Merge pull request #225 from RadekManak/rebase

OCPCLOUD-2742: Merge https://github.com/kubernetes-sigs/cluster-api:v1.8.4 into master

Author: openshift-merge-bot[bot]

.github/ISSUE_TEMPLATE/kubernetes_bump.md

@@ -11,30 +11,20 @@ This issue is tracking the tasks that should be implemented **after** the Kubern
 
 ## Tasks
 
-Prerequisites:
-* [ ] Decide which Cluster API release series will support the new Kubernetes version
-  * If feasible we usually cherry-pick the changes back to the latest release series.
+**Note:** If feasible we usually cherry-pick the changes back to the latest release series.
 
 ### Supporting managing and running on the new Kubernetes version
 
 This section contains tasks to update our book, e2e testing and CI to use and test the new Kubernetes version
 as well as changes to Cluster API that we might have to make to support the new Kubernetes version. All of these
 changes should be cherry-picked to all release series that will support the new Kubernetes version.
 
-* [ ] Modify quickstart and CAPD to use the new Kubernetes release:
-  * Bump the Kubernetes version in:
-    * `test/*`: search for occurrences of the previous Kubernetes version
-    * `Tiltfile`
-  * Ensure the latest available kind version is used (including the latest images for this kind release)
-    * Add new images in the [kind mapper.go](https://github.com/kubernetes-sigs/cluster-api/blob/0f47a19e038ee6b0d3b1e7675a62cdaf84face8c/test/infrastructure/kind/mapper.go#L79).
-      * See the [kind releases page](https://github.com/kubernetes-sigs/kind/releases) for the list of released images.
-    * Set new default image for the [test framework](https://github.com/kubernetes-sigs/cluster-api/blob/0f47a19e038ee6b0d3b1e7675a62cdaf84face8c/test/framework/bootstrap/kind_provider.go#L40)
-    * If code changes are required for CAPD to incorporate the new Kind version, update [kind latestMode](https://github.com/kubernetes-sigs/cluster-api/blob/0f47a19e038ee6b0d3b1e7675a62cdaf84face8c/test/infrastructure/kind/mapper.go#L66)
-    * Prior art: #10094
-  * Verify the quickstart manually
-  * Bump `InitWithKubernetesVersion` and `WorkloadKubernetesVersion` in `clusterctl_upgrade_test.go`
-    * Note: Only bump for Cluster API versions that will support the new Kubernetes release.
-  * Prior art: #9160
+* [ ] Continuously modify CAPD to use early versions of the upcoming Kubernetes release (betas and rcs):
+  * Bump the Kubernetes version in `test/*` except for `test/infrastructure/kind/*`.
+  * Prior art: #10384
+* [ ] Modify CAPD to use the new Kubernetes release after it is GA:
+  * Bump the Kubernetes version in `test/*` except for `test/infrastructure/kind/*`.
+  * Prior art: #10454
 * [ ] Ensure the jobs are adjusted to provide test coverage according to our [support policy](https://cluster-api.sigs.k8s.io/reference/versions.html#supported-kubernetes-versions):
 
   * At the `.versions`  section in the `cluster-api-prowjob-gen.yaml` file in [test-infra](https://github.com/kubernetes/test-infra/blob/master/config/jobs/kubernetes-sigs/cluster-api/):
@@ -55,13 +45,36 @@ changes should be cherry-picked to all release series that will support the new
     TEST_INFRA_DIR=../../k8s.io/test-infra make generate-test-infra-prowjobs
     ```
 
+  * Prior art: #32456
+
 * [ ] Update book:
   * Update supported versions in `versions.md`
-  * Prior art: #9161
+  * Prior art: #10454
+
 * [ ] Issues specific to the Kubernetes minor release:
   * Sometimes there are adjustments that we have to make in Cluster API to be able to support
     a new Kubernetes minor version. Please add these issues here when they are identified.
 
+### Bump quickstart and kind image references in CAPD
+
+Prerequisites:
+
+* The target Kubernetes version is GA
+* There is a new [kind version with/or a new set of kind images](https://github.com/kubernetes-sigs/kind/releases) for the target Kubernetes version
+
+* [ ] Bump quickstart and kind image references in CAPD:
+  * Bump the Kubernetes version in:
+    * `docs/*`
+    * `Tiltfile`
+  * Bump kind image references in CAPD (and also kind if necessary, including the latest images for this kind release)
+    * Add new images in the [kind mapper.go](https://github.com/kubernetes-sigs/cluster-api/blob/0f47a19e038ee6b0d3b1e7675a62cdaf84face8c/test/infrastructure/kind/mapper.go#L79).
+      * See the [kind releases page](https://github.com/kubernetes-sigs/kind/releases) for the list of released images.
+    * Set new default image for the [test framework](https://github.com/kubernetes-sigs/cluster-api/blob/0f47a19e038ee6b0d3b1e7675a62cdaf84face8c/test/framework/bootstrap/kind_provider.go#L40)
+    * If code changes are required for CAPD to incorporate the new Kind version, update [kind latestMode](https://github.com/kubernetes-sigs/cluster-api/blob/0f47a19e038ee6b0d3b1e7675a62cdaf84face8c/test/infrastructure/kind/mapper.go#L66)
+  * Verify the quickstart manually
+  * Prior art: #10610
+* [ ] Cherry-pick above PR to the latest release branch.
+
 ### Using new Kubernetes dependencies
 
 This section contains tasks to update Cluster API to use the latest Kubernetes Go dependencies and related topics
@@ -72,17 +85,19 @@ run the Cluster API controllers on the new Kubernetes version.
 * [ ] Ensure there is a new controller-runtime minor release which uses the new Kubernetes Go dependencies.
 * [ ] Update our Prow jobs for the `main` branch to use the correct `kubekins-e2e` image via the configuration file and by running `make generate-test-infra-prowjobs`.
   * It is recommended to have one PR for presubmit and one for periodic jobs to reduce the risk of breaking the periodic jobs.
-  * Prior art: presubmit jobs: https://github.com/kubernetes/test-infra/pull/27311
-  * Prior art: periodic jobs: https://github.com/kubernetes/test-infra/pull/27326
+  * Prior art: https://github.com/kubernetes/test-infra/pull/32380
 * [ ] Bump the Go version in Cluster API: (if Kubernetes is using a new Go minor version)
   * Search for the currently used Go version across the repository and update it
   * We have to at least modify it in: `hack/ensure-go.sh`, `.golangci.yml`, `cloudbuild*.yaml`, `go.mod`, `Makefile`, `netlify.toml`, `Tiltfile`
-  * Prior art: #7135
+  * Prior art: #10452
 * [ ] Bump controller-runtime
 * [ ] Bump controller-tools
 * [ ] Bump the Kubernetes version used in integration tests via `KUBEBUILDER_ENVTEST_KUBERNETES_VERSION` in `Makefile`
   * **Note**: This PR should be cherry-picked as well. It is part of this section as it depends on kubebuilder/controller-runtime
     releases and is not strictly necessary for [Supporting managing and running on the new Kubernetes version](#supporting-managing-and-running-on-the-new-kubernetes-version).
+  * Prior art to release envtest binaries: https://github.com/kubernetes-sigs/kubebuilder/pull/3864
   * Prior art: #7193
 * [ ] Bump conversion-gen via `CONVERSION_GEN_VER` in `Makefile`
   * Prior art: #7118
+
+After release of CAPI v1.X.x (that supports Kubernetes v1.Y):

.github/ISSUE_TEMPLATE/release_tracking.md

@@ -81,4 +81,7 @@ Continuously:
 If and when necessary:
 * [ ] [Release Lead] [Track] [Bump the Cluster API apiVersion](https://github.com/kubernetes-sigs/cluster-api/blob/main/docs/release/release-tasks.md#optional-track-bump-the-cluster-api-apiversion)
 * [ ] [Release Lead] [Track] [Bump the Kubernetes version](https://github.com/kubernetes-sigs/cluster-api/blob/main/docs/release/release-tasks.md#optional-track-bump-the-kubernetes-version)
-* [ ] [Release Lead] [Track Release and Improvement tasks](https://github.com/kubernetes-sigs/cluster-api/blob/main/docs/release/release-tasks.md#optional-track-release-and-improvement-tasks)
+* [ ] [Release Lead] [Track Release and Improvement tasks](https://github.com/kubernetes-sigs/cluster-api/blob/main/docs/release/release-tasks.md#optional-track-release-and-improvement-tasks)
+
+/priority critical-urgent
+/kind feature

.github/dependabot.yaml

@@ -7,33 +7,48 @@ updates:
   directory: "/"
   schedule:
       interval: "weekly"
+  groups:
+    all-github-actions:
+      patterns: [ "*" ]
   commit-message:
       prefix: ":seedling:"
   labels:
     - "area/ci"
     - "ok-to-test"
 
-# Main Go module
+# Go modules
 - package-ecosystem: "gomod"
-  directory: "/"
+  directories:
+  - "/"
+  - "/test"
+  - "/hack/tools"
   schedule:
     interval: "weekly"
     day: "monday"
   ## group all dependencies with a k8s.io prefix into a single PR.
   groups:
-    kubernetes:
-      patterns: [ "k8s.io/*" ]
+    all-go-mod-patch-and-minor:
+      patterns: [ "*" ]
+      update-types: [ "patch", "minor" ]
   ignore:
   # Ignore controller-runtime as its upgraded manually.
   - dependency-name: "sigs.k8s.io/controller-runtime"
     update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
     # Ignore k8s and its transitives modules as they are upgraded manually together with controller-runtime.
   - dependency-name: "k8s.io/*"
     update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+  - dependency-name: "github.com/prometheus/*"
+    update-types: [ "version-update:semver-major", "version-update:semver-minor"]
   - dependency-name: "go.etcd.io/*"
     update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
   - dependency-name: "google.golang.org/grpc"
     update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+  # Note: We have to keep this 100% in sync with k8s.io, so we get exactly the behavior
+  # that the k8s.io CEL code expects.
+  - dependency-name: "github.com/google/cel-go"
+    # Ignore kind as its upgraded manually.
+  - dependency-name: "sigs.k8s.io/kind"
+    update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
     # Bumping the kustomize API independently can break compatibility with client-go as they share k8s.io/kube-openapi as a dependency.
   - dependency-name: "sigs.k8s.io/kustomize/api"
     update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
@@ -42,63 +57,3 @@ updates:
   labels:
     - "area/dependency"
     - "ok-to-test"
-
-  # Test Go module
-- package-ecosystem: "gomod"
-  directory: "/test"
-  schedule:
-    interval: "weekly"
-    day: "tuesday"
-  ## group all dependencies with a k8s.io prefix into a single PR.
-  groups:
-    kubernetes:
-      patterns: [ "k8s.io/*" ]
-  ignore:
-    # Ignore controller-runtime as its upgraded manually.
-    - dependency-name: "sigs.k8s.io/controller-runtime"
-      update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
-    # Ignore k8s and its transitives modules as they are upgraded manually together with controller-runtime.
-    - dependency-name: "k8s.io/*"
-      update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
-    - dependency-name: "go.etcd.io/*"
-      update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
-    - dependency-name: "google.golang.org/grpc"
-      update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
-    # Bumping the kustomize API independently can break compatibility with client-go as they share k8s.io/kube-openapi as a dependency.
-    - dependency-name: "sigs.k8s.io/kustomize/api"
-      update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
-  commit-message:
-    prefix: ":seedling:"
-  labels:
-    - "area/dependency"
-    - "ok-to-test"
-
-  # Hack/tools Go module
-- package-ecosystem: "gomod"
-  directory: "/hack/tools"
-  schedule:
-    interval: "weekly"
-    day: "wednesday"
-  ## group all dependencies with a k8s.io prefix into a single PR.
-  groups:
-    kubernetes:
-      patterns: [ "k8s.io/*" ]
-  ignore:
-    # Ignore controller-runtime as its upgraded manually.
-    - dependency-name: "sigs.k8s.io/controller-runtime"
-      update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
-    # Ignore k8s and its transitives modules as they are upgraded manually together with controller-runtime.
-    - dependency-name: "k8s.io/*"
-      update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
-    - dependency-name: "go.etcd.io/*"
-      update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
-    - dependency-name: "google.golang.org/grpc"
-      update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
-    # Bumping the kustomize API independently can break compatibility with client-go as they share k8s.io/kube-openapi as a dependency.
-    - dependency-name: "sigs.k8s.io/kustomize/api"
-      update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
-  commit-message:
-    prefix: ":seedling:"
-  labels:
-    - "area/dependency"
-    - "ok-to-test"

.github/workflows/pr-gh-workflow-approve.yaml

@@ -8,6 +8,8 @@ on:
       - reopened
       - synchronize
 
+permissions: {}
+
 jobs:
   approve:
     name: Approve ok-to-test

.github/workflows/pr-md-link-check.yaml

@@ -14,10 +14,10 @@ jobs:
     name: Broken Links
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # tag=v4.1.2
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # tag=v4.1.7
     - uses: gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368 # tag=v1
       with:
         use-quiet-mode: 'yes'
         config-file: .markdownlinkcheck.json
         check-modified-files-only: 'yes'
-        base-branch: release-1.7
+        base-branch: release-1.8

.github/workflows/release.yaml

@@ -17,12 +17,12 @@ jobs:
       release_tag: ${{ steps.release-version.outputs.release_version }}
     steps:
       - name: Checkout code 
-        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # tag=v4.1.2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # tag=v4.1.7
         with:
           fetch-depth: 0
       - name: Get changed files
         id: changed-files
-        uses: tj-actions/changed-files@2d756ea4c53f7f6b397767d8723b3a10a9f35bf2 # tag=v44.0.0
+        uses: tj-actions/changed-files@6b2903bdce6310cfbddd87c418f253cf29b2dec9 # tag=v44.5.6
       - name: Get release version
         id: release-version
         run: |
@@ -87,14 +87,14 @@ jobs:
         env:
           RELEASE_TAG: ${{needs.push_release_tags.outputs.release_tag}}
       - name: checkout code
-        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # tag=v4.1.2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # tag=v4.1.7
         with:
           fetch-depth: 0
           ref: ${{ env.RELEASE_TAG }}
       - name: Calculate go version
         run: echo "go_version=$(make go-version)" >> $GITHUB_ENV
       - name: Set up Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # tag=v5.0.0
+        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # tag=v5.0.2
         with:
           go-version: ${{ env.go_version }}
       - name: generate release artifacts
@@ -105,7 +105,7 @@ jobs:
           curl -L "https://raw.githubusercontent.com/${{ github.repository }}/main/CHANGELOG/${{ env.RELEASE_TAG }}.md" \
           -o "${{ env.RELEASE_TAG }}.md"
       - name: Release
-        uses: softprops/action-gh-release@9d7c94cfd0a1f3ed45544c887983e9fa900f0564 # tag=v2.0.4
+        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # tag=v2.0.8
         with:
           draft: true
           files: out/*

.github/workflows/weekly-md-link-check.yaml

@@ -14,10 +14,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        branch: [ main, release-1.6, release-1.5 ]
+        branch: [ main, release-1.7, release-1.6 ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # tag=v4.1.2
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # tag=v4.1.7
         with:
           ref: ${{ matrix.branch }}
       - uses: gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368 # tag=v1

.github/workflows/weekly-security-scan.yaml

@@ -13,19 +13,19 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        branch: [ main, release-1.6, release-1.5 ]
+        branch: [ main, release-1.7, release-1.6 ]
     name: Trivy
     runs-on: ubuntu-latest
     steps:
     - name: Check out code
-      uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # tag=v4.1.2
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # tag=v4.1.7
       with:
         ref: ${{ matrix.branch }}
     - name: Calculate go version
       id: vars
       run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
     - name: Set up Go
-      uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # tag=v5.0.0
+      uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # tag=v5.0.2
       with:
         go-version: ${{ steps.vars.outputs.go_version }}
     - name: Run verify security target

.github/workflows/weekly-test-release.yaml

@@ -17,10 +17,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        branch: [ main, release-1.6, release-1.5 ]
+        branch: [ main, release-1.7, release-1.6 ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # tag=v4.1.2
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # tag=v4.1.7
         with:
           ref: ${{ matrix.branch }}
           fetch-depth: 0
@@ -32,7 +32,7 @@ jobs:
       - name: Calculate go version
         run: echo "go_version=$(make go-version)" >> $GITHUB_ENV
       - name: Set up Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # tag=v5.0.0
+        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # tag=v5.0.2
         with:
           go-version: ${{ env.go_version }}
       - name: Test release