Repository: kubernetes-sigs/cluster-api (go)

Issue:
Cert manager raises "Certificate will be issued with an empty Issuer DN" warning
While debugging 5248 with tilt I noticed  following events generated by cert-manager

```
[K8s EVENT: CertificateRequest capi-kubeadm-bootstrap-serving-cert-ffg5p (ns: capi-kubeadm-bootstrap-system)] Certificate will be issued with an empty Issuer DN, which contravenes RFC 5280 and could break some strict clients
[K8s EVENT: CertificateRequest capd-serving-cert-wbgbj (ns: capd-system)] Certificate will be issued with an empty Issuer DN, which contravenes RFC 5280 and could break some strict clients
[K8s EVENT: CertificateRequest capi-serving-cert-mn8zx (ns: capi-system)] Certificate will be issued with an empty Issuer DN, which contravenes RFC 5280 and could break some strict clients
[K8s EVENT: CertificateRequest capi-kubeadm-control-plane-serving-cert-pvh4v (ns: capi-kubeadm-control-plane-system)] Certificate will be issued with an empty Issuer DN, which contravenes RFC 5280 and could break some strict clients
```

Digging a little bit those warning were added by https://github.com/jetstack/cert-manager/pull/3760, and the explanation of the underlying problem can be found in https://cert-manager.io/docs/configuration/selfsigned/#certificate-validity

According to the above doc, possible  solution could be to add

```
  subject:
    organizations:
      - cluster-api
```

To our certificates

/kind bug
 


Pull request:
🌱 add organizations to certificates
<!-- please add a icon to the title of this PR (see https://sigs.k8s.io/cluster-api/VERSIONING.md), and delete this line and similar ones -->
<!-- the icon will be either ⚠️ (:warning:, major or breaking changes), ✨ (:sparkles:, feature additions), 🐛 (:bug:, patch and bugfixes), 📖 (:book:, documentation or proposals), or 🌱 (:seedling:, minor or other) -->

**What this PR does / why we need it**:
Adds organizations to certificates to remove the following errors that are observed during `tilt up`.
```
[K8s EVENT: CertificateRequest capi-kubeadm-bootstrap-serving-cert-rr6c4 (ns: capi-kubeadm-bootstrap-system)] Certificate will be issued with an empty Issuer DN, which contravenes RFC 5280 and could break some strict clients
[K8s EVENT: CertificateRequest capi-serving-cert-n2fh6 (ns: capi-system)] Certificate will be issued with an empty Issuer DN, which contravenes RFC 5280 and could break some strict clients
[K8s EVENT: CertificateRequest capd-serving-cert-hmjpt (ns: capd-system)] Certificate will be issued with an empty Issuer DN, which contravenes RFC 5280 and could break some strict clients
[K8s EVENT: CertificateRequest capi-kubeadm-control-plane-serving-cert-4grqr (ns: capi-kubeadm-control-plane-system)] Certificate will be issued with an empty Issuer DN, which contravenes RFC 5280 and could break some strict clients

```

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #5257


Patch:
diff --git a/bootstrap/kubeadm/config/certmanager/certificate.yaml b/bootstrap/kubeadm/config/certmanager/certificate.yaml
index 1bcfdedf2..d53b0e8e9 100644
--- a/bootstrap/kubeadm/config/certmanager/certificate.yaml
+++ b/bootstrap/kubeadm/config/certmanager/certificate.yaml
@@ -23,3 +23,6 @@ spec:
     kind: Issuer
     name: selfsigned-issuer
   secretName: $(SERVICE_NAME)-cert # this secret will not be prefixed, since it's not managed by kustomize
+  subject:
+    organizations:
+      - k8s-sig-cluster-lifecycle
\ No newline at end of file
diff --git a/cmd/clusterctl/cmd/upgrade_apply.go b/cmd/clusterctl/cmd/upgrade_apply.go
index 6dbc7be04..2a01c9628 100644
--- a/cmd/clusterctl/cmd/upgrade_apply.go
+++ b/cmd/clusterctl/cmd/upgrade_apply.go
@@ -86,9 +86,6 @@ func runUpgradeApply() error {
 		(len(ua.controlPlaneProviders) > 0) ||
 		(len(ua.infrastructureProviders) > 0)
 
