Repository: kubernetes-sigs/cluster-api
Pull request #7802 (2022-12-23 13:35:14)

📖 docs update jobs.md for 1.26
Signed-off-by: Aniruddha Basak <codewithaniruddha@gmail.com>

part of #7671 

cc @kubernetes-sigs/cluster-api-release-team

Q: Do we have to add a `1-26-latest` after line 126? 

k8s-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by:
**Once this PR has been reviewed and has the lgtm label**, please assign enxebre for approval by writing `/assign @enxebre` in a comment. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fcluster-api).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/kubernetes-sigs/cluster-api/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["enxebre"]} -->
sbueringer: /hold

@aniruddha2000  Let me review the test-infra PR (https://github.com/kubernetes/test-infra/pull/28309) first (~ first January week), then we can update this PR accordingly

k8s-ci-robot: @aniruddha2000: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-cluster-api-test-main | 958d231eadb61500de5d2023ca4be127f4798d70 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_cluster-api/7802/pull-cluster-api-test-main/1609489605478846464) | true | `/test pull-cluster-api-test-main`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=cluster-api&pr=7802). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Aaniruddha2000). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/cluster-api/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->

Patch:
diff --git a/.github/ISSUE_TEMPLATE/kubernetes_bump.md b/.github/ISSUE_TEMPLATE/kubernetes_bump.md
index b00d6a799..a8f017aff 100644
--- a/.github/ISSUE_TEMPLATE/kubernetes_bump.md
+++ b/.github/ISSUE_TEMPLATE/kubernetes_bump.md
@@ -17,8 +17,8 @@ Prerequisites:
 
 ### Supporting managing and running on the new Kubernetes version
 
-This section contains tasks to update our book, e2e testing and CI to use and test the new Kubernetes version
-as well as changes to Cluster API that we might have to make to support the new Kubernetes version. All of these
+This section contains tasks to update our book, e2e testing and CI to use and test the new Kubernetes version 
+as well as changes to Cluster API that we might have to make to support the new Kubernetes version. All of these 
 changes should be cherry-picked to all release series that will support the new Kubernetes version.
 
 * [ ] Modify quickstart and CAPD to use the new Kubernetes release:
@@ -28,9 +28,8 @@ changes should be cherry-picked to all release series that will support the new
   * Ensure the latest available kind version is used (including the latest images for this kind release)
   * Verify the quickstart manually
   * Prior art: #7156
-  * bump `InitWithKubernetesVersion` in `clusterctl_upgrade_test.go`
 * [ ] Job configurations:
-  * For all releases which will support the new Kubernetes version:
+  * For all releases which will support the new Kubernetes version: 
     * Update `INIT_WITH_KUBERNETES_VERSION`.
     * Add new periodic upgrade jobs .
     * Adjust presubmit jobs so that we have the latest upgrade jobs available on PRs.
@@ -40,12 +39,12 @@ changes should be cherry-picked to all release series that will support the new
   * Update job documentation in `jobs.md`
   * Prior art: #7194 #7196
 * [ ] Issues specific to the Kubernetes minor release:
-  * Sometimes there are adjustments that we have to make in Cluster API to be able to support
+  * Sometimes there are adjustments that we have to make in Cluster API to be able to support 
     a new Kubernetes minor version. Please add these issues here when they are identified.
 
 ### Using new Kubernetes dependencies
 
-This section contains tasks to update Cluster API to use the latest Kubernetes Go dependencies and related topics
+This section contains tasks to update Cluster API to use the latest Kubernetes Go dependencies and related topics 
 like using the right Go version and build images. These changes are only made on the main branch. We don't
 need them in older releases as they are not necessary to manage workload clusters of the new Kubernetes version or
 run the Cluster API controllers on the new Kubernetes version.
@@ -54,7 +53,7 @@ run the Cluster API controllers on the new Kubernetes version.
 * [ ] Update our Prow jobs for the `main` branch to use the correct `kubekins-e2e` image
   * It is recommended to have one PR for presubmit and one for periodic jobs to reduce the risk of breaking the periodic jobs.
   * Prior art: presubmit jobs: https://github.com/kubernetes/test-infra/pull/27311
-  * Prior art: periodic jobs: https://github.com/kubernetes/test-infra/pull/27326
+  * Prior art: periodic jobs: https://github.com/kubernetes/test-infra/pull/27311
 * [ ] Bump the Go version in Cluster API: (if Kubernetes is using a new Go minor version)
   * Search for the currently used Go version across the repository and update it
   * We have to at least modify it in: `.github/workflows`, `hack/ensure-go.sh`, `.golangci.yml`, `cloudbuild*.yaml`, `go.mod`, `Makefile`, `netlify.toml`, `Tiltfile`
@@ -65,5 +64,5 @@ run the Cluster API controllers on the new Kubernetes version.
   * **Note**: This PR should be cherry-picked as well. It is part of this section as it depends on kubebuilder/controller-runtime
     releases and is not strictly necessary for [Supporting managing and running on the new Kubernetes version](#supporting-managing-and-running-on-the-new-kubernetes-version).
   * Prior art: #7193
-* [ ] Bump conversion-gen via `CONVERSION_GEN_VER` in `Makefile`
+* [ ] Bump conversion-gen via `CONVERSION_GEN_VER` in `Makefile` 
   * Prior art: #7118
diff --git a/.github/workflows/dependabot.yml b/.github/workflows/dependabot.yml
index 3f123df94..4f4fa0aa7 100644
--- a/.github/workflows/dependabot.yml
+++ b/.github/workflows/dependabot.yml
@@ -24,7 +24,7 @@ jobs:
       id: go
     - name: Check out code into the Go module directory
       uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3.2.0
-    - uses: actions/cache@4723a57e26efda3a62cbde1812113b730952852d # tag=v3.2.2
+    - uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # tag=v3.0.11
       name: Restore go cache
       with:
         path: |
diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml
deleted file mode 100644
index 648f337b1..000000000
--- a/.github/workflows/scan.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-name: scan-images
-
-on:
-  schedule:
-    - cron: "0 12 * * 1"
-
-# Remove all permissions from GITHUB_TOKEN except metadata.
-permissions: {}
-
-jobs:
-  scan:
-    name: Trivy
-    runs-on: ubuntu-latest
-    steps:
-    - name: Check out code
-      uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0
-    - name: Setup go
-      uses: actions/setup-go@d0a58c1c4d2b25278816e339b944508c875f3613 # tag=v3.4.0
-      with:
-        go-version: 1.19
-    - name: Run verify container script
-      run: make verify-container-images
diff --git a/Makefile b/Makefile
index 4d7041edd..b0575da29 100644
--- a/Makefile
+++ b/Makefile
@@ -624,10 +624,6 @@ verify-shellcheck: ## Verify shell files
 verify-tiltfile: ## Verify Tiltfile format
 	TRACE=$(TRACE) ./hack/verify-starlark.sh
 
-.PHONY: verify-container-images
-verify-container-images: ## Verify container images
-	TRACE=$(TRACE) ./hack/verify-container-images.sh
-
 ## --------------------------------------
 ## Binaries
 ## --------------------------------------
diff --git a/Tiltfile b/Tiltfile
index 224000690..907c2e8f7 100644
--- a/Tiltfile
+++ b/Tiltfile
@@ -3,18 +3,13 @@
 envsubst_cmd = "./hack/tools/bin/envsubst"
 clusterctl_cmd = "./bin/clusterctl"
 kubectl_cmd = "kubectl"
-default_build_engine = "docker"
-kubernetes_version = "v1.26.0"
+kubernetes_version = "v1.25.3"
 
 if str(local("command -v " + kubectl_cmd + " || true", quiet = True)) == "":
     fail("Required command '" + kubectl_cmd + "' not found in PATH")
 
 load("ext://uibutton", "cmd_button", "location", "text_input")
 
-# detect if docker images should be built using podman
-if "Podman Engine" in str(local("docker version || podman version", quiet = True)):
-    default_build_engine = "podman"
-
 # set defaults
 version_settings(True, ">=0.30.8")
 
@@ -22,7 +17,6 @@ settings = {
     "enable_providers": ["docker"],
     "kind_cluster_name": os.getenv("CAPI_KIND_CLUSTER_NAME", "capi-test"),
     "debug": {},
-    "build_engine": default_build_engine,
 }
 
 # global settings
@@ -258,40 +252,18 @@ def build_docker_image(image, context, binary_name, additional_docker_build_comm
 
     # Set up an image build for the provider. The live update configuration syncs the output from the local_resource
     # build into the container.
-    if settings.get("build_engine") == "podman":
-        bin_context = context + "/.tiltbuild/bin/"
-
-        # Write dockerfile_contents to a Dockerfile as custom_build doesn't support dockerfile_contents nor stdin.
-        # The Dockerfile is in the context path to simplify the below podman command.
-        local("tee %s/Dockerfile" % (shlex.quote(bin_context)), quiet = True, stdin = dockerfile_contents)
-
-        custom_build(
-            ref = image,
-            command = (
-                "set -ex\n" +
-                "podman build -t $EXPECTED_REF --build-arg binary_name=%s --target tilt %s\n" +
-                "podman push --format=docker $EXPECTED_REF\n"
-            ) % (binary_name, shlex.quote(bin_context)),
-            deps = [bin_context],
-            skips_local_docker = True,
-            live_update = [
-                sync(bin_context + binary_name, "/" + binary_name),
-                run("sh /restart.sh"),
-            ],
-        )
-    else:
-        docker_build(
-            ref = image,
-            context = context + "/.tiltbuild/bin/",
-            dockerfile_contents = dockerfile_contents,
-            build_args = {"binary_name": binary_name},
-            target = "tilt",
-            only = binary_name,
-            live_update = [
-                sync(context + "/.tiltbuild/bin/" + binary_name, "/" + binary_name),
-                run("sh /restart.sh"),
-            ],
-        )
+    docker_build(
+        ref = image,
+        context = context + "/.tiltbuild/bin/",
+        dockerfile_contents = dockerfile_contents,
+        build_args = {"binary_name": binary_name},
+        target = "tilt",
+        only = binary_name,
+        live_update = [
+            sync(context + "/.tiltbuild/bin/" + binary_name, "/" + binary_name),
+            run("sh /restart.sh"),
+        ],
+    )
 
 def get_port_forwards(debug):
     port_forwards = []
@@ -474,9 +446,6 @@ def cluster_templates():
     })
 
     for provider, provider_dirs in template_dirs.items():
-        if provider not in get_providers():
-            continue
-
         p = providers.get(provider)
         label = p.get("label", provider)
 
diff --git a/api/v1beta1/cluster_types.go b/api/v1beta1/cluster_types.go
index 1b05c471e..50898cfe0 100644
--- a/api/v1beta1/cluster_types.go
+++ b/api/v1beta1/cluster_types.go
@@ -171,7 +171,7 @@ type MachineDeploymentTopology struct {
 	FailureDomain *string `json:"failureDomain,omitempty"`
 
 	// Replicas is the number of worker nodes belonging to this set.
-	// If the value is nil, the MachineDeployment is created without the number of Replicas (defaulting to 1)
+	// If the value is nil, the MachineDeployment is created without the number of Replicas (defaulting to zero)
 	// and it's assumed that an external entity (like cluster autoscaler) is responsible for the management
 	// of this value.
 	// +optional
diff --git a/api/v1beta1/zz_generated.openapi.go b/api/v1beta1/zz_generated.openapi.go
index cda6c248b..59349ecfa 100644
--- a/api/v1beta1/zz_generated.openapi.go
+++ b/api/v1beta1/zz_generated.openapi.go
@@ -1794,7 +1794,7 @@ func schema_sigsk8sio_cluster_api_api_v1beta1_MachineDeploymentTopology(ref comm
 					},
 					"replicas": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Replicas is the number of worker nodes belonging to this set. If the value is nil, the MachineDeployment is created without the number of Replicas (defaulting to 1) and it's assumed that an external entity (like cluster autoscaler) is responsible for the management of this value.",
+							Description: "Replicas is the number of worker nodes belonging to this set. If the value is nil, the MachineDeployment is created without the number of Replicas (defaulting to zero) and it's assumed that an external entity (like cluster autoscaler) is responsible for the management of this value.",
 							Type:        []string{"integer"},
 							Format:      "int32",
 						},
diff --git a/cmd/clusterctl/client/client.go b/cmd/clusterctl/client/client.go
index 1aaf5b0e4..4b0eea5ed 100644
--- a/cmd/clusterctl/client/client.go
+++ b/cmd/clusterctl/client/client.go
@@ -54,6 +54,11 @@ type Client interface {
 	// Move moves all the Cluster API objects existing in a namespace (or from all the namespaces if empty) to a target management cluster.
 	Move(options MoveOptions) error
 
+	// Backup saves all the Cluster API objects existing in a namespace (or from all the namespaces if empty) to a target management cluster.
+	//
+	// Deprecated: This will be dropped in a future release. Please use Move.
+	Backup(options BackupOptions) error
+
 	// Restore restores all the Cluster API objects existing in a configured directory based on a glob to a target management cluster.
 	//
 	// Deprecated: This will be dropped in a future release. Please use Move.
diff --git a/cmd/clusterctl/client/cluster/mover.go b/cmd/clusterctl/client/cluster/mover.go
index 61c23c045..e587ae67d 100644
--- a/cmd/clusterctl/client/cluster/mover.go
+++ b/cmd/clusterctl/client/cluster/mover.go
@@ -53,6 +53,11 @@ type ObjectMover interface {
 	// FromDirectory reads all the Cluster API objects existing in a configured directory to a target management cluster.
 	FromDirectory(toCluster Client, directory string) error
 
+	// Backup saves all the Cluster API objects existing in a namespace (or from all the namespaces if empty) to a target directory.
+	//
+	// Deprecated: This will be dropped in a future release. Please use ToDirectory.
+	Backup(namespace string, directory string) error
+
 	// Restore restores all the Cluster API objects existing in a configured directory to a target management cluster.
 	//
 	// Deprecated: This will be dropped in a future release. Please use FromDirectory.
@@ -100,6 +105,12 @@ func (o *objectMover) Move(namespace string, toCluster Client, dryRun bool) erro
 	return o.move(objectGraph, proxy)
 }
 
+func (o *objectMover) Backup(namespace string, directory string) error {
+	log := logf.Log
+	log.V(5).Info("Deprecated: This function will be dropped in a future release. Please use ToDirectory instead of Backup.")
+	return o.ToDirectory(namespace, directory)
+}
+
 func (o *objectMover) ToDirectory(namespace string, directory string) error {
 	log := logf.Log
 	log.Info("Moving to directory...")
diff --git a/cmd/clusterctl/client/cluster/template.go b/cmd/clusterctl/client/cluster/template.go
index 7e3ea76a6..213addd9f 100644
--- a/cmd/clusterctl/client/cluster/template.go
+++ b/cmd/clusterctl/client/cluster/template.go
@@ -51,7 +51,6 @@ type templateClient struct {
 	configClient        config.Client
 	gitHubClientFactory func(configVariablesClient config.VariablesClient) (*github.Client, error)
 	processor           yaml.Processor
-	httpClient          *http.Client
 }
 
 // ensure templateClient implements TemplateClient.
@@ -71,7 +70,6 @@ func newTemplateClient(input TemplateClientInput) *templateClient {
 		configClient:        input.configClient,
 		gitHubClientFactory: getGitHubClient,
 		processor:           input.processor,
-		httpClient:          http.DefaultClient,
 	}
 }
 
@@ -145,11 +143,8 @@ func (t *templateClient) getURLContent(templateURL string) ([]byte, error) {
 		return nil, errors.Wrapf(err, "failed to parse %q", templateURL)
 	}
 
-	if rURL.Scheme == "https" {
-		if rURL.Host == "github.com" {
-			return t.getGitHubFileContent(rURL)
-		}
-		return t.getRawURLFileContent(templateURL)
+	if rURL.Scheme == "https" && rURL.Host == "github.com" {
+		return t.getGitHubFileContent(rURL)
 	}
 
 	if rURL.Scheme == "file" || rURL.Scheme == "" {
@@ -215,30 +210,6 @@ func (t *templateClient) getGitHubFileContent(rURL *url.URL) ([]byte, error) {
 	return content, nil
 }
 
-func (t *templateClient) getRawURLFileContent(rURL string) ([]byte, error) {
-	request, err := http.NewRequestWithContext(ctx, http.MethodGet, rURL, http.NoBody)
-	if err != nil {
-		return nil, err
-	}
-
-	response, err := t.httpClient.Do(request)
-	if err != nil {
-		return nil, err
-	}
-	defer response.Body.Close()
-
-	if response.StatusCode != http.StatusOK {
-		return nil, errors.Errorf("failed to get file, got %d", response.StatusCode)
-	}
-
-	content, err := io.ReadAll(response.Body)
-	if err != nil {
-		return nil, err
-	}
-
-	return content, nil
-}
-
 func getGitHubClient(configVariablesClient config.VariablesClient) (*github.Client, error) {
 	var authenticatingHTTPClient *http.Client
 	if token, err := configVariablesClient.Get(config.GitHubTokenVariable); err == nil {
diff --git a/cmd/clusterctl/client/move.go b/cmd/clusterctl/client/move.go
index 8f936af84..d5534cbc3 100644
--- a/cmd/clusterctl/client/move.go
+++ b/cmd/clusterctl/client/move.go
@@ -48,6 +48,22 @@ type MoveOptions struct {
 	DryRun bool
 }
 
+// BackupOptions holds options supported by backup.
+//
+// Deprecated: This will be dropped in a future release. Please use MoveOptions.
+type BackupOptions struct {
+	// FromKubeconfig defines the kubeconfig to use for accessing the source management cluster. If empty,
+	// default rules for kubeconfig discovery will be used.
+	FromKubeconfig Kubeconfig
+
+	// Namespace where the objects describing the workload cluster exists. If unspecified, the current
+	// namespace will be used.
+	Namespace string
+
+	// Directory defines the local directory to store the cluster objects
+	Directory string
+}
+
 // RestoreOptions holds options supported by restore.
 //
 // Deprecated: This will be dropped in a future release. Please use MoveOptions.
@@ -144,6 +160,17 @@ func (c *clusterctlClient) toDirectory(options MoveOptions) error {
 	return fromCluster.ObjectMover().ToDirectory(options.Namespace, options.ToDirectory)
 }
 
+// Backup saves all the Cluster API objects existing in a namespace (or from all the namespaces if empty) to a target directory.
+//
+// Deprecated: This will be dropped in a future release. Please use ToDirectory.
+func (c *clusterctlClient) Backup(options BackupOptions) error {
+	return c.Move(MoveOptions{
+		FromKubeconfig: options.FromKubeconfig,
+		ToDirectory:    options.Directory,
+		Namespace:      options.Namespace,
+	})
+}
+
 // Restore restores all the Cluster API objects existing in a configured directory to a target management cluster.
 //
 // Deprecated: This will be dropped in a future release. Please use FromDirectory.
diff --git a/cmd/clusterctl/cmd/backup.go b/cmd/clusterctl/cmd/backup.go
new file mode 100644
index 000000000..9762480e2
--- /dev/null
+++ b/cmd/clusterctl/cmd/backup.go
@@ -0,0 +1,80 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cmd
+
+import (
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+
+	"sigs.k8s.io/cluster-api/cmd/clusterctl/client"
+)
+
+type backupOptions struct {
+	fromKubeconfig        string
+	fromKubeconfigContext string
+	namespace             string
+	directory             string
+}
+
+var buo = &backupOptions{}
+
+var backupCmd = &cobra.Command{
+	Use:     "backup",
+	GroupID: groupManagement,
+	Short:   "Backup Cluster API objects and all dependencies from a management cluster",
+	Long: LongDesc(`
+		Backup Cluster API objects and all dependencies from a management cluster.`),
+
+	Example: Examples(`
+		Backup Cluster API objects and all dependencies from a management cluster.
+		clusterctl backup --directory=/tmp/backup-directory`),
+	Args: cobra.NoArgs,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return runBackup()
+	},
+	Deprecated: "use 'clusterctl move --to-directory' instead.",
+}
+
+func init() {
+	backupCmd.Flags().StringVar(&buo.fromKubeconfig, "kubeconfig", "",
+		"Path to the kubeconfig file for the source management cluster to backup. If unspecified, default discovery rules apply.")
+	backupCmd.Flags().StringVar(&buo.fromKubeconfigContext, "kubeconfig-context", "",
+		"Context to be used within the kubeconfig file for the source management cluster. If empty, current context will be used.")
+	backupCmd.Flags().StringVarP(&buo.namespace, "namespace", "n", "",
+		"The namespace where the workload cluster is hosted. If unspecified, the current context's namespace is used.")
+	backupCmd.Flags().StringVar(&buo.directory, "directory", "",
+		"The directory to save Cluster API objects to as yaml files")
+
+	RootCmd.AddCommand(backupCmd)
+}
+
+func runBackup() error {
+	if buo.directory == "" {
+		return errors.New("please specify a directory to backup cluster API objects to using the --directory flag")
+	}
+
+	c, err := client.New(cfgFile)
+	if err != nil {
+		return err
+	}
+
+	return c.Move(client.MoveOptions{
+		FromKubeconfig: client.Kubeconfig{Path: buo.fromKubeconfig, Context: buo.fromKubeconfigContext},
+		Namespace:      buo.namespace,
+		ToDirectory:    buo.directory,
+	})
+}
diff --git a/config/crd/bases/cluster.x-k8s.io_clusters.yaml b/config/crd/bases/cluster.x-k8s.io_clusters.yaml
index 688dd7ed4..d80982e2e 100644
--- a/config/crd/bases/cluster.x-k8s.io_clusters.yaml
+++ b/config/crd/bases/cluster.x-k8s.io_clusters.yaml
@@ -1251,8 +1251,8 @@ spec:
                               description: Replicas is the number of worker nodes
                                 belonging to this set. If the value is nil, the MachineDeployment
                                 is created without the number of Replicas (defaulting
-                                to 1) and it's assumed that an external entity (like
-                                cluster autoscaler) is responsible for the management
+                                to zero) and it's assumed that an external entity
+                                (like cluster autoscaler) is responsible for the management
                                 of this value.
                               format: int32
                               type: integer
diff --git a/controlplane/kubeadm/internal/control_plane.go b/controlplane/kubeadm/internal/control_plane.go
index b64a0bdaa..55850a35e 100644
--- a/controlplane/kubeadm/internal/control_plane.go
+++ b/controlplane/kubeadm/internal/control_plane.go
@@ -168,8 +168,13 @@ func (c *ControlPlane) MachinesNeedingRollout() collections.Machines {
 	machines := c.Machines.Filter(collections.Not(collections.HasDeletionTimestamp))
 
 	// Return machines if they are scheduled for rollout or if with an outdated configuration.
-	return machines.Filter(
-		NeedsRollout(&c.reconciliationTime, c.KCP.Spec.RolloutAfter, c.KCP.Spec.RolloutBefore, c.infraResources, c.kubeadmConfigs, c.KCP),
+	return machines.AnyFilter(
+		// Machines whose certificates are about to expire.
+		collections.ShouldRolloutBefore(&c.reconciliationTime, c.KCP.Spec.RolloutBefore),
+		// Machines that are scheduled for rollout (KCP.Spec.RolloutAfter set, the RolloutAfter deadline is expired, and the machine was created before the deadline).
+		collections.ShouldRolloutAfter(&c.reconciliationTime, c.KCP.Spec.RolloutAfter),
+		// Machines that do not match with KCP config.
+		collections.Not(MatchesMachineSpec(c.infraResources, c.kubeadmConfigs, c.KCP)),
 	)
 }
 
@@ -177,7 +182,12 @@ func (c *ControlPlane) MachinesNeedingRollout() collections.Machines {
 // plane's configuration and therefore do not require rollout.
 func (c *ControlPlane) UpToDateMachines() collections.Machines {
 	return c.Machines.Filter(
-		collections.Not(NeedsRollout(&c.reconciliationTime, c.KCP.Spec.RolloutAfter, c.KCP.Spec.RolloutBefore, c.infraResources, c.kubeadmConfigs, c.KCP)),
+		// Machines that shouldn't be rollout out if their certificates are not about to expire.
+		collections.Not(collections.ShouldRolloutBefore(&c.reconciliationTime, c.KCP.Spec.RolloutBefore)),
+		// Machines that shouldn't be rolled out after the deadline has expired.
+		collections.Not(collections.ShouldRolloutAfter(&c.reconciliationTime, c.KCP.Spec.RolloutAfter)),
+		// Machines that match with KCP config.
+		MatchesMachineSpec(c.infraResources, c.kubeadmConfigs, c.KCP),
 	)
 }
 
diff --git a/controlplane/kubeadm/internal/filters.go b/controlplane/kubeadm/internal/filters.go
index b1da90912..cea8b3b21 100644
--- a/controlplane/kubeadm/internal/filters.go
+++ b/controlplane/kubeadm/internal/filters.go
@@ -20,7 +20,6 @@ import (
 	"encoding/json"
 	"reflect"
 
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
@@ -43,18 +42,6 @@ func MatchesMachineSpec(infraConfigs map[string]*unstructured.Unstructured, mach
 	)
 }
 
-// NeedsRollout returns a filter to determine if a machine needs rollout.
-func NeedsRollout(reconciliationTime, rolloutAfter *metav1.Time, rolloutBefore *controlplanev1.RolloutBefore, infraConfigs map[string]*unstructured.Unstructured, machineConfigs map[string]*bootstrapv1.KubeadmConfig, kcp *controlplanev1.KubeadmControlPlane) func(machine *clusterv1.Machine) bool {
-	return collections.Or(
-		// Machines whose certificates are about to expire.
-		collections.ShouldRolloutBefore(reconciliationTime, rolloutBefore),
-		// Machines that are scheduled for rollout (KCP.Spec.RolloutAfter set, the RolloutAfter deadline is expired, and the machine was created before the deadline).
-		collections.ShouldRolloutAfter(reconciliationTime, rolloutAfter),
-		// Machines that do not match with KCP config.
-		collections.Not(MatchesMachineSpec(infraConfigs, machineConfigs, kcp)),
-	)
-}
-
 // MatchesTemplateClonedFrom returns a filter to find all machines that match a given KCP infra template.
 func MatchesTemplateClonedFrom(infraConfigs map[string]*unstructured.Unstructured, kcp *controlplanev1.KubeadmControlPlane) collections.Func {
 	return func(machine *clusterv1.Machine) bool {
diff --git a/docs/book/src/clusterctl/commands/additional-commands.md b/docs/book/src/clusterctl/commands/additional-commands.md
index dbd0e138c..6a947842e 100644
--- a/docs/book/src/clusterctl/commands/additional-commands.md
+++ b/docs/book/src/clusterctl/commands/additional-commands.md
@@ -1,3 +1,9 @@
+# clusterctl backup
+
+**DEPRECATED. Please use `clusterctl move --to-directory` instead.**
+
+Backup Cluster API objects and all dependencies from a management cluster.
+
 # clusterctl config repositories
 
 Display the list of providers and their repository configurations.
diff --git a/docs/book/src/clusterctl/commands/commands.md b/docs/book/src/clusterctl/commands/commands.md
index 52c68caf2..4c0e2fd54 100644
--- a/docs/book/src/clusterctl/commands/commands.md
+++ b/docs/book/src/clusterctl/commands/commands.md
@@ -4,6 +4,7 @@
 |------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|
 | [`clusterctl alpha rollout`](alpha-rollout.md)                               | Manages the rollout of Cluster API resources. For example: MachineDeployments.                                                                        |
 | [`clusterctl alpha topology plan`](alpha-topology-plan.md)                   | Describes the changes to a cluster topology for a given input.                                                                                        |
+| [`clusterctl backup`](additional-commands.md#clusterctl-backup)              | Backup Cluster API objects and all their dependencies from a management cluster. **DEPRECATED. Please use `clusterctl move --to-directory` instead.** |
 | [`clusterctl completion`](completion.md)                                     | Output shell completion code for the specified shell (bash or zsh).                                                                                   |
 | [`clusterctl config`](additional-commands.md#clusterctl-config-repositories) | Display clusterctl configuration.                                                                                                                     |
 | [`clusterctl delete`](delete.md)                                             | Delete one or more providers from the management cluster.                                                                                             |
diff --git a/docs/book/src/clusterctl/commands/move.md b/docs/book/src/clusterctl/commands/move.md
index f6f3ecaf0..bcca21645 100644
--- a/docs/book/src/clusterctl/commands/move.md
+++ b/docs/book/src/clusterctl/commands/move.md
@@ -52,7 +52,7 @@ while doing the move operation, and possible race conditions happening while the
 remediating etc. has never been investigated nor addressed.
 
 In order to avoid further confusion about this point, `clusterctl backup` and `clusterctl restore` commands have been
-removed because they were built on top of `clusterctl move` logic and they were sharing he same limitations.
+deprecated because they were built on top of `clusterctl move` logic and they were sharing he same limitations. 
 User can use `clusterctl move --to-directory` and `clusterctl move --from-directory` instead; this will hopefully
 make it clear those operation have the same limitations of the move command.
 
diff --git a/docs/book/src/developer/providers/v1.3-to-v1.4.md b/docs/book/src/developer/providers/v1.3-to-v1.4.md
index 505818ef6..6ce929a85 100644
--- a/docs/book/src/developer/providers/v1.3-to-v1.4.md
+++ b/docs/book/src/developer/providers/v1.3-to-v1.4.md
@@ -20,11 +20,11 @@ maintainers of providers and consumers of our Go API.
 
 ### Removals
 
-- `clusterctl backup` has been removed.
+-
 
 ### API Changes
 
-- `Backup(options BackupOptions) error` in the Client interface has been removed.
+-
 
 ### Other
 
diff --git a/docs/book/src/developer/tilt.md b/docs/book/src/developer/tilt.md
index e5474228c..1e2f25573 100644
--- a/docs/book/src/developer/tilt.md
+++ b/docs/book/src/developer/tilt.md
@@ -63,9 +63,6 @@ If you prefer JSON, you can create a `tilt-settings.json` file instead. YAML wil
 **default_registry** (String, default=""): The image registry to use if you need to push images. See the [Tilt
 documentation](https://docs.tilt.dev/api.html#api.default_registry) for more details.
 
-**build_engine** (String, default="docker"): The engine used to build images. Can either be `docker` or `podman`.
-NB: the default is dynamic and will be "podman" if the string "Podman Engine" is found in `docker version` (or in `podman version` if the command fails).
-
 **kind_cluster_name** (String, default="capi-test"): The name of the kind cluster to use when preloading images.
 
 **provider_repos** (Array[]String, default=[]): A list of paths to all the providers you want to use. Each provider must have a
@@ -185,7 +182,7 @@ kustomize_substitutions:
 {{#/tabs }}
 
 **deploy_observability** ([string], default=[]): If set, installs on the dev cluster one of more observability
-tools.
+tools. 
 Important! This feature requires the `helm` command to be available in the user's path.
 
 Supported values are:
@@ -315,7 +312,7 @@ Custom values for variable substitutions can be set using `kustomize_substitutio
 ```yaml
 kustomize_substitutions:
   NAMESPACE: default
-  KUBERNETES_VERSION: v1.26.0
+  KUBERNETES_VERSION: v1.25.3
   CONTROL_PLANE_MACHINE_COUNT: 1
   WORKER_MACHINE_COUNT: 3
 ```
@@ -366,6 +363,7 @@ A provider must supply a `tilt-provider.yaml` file describing how to build it. H
 name: aws
 config:
   image: "gcr.io/k8s-staging-cluster-api-aws/cluster-api-aws-controller",
+  label: CAPA
   live_reload_deps: ["main.go", "go.mod", "go.sum", "api", "cmd", "controllers", "pkg"]
   label: CAPA
 ```
@@ -460,13 +458,3 @@ syntax highlighting and auto-formatting. To enable it for Tiltfile a file associ
   "Tiltfile": "starlark",
 },
 ```
-
-## Using Podman
-
-[Podman](https://podman.io) can be used instead of docker by following these actions:
-
-1. Enable the podman unix socket (eg. `systemctl --user enable --now podman.socket` on Fedora)
-1. Set `build_engine` to `podman` in `tilt-settings.yaml` (optional, only if both docker & podman are installed)
-1. Define the env variable `DOCKER_HOST` to the right socket while running tilt (eg. `DOCKER_HOST=unix:///run/user/$(id -u)/podman/podman.sock tilt up`)
-
-NB: The socket defined by `DOCKER_HOST` is used only for the `hack/tools/tilt-prepare` command, the image build is running the `podman build`/`podman push` commands.
\ No newline at end of file
diff --git a/docs/book/src/reference/jobs.md b/docs/book/src/reference/jobs.md
index f318b78f9..2ff258189 100644
--- a/docs/book/src/reference/jobs.md
+++ b/docs/book/src/reference/jobs.md
@@ -27,7 +27,7 @@ Prow Presubmits:
   * GINKGO_FOCUS: `[IPv6] [PR-Informing]`, IP_FAMILY: `IPv6`
 * ✳️️ ✴️ [pull-cluster-api-e2e-full-main] `./scripts/ci-e2e.sh`
   * GINKGO_SKIP: `[PR-Blocking] [Conformance] [K8s-Upgrade] [IPv6]` (i.e. "no tags")
-* ✳️️ ✴️ [pull-cluster-api-e2e-workload-upgrade-1-25-latest-main] `./scripts/ci-e2e.sh` FROM: `stable-1.25` TO: `ci/latest-1.26`
+* ✳️️ ✴️ [pull-cluster-api-e2e-workload-upgrade-1-26-latest-main] `./scripts/ci-e2e.sh` FROM: `stable-1.26` TO: `ci/latest-1.27`
   * GINKGO_FOCUS: `[K8s-Upgrade]`
 
 GitHub Presubmit Workflows:
@@ -37,19 +37,12 @@ GitHub Presubmit Workflows:
   * Verifies the PR titles have a valid format, i.e. contains one of the valid icons.
   * Verifies the PR description is valid, i.e. is long enough.
 * Check PR Markdown links (run when markdown files changed)
-  * Checks markdown for broken links. 
+  * Checks markdown for broken links.
 * dependabot (run on dependabot PRs)
   * Regenerates Go modules and code.
 * release (run on tags)
   * Creates a GitHub release with release notes for the tag.
 
