Repository navigation
feat: upgrade cluster-api to v1.14.2 - #412
Merged
Merged
Conversation
CAPIC adds an owner reference to the user-provided credentials Secret. The OwnerReferencesPermissionEnforcement admission plugin only lets callers that can delete an object change its ownerReferences, so every IonosCloudCluster and IonosCloudMachine reconcile failed with "cannot set an ownerRef on a resource you can't delete" wherever the plugin is enabled. OpenShift enables it by default, and the CAPI v1.14 e2e framework enables it on the kind management cluster. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Bumps cluster-api to v1.14.2, controller-runtime to v0.24.1 and the Kubernetes libraries to v0.36.5, following the v1.13-to-v1.14 migration guide. No code changes are needed. CAPI v1.14 ships its API types in a new Go module, sigs.k8s.io/cluster-api/api, which has to be required explicitly. Dependabot now bumps it together with the other CAPI modules. The e2e suite runs against the v1.14.2 core providers, and the README lists v1.14 as supported by v0.8. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
controller-gen v0.21.0 (the CRDs change only in their version stamp) and envtest 1.37.0, matching CAPI v1.14.2's Makefile. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
WassimKallel
requested review from
gauravgahlot,
gfariasalves-ionos,
jriedel-ionos,
mcbenjemaa,
mneverov,
piepmatz,
pulish,
schegi,
tinashe-mundangepfupfu and
wikkyk
as code owners
September 30, 2026 14:05
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The dependency, tooling, E2E, documentation, and generated RBAC changes are consistent and comprehensively validated.
Review effort: Balanced
Findings: None
What changed in this PR
Upgrades CAPIC to Cluster API v1.14.2 and aligns its dependencies, tooling, tests, documentation, and RBAC.
Changes:
- Upgrades Cluster API, Kubernetes, controller-runtime, controller-gen, and envtest dependencies.
- Updates E2E provider metadata and compatibility documentation.
- Grants required Secret deletion permission for owner-reference enforcement.
| File | Description |
|---|---|
.github/dependabot.yml |
Groups the new Cluster API API module. |
Makefile |
Updates controller-gen and envtest versions. |
README.md |
Documents v1.14 compatibility. |
config/crd/bases/infrastructure.cluster.x-k8s.io_ionoscloudclusters.yaml |
Updates generator version stamp. |
config/crd/bases/infrastructure.cluster.x-k8s.io_ionoscloudclustertemplates.yaml |
Updates generator version stamp. |
config/crd/bases/infrastructure.cluster.x-k8s.io_ionoscloudmachines.yaml |
Updates generator version stamp. |
config/crd/bases/infrastructure.cluster.x-k8s.io_ionoscloudmachinetemplates.yaml |
Updates generator version stamp. |
config/rbac/role.yaml |
Adds Secret deletion permission. |
go.mod |
Upgrades direct and transitive dependencies. |
go.sum |
Records upgraded dependency checksums. |
internal/controller/ionoscloudcluster_controller.go |
Updates the Secret RBAC marker. |
internal/controller/ionoscloudmachine_controller.go |
Updates the Secret RBAC marker. |
test/e2e/config/ionoscloud.yaml |
Uses CAPI v1.14.2 E2E providers. |
test/e2e/data/shared/v1.14/metadata.yaml |
Adds v1.14 clusterctl metadata. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
mneverov
previously approved these changes
Sep 30, 2026
CAPI removed the v1alpha3 and v1alpha4 API versions (kubernetes-sigs/cluster-api#11919), and its own v1.14.2 metadata.yaml stops at the 1.0 series. Match it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
v0.8.0 was cut just before this upgrade, so the CAPI v1.14 support and the secrets RBAC fix ship in v0.9.0. Following the minor-release checklist, add the 0.9 series to metadata.yaml, bump nextVersion in clusterctl-settings.json (still on v0.7.0) and the e2e provider version to v0.9.99, and add a v0.9 row to the compatibility table. v0.8 is marked unvalidated against CAPI v1.14. It was never tested against a v1.14 core, and without the secrets delete permission it fails wherever OwnerReferencesPermissionEnforcement is enabled. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
WassimKallel
enabled auto-merge (squash)
October 1, 2026 09:47
jriedel-ionos
approved these changes
Oct 1, 2026
WassimKallel
disabled auto-merge
October 1, 2026 12:36
WassimKallel
enabled auto-merge (squash)
October 1, 2026 12:36
WassimKallel
disabled auto-merge
October 1, 2026 12:36
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is the purpose of this pull request/Why do we need it?
Upgrade to Cluster API v1.14.2, following the v1.13 → v1.14 migration guide.
This ships in v0.9.0. v0.8.0 was cut from the commit right before this PR, built on CAPI v1.13.5 and without the RBAC fix below.
Issue #, if available:
Description of changes:
fix(rbac)deletesecrets. Without it, theOwnerReferencesPermissionEnforcementadmission plugin rejects the owner reference CAPIC adds to the credentials Secret (cannot set an ownerRef on a resource you can't delete), and every IonosCloudCluster and IonosCloudMachine reconcile fails. The CAPI v1.14 e2e framework enables this plugin, and OpenShift enables it by default.featsigs.k8s.io/cluster-api/api, which has to be required explicitly; it's added to the dependabotcluster-apigroup. E2E config moves to the v1.14.2 providers, and the README gets a v1.14 column. No Go code changes.chore(build)test(e2e)metadata.yaml(kubernetes-sigs/cluster-api#11919).chore(release)0.9 → v1beta2tometadata.yaml, bumpnextVersioninclusterctl-settings.json, move the e2e provider tov0.9.99, and add a v0.9 row to the README. v0.8 × CAPI v1.14 is marked ☓ (not validated).None of the v1.14 breaking changes or deprecations affect CAPIC: the controller-runtime/controller-tools bump, webhook version validation, the Docker* resources,
util/recordandcontrollers/remote.Testing:
Local:
make verify lint vet unit-test integration-test(envtest 1.37.0) andgo vet -tags e2e ./test/e2e/...all pass.envtest with
OwnerReferencesPermissionEnforcementand CAPIC's generated ClusterRole: the owner reference update on the Secret is rejected before the RBAC fix and allowed after it.In place, on a kind management cluster (k8s v1.33.1) running CAPI v1.13.5 and CAPIC v0.8.99, with a live IONOS workload cluster (3 CP + 2 workers, k8s v1.34.11):
clusterctl upgrade applyto CAPI v1.14.2 and CAPIC from this branch. No machine rollout, the owner reference is restored within seconds, and the v1beta2 status shape is intact.templates/cluster-template.yaml(3 CP + 2 workers).After every step: all nodes Ready, all Cluster conditions true, no orphaned IONOS servers, and no resourceVersion changes on the CAPI/CAPIC objects while idle.
The e2e suite runs on this PR.
Special notes for your reviewer:
deleteon secrets is cluster-wide. CAPIC already had cluster-wide get/list/watch/update on secrets.clusterctlcarries over the stalecluster.x-k8s.io/v1beta1CRD label. Remove it as after the v0.7 → v0.8 upgrade.templates/*still use the v1beta1 CAPI APIs, which CAPI v1.16 plans to stop serving. That's for a follow-up.Checklist:
🤖 Generated with Claude Code