-	if ua.contract == "" && !hasProviderNames {
-		return errors.New("Either the --contract flag or at least one of the following flags has to be set: --core, --bootstrap, --control-plane, --infrastructure")
-	}
 	if ua.contract != "" && hasProviderNames {
 		return errors.New("The --contract flag can't be used in combination with --core, --bootstrap, --control-plane, --infrastructure")
 	}
diff --git a/config/certmanager/certificate.yaml b/config/certmanager/certificate.yaml
index abf6713a7..b1ae09af5 100644
--- a/config/certmanager/certificate.yaml
+++ b/config/certmanager/certificate.yaml
@@ -22,3 +22,6 @@ spec:
     kind: Issuer
     name: selfsigned-issuer
   secretName: $(SERVICE_NAME)-cert # this secret will not be prefixed, since it's not managed by kustomize
+  subject:
+    organizations:
+      - k8s-sig-cluster-lifecycle
\ No newline at end of file
diff --git a/controlplane/kubeadm/config/certmanager/certificate.yaml b/controlplane/kubeadm/config/certmanager/certificate.yaml
index 1bcfdedf2..d53b0e8e9 100644
--- a/controlplane/kubeadm/config/certmanager/certificate.yaml
+++ b/controlplane/kubeadm/config/certmanager/certificate.yaml
@@ -23,3 +23,6 @@ spec:
     kind: Issuer
     name: selfsigned-issuer
   secretName: $(SERVICE_NAME)-cert # this secret will not be prefixed, since it's not managed by kustomize
+  subject:
+    organizations:
+      - k8s-sig-cluster-lifecycle
\ No newline at end of file
diff --git a/docs/book/src/SUMMARY.md b/docs/book/src/SUMMARY.md
index 350947524..48f03a430 100644
--- a/docs/book/src/SUMMARY.md
+++ b/docs/book/src/SUMMARY.md
@@ -18,7 +18,6 @@
     - [Experimental Features](./tasks/experimental-features/experimental-features.md)
         - [MachinePools](./tasks/experimental-features/machine-pools.md)
         - [ClusterResourceSet](./tasks/experimental-features/cluster-resource-set.md)
-        - [ClusterClass](./tasks/experimental-features/cluster-classes.md)
 - [clusterctl CLI](./clusterctl/overview.md)
     - [clusterctl Commands](clusterctl/commands/commands.md)
         - [init](clusterctl/commands/init.md)
diff --git a/docs/book/src/clusterctl/developers.md b/docs/book/src/clusterctl/developers.md
index 740d9fd09..f0b2af97d 100644
--- a/docs/book/src/clusterctl/developers.md
+++ b/docs/book/src/clusterctl/developers.md
@@ -36,13 +36,15 @@ If you want to create a local artifact, follow these instructions:
 In order to build artifacts for the CAPI core provider, the kubeadm bootstrap provider and the kubeadm control plane provider:
 
 ```
-make docker-build REGISTRY=gcr.io/k8s-staging-cluster-api PULL_POLICY=IfNotPresent
+make docker-build REGISTRY=gcr.io/k8s-staging-cluster-api
+make generate-manifests REGISTRY=gcr.io/k8s-staging-cluster-api PULL_POLICY=IfNotPresent
 ```
 
 In order to build docker provider artifacts
 
 ```
-make -C test/infrastructure/docker docker-build REGISTRY=gcr.io/k8s-staging-cluster-api PULL_POLICY=IfNotPresent
+make -C test/infrastructure/docker docker-build REGISTRY=gcr.io/k8s-staging-cluster-api
+make -C test/infrastructure/docker generate-manifests REGISTRY=gcr.io/k8s-staging-cluster-api PULL_POLICY=IfNotPresent
 ```
 
 ### Create a clusterctl-settings.json file
@@ -175,9 +177,9 @@ cert-manager                        cert-manager-webhook
 When selecting the `--kubernetes-version`, ensure that the `kindest/node`
 image is available.
 
-For example, assuming that on [docker hub][kind-docker-hub] there is no
-image for version `vX.Y.Z`, therefore creating a CAPD workload cluster with
-`--kubernetes-version=vX.Y.Z` will fail. See [issue 3795] for more details.
+For example, on [docker hub][kind-docker-hub] there is no
+image for version `v1.21.2`, therefore creating a CAPD workload cluster with
+`--kubernetes-version=v1.21.2` will fail. See [issue 3795] for more details.
 
 ### Get the kubeconfig for the workload cluster
 
diff --git a/docs/book/src/developer/providers/v1alpha4-to-v1beta1.md b/docs/book/src/developer/providers/v1alpha4-to-v1beta1.md
index 8c07b737a..683558d5b 100644
--- a/docs/book/src/developer/providers/v1alpha4-to-v1beta1.md
+++ b/docs/book/src/developer/providers/v1alpha4-to-v1beta1.md
@@ -22,6 +22,10 @@ The core ClusterAPI providers will support upgrade from v1alpha3 **and** v1alpha
 from v1alpha3 and v1alpha4 to v1beta1 have been implemented. If other providers also want to support the upgrade from v1alpha3 **and**
 v1alpha4, the same conversions have to be implemented.
 
+## Certificates
+
+The `serving-cert` certificates now have organization set to `k8s-sig-cluster-lifecycle`.
+
 ## Removed items
 
 ### API Fields 
diff --git a/docs/book/src/tasks/experimental-features/cluster-classes.md b/docs/book/src/tasks/experimental-features/cluster-classes.md
deleted file mode 100644
index 12e523802..000000000
--- a/docs/book/src/tasks/experimental-features/cluster-classes.md
+++ /dev/null
@@ -1,204 +0,0 @@
-# ClusterClass
-
-The ClusterClass feature introduces a new way to create clusters which reduces boilerplate and enables flexible and powerful customization of clusters.
-ClusterClass is a powerful abstraction implemented on top of existing interfaces and offering a set of tools and operations to streamline cluster lifecycle management while maintaining the same underlying API.
-
-This tutorial covers using Cluster API and ClusterClass to create a Kubernetes cluster and how to perform a one-touch Kubernetes version upgrade.
-
-<aside class="note warning">
-
-<h1>Note</h1>
-
-This guide only covers creating a ClusterClass cluster with the CAPD provider.
-</aside>
-
-## Installation
-
-### Prerequisites
-
-#### Install tools
-
-This guide requires the following tools are installed: 
-- Install and setup [kubectl] and [clusterctl]
-- Install [Kind] and [Docker]
-
-#### Enable experimental features
-
-ClusterClass is currently behind a feature gate that needs to be enabled.
-This tutorial will also use another experimental gated feature - Cluster Resource Set. This is not required for ClusterClass to work but is used in this tutorial to set up networking.
-
-To enable these features set the respective environment variables by running:
-```bash
-export EXP_CLUSTER_RESOURCE_SET=true
-export CLUSTER_TOPOLOGY=true
-```
-This ensures that the Cluster Topology and Cluster Resource Set features are enabled when the providers are initialized.
-
-
-#### Create a CAPI management cluster
-
-A script to set up a Kind cluster pre-configured for CAPD (the docker infrastructure provider) can be found in the [hack folder of the core repo](https://raw.githubusercontent.com/kubernetes-sigs/cluster-api/main/hack/kind-install-for-capd.sh). 
-
-To set up the cluster from the root of the repo run:
-```bash
-./hack/kind-install-for-capd.sh
-clusterctl init --infrastructure docker
-````
-
-### Create a new Cluster using ClusterClass
-
-#### Create the ClusterClass and templates
-
-With a management Cluster with CAPD initialized and the Cluster Topology feature gate enabled, the next step is to create the ClusterClass and its referenced templates.
-The ClusterClass - first in the yaml below - contains references to the templates needed to build a full cluster, defining a shape that can be re-used for any number of clusters.
-* ClusterClass
-* For the InfrastructureCluster:
-  * DockerClusterTemplate
-* For the ControlPlane:
-  * KubeadmControlPlaneTemplate
-  * DockerMachineTemplate 
-* For the worker nodes:
-  * DockerMachineTemplate
-  * KubeadmConfigTemplate
-
-The full ClusterClass definition can also be found in the [CAPI repo](https://raw.githubusercontent.com/kubernetes-sigs/cluster-api/main/docs/book/src/tasks/yamls/clusterclass.yaml).
-
-<details><summary>ClusterClass</summary>
-
-```yaml
-{{#include ./yamls/clusterclass.yaml}}
-```
-
-</details>
-
-
-To create the objects on your local cluster run:
-
-```bash
-kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/cluster-api/main/docs/book/src/tasks/yamls/clusterclass.yaml 
-```
-
-#### Enable networking for workload clusters
-
-To make sure workload clusters come up with a functioning network a Kindnet ConfigMap with a Kindnet ClusterResourceSet is required. Kindnet only offers networking for Clusters built with Kind and CAPD. This can be substituted for any other networking solution for Kubernetes e.g. Calico as used in the Quickstart guide.
-
-The kindnet configuration file can be found in the [CAPI repo](https://raw.githubusercontent.com/kubernetes-sigs/cluster-api/main/docs/book/src/tasks/yamls/clusterclass.yaml).
-
-To create the resources run:
-```bash
-kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/cluster-api/main/docs/book/src/tasks/yamls/kindnet-clusterresourceset.yaml 
-```
-
-#### Create the workload cluster
-
-This is a Cluster definition that leverages the ClusterClass created above to define its shape.
-
-<details><summary>Cluster</summary>
-
-```yaml
-{{#include ./yamls/clusterclass-quickstart.yaml}}
-```
-</details>
-
-Create the Cluster object from the file in [the CAPI repo](https://raw.githubusercontent.com/kubernetes-sigs/cluster-api/main/docs/book/src/tasks/yamls/clusterclass-quickstart.yaml) with:
-
-```bash
-kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/cluster-api/main/docs/book/src/tasks/yamls/clusterclass-quickstart.yaml
-```
-
-#### Verify the workload cluster is running
-
-The cluster will now start provisioning. You can check status with:
-
-```bash
-kubectl get cluster
-```
-
-Get a view of the cluster and its resources as they are created by running:
-
-```bash
-clusterctl describe cluster clusterclass-quickstart
-```
-
-To verify the control plane is up:
-
-```bash
-kubectl get kubeadmcontrolplane
-```
-
-The output should be similar to:
-
-```bash
-NAME                                    INITIALIZED   API SERVER AVAILABLE   VERSION   REPLICAS   READY   UPDATED   UNAVAILABLE
-clusterclass-quickstart                 true                                 v1.21.2   1                  1         1
-```
-
-
-## Upgrade a Cluster using Managed Topology
-
-The `spec.topology` field added to the Cluster object as part of ClusterClass allows changes made on the Cluster to be propagated across all relevant objects. This turns a Kubernetes cluster upgrade into a one-touch operation.
-Looking at the newly-created cluster, the version of the control plane and the machine deployments is v1.21.2.
-
-```bash
-> kubectl get kubeadmcontrolplane,machinedeployments
-
-NAME                                                                              CLUSTER                   INITIALIZED   API SERVER AVAILABLE   REPLICAS   READY   UPDATED   UNAVAILABLE   AGE     VERSION
-kubeadmcontrolplane.controlplane.cluster.x-k8s.io/clusterclass-quickstart-XXXX    clusterclass-quickstart   true          true                   1          1       1         0             2m21s   v1.21.2
-
-NAME                                                                             CLUSTER                   REPLICAS   READY   UPDATED   UNAVAILABLE   PHASE     AGE     VERSION
-machinedeployment.cluster.x-k8s.io/clusterclass-quickstart-linux-workers-XXXX    clusterclass-quickstart   1          1       1         0             Running   2m21s   v1.21.2
-
-```
-
-To update the Cluster the only change needed is to the `version` field under `spec.topology` in the Cluster object.
-
-
-Change `1.21.2` to `1.22.0` as below. 
-```bash
-kubectl patch cluster clusterclass-quickstart --type json --patch '[{"op": "replace", "path": "/spec/topology/version", "value": "v1.22.0"}]'
-```
-
-The upgrade will take some time to roll out as it will take place machine by machine with older versions of the machines only being removed after healthy newer versions come online.
-
-To watch the update progress run:
-```bash
-watch kubectl get kubeadmcontrolplane,machinedeployments
-```
-After a few minutes the upgrade will be complete and the output will be similar to:
-```bash
-NAME                                                                              CLUSTER                   INITIALIZED   API SERVER AVAILABLE   REPLICAS   READY   UPDATED   UNAVAILABLE   AGE     VERSION
-kubeadmcontrolplane.controlplane.cluster.x-k8s.io/clusterclass-quickstart-XXXX    clusterclass-quickstart   true          true                   1          1       1         0             7m29s   v1.22.0
-
-NAME                                                                             CLUSTER                   REPLICAS   READY   UPDATED   UNAVAILABLE   PHASE     AGE     VERSION
-machinedeployment.cluster.x-k8s.io/clusterclass-quickstart-linux-workers-XXXX    clusterclass-quickstart   1          1       1         0             Running   7m29s   v1.22.0
-```
-
-## Clean Up
-
-Delete workload cluster.
-```bash
-kubectl delete cluster clusterclass-quickstart
-```
-<aside class="note warning">
-
-IMPORTANT: In order to ensure a proper cleanup of your infrastructure you must always delete the cluster object. Deleting the entire cluster template with `kubectl delete -f clusterclass-quickstart.yaml` might lead to pending resources to be cleaned up manually.
-</aside>
-
-Delete management cluster
-```bash
-kind delete clusters capi-test
-```
-
-<!-- links -->
-[quick start guide]: ../../user/quick-start.md
-[bootstrap cluster]: ../../reference/glossary.md#bootstrap-cluster
-[clusterctl]: ../../user/quick-start.md#install-clusterctl
-[Docker]: https://www.docker.com/
-[infrastructure provider]: ../../reference/glossary.md#infrastructure-provider
-[kind]: https://kind.sigs.k8s.io/
-[KubeadmControlPlane]: ../../developer/architecture/controllers/control-plane.md
-[kubectl]: https://kubernetes.io/docs/tasks/tools/install-kubectl/
-[management cluster]: ../../reference/glossary.md#management-cluster
-[provider]:../../reference/providers.md
-[provider components]: ../../reference/glossary.md#provider-components
-[workload cluster]: ../../reference/glossary.md#workload-cluster
diff --git a/docs/book/src/tasks/experimental-features/experimental-features.md b/docs/book/src/tasks/experimental-features/experimental-features.md
index e5076b9ca..901e4082e 100644
--- a/docs/book/src/tasks/experimental-features/experimental-features.md
+++ b/docs/book/src/tasks/experimental-features/experimental-features.md
@@ -76,7 +76,6 @@ Similarly, to **validate** if a particular feature is enabled, see cluster-api-p
 
 * [MachinePools](./machine-pools.md)
 * [ClusterResourceSet](./cluster-resource-set.md)
-* [ClusterClass](./cluster-classes.md)
 
 **Warning**: Experimental features are unreliable, i.e., some may one day be promoted to the main repository, or they may be modified arbitrarily or even disappear altogether.
 In short, they are not subject to any compatibility or deprecation promise.
diff --git a/docs/book/src/tasks/experimental-features/yamls/clusterclass-quickstart.yaml b/docs/book/src/tasks/experimental-features/yamls/clusterclass-quickstart.yaml
deleted file mode 100644
index bb813cb67..000000000
--- a/docs/book/src/tasks/experimental-features/yamls/clusterclass-quickstart.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-apiVersion: cluster.x-k8s.io/v1beta1
-kind: Cluster
-metadata:
-  name: "clusterclass-quickstart"
-  namespace: default
-  labels:
-    cni: kindnet
-spec:
-  clusterNetwork:
-    services:
-      cidrBlocks: ["10.128.0.0/12"]
-    pods:
-      cidrBlocks: ["192.168.0.0/16"]
-    serviceDomain: "cluster.local"
-  topology:
-    class: clusterclass
-    version: v1.21.2
-    controlPlane:
-      replicas: 1
-    workers:
-      machineDeployments:
-        - class: linux-worker
-          name: linux-workers
-          replicas: 1
diff --git a/docs/book/src/tasks/experimental-features/yamls/clusterclass.yaml b/docs/book/src/tasks/experimental-features/yamls/clusterclass.yaml
deleted file mode 100644
index dcbd5e5a9..000000000
--- a/docs/book/src/tasks/experimental-features/yamls/clusterclass.yaml
+++ /dev/null
@@ -1,118 +0,0 @@
-apiVersion: cluster.x-k8s.io/v1beta1
-kind: ClusterClass
-metadata:
-  name: clusterclass
-  namespace: default
-spec:
-  controlPlane:
-    metadata:
-    ref:
-      apiVersion: controlplane.cluster.x-k8s.io/v1beta1
-      kind: KubeadmControlPlaneTemplate
-      name: clusterclass-control-plane
-      namespace: default
-    machineInfrastructure:
-      ref:
-        kind: DockerMachineTemplate
-        apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
-        name: "clusterclass-control-plane"
-        namespace: default
-  infrastructure:
-    ref:
-      apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
-      kind: DockerClusterTemplate
-      name: clusterclass-infrastructure
-      namespace: default
-  workers:
-    machineDeployments:
-      - class: linux-worker
-        template:
-          metadata:
-          bootstrap:
-            ref:
-              kind: KubeadmConfigTemplate
-              apiVersion: bootstrap.cluster.x-k8s.io/v1beta1
-              name: "clusterclass-md-1"
-          infrastructure:
-            ref:
-              kind: DockerMachineTemplate
-              apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
-              name: "clusterclass-md-1"
-
----
-
-apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
-kind: DockerClusterTemplate
-metadata:
-  name: clusterclass-infrastructure
-  namespace: default
----
-kind: KubeadmControlPlaneTemplate
-apiVersion: controlplane.cluster.x-k8s.io/v1beta1
-metadata:
-  name: "clusterclass-control-plane"
-  namespace: default
-spec:
-  template:
-    spec:
-      replicas: 1
-      machineTemplate:
-        infrastructureRef:
-          kind: DockerMachineTemplate
-          apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
-          name: "clusterclass-control-plane"
-          namespace: default
-      kubeadmConfigSpec:
-        clusterConfiguration:
-          controllerManager:
-            extraArgs: { enable-hostpath-provisioner: 'true' }
-          apiServer:
-            certSANs: [ localhost, 127.0.0.1 ]
-        initConfiguration:
-          nodeRegistration:
-            criSocket: /var/run/containerd/containerd.sock
-            kubeletExtraArgs:
-              cgroup-driver: cgroupfs
-              eviction-hard: 'nodefs.available<0%,nodefs.inodesFree<0%,imagefs.available<0%'
-        joinConfiguration:
-          nodeRegistration:
-            criSocket: /var/run/containerd/containerd.sock
-            kubeletExtraArgs:
-              cgroup-driver: cgroupfs
-              eviction-hard: 'nodefs.available<0%,nodefs.inodesFree<0%,imagefs.available<0%'
-      version: v1.21.2
----
-apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
-kind: DockerMachineTemplate
-metadata:
-  name: "clusterclass-control-plane"
-  namespace: default
-spec:
-  template:
-    spec:
-      extraMounts:
-        - containerPath: "/var/run/docker.sock"
-          hostPath: "/var/run/docker.sock"
----
-apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
-kind: DockerMachineTemplate
-metadata:
-  name: "clusterclass-md-1"
-  namespace: default
-spec:
-  template:
-    spec: { }
----
-apiVersion: bootstrap.cluster.x-k8s.io/v1beta1
-kind: KubeadmConfigTemplate
-metadata:
-  name: "clusterclass-md-1"
-  namespace: default
-spec:
-  template:
-    spec:
-      joinConfiguration:
-        nodeRegistration:
-          kubeletExtraArgs:
-            cgroup-driver: cgroupfs
-            eviction-hard: 'nodefs.available<0%,nodefs.inodesFree<0%,imagefs.available<0%'
diff --git a/docs/book/src/tasks/experimental-features/yamls/kindnet-clusterresourceset.yaml b/docs/book/src/tasks/experimental-features/yamls/kindnet-clusterresourceset.yaml
deleted file mode 100644
index b3d326411..000000000
--- a/docs/book/src/tasks/experimental-features/yamls/kindnet-clusterresourceset.yaml
+++ /dev/null
@@ -1,131 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kindnet
-data:
-  kindnet: |
-    # kindnetd networking manifest
-    ---
-    kind: ClusterRole
-    apiVersion: rbac.authorization.k8s.io/v1
-    metadata:
-      name: kindnet
-    rules:
-      - apiGroups:
-          - policy
-        resources:
-          - podsecuritypolicies
-        verbs:
-          - use
-        resourceNames:
-          - kindnet
-      - apiGroups:
-          - ""
-        resources:
-          - nodes
-        verbs:
-          - list
-          - watch
-    ---
-    kind: ClusterRoleBinding
-    apiVersion: rbac.authorization.k8s.io/v1
-    metadata:
-      name: kindnet
-    roleRef:
-      apiGroup: rbac.authorization.k8s.io
-      kind: ClusterRole
-      name: kindnet
-    subjects:
-      - kind: ServiceAccount
-        name: kindnet
-        namespace: kube-system
-    ---
-    apiVersion: v1
-    kind: ServiceAccount
-    metadata:
-      name: kindnet
-      namespace: kube-system
-    ---
-    apiVersion: apps/v1
-    kind: DaemonSet
-    metadata:
-      name: kindnet
-      namespace: kube-system
-      labels:
-        tier: node
-        app: kindnet
-        k8s-app: kindnet
-    spec:
-      selector:
-        matchLabels:
-          app: kindnet
-      template:
-        metadata:
-          labels:
-            tier: node
-            app: kindnet
-            k8s-app: kindnet
-        spec:
-          hostNetwork: true
-          tolerations:
-            - operator: Exists
-              effect: NoSchedule
-          serviceAccountName: kindnet
-          containers:
-            - name: kindnet-cni
-              image: kindest/kindnetd:0.5.4
-              env:
-                - name: HOST_IP
-                  valueFrom:
-                    fieldRef:
-                      fieldPath: status.hostIP
-                - name: POD_IP
-                  valueFrom:
-                    fieldRef:
-                      fieldPath: status.podIP
-                - name: POD_SUBNET
-                  value: '${DOCKER_POD_CIDRS}'
-              volumeMounts:
-                - name: cni-cfg
-                  mountPath: /etc/cni/net.d
-                - name: xtables-lock
-                  mountPath: /run/xtables.lock
-                  readOnly: false
-                - name: lib-modules
-                  mountPath: /lib/modules
-                  readOnly: true
-              resources:
-                requests:
-                  cpu: "100m"
-                  memory: "50Mi"
-                limits:
-                  cpu: "100m"
-                  memory: "50Mi"
-              securityContext:
-                privileged: false
-                capabilities:
-                  add: ["NET_RAW", "NET_ADMIN"]
-          volumes:
-            - name: cni-cfg
-              hostPath:
-                path: /etc/cni/net.d
-            - name: xtables-lock
-              hostPath:
-                path: /run/xtables.lock
-                type: FileOrCreate
-            - name: lib-modules
-              hostPath:
-                path: /lib/modules
----
-apiVersion: addons.cluster.x-k8s.io/v1beta1
-kind: ClusterResourceSet
-metadata:
-  name: cni
-spec:
-  strategy: ApplyOnce
-  clusterSelector:
-    matchLabels:
-      cni: kindnet
-  resources:
-    - name: kindnet
-      kind: ConfigMap
diff --git a/go.mod b/go.mod
index 6a83ddf22..63180ed4a 100644
--- a/go.mod
+++ b/go.mod
@@ -38,6 +38,6 @@ require (
 	k8s.io/klog/v2 v2.9.0
 	k8s.io/kubectl v0.21.4
 	k8s.io/utils v0.0.0-20210819203725-bdf08cb9a70a
-	sigs.k8s.io/controller-runtime v0.10.2
+	sigs.k8s.io/controller-runtime v0.10.1
 	sigs.k8s.io/yaml v1.2.0
 )
diff --git a/go.sum b/go.sum
index ab7aee5c6..9adc754a6 100644
--- a/go.sum
+++ b/go.sum
@@ -1125,8 +1125,8 @@ rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.22/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
-sigs.k8s.io/controller-runtime v0.10.2 h1:jW8qiY+yMnnPx6O9hu63tgcwaKzd1yLYui+mpvClOOc=
-sigs.k8s.io/controller-runtime v0.10.2/go.mod h1:CQp8eyUQZ/Q7PJvnIrB6/hgfTC1kBkGylwsLgOQi1WY=
+sigs.k8s.io/controller-runtime v0.10.1 h1:+eLHgY/VrJWnfg6iXUqhCUqNXgPH1NZeP9drNAAgWlg=
+sigs.k8s.io/controller-runtime v0.10.1/go.mod h1:CQp8eyUQZ/Q7PJvnIrB6/hgfTC1kBkGylwsLgOQi1WY=
 sigs.k8s.io/kustomize/api v0.8.8/go.mod h1:He1zoK0nk43Pc6NlV085xDXDXTNprtcyKZVm3swsdNY=
 sigs.k8s.io/kustomize/cmd/config v0.9.10/go.mod h1:Mrby0WnRH7hA6OwOYnYpfpiY0WJIMgYrEDfwOeFdMK0=
 sigs.k8s.io/kustomize/kustomize/v4 v4.1.2/go.mod h1:PxBvo4WGYlCLeRPL+ziT64wBXqbgfcalOS/SXa/tcyo=


Test patch:
diff --git a/test/e2e/clusterctl_upgrade.go b/test/e2e/clusterctl_upgrade.go
index 3d86580a8..ed822a25f 100644
--- a/test/e2e/clusterctl_upgrade.go
+++ b/test/e2e/clusterctl_upgrade.go
@@ -53,22 +53,20 @@ const (
 
 // ClusterctlUpgradeSpecInput is the input for ClusterctlUpgradeSpec.
 type ClusterctlUpgradeSpecInput struct {
-	E2EConfig                 *clusterctl.E2EConfig
-	ClusterctlConfigPath      string
-	BootstrapClusterProxy     framework.ClusterProxy
-	ArtifactFolder            string
-	InitWithBinary            string
-	InitWithProvidersContract string
-	SkipCleanup               bool
-	PreUpgrade                func(managementClusterProxy framework.ClusterProxy)
-	PostUpgrade               func(managementClusterProxy framework.ClusterProxy)
-	MgmtFlavor                string
-	WorkloadFlavor            string
+	E2EConfig             *clusterctl.E2EConfig
+	ClusterctlConfigPath  string
+	BootstrapClusterProxy framework.ClusterProxy
+	ArtifactFolder        string
+	SkipCleanup           bool
+	PreUpgrade            func(managementClusterProxy framework.ClusterProxy)
+	PostUpgrade           func(managementClusterProxy framework.ClusterProxy)
+	MgmtFlavor            string
+	WorkloadFlavor        string
 }
 
 // ClusterctlUpgradeSpec implements a test that verifies clusterctl upgrade of a management cluster.
 //
-// NOTE: this test is designed to test older versions of Cluster API --> v1beta1 upgrades.
+// NOTE: this test is designed to test v1alpha3 --> v1alpha4 upgrades.
 func ClusterctlUpgradeSpec(ctx context.Context, inputGetter func() ClusterctlUpgradeSpecInput) {
 	var (
 		specName = "clusterctl-upgrade"
@@ -78,7 +76,6 @@ func ClusterctlUpgradeSpec(ctx context.Context, inputGetter func() ClusterctlUpg
 		testCancelWatches context.CancelFunc
 
 		managementClusterName          string
-		clusterctlBinaryURL            string
 		managementClusterNamespace     *corev1.Namespace
 		managementClusterCancelWatches context.CancelFunc
 		managementClusterResources     *clusterctl.ApplyClusterTemplateAndWaitResult
@@ -93,16 +90,8 @@ func ClusterctlUpgradeSpec(ctx context.Context, inputGetter func() ClusterctlUpg
 		Expect(input.E2EConfig).ToNot(BeNil(), "Invalid argument. input.E2EConfig can't be nil when calling %s spec", specName)
 		Expect(input.ClusterctlConfigPath).To(BeAnExistingFile(), "Invalid argument. input.ClusterctlConfigPath must be an existing file when calling %s spec", specName)
 		Expect(input.BootstrapClusterProxy).ToNot(BeNil(), "Invalid argument. input.BootstrapClusterProxy can't be nil when calling %s spec", specName)
-		var clusterctlBinaryURLTemplate string
-		if input.InitWithBinary == "" {
-			Expect(input.E2EConfig.Variables).To(HaveKey(initWithBinaryVariableName), "Invalid argument. %s variable must be defined when calling %s spec", initWithBinaryVariableName, specName)
-			Expect(input.E2EConfig.Variables[initWithBinaryVariableName]).ToNot(BeEmpty(), "Invalid argument. %s variable can't be empty when calling %s spec", initWithBinaryVariableName, specName)
-			clusterctlBinaryURLTemplate = input.E2EConfig.GetVariable(initWithBinaryVariableName)
-		} else {
-			clusterctlBinaryURLTemplate = input.InitWithBinary
-		}
-		clusterctlBinaryURLReplacer := strings.NewReplacer("{OS}", runtime.GOOS, "{ARCH}", runtime.GOARCH)
-		clusterctlBinaryURL = clusterctlBinaryURLReplacer.Replace(clusterctlBinaryURLTemplate)
+		Expect(input.E2EConfig.Variables).To(HaveKey(initWithBinaryVariableName), "Invalid argument. %s variable must be defined when calling %s spec", initWithBinaryVariableName, specName)
+		Expect(input.E2EConfig.Variables[initWithBinaryVariableName]).ToNot(BeEmpty(), "Invalid argument. %s variable can't be empty when calling %s spec", initWithBinaryVariableName, specName)
 		Expect(input.E2EConfig.Variables).To(HaveKey(initWithKubernetesVersion))
 		Expect(input.E2EConfig.Variables).To(HaveKey(KubernetesVersion))
 		Expect(os.MkdirAll(input.ArtifactFolder, 0750)).To(Succeed(), "Invalid argument. input.ArtifactFolder can't be created for %s spec", specName)
@@ -154,7 +143,10 @@ func ClusterctlUpgradeSpec(ctx context.Context, inputGetter func() ClusterctlUpg
 		// Get a ClusterProxy so we can interact with the workload cluster
 		managementClusterProxy = input.BootstrapClusterProxy.GetWorkloadCluster(ctx, cluster.Namespace, cluster.Name)
 
-		// Download the older clusterctl version to be used for setting up the management cluster to be upgraded
+		// Download the v1alpha3 clusterctl version to be used for setting up the management cluster to be upgraded
+		clusterctlBinaryURL := input.E2EConfig.GetVariable(initWithBinaryVariableName)
+		clusterctlBinaryURL = strings.ReplaceAll(clusterctlBinaryURL, "{OS}", runtime.GOOS)
+		clusterctlBinaryURL = strings.ReplaceAll(clusterctlBinaryURL, "{ARCH}", runtime.GOARCH)
 
 		log.Logf("Downloading clusterctl binary from %s", clusterctlBinaryURL)
 		clusterctlBinaryPath := downloadToTmpFile(clusterctlBinaryURL)
@@ -172,9 +164,6 @@ func ClusterctlUpgradeSpec(ctx context.Context, inputGetter func() ClusterctlUpg
 		if input.E2EConfig.HasVariable(initWithProvidersContract) {
 			contract = input.E2EConfig.GetVariable(initWithProvidersContract)
 		}
-		if input.InitWithProvidersContract != "" {
-			contract = input.InitWithProvidersContract
-		}
 
 		clusterctl.InitManagementClusterAndWatchControllerLogs(ctx, clusterctl.InitManagementClusterAndWatchControllerLogsInput{
 			ClusterctlBinaryPath:    clusterctlBinaryPath, // use older version of clusterctl to init the management cluster
diff --git a/test/go.mod b/test/go.mod
index f35f7421c..7fb7aa21c 100644
--- a/test/go.mod
+++ b/test/go.mod
@@ -24,7 +24,7 @@ require (
 	k8s.io/klog/v2 v2.9.0
 	k8s.io/utils v0.0.0-20210819203725-bdf08cb9a70a
 	sigs.k8s.io/cluster-api v0.0.0-00010101000000-000000000000
-	sigs.k8s.io/controller-runtime v0.10.2
+	sigs.k8s.io/controller-runtime v0.10.1
 	sigs.k8s.io/kind v0.11.1
 	sigs.k8s.io/yaml v1.2.0
 )
diff --git a/test/go.sum b/test/go.sum
index 41da39b4f..2f3fc3da4 100644
--- a/test/go.sum
+++ b/test/go.sum
@@ -1469,8 +1469,8 @@ rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.14/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.15/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.22/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
-sigs.k8s.io/controller-runtime v0.10.2 h1:jW8qiY+yMnnPx6O9hu63tgcwaKzd1yLYui+mpvClOOc=
-sigs.k8s.io/controller-runtime v0.10.2/go.mod h1:CQp8eyUQZ/Q7PJvnIrB6/hgfTC1kBkGylwsLgOQi1WY=
+sigs.k8s.io/controller-runtime v0.10.1 h1:+eLHgY/VrJWnfg6iXUqhCUqNXgPH1NZeP9drNAAgWlg=
+sigs.k8s.io/controller-runtime v0.10.1/go.mod h1:CQp8eyUQZ/Q7PJvnIrB6/hgfTC1kBkGylwsLgOQi1WY=
 sigs.k8s.io/kind v0.11.1 h1:pVzOkhUwMBrCB0Q/WllQDO3v14Y+o2V0tFgjTqIUjwA=
 sigs.k8s.io/kind v0.11.1/go.mod h1:fRpgVhtqAWrtLB9ED7zQahUimpUXuG/iHT88xYqEGIA=
 sigs.k8s.io/kustomize/api v0.8.8/go.mod h1:He1zoK0nk43Pc6NlV085xDXDXTNprtcyKZVm3swsdNY=
diff --git a/test/infrastructure/docker/config/certmanager/certificate.yaml b/test/infrastructure/docker/config/certmanager/certificate.yaml
index 4079986e8..0c895e117 100644
--- a/test/infrastructure/docker/config/certmanager/certificate.yaml
+++ b/test/infrastructure/docker/config/certmanager/certificate.yaml
@@ -22,3 +22,6 @@ spec:
     kind: Issuer
     name: selfsigned-issuer
   secretName: $(SERVICE_NAME)-cert # this secret will not be prefixed, since it's not managed by kustomize
+  subject:
+    organizations:
+      - k8s-sig-cluster-lifecycle
\ No newline at end of file