-
-GitHub Weekly Workflows:
-* golangci-lint: golangci/golangci-lint-action
-  * Weekly check all Markdown links
-* scan-images:
-  * Scan all images for vulnerabilities. Can be run locally via `make verify-container-images`
-
 ### Postsubmits
 
 Prow Postsubmits:
@@ -60,7 +53,7 @@ Prow Postsubmits:
 Prow Periodics:
 * [periodic-cluster-api-test-main] `./scripts/ci-test.sh`
 * [periodic-cluster-api-test-mink8s-main] `./scripts/ci-test.sh`
-  * KUBEBUILDER_ENVTEST_KUBERNETES_VERSION: `1.20.2` 
+  * KUBEBUILDER_ENVTEST_KUBERNETES_VERSION: `1.20.2`
 * [periodic-cluster-api-e2e-main] `./scripts/ci-e2e.sh`
   * GINKGO_SKIP: `[Conformance] [K8s-Upgrade]|[IPv6]`
 * [periodic-cluster-api-e2e-mink8s-main] `./scripts/ci-e2e.sh`
@@ -80,18 +73,20 @@ Prow Periodics:
   * GINKGO_FOCUS: `[K8s-Upgrade]`
 * [periodic-cluster-api-e2e-workload-upgrade-1-24-1-25-main] `./scripts/ci-e2e.sh` FROM: `stable-1.24` TO: `stable-1.25`
   * GINKGO_FOCUS: `[K8s-Upgrade]`
-* [periodic-cluster-api-e2e-workload-upgrade-1-25-latest-main] `./scripts/ci-e2e.sh` FROM: `stable-1.25` TO: `ci/latest-1.26`
+* [periodic-cluster-api-e2e-workload-upgrade-1-25-1-26-main] `./scripts/ci-e2e.sh` FROM: `stable-1.25` TO: `stable-1.26`
+  * GINKGO_FOCUS: `[K8s-Upgrade]`
+* [periodic-cluster-api-e2e-workload-upgrade-1-26-latest-main] `./scripts/ci-e2e.sh` FROM: `stable-1.26` TO: `ci/latest-1.27`
   * GINKGO_FOCUS: `[K8s-Upgrade]`
 * [cluster-api-push-images-nightly] Google Cloud Build: `make release-staging-nightly`
 
 ## Test-infra configuration
 
 * config/jobs/image-pushing/k8s-staging-cluster-api.yaml
-  * Configures nightly and postsubmit jobs to push images and manifests. 
+  * Configures nightly and postsubmit jobs to push images and manifests.
 * config/jobs/kubernetes-sigs/cluster-api/
   * Configures Cluster API  presubmit and periodic jobs.
 * config/testgrids/kubernetes/sig-cluster-lifecycle/config.yaml
-  * Configures Cluster API testgrid dashboards.  
+  * Configures Cluster API testgrid dashboards.
 * config/prow/config.yaml
   * `branch-protection` and `tide` are configured to make the golangci-lint GitHub action mandatory for merge
 * config/prow/plugins.yaml
@@ -103,7 +98,7 @@ Prow Periodics:
   * `plugins`: enables `milestone`, `override` and `require-matching-label` plugins
   * `external_plugins`: enables `cherrypicker`
 * label_sync/labels.yaml
-  * Configures labels for the `cluster-api` repository. 
+  * Configures labels for the `cluster-api` repository.
 
 
 <!-- links -->
@@ -116,7 +111,7 @@ Prow Periodics:
 [pull-cluster-api-e2e-informing-main]: https://testgrid.k8s.io/sig-cluster-lifecycle-cluster-api#capi-pr-e2e-informing-main
 [pull-cluster-api-e2e-informing-ipv6-main]: https://testgrid.k8s.io/sig-cluster-lifecycle-cluster-api#capi-pr-e2e-informing-ipv6-main
 [pull-cluster-api-e2e-full-main]: https://testgrid.k8s.io/sig-cluster-lifecycle-cluster-api#capi-pr-e2e-full-main
-[pull-cluster-api-e2e-workload-upgrade-1-25-latest-main]: https://testgrid.k8s.io/sig-cluster-lifecycle-cluster-api#capi-pr-e2e-main-1-25-latest
+[pull-cluster-api-e2e-workload-upgrade-1-26-latest-main]: https://testgrid.k8s.io/sig-cluster-lifecycle-cluster-api#capi-pr-e2e-main-1-26-latest
 [periodic-cluster-api-test-main]: https://testgrid.k8s.io/sig-cluster-lifecycle-cluster-api#capi-test-main
 [periodic-cluster-api-test-mink8s-main]: https://testgrid.k8s.io/sig-cluster-lifecycle-cluster-api#capi-test-mink8s-main
 [periodic-cluster-api-e2e-main]: https://testgrid.k8s.io/sig-cluster-lifecycle-cluster-api#capi-e2e-main
@@ -130,6 +125,7 @@ Prow Periodics:
 [periodic-cluster-api-e2e-workload-upgrade-1-22-1-23-main]: https://testgrid.k8s.io/sig-cluster-lifecycle-cluster-api#capi-e2e-main-1-22-1-23
 [periodic-cluster-api-e2e-workload-upgrade-1-23-1-24-main]: https://testgrid.k8s.io/sig-cluster-lifecycle-cluster-api#capi-e2e-main-1-23-1-24
 [periodic-cluster-api-e2e-workload-upgrade-1-24-1-25-main]: https://testgrid.k8s.io/sig-cluster-lifecycle-cluster-api#capi-e2e-main-1-24-1-25
-[periodic-cluster-api-e2e-workload-upgrade-1-25-latest-main]: https://testgrid.k8s.io/sig-cluster-lifecycle-cluster-api#capi-e2e-main-1-25-latest
+[periodic-cluster-api-e2e-workload-upgrade-1-25-1-26-main]: https://testgrid.k8s.io/sig-cluster-lifecycle-cluster-api#capi-e2e-main-1-25-1-26
+[periodic-cluster-api-e2e-workload-upgrade-1-26-latest-main]: https://testgrid.k8s.io/sig-cluster-lifecycle-cluster-api#capi-e2e-main-1-26-latest
 [cluster-api-push-images-nightly]: https://testgrid.k8s.io/sig-cluster-lifecycle-image-pushes#cluster-api-push-images-nightly
 [post-cluster-api-push-images]: https://testgrid.k8s.io/sig-cluster-lifecycle-image-pushes#post-cluster-api-push-images
diff --git a/docs/book/src/reference/providers.md b/docs/book/src/reference/providers.md
index 3766a482b..5ad09c584 100644
--- a/docs/book/src/reference/providers.md
+++ b/docs/book/src/reference/providers.md
@@ -6,7 +6,7 @@ are also sponsored by SIG Cluster Lifecycle. Check provider's documentation for
 updated info about which API version they are supporting.
 
 ## Bootstrap
-- [Amazon Elastic Kubernetes Service (EKS)](https://github.com/kubernetes-sigs/cluster-api-provider-aws/tree/main/bootstrap/eks)
+- [EKS](https://github.com/kubernetes-sigs/cluster-api-provider-aws/tree/main/bootstrap/eks)
 - [Kubeadm](https://github.com/kubernetes-sigs/cluster-api/tree/main/bootstrap/kubeadm)
 - [MicroK8s](https://github.com/canonical/cluster-api-bootstrap-provider-microk8s)
 - [Talos](https://github.com/siderolabs/cluster-api-bootstrap-provider-talos)
@@ -21,12 +21,12 @@ updated info about which API version they are supporting.
 - [AWS](https://cluster-api-aws.sigs.k8s.io/)
 - [Azure](https://github.com/kubernetes-sigs/cluster-api-provider-azure)
 - [Azure Stack HCI](https://github.com/microsoft/cluster-api-provider-azurestackhci)
-- [Bring Your Own Host (BYOH)](https://github.com/vmware-tanzu/cluster-api-provider-bringyourownhost)
+- [BYOH](https://github.com/vmware-tanzu/cluster-api-provider-bringyourownhost)
 - [CloudStack](https://github.com/kubernetes-sigs/cluster-api-provider-cloudstack)
 - [CoxEdge](https://github.com/coxedge/cluster-api-provider-coxedge)
 - [DigitalOcean](https://github.com/kubernetes-sigs/cluster-api-provider-digitalocean)
 - [Equinix Metal (formerly Packet)](https://github.com/kubernetes-sigs/cluster-api-provider-packet)
-- [Google Cloud Platform (GCP)](https://github.com/kubernetes-sigs/cluster-api-provider-gcp)
+- [GCP](https://github.com/kubernetes-sigs/cluster-api-provider-gcp)
 - [Hetzner](https://github.com/syself/cluster-api-provider-hetzner)
 - [IBM Cloud](https://github.com/kubernetes-sigs/cluster-api-provider-ibmcloud)
 - [KubeKey](https://github.com/kubesphere/kubekey)
@@ -36,7 +36,7 @@ updated info about which API version they are supporting.
 - [Microvm](https://github.com/weaveworks-liquidmetal/cluster-api-provider-microvm)
 - [Nested](https://github.com/kubernetes-sigs/cluster-api-provider-nested)
 - [Nutanix](https://github.com/nutanix-cloud-native/cluster-api-provider-nutanix)
-- [Oracle Cloud Infrastructure (OCI)](https://github.com/oracle/cluster-api-provider-oci)
+- [OCI](https://github.com/oracle/cluster-api-provider-oci)
 - [OpenStack](https://github.com/kubernetes-sigs/cluster-api-provider-openstack)
 - [Outscale](https://github.com/outscale-dev/cluster-api-provider-outscale)
 - [Sidero](https://github.com/siderolabs/sidero)
diff --git a/docs/book/src/user/quick-start.md b/docs/book/src/user/quick-start.md
index 2d571d0cb..8adf0e541 100644
--- a/docs/book/src/user/quick-start.md
+++ b/docs/book/src/user/quick-start.md
@@ -271,14 +271,13 @@ before getting started with Cluster API. See below for the expected settings for
 {{#tabs name:"tab-installation-infrastructure" tabs:"AWS,Azure,CloudStack,DigitalOcean,Docker,Equinix Metal,GCP,Hetzner,IBM Cloud,KubeKey,KubeVirt,Metal3,Nutanix,OCI,OpenStack,Outscale,VCD,vcluster,Virtink,vSphere"}}
 {{#tab AWS}}
 
-Download the latest binary of `clusterawsadm` from the [AWS provider releases]. The [clusterawsadm] command line utility assists with identity and access management (IAM) for [Cluster API Provider AWS][capa].
-
-{{#tabs name:"install-clusterawsadm" tabs:"Linux,macOS,homebrew,Windows"}}
+Download the latest binary of `clusterawsadm` from the [AWS provider releases].
+{{#tabs name:"install-clusterawsadm" tabs:"Linux,macOS,homebrew"}}
 {{#tab Linux}}
 
 Download the latest release; on Linux, type:
 ```
-curl -L {{#releaselink gomodule:"sigs.k8s.io/cluster-api-provider-aws" asset:"clusterawsadm-linux-amd64" version:">=2.0.0"}} -o clusterawsadm
+curl -L {{#releaselink gomodule:"sigs.k8s.io/cluster-api-provider-aws" asset:"clusterawsadm-linux-amd64" version:">=1.0.0"}} -o clusterawsadm
 ```
 
 Make it executable
@@ -295,39 +294,17 @@ Check version to confirm installation
 ```
 clusterawsadm version
 ```
-
-**Example Usage**
-```bash
-export AWS_REGION=us-east-1 # This is used to help encode your environment variables
-export AWS_ACCESS_KEY_ID=<your-access-key>
-export AWS_SECRET_ACCESS_KEY=<your-secret-access-key>
-export AWS_SESSION_TOKEN=<session-token> # If you are using Multi-Factor Auth.
-
-# The clusterawsadm utility takes the credentials that you set as environment
-# variables and uses them to create a CloudFormation stack in your AWS account
-# with the correct IAM resources.
-clusterawsadm bootstrap iam create-cloudformation-stack
-
-# Create the base64 encoded credentials using clusterawsadm.
-# This command uses your environment variables and encodes
-# them in a value to be stored in a Kubernetes Secret.
-export AWS_B64ENCODED_CREDENTIALS=$(clusterawsadm bootstrap credentials encode-as-profile)
-
-# Finally, initialize the management cluster
-clusterctl init --infrastructure aws
-```
-
 {{#/tab }}
 {{#tab macOS}}
 
 Download the latest release; on macOs, type:
 ```
-curl -L {{#releaselink gomodule:"sigs.k8s.io/cluster-api-provider-aws" asset:"clusterawsadm-darwin-amd64" version:">=2.0.0"}} -o clusterawsadm
+curl -L {{#releaselink gomodule:"sigs.k8s.io/cluster-api-provider-aws" asset:"clusterawsadm-darwin-amd64" version:">=1.0.0"}} -o clusterawsadm
 ```
 
 Or if your Mac has an M1 CPU (”Apple Silicon”):
 ```
-curl -L {{#releaselink gomodule:"sigs.k8s.io/cluster-api-provider-aws" asset:"clusterawsadm-darwin-arm64" version:">=2.0.0"}} -o clusterawsadm
+curl -L {{#releaselink gomodule:"sigs.k8s.io/cluster-api-provider-aws" asset:"clusterawsadm-darwin-arm64" version:">=1.0.0"}} -o clusterawsadm
 ```
 
 Make it executable
@@ -344,27 +321,6 @@ Check version to confirm installation
 ```
 clusterawsadm version
 ```
-
-**Example Usage**
-```bash
-export AWS_REGION=us-east-1 # This is used to help encode your environment variables
-export AWS_ACCESS_KEY_ID=<your-access-key>
-export AWS_SECRET_ACCESS_KEY=<your-secret-access-key>
-export AWS_SESSION_TOKEN=<session-token> # If you are using Multi-Factor Auth.
-
-# The clusterawsadm utility takes the credentials that you set as environment
-# variables and uses them to create a CloudFormation stack in your AWS account
-# with the correct IAM resources.
-clusterawsadm bootstrap iam create-cloudformation-stack
-
-# Create the base64 encoded credentials using clusterawsadm.
-# This command uses your environment variables and encodes
-# them in a value to be stored in a Kubernetes Secret.
-export AWS_B64ENCODED_CREDENTIALS=$(clusterawsadm bootstrap credentials encode-as-profile)
-
-# Finally, initialize the management cluster
-clusterctl init --infrastructure aws
-```
 {{#/tab }}
 {{#tab homebrew}}
 
@@ -378,7 +334,11 @@ Check version to confirm installation
 clusterawsadm version
 ```
 
-**Example Usage**
+{{#/tab }}
+{{#/tabs }}
+
+The [clusterawsadm] command line utility assists with identity and access management (IAM) for [Cluster API Provider AWS][capa].
+
 ```bash
 export AWS_REGION=us-east-1 # This is used to help encode your environment variables
 export AWS_ACCESS_KEY_ID=<your-access-key>
@@ -399,43 +359,6 @@ export AWS_B64ENCODED_CREDENTIALS=$(clusterawsadm bootstrap credentials encode-a
 clusterctl init --infrastructure aws
 ```
 
-{{#/tab }}
-{{#tab Windows}}
-
-Download the latest release; on Windows, type:
-```
-curl.exe -L {{#releaselink gomodule:"sigs.k8s.io/cluster-api-provider-aws" asset:"clusterawsadm-windows-amd64" version:">=2.0.0"}} -o clusterawsadm.exe
-```
-
-Append or prepend the path of that directory to the `PATH` environment variable.
-Check version to confirm installation
-```
-clusterawsadm.exe version
-```
-
-**Example Usage in Powershell**
-```bash
-$Env:AWS_REGION="us-east-1" # This is used to help encode your environment variables
-$Env:AWS_ACCESS_KEY_ID="<your-access-key>"
-$Env:AWS_SECRET_ACCESS_KEY="<your-secret-access-key>"
-$Env:AWS_SESSION_TOKEN="<session-token>" # If you are using Multi-Factor Auth.
-
-# The clusterawsadm utility takes the credentials that you set as environment
-# variables and uses them to create a CloudFormation stack in your AWS account
-# with the correct IAM resources.
-clusterawsadm bootstrap iam create-cloudformation-stack
-
-# Create the base64 encoded credentials using clusterawsadm.
-# This command uses your environment variables and encodes
-# them in a value to be stored in a Kubernetes Secret.
-$Env:AWS_B64ENCODED_CREDENTIALS=$(clusterawsadm bootstrap credentials encode-as-profile)
-
-# Finally, initialize the management cluster
-clusterctl init --infrastructure aws
-```
-{{#/tab }}
-{{#/tabs }}
-
 See the [AWS provider prerequisites] document for more details.
 
 {{#/tab }}
@@ -675,7 +598,7 @@ export OSC_REGION=<you-region>
 # Create namespace
 kubectl create namespace cluster-api-provider-outscale-system
 # Create secret
-kubectl create secret generic cluster-api-provider-outscale --from-literal=access_key=${OSC_ACCESS_KEY} --from-literal=secret_key=${OSC_SECRET_KEY} --from-literal=region=${OSC_REGION}  -n cluster-api-provider-outscale-system
+kubectl create secret generic cluster-api-provider-outscale --from-literal=access_key=${OSC_ACCESS_KEY} --from-literal=secret_key=${OSC_SECRET_KEY} --from-literal=region=${OSC_REGION}  -n cluster-api-provider-outscale-system 
 # Initialize the management cluster
 clusterctl init --infrastructure outscale
 ```
@@ -1004,7 +927,7 @@ Please visit the [IBM Cloud provider] for more information.
 export KKZONE=""
 # The ssh name of the all instance Linux user. (e.g. root, ubuntu)
 export USER_NAME=<your-linux-user>
-# The ssh password of the all instance Linux user.
+# The ssh password of the all instance Linux user. 
 export PASSWORD=<your-linux-user-password>
 # The ssh IP address of the all instance. (e.g. "[{address: 192.168.100.3}, {address: 192.168.100.4}]")
 export INSTANCES=<your-linux-ip-address>
@@ -1214,7 +1137,7 @@ The Docker provider is not designed for production use and is intended for devel
 
 ```bash
 clusterctl generate cluster capi-quickstart --flavor development \
-  --kubernetes-version v1.26.0 \
+  --kubernetes-version v1.25.3 \
   --control-plane-machine-count=3 \
   --worker-machine-count=3 \
   > capi-quickstart.yaml
@@ -1226,7 +1149,7 @@ clusterctl generate cluster capi-quickstart --flavor development \
 ```bash
 export CLUSTER_NAME=kind
 export CLUSTER_NAMESPACE=vcluster
-export KUBERNETES_VERSION=1.26.0
+export KUBERNETES_VERSION=1.25.0
 export HELM_VALUES="service:\n  type: NodePort"
 
 kubectl create namespace ${CLUSTER_NAMESPACE}
@@ -1257,7 +1180,7 @@ clusterctl generate cluster capi-quickstart \
 
 ```bash
 clusterctl generate cluster capi-quickstart \
-  --kubernetes-version v1.26.0 \
+  --kubernetes-version v1.25.3 \
   --control-plane-machine-count=3 \
   --worker-machine-count=3 \
   > capi-quickstart.yaml
@@ -1317,7 +1240,7 @@ You should see an output is similar to this:
 
 ```bash
 NAME                    CLUSTER           INITIALIZED   API SERVER AVAILABLE   REPLICAS   READY   UPDATED   UNAVAILABLE   AGE    VERSION
-capi-quickstart-g2trk   capi-quickstart   true                                 3                  3         3             4m7s   v1.26.0
+capi-quickstart-g2trk   capi-quickstart   true                                 3                  3         3             4m7s   v1.25.3
 ```
 
 <aside class="note warning">
@@ -1519,12 +1442,12 @@ kubectl --kubeconfig=./capi-quickstart.kubeconfig get nodes
 ```
 ```bash
 NAME                                          STATUS   ROLES           AGE   VERSION
-capi-quickstart-g2trk-9xrjv                   Ready    control-plane   12m   v1.26.0
-capi-quickstart-g2trk-bmm9v                   Ready    control-plane   11m   v1.26.0
-capi-quickstart-g2trk-hvs9q                   Ready    control-plane   13m   v1.26.0
-capi-quickstart-md-0-55x6t-5649968bd7-8tq9v   Ready    <none>          12m   v1.26.0
-capi-quickstart-md-0-55x6t-5649968bd7-glnjd   Ready    <none>          12m   v1.26.0
-capi-quickstart-md-0-55x6t-5649968bd7-sfzp6   Ready    <none>          12m   v1.26.0
+capi-quickstart-g2trk-9xrjv                   Ready    control-plane   12m   v1.25.3
+capi-quickstart-g2trk-bmm9v                   Ready    control-plane   11m   v1.25.3
+capi-quickstart-g2trk-hvs9q                   Ready    control-plane   13m   v1.25.3
+capi-quickstart-md-0-55x6t-5649968bd7-8tq9v   Ready    <none>          12m   v1.25.3
+capi-quickstart-md-0-55x6t-5649968bd7-glnjd   Ready    <none>          12m   v1.25.3
+capi-quickstart-md-0-55x6t-5649968bd7-sfzp6   Ready    <none>          12m   v1.25.3
 ```
 
 {{#/tab }}
diff --git a/docs/proposals/20210526-cluster-class-and-managed-topologies.md b/docs/proposals/20210526-cluster-class-and-managed-topologies.md
index 7eb5255db..e079999b6 100644
--- a/docs/proposals/20210526-cluster-class-and-managed-topologies.md
+++ b/docs/proposals/20210526-cluster-class-and-managed-topologies.md
@@ -607,7 +607,7 @@ Note: Builtin variables are defined in [Builtin variables](#builtin-variables) b
       Name string `json:"name"`
 
       // The number of worker nodes belonging to this set.
-      // If the value is nil, the MachineDeployment is created without the number of Replicas (defaulting to 1)
+      // If the value is nil, the MachineDeployment is created without the number of Replicas (defaulting to zero)
       // and it's assumed that an external entity (like cluster autoscaler) is responsible for the management
       // of this value.
       // +optional
diff --git a/docs/proposals/images/runtime-hooks/runtime-hooks-openapi.yaml b/docs/proposals/images/runtime-hooks/runtime-hooks-openapi.yaml
index da2636778..3b55d0f89 100644
--- a/docs/proposals/images/runtime-hooks/runtime-hooks-openapi.yaml
+++ b/docs/proposals/images/runtime-hooks/runtime-hooks-openapi.yaml
@@ -525,7 +525,7 @@ components:
         replicas:
           description: Replicas is the number of worker nodes belonging to this set.
             If the value is nil, the MachineDeployment is created without the number
-            of Replicas (defaulting to 1) and it's assumed that an external entity
+            of Replicas (defaulting to zero) and it's assumed that an external entity
             (like cluster autoscaler) is responsible for the management of this value.
           format: int32
           type: integer
diff --git a/docs/release/release-tasks.md b/docs/release/release-tasks.md
index 7db7d86dc..28646fd98 100644
--- a/docs/release/release-tasks.md
+++ b/docs/release/release-tasks.md
@@ -12,39 +12,38 @@ This document details the responsibilities and tasks for each role in the releas
 <!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
 **Table of Contents**
 
-- [Release Tasks](#release-tasks)
-  - [Release Lead](#release-lead)
-    - [Responsibilities](#responsibilities)
-    - [Tasks](#tasks)
-      - [Set a tentative release date for the minor release](#set-a-tentative-release-date-for-the-minor-release)
-      - [Assemble release team](#assemble-release-team)
-      - [Finalize release schedule and team](#finalize-release-schedule-and-team)
-      - [Prepare main branch for development of the new release](#prepare-main-branch-for-development-of-the-new-release)
-      - [Create a new GitHub milestone for the next release](#create-a-new-github-milestone-for-the-next-release)
-      - [\[Track\] Remove previously deprecated code](#track-remove-previously-deprecated-code)
-      - [\[Track\] Bump dependencies](#track-bump-dependencies)
-      - [Create a release branch](#create-a-release-branch)
-      - [\[Continuously\] Maintain the GitHub release milestone](#continuously-maintain-the-github-release-milestone)
-      - [\[Repeatedly\] Cut a release](#repeatedly-cut-a-release)
-      - [\[Optional\] \[Track\] Bump the Cluster API apiVersion](#optional-track-bump-the-cluster-api-apiversion)
-      - [\[Optional\] \[Track\] Bump the Kubernetes version](#optional-track-bump-the-kubernetes-version)
-  - [Communications/Docs/Release Notes Manager](#communicationsdocsrelease-notes-manager)
-    - [Responsibilities](#responsibilities-1)
-    - [Tasks](#tasks-1)
-      - [Add docs to collect release notes for users and migration notes for provider implementers](#add-docs-to-collect-release-notes-for-users-and-migration-notes-for-provider-implementers)
-      - [Update supported versions](#update-supported-versions)
-      - [Ensure the book for the new release is available](#ensure-the-book-for-the-new-release-is-available)
-      - [Polish release notes](#polish-release-notes)
-      - [Change production branch in Netlify to the new release branch](#change-production-branch-in-netlify-to-the-new-release-branch)
-      - [Update clusterctl links in the quickstart](#update-clusterctl-links-in-the-quickstart)
-      - [Continuously: Communicate key dates to the community](#continuously-communicate-key-dates-to-the-community)
-  - [CI Signal/Bug Triage/Automation Manager](#ci-signalbug-triageautomation-manager)
-    - [Responsibilities](#responsibilities-2)
-    - [Tasks](#tasks-2)
-      - [Setup jobs and dashboards for a new release branch](#setup-jobs-and-dashboards-for-a-new-release-branch)
-      - [\[Continuously\] Monitor CI signal](#continuously-monitor-ci-signal)
-      - [\[Continuously\] Reduce the amount of flaky tests](#continuously-reduce-the-amount-of-flaky-tests)
-      - [\[Continuously\] Bug triage](#continuously-bug-triage)
+- [Release Lead](#release-lead)
+  - [Responsibilities](#responsibilities)
+  - [Tasks](#tasks)
+    - [Set a tentative release date for the minor release](#set-a-tentative-release-date-for-the-minor-release)
+    - [Assemble release team](#assemble-release-team)
+    - [Finalize release schedule and team](#finalize-release-schedule-and-team)
+    - [Prepare main branch for development of the new release](#prepare-main-branch-for-development-of-the-new-release)
+    - [Create a new GitHub milestone for the next release](#create-a-new-github-milestone-for-the-next-release)
+    - [[Track] Remove previously deprecated code](#track-remove-previously-deprecated-code)
+    - [[Track] Bump dependencies](#track-bump-dependencies)
+    - [Create a release branch](#create-a-release-branch)
+    - [[Continuously] Maintain the GitHub release milestone](#continuously-maintain-the-github-release-milestone)
+    - [[Repeatedly] Cut a release](#repeatedly-cut-a-release)
+    - [[Optional] [Track] Bump the Cluster API apiVersion](#optional-track-bump-the-cluster-api-apiversion)
+    - [[Optional] [Track] Bump the Kubernetes version](#optional-track-bump-the-kubernetes-version)
+- [Communications/Docs/Release Notes Manager](#communicationsdocsrelease-notes-manager)
+  - [Responsibilities](#responsibilities-1)
+  - [Tasks](#tasks-1)
+    - [Add docs to collect release notes for users and migration notes for provider implementers](#add-docs-to-collect-release-notes-for-users-and-migration-notes-for-provider-implementers)
+    - [Update supported versions](#update-supported-versions)
+    - [Ensure the book for the new release is available](#ensure-the-book-for-the-new-release-is-available)
+    - [Polish release notes](#polish-release-notes)
+    - [Change production branch in Netlify to the new release branch](#change-production-branch-in-netlify-to-the-new-release-branch)
+    - [Update clusterctl links in the quickstart](#update-clusterctl-links-in-the-quickstart)
+    - [Continuously: Communicate key dates to the community](#continuously-communicate-key-dates-to-the-community)
+- [CI Signal/Bug Triage/Automation Manager](#ci-signalbug-triageautomation-manager)
+  - [Responsibilities](#responsibilities-2)
+  - [Tasks](#tasks-2)
+    - [Setup jobs and dashboards for a new release branch](#setup-jobs-and-dashboards-for-a-new-release-branch)
+    - [[Continuously] Monitor CI signal](#continuously-monitor-ci-signal)
+    - [[Continuously] Reduce the amount of flaky tests](#continuously-reduce-the-amount-of-flaky-tests)
+    - [[Continuously] Bug triage](#continuously-bug-triage)
 
 <!-- END doctoc generated TOC please keep comment here to allow auto update -->
 
@@ -156,7 +155,6 @@ This can be done by:
 #### [Repeatedly] Cut a release
 
 1. Ensure CI is stable before cutting the release (e.g. by checking with the CI manager)
-   Note: special attention should be given to image scan results, so we can avoid cutting a release with CVE or document known CVEs in release notes.
 2. Create and push the release tags to the GitHub repository:
    ```bash 
    # Export the tag of the release to be cut, e.g.:
@@ -385,13 +383,10 @@ The goal of this task is to keep our tests running in CI stable.
 1. Add yourself to the [Cluster API alert mailing list](https://github.com/kubernetes/k8s.io/blob/151899b2de933e58a4dfd1bfc2c133ce5a8bbe22/groups/sig-cluster-lifecycle/groups.yaml#L20-L35)
     <br\>**Note**: An alternative to the alert mailing list is manually monitoring the [testgrid dashboards](https://testgrid.k8s.io/sig-cluster-lifecycle-cluster-api)
     (also dashboards of previous releases). Using the alert mailing list has proven to be a lot less effort though.
-2. Check the existing **failing-test** and **flaking-test** issue templates under `.github/ISSUE_TEMPLATE/` folder of the repo, used to create an issue for failing or flaking tests respectively. Please make sure they are up-to-date and if not, send a PR to update or improve them.
-3. Triage CI failures reported by mail alerts or found by monitoring the testgrid dashboards:
-    1. Create an issue using an appropriate template (failing-test) in the Cluster API repository to surface the CI failure.
+2. Triage CI failures reported by mail alerts or found by monitoring the testgrid dashboards:
+    1. Create an issue in the Cluster API repository to surface the CI failure.
     2. Identify if the issue is a known issue, new issue or a regression.
     3. Mark the issue as `release-blocking` if applicable.
-4. Triage periodic GitHub actions failures, with special attention to image scan results;
-   Eventually open issues as described above.
 
 #### [Continuously] Reduce the amount of flaky tests
 
@@ -403,7 +398,7 @@ To reduce the amount of flakes please periodically:
     * [periodic-cluster-api-e2e-mink8s-main](https://storage.googleapis.com/k8s-triage/index.html?pr=1&job=periodic-cluster-api-e2e-mink8s-main)
     * [periodic-cluster-api-test-main](https://storage.googleapis.com/k8s-triage/index.html?pr=1&job=periodic-cluster-api-test-main)
     * [periodic-cluster-api-test-mink8s-main](https://storage.googleapis.com/k8s-triage/index.html?pr=1&job=periodic-cluster-api-test-mink8s-main)
-2. Open issues using an appropriate template (flaking-test) for occurring flakes and ideally fix them or find someone who can.
+3. Open issues for occurring flakes and ideally fix them or find someone who can.
    **Note**: Given resource limitations in the Prow cluster it might not be possible to fix all flakes.
    Let's just try to pragmatically keep the amount of flakes pretty low.
 
diff --git a/go.mod b/go.mod
index 290e5da9b..8cc95e1c1 100644
--- a/go.mod
+++ b/go.mod
@@ -26,7 +26,7 @@ require (
 	github.com/spf13/cobra v1.6.1
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.14.0
-	github.com/valyala/fastjson v1.6.4
+	github.com/valyala/fastjson v1.6.3
 	go.etcd.io/etcd/api/v3 v3.5.5
 	go.etcd.io/etcd/client/v3 v3.5.5
 	golang.org/x/net v0.4.0 // indirect
diff --git a/go.sum b/go.sum
index 421518b63..d7cb16b49 100644
--- a/go.sum
+++ b/go.sum
@@ -563,8 +563,8 @@ github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69
 github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs=
 github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
-github.com/valyala/fastjson v1.6.4 h1:uAUNq9Z6ymTgGhcm0UynUAB6tlbakBrz6CQFax3BXVQ=
-github.com/valyala/fastjson v1.6.4/go.mod h1:CLCAqky6SMuOcxStkYQvblddUtoRxhYMGLrsQns1aXY=
+github.com/valyala/fastjson v1.6.3 h1:tAKFnnwmeMGPbwJ7IwxcTPCNr3uIzoIj3/Fh90ra4xc=
+github.com/valyala/fastjson v1.6.3/go.mod h1:CLCAqky6SMuOcxStkYQvblddUtoRxhYMGLrsQns1aXY=
 github.com/vincent-petithory/dataurl v1.0.0 h1:cXw+kPto8NLuJtlMsI152irrVw9fRDX8AbShPRpg2CI=
 github.com/vincent-petithory/dataurl v1.0.0/go.mod h1:FHafX5vmDzyP+1CQATJn7WFKc9CvnvxyvZy6I1MrG/U=
 github.com/vmware/vmw-guestinfo v0.0.0-20170707015358-25eff159a728/go.mod h1:x9oS4Wk2s2u4tS29nEaDLdzvuHdB19CvSGJjPgkZJNk=
diff --git a/hack/tools/go.mod b/hack/tools/go.mod
index b0f300325..fd1541490 100644
--- a/hack/tools/go.mod
+++ b/hack/tools/go.mod
@@ -12,7 +12,7 @@ require (
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/pkg/errors v0.9.1
 	github.com/spf13/pflag v1.0.5
-	github.com/valyala/fastjson v1.6.4
+	github.com/valyala/fastjson v1.6.3
 	golang.org/x/tools v0.1.12
 	google.golang.org/api v0.102.0
 	helm.sh/helm/v3 v3.10.3
diff --git a/hack/tools/go.sum b/hack/tools/go.sum
index 086d38a9a..e32ec59b4 100644
--- a/hack/tools/go.sum
+++ b/hack/tools/go.sum
@@ -512,8 +512,8 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
 github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs=
 github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
-github.com/valyala/fastjson v1.6.4 h1:uAUNq9Z6ymTgGhcm0UynUAB6tlbakBrz6CQFax3BXVQ=
-github.com/valyala/fastjson v1.6.4/go.mod h1:CLCAqky6SMuOcxStkYQvblddUtoRxhYMGLrsQns1aXY=
+github.com/valyala/fastjson v1.6.3 h1:tAKFnnwmeMGPbwJ7IwxcTPCNr3uIzoIj3/Fh90ra4xc=
+github.com/valyala/fastjson v1.6.3/go.mod h1:CLCAqky6SMuOcxStkYQvblddUtoRxhYMGLrsQns1aXY=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
diff --git a/hack/verify-container-images.sh b/hack/verify-container-images.sh
deleted file mode 100755
index 85a2dfa77..000000000
--- a/hack/verify-container-images.sh
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/bin/bash
-
-# Copyright 2022 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-set -o errexit
-set -o nounset
-set -o pipefail
-
-if [[ "${TRACE-0}" == "1" ]]; then
-    set -o xtrace
-fi
-
-TRIVY_VERSION=0.34.0
-
-GO_OS="$(go env GOOS)"
-if [[ "${GO_OS}" == "linux" ]]; then
-  TRIVY_OS="Linux"
-elif [[ "${GO_OS}" == "darwin"* ]]; then
-  TRIVY_OS="macOS"
-fi
-
-GO_ARCH="$(go env GOARCH)"
-if [[ "${GO_ARCH}" == "amd" ]]; then
-  TRIVY_ARCH="32bit"
-elif [[ "${GO_ARCH}" == "amd64"* ]]; then
-  TRIVY_ARCH="64bit"
-elif [[ "${GO_ARCH}" == "arm" ]]; then
-  TRIVY_ARCH="ARM"
-elif [[ "${GO_ARCH}" == "arm64" ]]; then
-  TRIVY_ARCH="ARM64"
-fi
-
-TOOL_BIN=hack/tools/bin
-mkdir -p ${TOOL_BIN}
-
-# Downloads trivy scanner
-curl -L -o ${TOOL_BIN}/trivy.tar.gz "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_${TRIVY_OS}-${TRIVY_ARCH}.tar.gz"
-
-tar -xf "${TOOL_BIN}/trivy.tar.gz" -C "${TOOL_BIN}" trivy
-chmod +x ${TOOL_BIN}/trivy
-rm ${TOOL_BIN}/trivy.tar.gz
-
-# Builds all the container images to be scanned and cleans up changes to ./*manager_image_patch.yaml ./*manager_pull_policy.yaml.
-make REGISTRY=gcr.io/k8s-staging-cluster-api PULL_POLICY=IfNotPresent TAG=dev docker-build
-make clean-release-git
-
-# Scan the images
-${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/clusterctl-"${GO_ARCH}":dev && R1=$? || R1=$?
-${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/test-extension-"${GO_ARCH}":dev && R2=$? || R2=$?
-${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/kubeadm-control-plane-controller-"${GO_ARCH}":dev && R3=$? || R3=$?
-${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/kubeadm-bootstrap-controller-"${GO_ARCH}":dev && R4=$? || R4=$?
-${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/cluster-api-controller-"${GO_ARCH}":dev && R5=$? || R5=$?
-${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api/capd-manager-"${GO_ARCH}":dev && R6=$? || R6=$?
-
-echo ""
-BRed='\033[1;31m'
-BGreen='\033[1;32m'
-NC='\033[0m' # No
-
-if [ "$R1" -ne "0" ] || [ "$R2"  -ne "0" ] || [ "$R3" -ne "0" ] || [ "$R4" -ne "0"  ] || [ "$R5" -ne "0"  ] || [ "$R6" -ne "0" ]
-then
-  echo -e "${BRed}Check container images failed! There are vulnerability to be fixed${NC}"
-  exit 1
-fi
-
-echo -e "${BGreen}Check container images passed! No vulnerability found${NC}"


Test patch:
diff --git a/.github/ISSUE_TEMPLATE/failing-test.md b/.github/ISSUE_TEMPLATE/failing-test.md
deleted file mode 100644
index 99f4f5d26..000000000
--- a/.github/ISSUE_TEMPLATE/failing-test.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-name: 🚨 Failing Test
-about: Report continuously failing tests or jobs in Cluster API CI
-title: ''
-labels: ''
-assignees: ''
-
----
-
-<!-- Please only use this template for submitting reports about continuously failing tests or jobs in Cluster API CI -->
-
-**Which jobs are failing:**
-
-**Which tests are failing:**
-
-**Since when has it been failing:**
-
-**Testgrid link:**
-
-**Reason for failure (if possible):**
-
-**Anything else we need to know:**
-
-/kind failing-test
-
-[One or more /area label. See https://github.com/kubernetes-sigs/cluster-api/labels?q=area for the list of labels]
\ No newline at end of file
diff --git a/.github/ISSUE_TEMPLATE/flaking-test.md b/.github/ISSUE_TEMPLATE/flaking-test.md
deleted file mode 100644
index 942910d27..000000000
--- a/.github/ISSUE_TEMPLATE/flaking-test.md
+++ /dev/null
@@ -1,27 +0,0 @@
----
-name: ❄️ Flaking Test
-about: Report flaky tests or jobs in Cluster API CI
-title: ''
-labels: ''
-assignees: ''
-
----
-
-<!-- Please only use this template for submitting reports about flaky tests or jobs (pass or fail with no underlying change in code) in Cluster API CI -->
-
-**Which jobs are flaking:**
-
-**Which tests are flaking:**
-
-**Testgrid link:**
-
-**Reason for failure (if possible):**
-
-**Anything else we need to know:**
-- links to go.k8s.io/triage appreciated
-- links to specific failures in spyglass appreciated
-
-
-/kind flake
-
-[One or more /area label. See https://github.com/kubernetes-sigs/cluster-api/labels?q=area for the list of labels]
\ No newline at end of file
diff --git a/cmd/clusterctl/client/client_test.go b/cmd/clusterctl/client/client_test.go
index ca24a33c0..6da604f0e 100644
--- a/cmd/clusterctl/client/client_test.go
+++ b/cmd/clusterctl/client/client_test.go
@@ -108,6 +108,10 @@ func (f fakeClient) Move(options MoveOptions) error {
 	return f.internalClient.Move(options)
 }
 
+func (f fakeClient) Backup(options BackupOptions) error {
+	return f.internalClient.Backup(options)
+}
+
 func (f fakeClient) Restore(options RestoreOptions) error {
 	return f.internalClient.Restore(options)
 }
diff --git a/cmd/clusterctl/client/cluster/mover_test.go b/cmd/clusterctl/client/cluster/mover_test.go
index 499d28e52..5882abd06 100644
--- a/cmd/clusterctl/client/cluster/mover_test.go
+++ b/cmd/clusterctl/client/cluster/mover_test.go
@@ -840,7 +840,7 @@ func Test_objectMover_restoreTargetObject(t *testing.T) {
 	}
 }
 
-func Test_objectMover_toDirectory(t *testing.T) {
+func Test_objectMover_backup(t *testing.T) {
 	// NB. we are testing the move and move sequence using the same set of moveTests, but checking the results at different stages of the move process
 	for _, tt := range backupRestoreTests {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/cmd/clusterctl/client/cluster/template_test.go b/cmd/clusterctl/client/cluster/template_test.go
index 696b7f6b4..af9ba015e 100644
--- a/cmd/clusterctl/client/cluster/template_test.go
+++ b/cmd/clusterctl/client/cluster/template_test.go
@@ -20,7 +20,6 @@ import (
 	"encoding/base64"
 	"fmt"
 	"net/http"
-	"net/http/httptest"
 	"net/url"
 	"os"
 	"path/filepath"
@@ -226,49 +225,6 @@ func Test_templateClient_getGitHubFileContent(t *testing.T) {
 	}
 }
 
-func Test_templateClient_getRawUrlFileContent(t *testing.T) {
-	fakeServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		fmt.Fprint(w, template)
-	}))
-
-	defer fakeServer.Close()
-
-	type args struct {
-		rURL string
-	}
-	tests := []struct {
-		name    string
-		args    args
-		want    []byte
-		wantErr bool
-	}{
-		{
-			name: "Return custom template",
-			args: args{
-				rURL: fakeServer.URL,
-			},
-			want:    []byte(template),
-			wantErr: false,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			g := NewWithT(t)
-
-			c := newTemplateClient(TemplateClientInput{})
-			got, err := c.getRawURLFileContent(tt.args.rURL)
-			if tt.wantErr {
-				g.Expect(err).To(HaveOccurred())
-				return
-			}
-
-			g.Expect(err).NotTo(HaveOccurred())
-
-			g.Expect(got).To(Equal(tt.want))
-		})
-	}
-}
-
 func Test_templateClient_getLocalFileContent(t *testing.T) {
 	g := NewWithT(t)
 
diff --git a/cmd/clusterctl/client/move_test.go b/cmd/clusterctl/client/move_test.go
index 94808b121..3b9245cf2 100644
--- a/cmd/clusterctl/client/move_test.go
+++ b/cmd/clusterctl/client/move_test.go
@@ -139,7 +139,7 @@ func Test_clusterctlClient_Move(t *testing.T) {
 	}
 }
 
-func Test_clusterctlClient_ToDirectory(t *testing.T) {
+func Test_clusterctlClient_Backup(t *testing.T) {
 	dir, err := os.MkdirTemp("/tmp", "cluster-api")
 	if err != nil {
 		t.Error(err)
@@ -152,7 +152,7 @@ func Test_clusterctlClient_ToDirectory(t *testing.T) {
 	// These tests are checking the Backup scaffolding
 	// The internal library handles the backup logic and tests can be found there
 	type args struct {
-		options MoveOptions
+		options BackupOptions
 	}
 	tests := []struct {
 		name    string
@@ -166,9 +166,9 @@ func Test_clusterctlClient_ToDirectory(t *testing.T) {
 				client: fakeClientForMove(), // core v1.0.0 (v1.0.1 available), infra v2.0.0 (v2.0.1 available)
 			},
 			args: args{
-				options: MoveOptions{
+				options: BackupOptions{
 					FromKubeconfig: Kubeconfig{Path: "kubeconfig", Context: "mgmt-context"},
-					ToDirectory:    dir,
+					Directory:      dir,
 				},
 			},
 			wantErr: false,
@@ -179,9 +179,9 @@ func Test_clusterctlClient_ToDirectory(t *testing.T) {
 				client: fakeClientForMove(), // core v1.0.0 (v1.0.1 available), infra v2.0.0 (v2.0.1 available)
 			},
 			args: args{
-				options: MoveOptions{
+				options: BackupOptions{
 					FromKubeconfig: Kubeconfig{Path: "kubeconfig", Context: "does-not-exist"},
-					ToDirectory:    dir,
+					Directory:      dir,
 				},
 			},
 			wantErr: true,
@@ -192,7 +192,7 @@ func Test_clusterctlClient_ToDirectory(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			g := NewWithT(t)
 
