Merge https://github.com/kubernetes-sigs/cluster-api-provider-vsphere:v1.16.0 (d7faa72) into master

[cloud-team-rebase-bot]

Summary by CodeRabbit

• New Features

  • Added v1beta1 and v1beta2 API versions for infrastructure resources.
  • Expanded Go version support to 1.25.

• Deprecations

  • Removed v1alpha3 API version and related conversions; migrate to newer API versions.

• Chores

  • Updated CI/CD workflows and GitHub Actions to latest versions.
  • Removed testing for v1.13 branch; added v1.15 support.
  • Updated build dependencies and linting configurations.
  • Updated release support documentation.

[coderabbitai]

Walkthrough

This pull request performs a comprehensive upgrade of the infrastructure provider, introducing v1beta1 and v1beta2 API versions for both govmomi and supervisor packages, removing deprecated v1alpha3 types, and updating build toolchain versions, GitHub Actions, and supporting configuration files.

Changes

Cohort / File(s)	Summary
GitHub Actions & Workflows .github/workflows/cover.yaml, .github/workflows/pr-dependabot.yaml, .github/workflows/pr-golangci-lint.yaml, .github/workflows/pr-md-link-check.yaml, .github/workflows/release.yaml, .github/workflows/weekly-*.yaml	Updated pinned GitHub Actions versions (checkout v6.0.1→v6.0.2, setup-go v6.1.0→v6.3.0, cache v5.0.1→v5.0.3, harden-runner v2.14.0→v2.16.0, softprops/action-gh-release v2.5.0→v2.6.1) and removed release-1.13 from branch matrices in weekly workflows.
Build Configuration Dockerfile, Makefile, .golangci.yml, .golangci-kal.yml	Bumped Go version from 1.24 to 1.25, updated toolchain versions (envtest, controller-gen, gotestsum, conversion-gen, etc.), added GCFLAGS build argument support, introduced new VM operator version handling, extended e2e template generation targets, and refined linting rules with new import/forbid restrictions and updated deprecation exclusions.
Project Metadata README.md, .gitignore, api/.import-restrictions	Updated CAPV release support documentation to reflect v1.15 addition and v1.12/v1.13 status changes; added gitignore patterns for E2E templates and supervisor-related files; introduced API-layer import restrictions for internal/controller-runtime dependencies.
Govmomi v1beta1 API api/govmomi/v1beta1/*.go	New complete v1beta1 API surface with types for VSphereCluster, VSphereClusterTemplate, VSphereClusterIdentity, VSphereDeploymentZone, VSphereFailureDomain, VSphereMachine, VSphereMachineTemplate, and VSphereVM, including full bidirectional conversion layer to v1beta2 with manual field mapping for pointer semantics and condition handling.
Govmomi v1beta2 API api/govmomi/v1beta2/*.go	New complete v1beta2 API surface mirroring v1beta1 with Hub() interface implementations, condition constants, and support structures for vSphere machine templates, network configuration, and resource definitions.
Supervisor v1beta1 API api/supervisor/v1beta1/*.go	New complete v1beta1 API surface for supervisor-specific types (VSphereCluster, VSphereMachine, VSphereClusterTemplate, VSphereMachineTemplate, ProviderServiceAccount) with v1beta2 conversion layer handling status initialization, failure domain representation changes, and deprecated field normalization.
Supervisor v1beta2 API api/supervisor/v1beta2/*.go	New complete v1beta2 API surface including VSphereCluster, VSphereMachine, VSphereClusterTemplate, VSphereMachineTemplate, ProviderServiceAccount, detailed network status types (DNS, DHCP, interface IP), and condition constants with Hub() methods.
Deprecated v1alpha3 Removal apis/v1alpha3/*.go	Removed all deprecated v1alpha3 API types and conversion logic, including VSphereCluster, VSphereClusterIdentity, VSphereDeploymentZone, vendored Cluster API types, cloud provider configuration types, and associated encoding/conversion implementations.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

[openshift-ci]

Hi @cloud-team-rebase-bot[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

Actionable comments posted: 15

🧹 Nitpick comments (5)

api/govmomi/v1beta1/types.go (1)

644-649: 💤 Low value

Missing explicit type annotations on const declarations.

Several constants are declared without explicit type annotations. While Go allows this when the first constant in a block has a type, these constants rely on implicit typing which can be error-prone and inconsistent with the surrounding code style.

🔧 Suggested fix

 const (
 	VirtualMachineStateNotFound VirtualMachineState = "notfound"
-	VirtualMachineStatePending = "pending"
-	VirtualMachineStateReady = "ready"
+	VirtualMachineStatePending VirtualMachineState = "pending"
+	VirtualMachineStateReady VirtualMachineState = "ready"
 )

 const (
 	VirtualMachinePowerStatePoweredOn VirtualMachinePowerState = "poweredOn"
-	VirtualMachinePowerStatePoweredOff = "poweredOff"
-	VirtualMachinePowerStateSuspended = "suspended"
+	VirtualMachinePowerStatePoweredOff VirtualMachinePowerState = "poweredOff"
+	VirtualMachinePowerStateSuspended VirtualMachinePowerState = "suspended"
 )

Also applies to: 658-663

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/govmomi/v1beta1/types.go` around lines 644 - 649, The consts like
VirtualMachineStatePending and VirtualMachineStateReady are declared without an
explicit type; update these constant declarations (and the other similar ones
noted around the same block) to include the explicit type string (e.g., add the
type to the const spec so the constants are typed as string) so they match
surrounding style and avoid implicit typing issues—look for declarations named
VirtualMachineStatePending, VirtualMachineStateReady and the other constants in
that block and change their const entries to use an explicit string type.

Makefile (1)

26-27: Consider updating to Go 1.26.2.

Go 1.25.9 is available but outdated. The latest stable version as of April 2026 is Go 1.26.2. Evaluate whether upgrading to the latest release would benefit the project with newer features, security patches, and bug fixes.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@Makefile` around lines 26 - 27, Update the Makefile Go versions: set
GO_VERSION to 1.26.2 and bump GO_DIRECTIVE_VERSION to the matching Go directive
series (e.g., 1.26.0) so the build uses the latest stable Go release; change the
values for GO_VERSION and GO_DIRECTIVE_VERSION in the Makefile accordingly and
run a quick build/test to verify compatibility.

api/govmomi/v1beta2/vsphereclusteridentity_types.go (1)

24-26: 💤 Low value

Minor formatting issue in comment.

There's a trailing space before the period in the comment.

