Update module sigs.k8s.io/cluster-api-provider-aws/v2 to v2.8.4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
sigs.k8s.io/cluster-api-provider-aws/v2	v2.6.1 -> v2.8.4

---

Release Notes

kubernetes-sigs/cluster-api-provider-aws (sigs.k8s.io/cluster-api-provider-aws/v2)

v2.8.4

Compare Source

Release notes for Cluster API Provider AWS (CAPA) v2.8.4

Documentation

Changelog since v2.8.3

Urgent Upgrade Notes

(No, really, you MUST read this before you upgrade)

Add missing permissions for controller. Its recommended that you update your CloudFormation stack. (#​5539, @​k8s-infra-cherrypick-robot)

Changes by Kind

Uncategorized

• Add machine pool template for Flatcar Linux (#​5534, @​k8s-infra-cherrypick-robot)
• Fix: Ignore conflict resolution and correctly compare configuration for AddOn reconciliation (#​5501, @​k8s-infra-cherrypick-robot)
• Fixed the default AMI lookup when using a bastion. (#​5533, @​k8s-infra-cherrypick-robot)
• ✨ Added support for Amazon Linux 2023 and Amazon Linux 2023 GPU AMI lookup in EKS optimized AMI workflow. (#​5555, @​k8s-infra-cherrypick-robot)
• 🐛 Fix missing CRD validation for Amazon Linux 2023 eksLookupType enum values, completing the AL2023 support introduced in v2.8. (#​5566, @​k8s-infra-cherrypick-robot)

The images for this release are:

registry.k8s.io/cluster-api-aws/cluster-api-aws-controller:v2.8.4

Thanks to all our contributors.

v2.8.3

Compare Source

Release notes for Cluster API Provider AWS (CAPA) v2.8.3

Documentation

Changelog since v2.8.2

Changes by Kind

Support

• Bump github.com/golang-jwt/jwt to 4.5.2 and 5.5.2 (#​5436, @​damdo)

Uncategorized

• Bump calico used in e2e tests to newest version. (#​5463, @​k8s-infra-cherrypick-robot)
• Fix: Ignore conflict resolution and correctly compare configuration for AddOn reconciliation (#​5501, @​k8s-infra-cherrypick-robot)

The images for this release are:
registry.k8s.io/cluster-api-aws/cluster-api-aws-controller:v2.8.3

Thanks to all our contributors.

v2.8.2

Compare Source

Release notes for Cluster API Provider AWS (CAPA) v2.8.2

Documentation

Changelog since v2.8.1

Changes by Kind

Support

• Bump github.com/golang-jwt/jwt to 4.5.2 and 5.5.2 (#​5436, @​damdo)

The images for this release are:
registry.k8s.io/cluster-api-aws/cluster-api-aws-controller:v2.8.2

Thanks to all our contributors.

v2.8.1

Release notes for Cluster API Provider AWS (CAPA) v2.8.1

Documentation

There is no v2.8.0 GitHub release due to issues during the release process.

Changelog since v2.7.1

Urgent Upgrade Notes

(No, really, you MUST read this before you upgrade)

• Action required
  Bump CAPI to v1.9.z
  !! ACTION REQUIRED BEFORE UPGRADING !!
  If you are using the AWSManagedControlPlane to provision EKS clusters and you do not have a spec.Version specified in such resource (meaning you are relying on the default that AWS provides), you will need to either:
  a) explicitly set such spec.Version field before upgrading CAPA
  or b) disable the MachineSetPreflightChecks in your cluster either:
  b1) by setting this core CAPI feature gate to false
  b2) or by disabling it via the relevant annotation on all the machineSets belonging to said cluster (follow this guide on how to do this: https://cluster-api.sigs.k8s.io/tasks/experimental-features/machineset-preflight-checks).
  This is necessary as core CAPI 1.9 introduces a feature gate change, setting MachineSetPreflightChecks=true, which in turn relies on the presence of spec.Version and status.Version on the AWSManagedControlPlane object.
  We are planning a future refactor of these API fields in v1bhttps://github.com/kubernetes-sigs/cluster-api-provider-aws/issues/3853s/3853).
  Other places where you can find details on this are:
  • https://github.com/kubernetes-sigs/cluster-api-provider-aws/issues/5225
  • https://github.com/kubernetes-sigs/cluster-api/issues/11117
  • https://kubernetes.slack.com/archives/CD6U2V71N/p1739783013734149 (#​5209, @​damdo)
• Action required
  From this release onwards we recommend not creating clusters using the classic ELB (which is the default for the API). Classic ELB support is deprected and support will be removed in a future version.
  For new & existing clusters that use a classic elb AND do not specify the health check protocol then the protocol will be changed/set to TCP instead of SSL.
  If you want to use a classic elb with an SSL healthcheck then you will need to specify the cipher suites to use in the KubeadmControlPlane:

apiVersion: controlplane.cluster.x-k8s.io/v1beta1
kind: KubeadmControlPlane
metadata:
  name: "${CLUSTER_NAME}-control-plane"
spec:
  kubeadmConfigSpec:
    clusterConfiguration:
      apiServer:
        extraArgs:
          cloud-provider: external

### This is needed for Kubernetes v1.30+ since else it uses the Go defaults which don't
### work with AWS classic load balancers, see

### https://github.com/kubernetes-sigs/cluster-api-provider-aws/issues/5139. If you use
### another load balancer type such as NLB, this is not needed.
          #

### The list consists of the secure ciphers from Go 1.23.3, plus some less secure
### RSA ciphers which the AWS classic load balancer instance health check supports.
          tls-cipher-suites: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256

(#​5346, @​richardcase)

• If deploying clusters to an existing VPC (not managed by the AWS provider), the provider will no longer automatically create a security group rule allowing traffic from all addresses (0.0.0.0/0). You may need to update AWSCluster.spec.controlPlaneLoadBalancer.ingressRules with the source address of your Management Cluster. (#​5198, @​sl1pm4t)

Changes by Kind

Support

• Add devbox and devcontainer configuration (#​5301, @​faermanj)
• Update metadata file for v2.7.0 release. (#​5187, @​richardcase)
• Update metadata for release v2.8.x (#​5397, @​richardcase)

API Change

• Adds optional Conditions field to Status for AWSManagedCluster, ROSACluster. Sets Paused condition when reconciliation is paused (Contract change) (#​5394, @​theobarberbany)

Feature

• Add AWSMachines to back the EC2 instances in AWSMachinePools and AWSManagedMachinePools (#​5319, @​AndiDog)
• Add ROSA-HCP version channel group for Machine Pools (#​5332, @​PanSpagetka)
• Add VolumeSize parameter for RosaMachinePool. (#​5270, @​PanSpagetka)
• Add flag to support BootstrapSelfManagedAddons to provision Bare EKS cluster without default addons (coreDNS, kube-proxy, aws-vpc-cni) (#​5222, @​jas-nik)
• Add support for creating instances with elastic fabric adapter interface type. (#​5275, @​RadekManak)
• Avoid reconciling AWSMachinePools when only the status field has changed (#​5333, @​fiunchinho)
• Introduce the --disable-controllers argument to the controller manager binary. (#​5395, @​nrb)
• Log AWS account being used when the e2e tests run. (#​5250, @​richardcase)
• Support running EC2 instances from a reserved capacity block (new API field marketType). i.e, marketType: capacity-block (#​5211, @​athiruma)
• Templates: start explicitly using NLB (Network Load Balancer) + HTTPS checks for the Control Plane Load Balancer (#​5345, @​damdo)
• Wait for AWSCluster dependent object to be deleted (#​5365, @​alexander-demicev)

Documentation

• Fix typo on table of feature gates (#​5273, @​Rudro-25)
• Release notes include reminder to update Prow jobs. (#​5204, @​richardcase)
• Update links to new 2025 meeting notes doc (#​5277, @​richardcase)

Failing Test

• Fix the EFS & classic elb e2e tests. (#​5418, @​richardcase)
• Remove CoreDNS check from EKS e2e after a change by AWS to EKS. (#​5239, @​nrb)
• Updates to e2e tests to stop using v1.23 (#​5297, @​richardcase)
• Upgrade to CAPI 1.8.6 (#​5249, @​nrb)

Bug or Regression

• 1. fixed adding a secondary load balancer to existing aws cluster (#​5248, @​alexeysofin)
• Filter out AWS internal tags when reconciling AWS infra (#​5181, @​fiunchinho)
• Fix OIDC unit test after test runner go version change. (#​5352, @​richardcase)
• Fix ROSA doc formatting (#​5324, @​mzazrivec)
• Fix cluster deletion when using BYO AWS infra mode and Secondary CIDR (#​5291, @​adriananeci)
• Fix delay in reconciliation caused by patching wrong object with new paused condition. (#​5425, @​richardcase)
• Fix nil pointer dereference in reconcileNodegroupVersion by adding a check for nodegroup version. (#​5019, @​nueavv)
• Fix self hosted e2e test caused by disk pressure. (#​5288, @​richardcase)
• Fix subnet sorting with multiple vpcs when launching an instance (#​5114, @​cnmcavoy)
• Fix: Include AddOn configuration and conflict resolution for reconciliation (#​5199, @​gutmensch)
• Fixed RosaMachinePool typo. (#​5244, @​tinaafitz)
• Remove placeholder CA bundles from webhook configuration to support Kubernetes 1.31. (#​5197, @​robinkb)
• Tags defined in subnet spec should be applied (#​5175, @​fiunchinho)
• Use different names for controllers watching AWSCluster objects (#​5313, @​AndiDog)

Other (Cleanup or Flake)

• Update PR verifier to be inline with upstream CAPI. (#​5300, @​richardcase)

Uncategorized

• Add ROSA-HCP version channel group (#​5279, @​serngawy)
• Feat: enable support for service account authentication in ROSA installations (#​5233, @​mzazrivec)
• Fixed a few typos. (#​5238, @​tinaafitz)
• Set Paused condition on reconciled resources status upon pausing reconciliation (CAPI provider contract change) (#​5383, @​theobarberbany)
• Update ROSA upgrade documentation (#​5235, @​serngawy)

The images for this release are:
docker pull registry.k8s.io/cluster-api-aws/cluster-api-aws-controller:v2.8.1

Thanks to all our contributors.

v2.7.2

Compare Source

Release notes for Cluster API Provider AWS (CAPA) v2.7.2

Documentation

Changelog since v2.7.1

Changes by Kind

Support

• Bump github.com/golang-jwt/jwt to 4.5.2 and 5.5.2 (#​5435, @​damdo)

Uncategorized

• Add devbox and devcontainer configuration (#​5317, @​k8s-infra-cherrypick-robot)
• Fix OIDC unit test after test runner go version change. (#​5353, @​k8s-infra-cherrypick-robot)
• Fix self hosted e2e test caused by disk pressure. (#​5293, @​k8s-infra-cherrypick-robot)
• Fix: Include AddOn configuration and conflict resolution for reconciliation (#​5202, @​k8s-infra-cherrypick-robot)
• Update PR verifier to be inline with upstream CAPI. (#​5302, @​k8s-infra-cherrypick-robot)
• Updates to e2e tests to stop using v1.23 (#​5310, @​k8s-infra-cherrypick-robot)
• Upgrade to CAPI 1.8.6 (#​5328, @​k8s-infra-cherrypick-robot)

The images for this release are:

registry.k8s.io/cluster-api-aws/cluster-api-aws-controller:v2.7.2

Thanks to all our contributors.

v2.7.1

Compare Source

Release notes for Cluster API Provider AWS (CAPA) v2.7.1

Documentation

Changelog since v2.6.1

NOTE: there is no v2.7.0 release available due to an issue encountered during the release process.

Urgent Upgrade Notes

(No, really, you MUST read this before you upgrade)

• A new community owned AWS account is now being used for publishing AMIs. The old account owner by a company is no longer accessible and the images are being automatically deleted by AWS. Support for ubuntu 18.04 & 20.04 has been dropped and ubuntu 24.04 is now the default OS if no OS is supplied. (#​5133, @​richardcase)
• View the projects policy on publishing AMIs here.
• There is known issue creating clusters with Kubernetes v1.30 or greater when the load balancer is an ELB (which is the default). Its recommended for new clusters that you use an NLB instead, See #​5139 for further details.

Changes by Kind

Support

• Add issue templates for reviewer and maintainer changes (#​5079, @​richardcase)
• Bump CAPI to v1.8.4 (#​5061, @​damdo)
• Switch PodDisruptionBudget in templates to policy/v1 (#​5102, @​AndiDog)
• Templates: align cluster-template.yaml and cluster-template-machinepool.yaml, use external cloud controller and CSI (#​5136, @​AndiDog)
• Update metadata file for v2.7.0 release. (#​5187, @​richardcase)

Feature

• Add NonRootVolumes to AWSMachinePool launch template. (#​4954, @​mnitchev)
• Add ROSA Control plane registry configuration. (#​5132, @​serngawy)
• Change prevenet deletion label to be specific to CAPA. (#​5072, @​richardcase)
• Feat: add support for additionalControlPlaneIngressRules in AWSManagedControlPlane (#​4783, @​fad3t)
• New AMI building workflow that allows a packer vars file to be passed in. (#​5152, @​richardcase)
• New AWSCluster.spec.network.NodePortIngressRuleCidrBlocks parameter which allows to specify IPv4 CIDR blocks for Security group rule "Node Port Services" instead of default 0.0.0.0/. (#​5147, @​krasoffski)
• New workflow to publish CAPA AMIs (#​5138, @​richardcase)
• Support adding custom secondary VPC CIDR blocks in AWSCluster (#​4898, @​AndiDog)
• Support setting maxHealthyPercentage to configure ASG instance refresh (#​5140, @​fiunchinho)

Bug or Regression

• A missing permission needed for using nlbs (#​5154, @​richardcase)
• Check for the LB "active" status instead of trying to resolve the DNS name to validate the LB is ready. (#​5093, @​r4f4)
• Fix duplicated/leaked EIP when using BYO IPv4 on Machines. (#​5039, @​mtulio)
• Fix kustomize issue with e2e tests. (#​5167, @​richardcase)
• Fix: do not attach security groups for Network Load Balancers in secret regions. (#​5030, @​r4f4)
• Mark S3BucketCreated condition ready after successful reconciliation (#​5089, @​AndiDog)
• Updates EKS e2e tests after recent bumping of EKS versions. (#​5185, @​richardcase)

Uncategorized

• Add versionGate Acknowledgement for upgrading ROSA-HCP y-stream versions (#​5166, @​serngawy)
• Fix: Fargate: Standardize cluster name in role names to avoid errors on mismatch between Cluster CR and EKS cluster name (#​5111, @​alam0rt)
• Update Flatcar template to use external CCM. (#​5099, @​ader1990)

The images for this release are:

registry.k8s.io/cluster-api-aws/cluster-api-aws-controller:v2.7.1

Thanks to all our contributors.

v2.7.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 11 additional dependencies were updated

Details:

Package	Change
k8s.io/api	v0.31.2 -> v0.31.3
k8s.io/apimachinery	v0.31.2 -> v0.31.3
k8s.io/client-go	v0.31.2 -> v0.31.3
k8s.io/kubectl	v0.31.2 -> v0.31.3
sigs.k8s.io/cluster-api	v1.8.3 -> v1.9.4
sigs.k8s.io/controller-runtime	v0.19.3 -> v0.19.4
github.com/gobuffalo/flect	v1.0.2 -> v1.0.3
github.com/google/gnostic-models	v0.6.8 -> v0.6.9-0.20230804172637-c7be7c783f49
k8s.io/apiextensions-apiserver	v0.31.0 -> v0.31.3
k8s.io/cluster-bootstrap	v0.30.3 -> v0.31.3
k8s.io/component-base	v0.31.2 -> v0.31.3