kubernetes-sigs/cluster-api-provider-vsphere v1.16.0-rc.1

on GitHub

⚠️ RELEASE CANDIDATE NOTES ⚠️

Highlights

• REPLACE ME

Changes since v1.15.0

📈 Overview

• 123 new commits merged
• 16 breaking changes ⚠️
• 27 feature additions ✨
• 6 bugs fixed 🐛

⚠️ Breaking Changes

• Adjust v1beta2 APIs to use correct ref types (govmomi) (#3792)
• Adjust VSphereMachineStatus to API conventions (supervisor) (#3798)
• Align ./apis package names with conventions (#3802)
• Align failureDomain fields to CAPI contract (#3805)
• Align NumCPUs & NumCoresPerSocket to API conventions (#3803)
• Bump to Cluster API, controller-runtime main & controller-tools v0.20 (#3733)
• Deprecate ProviderServiceAccount CRD (#3799)
• Drop deprecated AutoConfigure field (#3762)
• Drop deprecated PreferredAPIServerCIDR field (#3761)
• Drop VSphereCluster.status.resourcePolicyName (supervisor) (#3809)
• Remove DefaulterRemoveUnknownOrOmitableFields mutating webhook option (#3763)
• Remove pointer from NamingStrategy field (#3765)
• Remove v1alpha3 + v1alpha4 apiVersions (#3741)
• Rename condition & reason constants for v1beta2 (#3800)
• Rename namingStrategy fields to naming (supervisor+govmomi) (#3810)
• Rename VSphereMachine Network field to NetworkRef (#3793)

✨ New Features

• Add CAPV v1beta2 API types (govmomi) (#3744)
• Add CAPV v1beta2 API types (supervisor) (#3771)
• Add e2e test for v1beta1 (#3811)
• Add operating system and architecture information to VSphereMachineTemplate status (#3788)
• Add support for multiple supervisor versions (#3767)
• Allow to configure crypto (#3907)
• Allow to set NestedHV, FtEncryptionMode and MigrateEncryption (#3740)
• Bump to Go 1.25.5 (#3732)
• Deprecate v1beta1 API packages (#3783)
• Disable DWARF and symbol table to decrease binary/image size (#3875)
• Dynamically choose API version for vm-operator (#3812)
• Enable PriorityQueue feature gate per default (#3730)
• Fix KAL findings in supervisor v1beta2 API & add metadata to templates (#3785)
• Fix KAL findings in v1beta2 API (govmomi) (#3748)
• Implement ReconcilerRateLimiting (#3846)
• Implement v1beta2 contract (govmomi) (#3746)
• Implement v1beta2 contract (supervisor) (#3778)
• Improve scale testing machinery (#3878)
• Improve v1beta2 CRD columns (govmomi+supervisor) (#3794)
• Migrate E2E tests to v1beta2 (govmomi) (#3747)
• Migrate E2E tests to v1beta2 (supervisor) (#3781)
• Optimize cache configuration for supervisor mode (#3861)
• Prepare main branch for v1.16 (#3735)
• Promote v1beta2 conditions on VSphereCluster, VSphereClusterIdentity, VSphereDeploymentZone + minor v1beta2 field migrations (#3745)
• Promote v1beta2 conditions on VSphereVM, VSphereMachine, VSphereCluster (#3772)
• Support Node Auto Placement and Node AF/AAF (#3655)
• Switch from vm-operator v1alpha2 API to v1alpha5 (#3784)

🐛 Bug Fixes

• Bump trivy to v0.69.2 to fix CI (#3851)
• Fetch zone info from already-placed VM condition message (#3894)
• Fix contract label for supervisor infrastructure components (#3877)
• Fix issue to use a legacy VMS using the same name (#3881)
• Set VM.spec.affinity only on create (#3835)
• Stop patching VSphereMachine on every reconcile (#3857)

🌱 Others

• Add 1.15 to support matrix (#3729)
• Add spec.template.metadata to VSphereClusterTemplate (govmomi) (#3768)
• Add support for vm-operator sim mode in vcsim (#3821)
• Add test coverage for apiVersion bump on VMG (#3815)
• Block direct usage of vm-operator APIs in prod code (#3796)
• Bump AdmissionReview and ConversionReview APIVersions (#3759)
• Bump autoscaler version used for testing to v1.35.0 (#3841)
• Bump CAPI to v1.13.0-beta.0 (#3886)
• Bump CAPI v1.13.0-beta.1 (#3915)
• Bump CAPI v1.13.0-rc.0 (#3925)
• Bump CAPI v1.13.0-rc.1 (#3946)
• Bump cpi to v1.35.0 (#3736)
• Bump CPI to v1.36.0-beta.0 (#3905)
• Bump CPI to v1.36.0-rc.0 (#3939)
• Bump dependencies (#3944)
• Bump Go to 1.25.6 (#3773)
• Bump go v1.25.8 (#3865)
• Bump go v1.25.9 (#3921)
• Bump golang.org/x/net to v0.51 to fix CVE (#3855)
• Bump google.golang.org/grpc to fix CVE (#3902)
• Bump govmomi v0.53.0 (#3844)
• Bump otel to fix CVE (#3847)
• Bump to CAPI main & use MarshalDataUnsafeNoCopy (#3874)
• Bump to CAPI main 2026.01.12 (#3754)
• Bump to CAPI main 2026.01.15 (#3770)
• Bump to CAPI main 2026.01.27 (#3814)
• Bump to CAPI main, fixes for scale tests (#3827)
• Bump to controller-runtime v0.23 & CAPI main 2026.01.19 (#3777)
• Bump to Go v1.25.7 (#3831)
• Change rbac proxy image (#3869)
• Cleanup KAL config (#3817)
• Cleanup RuntimeExtension provider e2e test setup (#3786)
• Drop defaulting from PowerOffMode API fields (govmomi) (#3760)
• Drop or reduce verbosity for noisy logs (#3876)
• Drop security scan on 1.13 (#3883)
• Drop usage of v1beta1 conditions (#3795)
• Extend govmomi test runtime extension, change quickstart to use runtime extension (#3820)
• Extend ownerRef tests to cover VirtualMachineSetResourcePolicy (#3813)
• Fix commentstart linter findings in supervisor v1beta1 API (#3769)
• Fix CRD columns (govmomi) (#3766)
• Fix CVE-2026-39883 (#3933)
• Implement type check for hub types (#3801)
• Improve godoc fo cloneMode field (#3838)
• Increase default kube-api qps/burst (#3828)
• Inline incorrect APIEndpoint.IsZero() func (#3764)
• Log flags on controller startup (#3879)
• Move VSphereVM failureReason/failureMessage fields to deprecated (#3789)
• Remove some occurrences of v1beta1 (#3804)
• Scale e2e tests: drop ValidateTopology RX, add MHC, add metrics for tilt (#3842)
• Set WithOwnedV1Beta1Conditions patchHelper option consistently (#3806)
• Simplify patch for external CRDs (#3742)
• Start testing with Kubernetes v1.36.0-beta.0 (#3906)
• Start testing with Kubernetes v1.36.0-rc.0 (#3930)
• Start testing with VM operator v1.9 (#3756)
• Stop using v1beta1 status in controllers (#3787)
• Supervisor: adjust cache configuration to only cache CAPV VirtualMachine objects (#3752)
• Update metrics config for v1vbeta2 (#3791)

📖 Additionally, there have been 2 contributions to our documentation and book. (#3790, #3840)

Dependencies

Added

• github.com/cenkalti/backoff/v5: v5.0.3
• github.com/google/go-github/v82: v82.0.0
• golang.org/x/tools/go/expect: v0.1.0-deprecated
• golang.org/x/tools/go/packages/packagestest: v0.1.1-deprecated
• gonum.org/v1/gonum: v0.17.0

Changed

• cel.dev/expr: v0.24.0 → v0.25.1
• cloud.google.com/go/compute/metadata: v0.6.0 → v0.9.0
• github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp: v1.26.0 → v1.31.0
• github.com/cncf/xds/go: 2f00578 → ee656c7
• github.com/coredns/corefile-migration: v1.0.29 → v1.0.31
• github.com/envoyproxy/go-control-plane/envoy: v1.32.4 → v1.36.0
• github.com/envoyproxy/go-control-plane: v0.13.4 → v0.14.0
• github.com/envoyproxy/protoc-gen-validate: v1.2.1 → v1.3.0
• github.com/fatih/color: v1.18.0 → v1.19.0
• github.com/go-jose/go-jose/v4: v4.0.4 → v4.1.3
• github.com/golang/glog: v1.2.4 → v1.2.5
• github.com/google/go-querystring: v1.1.0 → v1.2.0
• github.com/google/pprof: f64d9cf → 294ebfa
• github.com/grpc-ecosystem/grpc-gateway/v2: v2.26.3 → v2.28.0
• github.com/onsi/ginkgo/v2: v2.27.3 → v2.28.1
• github.com/onsi/gomega: v1.38.3 → v1.39.1
• github.com/prometheus/client_golang: v1.22.0 → v1.23.2
• github.com/prometheus/common: v0.62.0 → v0.66.1
• github.com/prometheus/procfs: v0.15.1 → v0.16.1
• github.com/spiffe/go-spiffe/v2: v2.5.0 → v2.6.0
• github.com/valyala/fastjson: v1.6.4 → v1.6.10
• github.com/vmware-tanzu/net-operator-api: 1f32d6b → 90a4bb2
• github.com/vmware-tanzu/nsx-operator/pkg/apis: 9da8637 → 288a237
• github.com/vmware-tanzu/vm-operator/api: v1.8.6 → 93918c5
• github.com/vmware-tanzu/vm-operator/external/ncp: de75746 → 93918c5
• github.com/vmware/govmomi: v0.52.0 → v0.53.0
• go.etcd.io/bbolt: v1.4.2 → v1.4.3
• go.etcd.io/etcd/api/v3: v3.6.6 → v3.6.10
• go.etcd.io/etcd/client/pkg/v3: v3.6.6 → v3.6.10
• go.etcd.io/etcd/client/v3: v3.6.6 → v3.6.10
• go.etcd.io/etcd/pkg/v3: v3.6.4 → v3.6.5
• go.etcd.io/etcd/server/v3: v3.6.4 → v3.6.5
• go.opentelemetry.io/auto/sdk: v1.1.0 → v1.2.1
• go.opentelemetry.io/contrib/detectors/gcp: v1.34.0 → v1.39.0
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp: v0.58.0 → v0.65.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.34.0 → v1.43.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.34.0 → v1.43.0
• go.opentelemetry.io/otel/metric: v1.35.0 → v1.43.0
• go.opentelemetry.io/otel/sdk/metric: v1.34.0 → v1.43.0
• go.opentelemetry.io/otel/sdk: v1.34.0 → v1.43.0
• go.opentelemetry.io/otel/trace: v1.35.0 → v1.43.0
• go.opentelemetry.io/otel: v1.35.0 → v1.43.0
• go.opentelemetry.io/proto/otlp: v1.5.0 → v1.10.0
• go.yaml.in/yaml/v2: v2.4.2 → v2.4.3
• golang.org/x/crypto: v0.46.0 → v0.50.0
• golang.org/x/mod: v0.31.0 → v0.35.0
• golang.org/x/net: v0.48.0 → v0.53.0
• golang.org/x/oauth2: v0.33.0 → v0.36.0
• golang.org/x/sync: v0.19.0 → v0.20.0
• golang.org/x/sys: v0.39.0 → v0.43.0
• golang.org/x/telemetry: 8fff8a5 → be6f6cb
• golang.org/x/term: v0.38.0 → v0.42.0
• golang.org/x/text: v0.32.0 → v0.36.0
• golang.org/x/tools: v0.40.0 → v0.44.0
• google.golang.org/genproto/googleapis/api: a0af3ef → 9d38bb4
• google.golang.org/genproto/googleapis/rpc: a0af3ef → 9d38bb4
• google.golang.org/grpc: v1.72.3 → v1.80.0
• google.golang.org/protobuf: v1.36.7 → v1.36.11
• gopkg.in/evanphx/json-patch.v4: v4.12.0 → v4.13.0
• k8s.io/api: v0.34.3 → v0.35.3
• k8s.io/apiextensions-apiserver: v0.34.3 → v0.35.3
• k8s.io/apimachinery: v0.34.3 → v0.35.3
• k8s.io/apiserver: v0.34.3 → v0.35.3
• k8s.io/client-go: v0.34.3 → v0.35.3
• k8s.io/cluster-bootstrap: v0.34.3 → v0.35.3
• k8s.io/code-generator: v0.34.3 → v0.35.3
• k8s.io/component-base: v0.34.3 → v0.35.3
• k8s.io/gengo/v2: 85fd79d → ec3ebc5
• k8s.io/kms: v0.34.3 → v0.35.3
• k8s.io/kube-openapi: f3f2b99 → 589584f
• k8s.io/utils: 4c0f3b2 → bc988d5
• sigs.k8s.io/cluster-api: v1.12.1 → v1.13.0-rc.1
• sigs.k8s.io/controller-runtime: v0.22.4 → v0.23.3
• sigs.k8s.io/json: cfa47c3 → 2d32026
• sigs.k8s.io/structured-merge-diff/v6: v6.3.0 → v6.3.2

Removed

• github.com/ProtonMail/go-crypto: 7d5c6f0
• github.com/PuerkitoBio/purell: v1.0.0
• github.com/PuerkitoBio/urlesc: 5bd2802
• github.com/cloudflare/circl: v1.6.1
• github.com/docker/spdystream: 449fdfc
• github.com/elazarl/goproxy: c4fc265
• github.com/emicklei/go-restful: ff4f55a
• github.com/ghodss/yaml: 73d445a
• github.com/go-openapi/spec: 6aced65
• github.com/go-task/slim-sprig: 52ccab3
• github.com/golang/groupcache: 41bb18b
• github.com/google/go-github/v53: v53.2.0
• github.com/googleapis/gnostic: 0c51083
• github.com/hashicorp/golang-lru: v0.5.1
• github.com/hpcloud/tail: v1.0.0
• github.com/imdario/mergo: v0.3.6
• github.com/kisielk/errcheck: v1.5.0
• github.com/kisielk/gotool: v1.0.0
• github.com/matttproud/golang_protobuf_extensions/v2: v2.0.0
• github.com/onsi/ginkgo: v1.10.1
• github.com/vmware-tanzu/vm-operator/pkg/constants/testlabels: de75746
• github.com/zeebo/errs: v1.4.0
• go.uber.org/automaxprocs: v1.6.0
• golang.org/x/xerrors: 5ec99f8
• google.golang.org/appengine: v1.6.7
• gopkg.in/gcfg.v1: v1.2.3
• gopkg.in/tomb.v1: dd63297
• gopkg.in/warnings.v0: v0.1.2
• k8s.io/gengo: 485abfe
• sigs.k8s.io/structured-merge-diff: 15d366b