📝 Proposed fix

 const (
-	// SecretIdentitySetFinalizer is the finalizer for VSphereCluster credentials secrets .
+	// SecretIdentitySetFinalizer is the finalizer for VSphereCluster credentials secrets.
 	SecretIdentitySetFinalizer = "vspherecluster/infrastructure.cluster.x-k8s.io"

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/govmomi/v1beta2/vsphereclusteridentity_types.go` around lines 24 - 26,
The comment for the constant SecretIdentitySetFinalizer has a trailing space
before the period; remove that extra space so the comment reads without the
stray space before the period (edit the comment above
SecretIdentitySetFinalizer).

api/govmomi/v1beta1/vspheremachine_types.go (1)

113-117: 💤 Low value

Typo in ProviderID documentation comment.

"formated" should be "formatted".

📝 Proposed fix

-	// ProviderID is the virtual machine's BIOS UUID formated as
+	// ProviderID is the virtual machine's BIOS UUID formatted as
 	// vsphere://12345678-1234-1234-1234-123456789abc
 	// +optional
 	ProviderID *string `json:"providerID,omitempty"`

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/govmomi/v1beta1/vspheremachine_types.go` around lines 113 - 117, Fix the
typo in the ProviderID doc comment: change "formated" to "formatted" in the
comment above the ProviderID field (the ProviderID *string
`json:"providerID,omitempty"` declaration in vspheremachine_types.go) so the
documentation reads "virtual machine's BIOS UUID formatted as vsphere://...".

api/govmomi/v1beta2/vspheremachine_types.go (1)

256-261: 💤 Low value

Missing nolint comment for consistency with FailureMessage field.

The FailureReason field is missing the //nolint:kubeapilinter comment that the FailureMessage field has on Line 284. For consistency and to prevent potential linter issues, both deprecated fields should have the same annotation.

📝 Proposed fix

 	// +optional
-	FailureReason *errors.MachineStatusError `json:"failureReason,omitempty"`
+	FailureReason *errors.MachineStatusError `json:"failureReason,omitempty"` //nolint:kubeapilinter // field will be removed when v1beta1 is removed

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/govmomi/v1beta2/vspheremachine_types.go` around lines 256 - 261, The
FailureReason field is missing the same linter suppression as the deprecated
FailureMessage field; update the declaration of FailureReason (the FailureReason
*errors.MachineStatusError field in vspheremachine_types.go) to include the same
//nolint:kubeapilinter comment directly above it, matching the annotation used
for FailureMessage so both deprecated fields are treated consistently by
linters.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@api/govmomi/v1beta1/conversion.go`:
- Around line 384-386: The conversion currently copies only
src.Spec.BootstrapRef.Name into dst.Spec.BootstrapRef, which loses
kind/namespace/apiVersion and can misrepresent non-Secret or cross-namespace
refs; change the conversion to preserve the entire ObjectReference by copying
the whole src.Spec.BootstrapRef into dst.Spec.BootstrapRef (e.g., assign or
deep-copy all fields rather than only Name) so kind/namespace/apiVersion/UID are
retained; apply the same fix to the analogous conversion site referenced around
the other block (lines 455-461) that also only copies Name.

In `@api/govmomi/v1beta1/types.go`:
- Line 326: Fix the typo in the comment describing the cpu field: update the
comment text that currently reads "cpu is the number of spu shares to assign to
the VM" to "cpu is the number of cpu shares to assign to the VM" so the comment
correctly references cpu shares for the cpu field in types.go.
- Around line 492-494: The struct field Gateway6 currently has a copy-pasted
comment saying "Gateway4 is the IPv4 gateway used by this device." Update the
comment for Gateway6 to correctly describe it as the IPv6 gateway (e.g.,
"Gateway6 is the IPv6 gateway used by this device.") so the docstring matches
the field name Gateway6 in the types.go struct.

In `@api/govmomi/v1beta2/types.go`:
- Around line 259-262: CustomVMXKeys currently defined as map[string]string
violates the enabled nomaps lint; replace it with a slice of key/value entry
structs (e.g., type CustomVMXKey struct { Key string `json:"key"` Value string
`json:"value"` } and change CustomVMXKeys to []CustomVMXKey) in the same
types.go, keep the json tags and +optional marker on the field, and update any
code that constructs/reads CustomVMXKeys (marshal/unmarshal, validation,
defaulting, and any callers referencing CustomVMXKeys by map) to use the slice
of entries instead.
- Around line 430-432: The Spec field on the VSphereMachineTemplate currently
allows omission (it has the +optional marker and json:"spec,omitzero"), so make
the nested machine spec required by removing the +optional comment and the
omitzero tag: update the Spec field declaration for VSphereMachineTemplate (Spec
VSphereMachineSpec) to remove the +optional marker and use a plain json:"spec"
tag (or another non-omitempty form) so validation requires Spec to be present.
- Around line 715-719: The UseRoutes field is incorrectly typed as *string;
change its type to *bool (i.e., UseRoutes *bool `json:"useRoutes,omitempty"`)
and replace the string-specific kubebuilder validation (remove MaxLength=128)
with the appropriate boolean/optional annotation (or no length validation) so
the field serializes as a JSON boolean; update any code that constructs or reads
govmomi.v1beta2.types.UseRoutes to pass/expect a *bool accordingly.
- Around line 451-454: The APIEndpoint.String method constructs HOST:PORT
manually which breaks IPv6 literals; update the APIEndpoint.String
implementation to use the standard library net.JoinHostPort to format the host
and port correctly (e.g., call net.JoinHostPort(v.Host,
strconv.Itoa(int(v.Port))) inside APIEndpoint.String) so IPv6 addresses are
wrapped in brackets and ports are appended properly.

In `@api/govmomi/v1beta2/vspheremachinetemplate_types.go`:
- Around line 45-47: The Spec field on VSphereMachineTemplate is marked optional
and uses `omitempty,omitzero`; make it required by removing the `// +optional`
marker and the omitempty/omitzero from the json tag (change `Spec
VSphereMachineTemplateSpec `json:"spec,omitempty,omitzero"` to `Spec
VSphereMachineTemplateSpec `json:"spec"`), and optionally add a kubebuilder
validation marker (e.g., `// +kubebuilder:validation:Required`) above the Spec
declaration to ensure the CRD schema enforces a present spec; update references
to VSphereMachineTemplate.Spec and the VSphereMachineTemplateSpec type
accordingly.

In `@api/supervisor/v1beta1/providerserviceaccount_types.go`:
- Around line 54-55: The root CRD type ProviderServiceAccount is missing a
Status field despite having ProviderServiceAccountStatus and the
+kubebuilder:subresource:status tag; add a Status field to the
ProviderServiceAccount struct: Status ProviderServiceAccountStatus
`json:"status,omitempty"` (ensure the field name and type match the existing
ProviderServiceAccountStatus), so the status subresource can be persisted and
round-tripped; verify the struct tags/markers and deepcopy/runtime.Object
markers remain intact and apply the same pattern if a corresponding list or
other root types are missing status fields.

