Skip to content

✨ Adding Support for CAPI >= 1.11 (v1beta2) - #346

Open
schmidax wants to merge 16 commits into
mainfrom
migration/capi-v1.11
Open

schmidax wants to merge 16 commits into
mainfrom
migration/capi-v1.11

Conversation

@schmidax

Copy link
Copy Markdown

What this PR does / why we need it:
Migrate cluster-stack-operator from CAPI v1.8.1 to CAPI v1.11.0 (Stage 1).
Key changes:

  • Upgrade sigs.k8s.io/cluster-api dependency from v1.8.1 to v1.11.0
  • Update import paths: api/v1beta1 → api/core/v1beta1, exp/runtime/hooks/api/v1alpha1 → api/runtime/hooks/v1alpha1
  • Use deprecated v1beta1 conditions packages (util/deprecated/v1beta1/conditions + util/deprecated/v1beta1/patch) per Stage 1 migration guidance
  • Fix breaking API changes: external.Get (3 args), predicates.ResourceNotPausedAndHasFilterLabel (added *runtime.Scheme), removed external.GetObjectReference
  • Fix ClusterAddon webhook to implement webhook.CustomValidator (old Validator interface removed in controller-runtime)
  • Fix Helm chart templates: use dynamic namespaces ({{ .Release.Namespace }}) and release-name-based secret references
  • Fix cross-namespace ClusterClass lookup: use cluster.Spec.Topology.ClassNamespace (CAPI v1.11+ supports ClusterClasses in different namespaces than the Cluster resource)
    This is a Stage 1 migration only — conditions still use the clusterv1.Conditions type via the deprecated v1beta1 packages. Migration to metav1.Conditions (Stage 2/3) is intentionally deferred.

Special notes for your reviewer:

  • No image version changes — this PR only changes operator code, Helm chart templates, and vendored dependencies
  • Verified against kind cluster with CAPI v1.11 providers: operator reconciles ClusterStack, ClusterStackRelease, and ClusterAddon correctly

@schmidax
schmidax force-pushed the migration/capi-v1.11 branch from baa2fc0 to 331d9f2 Compare August 21, 2026 09:10
@Nils98Ar

Nils98Ar commented Sep 9, 2026

Copy link
Copy Markdown
Member

@schmidax What about the failing checks? Is there an image available somewhere, or do I need to build one myself for testing?

@schmidax

schmidax commented Sep 14, 2026 •

Copy link
Copy Markdown
Author

@Nils98Ar I'll take a look at the failing checks. And I haven't uploaded the image anywhere yet.

- Upgrade CAPI dependency from v1.8.1 to v1.11.0
- Update import paths to v1beta1/v1beta2 locations
- Use deprecated v1beta1 conditions packages (Stage 1)
- Fix API signature changes (external.Get, predicates)
- Fix ClusterAddon webhook (CustomValidator interface)
- Fix Helm chart templates (dynamic namespaces)
- Add MIGRATION.md documentation

Per CAPI v1.11 migration guide:
https://release-1-11.cluster-api.sigs.k8s.io/developer/providers/migrations/v1.10-to-v1.11

Signed-off-by: Axel Schmidt <axel.schmidt@rz.uni-augsburg.de>
- Upgrade CAPI dependency from v1.8.1 to v1.11.0
- Update import paths to v1beta1/v1beta2 locations
- Use deprecated v1beta1 conditions packages (Stage 1)
- Fix API signature changes (external.Get, predicates)
- Fix ClusterAddon webhook (CustomValidator interface)
- Fix Helm chart templates (dynamic namespaces)

Per CAPI v1.11 migration guide:
https://release-1-11.cluster-api.sigs.k8s.io/developer/providers/migrations/v1.10-to-v1.11

Signed-off-by: Axel Schmidt <axel.schmidt@rz.uni-augsburg.de>
- Use cluster.Spec.Topology.ClassNamespace when looking up ClusterStackRelease
- Fallback to cluster.Namespace if classNamespace is not set
- Supports CAPI v1.11+ cross-namespace ClusterClass references

Signed-off-by: Axel Schmidt <axel.schmidt@rz.uni-augsburg.de>
Signed-off-by: Axel Schmidt <axel.schmidt@rz.uni-augsburg.de>
Signed-off-by: Axel Schmidt <axel.schmidt@rz.uni-augsburg.de>
@schmidax
schmidax force-pushed the migration/capi-v1.11 branch from bb549c6 to e19e719 Compare September 17, 2026 07:22
schmidax and others added 11 commits September 17, 2026 10:30
Signed-off-by: Axel Schmidt <axel.schmidt@rz.uni-augsburg.de>
Signed-off-by: Axel Schmidt <axel.schmidt@rz.uni-augsburg.de>
…he owning object

external.Get in CAPI >= 1.11 uses the namespace of the reference instead of an
explicit namespace argument. A ClusterStack with a providerRef without
namespace (as documented) could therefore not find its template anymore.

Always resolve the template in the namespace of the ClusterStack, like before,
default the namespace of the Cluster references used for the addon builtins and
add a test for a providerRef without namespace.

Signed-off-by: Jan Schoone <6106846+jschoone@users.noreply.github.com>
…p in the workload cluster

cleanUpResources talks to the workload cluster, where resources without a
namespace belong to the addon namespace (kube-system). The namespace of the
ClusterAddon object in the management cluster is not meaningful there.

Signed-off-by: Jan Schoone <6106846+jschoone@users.noreply.github.com>
…terClasses are in use

Clusters of any namespace can use the ClusterClasses of a namespace since CAPI
1.11. The in-use checks of the ClusterStack and ClusterStackRelease webhooks and
controllers only looked at the clusters of the own namespace, so a
ClusterStackRelease could be deleted while a cluster in another namespace still
used its ClusterClass, and clusters of the own namespace using a ClusterClass of
another namespace were wrongly counted.

Add pkg/clusterclass with a helper listing the clusters that use the
ClusterClasses of a namespace and a test for getUsedClusterClasses.

Signed-off-by: Jan Schoone <6106846+jschoone@users.noreply.github.com>
Add support for CAPI >= 1.11 (v1beta2)
The integration tests created their workload cluster from the kindest/node
v1.26.6 image. On current runner kernels kube-proxy and kindnet of that image
crash (the iptables of its Debian 11 base no longer works), so the node never
becomes ready and the Test Code check fails.

Use kind v0.31.0 with its node image v1.35.0, detect the container runtime
instead of forcing docker (KIND_EXPERIMENTAL_PROVIDER selects another one) and
move hack/kind-dev.sh to the same Kubernetes version.

Signed-off-by: Jan Schoone <6106846+jschoone@users.noreply.github.com>
The 3 second timeout is too short for the specs that wait for the cluster addon
to apply Helm charts to the kind cluster. Raise it to 30 seconds, the specs
still return as soon as the condition is met.

Signed-off-by: Jan Schoone <6106846+jschoone@users.noreply.github.com>
When a cluster switches to a release of the same Kubernetes version, the objects
of the old release that are not part of the new one are deleted. The objects of
the old release were collected with the stages of the clusteraddon.yaml of the
new release, but from the charts of the old release. An addon that only exists
in the old release (removed from the cluster stack) was therefore never found
and its objects stayed in the workload cluster.

Read the stages from the clusteraddon.yaml of the old release.

Signed-off-by: Jan Schoone <6106846+jschoone@users.noreply.github.com>
…cluster stack

The integration tests used releases in the old cluster stack format
(docker-ferrol 1.27), with a single Helm chart per release and a version label
on the objects. Replace them with two releases built from the docker/scs
cluster stack of cluster-stacks (Kubernetes 1.35), which use the addon stages:

- the hook applies the gateway-api, cni and metrics-server addons, including a
  value that is templated from the Cluster object,
- a release with a changed addon updates the objects,
- a release without the gateway-api addon removes its objects.

test/releases/README.md describes how the releases are built. The old releases
stay for the unit tests of the controllers.

Signed-off-by: Jan Schoone <6106846+jschoone@users.noreply.github.com>
go mod tidy after the update to kind v0.31.0 removes the checksums of v0.30.0.

Signed-off-by: Jan Schoone <6106846+jschoone@users.noreply.github.com>
@jschoone

Copy link
Copy Markdown
Contributor

Hi @schmidax and @Nils98Ar, checks are green again.
To get the image you can run the Build cso Image workflow on any branch you like. I just did that, you can use ghcr.io/sovereigncloudstack/cso-staging:sha-ef9fb41
The hash is also the commit id, which is the last commit in this PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants