Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.17.0 (2509b8e) into main

.dockerignore

@@ -6,6 +6,7 @@
 bin/
 **/*.yaml
 !test/framework/vmoperator/vmoperator-capabilities-9.1.yaml
+!test/framework/vmoperator/vmoperator-capabilities-9.2.yaml
 out/
 docs/
 packaging/

.github/workflows/cover.yaml

@@ -12,12 +12,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
       with:
         egress-policy: audit
 
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-    - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
+    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: '1.22'
     - run: "PATH=/usr/local/go/bin:$PATH make test-cover"

.github/workflows/pr-dependabot.yaml

@@ -19,15 +19,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v7.0.1
     - name: Calculate go version
       id: vars
       run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
     - name: Set up Go
-      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # tag=v6.3.0
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # tag=v7.0.0
       with:
         go-version: ${{ steps.vars.outputs.go_version }}
-    - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # tag=v5.0.3
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # tag=v6.1.0
       name: Restore go cache
       with:
         path: |
@@ -40,7 +40,7 @@ jobs:
       run: make generate-modules
     - name: Update generated code
       run: make generate
-    - uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # tag=v9.1.4
+    - uses: EndBug/add-and-commit@290ea2c423ad77ca9c62ae0f5b224379612c0321 # tag=v10.0.0
       name: Commit changes
       with:
         author_name: dependabot[bot]

.github/workflows/pr-gh-workflow-approve.yaml

@@ -17,7 +17,7 @@ jobs:
       actions: write
     steps:
       - name: Update PR
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         continue-on-error: true
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pr-golangci-lint.yaml

@@ -8,6 +8,24 @@ on:
 permissions: {}
 
 jobs:
+  golangci-api:
+    name: lint-api
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v7.0.1
+        with:
+          persist-credentials: false
+      - name: Calculate go version
+        id: vars
+        run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # tag=v7.0.0
+        with:
+          go-version: ${{ steps.vars.outputs.go_version }}
+      - name: Lint API
+        run: make lint-api
   golangci:
     name: lint
     runs-on: ubuntu-latest
@@ -16,23 +34,22 @@ jobs:
       matrix:
         working-directory:
           - ""
+          - api
           - test
           - packaging
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v7.0.1
         with:
-          fetch-depth: 0 # needed for --new-from-rev
+          persist-credentials: false
       - name: Calculate go version
         id: vars
         run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
       - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # tag=v6.3.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # tag=v7.0.0
         with:
           go-version: ${{ steps.vars.outputs.go_version }}
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # tag=v9.2.0
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # tag=v9.3.0
         with:
-          version: v2.7.0
+          version: v2.12.2
           working-directory: ${{matrix.working-directory}}
-      - name: Lint API
-        run: GOLANGCI_LINT_API_EXTRA_ARGS=--new-from-rev=${{ github.event.pull_request.base.sha }} make lint-api

.github/workflows/pr-md-link-check.yaml

@@ -14,7 +14,9 @@ jobs:
     name: Broken Links
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v7.0.1
+      with:
+        persist-credentials: false
     - uses: gaurav-nelson/github-action-markdown-link-check@3c3b66f1f7d0900e37b71eca45b63ea9eedfce31 # tag=1.0.17
       with:
         use-quiet-mode: 'yes'

.github/workflows/release.yaml

@@ -17,13 +17,13 @@ jobs:
       - name: Set env
         run:  echo "RELEASE_TAG=${GITHUB_REF:10}" >> $GITHUB_ENV
       - name: checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v7.0.1
         with:
           fetch-depth: 0
       - name: Calculate go version
         run: echo "go_version=$(make go-version)" >> $GITHUB_ENV
       - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # tag=v6.3.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # tag=v7.0.0
         with:
           go-version: ${{ env.go_version }}
       - name: generate release artifacts
@@ -37,7 +37,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
       - name: Release
-        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # tag=v2.6.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # tag=v3.0.2
         with:
           draft: true
           files: out/*

.github/workflows/weekly-md-link-check.yaml

@@ -14,12 +14,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        branch: [ main, release-1.15, release-1.14 ]
+        branch: [ main, release-1.17, release-1.16, release-1.15 ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v7.0.1
         with:
           ref: ${{ matrix.branch }}
+          persist-credentials: false
       - uses: gaurav-nelson/github-action-markdown-link-check@3c3b66f1f7d0900e37b71eca45b63ea9eedfce31 # tag=1.0.17
         with:
           use-quiet-mode: 'yes'

.github/workflows/weekly-security-scan.yaml

@@ -13,19 +13,20 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        branch: [ main, release-1.15, release-1.14 ]
+        branch: [ main, release-1.17, release-1.16, release-1.15 ]
     name: Trivy
     runs-on: ubuntu-latest
     steps:
     - name: Check out code
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v7.0.1
       with:
         ref: ${{ matrix.branch }}
+        persist-credentials: false
     - name: Calculate go version
       id: vars
       run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
     - name: Set up Go
-      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # tag=v6.3.0
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # tag=v7.0.0
       with:
         go-version: ${{ steps.vars.outputs.go_version }}
     - name: Run verify security target

.github/workflows/weekly-test-release.yaml

@@ -17,13 +17,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        branch: [ main, release-1.15, release-1.14 ]
+        branch: [ main, release-1.17, release-1.16, release-1.15 ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v7.0.1
         with:
           ref: ${{ matrix.branch }}
           fetch-depth: 0
+          persist-credentials: false
       - name: Set env
         run:  echo "RELEASE_TAG=v9.9.9-fake" >> $GITHUB_ENV
       - name: Set fake tag for release
@@ -32,7 +33,7 @@ jobs:
       - name: Calculate go version
         run: echo "go_version=$(make go-version)" >> $GITHUB_ENV
       - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # tag=v6.3.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # tag=v7.0.0
         with:
           go-version: ${{ env.go_version }}
       - name: Test release

.golangci-kal.yml

@@ -1,6 +1,6 @@
 version: "2"
 run:
-  go: "1.25"
+  go: "1.26"
   allow-parallel-runners: true
 linters:
   default: none

