Merge https://github.com/kubernetes-sigs/cluster-api-provider-ibmcloud:v0.14.0 (5d081d1) into main

[cloud-team-rebase-bot]

Summary by CodeRabbit

• New Features

  • PowerVS v1beta2/v1beta3 and VPC v1beta2 APIs added with expanded resource types and richer condition/status reporting.
  • Improved API conversion and round‑trip tests to support seamless migration between versions.

• Build & Configuration

  • Toolchain bumped to Go 1.25; CI and security scan workflows updated; build/Make flows adjusted for new generation.

• Documentation

  • Expanded machine image onboarding checklist with provider-specific steps; compatibility matrix updated.

• Deprecations

  • v1beta1 APIs removed/deprecated in favor of newer versions.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign mkumatag for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Actionable comments posted: 4

♻️ Duplicate comments (16)

api/powervs/v1beta2/vpc.go (4)

24-25: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Fix malformed kubebuilder validation markers (:= should be =).

Lines 24, 25, and 32 use MinLength:= and MaxLength:= syntax, which is invalid. Kubebuilder markers require = without the colon. These malformed markers are silently ignored by controller-gen, causing validation rules to be absent from the generated CRD.

Suggested fix

-	// +kubebuilder:validation:MinLength:=1
-	// +kubebuilder:validation:MaxLength:=63
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=63
 	// +kubebuilder:validation:Pattern=`^([a-z]|[a-z][-a-z0-9]*[a-z0-9])$`
 	// +optional
 	Name string `json:"name,omitempty"`

 	// id of the loadbalancer
 	// +kubebuilder:validation:MinLength=1
-	// +kubebuilder:validation:MaxLength:=64
+	// +kubebuilder:validation:MaxLength=64

Also applies to: 32-32

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta2/vpc.go` around lines 24 - 25, The kubebuilder validation
markers in vpc.go are malformed (they use `MinLength:=` and `MaxLength:=`) so
controller-gen ignores them; edit the kubebuilder markers associated with the
VPC fields (the lines containing `+kubebuilder:validation:MinLength:=` and
`+kubebuilder:validation:MaxLength:=` — including the third occurrence
referenced) and replace the `:=` with `=` so the annotations read
`+kubebuilder:validation:MinLength=` and `+kubebuilder:validation:MaxLength=`;
keep the same numeric values and ensure the corrected markers sit immediately
above the corresponding struct field tags.

---

113-114: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Fix CEL validation marker: missing + prefix and field name typo.

Line 113 has two issues:

1. Missing + prefix—marker should start with +kubebuilder: not kubebuilder:
2. CEL expression uses self.dely but the struct field is Delay (json:"delay")

Without the + prefix, controller-gen won't recognize this marker. The typo would cause the rule to fail at runtime.

Suggested fix

-// kubebuilder:validation:XValidation:rule="self.dely > self.timeout",message="health monitor's delay must be greater than the timeout"
+// +kubebuilder:validation:XValidation:rule="self.delay > self.timeout",message="health monitor's delay must be greater than the timeout"
 type VPCLoadBalancerHealthMonitorSpec struct {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta2/vpc.go` around lines 113 - 114, Update the kubebuilder
XValidation marker on VPCLoadBalancerHealthMonitorSpec to include the required
'+' prefix and fix the field typo: change the marker from
kubebuilder:validation:XValidation... to +kubebuilder:validation:XValidation...
and correct the CEL expression to reference the json field name (self.delay)
instead of self.dely so the rule reads self.delay > self.timeout; ensure this
marker sits immediately above the VPCLoadBalancerHealthMonitorSpec type
declaration.

---

46-46: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Fix double-plus kubebuilder marker (++ should be +).

Line 46 uses ++kubebuilder instead of +kubebuilder, which prevents controller-gen from recognizing the marker.

Suggested fix

-	// ++kubebuilder:validation:UniqueItems=true
+	// +kubebuilder:validation:UniqueItems=true
 	AdditionalListeners []AdditionalListenerSpec `json:"additionalListeners,omitempty"`

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta2/vpc.go` at line 46, The kubebuilder marker comment is
mistyped as "++kubebuilder:validation:UniqueItems=true" which prevents
controller-gen from recognizing it; locate the comment string (the kubebuilder
marker for UniqueItems) in vpc.go (the line containing
"++kubebuilder:validation:UniqueItems=true") and change the leading "++" to a
single "+" so it reads "+kubebuilder:validation:UniqueItems=true" ensuring
controller-gen will parse the marker correctly.

---

68-69: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Fix additional malformed kubebuilder markers.

Lines 68, 69, 93, and 94 also use the invalid := syntax. Apply the same fix as the Name/ID fields.

Suggested fix

 	// defaultPoolName defines the name of a VPC Load Balancer Backend Pool to use for the VPC Load Balancer Listener.
-	// +kubebuilder:validation:MinLength:=1
-	// +kubebuilder:validation:MaxLength:=63
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=63
 	// +kubebuilder:validation:Pattern=`^([a-z]|[a-z][-a-z0-9]*[a-z0-9])$`
 	// +optional
 	DefaultPoolName *string `json:"defaultPoolName,omitempty"`

...

 	// name defines the name of the Backend Pool.
-	// +kubebuilder:validation:MinLength:=1
-	// +kubebuilder:validation:MaxLength:=63
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=63

Also applies to: 93-94

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta2/vpc.go` around lines 68 - 69, Replace the malformed
kubebuilder markers that use ":=" with the correct "=" syntax for the MinLength
and MaxLength tags; update the validation marker comments on the VPC spec fields
(the same pattern used previously for Name/ID) so they read "//
+kubebuilder:validation:MinLength=1" and "//
+kubebuilder:validation:MaxLength=63" for the affected fields in vpc.go (the
tags around the VPCSpec fields / the specific validation comments at the
locations referenced).

api/vpc/v1beta1/types.go (1)

49-53: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Add omitempty to Subnet pointer fields for consistency with v1beta2.

The four pointer fields serialize nil as JSON null instead of being omitted. The v1beta2 Subnet struct includes omitempty on all corresponding fields for proper optional field handling.

Suggested fix

-	Ipv4CidrBlock *string `json:"cidr"`
-	Name          *string `json:"name"`
-	ID            *string `json:"id"`
-	Zone          *string `json:"zone"`
+	Ipv4CidrBlock *string `json:"cidr,omitempty"`
+	Name          *string `json:"name,omitempty"`
+	ID            *string `json:"id,omitempty"`
+	Zone          *string `json:"zone,omitempty"`

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/vpc/v1beta1/types.go` around lines 49 - 53, The Subnet pointer fields
(Ipv4CidrBlock, Name, ID, Zone) are currently serializing nil as JSON null;
update their struct tag JSON annotations to include omitempty so nil pointers
are omitted (e.g., change `json:"cidr"` to `json:"cidr,omitempty"` for
Ipv4CidrBlock and similarly add `omitempty` to Name, ID, and Zone) to match
v1beta2 behavior.

.github/ISSUE_TEMPLATE/add_new_machine_image.md (3)

30-30: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Make this task a real checklist item.

Line 30 is missing - [ ], so it won’t be trackable in the issue UI.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/ISSUE_TEMPLATE/add_new_machine_image.md at line 30, Convert the
plain text "Test the image with
[cluster-template-powervs-create-infra.yaml](...)" into a checklist item by
prepending "- [ ] " so it becomes a trackable checkbox; locate the line
containing that exact sentence in the add_new_machine_image.md template and
update it to start with "- [ ] " (preserving the link and text) so the issue UI
will render it as an unchecked task.

---

20-21: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Use branch-based links instead of pinned commit SHA.

These URLs will stale over time; switch them to blob/main/... so the template stays evergreen.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/ISSUE_TEMPLATE/add_new_machine_image.md around lines 20 - 21, The
links in the checklist point to files using a pinned commit SHA which will go
stale; update the two URLs (the E2E config link referencing
test/e2e/config/ibmcloud-e2e-powervs.yaml and the E2E script link referencing
scripts/ci-e2e.sh) to use branch-based links (replace the commit SHA segment
with blob/main/...) so they remain evergreen. Ensure both occurrences in the
checklist are changed to the blob/main path format.

---

28-28: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix heading typo.

Line 28 still says infrastruction; change it to infrastructure.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/ISSUE_TEMPLATE/add_new_machine_image.md at line 28, Fix the heading
typo in the section titled "PowerVS image with DHCP support for cluster
deployment with infrastruction creation" by replacing the misspelled word
"infrastruction" with "infrastructure" so the heading reads "PowerVS image with
DHCP support for cluster deployment with infrastructure creation".

api/powervs/v1beta3/ibmpowervscluster_types.go (2)

411-414: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Guard pointer dereference in ResourceReference.Set.

Line 413 can panic when rf.ControllerCreated is nil.

Proposed fix

 func (rf *ResourceReference) Set(resource ResourceReference) {
 	rf.ID = resource.ID
-	if !*rf.ControllerCreated {
+	if rf.ControllerCreated == nil || !*rf.ControllerCreated {
 		rf.ControllerCreated = resource.ControllerCreated
 	}
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta3/ibmpowervscluster_types.go` around lines 411 - 414, The
Set method for ResourceReference dereferences rf.ControllerCreated without
checking for nil, which can panic; update ResourceReference.Set so it first
checks rf.ControllerCreated for nil before using *rf.ControllerCreated and also
guard resource.ControllerCreated when assigning: e.g., if rf.ControllerCreated
== nil { rf.ControllerCreated = resource.ControllerCreated } else if
resource.ControllerCreated != nil && !*rf.ControllerCreated {
rf.ControllerCreated = resource.ControllerCreated }; modify the logic inside the
ResourceReference.Set function (referencing rf.ControllerCreated and
resource.ControllerCreated) accordingly to avoid nil pointer dereference.

---

278-286: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Fix malformed kubebuilder validation markers.

Several markers use := (invalid syntax for these directives), so validations may not be generated/applied as intended.

Proposed fix

-// +kubebuilder:validation:MaxLength:=64
+// +kubebuilder:validation:MaxLength=64
...
-// +kubebuilder:validation:MaxLength:=63
+// +kubebuilder:validation:MaxLength=63
...
-// +kubebuilder:validation:MinLength:=3
-// +kubebuilder:validation:MaxLength:=63
+// +kubebuilder:validation:MinLength=3
+// +kubebuilder:validation:MaxLength=63

Also applies to: 300-300, 318-319

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta3/ibmpowervscluster_types.go` around lines 278 - 286, The
kubebuilder markers for MaxLength are malformed (they use ":="); update the
annotations so they use "=" instead. Specifically, for the ID field (ID *string
`json:"id,omitempty"`) change "+kubebuilder:validation:MaxLength:=64" to
"+kubebuilder:validation:MaxLength=64", and for the name field (the "name of
resource." block) change "+kubebuilder:validation:MaxLength:=63" to
"+kubebuilder:validation:MaxLength=63"; apply the same replacement for the other
occurrences mentioned (the markers at the other two locations).

api/powervs/v1beta2/ibmpowervsimage_types.go (1)

40-43: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Make deprecated serviceInstanceID optional.

ServiceInstanceID is deprecated but still required in schema shape, which conflicts with the new optional serviceInstance path.

Proposed fix

 	// Deprecated: use ServiceInstance instead
 	//
 	// ServiceInstanceID is the id of the power cloud instance where the image will get imported.
-	ServiceInstanceID string `json:"serviceInstanceID"`
+	// +optional
+	ServiceInstanceID *string `json:"serviceInstanceID,omitempty"`

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta2/ibmpowervsimage_types.go` around lines 40 - 43,
ServiceInstanceID is deprecated but still required in the CRD; mark it optional
by adding the kubebuilder optional marker and omitting it from JSON when absent:
add the comment marker "// +optional" immediately above the ServiceInstanceID
field in ibmpowervsimage_types.go and change its struct tag to
`json:"serviceInstanceID,omitempty"` so the schema treats it as optional
(optionally convert the type to *string if you need to distinguish unset vs
empty).

api/powervs/v1beta3/vpc.go (1)

24-26: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Correct malformed validation markers so CRD validation actually applies.

There are several invalid marker forms (:=, ++kubebuilder, missing +) plus a typo in the XValidation rule (self.dely), which can prevent these constraints from taking effect.

Proposed fix

-// +kubebuilder:validation:MinLength:=1
-// +kubebuilder:validation:MaxLength:=63
+// +kubebuilder:validation:MinLength=1
+// +kubebuilder:validation:MaxLength=63
...
-// +kubebuilder:validation:MaxLength:=64
+// +kubebuilder:validation:MaxLength=64
...
-// ++kubebuilder:validation:UniqueItems=true
+// +kubebuilder:validation:UniqueItems=true
...
-// kubebuilder:validation:XValidation:rule="self.dely > self.timeout",message="health monitor's delay must be greater than the timeout"
+// +kubebuilder:validation:XValidation:rule="self.delay > self.timeout",message="health monitor's delay must be greater than the timeout"

Also applies to: 32-33, 46-46, 68-70, 92-94, 112-113

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta3/vpc.go` around lines 24 - 26, Fix the malformed
kubebuilder markers by ensuring each validation comment starts with a single
plus and uses '=' rather than ':=' (e.g. change "//
+kubebuilder:validation:MinLength:=1" to "//
+kubebuilder:validation:MinLength=1", same for MaxLength and Pattern) and
correct the XValidation typo (`self.dely`) to the intended field name
(`self.delay`) so CRD validation applies; apply the same fixes to the other
occurrences noted (the marker groups around lines 32-33, 46, 68-70, 92-94,
112-113) so all "+kubebuilder:validation:..." markers and the XValidation rule
use the proper '+' prefix, '=' assignment form, and correct field reference.

api/powervs/v1beta3/ibmpowervsmachine_types.go (2)

224-224: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Remove trailing whitespace from the Ready printcolumn JSONPath.

The JSONPath contains a trailing tab (.status.initialization.provisioned\t), which can make the printcolumn invalid.

Proposed fix

-// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.initialization.provisioned	",description="Cluster infrastructure is ready for IBM PowerVS instances"
+// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.initialization.provisioned",description="Cluster infrastructure is ready for IBM PowerVS instances"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta3/ibmpowervsmachine_types.go` at line 224, The Ready
printcolumn annotation on the ibmpowervsmachine type has a trailing tab
character in the JSONPath (".status.initialization.provisioned\t"); update the
kubebuilder:printcolumn line to remove any trailing whitespace or control
characters so the JSONPath is exactly ".status.initialization.provisioned"
(locate the annotation line with name="Ready" in ibmpowervsmachine_types.go and
edit the JSONPath value accordingly).

---

78-90: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Fix invalid kubebuilder enum marker syntax (:= → =).

+kubebuilder:validation:Enum:=... is not valid marker syntax; this can prevent enum validation from being generated.

Proposed fix

-	// +kubebuilder:validation:Enum:="s922";"e980";"s1022";"e1050";"e1080";""
+	// +kubebuilder:validation:Enum="s922";"e980";"s1022";"e1050";"e1080";""
@@
-	// +kubebuilder:validation:Enum:="Dedicated";"Shared";"Capped";""
+	// +kubebuilder:validation:Enum="Dedicated";"Shared";"Capped";""

#!/bin/bash
# Verify invalid Enum marker syntax still exists.
rg -n 'kubebuilder:validation:Enum:=' api/powervs/v1beta3/ibmpowervsmachine_types.go

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta3/ibmpowervsmachine_types.go` around lines 78 - 90, The
kubebuilder enum markers for SystemType and processorType use invalid ':='
syntax; update the marker lines above the SystemType field and the processorType
comment to use '=' instead (change '+kubebuilder:validation:Enum:="s922";..."'
to '+kubebuilder:validation:Enum="s922";...' and similarly for
'+kubebuilder:validation:Enum:="Dedicated";..."' to
'+kubebuilder:validation:Enum="Dedicated";...') so that code generation will
produce proper enum validation for the SystemType and processorType fields.

api/powervs/v1beta3/conditions_consts.go (1)

226-227: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Rename the exported identifier to match reason semantics.

VPCSecurityGroupNotReadyCondition is bound to clusterv1.NotReadyReason, so the name is semantically incorrect for public API consumers. Rename it to VPCSecurityGroupNotReadyReason and update references.

Proposed fix

-	// VPCSecurityGroupNotReadyCondition surfaces when VPC security group is not ready.
-	VPCSecurityGroupNotReadyCondition = clusterv1.NotReadyReason
+	// VPCSecurityGroupNotReadyReason surfaces when VPC security group is not ready.
+	VPCSecurityGroupNotReadyReason = clusterv1.NotReadyReason

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta3/conditions_consts.go` around lines 226 - 227, The
exported identifier VPCSecurityGroupNotReadyCondition is misnamed for a reason
constant; rename it to VPCSecurityGroupNotReadyReason (bound to
clusterv1.NotReadyReason) and update all usages and imports that reference
VPCSecurityGroupNotReadyCondition to the new name (e.g., any comparisons,
assignments, or documentation). Ensure the declaration changing
VPCSecurityGroupNotReadyCondition = clusterv1.NotReadyReason is replaced with
VPCSecurityGroupNotReadyReason = clusterv1.NotReadyReason and run tests/linters
to catch remaining references.

api/powervs/v1beta3/types.go (1)

547-566: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Enforce the documented one-of contract for id/name/regex.

The type comment states only one selector may be set, but schema validation does not enforce it. Add an XValidation rule to prevent ambiguous references.

Proposed fix

 // IBMPowerVSResourceReference is a reference to a specific PowerVS resource by ID, Name or RegEx
 // Only one of ID, Name or RegEx may be specified. Specifying more than one will result in
 // a validation error.
+// +kubebuilder:validation:XValidation:rule="(has(self.id)?1:0) + (has(self.name)?1:0) + (has(self.regex)?1:0) <= 1",message="only one of id, name or regex may be specified"
 type IBMPowerVSResourceReference struct {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta3/types.go` around lines 547 - 566, Add a kubebuilder
XValidation marker to IBMPowerVSResourceReference to enforce the one-of
constraint for ID, Name and RegEx; specifically, add a
+kubebuilder:validation:XValidation marker above the type with a rule that
validates exactly one of the three fields is set (e.g. a logical OR of the three
mutually exclusive cases: only ID set OR only Name set OR only RegEx set) and a
helpful message, referencing the struct IBMPowerVSResourceReference and the
fields ID, Name and RegEx so the generated CRD will reject ambiguous references.

🧹 Nitpick comments (1)

api/vpc/v1beta2/conditions_consts.go (1)

223-226: 💤 Low value

Incorrect condition names in comment.

The comment references "FailureDomainsReady, VCenterAvailable and ClusterModulesReady" which appear to be vSphere-specific condition names, likely copy-pasted from another provider. Consider updating to reflect the actual IBM PowerVS cluster readiness criteria.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/vpc/v1beta2/conditions_consts.go` around lines 223 - 226, Update the
comment for IBMPowerVSClusterReadyV1Beta2Condition to remove the
vSphere-specific condition names and describe the actual IBM PowerVS cluster
readiness criteria; locate the constant IBMPowerVSClusterReadyV1Beta2Condition
and replace the current line mentioning "FailureDomainsReady, VCenterAvailable
and ClusterModulesReady" with a concise description that matches the IBM PowerVS
conditions (e.g., deletionTimestamp not set and the IBM PowerVS-specific
subconditions such as control plane, networking, and any provider-specific
readiness flags used in this codebase).

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/weekly-security-scan.yaml:
- Around line 20-23: The checkout step named "Check out code" is leaving
credentials persisted; update the actions/checkout@... step (the "uses:
actions/checkout" invocation) to include with: persist-credentials: false so the
runner does not keep GITHUB_TOKEN credentials during this security-scan
workflow; keep the existing ref: ${{ matrix.branch }} and add the
persist-credentials: false key alongside it.

In `@api/powervs/v1beta2/ibmpowervscluster_types.go`:
- Around line 284-286: Fix the malformed kubebuilder tags by replacing every
occurrence of "+kubebuilder:validation:MaxLength:=<n>" with the correct
"+kubebuilder:validation:MaxLength=<n>" in ibmpowervscluster_types.go (i.e.,
remove the stray colon before '=' in the MaxLength markers), update the three
broken annotations that currently read "+kubebuilder:validation:MaxLength:=" so
they match the other kubebuilder markers, and re-generate/validate the CRD
(controller-gen) to confirm the MaxLength validations are now applied.

In `@api/powervs/v1beta3/ibmpowervsmachine_types.go`:
- Around line 65-70: Add a kubebuilder XValidation rule to enforce mutual
exclusivity between the Image and ImageRef fields (so specs cannot set both).
Insert a marker (for example above the containing struct or immediately above
the ImageRef field) using
+kubebuilder:validation:XValidation:rule="!((has(self.image) &&
has(self.imageRef)))",message="image and imageRef are mutually exclusive"
referencing the Image (type IBMPowerVSResourceReference) and ImageRef (type
ImageReference) symbols so the CRD rejects objects that set both.

In `@api/powervs/v1beta3/types.go`:
- Around line 482-488: The kubebuilder validation markers for MaxLength in
types.go are using the invalid ':=' syntax; update the annotations for the Name
field and the id comment to use '=' (e.g., change
"+kubebuilder:validation:MaxLength:=63" to
"+kubebuilder:validation:MaxLength=63" and
"+kubebuilder:validation:MaxLength:=64" to
"+kubebuilder:validation:MaxLength=64") so controller-gen will apply the
constraints; search for the markers near the Name *string
`json:"name,omitempty"` declaration and the id comment for the subnet to make
the edits.

---

Duplicate comments:
In @.github/ISSUE_TEMPLATE/add_new_machine_image.md:
- Line 30: Convert the plain text "Test the image with
[cluster-template-powervs-create-infra.yaml](...)" into a checklist item by
prepending "- [ ] " so it becomes a trackable checkbox; locate the line
containing that exact sentence in the add_new_machine_image.md template and
update it to start with "- [ ] " (preserving the link and text) so the issue UI
will render it as an unchecked task.
- Around line 20-21: The links in the checklist point to files using a pinned
commit SHA which will go stale; update the two URLs (the E2E config link
referencing test/e2e/config/ibmcloud-e2e-powervs.yaml and the E2E script link
referencing scripts/ci-e2e.sh) to use branch-based links (replace the commit SHA
segment with blob/main/...) so they remain evergreen. Ensure both occurrences in
the checklist are changed to the blob/main path format.
- Line 28: Fix the heading typo in the section titled "PowerVS image with DHCP
support for cluster deployment with infrastruction creation" by replacing the
misspelled word "infrastruction" with "infrastructure" so the heading reads
"PowerVS image with DHCP support for cluster deployment with infrastructure
creation".

In `@api/powervs/v1beta2/ibmpowervsimage_types.go`:
- Around line 40-43: ServiceInstanceID is deprecated but still required in the
CRD; mark it optional by adding the kubebuilder optional marker and omitting it
from JSON when absent: add the comment marker "// +optional" immediately above
the ServiceInstanceID field in ibmpowervsimage_types.go and change its struct
tag to `json:"serviceInstanceID,omitempty"` so the schema treats it as optional
(optionally convert the type to *string if you need to distinguish unset vs
empty).

In `@api/powervs/v1beta2/vpc.go`:
- Around line 24-25: The kubebuilder validation markers in vpc.go are malformed
(they use `MinLength:=` and `MaxLength:=`) so controller-gen ignores them; edit
the kubebuilder markers associated with the VPC fields (the lines containing
`+kubebuilder:validation:MinLength:=` and `+kubebuilder:validation:MaxLength:=`
— including the third occurrence referenced) and replace the `:=` with `=` so
the annotations read `+kubebuilder:validation:MinLength=` and
`+kubebuilder:validation:MaxLength=`; keep the same numeric values and ensure
the corrected markers sit immediately above the corresponding struct field tags.
- Around line 113-114: Update the kubebuilder XValidation marker on
VPCLoadBalancerHealthMonitorSpec to include the required '+' prefix and fix the
field typo: change the marker from kubebuilder:validation:XValidation... to
+kubebuilder:validation:XValidation... and correct the CEL expression to
reference the json field name (self.delay) instead of self.dely so the rule
reads self.delay > self.timeout; ensure this marker sits immediately above the
VPCLoadBalancerHealthMonitorSpec type declaration.
- Line 46: The kubebuilder marker comment is mistyped as
"++kubebuilder:validation:UniqueItems=true" which prevents controller-gen from
recognizing it; locate the comment string (the kubebuilder marker for
UniqueItems) in vpc.go (the line containing
"++kubebuilder:validation:UniqueItems=true") and change the leading "++" to a
single "+" so it reads "+kubebuilder:validation:UniqueItems=true" ensuring
controller-gen will parse the marker correctly.
- Around line 68-69: Replace the malformed kubebuilder markers that use ":="
with the correct "=" syntax for the MinLength and MaxLength tags; update the
validation marker comments on the VPC spec fields (the same pattern used
previously for Name/ID) so they read "// +kubebuilder:validation:MinLength=1"
and "// +kubebuilder:validation:MaxLength=63" for the affected fields in vpc.go
(the tags around the VPCSpec fields / the specific validation comments at the
locations referenced).

In `@api/powervs/v1beta3/conditions_consts.go`:
- Around line 226-227: The exported identifier VPCSecurityGroupNotReadyCondition
is misnamed for a reason constant; rename it to VPCSecurityGroupNotReadyReason
(bound to clusterv1.NotReadyReason) and update all usages and imports that
reference VPCSecurityGroupNotReadyCondition to the new name (e.g., any
comparisons, assignments, or documentation). Ensure the declaration changing
VPCSecurityGroupNotReadyCondition = clusterv1.NotReadyReason is replaced with
VPCSecurityGroupNotReadyReason = clusterv1.NotReadyReason and run tests/linters
to catch remaining references.

In `@api/powervs/v1beta3/ibmpowervscluster_types.go`:
- Around line 411-414: The Set method for ResourceReference dereferences
rf.ControllerCreated without checking for nil, which can panic; update
ResourceReference.Set so it first checks rf.ControllerCreated for nil before
using *rf.ControllerCreated and also guard resource.ControllerCreated when
assigning: e.g., if rf.ControllerCreated == nil { rf.ControllerCreated =
resource.ControllerCreated } else if resource.ControllerCreated != nil &&
!*rf.ControllerCreated { rf.ControllerCreated = resource.ControllerCreated };
modify the logic inside the ResourceReference.Set function (referencing
rf.ControllerCreated and resource.ControllerCreated) accordingly to avoid nil
pointer dereference.
- Around line 278-286: The kubebuilder markers for MaxLength are malformed (they
use ":="); update the annotations so they use "=" instead. Specifically, for the
ID field (ID *string `json:"id,omitempty"`) change
"+kubebuilder:validation:MaxLength:=64" to
"+kubebuilder:validation:MaxLength=64", and for the name field (the "name of
resource." block) change "+kubebuilder:validation:MaxLength:=63" to
"+kubebuilder:validation:MaxLength=63"; apply the same replacement for the other
occurrences mentioned (the markers at the other two locations).

In `@api/powervs/v1beta3/ibmpowervsmachine_types.go`:
- Line 224: The Ready printcolumn annotation on the ibmpowervsmachine type has a
trailing tab character in the JSONPath (".status.initialization.provisioned\t");
update the kubebuilder:printcolumn line to remove any trailing whitespace or
control characters so the JSONPath is exactly
".status.initialization.provisioned" (locate the annotation line with
name="Ready" in ibmpowervsmachine_types.go and edit the JSONPath value
accordingly).
- Around line 78-90: The kubebuilder enum markers for SystemType and
processorType use invalid ':=' syntax; update the marker lines above the
SystemType field and the processorType comment to use '=' instead (change
'+kubebuilder:validation:Enum:="s922";..."' to
'+kubebuilder:validation:Enum="s922";...' and similarly for
'+kubebuilder:validation:Enum:="Dedicated";..."' to
'+kubebuilder:validation:Enum="Dedicated";...') so that code generation will
produce proper enum validation for the SystemType and processorType fields.

In `@api/powervs/v1beta3/types.go`:
- Around line 547-566: Add a kubebuilder XValidation marker to
IBMPowerVSResourceReference to enforce the one-of constraint for ID, Name and
RegEx; specifically, add a +kubebuilder:validation:XValidation marker above the
type with a rule that validates exactly one of the three fields is set (e.g. a
logical OR of the three mutually exclusive cases: only ID set OR only Name set
OR only RegEx set) and a helpful message, referencing the struct
IBMPowerVSResourceReference and the fields ID, Name and RegEx so the generated
CRD will reject ambiguous references.

In `@api/powervs/v1beta3/vpc.go`:
- Around line 24-26: Fix the malformed kubebuilder markers by ensuring each
validation comment starts with a single plus and uses '=' rather than ':=' (e.g.
change "// +kubebuilder:validation:MinLength:=1" to "//
+kubebuilder:validation:MinLength=1", same for MaxLength and Pattern) and
correct the XValidation typo (`self.dely`) to the intended field name
(`self.delay`) so CRD validation applies; apply the same fixes to the other
occurrences noted (the marker groups around lines 32-33, 46, 68-70, 92-94,
112-113) so all "+kubebuilder:validation:..." markers and the XValidation rule
use the proper '+' prefix, '=' assignment form, and correct field reference.

In `@api/vpc/v1beta1/types.go`:
- Around line 49-53: The Subnet pointer fields (Ipv4CidrBlock, Name, ID, Zone)
are currently serializing nil as JSON null; update their struct tag JSON
annotations to include omitempty so nil pointers are omitted (e.g., change
`json:"cidr"` to `json:"cidr,omitempty"` for Ipv4CidrBlock and similarly add
`omitempty` to Name, ID, and Zone) to match v1beta2 behavior.

---

Nitpick comments:
In `@api/vpc/v1beta2/conditions_consts.go`:
- Around line 223-226: Update the comment for
IBMPowerVSClusterReadyV1Beta2Condition to remove the vSphere-specific condition
names and describe the actual IBM PowerVS cluster readiness criteria; locate the
constant IBMPowerVSClusterReadyV1Beta2Condition and replace the current line
mentioning "FailureDomainsReady, VCenterAvailable and ClusterModulesReady" with
a concise description that matches the IBM PowerVS conditions (e.g.,
deletionTimestamp not set and the IBM PowerVS-specific subconditions such as
control plane, networking, and any provider-specific readiness flags used in
this codebase).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1f6a2f73-8332-462d-a2ba-e1284838d227

📥 Commits

Reviewing files that changed from the base of the PR and between ea32643 and 8b85e0b.

⛔ Files ignored due to path filters (156)

