feat: configure service-account-issuer on workload cluster apiserver in prow CI templates

.codespellignore

@@ -7,3 +7,4 @@ shouldnot
 decorder
 overriden
 wit
+ist

.github/workflows/codeql.yml

@@ -41,7 +41,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
         with:
           egress-policy: audit
 
@@ -50,7 +50,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
+        uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -60,7 +60,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
+        uses: github/codeql-action/autobuild@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -73,6 +73,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
+        uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/cover.yaml

@@ -14,19 +14,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
       with:
         egress-policy: audit
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Get Go version
       id: vars
       run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
     - name: Set up Go
-      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
         go-version: ${{ steps.vars.outputs.go_version }}
     - run: "PATH=/usr/local/go/bin:$PATH make test-cover"
-    - uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
+    - uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
       env:
         CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
       with:

.github/workflows/dependabot-code-gen.yml

@@ -20,20 +20,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
       with:
         egress-policy: audit
     - name: Get Go version
       id: vars
       run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
     - name: Set up Go
-      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
         go-version: ${{ steps.vars.outputs.go_version }}
       id: go
     - name: Check out code into the Go module directory
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-    - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # tag=v5.0.4
+    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # tag=v5.0.5
       name: Restore go cache
       with:
         path: |

.github/workflows/dependency-review.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
         with:
           egress-policy: audit
 

.github/workflows/lint-docs.yaml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
       with:
         egress-policy: audit
 

.github/workflows/pr-golangci-lint.yaml

@@ -25,7 +25,7 @@ jobs:
         run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
 
       - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # tag=v6.3.0
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # tag=v6.4.0
         with:
           go-version: ${{ steps.vars.outputs.go_version }}
 

.github/workflows/release.yaml

@@ -20,7 +20,7 @@ jobs:
       release_tag: ${{ steps.release-version.outputs.release_version }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
         with:
           egress-policy: audit
       - name: Checkout code
@@ -29,7 +29,7 @@ jobs:
           fetch-depth: 0
       - name: Get changed files
         id: changed-markdown-files
-        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # tag=v47.0.5
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # tag=v47.0.6
         with:
           files: CHANGELOG/**.md
       - name: Get release version
@@ -92,7 +92,7 @@ jobs:
     needs: push_release_tag
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
         with:
           egress-policy: audit
       - name: Set env
@@ -107,7 +107,7 @@ jobs:
       - name: Get Go version
         run: echo "go_version=$(make go-version)" >> $GITHUB_ENV
       - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # tag=v6.3.0
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # tag=v6.4.0
         with:
           go-version: ${{ env.go_version }}
       - name: generate release artifacts
@@ -118,7 +118,7 @@ jobs:
           curl -L "https://raw.githubusercontent.com/${{ github.repository }}/main/CHANGELOG/${{ env.RELEASE_TAG }}.md" \
           -o "${{ env.RELEASE_TAG }}.md"
       - name: Release
-        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # tag=v2.6.1
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # tag=v3.0.0
         with:
           draft: true
           files: out/*

.github/workflows/scorecards.yml

@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
         with:
           egress-policy: audit
 
@@ -63,14 +63,14 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
+        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
         with:
           sarif_file: results.sarif

.github/workflows/weekly-security-scan.yaml

@@ -14,7 +14,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        branch: [ main, release-1.22, release-1.21 ]
+        branch: [ main, release-1.24, release-1.23 ]
     name: Trivy
     runs-on: ubuntu-latest
     steps:
@@ -26,7 +26,7 @@ jobs:
       id: vars
       run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
     - name: Set up Go
-      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # tag=v6.3.0
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # tag=v6.4.0
       with:
         go-version: ${{ steps.vars.outputs.go_version }}
     - name: Run verify security target

.golangci.yml

@@ -160,7 +160,7 @@ linters:
               - jsontags          # Ensures proper JSON tag formatting
               - nofloats          # Prevents float type usage
               - nomaps            # Restricts map usage
-              - nonullable        # Prevents usage of the nullable marker 
+              - nonullable        # Prevents usage of the nullable marker
               - nophase           # Prevents Phase field usage
               - notimestamp       # Prevents TimeStamp field usage
           lintersConfig: {}
@@ -340,6 +340,10 @@ linters:
         - staticcheck
         path: .*\.go$
         text: 'SA1019: "sigs.k8s.io/cluster-api/util/deprecated/.*" is deprecated: This package is deprecated and is going to be removed when support for v1beta1 will be dropped.'
+      # Ignore GetEventRecorderFor deprecation (CAPI itself still uses it).
+      - linters:
+          - staticcheck
+        text: 'SA1019: (env|mgr|testEnv).GetEventRecorderFor is deprecated'
       # Ignore CAPZ v1beta1 deprecations (SharedGallery, VMState) still used for backward compatibility.
       - linters:
           - staticcheck

AGENTS.md

@@ -117,6 +117,8 @@ make kind-reset
 
 **tilt-settings.yaml** is required with Azure credentials (see docs/book/src/developers/development.md for details).
 
+`make tilt-up` runs `check-az-cli`; if `az` is missing, it warns and tells you to install the Azure CLI and retry `make tilt-up` (needed for Tilt flows that call `az`, e.g. VNet peering with AKS as management cluster). Use `VERBOSE=1 make check-az-cli` to print the detected binary path.
+
 ### E2E Testing
 
 ```bash
@@ -201,7 +203,7 @@ make generate-go  # Regenerates mocks in azure/services/*/mock_*/
 - `main.go`: Entry point, registers controllers and webhooks
 - `Makefile`: All build/test/dev targets
 - `Tiltfile`: Local development with Tilt
-- `go.mod`: Go dependencies (uses Go 1.24+)
+- `go.mod`: Go dependencies (uses Go 1.25+)
 - `config/`: Kustomize configurations for CRDs, RBAC, webhooks, manager
 - `templates/`: Cluster template flavors for different scenarios
 - `test/e2e/`: E2E test suites and data files

CHANGELOG/v1.22.2.md

@@ -0,0 +1,43 @@
+## Changes by Kind
+
+### Other (Cleanup or Flake)
+
+- Bump CAPI to v1.11.7 ([#6174](https://github.com/kubernetes-sigs/cluster-api-provider-azure/pull/6174), [@mboersma](https://github.com/mboersma))
+
+## Dependencies
+
+### Added
+- sigs.k8s.io/structured-merge-diff/v6: v6.3.2
+
+### Changed
+- cel.dev/expr: v0.24.0 → v0.25.1
+- github.com/cloudflare/circl: [v1.6.1 → v1.6.3](https://github.com/cloudflare/circl/compare/v1.6.1...v1.6.3)
+- github.com/cncf/xds/go: [0feb691 → ee656c7](https://github.com/cncf/xds/compare/0feb691...ee656c7)
+- github.com/envoyproxy/go-control-plane/envoy: [v1.35.0 → v1.36.0](https://github.com/envoyproxy/go-control-plane/compare/envoy/v1.35.0...envoy/v1.36.0)
+- github.com/envoyproxy/go-control-plane: [75eaa19 → v0.14.0](https://github.com/envoyproxy/go-control-plane/compare/75eaa19...v0.14.0)
+- github.com/envoyproxy/protoc-gen-validate: [v1.2.1 → v1.3.0](https://github.com/envoyproxy/protoc-gen-validate/compare/v1.2.1...v1.3.0)
+- github.com/grpc-ecosystem/grpc-gateway/v2: [v2.27.3 → v2.27.7](https://github.com/grpc-ecosystem/grpc-gateway/compare/v2.27.3...v2.27.7)
+- go.opentelemetry.io/contrib/detectors/gcp: v1.38.0 → v1.39.0
+- go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp: v0.60.0 → v0.65.0
+- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.39.0 → v1.40.0
+- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp: v1.22.0 → v1.40.0
+- go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.39.0 → v1.40.0
+- go.opentelemetry.io/otel/metric: v1.39.0 → v1.40.0
+- go.opentelemetry.io/otel/sdk/metric: v1.39.0 → v1.40.0
+- go.opentelemetry.io/otel/sdk: v1.39.0 → v1.40.0
+- go.opentelemetry.io/otel/trace: v1.39.0 → v1.40.0
+- go.opentelemetry.io/otel: v1.39.0 → v1.40.0
+- golang.org/x/oauth2: v0.32.0 → v0.34.0
+- google.golang.org/genproto/googleapis/api: ff82c1b → 8636f87
+- google.golang.org/genproto/googleapis/rpc: ff82c1b → 8636f87
+- google.golang.org/grpc: v1.77.0 → v1.79.3
+- google.golang.org/protobuf: v1.36.10 → v1.36.11
+- sigs.k8s.io/cluster-api/test: v1.11.6 → v1.11.7
+- sigs.k8s.io/cluster-api: v1.11.6 → v1.11.7
+
+### Removed
+_Nothing has changed._
+
+## Details
+<!-- markdown-link-check-disable-next-line -->
+https://github.com/kubernetes-sigs/cluster-api-provider-azure/compare/v1.22.1...v1.22.2

CHANGELOG/v1.22.4.md

@@ -0,0 +1,63 @@
+## Changes by Kind
+
+### Other (Cleanup or Flake)
+
+- Bump CAPI to v1.11.10 ([#6249](https://github.com/kubernetes-sigs/cluster-api-provider-azure/pull/6249), [@mboersma](https://github.com/mboersma))
+
+## Dependencies
+
+### Added
+- github.com/moby/moby/api: [v1.54.1](https://github.com/moby/moby/tree/api/v1.54.1)
+- github.com/moby/moby/client: [v0.4.0](https://github.com/moby/moby/tree/client/v0.4.0)
+- github.com/russross/blackfriday: [v1.6.0](https://github.com/russross/blackfriday/tree/v1.6.0)
+- github.com/santhosh-tekuri/jsonschema/v5: [v5.3.1](https://github.com/santhosh-tekuri/jsonschema/tree/v5.3.1)
+- pgregory.net/rapid: v1.2.0
+
+### Changed
+- github.com/Azure/go-ansiterm: [306776e → faa5f7b](https://github.com/Azure/go-ansiterm/compare/306776e...faa5f7b)
+- github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp: [v1.30.0 → v1.31.0](https://github.com/GoogleCloudPlatform/opentelemetry-operations-go/compare/detectors/gcp/v1.30.0...detectors/gcp/v1.31.0)
+- github.com/Microsoft/go-winio: [v0.5.0 → v0.6.2](https://github.com/Microsoft/go-winio/compare/v0.5.0...v0.6.2)
+- github.com/creack/pty: [v1.1.18 → v1.1.24](https://github.com/creack/pty/compare/v1.1.18...v1.1.24)
+- github.com/docker/go-connections: [v0.5.0 → v0.6.0](https://github.com/docker/go-connections/compare/v0.5.0...v0.6.0)
+- github.com/docker/go-units: [v0.4.0 → v0.5.0](https://github.com/docker/go-units/compare/v0.4.0...v0.5.0)
+- github.com/emicklei/go-restful/v3: [v3.12.2 → v3.13.0](https://github.com/emicklei/go-restful/compare/v3.12.2...v3.13.0)
+- github.com/grpc-ecosystem/grpc-gateway/v2: [v2.27.7 → v2.28.0](https://github.com/grpc-ecosystem/grpc-gateway/compare/v2.27.7...v2.28.0)
+- github.com/moby/term: [v0.5.0 → v0.5.2](https://github.com/moby/term/compare/v0.5.0...v0.5.2)
+- github.com/opencontainers/image-spec: [v1.0.2 → v1.1.1](https://github.com/opencontainers/image-spec/compare/v1.0.2...v1.1.1)
+- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.40.0 → v1.43.0
+- go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.40.0 → v1.43.0
+- go.opentelemetry.io/otel/metric: v1.40.0 → v1.43.0
+- go.opentelemetry.io/otel/sdk/metric: v1.40.0 → v1.43.0
+- go.opentelemetry.io/otel/sdk: v1.40.0 → v1.43.0
+- go.opentelemetry.io/otel/trace: v1.40.0 → v1.43.0
+- go.opentelemetry.io/otel: v1.40.0 → v1.43.0
+- go.opentelemetry.io/proto/otlp: v1.9.0 → v1.10.0
+- golang.org/x/crypto: v0.47.0 → v0.49.0
+- golang.org/x/mod: v0.32.0 → v0.33.0
+- golang.org/x/net: v0.49.0 → v0.52.0
+- golang.org/x/oauth2: v0.34.0 → v0.35.0
+- golang.org/x/sync: v0.19.0 → v0.20.0
+- golang.org/x/sys: v0.40.0 → v0.42.0
+- golang.org/x/telemetry: 8fff8a5 → e7419c6
+- golang.org/x/term: v0.39.0 → v0.41.0
+- golang.org/x/text: v0.33.0 → v0.35.0
+- golang.org/x/tools: v0.40.0 → v0.42.0
+- gonum.org/v1/gonum: v0.16.0 → v0.17.0
+- google.golang.org/genproto/googleapis/api: 8636f87 → 9d38bb4
+- google.golang.org/genproto/googleapis/rpc: 8636f87 → 9d38bb4
+- google.golang.org/grpc: v1.79.3 → v1.80.0
+- gotest.tools/v3: v3.4.0 → v3.5.2
+- sigs.k8s.io/cluster-api/test: v1.11.7 → v1.11.10
+- sigs.k8s.io/cluster-api: v1.11.7 → v1.11.10
+
+### Removed
+- github.com/containerd/log: [v0.1.0](https://github.com/containerd/log/tree/v0.1.0)
+- github.com/docker/docker: [v28.3.3+incompatible](https://github.com/docker/docker/tree/v28.3.3)
+- github.com/moby/sys/atomicwriter: [v0.1.0](https://github.com/moby/sys/tree/atomicwriter/v0.1.0)
+- github.com/moby/sys/sequential: [v0.6.0](https://github.com/moby/sys/tree/sequential/v0.6.0)
+- github.com/morikuni/aec: [v1.0.0](https://github.com/morikuni/aec/tree/v1.0.0)
+- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp: v1.40.0
+
+## Details
+<!-- markdown-link-check-disable-next-line -->
+https://github.com/kubernetes-sigs/cluster-api-provider-azure/compare/v1.22.2...v1.22.4