Merge https://github.com/kubernetes/cloud-provider-vsphere:master (7540cfb) into main

[cloud-team-rebase-bot]

This is an automated rebase PR generated by RebaseBot.

Summary

• Source: https://github.com/kubernetes/cloud-provider-vsphere:master
• Destination: https://github.com/openshift/cloud-provider-vsphere:main
• 72 new upstream commits

Dropped downstream commits

• 1a8fa50 UPSTREAM: : Updating and vendoring go modules after an upstream rebase (dropped by tag policy)

Logs

View job log

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

The changes update CPI release procedures and dependency automation, add Helm node IP selection, refresh build inputs, and expand vSphere end-to-end tests for readiness, networking, VM deletion, and worker replacement.

Changes

CPI release and validation

Layer / File(s)	Summary
Release procedures and branch automation docs/book/tutorials/make_a_new_cpi_release.md, .github/dependabot.yml	The release guide now covers phased releases, dependency updates, tagging, image promotion, chart publication, and Dependabot maintenance. Dependabot adds release-1.36 configuration and updates older release metadata.
Node network configuration and installation validation charts/vsphere-cpi/values.yaml, charts/vsphere-cpi/templates/configmap.yaml, test/e2e/cpi_install_test.go	The Helm chart adds node subnet, VM network, and exclusion settings. The installation test applies these settings and verifies the worker-node IP.
VM lifecycle and worker replacement validation test/e2e/cpi_vm_test.go	VM tests retry resource lookups and identity checks, pause reconciliation during deletion, and verify replacement worker creation.
Dependency and build environment refresh go.mod, test/e2e/go.mod, hack/tools/go.mod, Makefile, cluster/images/controller-manager/Dockerfile, cloudbuild*.yaml	Go, Ginkgo, Go, Docker, and Cloud Build inputs are updated.
Workflow action pin updates .github/workflows/*	The workflows now use the pinned actions/checkout v7.0.1 action.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: 🟡 Moderate · up to 082d4

This rebase leaves mutable external container inputs, persistent write-capable checkout credentials in four workflows, and release-candidate Kubernetes modules in the production dependency graph. These create supply-chain, repository-security, and dependency-compatibility risks, so merge should wait for fixes or explicit owner acceptance.

Suggested reviewers: radekmanak, theobarberbany, zhanggbj

Sequence Diagram(s)

sequenceDiagram
  participant E2ETest
  participant Helm
  participant CPI
  participant WorkerNode
  E2ETest->>WorkerNode: Discover internal IP and VM network
  E2ETest->>Helm: Upgrade release with node network values
  Helm->>CPI: Render nodes configuration
  CPI->>WorkerNode: Select node address
  E2ETest->>WorkerNode: Verify IP remains in configured subnet

Loading

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 4 warnings)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	New E2E klog.Infof calls log runtime worker-node, VM, and vSphere network names, which can expose internal hostnames; these logs are absent from origin/main.	Remove or redact runtime node, VM, and network identifiers. Do not log raw Helm command output; use fixed status messages or sanitized values.
Test Structure And Quality	⚠️ Warning	The new nodes-config It adds multiple Expect(err).NotTo(HaveOccurred()) and Eventually(...).Should(Succeed()) calls without diagnostic messages, and its Helm upgrade has no AfterEach restore.	Add meaningful messages to all new assertions and waits. Bound the Helm command and restore the shared kube-system/vsphere-cpi configuration during cleanup.
Microshift Test Compatibility	⚠️ Warning	The changed VM-deletion test now expects the deleted worker node to disappear and a replacement worker node to be created; this node-scaling assumption is unsupported on MicroShift and has no skip...	Add [Skipped:MicroShift] to the test name or guard it with IsMicroShiftCluster and g.Skip. If MicroShift CI applies, verify with the appropriate MicroShift e2e job.
Single Node Openshift (Sno) Test Compatibility	⚠️ Warning	New It() calls getWorkerNode(), which excludes control-plane-labeled nodes and waits for a separate worker; no SNO guard exists, so it can time out on SNO.	Add [Skipped:SingleReplicaTopology] or an IsSingleNode()/skipOnSingleNodeTopology() guard, then verify with /payload-job periodic-ci-openshift-release-master-ci-4.22-e2e-aws-upgrade-ovn-single-node.
Ipv6 And Disconnected Network Test Compatibility	⚠️ Warning	The new Ginkgo It at cpi_install_test.go:103 hardcodes /24 and 255.255.255.0/24, so it assumes IPv4 instead of adapting to IPv6.	Run the required IPv6 CI job. Replace these values with family-aware CIDRs using GetIPAddressFamily()/correctCIDRFamily(), or skip the test when IPv4 is required.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the upstream repository, source revision, and target branch for the merge described in the PR objectives.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR adds one Ginkgo It title, and it is a static literal; all project-level It/Describe/Context/When titles use literals with no dynamic node, IP, pod, namespace, or timestamp data.
Topology-Aware Scheduling Compatibility	✅ Passed	The diff adds vSphere node IP settings to a ConfigMap and updates E2E polling; no Deployment/DaemonSet scheduling fields or topology constraints changed. Existing control-plane affinity is unchanged.
Ote Binary Stdout Contract	✅ Passed	The PR adds only klog calls inside Ginkgo It/By test bodies; it adds no process-level stdout writes, and e2e_suite_test.go is unchanged.
No-Weak-Crypto	✅ Passed	The PR diff adds no weak-crypto calls, modes, custom crypto, or secret comparisons; the only MD5/SHA1/DES/RC4 matches are generated x/tools stdlib metadata.
Container-Privileges	✅ Passed	The PR adds no privileged, hostPID, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation settings; existing hostNetwork and non-root settings are unchanged, and the image uses USER nobody.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

Hi @cloud-team-rebase-bot[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign nrb for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/book/tutorials/make_a_new_cpi_release.md`:
- Around line 196-202: Update the GITHUB_TOKEN setup instructions to avoid
placing the personal access token in shell history; replace the inline export
example with a hidden prompt or credential-manager approach that assigns and
exports the token while preserving the existing environment-variable
requirement.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4b9fcb6c-9e86-4431-bf0e-115d89d3ee06

📥 Commits

Reviewing files that changed from the base of the PR and between eb29de1 and 01bea79.

📒 Files selected for processing (3)

• .github/dependabot.yml
• docs/book/tutorials/make_a_new_cpi_release.md
• test/e2e/cpi_vm_test.go

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Avoid placing the PAT directly in shell history.

Lines [198-202] encourage users to type a live token into a command; Bash can save that command to the history file. Use a credential manager or hidden prompt instead. (gnu.org)

Safer example

read -rsp "GitHub token: " GITHUB_TOKEN
printf '\n'
export GITHUB_TOKEN

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/book/tutorials/make_a_new_cpi_release.md` around lines 196 - 202, Update
the GITHUB_TOKEN setup instructions to avoid placing the personal access token
in shell history; replace the inline export example with a hidden prompt or
credential-manager approach that assigns and exports the token while preserving
the existing environment-variable requirement.