feat: upgrade cluster-api to v1.10.10 by schegi · Pull Request #358 · ionos-cloud/cluster-api-provider-ionoscloud

schegi · 2026-04-13T07:19:44Z

Summary

Bump `sigs.k8s.io/cluster-api` and `cluster-api/test` v1.8.12 → v1.10.10
Bump `sigs.k8s.io/controller-runtime` v0.18.7 → v0.20.4 and `k8s.io/*` v0.30.x → v0.32.3
Fix CAPI v1.9 predicate signatures: `ResourceNotPaused` and `ClusterUnpaused` now require scheme argument
Fix CAPI v1.10 API rename: `E2EConfig.GetVariable` → `MustGetVariable` (2 call sites in e2e tests)
Fix import path change: `exp/addons/api/v1beta1` → `api/addons/v1beta1` (addons graduated from experimental)
Add `--skip-crd-migration-phases` flag and wire `CRDMigrator` controller for all provider CRDs per CAPI v1.10 migration guide
Remove deprecated `FailureReason`/`FailureMessage` fields from `IonosCloudMachineStatus`
Update e2e clusterctl config: component URLs → v1.10.10
Add `test/e2e/data/shared/v1.10/metadata.yaml` for clusterctl compatibility
Update README compatibility table with CAPI v1.9 and v1.10 columns
Update golangci-lint config for `+list` marker support

Migration Guides Implemented

Explicitly Not Included

No v1beta2 conditions adoption
No `metav1.Condition` migration

Release Notes

Important: The CRD migrator adds the `crd-migration.cluster.x-k8s.io/observed-generation` annotation to CRD objects. If CRDs are managed by a GitOps tool such as kapp, Argo CD, or Flux, ensure this annotation is not continuously removed (e.g. by configuring the tool to ignore it), otherwise the migrator will re-run on every reconciliation.

Test plan

🤖 Generated with Claude Code

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…vider-ionoscloud

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Resolves HIGH severity CVE-2026-39883 (PATH hijacking via BSD kenv) detected by Trivy image scan in CI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Resolves HIGH severity CVE-2026-32282 (Root.Chmod symlink traversal) in Go stdlib, detected by Trivy image scan in CI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

schegi · 2026-04-13T07:35:48Z

@copilot review

Copilot · 2026-04-13T07:39:15Z

@copilot review

Here's my review of the PR changes:

Overall: The PR correctly implements all required migration steps from CAPI v1.8.12 → v1.10.10. The changes are well-scoped and follow the upstream migration guides.

✅ Migration Guide Compliance

v1.8 → v1.9 (predicate signatures) — cmd/internal/controller/ionoscloudcluster_controller.go correctly adds the mgr.GetScheme() argument to both predicates.ResourceNotPaused and predicates.ClusterUnpaused, which now require a scheme parameter.

v1.9 → v1.10 (API renames) — E2EConfig.GetVariable → MustGetVariable correctly updated in both suite_test.go call sites.

Addons graduation — exp/addons/api/v1beta1 → api/addons/v1beta1 correctly updated in finalizers.go and ownerreference.go.

CRDMigrator — All four CRD types (IonosCloudCluster, IonosCloudClusterTemplate, IonosCloudMachine, IonosCloudMachineTemplate) are registered. UseCache: true for the types that have dedicated reconcilers using the cache, UseCache: false for template types. RBAC markers, scheme registration, and the --skip-crd-migration-phases flag are all wired up correctly.

✅ Code Quality

Test code modernized with t.Context(), wg.Go() (Go 1.25), and testing/synctest (stabilized in Go 1.25) — all consistent with the go 1.25.0 requirement in go.mod.
slices.Delete() replaces the manual append(s[:i], s[i+1:]...) pattern in network.go, avoiding the slice aliasing footgun.
setupControllers() extracted as a helper function, returning errors instead of calling os.Exit directly — improves testability.

⚠️ Minor Observations

Go version mismatch: go.mod specifies go 1.25.0 but Dockerfile uses golang:1.25.9 (bumped for CVE-2026-32282). This is intentional and fine — the go directive is a minimum version floor, not the exact build version.
e2e config version inconsistency (pre-existing, now fixed): The old config had name: "v1.8.5" but downloaded from v1.8.1 URLs. Now both name and URL are consistently v1.10.10.
golangci-lint suppressions: The SA1019 suppression for sigs.k8s.io/cluster-api/errors is necessary since FailureReason/FailureMessage removal is deferred to the follow-up PR — this is correctly documented in the PR description.
Docs plan files: docs/superpowers/plans/ and docs/superpowers/specs/ add ~1,900 lines of implementation notes. These are fine as architecture decision records, but worth confirming the team wants them committed vs. kept in an external tracker.

No blocking issues found. The PR is ready for merge once the follow-up FailureReason/FailureMessage removal PR is planned.

These were created during development and should not be in the repo. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

schegi · 2026-04-15T12:28:59Z

Replaces: #352
#353

Copilot

Pull request overview

Upgrades this provider to Cluster API v1.10.10 (and aligned Kubernetes/controller-runtime deps), and applies the required API/migration-guide changes so controllers and e2e infrastructure continue to work with CAPI v1.10.

Changes:

Bump sigs.k8s.io/cluster-api (+ test framework) to v1.10.10 and align controller-runtime/k8s.io/* dependencies.
Wire up CAPI’s CRDMigrator controller (plus RBAC + flag) and update controller predicate calls to match new signatures.
Update e2e wiring (clusterctl config/metadata, addon import path, E2EConfig API rename) and refresh docs/tooling config.

Reviewed changes

Copilot reviewed 16 out of 17 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`go.mod`	Updates core deps to CAPI v1.10.10 / controller-runtime v0.20.4 / k8s v0.32.3 and adds new indirects.
`go.sum`	Module checksum updates corresponding to the dependency bump.
`cmd/main.go`	Adds CRDMigrator controller setup, CRD scheme registration, and `--skip-crd-migration-phases` flag + RBAC markers.
`config/rbac/role.yaml`	Grants CRD read/patch permissions needed by CRDMigrator.
`internal/controller/ionoscloudcluster_controller.go`	Updates pause predicates to new CAPI signatures requiring scheme.
`config/crd/bases/infrastructure.cluster.x-k8s.io_ionoscloudclusters.yaml`	Regenerated CRD schema updates from newer tooling/deps.
`config/crd/bases/infrastructure.cluster.x-k8s.io_ionoscloudmachines.yaml`	Regenerated CRD schema updates from newer tooling/deps.
`config/crd/bases/infrastructure.cluster.x-k8s.io_ionoscloudclustertemplates.yaml`	Regenerated CRD schema updates from newer tooling/deps.
`config/crd/bases/infrastructure.cluster.x-k8s.io_ionoscloudmachinetemplates.yaml`	Regenerated CRD schema updates from newer tooling/deps.
`test/e2e/suite_test.go`	Updates to `MustGetVariable` per CAPI v1.10 E2EConfig API rename.
`test/e2e/helpers/ownerreference.go`	Updates addons API import path to graduated location.
`test/e2e/helpers/finalizers.go`	Updates addons API import path to graduated location.
`test/e2e/config/ionoscloud.yaml`	Updates clusterctl component URLs and metadata reference to v1.10.10.
`test/e2e/data/shared/v1.10/metadata.yaml`	Adds clusterctl metadata for CAPI v1.10 compatibility.
`README.md`	Extends compatibility matrix to include a CAPI v1.10 column.
`Dockerfile`	Bumps Go builder image patch version.
`.golangci.yml`	Adjusts lint exclusions for deprecated CAPI errors package and `+list` marker handling.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

piepmatz · 2026-04-16T13:56:45Z

1 more thing: The CAPI migration docs contain this important bit:

Note: The CRD migrator will add the crd-migration.cluster.x-k8s.io/observed-generation annotation on the CRD object, please ensure that if these CRD objects are deployed with a tool like kapp / Argo / Flux the annotation is not continuously removed.

Please add that do the PR description. We must not forget putting this into the release notes.

- Scope CRDMigrator RBAC markers to our 4 CRD resource names (patch/update) and drop the overly-broad unscoped patch permission; regenerate role.yaml - Rename setupControllers → setUpControllers ("set up" is a phrasal verb) - Update --skip-crd-migration-phases flag description to list valid values instead of referencing the internal CAPI CRDMigrator implementation - Remove deprecated FailureReason/FailureMessage fields from IonosCloudMachineStatus, drop the cluster-api/errors import, remove HasFailed() and its call site, and delete the associated tests - Clean up compatibility matrix: drop stale v1.7 column and v0.2/v0.3 rows, add v1.9 column, mark only v0.6 as compatible with v1.9 and v1.10, remove premature v0.7 row Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sonarqubecloud · 2026-04-29T11:09:49Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Signed-off-by: Gaurav Gahlot <gaurav.gahlot@ionos.com>

Scope the mutating CRD verbs to our CRDs by name and merge the customresourcedefinitions and customresourcedefinitions/status rules into a single update;patch rule. Add CR RBAC for the template kinds (ionoscloudclustertemplates, ionoscloudmachinetemplates), which have no reconciler and were previously missing markers. Addresses PR #358 review comments. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

sonarqubecloud · 2026-06-11T13:40:12Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@gauravgahlot

Parental leave, @gauravgahlot checked and approved.

schegi and others added 16 commits April 1, 2026 17:21

docs: add cluster-api v1.9.11 upgrade design spec

969138b

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Merge branch 'main' of https://github.com/ionos-cloud/cluster-api-pro…

a02cd77

…vider-ionoscloud

docs: add cluster-api v1.9.11 upgrade implementation plan

80cae03

Merge branch 'main' of https://github.com/ionos-cloud/cluster-api-pro…

91a5f62

…vider-ionoscloud

docs: add cluster-api v1.10.10 upgrade design spec

6346fd8

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs: add README compatibility table update to upgrade spec

ece600d

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs: add cluster-api v1.10.10 upgrade implementation plan