.golangci.yml

@@ -1,7 +1,7 @@
 version: "2"
 run:
   timeout: 10m
-  go: "1.25"
+  go: "1.26"
   allow-parallel-runners: true
 linters:
   default: none
@@ -19,7 +19,6 @@ linters:
     - errchkjson # invalid types passed to json encoder
     - forbidigo # allows to block usage of funcs
     - ginkgolinter # ginkgo and gomega
-    - goconst
     - gocritic # bugs, performance, style (we could add custom ones to this one)
     - godot # checks that comments end in a period
     - godox # block FIXMEs
@@ -52,6 +51,21 @@ linters:
   settings:
     depguard:
       rules:
+        api:
+          list-mode: strict
+          files:
+            - "**/cluster-api-provider-vsphere/api/**/*.go"
+          allow:
+            - $gostd
+            - k8s.io/api/core/v1$
+            - k8s.io/api/rbac/v1$ # drop after ProviderServiceAccountSpec has been removed
+            - k8s.io/apimachinery/pkg/api/resource$
+            - k8s.io/apimachinery/pkg/apis/meta/v1$
+            - k8s.io/apimachinery/pkg/conversion$
+            - k8s.io/apimachinery/pkg/runtime$
+            - k8s.io/apimachinery/pkg/runtime/schema$
+            - sigs.k8s.io/cluster-api-provider-vsphere/api
+            - sigs.k8s.io/cluster-api/api
         vm-operator:
           deny:
             - pkg: "github.com/vmware-tanzu/vm-operator/api"
@@ -117,6 +131,11 @@ linters:
         # Controller Runtime
         - pkg: sigs.k8s.io/controller-runtime
           alias: ctrl
+        # Misc
+        - pkg: github.com/pkg/errors
+          alias: pkgerrors
+        - pkg: errors
+          alias: ""
         # CAPV
         - pkg: sigs.k8s.io/cluster-api-provider-vsphere/api/govmomi/v1beta1
           alias: infrav1beta1
@@ -139,6 +158,8 @@ linters:
           alias: vmoprv1alpha2conversion
         - pkg: sigs.k8s.io/cluster-api-provider-vsphere/pkg/conversion/api/vmoperator/v1alpha5
           alias: vmoprv1alpha5conversion
+        - pkg: sigs.k8s.io/cluster-api-provider-vsphere/pkg/conversion/api/vmoperator/v1alpha6
+          alias: vmoprv1alpha6conversion
         # VM Operator
         - pkg: github.com/vmware-tanzu/vm-operator/api/v1alpha2
           alias: vmoprv1alpha2
@@ -148,6 +169,10 @@ linters:
           alias: vmoprv1alpha5
         - pkg: github.com/vmware-tanzu/vm-operator/api/v1alpha5/common
           alias: vmoprv1alpha5common
+        - pkg: github.com/vmware-tanzu/vm-operator/api/v1alpha6
+          alias: vmoprv1alpha6
+        - pkg: github.com/vmware-tanzu/vm-operator/api/v1alpha6/common
+          alias: vmoprv1alpha6common
         # NSX Operator
         - pkg: github.com/vmware-tanzu/nsx-operator/pkg/apis/vpc/v1alpha1
           alias: nsxvpcv1
@@ -179,7 +204,7 @@ linters:
         # CAPI addons
         - pkg: sigs.k8s.io/cluster-api/api/addons/v1beta2
           alias: addonsv1
-        # CAPI IPAM 
+        # CAPI IPAM
         - pkg: sigs.k8s.io/cluster-api/api/ipam/v1beta2
           alias: ipamv1
         - pkg: sigs.k8s.io/cluster-api/api/ipam/v1beta1
@@ -225,7 +250,6 @@ linters:
       - zz_generated.*\.go$
       - _conversion\.go$
       - vendored_cluster_api\.go$
-      - ^internal/apis/topology/v1alpha1
     # Specific exclude rules for deprecated fields that are still part of the codebase. These
     # should be removed as the referenced deprecated item is removed from the project.
     rules:
@@ -249,14 +273,15 @@ linters:
       - linters:
           - staticcheck
         text: 'SA1019: mgr.GetEventRecorderFor is deprecated'
-        # Deprecations for FailureReason
-      - linters:
-          - staticcheck
-        text: 'SA1019: "sigs.k8s.io/cluster-api/errors" is deprecated:'
         # Deprecations for old api groups
       - linters:
           - staticcheck
         text: 'SA1019: "sigs.k8s.io/cluster-api/api/core/v1beta1" is deprecated: This package is deprecated and is going to be removed when support for v1beta1 will be dropped.'
+        # Deprecations for old fields for conversion tests
+      - linters:
+          - staticcheck
+        path: '.*/conversion_test.go'
+        text: 'SA1019: .*'
         # Exclude for hub types
       - linters:
           - revive
@@ -269,7 +294,7 @@ linters:
         # Allow direct usage of vm-operator APIs in a few places like e.g. tests and main.go
       - linters:
           - depguard
-        path: main.go|pkg/manager/manager.go|.*_test.go|internal/test/helpers/.*|pkg/context/fake/fake_controller_manager_context.go|pkg/conversion/.*|pkg/util/testutil.go
+        path: main.go|feature/feature.go|feature/gates.go|pkg/manager/manager.go|.*_test.go|internal/test/helpers/.*|pkg/context/fake/fake_controller_manager_context.go|pkg/conversion/.*|pkg/util/testutil.go
         text: 'Use vmoprvhub in prod code instead'
       - linters:
           - staticcheck
@@ -370,7 +395,7 @@ linters:
       - linters:
           - goconst
         path: (.+)_test\.go
-        # It's clearer to see that a field gets accessed or func gets called on the embedded objects 
+        # It's clearer to see that a field gets accessed or func gets called on the embedded objects
       - linters:
           - staticcheck
         path: (.+)\.go$
@@ -409,5 +434,3 @@ formatters:
       - zz_generated.*\.go$
       - _conversion\.go$
       - vendored_cluster_api\.go$
-      # We don't want to invest time to fix new linter findings in old API types.
-      - ^internal/apis/topology/v1alpha1

Dockerfile

@@ -36,6 +36,9 @@ ENV GOPROXY=$goproxy
 COPY go.mod go.mod
 COPY go.sum go.sum
 
+COPY api/go.mod api/go.mod
+COPY api/go.sum api/go.sum
+
 # Cache deps before building and copying source so that we don't need to re-download as much
 # and so that source changes don't invalidate our downloaded layer
 RUN --mount=type=cache,target=/go/pkg/mod \
@@ -62,7 +65,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
     go build -trimpath -gcflags "${gcflags}" -ldflags "${ldflags} -extldflags '-static'" \
     -o manager ${package}
 
-
+# Production image
 FROM gcr.io/distroless/static:nonroot-${ARCH}
 WORKDIR /
 COPY --from=builder /workspace/manager .