Merge https://github.com/kubernetes-sigs/cluster-api:v1.13.3 (cf0f6c0) into main #298
The diff you're trying to view is too large. We only load the first 3000 changed files.
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -58,4 +58,4 @@ go.work.sum | |
| **/.DS_Store | ||
| **/*.swp | ||
|
|
||
| tmp/ | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,10 +14,10 @@ jobs: | |
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| branch: [ main, release-1.12, release-1.11 ] | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2 | ||
| with: | ||
| ref: ${{ matrix.branch }} | ||
| - uses: gaurav-nelson/github-action-markdown-link-check@3c3b66f1f7d0900e37b71eca45b63ea9eedfce31 # tag=1.0.17 | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -13,19 +13,19 @@ jobs: | |||||||||||||||
| strategy: | ||||||||||||||||
| fail-fast: false | ||||||||||||||||
| matrix: | ||||||||||||||||
| branch: [ main, release-1.12, release-1.11 ] | ||||||||||||||||
| name: Trivy | ||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||
| steps: | ||||||||||||||||
| - name: Check out code | ||||||||||||||||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2 | ||||||||||||||||
| with: | ||||||||||||||||
| ref: ${{ matrix.branch }} | ||||||||||||||||
|
Comment on lines
+21
to
23
There was a problem hiding this comment. Set Please disable token persistence in this checkout step as well. Suggested fix - name: Check out code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
with:
ref: ${{ matrix.branch }}
+ persist-credentials: falseAs per coding guidelines "CI/CD security (prodsec-skills): ... Least privilege: minimize GITHUB_TOKEN permissions". 📝 Committable suggestion
Suggested change
🧰 Tools🪛 zizmor (1.25.2)[warning] 20-23: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 🤖 Prompt for AI Agents |
||||||||||||||||
| - name: Calculate go version | ||||||||||||||||
| id: vars | ||||||||||||||||
| run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT | ||||||||||||||||
| - name: Set up Go | ||||||||||||||||
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # tag=v6.4.0 | ||||||||||||||||
| with: | ||||||||||||||||
| go-version: ${{ steps.vars.outputs.go_version }} | ||||||||||||||||
| - name: Run verify security target | ||||||||||||||||
|
|
||||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -17,10 +17,10 @@ jobs: | |
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| branch: [ main, release-1.12, release-1.11 ] | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2 | ||
| with: | ||
| ref: ${{ matrix.branch }} | ||
| fetch-depth: 0 | ||
|
|
@@ -32,7 +32,7 @@ jobs: | |
| - name: Calculate go version | ||
| run: echo "go_version=$(make go-version)" >> $GITHUB_ENV | ||
| - name: Set up Go | ||
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # tag=v6.4.0 | ||
| with: | ||
| go-version: ${{ env.go_version }} | ||
| - name: Test release | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| version: "2" | ||
| run: | ||
| go: "1.25" | ||
| allow-parallel-runners: true | ||
| linters: | ||
| default: none | ||
|
|
@@ -75,8 +75,6 @@ linters: | |
| paths: | ||
| - zz_generated.*\.go$ | ||
| - vendored_openapi\.go$ | ||
| - ".*_test.go" # Exclude test files. | ||
| rules: | ||
| ## KAL should only run on API folders. | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,7 @@ | ||
| version: "2" | ||
| run: | ||
| timeout: 10m | ||
| go: "1.25" | ||
| build-tags: | ||
| - tools | ||
| - e2e | ||
|
|
@@ -115,37 +115,21 @@ linters: | |
| - pkg: sigs.k8s.io/controller-runtime | ||
| alias: ctrl | ||
| # CABPK | ||
| - pkg: sigs.k8s.io/cluster-api/api/bootstrap/kubeadm/v1beta1 | ||
| alias: bootstrapv1beta1 | ||
| - pkg: sigs.k8s.io/cluster-api/api/bootstrap/kubeadm/v1beta2 | ||
| alias: bootstrapv1 | ||
| # KCP | ||
| - pkg: sigs.k8s.io/cluster-api/api/controlplane/kubeadm/v1beta1 | ||
| alias: controlplanev1beta1 | ||
| - pkg: sigs.k8s.io/cluster-api/api/controlplane/kubeadm/v1beta2 | ||
| alias: controlplanev1 | ||
| # CAPI | ||
| - pkg: sigs.k8s.io/cluster-api/api/core/v1beta1 | ||
| alias: clusterv1beta1 | ||
| - pkg: sigs.k8s.io/cluster-api/api/core/v1beta2 | ||
| alias: clusterv1 | ||
| # CAPI exp addons | ||
| - pkg: sigs.k8s.io/cluster-api/api/addons/v1beta1 | ||
| alias: addonsv1beta1 | ||
| - pkg: sigs.k8s.io/cluster-api/api/addons/v1beta2 | ||
|
|
@@ -185,22 +169,14 @@ linters: | |
| alias: topologynames | ||
| - pkg: sigs.k8s.io/cluster-api/internal/util/client | ||
| alias: "clientutil" | ||
| - pkg: sigs.k8s.io/cluster-api/util/controller | ||
| alias: "capicontrollerutil" | ||
| # CAPD | ||
| - pkg: sigs.k8s.io/cluster-api/test/infrastructure/docker/api/v1beta1 | ||
| alias: infrav1beta1 | ||
| - pkg: sigs.k8s.io/cluster-api/test/infrastructure/docker/api/v1beta2 | ||
| alias: infrav1 | ||
| # CAPD exp | ||
| - pkg: sigs.k8s.io/cluster-api/test/infrastructure/docker/exp/api/v1beta1 | ||
| alias: infraexpv1beta1 | ||
| - pkg: sigs.k8s.io/cluster-api/test/infrastructure/docker/exp/api/v1beta2 | ||
|
|
@@ -246,13 +222,12 @@ linters: | |
| paths: | ||
| - zz_generated.*\.go$ | ||
| - vendored_openapi\.go$ | ||
| rules: | ||
| # Specific exclude rules for deprecated fields that are still part of the codebase. These | ||
| # should be removed as the referenced deprecated item is removed from the project. | ||
| - linters: | ||
| - staticcheck | ||
| text: 'SA1019: (bootstrapv1.ClusterStatus|DockerMachine.Spec.Bootstrapped|machineStatus.Bootstrapped|dockerMachine.Spec.Backend.Docker.Bootstrapped|dockerMachine.Spec.Bootstrapped|devMachine.Spec.Backend.Docker.Bootstrapped|clusterv1.ClusterClassVariableMetadata|(variable|currentDefinition|specVar|newVariableDefinition|statusVarDefinition|out).DeprecatedV1Beta1Metadata) is deprecated' | ||
| # Deprecations for MHC MaxUnhealthy, UnhealthyRange | ||
| - linters: | ||
| - staticcheck | ||
|
|
@@ -267,13 +242,17 @@ linters: | |
| text: 'SA1019: .* is deprecated: This package is deprecated and is going to be removed when support for v1beta1 will be dropped.' | ||
| # Specific exclude rules for deprecated types that are still part of the codebase. These | ||
| # should be removed as the referenced deprecated types are removed from the project. | ||
| # v1Beta1 deprecated fields/types | ||
| - linters: | ||
| - staticcheck | ||
| text: 'SA1019: .*\.Deprecated\.V1Beta1.* is deprecated' | ||
| # Docker resources are marked as deprecated. | ||
| - linters: | ||
| - staticcheck | ||
| text: 'SA1019: .*Docker.* is deprecated: .* Use Dev.* instead\.' | ||
| - linters: | ||
| - staticcheck | ||
| text: 'SA1019: clusterv1\.(Condition|Conditions|ConditionSeverity|ConditionType) is deprecated' | ||
| # TODO: var-naming: avoid meaningless package names by revive | ||
| # * test/infrastructure/docker/internal/docker/types/ | ||
| # * bootstrap/kubeadm/types/ | ||
|
|
@@ -293,6 +272,10 @@ linters: | |
| - linters: | ||
| - errcheck | ||
| text: Error return value of .((os\.)?std(out|err)\..*|.*Close|.*Flush|os\.Remove(All)?|.*print(f|ln)?|os\.(Un)?Setenv). is not checked | ||
| # deprecated feature gates | ||
| - linters: | ||
| - staticcheck | ||
| text: 'SA1019: feature.MachineWaitForVolumeDetachConsiderVolumeAttachments is deprecated' | ||
| # v1beta1 deprecated util packages | ||
| - linters: | ||
| - staticcheck | ||
|
|
@@ -306,6 +289,10 @@ linters: | |
| - importas | ||
| text: 'imported as ".*" but must be ".*" according to config' | ||
| path: util/deprecated/v1beta1/.*\.go$ | ||
| # Excludes for controller-runtime deprecations that we should migrate away from sooner or later | ||
| - linters: | ||
| - staticcheck | ||
| text: 'SA1019: (env|mgr).GetEventRecorderFor is deprecated' | ||
| # Exclude some packages or code to require comments, for example test code, or fake clients. | ||
| - linters: | ||
| - revive | ||
|
|
@@ -443,5 +430,3 @@ formatters: | |
| paths: | ||
| - zz_generated.*\.go$ | ||
| - vendored_openapi\.go$ | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| ## 👌 Kubernetes version support | ||
|
|
||
| - Management Cluster: v1.28.x -> v1.33.x | ||
| - Workload Cluster: v1.26.x -> v1.33.x | ||
|
|
||
| [More information about version support can be found here](https://cluster-api.sigs.k8s.io/reference/versions.html) | ||
|
|
||
| ## Changes since v1.10.9 | ||
| ## :chart_with_upwards_trend: Overview | ||
| - 1 new commit merged | ||
| - 1 bug fixed 🐛 | ||
|
|
||
| ## :bug: Bug Fixes | ||
| - Runtime SDK: Improve client cert/key rotation of the RuntimeSDK client (#13215) | ||
|
|
||
| ## Dependencies | ||
|
|
||
| ### Added | ||
| _Nothing has changed._ | ||
|
|
||
| ### Changed | ||
| _Nothing has changed._ | ||
|
|
||
| ### Removed | ||
| _Nothing has changed._ | ||
|
|
||
| _Thanks to all our contributors!_ 😊 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| ## 👌 Kubernetes version support | ||
|
|
||
| - Management Cluster: v1.28.x -> v1.33.x | ||
| - Workload Cluster: v1.26.x -> v1.33.x | ||
|
|
||
| [More information about version support can be found here](https://cluster-api.sigs.k8s.io/reference/versions.html) | ||
|
|
||
| ## Changes since v1.10.8 | ||
| ## :chart_with_upwards_trend: Overview | ||
| - 10 new commits merged | ||
| - 1 bug fixed 🐛 | ||
|
|
||
| ## :bug: Bug Fixes | ||
| - ClusterClass: Do not overwrite global http.DefaultClient TLSConfig (#13061) | ||
|
|
||
| ## :seedling: Others | ||
| - CI: Ignore CVE-2025-47914 & CVE-2025-58181 in trivy scans (#13038) | ||
| - Dependency: [release-1.10] Bump Go to v1.24.11 (#13132) | ||
| - Dependency: Also set godebug on modules (#12967) | ||
| - Dependency: Bump Go to v1.24.10 (#12964) | ||
| - Dependency: Bump Go version to 1.24.9 (#12945) | ||
| - e2e: Skip test using outdated docker client (#13129) | ||
| - e2e: Temporarily disable KAL in CI (#13128) | ||
| - e2e: Use crane to pre-pull images instead of docker pull (#13131) | ||
| - Runtime SDK: Add httpClientCache to runtime client (#13084) | ||
|
|
||
| ## Dependencies | ||
|
|
||
| ### Added | ||
| _Nothing has changed._ | ||
|
|
||
| ### Changed | ||
| _Nothing has changed._ | ||
|
|
||
| ### Removed | ||
| _Nothing has changed._ | ||
|
|
||
| _Thanks to all our contributors!_ 😊 |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Disable token persistence in checkout step.
actions/checkoutshould setpersist-credentials: falseto avoid persisting the workflow token in git config.Suggested fix
As per coding guidelines "CI/CD security (prodsec-skills): ... Least privilege: minimize GITHUB_TOKEN permissions".
📝 Committable suggestion
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 17-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents