Merge https://github.com/kubernetes-sigs/cluster-api-provider-ibmcloud:v0.14.0 (5d081d1) into main

[cloud-team-rebase-bot]

Summary by CodeRabbit

• New Features

  • Added v1beta3/v1beta2 PowerVS and v1beta2 VPC APIs with richer machine/cluster/image/load‑balancer schemas and expanded status/condition fields.

• Tests

  • Added fuzz-based conversion round‑trip tests to validate API migrations.

• Build & Configuration

  • Tooling updates (Go 1.25), Make/Docker build adjustments, and updated weekly security-scan workflow.

• Documentation

  • Expanded provider-specific machine-image onboarding checklist; compatibility matrix updated.

• Deprecations

  • v1beta1 APIs removed or marked deprecated in favor of newer versions.

[coderabbitai]

Actionable comments posted: 7

♻️ Duplicate comments (15)

api/vpc/v1beta1/types.go (1)

49-52: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Past review fix not applied: Subnet pointer fields still lack omitempty.

The previous review flagged these four pointer fields as missing omitempty tags, and the comment was marked as addressed. However, the current code still has the same issue. Without omitempty, nil pointers will serialize as JSON null instead of being omitted, causing inconsistency with the v1beta2 API surface.

🔧 Apply the previously suggested fix

-	Ipv4CidrBlock *string `json:"cidr"`
-	Name          *string `json:"name"`
-	ID            *string `json:"id"`
-	Zone          *string `json:"zone"`
+	Ipv4CidrBlock *string `json:"cidr,omitempty"`
+	Name          *string `json:"name,omitempty"`
+	ID            *string `json:"id,omitempty"`
+	Zone          *string `json:"zone,omitempty"`

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/vpc/v1beta1/types.go` around lines 49 - 52, The JSON tags for the pointer
fields Ipv4CidrBlock, Name, ID, and Zone should include `omitempty` so nil
pointers are omitted instead of serialized as null; update the struct field tags
for these symbols in api/vpc/v1beta1/types.go to `json:"cidr,omitempty"`,
`json:"name,omitempty"`, `json:"id,omitempty"`, and `json:"zone,omitempty"`
respectively to match the v1beta2 API behavior.

api/vpc/v1beta2/types.go (1)

432-432: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Past review issue persists: Invalid kubebuilder validation marker syntax.

Lines 432 and 436 still use MaxLength:= instead of the correct MaxLength= syntax. The colon makes these invalid kubebuilder markers, which will cause CRD validation to be ignored or generated incorrectly.

🔧 Apply the previously suggested fix

-	// +kubebuilder:validation:MaxLength:=63
+	// +kubebuilder:validation:MaxLength=63
 	// +kubebuilder:validation:Pattern=`^([a-z]|[a-z][-a-z0-9]*[a-z0-9])$`
 	Name *string `json:"name,omitempty"`
 	// +kubebuilder:validation:MinLength=1
-	// +kubebuilder:validation:MaxLength:=64
+	// +kubebuilder:validation:MaxLength=64

Also applies to: 436-436

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/vpc/v1beta2/types.go` at line 432, The kubebuilder validation markers use
an invalid syntax (`MaxLength:=`) which breaks CRD generation; locate the
markers that read `+kubebuilder:validation:MaxLength:=63` (and the similar
`MaxLength:=` instance) in types.go and change them to the correct syntax
`+kubebuilder:validation:MaxLength=63` so the validator recognizes the MaxLength
constraint on the associated field(s) (search for
`+kubebuilder:validation:MaxLength` to find both occurrences).

.github/workflows/weekly-security-scan.yaml (1)

20-23: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Disable persisted checkout credentials in the workflow.

actions/checkout keeps credentials by default. For a security-scan workflow, set persist-credentials: false to reduce token exposure risk.

Proposed fix

     - name: Check out code
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
       with:
         ref: ${{ matrix.branch }}
+        persist-credentials: false

As per coding guidelines, "Least privilege: minimize GITHUB_TOKEN permissions" and "No secrets in logs; mask sensitive outputs" apply to CI/CD workflows.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/weekly-security-scan.yaml around lines 20 - 23, The
workflow uses actions/checkout@de0fac2e... which by default persists
credentials; update the checkout step (the actions/checkout usage) to add
persist-credentials: false in the step inputs so the action does not retain
GITHUB_TOKEN credentials during the security-scan run; ensure this change is
applied to the checkout step that uses ref: ${{ matrix.branch }}.

Source: Coding guidelines

api/powervs/v1beta3/ibmpowervscluster_types.go (2)

411-415: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Guard against nil dereference in ResourceReference.Set.

Line 413 dereferences rf.ControllerCreated without checking for nil, which can panic when the receiver is zero-valued.

Proposed fix

 func (rf *ResourceReference) Set(resource ResourceReference) {
 	rf.ID = resource.ID
-	if !*rf.ControllerCreated {
+	if rf.ControllerCreated == nil || !*rf.ControllerCreated {
 		rf.ControllerCreated = resource.ControllerCreated
 	}
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta3/ibmpowervscluster_types.go` around lines 411 - 415, The
method ResourceReference.Set may panic by dereferencing rf.ControllerCreated
without nil-check; update it to first check whether rf.ControllerCreated is nil
before evaluating *rf.ControllerCreated, and then copy
resource.ControllerCreated appropriately (e.g., if rf.ControllerCreated == nil
set it to resource.ControllerCreated, else if !*rf.ControllerCreated set it to
resource.ControllerCreated) so both nil and non-nil receiver cases are handled
safely.

---

278-278: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Fix malformed kubebuilder validation markers (use = instead of :=).

The markers MaxLength:=64, MinLength:=3, etc. are not standard kubebuilder syntax. Correct syntax uses a single equals sign: MaxLength=64, MinLength=3. This affects CRD schema validation generation.

Instances to fix:

• Line 278: MaxLength:= → MaxLength=
• Line 285: MaxLength:= → MaxLength=
• Line 300: MaxLength:= → MaxLength=
• Lines 318–319: MinLength:=3 and MaxLength:=63 → use =

Also applies to: 285-286, 300-301, 318-320

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta3/ibmpowervscluster_types.go` at line 278, Replace
malformed kubebuilder validation markers that use ':=' with the correct '='
notation: update occurrences of annotations like
`+kubebuilder:validation:MaxLength:=64`, `MinLength:=3` and `MaxLength:=63` to
use `+kubebuilder:validation:MaxLength=64`,
`+kubebuilder:validation:MinLength=3`, `+kubebuilder:validation:MaxLength=63`
respectively; locate the annotations adjacent to the affected CRD fields in
ibmpowervscluster_types.go (the kubebuilder validation comments above the struct
fields) and change all `:=` to `=` so CRD schema generation uses valid markers.

api/powervs/v1beta3/ibmpowervsmachine_types.go (3)

78-78: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Fix kubebuilder enum marker syntax.

Lines 78 and 90 use +kubebuilder:validation:Enum:=... with invalid := syntax; change to +kubebuilder:validation:Enum=.... The colon should not be included before the equals sign, otherwise enum validation will not be generated correctly in the CRD.

Also applies to: 90-90

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta3/ibmpowervsmachine_types.go` at line 78, The kubebuilder
validation marker uses an invalid ":=" sequence; locate the enum markers that
currently read
'+kubebuilder:validation:Enum:="s922";"e980";"s1022";"e1050";"e1080";""' (and
the similar marker at the other occurrence) and change them to use '=' rather
than ':=' so they read
'+kubebuilder:validation:Enum="s922";"e980";"s1022";"e1050";"e1080";""'; update
both occurrences so CRD enum validation is generated correctly.

---

224-224: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Remove the trailing tab from the printcolumn JSONPath.

Line 224 includes ".status.initialization.provisioned\t"; the extra tab can make the print column JSONPath invalid.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta3/ibmpowervsmachine_types.go` at line 224, Remove the stray
tab character in the kubebuilder printcolumn annotation by editing the
+kubebuilder:printcolumn line that currently has
JSONPath=".status.initialization.provisioned\t" so it reads
JSONPath=".status.initialization.provisioned" (locate the annotation with
+kubebuilder:printcolumn and the JSONPath ".status.initialization.provisioned"
to update).

---

65-70: ⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Enforce mutual exclusivity between image and imageRef.

The comments define imageRef as an alternative to image, but the schema currently allows both. Add CRD validation to reject specs setting both fields.

Proposed fix

 type IBMPowerVSMachineSpec struct {
+	// +kubebuilder:validation:XValidation:rule="!(has(self.image) && has(self.imageRef.name))",message="only one of image or imageRef may be specified"
+
 	// serviceInstance is the reference to the Power VS workspace on which the server instance(VM) will be created.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta3/ibmpowervsmachine_types.go` around lines 65 - 70, The CRD
currently allows both Image (*IBMPowerVSResourceReference) and ImageRef
(ImageReference) to be set even though they are alternatives; add server-side
validation by implementing webhook validation on the IBMPowerVSMachine type: add
ValidateCreate and ValidateUpdate methods that inspect r.Spec.Image and
r.Spec.ImageRef and return a validation error (using
k8s.io/apimachinery/pkg/util/validation/field or apierrors.NewInvalid) when both
are non-empty; ensure the error references the mutually exclusive fields (e.g.,
"spec.image" and "spec.imageRef") so the API rejects objects that set both.

api/powervs/v1beta3/conditions_consts.go (1)

226-227: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Rename the exported constant to match the value semantics.

VPCSecurityGroupNotReadyCondition maps to clusterv1.NotReadyReason, so the exported name is misleading. Please rename it to VPCSecurityGroupNotReadyReason before this API surface is consumed.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta3/conditions_consts.go` around lines 226 - 227, The
exported constant VPCSecurityGroupNotReadyCondition is misleading because it
maps to clusterv1.NotReadyReason (a Reason type), not a Condition type. Rename
the constant from VPCSecurityGroupNotReadyCondition to
VPCSecurityGroupNotReadyReason to accurately reflect its semantic meaning as a
reason value. Update the constant name in the file and ensure all usages of this
constant throughout the codebase are updated to use the new name.

api/powervs/v1beta2/ibmpowervscluster_types.go (2)

366-371: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Fix potential nil-pointer panic in ResourceReference.Set.

Line 368 dereferences rf.ControllerCreated without a nil guard. Since this field is optional (*bool), this will panic when the receiver's ControllerCreated is nil.

Proposed fix

 func (rf *ResourceReference) Set(resource ResourceReference) {
 	rf.ID = resource.ID
-	if !*rf.ControllerCreated {
+	if rf.ControllerCreated == nil || !*rf.ControllerCreated {
 		rf.ControllerCreated = resource.ControllerCreated
 	}
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta2/ibmpowervscluster_types.go` around lines 366 - 371, The
method ResourceReference.Set dereferences rf.ControllerCreated without a nil
check which can panic; modify Set (ResourceReference.Set) to first check if
rf.ControllerCreated is nil before dereferencing and assign
resource.ControllerCreated if rf.ControllerCreated is nil or false as
intended—i.e., guard uses of rf.ControllerCreated with an explicit nil check and
handle the three cases (nil, pointer to false, pointer to true) so you only
dereference when non-nil and copy resource.ControllerCreated when receiver lacks
a value.

---

284-313: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Fix kubebuilder MaxLength marker syntax (:= → =).

Lines 285, 305, and 312 use invalid MaxLength:= syntax that controller-gen will silently ignore.

Proposed fix

-	// +kubebuilder:validation:MaxLength:=63
+	// +kubebuilder:validation:MaxLength=63
@@
-	// +kubebuilder:validation:MaxLength:=64
+	// +kubebuilder:validation:MaxLength=64
@@
-	// +kubebuilder:validation:MaxLength:=63
+	// +kubebuilder:validation:MaxLength=63

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta2/ibmpowervscluster_types.go` around lines 284 - 313, The
kubebuilder markers use invalid syntax `MaxLength:=` which controller-gen
ignores; update the annotations to use `MaxLength=` instead for the affected
fields: change the MaxLength marker on the top-level Name field (the field
defined as Name *string `json:"name,omitempty"`), on VPCResourceReference.ID
(the field ID *string `json:"id,omitempty"` inside type VPCResourceReference),
and on VPCResourceReference.Name (the name field in VPCResourceReference) so
each `+kubebuilder:validation:MaxLength:=64`/`:=63` becomes
`+kubebuilder:validation:MaxLength=64`/`=63`.

api/powervs/v1beta3/vpc.go (1)

112-113: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Fix malformed XValidation marker (missing + prefix and typo in field reference).

Line 112 references self.dely instead of self.delay and is missing the required + marker prefix, preventing the delay > timeout constraint from being validated during admission control.

Proposed fix

-// kubebuilder:validation:XValidation:rule="self.dely > self.timeout",message="health monitor's delay must be greater than the timeout"
+// +kubebuilder:validation:XValidation:rule="self.delay > self.timeout",message="health monitor's delay must be greater than the timeout"
 type VPCLoadBalancerHealthMonitorSpec struct {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta3/vpc.go` around lines 112 - 113, The kubebuilder
XValidation marker on VPCLoadBalancerHealthMonitorSpec is malformed and
references the wrong field; update the marker to include the required '+' prefix
and fix the typo so the rule reads self.delay > self.timeout (e.g.,
"+kubebuilder:validation:XValidation:rule=\"self.delay >
self.timeout\",message=\"health monitor's delay must be greater than the
timeout\"") so admission validation will apply correctly to the struct.

api/powervs/v1beta3/types.go (2)

482-488: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Fix kubebuilder MaxLength marker syntax (:= → =).

Lines 482 and 487 use invalid MaxLength:= syntax that controller-gen will silently ignore, preventing the length validation from being applied.

Proposed fix

-	// +kubebuilder:validation:MaxLength:=63
+	// +kubebuilder:validation:MaxLength=63
@@
-	// +kubebuilder:validation:MaxLength:=64
+	// +kubebuilder:validation:MaxLength=64

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta3/types.go` around lines 482 - 488, The kubebuilder
validation markers for MaxLength on the Name field and the subnet id use
incorrect `MaxLength:=` syntax so controller-gen ignores them; update the marker
annotations to use `MaxLength=63` (for the Name field) and `MaxLength=64` (for
the subnet id) respectively so the validation is applied (locate the `Name
*string json:"name,omitempty"` field and the following `id is the ID of the
subnet.` block and replace `MaxLength:=` with `MaxLength=`).

---

547-566: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Add XValidation to enforce mutual exclusivity for IBMPowerVSResourceReference.

The struct comment (lines 547-549) documents that only one of ID, Name, or RegEx may be set, but no validation enforces this contract. This allows invalid configurations at admission time.

Proposed fix

 // IBMPowerVSResourceReference is a reference to a specific PowerVS resource by ID, Name or RegEx
 // Only one of ID, Name or RegEx may be specified. Specifying more than one will result in
 // a validation error.
+// +kubebuilder:validation:XValidation:rule="(has(self.id)?1:0) + (has(self.name)?1:0) + (has(self.regex)?1:0) <= 1",message="only one of id, name, or regex may be specified"
 type IBMPowerVSResourceReference struct {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta3/types.go` around lines 547 - 566, The
IBMPowerVSResourceReference struct documents that only one of ID, Name, or RegEx
may be set but lacks validation; add a kubebuilder XValidation marker on the
IBMPowerVSResourceReference type to enforce mutual exclusivity (only one of .ID,
.Name, .RegEx is non-empty) so admission rejects objects with multiple fields
set; update the struct comment and add the appropriate
+kubebuilder:validation:XValidation rule referencing the fields (ID, Name,
RegEx) to return a clear error when more than one is provided.

api/powervs/v1beta2/ibmpowervsimage_types.go (1)

40-44: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Make deprecated ServiceInstanceID field optional.

Line 43 defines the deprecated ServiceInstanceID as a required field (string without omitempty). This prevents users from omitting it when using the new serviceInstance field, creating a schema conflict.

Proposed fix

 	// Deprecated: use ServiceInstance instead
 	//
 	// ServiceInstanceID is the id of the power cloud instance where the image will get imported.
-	ServiceInstanceID string `json:"serviceInstanceID"`
+	// +optional
+	ServiceInstanceID *string `json:"serviceInstanceID,omitempty"`

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta2/ibmpowervsimage_types.go` around lines 40 - 44, The
deprecated ServiceInstanceID field is currently required (string) which forces
clients to provide it; change the ServiceInstanceID declaration to be optional
by making it a pointer and adding omitempty in the json tag (e.g.,
ServiceInstanceID *string `json:"serviceInstanceID,omitempty"`), and update any
validation/usage in code that reads ServiceInstanceID to handle nil (compare to
the new serviceInstance field) so callers can omit the deprecated field without
schema conflicts.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@api/powervs/v1beta3/vpc.go`:
- Line 46: The kubebuilder marker comment has an extra '+' prefix
("++kubebuilder:validation:UniqueItems=true") so the marker is ignored; edit the
marker in vpc.go to remove the extra plus so it reads
"+kubebuilder:validation:UniqueItems=true" (look for the comment immediately
above the relevant field/struct declaration) to restore proper kubebuilder
validation parsing.
- Around line 24-35: Update the kubebuilder validation markers on the Name and
ID fields in vpc.go: replace the invalid "MaxLength:=" occurrences with
"MaxLength=" so the markers on the Name field and the ID *string field are
syntactically correct (adjust the +kubebuilder:validation:MaxLength:=63 to
+kubebuilder:validation:MaxLength=63 and +kubebuilder:validation:MaxLength:=64
to +kubebuilder:validation:MaxLength=64).

In `@api/vpc/v1beta1/types.go`:
- Line 57: The Address pointer field in the struct is missing the `omitempty`
JSON tag, causing it to serialize as null when unset unlike the deprecated
`FIPID` and `LBID` fields; update the struct tag for `Address` to include
`omitempty` (matching `FIPID` and `LBID`) so all three pointer fields are
omitted when nil, ensuring consistent JSON serialization.

In `@api/vpc/v1beta2/types.go`:
- Line 144: Update the comment typos in the VPC types declarations: change the
ResourceTypeVPC comment from "Power VS network resource" to "VPC resource", fix
"Gatway" to "Gateway" in the relevant VPC gateway/comment, and correct "defiens"
to "defines" where the word appears; locate these by searching for the
symbols/comments around ResourceTypeVPC and any VPC Gateway-related type or
comment and update the three misspelled words accordingly.
- Line 62: Fix the typo "tudp" to "udp" in the comment(s) describing the
VPCLoadBalancerBackendPoolProtocolUDP constant; search for any remaining
occurrences of "tudp" in api/vpc/v1beta2/types.go (including the comment for
VPCLoadBalancerBackendPoolProtocolUDP and the similar comment at the other
occurrence) and update them to read "udp" so the comment correctly describes the
protocol.
- Line 48: Update the inline comments that currently read "diverage" to the
correct spelling "diverge" in the types.go comment blocks (the comment
containing "We have unique types in case IBM Cloud Load Balancer Listener and
Backend Pool supported algorithms ever diverage." and the similar occurrence
later); locate those comment strings and replace "diverage" with "diverge" so
both occurrences are fixed.
- Line 25: Fix the spelling typo in the comment for DefaultAPIServerPort: change
"defuault" to "default" in the comment that documents the DefaultAPIServerPort
constant to correct the grammar and maintain documentation quality.

---

Duplicate comments:
In @.github/workflows/weekly-security-scan.yaml:
- Around line 20-23: The workflow uses actions/checkout@de0fac2e... which by
default persists credentials; update the checkout step (the actions/checkout
usage) to add persist-credentials: false in the step inputs so the action does
not retain GITHUB_TOKEN credentials during the security-scan run; ensure this
change is applied to the checkout step that uses ref: ${{ matrix.branch }}.