In `@api/supervisor/v1beta1/vspherecluster_types.go`:
- Around line 137-154: The IsDefined helpers incorrectly treat a nil receiver as
defined; update NSXVPC.IsDefined and Network.IsDefined to first check for a nil
receiver (e.g., if r == nil { return false }) and only then perform the existing
reflect.DeepEqual check to the zero-value instance so that
(*NSXVPC)(nil).IsDefined() and (*Network)(nil).IsDefined() return false.

In `@api/supervisor/v1beta1/vspheremachine_types.go`:
- Around line 197-220: Update the doc comments on the InterfaceNetworkReference
fields Kind, Name, and APIVersion to describe a network object reference instead
of a "remediation template": replace every occurrence of "remediation template"
in the comments for Kind, Name, and APIVersion with text indicating they refer
to the network object being referenced (e.g., "network object" or "network
resource"), preserve the existing validation/kubebuilder tags and NOTE about
APIVersion being kept in sync with the referenced object's APIVersion, and
ensure the examples/constraints in the comments still make sense for network
object naming and API versioning.

In `@api/supervisor/v1beta2/vspherecluster_types.go`:
- Around line 139-156: The IsDefined methods for NSXVPC and Network incorrectly
report a nil receiver as defined; update both methods (NSXVPC.IsDefined and
Network.IsDefined) to first check if the receiver is nil and return false, then
proceed with the existing reflect.DeepEqual comparison to an empty literal so
omitted (nil) configs are treated as undefined.

In `@api/supervisor/v1beta2/vspheremachinenetworkstatus_types.go`:
- Around line 83-85: The IsDefined methods currently return true for nil
receivers; add a nil-check at the start of each IsDefined (e.g.,
VSphereMachineNetworkDNSStatus.IsDefined) and return false if the receiver is
nil, then proceed with the existing DeepEqual check — apply the same nil-guard
pattern to the other IsDefined implementations in this file as indicated (the
ones at the other noted ranges).

In `@README.md`:
- Line 59: Update the table row text in README.md (the row containing "v1.13.x |
Maintenance mode | Maintenance mode v1.15.0 release date, EOL when v1.16.0 will
be released") to include the word "since" before "v1.15.0" so the cell reads
"Maintenance mode since v1.15.0 release date, EOL when v1.16.0 will be
released"; edit the table cell content accordingly to preserve spacing and
alignment.

---

Nitpick comments:
In `@api/govmomi/v1beta1/types.go`:
- Around line 644-649: The consts like VirtualMachineStatePending and
VirtualMachineStateReady are declared without an explicit type; update these
constant declarations (and the other similar ones noted around the same block)
to include the explicit type string (e.g., add the type to the const spec so the
constants are typed as string) so they match surrounding style and avoid
implicit typing issues—look for declarations named VirtualMachineStatePending,
VirtualMachineStateReady and the other constants in that block and change their
const entries to use an explicit string type.

In `@api/govmomi/v1beta1/vspheremachine_types.go`:
- Around line 113-117: Fix the typo in the ProviderID doc comment: change
"formated" to "formatted" in the comment above the ProviderID field (the
ProviderID *string `json:"providerID,omitempty"` declaration in
vspheremachine_types.go) so the documentation reads "virtual machine's BIOS UUID
formatted as vsphere://...".

In `@api/govmomi/v1beta2/vsphereclusteridentity_types.go`:
- Around line 24-26: The comment for the constant SecretIdentitySetFinalizer has
a trailing space before the period; remove that extra space so the comment reads
without the stray space before the period (edit the comment above
SecretIdentitySetFinalizer).

In `@api/govmomi/v1beta2/vspheremachine_types.go`:
- Around line 256-261: The FailureReason field is missing the same linter
suppression as the deprecated FailureMessage field; update the declaration of
FailureReason (the FailureReason *errors.MachineStatusError field in
vspheremachine_types.go) to include the same //nolint:kubeapilinter comment
directly above it, matching the annotation used for FailureMessage so both
deprecated fields are treated consistently by linters.

In `@Makefile`:
- Around line 26-27: Update the Makefile Go versions: set GO_VERSION to 1.26.2
and bump GO_DIRECTIVE_VERSION to the matching Go directive series (e.g., 1.26.0)
so the build uses the latest stable Go release; change the values for GO_VERSION
and GO_DIRECTIVE_VERSION in the Makefile accordingly and run a quick build/test
to verify compatibility.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 90e3c963-8e4f-4bb0-89be-4de35d7eb1d5

📥 Commits

Reviewing files that changed from the base of the PR and between 0f0e7b1 and 3a5274a.

⛔ Files ignored due to path filters (13)

• api/govmomi/v1beta1/zz_generated.conversion.go is excluded by !**/zz_generated*
• api/govmomi/v1beta1/zz_generated.deepcopy.go is excluded by !**/zz_generated*
• api/govmomi/v1beta2/zz_generated.deepcopy.go is excluded by !**/zz_generated*
• api/supervisor/v1beta1/zz_generated.conversion.go is excluded by !**/zz_generated*
• api/supervisor/v1beta1/zz_generated.deepcopy.go is excluded by !**/zz_generated*
• api/supervisor/v1beta2/zz_generated.deepcopy.go is excluded by !**/zz_generated*
• apis/v1alpha3/zz_generated.conversion.go is excluded by !**/zz_generated*
• apis/v1alpha3/zz_generated.deepcopy.go is excluded by !**/zz_generated*
• apis/v1alpha4/zz_generated.conversion.go is excluded by !**/zz_generated*
• apis/v1alpha4/zz_generated.deepcopy.go is excluded by !**/zz_generated*
• apis/v1beta1/zz_generated.deepcopy.go is excluded by !**/zz_generated*
• go.sum is excluded by !**/*.sum
• internal/apis/topology/v1alpha1/zz_generated.deepcopy.go is excluded by !**/zz_generated*

📒 Files selected for processing (287)

• .github/workflows/cover.yaml
• .github/workflows/pr-dependabot.yaml
• .github/workflows/pr-golangci-lint.yaml
• .github/workflows/pr-md-link-check.yaml
• .github/workflows/release.yaml
• .github/workflows/weekly-md-link-check.yaml
• .github/workflows/weekly-security-scan.yaml
• .github/workflows/weekly-test-release.yaml
• .gitignore
• .golangci-kal.yml
• .golangci.yml
• Dockerfile
• Makefile
• README.md
• api/.import-restrictions
• api/govmomi/v1beta1/.import-restrictions
• api/govmomi/v1beta1/condition_consts.go
• api/govmomi/v1beta1/conversion.go
• api/govmomi/v1beta1/conversion_test.go
• api/govmomi/v1beta1/doc.go
• api/govmomi/v1beta1/groupversion_info.go
• api/govmomi/v1beta1/types.go
• api/govmomi/v1beta1/vspherecluster_types.go
• api/govmomi/v1beta1/vsphereclusteridentity_types.go
• api/govmomi/v1beta1/vsphereclustertemplate_types.go
• api/govmomi/v1beta1/vspheredeploymentzone_types.go
• api/govmomi/v1beta1/vspherefailuredomain_types.go
• api/govmomi/v1beta1/vspheremachine_types.go
• api/govmomi/v1beta1/vspheremachinetemplate_types.go
• api/govmomi/v1beta1/vspherevm_types.go
• api/govmomi/v1beta2/condition_consts.go
• api/govmomi/v1beta2/conversion.go
• api/govmomi/v1beta2/doc.go
• api/govmomi/v1beta2/groupversion_info.go
• api/govmomi/v1beta2/types.go
• api/govmomi/v1beta2/vspherecluster_types.go
• api/govmomi/v1beta2/vsphereclusteridentity_types.go
• api/govmomi/v1beta2/vsphereclustertemplate_types.go
• api/govmomi/v1beta2/vspheredeploymentzone_types.go
• api/govmomi/v1beta2/vspherefailuredomain_types.go
• api/govmomi/v1beta2/vspheremachine_types.go
• api/govmomi/v1beta2/vspheremachinetemplate_types.go
• api/govmomi/v1beta2/vspherevm_types.go
• api/supervisor/v1beta1/.import-restrictions
• api/supervisor/v1beta1/conditions_consts.go
• api/supervisor/v1beta1/conversion.go
• api/supervisor/v1beta1/conversion_test.go
• api/supervisor/v1beta1/doc.go
• api/supervisor/v1beta1/groupversion_info.go
• api/supervisor/v1beta1/providerserviceaccount_types.go
• api/supervisor/v1beta1/types.go
• api/supervisor/v1beta1/vspherecluster_types.go
• api/supervisor/v1beta1/vsphereclustertemplate_types.go
• api/supervisor/v1beta1/vspheremachine_types.go
• api/supervisor/v1beta1/vspheremachinenetworkstatus_types.go
• api/supervisor/v1beta1/vspheremachinetemplate_types.go
• api/supervisor/v1beta2/.import-restrictions
• api/supervisor/v1beta2/conditions_consts.go
• api/supervisor/v1beta2/conversion.go
• api/supervisor/v1beta2/doc.go
• api/supervisor/v1beta2/groupversion_info.go
• api/supervisor/v1beta2/providerserviceaccount_types.go
• api/supervisor/v1beta2/types.go
• api/supervisor/v1beta2/vspherecluster_types.go
• api/supervisor/v1beta2/vsphereclustertemplate_types.go
• api/supervisor/v1beta2/vspheremachine_types.go
• api/supervisor/v1beta2/vspheremachinenetworkstatus_types.go
• api/supervisor/v1beta2/vspheremachinetemplate_types.go
• apis/v1alpha3/cloudprovider_encoding.go
• apis/v1alpha3/cloudprovider_encoding_test.go
• apis/v1alpha3/cloudprovider_types.go
• apis/v1alpha3/conversion.go
• apis/v1alpha3/conversion_test.go
• apis/v1alpha3/doc.go
• apis/v1alpha3/groupversion_info.go
• apis/v1alpha3/networkdevicespec_conversion.go
• apis/v1alpha3/topology_conversion.go
• apis/v1alpha3/types.go
• apis/v1alpha3/vendored_cluster_api.go
• apis/v1alpha3/vspherecluster_conversion.go
• apis/v1alpha3/vspherecluster_types.go
• apis/v1alpha3/vsphereclusteridentity_conversion.go
• apis/v1alpha3/vsphereclusteridentity_types.go
• apis/v1alpha3/vspheredeploymentzone_conversion.go
• apis/v1alpha3/vspheredeploymentzone_types.go
• apis/v1alpha3/vspherefailuredomain_conversion.go
• apis/v1alpha3/vspherefailuredomain_types.go
• apis/v1alpha3/vspheremachine_conversion.go
• apis/v1alpha3/vspheremachine_types.go
• apis/v1alpha3/vspheremachinetemplate_conversion.go
• apis/v1alpha3/vspheremachinetemplate_types.go
• apis/v1alpha3/vspherevm_conversion.go
• apis/v1alpha3/vspherevm_types.go
• apis/v1alpha4/conversion.go
• apis/v1alpha4/conversion_test.go
• apis/v1alpha4/doc.go
• apis/v1alpha4/groupversion_info.go
• apis/v1alpha4/networkdevicespec_conversion.go
• apis/v1alpha4/topology_conversion.go
• apis/v1alpha4/types.go
• apis/v1alpha4/vendored_cluster_api.go
• apis/v1alpha4/vspherecluster_conversion.go
• apis/v1alpha4/vspherecluster_types.go
• apis/v1alpha4/vsphereclusteridentity_conversion.go
• apis/v1alpha4/vsphereclusteridentity_types.go
• apis/v1alpha4/vsphereclustertemplate_conversion.go
• apis/v1alpha4/vsphereclustertemplate_types.go
• apis/v1alpha4/vspheredeploymentzone_conversion.go
• apis/v1alpha4/vspheredeploymentzone_types.go
• apis/v1alpha4/vspherefailuredomain_conversion.go
• apis/v1alpha4/vspherefailuredomain_types.go
• apis/v1alpha4/vspheremachine_conversion.go
• apis/v1alpha4/vspheremachine_types.go
• apis/v1alpha4/vspheremachinetemplate_conversion.go
• apis/v1alpha4/vspheremachinetemplate_types.go
• apis/v1alpha4/vspherevm_conversion.go
• apis/v1alpha4/vspherevm_types.go
• apis/v1beta1/.import-restrictions
• apis/v1beta1/doc.go
• apis/v1beta1/groupversion_info.go
• apis/v1beta1/types.go
• apis/v1beta1/vspherecluster_conversion.go
• apis/v1beta1/vspherecluster_types.go
• apis/v1beta1/vsphereclusteridentity_conversion.go
• apis/v1beta1/vsphereclusteridentity_types.go
• apis/v1beta1/vsphereclustertemplate_conversion.go
• apis/v1beta1/vsphereclustertemplate_types.go
• apis/v1beta1/vspheredeploymentzone_conversion.go
• apis/v1beta1/vspheredeploymentzone_types.go
• apis/v1beta1/vspherefailuredomain_conversion.go
• apis/v1beta1/vspherefailuredomain_types.go
• apis/v1beta1/vspheremachine_conversion.go
• apis/v1beta1/vspheremachine_types.go
• apis/v1beta1/vspheremachinetemplate_conversion.go
• apis/v1beta1/vspheremachinetemplate_types.go
• apis/v1beta1/vspherevm_conversion.go
• apis/v1beta1/vspherevm_types.go
• apis/vmware/v1beta1/.import-restrictions
• apis/vmware/v1beta1/conditions_consts.go
• apis/vmware/v1beta1/doc.go
• apis/vmware/v1beta1/groupversion_info.go
• apis/vmware/v1beta1/providerserviceaccount_types.go
• apis/vmware/v1beta1/types.go
• apis/vmware/v1beta1/vspherecluster_types.go
• apis/vmware/v1beta1/vsphereclustertemplate_types.go
• apis/vmware/v1beta1/vspheremachine_types.go
• apis/vmware/v1beta1/vspheremachinetemplate_types.go
• cloudbuild-nightly.yaml
• cloudbuild.yaml
• clusterctl-settings.json
• config/default/crd/bases/infrastructure.cluster.x-k8s.io_vsphereclusteridentities.yaml
• config/default/crd/bases/infrastructure.cluster.x-k8s.io_vsphereclusters.yaml
• config/default/crd/bases/infrastructure.cluster.x-k8s.io_vsphereclustertemplates.yaml
• config/default/crd/bases/infrastructure.cluster.x-k8s.io_vspheredeploymentzones.yaml
• config/default/crd/bases/infrastructure.cluster.x-k8s.io_vspherefailuredomains.yaml
• config/default/crd/bases/infrastructure.cluster.x-k8s.io_vspheremachines.yaml
• config/default/crd/bases/infrastructure.cluster.x-k8s.io_vspheremachinetemplates.yaml
• config/default/crd/bases/infrastructure.cluster.x-k8s.io_vspherevms.yaml
• config/default/crd/kustomization.yaml
• config/default/crd/patches/webhook_in_vsphereclusters.yaml
• config/default/crd/patches/webhook_in_vsphereclustertemplates.yaml
• config/default/crd/patches/webhook_in_vspheredeploymentzones.yaml
• config/default/crd/patches/webhook_in_vspherefailuredomains.yaml
• config/default/crd/patches/webhook_in_vspheremachines.yaml
• config/default/crd/patches/webhook_in_vspheremachinetemplates.yaml
• config/default/crd/patches/webhook_in_vspherevms.yaml
• config/deployments/integration-tests/crds/topology.tanzu.vmware.com_availabilityzones.yaml
• config/deployments/integration-tests/crds/vmoperator.vmware.com_clustervirtualmachineimages.yaml
• config/deployments/integration-tests/crds/vmoperator.vmware.com_contentlibraryproviders.yaml
• config/deployments/integration-tests/crds/vmoperator.vmware.com_contentsourcebindings.yaml
• config/deployments/integration-tests/crds/vmoperator.vmware.com_contentsources.yaml
• config/deployments/integration-tests/crds/vmoperator.vmware.com_virtualmachineclassbindings.yaml
• config/deployments/integration-tests/crds/vmoperator.vmware.com_virtualmachineclasses.yaml
• config/deployments/integration-tests/crds/vmoperator.vmware.com_virtualmachineclassinstances.yaml
• config/deployments/integration-tests/crds/vmoperator.vmware.com_virtualmachinegrouppublishrequests.yaml
• config/deployments/integration-tests/crds/vmoperator.vmware.com_virtualmachinegroups.yaml
• config/deployments/integration-tests/crds/vmoperator.vmware.com_virtualmachineimagecaches.yaml
• config/deployments/integration-tests/crds/vmoperator.vmware.com_virtualmachineimages.yaml
• config/deployments/integration-tests/crds/vmoperator.vmware.com_virtualmachinepublishrequests.yaml
• config/deployments/integration-tests/crds/vmoperator.vmware.com_virtualmachinereplicasets.yaml
• config/deployments/integration-tests/crds/vmoperator.vmware.com_virtualmachines.yaml
• config/deployments/integration-tests/crds/vmoperator.vmware.com_virtualmachineservices.yaml
• config/deployments/integration-tests/crds/vmoperator.vmware.com_virtualmachinesetresourcepolicies.yaml
• config/deployments/integration-tests/crds/vmoperator.vmware.com_virtualmachinesnapshots.yaml
• config/deployments/integration-tests/crds/vmoperator.vmware.com_virtualmachinewebconsolerequests.yaml
• config/deployments/integration-tests/crds/vmoperator.vmware.com_webconsolerequests.yaml
• config/deployments/integration-tests/kustomization.yaml
• config/govmomi/webhook/manifests.yaml
• config/manager/manager.yaml
• config/metrics/crd-metrics-config.yaml
• config/rbac/role.yaml
• config/supervisor-tilt/kustomization.yaml
• config/supervisor-tilt/metrics/crd-clusterrole.yaml
• config/supervisor-tilt/metrics/crd-metrics-config.yaml
• config/supervisor-tilt/metrics/kustomization.yaml
• config/supervisor/crd/bases/vmware.infrastructure.cluster.x-k8s.io_providerserviceaccounts.yaml
• config/supervisor/crd/bases/vmware.infrastructure.cluster.x-k8s.io_vsphereclusters.yaml
• config/supervisor/crd/bases/vmware.infrastructure.cluster.x-k8s.io_vsphereclustertemplates.yaml
• config/supervisor/crd/bases/vmware.infrastructure.cluster.x-k8s.io_vspheremachines.yaml
• config/supervisor/crd/bases/vmware.infrastructure.cluster.x-k8s.io_vspheremachinetemplates.yaml
• config/supervisor/crd/kustomization.yaml
• config/supervisor/crd/kustomizeconfig.yaml
• config/supervisor/crd/patches/cainjection_in_providerserviceaccounts.yaml
• config/supervisor/crd/patches/cainjection_in_vsphereclusters.yaml
• config/supervisor/crd/patches/cainjection_in_vsphereclustertemplates.yaml
• config/supervisor/crd/patches/cainjection_in_vspheremachines.yaml
• config/supervisor/crd/patches/cainjection_in_vspheremachinetemplates.yaml
• config/supervisor/crd/patches/webhook_in_providerserviceaccounts.yaml
• config/supervisor/crd/patches/webhook_in_vsphereclusters.yaml
• config/supervisor/crd/patches/webhook_in_vsphereclustertemplates.yaml
• config/supervisor/crd/patches/webhook_in_vspheremachines.yaml
• config/supervisor/crd/patches/webhook_in_vspheremachinetemplates.yaml
• config/supervisor/kustomization.yaml
• config/supervisor/webhook/manifests.yaml
• controllers/clustermodule_reconciler.go
• controllers/clustermodule_reconciler_test.go
• controllers/controllers_suite_test.go
• controllers/vmware/controllers_suite_test.go
• controllers/vmware/serviceaccount_controller.go
• controllers/vmware/serviceaccount_controller_intg_test.go
• controllers/vmware/serviceaccount_controller_suite_test.go
• controllers/vmware/serviceaccount_controller_unit_test.go
• controllers/vmware/servicediscovery_controller.go
• controllers/vmware/servicediscovery_controller_intg_test.go
• controllers/vmware/servicediscovery_controller_suite_test.go
• controllers/vmware/servicediscovery_controller_unit_test.go
• controllers/vmware/test/controllers_suite_test.go
• controllers/vmware/test/controllers_test.go
• controllers/vmware/virtualmachinegroup_controller.go
• controllers/vmware/virtualmachinegroup_reconciler.go
• controllers/vmware/virtualmachinegroup_reconciler_test.go
• controllers/vmware/vspherecluster_reconciler.go
• controllers/vmware/vspherecluster_reconciler_test.go
• controllers/vmware/vspheremachinetemplate_controller.go
• controllers/vmware/vspheremachinetemplate_controller_test.go
• controllers/vspherecluster_controller.go
• controllers/vspherecluster_reconciler.go
• controllers/vspherecluster_reconciler_test.go
• controllers/vsphereclusteridentity_controller.go
• controllers/vsphereclusteridentity_controller_test.go
• controllers/vspheredeploymentzone_controller.go
• controllers/vspheredeploymentzone_controller_domain.go
• controllers/vspheredeploymentzone_controller_domain_test.go
• controllers/vspheredeploymentzone_controller_test.go
• controllers/vspheremachine_controller.go
• controllers/vspheremachine_controller_test.go
• controllers/vspherevm_controller.go
• controllers/vspherevm_controller_test.go
• controllers/vspherevm_ipaddress_reconciler.go
• controllers/vspherevm_ipaddress_reconciler_test.go
• docs/gpu-pci.md
• docs/gpu-vgpu.md
• feature/feature.go
• go.mod
• hack/e2e.sh
• hack/ensure-go.sh
• hack/gogcflags.sh
• hack/tools/boskosctl/main.go
• hack/tools/pkg/janitor/janitor.go
• hack/version.sh
• internal/clusterclass/variables.go
• internal/test/helpers/envtest.go
• internal/test/helpers/vcsim/model.go
• internal/test/helpers/vmware/intg_test_context.go
• internal/test/helpers/vmware/unit_test_context.go
• internal/webhooks/doc.go
• internal/webhooks/vmware/vspherecluster.go
• internal/webhooks/vmware/vspherecluster_test.go
• internal/webhooks/vmware/vspheremachine.go
• internal/webhooks/vmware/vspheremachine_test.go
• internal/webhooks/vmware/vspheremachinetemplate.go
• internal/webhooks/vmware/vspheremachinetemplate_test.go
• internal/webhooks/vsphereclustertemplate.go
• internal/webhooks/vspheredeploymentzone.go
• internal/webhooks/vspheredeploymentzone_test.go
• internal/webhooks/vspherefailuredomain.go
• internal/webhooks/vspherefailuredomain_test.go
• internal/webhooks/vspheremachine.go
• internal/webhooks/vspheremachine_test.go
• internal/webhooks/vspheremachinetemplate.go
• internal/webhooks/vspheremachinetemplate_test.go
• internal/webhooks/vspherevm.go
• internal/webhooks/vspherevm_test.go
• main.go
• metadata.yaml
• openshift/capi-operator-manifests/default/manifests.yaml
• openshift/capi-operator-manifests/default/metadata.yaml

💤 Files with no reviewable changes (16)

• apis/v1alpha3/topology_conversion.go
• apis/v1alpha3/networkdevicespec_conversion.go
• apis/v1alpha3/conversion_test.go
• apis/v1alpha3/groupversion_info.go
• apis/v1alpha3/types.go
• apis/v1alpha3/vspherecluster_types.go
• apis/v1alpha3/vspheredeploymentzone_conversion.go
• apis/v1alpha3/vendored_cluster_api.go
• apis/v1alpha3/cloudprovider_encoding.go
• apis/v1alpha3/vsphereclusteridentity_types.go
• apis/v1alpha3/cloudprovider_encoding_test.go
• apis/v1alpha3/conversion.go
• apis/v1alpha3/vspherecluster_conversion.go
• apis/v1alpha3/cloudprovider_types.go
• apis/v1alpha3/doc.go
• apis/v1alpha3/vsphereclusteridentity_conversion.go

[coderabbitai]

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Preserve the full legacy BootstrapRef, not just its name.

v1beta1 exposes BootstrapRef as a provider-specific ObjectReference, but this conversion keeps only Name and recreates it as Secret/v1 in the VM namespace on the way back. Any non-Secret or cross-namespace legacy ref will change meaning after a round-trip through the hub.

Also applies to: 455-461

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/govmomi/v1beta1/conversion.go` around lines 384 - 386, The conversion
currently copies only src.Spec.BootstrapRef.Name into dst.Spec.BootstrapRef,
which loses kind/namespace/apiVersion and can misrepresent non-Secret or
cross-namespace refs; change the conversion to preserve the entire
ObjectReference by copying the whole src.Spec.BootstrapRef into
dst.Spec.BootstrapRef (e.g., assign or deep-copy all fields rather than only
Name) so kind/namespace/apiVersion/UID are retained; apply the same fix to the
analogous conversion site referenced around the other block (lines 455-461) that
also only copies Name.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Typo in comment: "spu" should be "cpu".

The comment states "cpu is the number of spu shares" but should say "cpu shares".

-	// cpu is the number of spu shares to assign to the VM
+	// cpu is the number of cpu shares to assign to the VM

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	// cpu is the number of spu shares to assign to the VM
	// cpu is the number of cpu shares to assign to the VM

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/govmomi/v1beta1/types.go` at line 326, Fix the typo in the comment
describing the cpu field: update the comment text that currently reads "cpu is
the number of spu shares to assign to the VM" to "cpu is the number of cpu
shares to assign to the VM" so the comment correctly references cpu shares for
the cpu field in types.go.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Comment incorrectly describes Gateway6 as IPv4.

