OSASINFRA-3707: ⚠️ Manual sync from release-0.12 on main ⚠️

.github/dependabot.yml

@@ -2,52 +2,154 @@
 
 version: 2
 updates:
-
+## main branch config starts here
 # github-actions
 - directory: "/"
   package-ecosystem: "github-actions"
-  open-pull-requests-limit: 5
   schedule:
     interval: "weekly"
     day: "monday"
+  target-branch: main
   groups:
     all-github-actions:
       patterns: [ "*" ]
   commit-message:
-    prefix: ":seedling: chore(deps): bump"
+    prefix: ":seedling:"
     include: scope
+  labels:
+  - "area/dependency"
+  - "ok-to-test"
+# Go directories
+- directories:
+  - "/"
+  - "/hack/tools"
+  package-ecosystem: "gomod"
+  schedule:
+    interval: "weekly"
+    day: "monday"
+  target-branch: main
+  groups:
+    all-go-mod-patch-and-minor:
+      patterns: [ "*" ]
+      update-types: [ "patch", "minor" ]
+  commit-message:
+    prefix: ":seedling:"
+    include: scope
+  ignore:
+  # Ignore controller-runtime major and minor bumps as its upgraded manually.
+  - dependency-name: "sigs.k8s.io/controller-runtime"
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  # Ignore k8s major and minor bumps and its transitives modules
+  - dependency-name: "k8s.io/*"
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  - dependency-name: "sigs.k8s.io/controller-tools"
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  # We will need k8s v0.31.3 to bump structured-merge-diff to v4.4.2 (check git history for details).
+  - dependency-name: "sigs.k8s.io/structured-merge-diff/*"
   labels:
     - "area/dependency"
     - "ok-to-test"
-
+## main branch config ends here
+## release-0.12 branch config starts here
+# github-actions
+- directory: "/"
+  package-ecosystem: "github-actions"
+  schedule:
+    interval: "weekly"
+    day: "monday"
+  target-branch: release-0.12
+  groups:
+    all-github-actions:
+      patterns: [ "*" ]
+  commit-message:
+    prefix: ":seedling:"
+    include: scope
+  labels:
+  - "area/dependency"
+  - "ok-to-test"
 # Go directories
 - directories:
-    - "/"
-    - "/hack/tools"
-    - "/orc"
+  - "/"
+  - "/hack/tools"
   package-ecosystem: "gomod"
-  open-pull-requests-limit: 5
   schedule:
     interval: "weekly"
     day: "monday"
-  ## group all dependencies with a k8s.io prefix into a single PR.
+  target-branch: release-0.12
   groups:
     all-go-mod-patch-and-minor:
       patterns: [ "*" ]
       update-types: [ "patch", "minor" ]
   commit-message:
-    prefix: ":seedling: chore(deps): bump"
+    prefix: ":seedling:"
     include: scope
   ignore:
-    # Ignore controller-runtime as its upgraded manually.
-    - dependency-name: "sigs.k8s.io/controller-runtime"
-      update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
-    # Ignore k8s and its transitives modules as they are upgraded manually together with controller-runtime.
-    - dependency-name: "k8s.io/*"
-      update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
-    - dependency-name: "github.com/prometheus/*"
-      update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
-    - dependency-name: "sigs.k8s.io/cluster-api-provider-openstack"
+  # Ignore CAPI major and minor bumps
+  - dependency-name: "sigs.k8s.io/cluster-api*"
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  # Ignore controller-runtime major and minor bumps as its upgraded manually.
+  - dependency-name: "sigs.k8s.io/controller-runtime"
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  # Ignore k8s major and minor bumps and its transitives modules
+  - dependency-name: "k8s.io/*"
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  - dependency-name: "sigs.k8s.io/controller-tools"
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  # We will need k8s v0.31.3 to bump structured-merge-diff to v4.4.2 (check git history for details).
+  - dependency-name: "sigs.k8s.io/structured-merge-diff/*"
   labels:
     - "area/dependency"
-    - "ok-to-test"
+    - "ok-to-test"
+## release-0.12 branch config ends here
+## release-0.11 branch config starts here
+# github-actions
+- directory: "/"
+  package-ecosystem: "github-actions"
+  schedule:
+    interval: "weekly"
+    day: "monday"
+  target-branch: release-0.11
+  groups:
+    all-github-actions:
+      patterns: [ "*" ]
+  commit-message:
+    prefix: ":seedling:"
+    include: scope
+  labels:
+  - "area/dependency"
+  - "ok-to-test"
+# Go directories
+- directories:
+  - "/"
+  - "/hack/tools"
+  - "/orc"
+  package-ecosystem: "gomod"
+  schedule:
+    interval: "weekly"
+    day: "monday"
+  target-branch: release-0.11
+  groups:
+    all-go-mod-patch-and-minor:
+      patterns: [ "*" ]
+      update-types: [ "patch", "minor" ]
+  commit-message:
+    prefix: ":seedling:"
+    include: scope
+  ignore:
+  # Ignore CAPI major and minor bumps
+  - dependency-name: "sigs.k8s.io/cluster-api*"
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  # Ignore controller-runtime major and minor bumps as its upgraded manually.
+  - dependency-name: "sigs.k8s.io/controller-runtime"
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  # Ignore k8s major and minor bumps and its transitives modules
+  - dependency-name: "k8s.io/*"
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  - dependency-name: "sigs.k8s.io/controller-tools"
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  # We will need k8s v0.31.3 to bump structured-merge-diff to v4.4.2 (check git history for details).
+  - dependency-name: "sigs.k8s.io/structured-merge-diff/*"
+  labels:
+    - "area/dependency"
+    - "ok-to-test"
+## release-0.11 branch config ends here

.github/workflows/pr-dependabot.yaml

@@ -24,7 +24,7 @@ jobs:
       id: vars
       run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
     - name: Set up Go
-      uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # tag=v5.2.0
+      uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # tag=v5.3.0
       with:
         go-version: ${{ steps.vars.outputs.go_version }}
     - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # tag=v4.2.0

.github/workflows/release.yaml

@@ -23,7 +23,7 @@ jobs:
       - name: Calculate go version
         run: echo "go_version=$(make go-version)" >> $GITHUB_ENV
       - name: Set up Go
-        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # tag=v5.2.0
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # tag=v5.3.0
         with:
           go-version: ${{ env.go_version }}
       - name: generate release artifacts

.gitignore

@@ -191,6 +191,3 @@ docs/book/book/
 !/vendor/**
 !/orc/vendor/**
 !/hack/tools/vendor/**
-# TODO Drop the codegen vendoring after 0.11
-!/orc/hack/codegen/vendor/**
-!/hack/codegen/vendor/**

.golangci.yml

@@ -182,7 +182,7 @@ issues:
   - "zz_generated.*\\.go$"
 
 run:
-  go: "1.22"
+  go: "1.23"
   timeout: 10m
   build-tags:
   - e2e

.snyk

@@ -8,13 +8,3 @@ exclude:
     - "hack/**"
     - "test/**"
     - "**/*_test.go"
-    # TODO: use the `ignore:` interface to be more specific on what issues we want to ignore but it doesn't seem to work.
-    #
-    # This file handle Glance image upload in CAPO.
-    # This code intentionally supports insecure hash algorithms, because for public images the consumer can't, in practise,
-    # influence the hash algorithm presented. If the only published hash is MD5 it's more secure to check it than not
-    # check it, so we support MD5.
-    # Incidentally, Glance only directly supports SHA512. This is wildly impractical as almost nobody publishes this:
-    # SHA256 is most common in practise. Also Glance publishes a hash of something that isn't guaranteed to be what it downloaded.
-    # Also there's no way to determine via the API if it's going to do this. Glance hash verification is unusable.
-    - 'internal/controllers/image/upload_helpers.go'

CONTRIBUTING.md

@@ -12,3 +12,63 @@ Kubernetes projects require that you sign a Contributor License Agreement (CLA)
 1. Fork the desired repo, develop and test your code changes.
 1. Submit a pull request.
 1. All code PR must be labeled with ⚠️ (:warning:, major or breaking changes), ✨ (:sparkles:, feature additions), 🐛 (:bug:, patch and bugfixes), 📖 (:book:, documentation or proposals), or 🌱 (:seedling:, minor or other)
+
+## Branches
+
+Cluster API Provider OpenStack has two types of branches: the *main* branch and
+*release-X* branches.
+
+The *main* branch is where development happens. All the latest and
+greatest code, including breaking changes, happens on main.
+
+The *release-X* branches contain stable, backwards compatible code. On every
+major or minor release, a new branch is created. It is from these
+branches that minor and patch releases are tagged. In some cases, it may
+be necessary to open PRs for bugfixes directly against stable branches, but
+this should generally not be the case.
+
+### Support and guarantees
+
+Cluster API Provider OpenStack maintains the most recent release/releases for all supported API and contract versions. Support for this section refers to the ability to backport and release patch versions.
+
+- The API version is determined from the GroupVersion defined in the top-level `api/` package.
+- The EOL date of each API Version is determined from the last release available once a new API version is published.
+
+| API Version  | Supported Until       |
+|--------------|-----------------------|
+| **v1beta1**  | TBD (current stable)  |
+
+- For the current stable API version (v1beta1) we support the two most recent minor releases; older minor releases are immediately unsupported when a new major/minor release is available.
+- For older API versions we only support the most recent minor release until the API version reaches EOL.
+- We will maintain test coverage for all supported minor releases and for one additional release for the current stable API version in case we have to do an emergency patch release.
+  For example, if v0.11 and v0.12 are currently supported, we will also maintain test coverage for v0.10 for one additional release cycle. When v0.13 is released, tests for v0.10 will be removed.
+
+| Minor Release | API Version  | Supported Until                                |
+|---------------|--------------|------------------------------------------------|
+| v0.12.x       | **v1beta1**  | when v0.14.0 will be released                  |
+| v0.11.x       | **v1beta1**  | when v0.13.0 will be released                  |
+| v0.10.x       | **v1beta1**  | EOL to be defined (v0.12.0 release date)       |
+| v0.9.x        | **v1alpha7** | EOL since 2024-10-24 - v0.11.0 release date    |
+| v0.8.x        | **v1alpha7** | EOL since 2024-04-17 - v0.10.0 release date    |
+
+- Exceptions can be filed with maintainers and taken into consideration on a case-by-case basis.
+
+### Removal of v1alpha apiVersions
+
+| Minor Release | v1beta1       | v1alpha7   | v1alpha6   | v1alpha5   |
+|---------------|---------------|------------|------------|------------|
+| v0.12.x       | **supported** | not served |            |            |
+| v0.11.x       | **supported** | deprecated | not served |            |
+| v0.10.x       | **supported** | supported  | deprecated | not served |
+| v0.9.x        |               | supported  | supported  | deprecated |
+| v0.8.x        |               | supported  | supported  | deprecated |
+
+Note: Removal of a deprecated APIVersion in Kubernetes [can cause issues with garbage collection by the kube-controller-manager](https://github.com/kubernetes/kubernetes/issues/102641)
+This means that some objects which rely on garbage collection for cleanup - e.g. MachineSets and their descendent objects, like Machines and InfrastructureMachines, may not be cleaned up properly if those
+objects were created with an APIVersion which is no longer served.
+To avoid these issues it's advised to ensure a restart to the kube-controller-manager is done after upgrading to a version of which drops support for an APIVersion.
+This can be accomplished with any Kubernetes control-plane rollout, including a Kubernetes version upgrade, or by manually stopping and restarting the kube-controller-manager.
+
+Note: We have introduced experimental APIs separate from the "main" API mentioned here.
+They do not follow the support cycle described here.
+The goal is to mature them separately so that they can be quickly iterated on, dropped or eventually included in the stable API.

Dockerfile

@@ -13,19 +13,17 @@
 # limitations under the License.
 
 # Build the manager binary
-FROM golang:1.22.0 as builder
+ARG GO_VERSION
+FROM golang:${GO_VERSION} AS builder
 WORKDIR /workspace
 
 # Run this with docker build --build_arg goproxy=$(go env GOPROXY) to override the goproxy
 ARG goproxy=https://proxy.golang.org
 ENV GOPROXY=$goproxy
 
 # Copy the Go Modules manifests
-RUN mkdir orc
 COPY go.mod go.mod
 COPY go.sum go.sum
-COPY orc/go.mod orc/go.mod
-COPY orc/go.sum orc/go.sum
 
 # Cache deps before building and copying source so that we don't need to re-download as much
 # and so that source changes don't invalidate our downloaded layer