In `@api/powervs/v1beta2/ibmpowervscluster_types.go`:
- Around line 366-371: The method ResourceReference.Set dereferences
rf.ControllerCreated without a nil check which can panic; modify Set
(ResourceReference.Set) to first check if rf.ControllerCreated is nil before
dereferencing and assign resource.ControllerCreated if rf.ControllerCreated is
nil or false as intended—i.e., guard uses of rf.ControllerCreated with an
explicit nil check and handle the three cases (nil, pointer to false, pointer to
true) so you only dereference when non-nil and copy resource.ControllerCreated
when receiver lacks a value.
- Around line 284-313: The kubebuilder markers use invalid syntax `MaxLength:=`
which controller-gen ignores; update the annotations to use `MaxLength=` instead
for the affected fields: change the MaxLength marker on the top-level Name field
(the field defined as Name *string `json:"name,omitempty"`), on
VPCResourceReference.ID (the field ID *string `json:"id,omitempty"` inside type
VPCResourceReference), and on VPCResourceReference.Name (the name field in
VPCResourceReference) so each `+kubebuilder:validation:MaxLength:=64`/`:=63`
becomes `+kubebuilder:validation:MaxLength=64`/`=63`.

In `@api/powervs/v1beta2/ibmpowervsimage_types.go`:
- Around line 40-44: The deprecated ServiceInstanceID field is currently
required (string) which forces clients to provide it; change the
ServiceInstanceID declaration to be optional by making it a pointer and adding
omitempty in the json tag (e.g., ServiceInstanceID *string
`json:"serviceInstanceID,omitempty"`), and update any validation/usage in code
that reads ServiceInstanceID to handle nil (compare to the new serviceInstance
field) so callers can omit the deprecated field without schema conflicts.

In `@api/powervs/v1beta3/conditions_consts.go`:
- Around line 226-227: The exported constant VPCSecurityGroupNotReadyCondition
is misleading because it maps to clusterv1.NotReadyReason (a Reason type), not a
Condition type. Rename the constant from VPCSecurityGroupNotReadyCondition to
VPCSecurityGroupNotReadyReason to accurately reflect its semantic meaning as a
reason value. Update the constant name in the file and ensure all usages of this
constant throughout the codebase are updated to use the new name.

In `@api/powervs/v1beta3/ibmpowervscluster_types.go`:
- Around line 411-415: The method ResourceReference.Set may panic by
dereferencing rf.ControllerCreated without nil-check; update it to first check
whether rf.ControllerCreated is nil before evaluating *rf.ControllerCreated, and
then copy resource.ControllerCreated appropriately (e.g., if
rf.ControllerCreated == nil set it to resource.ControllerCreated, else if
!*rf.ControllerCreated set it to resource.ControllerCreated) so both nil and
non-nil receiver cases are handled safely.
- Line 278: Replace malformed kubebuilder validation markers that use ':=' with
the correct '=' notation: update occurrences of annotations like
`+kubebuilder:validation:MaxLength:=64`, `MinLength:=3` and `MaxLength:=63` to
use `+kubebuilder:validation:MaxLength=64`,
`+kubebuilder:validation:MinLength=3`, `+kubebuilder:validation:MaxLength=63`
respectively; locate the annotations adjacent to the affected CRD fields in
ibmpowervscluster_types.go (the kubebuilder validation comments above the struct
fields) and change all `:=` to `=` so CRD schema generation uses valid markers.

In `@api/powervs/v1beta3/ibmpowervsmachine_types.go`:
- Line 78: The kubebuilder validation marker uses an invalid ":=" sequence;
locate the enum markers that currently read
'+kubebuilder:validation:Enum:="s922";"e980";"s1022";"e1050";"e1080";""' (and
the similar marker at the other occurrence) and change them to use '=' rather
than ':=' so they read
'+kubebuilder:validation:Enum="s922";"e980";"s1022";"e1050";"e1080";""'; update
both occurrences so CRD enum validation is generated correctly.
- Line 224: Remove the stray tab character in the kubebuilder printcolumn
annotation by editing the +kubebuilder:printcolumn line that currently has
JSONPath=".status.initialization.provisioned\t" so it reads
JSONPath=".status.initialization.provisioned" (locate the annotation with
+kubebuilder:printcolumn and the JSONPath ".status.initialization.provisioned"
to update).
- Around line 65-70: The CRD currently allows both Image
(*IBMPowerVSResourceReference) and ImageRef (ImageReference) to be set even
though they are alternatives; add server-side validation by implementing webhook
validation on the IBMPowerVSMachine type: add ValidateCreate and ValidateUpdate
methods that inspect r.Spec.Image and r.Spec.ImageRef and return a validation
error (using k8s.io/apimachinery/pkg/util/validation/field or
apierrors.NewInvalid) when both are non-empty; ensure the error references the
mutually exclusive fields (e.g., "spec.image" and "spec.imageRef") so the API
rejects objects that set both.

In `@api/powervs/v1beta3/types.go`:
- Around line 482-488: The kubebuilder validation markers for MaxLength on the
Name field and the subnet id use incorrect `MaxLength:=` syntax so
controller-gen ignores them; update the marker annotations to use `MaxLength=63`
(for the Name field) and `MaxLength=64` (for the subnet id) respectively so the
validation is applied (locate the `Name *string json:"name,omitempty"` field and
the following `id is the ID of the subnet.` block and replace `MaxLength:=` with
`MaxLength=`).
- Around line 547-566: The IBMPowerVSResourceReference struct documents that
only one of ID, Name, or RegEx may be set but lacks validation; add a
kubebuilder XValidation marker on the IBMPowerVSResourceReference type to
enforce mutual exclusivity (only one of .ID, .Name, .RegEx is non-empty) so
admission rejects objects with multiple fields set; update the struct comment
and add the appropriate +kubebuilder:validation:XValidation rule referencing the
fields (ID, Name, RegEx) to return a clear error when more than one is provided.

In `@api/powervs/v1beta3/vpc.go`:
- Around line 112-113: The kubebuilder XValidation marker on
VPCLoadBalancerHealthMonitorSpec is malformed and references the wrong field;
update the marker to include the required '+' prefix and fix the typo so the
rule reads self.delay > self.timeout (e.g.,
"+kubebuilder:validation:XValidation:rule=\"self.delay >
self.timeout\",message=\"health monitor's delay must be greater than the
timeout\"") so admission validation will apply correctly to the struct.

In `@api/vpc/v1beta1/types.go`:
- Around line 49-52: The JSON tags for the pointer fields Ipv4CidrBlock, Name,
ID, and Zone should include `omitempty` so nil pointers are omitted instead of
serialized as null; update the struct field tags for these symbols in
api/vpc/v1beta1/types.go to `json:"cidr,omitempty"`, `json:"name,omitempty"`,
`json:"id,omitempty"`, and `json:"zone,omitempty"` respectively to match the
v1beta2 API behavior.

In `@api/vpc/v1beta2/types.go`:
- Line 432: The kubebuilder validation markers use an invalid syntax
(`MaxLength:=`) which breaks CRD generation; locate the markers that read
`+kubebuilder:validation:MaxLength:=63` (and the similar `MaxLength:=` instance)
in types.go and change them to the correct syntax
`+kubebuilder:validation:MaxLength=63` so the validator recognizes the MaxLength
constraint on the associated field(s) (search for
`+kubebuilder:validation:MaxLength` to find both occurrences).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d0a9e5cf-73f2-4999-aa16-0846cc4ba2ae

📥 Commits

Reviewing files that changed from the base of the PR and between caf3e87 and b6e2509.

⛔ Files ignored due to path filters (155)

• api/powervs/v1beta2/zz_generated.conversion.go is excluded by !**/zz_generated*
• api/powervs/v1beta2/zz_generated.deepcopy.go is excluded by !**/zz_generated*
• api/powervs/v1beta3/zz_generated.deepcopy.go is excluded by !**/zz_generated*
• api/v1beta1/zz_generated.conversion.go is excluded by !**/zz_generated*
• api/v1beta1/zz_generated.deepcopy.go is excluded by !**/zz_generated*
• api/v1beta2/zz_generated.deepcopy.go is excluded by !**/zz_generated*
• api/vpc/v1beta1/zz_generated.conversion.go is excluded by !**/zz_generated*
• api/vpc/v1beta1/zz_generated.deepcopy.go is excluded by !**/zz_generated*
• api/vpc/v1beta2/zz_generated.deepcopy.go is excluded by !**/zz_generated*
• go.sum is excluded by !**/*.sum
• hack/tools/go.sum is excluded by !**/*.sum
• hack/tools/vendor/cel.dev/expr/.bazelversion is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/.gitattributes is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/.gitignore is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/BUILD.bazel is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/CODE_OF_CONDUCT.md is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/CONTRIBUTING.md is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/GOVERNANCE.md is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/MAINTAINERS.md is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/MODULE.bazel is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/README.md is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/WORKSPACE is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/WORKSPACE.bzlmod is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/checked.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• hack/tools/vendor/cel.dev/expr/cloudbuild.yaml is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/eval.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• hack/tools/vendor/cel.dev/expr/explain.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• hack/tools/vendor/cel.dev/expr/regen_go_proto.sh is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/regen_go_proto_canonical_protos.sh is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/syntax.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• hack/tools/vendor/cel.dev/expr/value.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/.editorconfig is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/.gitattributes is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/.gitignore is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/.golangci.yml is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/.goreleaser.yml is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/LICENSE is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/README.md is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/Taskfile.yaml is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/UPGRADE_GUIDE_V2.md is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/align.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/ansi_unix.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/ansi_windows.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/blending.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/borders.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/canvas.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/color.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/get.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/join.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/layer.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/lipgloss.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/position.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/query.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/ranges.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/runes.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/set.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/size.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/style.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/terminal.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/unset.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/whitespace.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/wrap.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/writer.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/CHANGES.md is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/LICENSE is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/README.md is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/auth.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/compute.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/detect.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/doc.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/filetypes.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/idtoken/cache.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/idtoken/compute.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/idtoken/file.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/idtoken/idtoken.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/idtoken/validate.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/impersonate/doc.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/impersonate/idtoken.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/impersonate/impersonate.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/impersonate/user.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/aws_provider.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/executable_provider.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/externalaccount.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/file_provider.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/info.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/programmatic_provider.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/url_provider.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/x509_provider.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/externalaccountuser/externalaccountuser.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/gdch/gdch.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/impersonate/idtoken.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/impersonate/impersonate.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/stsexchange/sts_exchange.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/selfsignedjwt.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/grpctransport/dial_socketopt.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/grpctransport/directpath.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/grpctransport/grpctransport.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/grpctransport/pool.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/httptransport/httptransport.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/httptransport/transport.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/compute/compute.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/compute/manufacturer.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/compute/manufacturer_linux.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/compute/manufacturer_windows.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/credsfile/credsfile.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/credsfile/filetype.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/credsfile/parse.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/internal.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/jwt/jwt.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/retry/retry.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/transport/cba.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/transport/cert/default_cert.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/transport/cert/enterprise_cert.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/transport/cert/secureconnect_cert.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/transport/cert/workload_cert.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/transport/headers/headers.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/transport/s2a.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/transport/transport.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/trustboundary/external_accounts_config_providers.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/trustboundary/trust_boundary.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/version.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/oauth2adapt/CHANGES.md is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/oauth2adapt/LICENSE is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/oauth2adapt/oauth2adapt.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/threelegged.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/compute/metadata/CHANGES.md is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/compute/metadata/LICENSE is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/compute/metadata/README.md is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/compute/metadata/log.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/compute/metadata/metadata.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/compute/metadata/retry.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/compute/metadata/retry_linux.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/compute/metadata/syscheck.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/compute/metadata/syscheck_linux.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/compute/metadata/syscheck_windows.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/iam/CHANGES.md is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/iam/LICENSE is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/iam/README.md is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/iam/apiv1/iampb/iam_policy.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/iam/apiv1/iampb/options.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/iam/apiv1/iampb/policy.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/iam/apiv1/iampb/resource_policy_member.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/iam/iam.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/internal/.repo-metadata-full.json is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/internal/README.md is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/internal/annotate.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/internal/gen_info.sh is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/internal/optional/optional.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/internal/retry.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/internal/trace/trace.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/internal/version/update_version.sh is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/internal/version/version.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/monitoring/LICENSE is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/monitoring/apiv3/v2/alert_policy_client.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/monitoring/apiv3/v2/auxiliary.go is excluded by !**/vendor/**

📒 Files selected for processing (145)

• .ci-operator.yaml
• .github/ISSUE_TEMPLATE/add_new_machine_image.md
• .github/workflows/weekly-security-scan.yaml
• .golangci-kal.yml
• .golangci.yml
• Dockerfile
• Makefile
• PROJECT
• README.md
• api/powervs/v1beta2/conditions_consts.go
• api/powervs/v1beta2/conversion.go
• api/powervs/v1beta2/conversion_test.go
• api/powervs/v1beta2/doc.go
• api/powervs/v1beta2/groupversion_info.go
• api/powervs/v1beta2/ibmpowervscluster_types.go
• api/powervs/v1beta2/ibmpowervsclustertemplate_types.go
• api/powervs/v1beta2/ibmpowervsimage_types.go
• api/powervs/v1beta2/ibmpowervsmachine_types.go
• api/powervs/v1beta2/ibmpowervsmachinetemplate_types.go
• api/powervs/v1beta2/types.go
• api/powervs/v1beta2/vpc.go
• api/powervs/v1beta3/conditions_consts.go
• api/powervs/v1beta3/conversion.go
• api/powervs/v1beta3/doc.go
• api/powervs/v1beta3/groupversion_info.go
• api/powervs/v1beta3/ibmpowervscluster_types.go
• api/powervs/v1beta3/ibmpowervsclustertemplate_types.go
• api/powervs/v1beta3/ibmpowervsimage_types.go
• api/powervs/v1beta3/ibmpowervsmachine_types.go
• api/powervs/v1beta3/ibmpowervsmachinetemplate_types.go
• api/powervs/v1beta3/types.go
• api/powervs/v1beta3/v1beta2_condition_consts.go
• api/powervs/v1beta3/vpc.go
• api/v1beta1/doc.go
• api/v1beta1/ibmpowervs_conversion.go
• api/v1beta1/ibmpowervscluster_types.go
• api/v1beta1/ibmpowervsclustertemplate_types.go
• api/v1beta1/ibmpowervsimage_types.go
• api/v1beta1/ibmpowervsmachine_types.go
• api/v1beta1/ibmpowervsmachinetemplate_types.go
• api/v1beta1/types.go
• api/v1beta2/conversion.go
• api/v1beta2/doc.go
• api/v1beta2/ibmpowervscluster_types.go
• api/v1beta2/ibmpowervsclustertemplate_types.go
• api/v1beta2/ibmpowervsimage_types.go
• api/v1beta2/ibmpowervsmachine_types.go
• api/v1beta2/ibmpowervsmachinetemplate_types.go
• api/v1beta2/types.go
• api/vpc/v1beta1/conditions_consts.go
• api/vpc/v1beta1/doc.go
• api/vpc/v1beta1/groupversion_info.go
• api/vpc/v1beta1/ibmvpc_conversion.go
• api/vpc/v1beta1/ibmvpccluster_types.go
• api/vpc/v1beta1/ibmvpcmachine_types.go
• api/vpc/v1beta1/ibmvpcmachinetemplate_types.go
• api/vpc/v1beta1/types.go
• api/vpc/v1beta2/conditions_consts.go
• api/vpc/v1beta2/conversion.go
• api/vpc/v1beta2/doc.go
• api/vpc/v1beta2/groupversion_info.go
• api/vpc/v1beta2/ibmvpccluster_types.go
• api/vpc/v1beta2/ibmvpcclustertemplate_types.go
• api/vpc/v1beta2/ibmvpcmachine_types.go
• api/vpc/v1beta2/ibmvpcmachinetemplate_types.go
• api/vpc/v1beta2/types.go
• cloud/scope/common_test.go
• cloud/scope/doc.go
• cloud/scope/powervs/doc.go
• cloud/scope/powervs/helper_test.go
• cloud/scope/powervs/powervs_cluster.go
• cloud/scope/powervs/powervs_cluster_test.go
• cloud/scope/powervs/powervs_image.go
• cloud/scope/powervs/powervs_image_test.go
• cloud/scope/powervs/powervs_machine.go
• cloud/scope/powervs/powervs_machine_test.go
• cloud/scope/powervs/suite_test.go
• cloud/scope/powervs/types.go
• cloud/scope/powervs/util.go
• cloud/scope/powervs/util_test.go
• cloud/scope/suite_test.go
• cloud/scope/types.go
• cloud/scope/util.go
• cloud/scope/vpc/cluster.go
• cloud/scope/vpc/cluster_test.go
• cloud/scope/vpc/cluster_v2.go
• cloud/scope/vpc/doc.go
• cloud/scope/vpc/helper_test.go
• cloud/scope/vpc/machine.go
• cloud/scope/vpc/machine_test.go
• cloud/scope/vpc/suite_test.go
• cloud/scope/vpc/util.go
• cloud/scope/vpc_cluster.go
• cloudbuild.yaml
• cmd/capibmadm/cmd/powervs/image/type.go
• cmd/capibmadm/cmd/powervs/key/type.go
• cmd/capibmadm/cmd/powervs/network/type.go
• cmd/capibmadm/cmd/powervs/port/type.go
• cmd/capibmadm/cmd/vpc/image/type.go
• cmd/capibmadm/cmd/vpc/key/type.go
• cmd/main.go
• config/crd/bases/infrastructure.cluster.x-k8s.io_ibmpowervsclusters.yaml
• config/crd/bases/infrastructure.cluster.x-k8s.io_ibmpowervsclustertemplates.yaml
• config/crd/bases/infrastructure.cluster.x-k8s.io_ibmpowervsimages.yaml
• config/crd/bases/infrastructure.cluster.x-k8s.io_ibmpowervsmachines.yaml
• config/crd/bases/infrastructure.cluster.x-k8s.io_ibmpowervsmachinetemplates.yaml
• config/crd/bases/infrastructure.cluster.x-k8s.io_ibmvpcclusters.yaml
• config/crd/bases/infrastructure.cluster.x-k8s.io_ibmvpcclustertemplates.yaml
• config/crd/bases/infrastructure.cluster.x-k8s.io_ibmvpcmachines.yaml
• config/crd/bases/infrastructure.cluster.x-k8s.io_ibmvpcmachinetemplates.yaml
• config/crd/kustomization.yaml
• config/rbac/ibmpowervscluster_admin_role.yaml
• config/rbac/ibmpowervsclustertemplate_admin_role.yaml
• config/rbac/ibmpowervsimage_admin_role.yaml
• config/rbac/ibmpowervsmachine_admin_role.yaml
• config/rbac/ibmpowervsmachinetemplate_admin_role.yaml
• config/rbac/kustomization.yaml
• config/rbac/role.yaml
• config/webhook/manifests.yaml
• controllers/alias.go
• controllers/doc.go
• controllers/ibmpowervscluster_controller.go
• controllers/ibmpowervsimage_controller.go
• controllers/ibmpowervsmachine_controller.go
• controllers/suite_test.go
• docs/book/src/SUMMARY.md
• docs/book/src/developer/conversion.md
• docs/book/src/developer/netlify-site.md
• docs/book/src/developer/release-support-guidelines.md
• docs/book/src/developer/release.md
• docs/book/src/developer/tilt.md
• docs/book/src/machine-images/powervs.md
• docs/book/src/machine-images/vpc.md
• docs/book/src/reference/regions-zones-mapping.md
• docs/book/src/topics/powervs/creating-a-cluster.md
• docs/book/src/topics/vpc/creating-a-cluster.md
• docs/proposal/20260421-powervs-v1beta3-api-modernization.md
• go.mod
• hack/ccm/Makefile
• hack/ccm/cloudbuild.yaml
• hack/ensure-go.sh
• hack/tools/.custom-gcl.yaml
• hack/tools/Makefile
• hack/tools/go.mod
• hack/tools/tools.go

💤 Files with no reviewable changes (16)

• api/v1beta1/types.go
• api/v1beta2/doc.go
• api/v1beta2/ibmpowervsmachinetemplate_types.go
• api/v1beta1/doc.go
• api/v1beta2/conversion.go
• api/v1beta1/ibmpowervscluster_types.go
• api/v1beta1/ibmpowervsclustertemplate_types.go
• api/v1beta2/ibmpowervsmachine_types.go
• api/v1beta2/ibmpowervsclustertemplate_types.go
• api/v1beta1/ibmpowervsimage_types.go
• api/v1beta2/ibmpowervscluster_types.go
• api/v1beta1/ibmpowervsmachine_types.go
• api/v1beta1/ibmpowervs_conversion.go
• api/v1beta2/types.go
• api/v1beta1/ibmpowervsmachinetemplate_types.go
• api/v1beta2/ibmpowervsimage_types.go

✅ Files skipped from review due to trivial changes (6)

• .ci-operator.yaml
• api/powervs/v1beta3/doc.go
• api/vpc/v1beta1/ibmvpc_conversion.go
• .golangci-kal.yml
• api/vpc/v1beta1/doc.go
• api/powervs/v1beta2/doc.go

🚧 Files skipped from review as they are similar to previous changes (8)

• README.md
• api/vpc/v1beta2/doc.go
• .golangci.yml
• Dockerfile
• .github/ISSUE_TEMPLATE/add_new_machine_image.md
• api/powervs/v1beta3/conversion.go
• PROJECT
• api/vpc/v1beta2/conversion.go

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Fix kubebuilder MaxLength marker syntax (:= → =).

Lines 24 and 32 use invalid MaxLength:= syntax that controller-gen will ignore.

Proposed fix

-	// +kubebuilder:validation:MaxLength:=63
+	// +kubebuilder:validation:MaxLength=63
@@
-	// +kubebuilder:validation:MaxLength:=64
+	// +kubebuilder:validation:MaxLength=64

🧰 Tools

🪛 golangci-lint (2.12.2)

[error] 32-32: : # sigs.k8s.io/cluster-api-provider-ibmcloud/api/powervs/v1beta3
api/powervs/v1beta3/ibmpowervscluster_types.go:32:36: cannot use &IBMPowerVSCluster{} (value of type *IBMPowerVSCluster) as "k8s.io/apimachinery/pkg/runtime".Object value in argument to append: *IBMPowerVSCluster does not implement "k8s.io/apimachinery/pkg/runtime".Object (missing method DeepCopyObject)
api/powervs/v1beta3/ibmpowervscluster_types.go:32:58: cannot use &IBMPowerVSClusterList{} (value of type *IBMPowerVSClusterList) as "k8s.io/apimachinery/pkg/runtime".Object value in argument to append: *IBMPowerVSClusterList does not implement "k8s.io/apimachinery/pkg/runtime".Object (missing method DeepCopyObject)
api/powervs/v1beta3/ibmpowervsclustertemplate_types.go:26:36: cannot use &IBMPowerVSClusterTemplate{} (value of type *IBMPowerVSClusterTemplate) as "k8s.io/apimachinery/pkg/runtime".Object value in argument to append: *IBMPowerVSClusterTemplate does not implement "k8s.io/apimachinery/pkg/runtime".Object (missing method DeepCopyObject)
api/powervs/v1beta3/ibmpowervsclustertemplate_types.go:26:66: cannot use &IBMPowerVSClusterTemplateList{} (value of type *IBMPowerVSClusterTemplateList) as "k8s.io/apimachinery/pkg/runtime".Object value in argument to append: *IBMPowerVSClusterTemplateList does not implement "k8s.io/apimachinery/pkg/runtime".Object (missing method DeepCopyObject)
api/powervs/v1beta3/ibmpowervsimage_types.go:32:36: cannot use &IBMPowerVSImage{} (value of type *IBMPowerVSImage) as "k8s.io/apimachinery/pkg/runtime".Object value in argument to append: *IBMPowerVSImage does not implement "k8s.io/apimachinery/pkg/runtime".Object (missing method DeepCopyObject)
api/powervs/v1beta3/ibmpowervsimage_types.go:32:56: cannot use &IBMPowerVSImageList{} (value of type *IBMPowerVSImageList) as "k8s.io/apimachinery/pkg/runtime".Object value in argument to append: *IBMPowerVSImageList does not implement "k8s.io/apimachinery/pkg/runtime".Object (missing method DeepCopyObject)
api/powervs/v1beta3/ibmpowervsmachine_types.go:44:36: cannot use &IBMPowerVSMachine{} (value of type *IBMPowerVSMachine) as "k8s.io/apimachinery/pkg/runtime".Object value in argument to append: *IBMPowerVSMachine does not implement "k8s.io/apimachinery/pkg/runtime".Object (missing method DeepCopyObject)
api/powervs/v1beta3/ibmpowervsmachine_types.go:44:58: cannot use &IBMPowerVSMachineList{} (value of type *IBMPowerVSMachineList) as "k8s.io/apimachinery/pkg/runtime".Object value in argument to append: *IBMPowerVSMachineList does not implement "k8s.io/apimachinery/pkg/runtime".Object (missing method DeepCopyObject)
api/powervs/v1beta3/ibmpowervsmachinetemplate_types.go:27:36: cannot use &IBMPowerVSMachineTemplate{} (value of type *IBMPowerVSMachineTemplate) as "k8s.io/apimachinery/pkg/runtime".Object value in argument to append: *IBMPowerVSMachineTemplate does not implement "k8s.io/apimachinery/pkg/runtime".Object (missing method DeepCopyObject)
api/powervs/v1beta3/ibmpowervsmachinetemplate_types.go:27:66: cannot use &IBMPowerVSMachineTemplateList{} (value of type *IBMPowerVSMachineTemplateList) as "k8s.io/apimachinery/pkg/runtime".Object value in argument to append: *IBMPowerVSMachineTemplateList does not implement "k8s.io/apimachinery/pkg/runtime".Object (missing method DeepCopyObject)
api/powervs/v1beta3/ibmpowervsmachinetemplate_types.go:27:66: too many errors

(typecheck)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta3/vpc.go` around lines 24 - 35, Update the kubebuilder
validation markers on the Name and ID fields in vpc.go: replace the invalid
"MaxLength:=" occurrences with "MaxLength=" so the markers on the Name field and
the ID *string field are syntactically correct (adjust the
+kubebuilder:validation:MaxLength:=63 to +kubebuilder:validation:MaxLength=63
and +kubebuilder:validation:MaxLength:=64 to
+kubebuilder:validation:MaxLength=64).

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Fix double-plus kubebuilder marker prefix.

Line 46 has ++kubebuilder instead of +kubebuilder, which will cause the marker to be ignored.

Proposed fix

-	// ++kubebuilder:validation:UniqueItems=true
+	// +kubebuilder:validation:UniqueItems=true

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	// ++kubebuilder:validation:UniqueItems=true
	// +kubebuilder:validation:UniqueItems=true

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta3/vpc.go` at line 46, The kubebuilder marker comment has an
extra '+' prefix ("++kubebuilder:validation:UniqueItems=true") so the marker is
ignored; edit the marker in vpc.go to remove the extra plus so it reads
"+kubebuilder:validation:UniqueItems=true" (look for the comment immediately
above the relevant field/struct declaration) to restore proper kubebuilder
validation parsing.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add omitempty to Address field for consistency.

The Address field is a pointer but lacks the omitempty JSON tag, while the deprecated FIPID and LBID fields both include it. This inconsistency will cause Address to serialize as null when unset, whereas the deprecated fields will be omitted. Add omitempty to align all three pointer fields.

🔧 Suggested fix

-	Address *string `json:"address"`
+	Address *string `json:"address,omitempty"`

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	Address *string `json:"address"`
	Address *string `json:"address,omitempty"`

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/vpc/v1beta1/types.go` at line 57, The Address pointer field in the struct
is missing the `omitempty` JSON tag, causing it to serialize as null when unset
unlike the deprecated `FIPID` and `LBID` fields; update the struct tag for
`Address` to include `omitempty` (matching `FIPID` and `LBID`) so all three
pointer fields are omitted when nil, ensuring consistent JSON serialization.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix typo in comment.

"defuault" should be "default".

🔧 Suggested fix

-	// DefaultAPIServerPort is defuault API server port number.
+	// DefaultAPIServerPort is default API server port number.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	// DefaultAPIServerPort is defuault API server port number.
	// DefaultAPIServerPort is default API server port number.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/vpc/v1beta2/types.go` at line 25, Fix the spelling typo in the comment
for DefaultAPIServerPort: change "defuault" to "default" in the comment that
documents the DefaultAPIServerPort constant to correct the grammar and maintain
documentation quality.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix typo in comments.

"diverage" should be "diverge" (appears at lines 48 and 67).

🔧 Suggested fix

 // VPCLoadBalancerBackendPoolProtocol describes the protocol for load balancer backend pools.
-// We have unique types in case IBM Cloud Load Balancer Listener and Backend Pool supported algorithms ever diverage.
+// We have unique types in case IBM Cloud Load Balancer Listener and Backend Pool supported algorithms ever diverge.
 // +kubebuilder:validation:Enum=http;https;tcp;udp
 type VPCLoadBalancerBackendPoolProtocol string

 // VPCLoadBalancerListenerProtocol describes the protocol for load balancer listeners.
-// We have unique types in case IBM Cloud Load Balancer Listener and Backend Pool supported algorithms ever diverage.
+// We have unique types in case IBM Cloud Load Balancer Listener and Backend Pool supported algorithms ever diverge.
 // +kubebuilder:validation:Enum=http;https;tcp;udp
 type VPCLoadBalancerListenerProtocol string

Also applies to: 67-67

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/vpc/v1beta2/types.go` at line 48, Update the inline comments that
currently read "diverage" to the correct spelling "diverge" in the types.go
comment blocks (the comment containing "We have unique types in case IBM Cloud
Load Balancer Listener and Backend Pool supported algorithms ever diverage." and
the similar occurrence later); locate those comment strings and replace
"diverage" with "diverge" so both occurrences are fixed.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix typo in comments.

"tudp" should be "udp" (appears at lines 62 and 81).

🔧 Suggested fix

-	// VPCLoadBalancerBackendPoolProtocolUDP is the string representing the tudp protocol for load balancer backend pools.
+	// VPCLoadBalancerBackendPoolProtocolUDP is the string representing the udp protocol for load balancer backend pools.
 	VPCLoadBalancerBackendPoolProtocolUDP VPCLoadBalancerBackendPoolProtocol = vpcv1.LoadBalancerPoolPrototypeLoadBalancerContextProtocolUDPConst

-	// VPCLoadBalancerListenerProtocolUDP is the string representing the tudp protocol for load balancer listeners.
+	// VPCLoadBalancerListenerProtocolUDP is the string representing the udp protocol for load balancer listeners.
 	VPCLoadBalancerListenerProtocolUDP VPCLoadBalancerListenerProtocol = vpcv1.LoadBalancerListenerProtocolUDPConst

Also applies to: 81-81

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/vpc/v1beta2/types.go` at line 62, Fix the typo "tudp" to "udp" in the
comment(s) describing the VPCLoadBalancerBackendPoolProtocolUDP constant; search
for any remaining occurrences of "tudp" in api/vpc/v1beta2/types.go (including
the comment for VPCLoadBalancerBackendPoolProtocolUDP and the similar comment at
the other occurrence) and update them to read "udp" so the comment correctly
describes the protocol.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix comment errors.

Three issues:

• Line 144: "Power VS network resource" should be "VPC resource" (VPC is not PowerVS)
• Line 160: "Gatway" should be "Gateway"
• Line 206: "defiens" should be "defines"

🔧 Suggested fix

-	// ResourceTypeVPC is Power VS network resource.
+	// ResourceTypeVPC is VPC resource.
 	ResourceTypeVPC = ResourceType("vpc")

-	// ResourceTypePublicGateway is a VPC Public Gatway.
+	// ResourceTypePublicGateway is a VPC Public Gateway.
 	ResourceTypePublicGateway = ResourceType("publicGateway")

-	// VPCSecurityGroupRuleProtocolIcmp defiens the Rule is for ICMP network protocol.
+	// VPCSecurityGroupRuleProtocolIcmp defines the Rule is for ICMP network protocol.
 	VPCSecurityGroupRuleProtocolIcmp VPCSecurityGroupRuleProtocol = vpcv1.NetworkACLRuleProtocolIcmpConst

Also applies to: 160-160, 206-206

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/vpc/v1beta2/types.go` at line 144, Update the comment typos in the VPC
types declarations: change the ResourceTypeVPC comment from "Power VS network
resource" to "VPC resource", fix "Gatway" to "Gateway" in the relevant VPC
gateway/comment, and correct "defiens" to "defines" where the word appears;
locate these by searching for the symbols/comments around ResourceTypeVPC and
any VPC Gateway-related type or comment and update the three misspelled words
accordingly.