The comment is copy-pasted from Gateway4 but this field is for IPv6.

-	// Gateway4 is the IPv4 gateway used by this device.
+	// Gateway6 is the IPv6 gateway used by this device.
 	// +optional
 	Gateway6 string `json:"gateway6,omitempty"`

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	// Gateway4 is the IPv4 gateway used by this device.
	// +optional
	Gateway6 string `json:"gateway6,omitempty"`
	// Gateway6 is the IPv6 gateway used by this device.
	// +optional
	Gateway6 string `json:"gateway6,omitempty"`

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/govmomi/v1beta1/types.go` around lines 492 - 494, The struct field
Gateway6 currently has a copy-pasted comment saying "Gateway4 is the IPv4
gateway used by this device." Update the comment for Gateway6 to correctly
describe it as the IPv6 gateway (e.g., "Gateway6 is the IPv6 gateway used by
this device.") so the docstring matches the field name Gateway6 in the types.go
struct.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

CustomVMXKeys conflicts with the enabled nomaps API lint.

kubeapilinter is enabled for api/**, and the only current nomaps carve-outs in this PR are the supervisor capacity fields. Adding a brand-new map[string]string here will either fail lint or force an immediate exception on a public v1beta2 API. Prefer a list of key/value entries if this needs to be user-facing.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/govmomi/v1beta2/types.go` around lines 259 - 262, CustomVMXKeys currently
defined as map[string]string violates the enabled nomaps lint; replace it with a
slice of key/value entry structs (e.g., type CustomVMXKey struct { Key string
`json:"key"` Value string `json:"value"` } and change CustomVMXKeys to
[]CustomVMXKey) in the same types.go, keep the json tags and +optional marker on
the field, and update any code that constructs/reads CustomVMXKeys
(marshal/unmarshal, validation, defaulting, and any callers referencing
CustomVMXKeys by map) to use the slice of entries instead.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Require template.spec in the schema.

Line 432 makes the nested machine spec optional, so a VSphereMachineTemplate can pass validation without any actual machine configuration and only fail later during reconciliation.

Suggested fix

 	// spec is the specification of the desired behavior of the machine.
-	// +optional
-	Spec VSphereMachineSpec `json:"spec,omitempty,omitzero"`
+	// +required
+	Spec VSphereMachineSpec `json:"spec,omitzero"`

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/govmomi/v1beta2/types.go` around lines 430 - 432, The Spec field on the
VSphereMachineTemplate currently allows omission (it has the +optional marker
and json:"spec,omitzero"), so make the nested machine spec required by removing
the +optional comment and the omitzero tag: update the Spec field declaration
for VSphereMachineTemplate (Spec VSphereMachineSpec) to remove the +optional
marker and use a plain json:"spec" tag (or another non-omitempty form) so
validation requires Spec to be present.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Make IsDefined return false for nil configs.

Like the v1beta2 version, these helpers treat a nil receiver as defined. That will misclassify omitted optional network config if a caller invokes (*NSXVPC)(nil).IsDefined() or (*Network)(nil).IsDefined().

Suggested fix

 func (r *NSXVPC) IsDefined() bool {
-	return !reflect.DeepEqual(r, &NSXVPC{})
+	return r != nil && !reflect.DeepEqual(*r, NSXVPC{})
 }
@@
 func (r *Network) IsDefined() bool {
-	return !reflect.DeepEqual(r, &Network{})
+	return r != nil && !reflect.DeepEqual(*r, Network{})
 }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	// IsDefined returns true if the NSXVPC is defined.
	func (r *NSXVPC) IsDefined() bool {
	return !reflect.DeepEqual(r, &NSXVPC{})
	}
	// Network defines the network configuration for the cluster with different network providers.
	// +kubebuilder:validation:XValidation:rule="has(self.nsxVPC) == has(oldSelf.nsxVPC)",message="field 'nsxVPC' cannot be added or removed after creation"
	// +kubebuilder:validation:MinProperties=1
	type Network struct {
	// nsxVPC defines the configuration when the network provider is NSX-VPC.
	// +optional
	NSXVPC NSXVPC `json:"nsxVPC,omitempty,omitzero"`
	}
	// IsDefined returns true if the Network is defined.
	func (r *Network) IsDefined() bool {
	return !reflect.DeepEqual(r, &Network{})
	}
	// IsDefined returns true if the NSXVPC is defined.
	func (r *NSXVPC) IsDefined() bool {
	return r != nil && !reflect.DeepEqual(*r, NSXVPC{})
	}
	// Network defines the network configuration for the cluster with different network providers.
	// +kubebuilder:validation:XValidation:rule="has(self.nsxVPC) == has(oldSelf.nsxVPC)",message="field 'nsxVPC' cannot be added or removed after creation"
	// +kubebuilder:validation:MinProperties=1
	type Network struct {
	// nsxVPC defines the configuration when the network provider is NSX-VPC.
	// +optional
	NSXVPC NSXVPC `json:"nsxVPC,omitempty,omitzero"`
	}
	// IsDefined returns true if the Network is defined.
	func (r *Network) IsDefined() bool {
	return r != nil && !reflect.DeepEqual(*r, Network{})
	}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/supervisor/v1beta1/vspherecluster_types.go` around lines 137 - 154, The
IsDefined helpers incorrectly treat a nil receiver as defined; update
NSXVPC.IsDefined and Network.IsDefined to first check for a nil receiver (e.g.,
if r == nil { return false }) and only then perform the existing
reflect.DeepEqual check to the zero-value instance so that
(*NSXVPC)(nil).IsDefined() and (*Network)(nil).IsDefined() return false.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Documentation comments reference "remediation template" instead of network objects.

The doc comments for Kind, Name, and APIVersion fields in InterfaceNetworkReference incorrectly reference "remediation template" - this appears to be copy-paste from another type. These should describe network object references instead.

📝 Proposed fix for documentation

 // InterfaceNetworkReference describes a reference to another object in the same
 // namespace as the referrer.
 type InterfaceNetworkReference struct {
-	// kind of the remediation template.
+	// kind of the network object.
 	// kind must consist of alphanumeric characters or '-', start with an alphabetic character, and end with an alphanumeric character.
 	// +required
 	// +kubebuilder:validation:MinLength=1
 	// +kubebuilder:validation:MaxLength=63
 	// +kubebuilder:validation:Pattern=`^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$`
 	Kind string `json:"kind,omitempty"`

-	// name of the remediation template.
+	// name of the network object.
 	// name must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character.
 	// +required
 	// +kubebuilder:validation:MinLength=1
 	// +kubebuilder:validation:MaxLength=253
 	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
 	Name string `json:"name,omitempty"`

-	// apiVersion of the remediation template.
-	// apiVersion must be fully qualified domain name followed by / and a version.
-	// NOTE: This field must be kept in sync with the APIVersion of the remediation template.
+	// apiVersion of the network object.
+	// apiVersion must be a fully qualified domain name followed by / and a version.
 	// +required
 	// +kubebuilder:validation:MinLength=1
 	// +kubebuilder:validation:MaxLength=317
 	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[a-z]([-a-z0-9]*[a-z0-9])?$`
 	APIVersion string `json:"apiVersion,omitempty"`
 }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	// kind of the remediation template.
	// kind must consist of alphanumeric characters or '-', start with an alphabetic character, and end with an alphanumeric character.
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=`^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$`
	Kind string `json:"kind,omitempty"`
	// name of the remediation template.
	// name must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character.
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
	Name string `json:"name,omitempty"`
	// apiVersion of the remediation template.
	// apiVersion must be fully qualified domain name followed by / and a version.
	// NOTE: This field must be kept in sync with the APIVersion of the remediation template.
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=317
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[a-z]([-a-z0-9]*[a-z0-9])?$`
	APIVersion string `json:"apiVersion,omitempty"`
	// kind of the network object.
	// kind must consist of alphanumeric characters or '-', start with an alphabetic character, and end with an alphanumeric character.
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=`^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$`
	Kind string `json:"kind,omitempty"`
	// name of the network object.
	// name must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character.
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
	Name string `json:"name,omitempty"`
	// apiVersion of the network object.
	// apiVersion must be a fully qualified domain name followed by / and a version.
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=317
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[a-z]([-a-z0-9]*[a-z0-9])?$`
	APIVersion string `json:"apiVersion,omitempty"`

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/supervisor/v1beta1/vspheremachine_types.go` around lines 197 - 220,
Update the doc comments on the InterfaceNetworkReference fields Kind, Name, and
APIVersion to describe a network object reference instead of a "remediation
template": replace every occurrence of "remediation template" in the comments
for Kind, Name, and APIVersion with text indicating they refer to the network
object being referenced (e.g., "network object" or "network resource"), preserve
the existing validation/kubebuilder tags and NOTE about APIVersion being kept in
sync with the referenced object's APIVersion, and ensure the
examples/constraints in the comments still make sense for network object naming
and API versioning.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Handle nil receivers in IsDefined.

Both helpers currently return true for a nil receiver because reflect.DeepEqual(nil, &NSXVPC{}) / reflect.DeepEqual(nil, &Network{}) is false. Any caller using these on optional pointers will treat an omitted config as present.

Suggested fix

 func (r *NSXVPC) IsDefined() bool {
-	return !reflect.DeepEqual(r, &NSXVPC{})
+	return r != nil && !reflect.DeepEqual(*r, NSXVPC{})
 }
@@
 func (r *Network) IsDefined() bool {
-	return !reflect.DeepEqual(r, &Network{})
+	return r != nil && !reflect.DeepEqual(*r, Network{})
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/supervisor/v1beta2/vspherecluster_types.go` around lines 139 - 156, The
IsDefined methods for NSXVPC and Network incorrectly report a nil receiver as
defined; update both methods (NSXVPC.IsDefined and Network.IsDefined) to first
check if the receiver is nil and return false, then proceed with the existing
reflect.DeepEqual comparison to an empty literal so omitted (nil) configs are
treated as undefined.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

IsDefined() should return false for nil receivers.

All current implementations treat nil as defined (true). Add a nil guard first so undefined pointers are handled correctly.

Suggested fix

 func (r *VSphereMachineNetworkDNSStatus) IsDefined() bool {
+	if r == nil {
+		return false
+	}
 	return !reflect.DeepEqual(r, &VSphereMachineNetworkDNSStatus{})
 }
@@
 func (r *VSphereMachineNetworkDHCPOptionsStatus) IsDefined() bool {
+	if r == nil {
+		return false
+	}
 	return !reflect.DeepEqual(r, &VSphereMachineNetworkDHCPOptionsStatus{})
 }
@@
 func (r *VSphereMachineNetworkDHCPStatus) IsDefined() bool {
+	if r == nil {
+		return false
+	}
 	return !reflect.DeepEqual(r, &VSphereMachineNetworkDHCPStatus{})
 }
@@
 func (r *VSphereMachineNetworkInterfaceIPStatus) IsDefined() bool {
+	if r == nil {
+		return false
+	}
 	return !reflect.DeepEqual(r, &VSphereMachineNetworkInterfaceIPStatus{})
 }
@@
 func (r *VSphereMachineNetworkStatus) IsDefined() bool {
+	if r == nil {
+		return false
+	}
 	return !reflect.DeepEqual(r, &VSphereMachineNetworkStatus{})
 }

Also applies to: 128-130, 149-151, 228-230, 285-287

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/supervisor/v1beta2/vspheremachinenetworkstatus_types.go` around lines 83
- 85, The IsDefined methods currently return true for nil receivers; add a
nil-check at the start of each IsDefined (e.g.,
VSphereMachineNetworkDNSStatus.IsDefined) and return false if the receiver is
nil, then proceed with the existing DeepEqual check — apply the same nil-guard
pattern to the other IsDefined implementations in this file as indicated (the
ones at the other noted ranges).

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix wording in Line 59 support status text.

Line 59 is missing “since,” which makes the sentence read incorrectly.

✏️ Suggested fix

-| v1.13.x       | Maintenance mode        | Maintenance mode v1.15.0 release date, EOL when v1.16.0 will be released             |
+| v1.13.x       | Maintenance mode        | In maintenance mode since v1.15.0 release date, EOL when v1.16.0 is released          |

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	| v1.13.x | Maintenance mode | Maintenance mode v1.15.0 release date, EOL when v1.16.0 will be released |
	| v1.13.x | Maintenance mode | In maintenance mode since v1.15.0 release date, EOL when v1.16.0 is released |

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@README.md` at line 59, Update the table row text in README.md (the row
containing "v1.13.x | Maintenance mode | Maintenance mode v1.15.0 release date,
EOL when v1.16.0 will be released") to include the word "since" before "v1.15.0"
so the cell reads "Maintenance mode since v1.15.0 release date, EOL when v1.16.0
will be released"; edit the table cell content accordingly to preserve spacing
and alignment.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: cloud-team-rebase-bot[bot]
Once this PR has been reviewed and has the lgtm label, please assign joelspeed for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment