Sync upstream Cloud API Adaptor v0.21.1

.github/workflows/podvm_mkosi.yaml

@@ -153,11 +153,15 @@ jobs:
         if: ${{ inputs.debug == true }}
         working-directory: src/cloud-api-adaptor/podvm-mkosi
         run: make image-debug
+        env:
+          MKOSI_VERSION: ${{ env.MKOSI_VERSION }}
 
       - name: Build mkosi image
         if: ${{ inputs.debug == false }}
         working-directory: src/cloud-api-adaptor/podvm-mkosi
         run: make image
+        env:
+          MKOSI_VERSION: ${{ env.MKOSI_VERSION }}
 
       - name: Upload the qcow2 with oras
         id: publish_oras_qcow2

.github/workflows/podvm_mkosi_ubuntu.yaml

@@ -77,7 +77,7 @@ permissions: {}
 jobs:
   build-image:
     name: Build mkosi Ubuntu image for ${{ inputs.arch }}
-    runs-on: ${{ inputs.arch == 's390x' && 's390x' || 'ubuntu-24.04' }}
+    runs-on: ${{ inputs.arch == 's390x' && 's390x' || (inputs.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04') }}
     permissions:
       contents: read # Required if we want to run on a fork?
       packages: write # Required to publish the oras package to ghcr
@@ -163,13 +163,15 @@ jobs:
         run: make image-debug
         env:
           PODVM_DISTRO: ubuntu
+          MKOSI_VERSION: ${{ env.MKOSI_VERSION }}
 
       - name: Build mkosi image
         if: ${{ inputs.debug == false }}
         working-directory: src/cloud-api-adaptor/podvm-mkosi
         run: make image
         env:
           PODVM_DISTRO: ubuntu
+          MKOSI_VERSION: ${{ env.MKOSI_VERSION }}
 
       - name: Upload the qcow2 with oras
         id: publish_oras_qcow2

.github/workflows/podvm_publish.yaml

@@ -102,6 +102,7 @@ jobs:
       packages: write # Required to publish the oras package to ghcr
       id-token: write # Required to publish the attestation provenance to ghcr
       attestations: write # Required to publish the attestation provenance to ghcr
+      artifact-metadata: write # Required by podvm_mkosi_ubuntu.yaml to write attestation metadata
     strategy:
       fail-fast: false
       matrix:

.github/workflows/podvm_smoketest.yaml

@@ -97,8 +97,8 @@ jobs:
         working-directory: src/cloud-api-adaptor
         run: |
           {
-            echo "KATA_REF=$(yq -e '.oci.kata-agent-ctl.reference' versions.yaml)";
-            echo "KATA_REG=$(yq -e '.oci.kata-agent-ctl.registry' versions.yaml)";
+            echo "KATA_REF=$(yq -e '.oci.kata-containers.reference' versions.yaml)";
+            echo "KATA_REG=$(yq -e '.oci.kata-containers.registry' versions.yaml)";
           } >> "$GITHUB_ENV"
 
       - name: Install kata-agent-ctl

.github/workflows/podvm_smoketest_ubuntu.yaml

@@ -123,8 +123,8 @@ jobs:
         run: |
           {
             echo "ORAS_VERSION=$(./hack/versions.py -q tools.oras)";
-            echo "KATA_AGENT_CTL_REF=$(./hack/versions.py -q oci.kata-agent-ctl.reference)";
-            echo "KATA_AGENT_CTL_REG=$(./hack/versions.py -q oci.kata-agent-ctl.registry)";
+            echo "KATA_REF=$(./hack/versions.py -q oci.kata-containers.reference)";
+            echo "KATA_REG=$(./hack/versions.py -q oci.kata-containers.registry)";
           } >> "$GITHUB_ENV"
 
       - uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2.0.0
@@ -133,7 +133,7 @@ jobs:
 
       - name: Install kata-agent-ctl
         run: |
-          oras pull "${KATA_AGENT_CTL_REG}/agent-ctl:${KATA_AGENT_CTL_REF}-x86_64"
+          oras pull "${KATA_REG}/agent-ctl:${KATA_REF}-x86_64"
           tar --zstd -xf kata-static-agent-ctl.tar.zst
           cp opt/kata/bin/kata-agent-ctl /usr/local/bin
 

.github/workflows/zizmor.yaml

@@ -28,6 +28,6 @@ jobs:
         fetch-depth: 0
 
     - name: Run zizmor
-      uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+      uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
       with:
         persona: auditor

src/cloud-api-adaptor/Dockerfile

@@ -1,9 +1,9 @@
 ARG BUILD_TYPE=dev
-# golang:1.25.11 (based on Debian 13 trixie)
-ARG BUILDER_BASE=golang@sha256:f188e8c16ea47a8b22d2bdcf6d9bcd07b63ea7876c199749c07bf31e0ab33bad
-# debian:trixie-slim (matches golang:1.25.11 base for library compatibility)
+# golang:1.25.12 (based on Debian 13 trixie)
+ARG BUILDER_BASE=golang@sha256:d7912cedddfa15b2900a8dfb7187df0af5ec2cb424a371139b5b352fd3e6b740
+# debian:trixie-slim (matches golang:1.25.12 base for library compatibility)
 # Multi-arch manifest list digest supporting amd64, arm64, ppc64le,, s390x
-ARG BASE=debian@sha256:109e2c65005bf160609e4ba6acf7783752f8502ad218e298253428690b9eaa4b
+ARG BASE=debian@sha256:28de0877c2189802884ccd20f15ee41c203573bd87bb6b883f5f46362d24c5c2
 
 # This dockerfile uses Go cross-compilation to build the binary,
 # we build on the host platform ($BUILDPLATFORM) and then copy the

src/cloud-api-adaptor/byom/e2e/kind_cluster.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+
+# Ref: https://stackoverflow.com/questions/299728/how-do-you-use-newgrp-in-a-script-then-stay-in-that-group-when-the-script-exits
+newgrp docker <<EOF
+
+# Accept two arguments: create and delete
+# create: creates a kind cluster
+# delete: deletes a kind cluster
+
+CLUSTER_NAME="${CLUSTER_NAME:-peer-pods}"
+KIND_CONFIG_FILE="${KIND_CONFIG_FILE:-kind-config.yaml}"
+
+if [ "$1" == "create" ]; then
+    # Check if kind is installed
+    if [ ! -x "$(command -v kind)" ]; then
+        echo "kind is not installed"
+        exit 0
+    fi
+    echo "Check if the cluster \$CLUSTER_NAME already exists"
+    if kind get clusters | grep -q "\$CLUSTER_NAME"; then
+        echo "Cluster \$CLUSTER_NAME already exists"
+        exit 0
+    fi
+    # Set some sysctls
+    # Ref: https://kind.sigs.k8s.io/docs/user/known-issues/#pod-errors-due-to-too-many-open-files
+    sudo sysctl fs.inotify.max_user_watches=524288
+    sudo sysctl fs.inotify.max_user_instances=512
+
+    # Create a kind cluster
+    echo "runtime: " "\$CONTAINER_RUNTIME"
+
+    # Create a kind cluster
+    echo "Creating a kind cluster"
+    kind create cluster --name "\$CLUSTER_NAME" --config "\$KIND_CONFIG_FILE" || exit 1
+
+    # Deploy calico
+    kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.0/manifests/calico.yaml || exit 1
+
+    exit 0
+fi
+
+if [ "$1" == "delete" ]; then
+    # Check if kind is installed
+    if [ ! -x "$(command -v kind)" ]; then
+        echo "kind is not installed"
+        exit 0
+    fi
+
+    # Delete the kind cluster
+    echo "Deleting the kind cluster"
+    kind delete cluster --name "\$CLUSTER_NAME" || exit 1
+
+    exit 0
+fi
+EOF

src/cloud-api-adaptor/docs/addnewprovider.md

@@ -219,8 +219,8 @@ go mod tidy
 
 ```bash
 cat > Dockerfile <<EOF
-# golang:1.25.11
-ARG BUILDER_BASE=golang@sha256:f188e8c16ea47a8b22d2bdcf6d9bcd07b63ea7876c199749c07bf31e0ab33bad
+# golang:1.25.12
+ARG BUILDER_BASE=golang@sha256:d7912cedddfa15b2900a8dfb7187df0af5ec2cb424a371139b5b352fd3e6b740
 FROM --platform="\$TARGETPLATFORM" \$BUILDER_BASE AS builder
 RUN apt-get update && apt-get install -y libvirt-dev pkg-config && rm -rf /var/lib/apt/lists/*
 WORKDIR /work