the new Kubernetes release after it is GA:
   * Bump the Kubernetes version in `test/*` except for `test/infrastructure/kind/*`.
   * Prior art: https://github.com/kubernetes-sigs/cluster-api/pull/11030
+* [ ] Start testing with next Kubernetes release on main by bumping `KUBERNETES_VERSION_LATEST_CI` in `docker.yaml`
+  * Prior art: https://github.com/kubernetes-sigs/cluster-api/pull/12709
 * [ ] Ensure the jobs are adjusted to provide test coverage according to our [support policy](https://cluster-api.sigs.k8s.io/reference/versions.html#supported-kubernetes-versions):
 
   * At the `.versions`  section in the `cluster-api-prowjob-gen.yaml` file in [test-infra](https://github.com/kubernetes/test-infra/blob/master/config/jobs/kubernetes-sigs/cluster-api/):

.github/workflows/pr-gh-workflow-approve.yaml

@@ -19,7 +19,7 @@ jobs:
       actions: write
     steps:
       - name: Update PR
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         continue-on-error: true
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pr-md-link-check.yaml

@@ -14,7 +14,7 @@ jobs:
     name: Broken Links
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # tag=v6.0.0
     - uses: gaurav-nelson/github-action-markdown-link-check@3c3b66f1f7d0900e37b71eca45b63ea9eedfce31 # tag=1.0.17
       with:
         use-quiet-mode: 'yes'

.github/workflows/release.yaml

@@ -17,12 +17,12 @@ jobs:
       release_tag: ${{ steps.release-version.outputs.release_version }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # tag=v6.0.0
         with:
           fetch-depth: 0
       - name: Get changed files
         id: changed-files
-        uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # tag=v46.0.5
+        uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # tag=v47.0.0
       - name: Get release version
         id: release-version
         run: |
@@ -88,14 +88,14 @@ jobs:
         env:
           RELEASE_TAG: ${{needs.push_release_tags.outputs.release_tag}}
       - name: checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # tag=v6.0.0
         with:
           fetch-depth: 0
           ref: ${{ env.RELEASE_TAG }}
       - name: Calculate go version
         run: echo "go_version=$(make go-version)" >> $GITHUB_ENV
       - name: Set up Go
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # tag=v5.5.0
+        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # tag=v6.1.0
         with:
           go-version: ${{ env.go_version }}
       - name: generate release artifacts
@@ -106,7 +106,7 @@ jobs:
           curl -L "https://raw.githubusercontent.com/${{ github.repository }}/main/CHANGELOG/${{ env.RELEASE_TAG }}.md" \
           -o "${{ env.RELEASE_TAG }}.md"
       - name: Release
-        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # tag=v2.3.2
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # tag=v2.5.0
         with:
           draft: true
           files: out/*

.github/workflows/weekly-md-link-check.yaml

@@ -14,10 +14,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        branch: [ main, release-1.10, release-1.9, release-1.8 ]
+        branch: [ main, release-1.11, release-1.10, release-1.9 ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # tag=v6.0.0
         with:
           ref: ${{ matrix.branch }}
       - uses: gaurav-nelson/github-action-markdown-link-check@3c3b66f1f7d0900e37b71eca45b63ea9eedfce31 # tag=1.0.17

.github/workflows/weekly-security-scan.yaml

@@ -13,19 +13,19 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        branch: [ main, release-1.10, release-1.9, release-1.8 ]
+        branch: [ main, release-1.11, release-1.10, release-1.9 ]
     name: Trivy
     runs-on: ubuntu-latest
     steps:
     - name: Check out code
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # tag=v6.0.0
       with:
         ref: ${{ matrix.branch }}
     - name: Calculate go version
       id: vars
       run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
     - name: Set up Go
-      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # tag=v5.5.0
+      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # tag=v6.1.0
       with:
         go-version: ${{ steps.vars.outputs.go_version }}
     - name: Run verify security target

.github/workflows/weekly-test-release.yaml

@@ -17,10 +17,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        branch: [ main, release-1.10, release-1.9, release-1.8 ]
+        branch: [ main, release-1.11, release-1.10, release-1.9 ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # tag=v6.0.0
         with:
           ref: ${{ matrix.branch }}
           fetch-depth: 0
@@ -32,7 +32,7 @@ jobs:
       - name: Calculate go version
         run: echo "go_version=$(make go-version)" >> $GITHUB_ENV
       - name: Set up Go
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # tag=v5.5.0
+        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # tag=v6.1.0
         with:
           go-version: ${{ env.go_version }}
       - name: Test release

.gitignore

@@ -12,13 +12,13 @@ hack/tools/bin
 
 # E2E test templates
 test/e2e/data/infrastructure-docker/**/cluster-template*.yaml
-!test/e2e/data/infrastructure-docker/**/clusterclass-quick-start.yaml
 !test/e2e/data/infrastructure-docker/**/clusterclass-quick-start-runtimesdk.yaml
 !test/e2e/data/infrastructure-docker/**/clusterclass-quick-start-runtimesdk-v1beta1.yaml
 !test/e2e/data/infrastructure-docker/**/cluster-template-in-memory.yaml
 !test/e2e/data/infrastructure-docker/**/clusterclass-in-memory.yaml
 test/e2e/data/infrastructure-docker/**/clusterclass-*.yaml
 test/e2e/data/infrastructure-inmemory/**/cluster-template*.yaml
+!test/e2e/data/infrastructure-docker/**/clusterclass-quick-start.yaml
 
 # Output of Makefile targets using sed on MacOS systems
 *.yaml-e

.golangci-kal.yml

@@ -18,12 +18,15 @@ linters:
               - "conditions" # Ensure conditions have the correct json tags and markers.
               - "conflictingmarkers"
               - "duplicatemarkers" # Ensure there are no exact duplicate markers. for types and fields.
+              - "forbiddenmarkers" # Ensure that types and fields do not contain any markers that are forbidden.
               - "integers" # Ensure only int32 and int64 are used for integers.
               - "jsontags" # Ensure every field has a json tag.
               - "maxlength" # Ensure all strings and arrays have maximum lengths/maximum items.
               - "nobools" # Bools do not evolve over time, should use enums instead.
+              - "nodurations" # Prevents usage of `Duration` types.
               - "nofloats" # Ensure floats are not used.
               - "nomaps" # Ensure maps are not used.
+              - "nonullable" # Ensure that types and fields do not have the nullable marker.
               - "notimestamp" # Prevents usage of 'Timestamp' fields
               - "optionalfields" # Ensure that all fields marked as optional adhere to being pointers and
                                  # having the `omitempty` value in their `json` tag where appropriate.
@@ -50,6 +53,12 @@ linters:
                   - ["default", "kubebuilder:default"]
                   - ["required", "kubebuilder:validation:Required", "k8s:required"]
                 description: "A field with a default value cannot be required"
+            forbiddenmarkers:
+              markers:
+                # We don't want to do any defaulting (including OpenAPI) anymore on API fields because we prefer
+                # to have a clear signal on user intent. This also allows us to easily change the default behavior if necessary.
+                - identifier: "kubebuilder:default"
+                - identifier: "default"
             conditions:
               isFirstField: Warn # Require conditions to be the first field in the status struct.
               usePatchStrategy: Forbid # Forbid patchStrategy markers on the Conditions field.
@@ -83,15 +92,15 @@ linters:
     ## Excludes for current apiVersions that can be removed once v1beta1 is removed.
     # .status.deprecated.v1beta1.conditions fields are using v1beta1.Condition types.
     - path: "api/addons/v1beta2|api/bootstrap/kubeadm/v1beta2|api/controlplane/kubeadm/v1beta2|api/core/v1beta2|api/ipam/v1beta2|api/runtime/v1beta2"
-      text: "Conditions field must be a slice of metav1.Condition"
+      text: "Conditions field in .*V1Beta1DeprecatedStatus must be a slice of metav1.Condition"
       linters:
         - kubeapilinter
     - path: "api/addons/v1beta2|api/bootstrap/kubeadm/v1beta2|api/controlplane/kubeadm/v1beta2|api/core/v1beta2|api/ipam/v1beta2|api/runtime/v1beta2"
-      text: "ssatags: Conditions should have a listType marker for proper Server-Side Apply behavior"
+      text: "ssatags: .*Conditions should have a listType marker for proper Server-Side Apply behavior"
       linters:
         - kubeapilinter
     - path: "api/core/v1beta2"
-      text: "field Conditions type Conditions must have a maximum items, add kubebuilder:validation:MaxItems marker"
+      text: "field .*Conditions type Conditions must have a maximum items, add kubebuilder:validation:MaxItems marker"
       linters:
         - kubeapilinter
     - path: "api/core/v1beta2/condition_types.go"
@@ -102,24 +111,18 @@ linters:
     ## Excludes for current clusterctl v1alpha3 and Runtime Hooks v1alpha1 apiVersions (can be fixed once we bump their apiVersion).
     # Note: The types in api/runtime/hooks/v1alpha1 are not CRDs, so e.g. SSA markers don't make sense there.
     - path: "cmd/clusterctl/api/v1alpha3|api/runtime/hooks/v1alpha1"
-      text: "optionalfields|requiredfields|maxlength|ssatags"
+      text: "maxlength|ssatags"
       linters:
         - kubeapilinter
-
-    ## Excludes for JSONSchemaProps
-    # controller-gen does not allow to add MaxItems to Schemaless fields: https://github.com/kubernetes-sigs/kube-api-linter/issues/120
-    - path: "api/core/v1beta2/clusterclass_types.go"
-      text: "maxlength: field (AllOf|OneOf|AnyOf) must have a maximum items, add kubebuilder:validation:MaxItems marker"
-      linters:
-        - kubeapilinter
-    # controller-gen does not allow to add listType to Schemaless fields: https://github.com/kubernetes-sigs/kube-api-linter/issues/120
-    - path: "api/core/v1beta2/clusterclass_types.go"
-      text: "ssatags: (AllOf|OneOf|AnyOf) should have a listType marker for proper Server-Side Apply behavior"
+    - path: "cmd/clusterctl/api/v1alpha3|api/runtime/hooks/v1alpha1/(common_types.go|discovery_types.go|lifecyclehooks_types.go|topologymutation_types.go|topologymutation_variable_types.go)"
+      text: "optionalfields|requiredfields"
       linters:
         - kubeapilinter
+
+    ## Excludes for JSONSchemaProps
     # We want to align to the JSON tags of the CustomResourceDefinition fields.
     - path: "api/core/v1beta2/clusterclass_types"
-      text: "field (XPreserveUnknownFields|XPreserveUnknownFields|XValidations|XMetadata|XIntOrString) json tag does not match pattern"
+      text: "field JSONSchemaProps.(XPreserveUnknownFields|XPreserveUnknownFields|XValidations|XMetadata|XIntOrString) json tag does not match pattern"
       linters:
         - kubeapilinter
     # We want to align Properties to the corresponding field in CustomResourceDefinitions.
@@ -142,7 +145,7 @@ linters:
     ## Excludes for kubeadm types
     # We want to align the FeatureGates field to the FeatureGates field in kubeadm.
     - path: "api/bootstrap/kubeadm/v1beta2/kubeadm_types.go"
-      text: "nomaps: FeatureGates should not use a map type, use a list type with a unique name/identifier instead"
+      text: "nomaps: ClusterConfiguration.FeatureGates should not use a map type, use a list type with a unique name/identifier instead"
       linters:
         - kubeapilinter
 
@@ -161,6 +164,16 @@ linters:
       linters:
         - kubeapilinter
 
+    # Excludes for existing default markers 
+    - path: "api/core/v1beta2/clusterclass_types.go"
+      text: 'forbiddenmarkers: field ValidationRule.Reason has forbidden marker "kubebuilder:default=FieldValueInvalid"'
+      linters:
+        - kubeapilinter
+    - path: "api/core/v1beta2/clusterclass_types.go"
+      text: 'forbiddenmarkers: field ValidationRule.Reason has forbidden marker "default=ref\(sigs.k8s.io/cluster-api/api/core/v1beta2.FieldValueInvalid\)"'
+      linters:
+        - kubeapilinter
+
     # TODO: Excludes that should be removed once the corresponding issues in KAL are fixed
     # KAL incorrectly reports that the Taints field doesn't have to be a pointer (it has to be to preserve []).
     # See: https://github.com/kubernetes-sigs/kube-api-linter/issues/116

.golangci.yml

@@ -20,9 +20,11 @@ linters:
     - durationcheck # multiplying two durations
     - errcheck # unchecked errors
     - errchkjson # invalid types passed to json encoder
+    - forbidigo # allows to block usage of funcs
     - ginkgolinter # ginkgo and gomega
     - gocritic # bugs, performance, style (we could add custom ones to this one)
     - godot # checks that comments end in a period
+    - godox # block FIXMEs
     - goprintffuncname # printft-like functions should be named with f at the end
     - gosec # potential security problems
     - govet # basically 'go vet'
@@ -51,6 +53,10 @@ linters:
     # TODO: It will be dropped when the Go version migration is done.
     - usetesting
   settings:
+    forbidigo:
+      forbid:
+        - pattern: ctrl.NewControllerManagedBy
+          msg: Use capicontrollerutil.NewControllerManagedBy instead
     ginkgolinter:
       forbid-focus-container: true
     gocritic:
@@ -83,6 +89,9 @@ linters:
         - ^ \+.*
         - ^ ANCHOR.*
         - '^ (alpha|beta|GA): v.*'
+    godox:
+      keywords:
+        - FIXME # FIXME's should be removed before merging PRs
     gosec:
       excludes:
       # integer overflow conversion int -> int32
@@ -174,6 +183,10 @@ linters:
           alias: ""
         - pkg: sigs.k8s.io/cluster-api/internal/topology/names
           alias: topologynames
+        - pkg: sigs.k8s.io/cluster-api/internal/util/client
+          alias: "clientutil"
+        - pkg: sigs.k8s.io/cluster-api/internal/util/controller
+          alias: "capicontrollerutil"
         # CAPD
         - pkg: sigs.k8s.io/cluster-api/test/infrastructure/docker/api/v1alpha3
           alias: infrav1alpha3
@@ -257,19 +270,11 @@ linters:
       - linters:
           - staticcheck
         text: 'SA1019: (clusterv1alpha3.*|clusterv1alpha4.*) is deprecated: This type will be removed in one of the next releases.'
-        # Specific exclude rules for deprecated feature flags
-      - linters:
-          - staticcheck
-        text: 'SA1019: feature.ClusterResourceSet is deprecated: ClusterResourceSet feature is now GA and the corresponding feature flag will be removed in 1.12 release.'
         # v1Beta1 deprecated fields
       - linters:
           - staticcheck
         text: 'SA1019: .*\.Deprecated\.V1Beta1.* is deprecated'
-        # CR v0.21 deprecated Result.Requeue, will be fixed incrementally and tracked via https://github.com/kubernetes-sigs/cluster-api/issues/12272
-      - linters:
-          - staticcheck
-        text: 'SA1019: .*(res|result|i|j)\.Requeue is deprecated: Use `RequeueAfter` instead'
-      # TODO: var-naming: avoid meaningless package names by revive  
+      # TODO: var-naming: avoid meaningless package names by revive
       #   * test/infrastructure/docker/internal/docker/types/
       #   * bootstrap/kubeadm/types/
       #   * internal/webhooks/util/
@@ -402,6 +407,22 @@ linters:
           - staticcheck
         path: (.+)\.go$
         text: 'QF1008: could remove embedded field'
+      - linters:
+          - revive
+        path: errors/.*\.go$
+        text: 'var-naming: avoid package names that conflict with Go standard library package names'
+      - linters:
+          - revive
+        path: internal/util/hash/.*\.go$
+        text: 'var-naming: avoid package names that conflict with Go standard library package names'
+      - linters:
+          - revive
+        path: internal/controllers/topology/cluster/patches/api/.*\.go$
+        text: 'var-naming: avoid meaningless package names'
+      - linters:
+          - revive
+        path: test/infrastructure/inmemory/pkg/server/api/.*\.go$
+        text: 'var-naming: avoid meaningless package names'
 issues:
   max-issues-per-linter: 0
   max-same-issues: 0

CHANGELOG/v1.10.5.md

@@ -0,0 +1,37 @@
+## 👌 Kubernetes version support
+
+- Management Cluster: v1.28.x -> v1.33.x
+- Workload Cluster: v1.26.x -> v1.33.x
+
+[More information about version support can be found here](https://cluster-api.sigs.k8s.io/reference/versions.html)
+
+## Changes since v1.10.4
+## :chart_with_upwards_trend: Overview
+- 6 new commits merged
+- 2 feature additions ✨
+- 1 bug fixed 🐛
+
+## :sparkles: New Features
+- KCP: Bump corefile-migration to v1.0.27 (#12637)
+- Runtime SDK: Add mTLS support to runtime extension server and client (#12519)
+
+## :bug: Bug Fixes
+- MachineDeployment: Fix second rolling update for MD rolloutAfter (#12555)
+
+## :seedling: Others
+- Dependency: Bump Go to v1.23.11 (#12530)
+- Dependency: Bump Go to v1.23.12 (#12612)
+- Testing: Skipping test that is failing because of infra issues (#12566)
+
+## Dependencies
+
+### Added
+_Nothing has changed._
+
+### Changed
+- github.com/coredns/corefile-migration: [v1.0.26 → v1.0.27](https://github.com/coredns/corefile-migration/compare/v1.0.26...v1.0.27)
+
+### Removed
+_Nothing has changed._
+
+_Thanks to all our contributors!_ 😊

CHANGELOG/v1.10.6.md

@@ -0,0 +1,26 @@
+## 👌 Kubernetes version support
+
+- Management Cluster: v1.28.x -> v1.33.x
+- Workload Cluster: v1.26.x -> v1.33.x
+
+[More information about version support can be found here](https://cluster-api.sigs.k8s.io/reference/versions.html)
+
+## Changes since v1.10.5
+## :chart_with_upwards_trend: Overview
+- 1 new commit merged
+
+## :seedling: Others
+- Dependency: Bump github.com/go-viper/mapstructure/v2 to fix CVE (#12681)
+
+## Dependencies
+
+### Added
+_Nothing has changed._
+
+### Changed
+- github.com/go-viper/mapstructure/v2: [v2.3.0 → v2.4.0](https://github.com/go-viper/mapstructure/compare/v2.3.0...v2.4.0)
+
+### Removed
+_Nothing has changed._
+
+_Thanks to all our contributors!_ 😊