• api/powervs/v1beta2/zz_generated.conversion.go is excluded by !**/zz_generated*
• api/powervs/v1beta2/zz_generated.deepcopy.go is excluded by !**/zz_generated*
• api/powervs/v1beta3/zz_generated.deepcopy.go is excluded by !**/zz_generated*
• api/v1beta1/zz_generated.conversion.go is excluded by !**/zz_generated*
• api/v1beta1/zz_generated.deepcopy.go is excluded by !**/zz_generated*
• api/v1beta2/zz_generated.deepcopy.go is excluded by !**/zz_generated*
• api/vpc/v1beta1/zz_generated.conversion.go is excluded by !**/zz_generated*
• api/vpc/v1beta1/zz_generated.deepcopy.go is excluded by !**/zz_generated*
• api/vpc/v1beta2/zz_generated.deepcopy.go is excluded by !**/zz_generated*
• go.sum is excluded by !**/*.sum
• hack/tools/go.sum is excluded by !**/*.sum
• hack/tools/vendor/cel.dev/expr/.bazelversion is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/.gitattributes is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/.gitignore is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/BUILD.bazel is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/CODE_OF_CONDUCT.md is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/CONTRIBUTING.md is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/GOVERNANCE.md is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/MAINTAINERS.md is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/MODULE.bazel is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/README.md is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/WORKSPACE is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/WORKSPACE.bzlmod is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/checked.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• hack/tools/vendor/cel.dev/expr/cloudbuild.yaml is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/eval.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• hack/tools/vendor/cel.dev/expr/explain.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• hack/tools/vendor/cel.dev/expr/regen_go_proto.sh is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/regen_go_proto_canonical_protos.sh is excluded by !**/vendor/**
• hack/tools/vendor/cel.dev/expr/syntax.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• hack/tools/vendor/cel.dev/expr/value.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/.editorconfig is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/.gitattributes is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/.gitignore is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/.golangci.yml is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/.goreleaser.yml is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/LICENSE is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/README.md is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/Taskfile.yaml is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/UPGRADE_GUIDE_V2.md is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/align.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/ansi_unix.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/ansi_windows.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/blending.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/borders.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/canvas.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/color.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/get.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/join.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/layer.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/lipgloss.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/position.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/query.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/ranges.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/runes.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/set.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/size.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/style.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/terminal.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/unset.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/whitespace.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/wrap.go is excluded by !**/vendor/**
• hack/tools/vendor/charm.land/lipgloss/v2/writer.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/CHANGES.md is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/LICENSE is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/README.md is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/auth.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/compute.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/detect.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/doc.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/filetypes.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/idtoken/cache.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/idtoken/compute.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/idtoken/file.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/idtoken/idtoken.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/idtoken/validate.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/impersonate/doc.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/impersonate/idtoken.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/impersonate/impersonate.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/impersonate/user.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/aws_provider.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/executable_provider.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/externalaccount.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/file_provider.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/info.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/programmatic_provider.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/url_provider.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/x509_provider.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/externalaccountuser/externalaccountuser.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/gdch/gdch.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/impersonate/idtoken.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/impersonate/impersonate.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/internal/stsexchange/sts_exchange.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/credentials/selfsignedjwt.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/grpctransport/dial_socketopt.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/grpctransport/directpath.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/grpctransport/grpctransport.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/grpctransport/pool.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/httptransport/httptransport.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/httptransport/transport.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/compute/compute.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/compute/manufacturer.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/compute/manufacturer_linux.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/compute/manufacturer_windows.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/credsfile/credsfile.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/credsfile/filetype.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/credsfile/parse.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/internal.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/jwt/jwt.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/retry/retry.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/transport/cba.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/transport/cert/default_cert.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/transport/cert/enterprise_cert.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/transport/cert/secureconnect_cert.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/transport/cert/workload_cert.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/transport/headers/headers.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/transport/s2a.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/transport/transport.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/trustboundary/external_accounts_config_providers.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/trustboundary/trust_boundary.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/internal/version.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/oauth2adapt/CHANGES.md is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/oauth2adapt/LICENSE is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/oauth2adapt/oauth2adapt.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/auth/threelegged.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/compute/metadata/CHANGES.md is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/compute/metadata/LICENSE is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/compute/metadata/README.md is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/compute/metadata/log.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/compute/metadata/metadata.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/compute/metadata/retry.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/compute/metadata/retry_linux.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/compute/metadata/syscheck.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/compute/metadata/syscheck_linux.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/compute/metadata/syscheck_windows.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/iam/CHANGES.md is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/iam/LICENSE is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/iam/README.md is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/iam/apiv1/iampb/iam_policy.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/iam/apiv1/iampb/options.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/iam/apiv1/iampb/policy.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/iam/apiv1/iampb/resource_policy_member.pb.go is excluded by !**/*.pb.go, !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/iam/iam.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/internal/.repo-metadata-full.json is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/internal/README.md is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/internal/annotate.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/internal/gen_info.sh is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/internal/optional/optional.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/internal/retry.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/internal/trace/trace.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/internal/version/update_version.sh is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/internal/version/version.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/monitoring/LICENSE is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/monitoring/apiv3/v2/alert_policy_client.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/monitoring/apiv3/v2/auxiliary.go is excluded by !**/vendor/**
• hack/tools/vendor/cloud.google.com/go/monitoring/apiv3/v2/auxiliary_go123.go is excluded by !**/vendor/**

📒 Files selected for processing (144)

• .github/ISSUE_TEMPLATE/add_new_machine_image.md
• .github/workflows/weekly-security-scan.yaml
• .golangci-kal.yml
• .golangci.yml
• Dockerfile
• Makefile
• PROJECT
• README.md
• api/powervs/v1beta2/conditions_consts.go
• api/powervs/v1beta2/conversion.go
• api/powervs/v1beta2/conversion_test.go
• api/powervs/v1beta2/doc.go
• api/powervs/v1beta2/groupversion_info.go
• api/powervs/v1beta2/ibmpowervscluster_types.go
• api/powervs/v1beta2/ibmpowervsclustertemplate_types.go
• api/powervs/v1beta2/ibmpowervsimage_types.go
• api/powervs/v1beta2/ibmpowervsmachine_types.go
• api/powervs/v1beta2/ibmpowervsmachinetemplate_types.go
• api/powervs/v1beta2/types.go
• api/powervs/v1beta2/vpc.go
• api/powervs/v1beta3/conditions_consts.go
• api/powervs/v1beta3/conversion.go
• api/powervs/v1beta3/doc.go
• api/powervs/v1beta3/groupversion_info.go
• api/powervs/v1beta3/ibmpowervscluster_types.go
• api/powervs/v1beta3/ibmpowervsclustertemplate_types.go
• api/powervs/v1beta3/ibmpowervsimage_types.go
• api/powervs/v1beta3/ibmpowervsmachine_types.go
• api/powervs/v1beta3/ibmpowervsmachinetemplate_types.go
• api/powervs/v1beta3/types.go
• api/powervs/v1beta3/v1beta2_condition_consts.go
• api/powervs/v1beta3/vpc.go
• api/v1beta1/doc.go
• api/v1beta1/ibmpowervs_conversion.go
• api/v1beta1/ibmpowervscluster_types.go
• api/v1beta1/ibmpowervsclustertemplate_types.go
• api/v1beta1/ibmpowervsimage_types.go
• api/v1beta1/ibmpowervsmachine_types.go
• api/v1beta1/ibmpowervsmachinetemplate_types.go
• api/v1beta1/types.go
• api/v1beta2/conversion.go
• api/v1beta2/doc.go
• api/v1beta2/ibmpowervscluster_types.go
• api/v1beta2/ibmpowervsclustertemplate_types.go
• api/v1beta2/ibmpowervsimage_types.go
• api/v1beta2/ibmpowervsmachine_types.go
• api/v1beta2/ibmpowervsmachinetemplate_types.go
• api/v1beta2/types.go
• api/vpc/v1beta1/conditions_consts.go
• api/vpc/v1beta1/doc.go
• api/vpc/v1beta1/groupversion_info.go
• api/vpc/v1beta1/ibmvpc_conversion.go
• api/vpc/v1beta1/ibmvpccluster_types.go
• api/vpc/v1beta1/ibmvpcmachine_types.go
• api/vpc/v1beta1/ibmvpcmachinetemplate_types.go
• api/vpc/v1beta1/types.go
• api/vpc/v1beta2/conditions_consts.go
• api/vpc/v1beta2/conversion.go
• api/vpc/v1beta2/doc.go
• api/vpc/v1beta2/groupversion_info.go
• api/vpc/v1beta2/ibmvpccluster_types.go
• api/vpc/v1beta2/ibmvpcclustertemplate_types.go
• api/vpc/v1beta2/ibmvpcmachine_types.go
• api/vpc/v1beta2/ibmvpcmachinetemplate_types.go
• api/vpc/v1beta2/types.go
• cloud/scope/common_test.go
• cloud/scope/doc.go
• cloud/scope/powervs/doc.go
• cloud/scope/powervs/helper_test.go
• cloud/scope/powervs/powervs_cluster.go
• cloud/scope/powervs/powervs_cluster_test.go
• cloud/scope/powervs/powervs_image.go
• cloud/scope/powervs/powervs_image_test.go
• cloud/scope/powervs/powervs_machine.go
• cloud/scope/powervs/powervs_machine_test.go
• cloud/scope/powervs/suite_test.go
• cloud/scope/powervs/types.go
• cloud/scope/powervs/util.go
• cloud/scope/powervs/util_test.go
• cloud/scope/suite_test.go
• cloud/scope/types.go
• cloud/scope/util.go
• cloud/scope/vpc/cluster.go
• cloud/scope/vpc/cluster_test.go
• cloud/scope/vpc/cluster_v2.go
• cloud/scope/vpc/doc.go
• cloud/scope/vpc/helper_test.go
• cloud/scope/vpc/machine.go
• cloud/scope/vpc/machine_test.go
• cloud/scope/vpc/suite_test.go
• cloud/scope/vpc/util.go
• cloud/scope/vpc_cluster.go
• cloudbuild.yaml
• cmd/capibmadm/cmd/powervs/image/type.go
• cmd/capibmadm/cmd/powervs/key/type.go
• cmd/capibmadm/cmd/powervs/network/type.go
• cmd/capibmadm/cmd/powervs/port/type.go
• cmd/capibmadm/cmd/vpc/image/type.go
• cmd/capibmadm/cmd/vpc/key/type.go
• cmd/main.go
• config/crd/bases/infrastructure.cluster.x-k8s.io_ibmpowervsclusters.yaml
• config/crd/bases/infrastructure.cluster.x-k8s.io_ibmpowervsclustertemplates.yaml
• config/crd/bases/infrastructure.cluster.x-k8s.io_ibmpowervsimages.yaml
• config/crd/bases/infrastructure.cluster.x-k8s.io_ibmpowervsmachines.yaml
• config/crd/bases/infrastructure.cluster.x-k8s.io_ibmpowervsmachinetemplates.yaml
• config/crd/bases/infrastructure.cluster.x-k8s.io_ibmvpcclusters.yaml
• config/crd/bases/infrastructure.cluster.x-k8s.io_ibmvpcclustertemplates.yaml
• config/crd/bases/infrastructure.cluster.x-k8s.io_ibmvpcmachines.yaml
• config/crd/bases/infrastructure.cluster.x-k8s.io_ibmvpcmachinetemplates.yaml
• config/crd/kustomization.yaml
• config/rbac/ibmpowervscluster_admin_role.yaml
• config/rbac/ibmpowervsclustertemplate_admin_role.yaml
• config/rbac/ibmpowervsimage_admin_role.yaml
• config/rbac/ibmpowervsmachine_admin_role.yaml
• config/rbac/ibmpowervsmachinetemplate_admin_role.yaml
• config/rbac/kustomization.yaml
• config/rbac/role.yaml
• config/webhook/manifests.yaml
• controllers/alias.go
• controllers/doc.go
• controllers/ibmpowervscluster_controller.go
• controllers/ibmpowervsimage_controller.go
• controllers/ibmpowervsmachine_controller.go
• controllers/suite_test.go
• docs/book/src/SUMMARY.md
• docs/book/src/developer/conversion.md
• docs/book/src/developer/netlify-site.md
• docs/book/src/developer/release-support-guidelines.md
• docs/book/src/developer/release.md
• docs/book/src/developer/tilt.md
• docs/book/src/machine-images/powervs.md
• docs/book/src/machine-images/vpc.md
• docs/book/src/reference/regions-zones-mapping.md
• docs/book/src/topics/powervs/creating-a-cluster.md
• docs/book/src/topics/vpc/creating-a-cluster.md
• docs/proposal/20260421-powervs-v1beta3-api-modernization.md
• go.mod
• hack/ccm/Makefile
• hack/ccm/cloudbuild.yaml
• hack/ensure-go.sh
• hack/tools/.custom-gcl.yaml
• hack/tools/Makefile
• hack/tools/go.mod
• hack/tools/tools.go

💤 Files with no reviewable changes (16)

• api/v1beta2/doc.go
• api/v1beta2/ibmpowervsmachinetemplate_types.go
• api/v1beta2/conversion.go
• api/v1beta1/ibmpowervsimage_types.go
• api/v1beta2/ibmpowervsmachine_types.go
• api/v1beta1/doc.go
• api/v1beta1/types.go
• api/v1beta1/ibmpowervsmachinetemplate_types.go
• api/v1beta1/ibmpowervsmachine_types.go
• api/v1beta2/ibmpowervscluster_types.go
• api/v1beta2/ibmpowervsimage_types.go
• api/v1beta2/ibmpowervsclustertemplate_types.go
• api/v1beta1/ibmpowervscluster_types.go
• api/v1beta2/types.go
• api/v1beta1/ibmpowervs_conversion.go
• api/v1beta1/ibmpowervsclustertemplate_types.go

✅ Files skipped from review due to trivial changes (7)

• api/powervs/v1beta3/conversion.go
• api/powervs/v1beta2/doc.go
• api/powervs/v1beta3/doc.go
• api/vpc/v1beta2/doc.go
• api/vpc/v1beta1/ibmvpc_conversion.go
• api/vpc/v1beta1/doc.go
• .golangci-kal.yml

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Disable persisted checkout credentials in the workflow.

actions/checkout keeps credentials by default. For a security-scan workflow, set persist-credentials: false to reduce token exposure risk.

Proposed fix

     - name: Check out code
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
       with:
         ref: ${{ matrix.branch }}
+        persist-credentials: false

🧰 Tools

🪛 zizmor (1.25.2)

[warning] 20-23: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/weekly-security-scan.yaml around lines 20 - 23, The
checkout step named "Check out code" is leaving credentials persisted; update
the actions/checkout@... step (the "uses: actions/checkout" invocation) to
include with: persist-credentials: false so the runner does not keep
GITHUB_TOKEN credentials during this security-scan workflow; keep the existing
ref: ${{ matrix.branch }} and add the persist-credentials: false key alongside
it.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Fix malformed kubebuilder MaxLength markers.

Lines 285, 305, and 312 use +kubebuilder:validation:MaxLength:=... which is invalid syntax. The correct syntax is +kubebuilder:validation:MaxLength=... (without the colon before =). This will cause the validation to be silently ignored during CRD generation.

🔧 Suggested fix

 	// +kubebuilder:validation:MinLength=1
-	// +kubebuilder:validation:MaxLength:=63
+	// +kubebuilder:validation:MaxLength=63
 	// +kubebuilder:validation:Pattern=`^([a-zA-Z]|[a-zA-Z][-_a-zA-Z0-9]*[a-zA-Z0-9])$`
 	// +optional
 	Name *string `json:"name,omitempty"`
...
 	// +kubebuilder:validation:MinLength=1
-	// +kubebuilder:validation:MaxLength:=64
+	// +kubebuilder:validation:MaxLength=64
 	// +kubebuilder:validation:Pattern=`^[-0-9a-z_]+$`
 	// +optional
 	ID *string `json:"id,omitempty"`
...
 	// +kubebuilder:validation:MinLength=1
-	// +kubebuilder:validation:MaxLength:=63
+	// +kubebuilder:validation:MaxLength=63
 	// +kubebuilder:validation:Pattern=`^([a-z]|[a-z][-a-z0-9]*[a-z0-9])$`
 	// +optional
 	Name *string `json:"name,omitempty"`

Also applies to: 304-306, 311-313

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta2/ibmpowervscluster_types.go` around lines 284 - 286, Fix
the malformed kubebuilder tags by replacing every occurrence of
"+kubebuilder:validation:MaxLength:=<n>" with the correct
"+kubebuilder:validation:MaxLength=<n>" in ibmpowervscluster_types.go (i.e.,
remove the stray colon before '=' in the MaxLength markers), update the three
broken annotations that currently read "+kubebuilder:validation:MaxLength:=" so
they match the other kubebuilder markers, and re-generate/validate the CRD
(controller-gen) to confirm the MaxLength validations are now applied.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Enforce mutual exclusivity between image and imageRef.

The comments define imageRef as an alternative to image, but the schema currently allows both. Add CRD validation to reject specs setting both fields.

Proposed fix

 type IBMPowerVSMachineSpec struct {
+	// +kubebuilder:validation:XValidation:rule="!(has(self.image) && has(self.imageRef.name))",message="only one of image or imageRef may be specified"
+
 	// serviceInstance is the reference to the Power VS workspace on which the server instance(VM) will be created.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta3/ibmpowervsmachine_types.go` around lines 65 - 70, Add a
kubebuilder XValidation rule to enforce mutual exclusivity between the Image and
ImageRef fields (so specs cannot set both). Insert a marker (for example above
the containing struct or immediately above the ImageRef field) using
+kubebuilder:validation:XValidation:rule="!((has(self.image) &&
has(self.imageRef)))",message="image and imageRef are mutually exclusive"
referencing the Image (type IBMPowerVSResourceReference) and ImageRef (type
ImageReference) symbols so the CRD rejects objects that set both.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify invalid MaxLength marker syntax occurrences.
rg -n 'kubebuilder:validation:MaxLength:=' api/powervs/v1beta3/types.go

Repository: openshift/cluster-api-provider-ibmcloud

Length of output: 175

---

🌐 Web query:

Kubebuilder validation marker MaxLength syntax +kubebuilder:validation:MaxLength= (and whether := is invalid)

💡 Result:

The correct syntax for the Kubebuilder MaxLength validation marker is: // +kubebuilder:validation:MaxLength=N where N is an integer [1][2]. The marker uses an equals sign (=) to assign the value [2]. Regarding the use of:=, this syntax is invalid for Kubebuilder markers [3][4]. Kubebuilder and controller-gen markers follow specific parsing rules where anonymous markers use the = sign to take a single value [3][4]. The:= operator is a Go short variable declaration syntax and is not recognized within these comment-based markers [3][4]. Using:= will likely result in the marker being ignored or failing to parse correctly, as it does not conform to the expected format for marker-specific configuration [3].

Citations:

• 1: https://book.kubebuilder.io/reference/markers/crd-validation.html
• 2: https://github.com/kubernetes-sigs/controller-tools/blob/master/pkg/crd/markers/validation.go
• 3: https://github.com/kubernetes-sigs/kubebuilder/blob/master/docs/book/src/reference/markers.md
• 4: https://github.com/kubernetes-sigs/kubebuilder/blob/fd63e2b6/docs/book/src/reference/markers.md

---

Fix kubebuilder MaxLength marker syntax (:= -> =).

+kubebuilder:validation:MaxLength:=... is not valid marker syntax; it should be +kubebuilder:validation:MaxLength=... so controller-gen applies the constraint instead of ignoring it.

Proposed fix

-	// +kubebuilder:validation:MaxLength:=63
+	// +kubebuilder:validation:MaxLength=63
@@
-	// +kubebuilder:validation:MaxLength:=64
+	// +kubebuilder:validation:MaxLength=64

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/powervs/v1beta3/types.go` around lines 482 - 488, The kubebuilder
validation markers for MaxLength in types.go are using the invalid ':=' syntax;
update the annotations for the Name field and the id comment to use '=' (e.g.,
change "+kubebuilder:validation:MaxLength:=63" to
"+kubebuilder:validation:MaxLength=63" and
"+kubebuilder:validation:MaxLength:=64" to
"+kubebuilder:validation:MaxLength=64") so controller-gen will apply the
constraints; search for the markers near the Name *string
`json:"name,omitempty"` declaration and the id comment for the subnet to make
the edits.