1d957bb

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chore(deps): bump cluster-api v1.8.12 -> v1.10.10 and dependencies

c2017f9

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix: update predicate signatures for CAPI v1.9+ (scheme argument)

18c3a18

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(e2e): rename GetVariable to MustGetVariable for CAPI v1.10

16a513c

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(e2e): update addons import path (graduated from experimental)

ea31ae4

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chore: update golangci-lint config for CAPI v1.10 markers

d73ded6

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chore(e2e): update CAPI component URLs to v1.10.10

ccee414

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs: update compatibility table for CAPI v1.10

9cac7c6

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

feat: add CRDMigrator controller per CAPI v1.10 migration guide

0b25bdd

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chore: regenerate manifests, deepcopy, and mocks for CAPI v1.10.10

43bcc89

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

schegi had a problem deploying to e2e April 13, 2026 07:19 — with GitHub Actions Failure

schegi mentioned this pull request Apr 13, 2026

feat(api): remove deprecated FailureReason/FailureMessage fields #359

Draft

4 tasks

fix: upgrade go.opentelemetry.io/otel/sdk to v1.43.0 for CVE-2026-39883

70e71a8

Resolves HIGH severity CVE-2026-39883 (PATH hijacking via BSD kenv) detected by Trivy image scan in CI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

schegi had a problem deploying to e2e April 13, 2026 07:30 — with GitHub Actions Failure

fix: bump Go builder image to 1.25.9 for CVE-2026-32282

41d7027

Resolves HIGH severity CVE-2026-32282 (Root.Chmod symlink traversal) in Go stdlib, detected by Trivy image scan in CI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

schegi had a problem deploying to e2e April 13, 2026 07:35 — with GitHub Actions Failure

Copilot started work on behalf of schegi April 13, 2026 07:35 View session

chore: remove agent-generated plan and spec docs

97d5ed3

These were created during development and should not be in the repo. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

schegi temporarily deployed to e2e April 13, 2026 07:39 — with GitHub Actions Inactive

Copilot finished work on behalf of schegi April 13, 2026 07:40

schegi marked this pull request as ready for review April 15, 2026 12:27

Copilot AI review requested due to automatic review settings April 15, 2026 12:27

schegi requested review from jriedel-ionos and wikkyk as code owners April 15, 2026 12:27

Copilot started reviewing on behalf of schegi April 15, 2026 12:28 View session

Copilot AI reviewed Apr 15, 2026

View reviewed changes

piepmatz previously requested changes Apr 16, 2026

View reviewed changes

schegi temporarily deployed to e2e April 29, 2026 11:09 — with GitHub Actions Inactive

tinashe-mundangepfupfu previously approved these changes May 18, 2026

View reviewed changes

Merge branch 'main' into feat/upgrade-capi-v1.10.10

30657db

schegi requested review from WassimKallel, gauravgahlot and pulish as code owners June 8, 2026 15:00

schegi requested a deployment to e2e June 8, 2026 15:00 — with GitHub Actions Waiting

schegi requested a review from piepmatz June 9, 2026 11:09

make CI happy

c911b12

Signed-off-by: Gaurav Gahlot <gaurav.gahlot@ionos.com>

gauravgahlot dismissed tinashe-mundangepfupfu’s stale review via c911b12 June 11, 2026 09:46

gauravgahlot requested a deployment to e2e June 11, 2026 09:46 — with GitHub Actions Waiting

update Go from v1.25.10 to v1.25.11

cb2a064

Signed-off-by: Gaurav Gahlot <gaurav.gahlot@ionos.com>

gauravgahlot had a problem deploying to e2e June 11, 2026 09:59 — with GitHub Actions Failure

schegi temporarily deployed to e2e June 11, 2026 13:39 — with GitHub Actions Inactive

gauravgahlot approved these changes Jun 11, 2026

View reviewed changes

schegi merged commit de375f0 into main Jun 12, 2026
10 checks passed

schegi deleted the feat/upgrade-capi-v1.10.10 branch June 12, 2026 09:52

Uh oh!

Conversation

schegi commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Migration Guides Implemented

Explicitly Not Included

Release Notes

Test plan

Uh oh!

schegi commented Apr 13, 2026

Uh oh!

Copilot AI commented Apr 13, 2026

✅ Migration Guide Compliance

✅ Code Quality

⚠️ Minor Observations

Uh oh!

schegi commented Apr 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

piepmatz commented Apr 16, 2026

Uh oh!

sonarqubecloud Bot commented Apr 29, 2026

Quality Gate passed

Uh oh!

sonarqubecloud Bot commented Jun 11, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

schegi commented Apr 13, 2026 •

edited

Loading