-			err := tt.fields.client.Move(tt.args.options)
+			err := tt.fields.client.Backup(tt.args.options)
 			if tt.wantErr {
 				g.Expect(err).To(HaveOccurred())
 				return
diff --git a/docs/book/src/developer/e2e.md b/docs/book/src/developer/e2e.md
index 94762a200..07748163c 100644
--- a/docs/book/src/developer/e2e.md
+++ b/docs/book/src/developer/e2e.md
@@ -77,6 +77,16 @@ This method:
 - Waits for the providers controllers to be running.
 - Creates log watchers for all the providers
 
+<aside class="note">
+
+<h1>Deprecated InitManagementCluster method</h1>
+
+The [Cluster API test framework] also includes a [deprecated InitManagementCluster method] implementation,
+that was used before the introduction of clusterctl. This might be removed in future releases
+of the test framework.
+
+</aside>
+
 ## Writing test specs
 
 A typical test spec is a sequence of:
@@ -192,6 +202,7 @@ test specs for the most common Cluster API use cases.
 [Cluster API quick start]:  ../user/quick-start.md
 [Cluster API test framework]: https://pkg.go.dev/sigs.k8s.io/cluster-api/test/framework?tab=doc
 [deprecated E2E config file]: https://pkg.go.dev/sigs.k8s.io/cluster-api/test/framework?tab=doc#Config
+[deprecated InitManagementCluster method]: https://pkg.go.dev/sigs.k8s.io/cluster-api/test/framework?tab=doc#InitManagementCluster
 [Apply method]: https://pkg.go.dev/sigs.k8s.io/cluster-api/test/framework?tab=doc#Applier
 [CAPA E2E tests]: https://github.com/kubernetes-sigs/cluster-api-provider-aws/blob/main/scripts/ci-e2e.sh
 [CAPG E2E tests]: https://github.com/kubernetes-sigs/cluster-api-provider-gcp/blob/main/scripts/ci-e2e.sh
diff --git a/test/e2e/clusterctl_upgrade_test.go b/test/e2e/clusterctl_upgrade_test.go
index 193d7f155..c5e76ae4b 100644
--- a/test/e2e/clusterctl_upgrade_test.go
+++ b/test/e2e/clusterctl_upgrade_test.go
@@ -68,7 +68,7 @@ var _ = Describe("When testing clusterctl upgrades (v1.2=>current)", func() {
 			SkipCleanup:               skipCleanup,
 			InitWithBinary:            "https://github.com/kubernetes-sigs/cluster-api/releases/download/v1.2.7/clusterctl-{OS}-{ARCH}",
 			InitWithProvidersContract: "v1beta1",
-			InitWithKubernetesVersion: "v1.26.0",
+			InitWithKubernetesVersion: "v1.25.3",
 		}
 	})
 })
@@ -83,7 +83,7 @@ var _ = Describe("When testing clusterctl upgrades (v1.3=>current)", func() {
 			SkipCleanup:               skipCleanup,
 			InitWithBinary:            "https://github.com/kubernetes-sigs/cluster-api/releases/download/v1.3.0/clusterctl-{OS}-{ARCH}",
 			InitWithProvidersContract: "v1beta1",
-			InitWithKubernetesVersion: "v1.26.0",
+			InitWithKubernetesVersion: "v1.25.3",
 		}
 	})
 })
@@ -98,7 +98,7 @@ var _ = Describe("When testing clusterctl upgrades using ClusterClass (v1.2=>cur
 			SkipCleanup:               skipCleanup,
 			InitWithBinary:            "https://github.com/kubernetes-sigs/cluster-api/releases/download/v1.2.7/clusterctl-{OS}-{ARCH}",
 			InitWithProvidersContract: "v1beta1",
-			InitWithKubernetesVersion: "v1.26.0",
+			InitWithKubernetesVersion: "v1.25.3",
 			WorkloadFlavor:            "topology",
 		}
 	})
@@ -114,7 +114,7 @@ var _ = Describe("When testing clusterctl upgrades using ClusterClass (v1.3=>cur
 			SkipCleanup:               skipCleanup,
 			InitWithBinary:            "https://github.com/kubernetes-sigs/cluster-api/releases/download/v1.3.0/clusterctl-{OS}-{ARCH}",
 			InitWithProvidersContract: "v1beta1",
-			InitWithKubernetesVersion: "v1.26.0",
+			InitWithKubernetesVersion: "v1.25.3",
 			WorkloadFlavor:            "topology",
 		}
 	})
diff --git a/test/e2e/config/docker.yaml b/test/e2e/config/docker.yaml
index 44ba0e2ab..3f093455b 100644
--- a/test/e2e/config/docker.yaml
+++ b/test/e2e/config/docker.yaml
@@ -254,11 +254,11 @@ variables:
   # allowing the same e2e config file to be re-used in different Prow jobs e.g. each one with a K8s version permutation.
   # The following Kubernetes versions should be the latest versions with already published kindest/node images.
   # This avoids building node images in the default case which improves the test duration significantly.
-  KUBERNETES_VERSION_MANAGEMENT: "v1.26.0"
-  KUBERNETES_VERSION: "v1.26.0"
-  KUBERNETES_VERSION_UPGRADE_FROM: "v1.25.3"
-  KUBERNETES_VERSION_UPGRADE_TO: "v1.26.0"
-  ETCD_VERSION_UPGRADE_TO: "3.5.6-0"
+  KUBERNETES_VERSION_MANAGEMENT: "v1.25.3"
+  KUBERNETES_VERSION: "v1.25.3"
+  KUBERNETES_VERSION_UPGRADE_FROM: "v1.24.7"
+  KUBERNETES_VERSION_UPGRADE_TO: "v1.25.3"
+  ETCD_VERSION_UPGRADE_TO: "3.5.4-0"
   COREDNS_VERSION_UPGRADE_TO: "v1.9.3"
   DOCKER_SERVICE_DOMAIN: "cluster.local"
   IP_FAMILY: "IPv4"
diff --git a/test/e2e/data/infrastructure-docker/v1beta1/main/cluster-template-ipv6/cluster-ipv6.yaml b/test/e2e/data/infrastructure-docker/v1beta1/main/cluster-template-ipv6/cluster-ipv6.yaml
index 0401174fb..90b25a2ae 100644
--- a/test/e2e/data/infrastructure-docker/v1beta1/main/cluster-template-ipv6/cluster-ipv6.yaml
+++ b/test/e2e/data/infrastructure-docker/v1beta1/main/cluster-template-ipv6/cluster-ipv6.yaml
@@ -9,12 +9,3 @@ spec:
       cidrBlocks: ['${DOCKER_SERVICE_IPV6_CIDRS}']
     pods:
       cidrBlocks: ['${DOCKER_POD_IPV6_CIDRS}']
----
-apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
-kind: DockerCluster
-metadata:
-  name: '${CLUSTER_NAME}'
-spec:
-  controlPlaneEndpoint:
-    port: 7777
-    host: ""
diff --git a/test/framework/bootstrap/kind_provider.go b/test/framework/bootstrap/kind_provider.go
index eb13eeefb..e8cded2e4 100644
--- a/test/framework/bootstrap/kind_provider.go
+++ b/test/framework/bootstrap/kind_provider.go
@@ -37,7 +37,7 @@ const (
 	DefaultNodeImageRepository = "kindest/node"
 
 	// DefaultNodeImageVersion is the default Kubernetes version to be used for creating a kind cluster.
-	DefaultNodeImageVersion = "v1.26.0"
+	DefaultNodeImageVersion = "v1.25.3"
 )
 
 // KindClusterOption is a NewKindClusterProvider option.
diff --git a/test/go.mod b/test/go.mod
index 9fc015041..a7cfd7a2a 100644
--- a/test/go.mod
+++ b/test/go.mod
@@ -105,7 +105,7 @@ require (
 	github.com/spf13/viper v1.14.0 // indirect
 	github.com/stoewer/go-strcase v1.2.0 // indirect
 	github.com/subosito/gotenv v1.4.1 // indirect
-	github.com/valyala/fastjson v1.6.4 // indirect
+	github.com/valyala/fastjson v1.6.3 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.8.0 // indirect
 	go.uber.org/zap v1.21.0 // indirect
diff --git a/test/go.sum b/test/go.sum
index 044d39f3c..1d878116e 100644
--- a/test/go.sum
+++ b/test/go.sum
@@ -508,8 +508,8 @@ github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69
 github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs=
 github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
-github.com/valyala/fastjson v1.6.4 h1:uAUNq9Z6ymTgGhcm0UynUAB6tlbakBrz6CQFax3BXVQ=
-github.com/valyala/fastjson v1.6.4/go.mod h1:CLCAqky6SMuOcxStkYQvblddUtoRxhYMGLrsQns1aXY=
+github.com/valyala/fastjson v1.6.3 h1:tAKFnnwmeMGPbwJ7IwxcTPCNr3uIzoIj3/Fh90ra4xc=
+github.com/valyala/fastjson v1.6.3/go.mod h1:CLCAqky6SMuOcxStkYQvblddUtoRxhYMGLrsQns1aXY=
 github.com/vincent-petithory/dataurl v1.0.0 h1:cXw+kPto8NLuJtlMsI152irrVw9fRDX8AbShPRpg2CI=
 github.com/vincent-petithory/dataurl v1.0.0/go.mod h1:FHafX5vmDzyP+1CQATJn7WFKc9CvnvxyvZy6I1MrG/U=
 github.com/vmware/vmw-guestinfo v0.0.0-20170707015358-25eff159a728/go.mod h1:x9oS4Wk2s2u4tS29nEaDLdzvuHdB19CvSGJjPgkZJNk=
diff --git a/test/infrastructure/docker/Dockerfile b/test/infrastructure/docker/Dockerfile
index 9fd743405..97c872de2 100644
--- a/test/infrastructure/docker/Dockerfile
+++ b/test/infrastructure/docker/Dockerfile
@@ -33,7 +33,7 @@ ENV GOPROXY=$goproxy
 # Gets additional CAPD dependencies
 WORKDIR /tmp
 
-RUN curl -LO "https://dl.k8s.io/release/v1.26.0/bin/linux/${ARCH}/kubectl" && \
+RUN curl -LO "https://dl.k8s.io/release/v1.25.3/bin/linux/${ARCH}/kubectl" && \
     chmod +x ./kubectl && \
     mv ./kubectl /usr/bin/kubectl
 
diff --git a/test/infrastructure/docker/api/v1beta1/dockercluster_types.go b/test/infrastructure/docker/api/v1beta1/dockercluster_types.go
index b4c138bb6..ab2b7e83b 100644
--- a/test/infrastructure/docker/api/v1beta1/dockercluster_types.go
+++ b/test/infrastructure/docker/api/v1beta1/dockercluster_types.go
@@ -91,7 +91,6 @@ type APIEndpoint struct {
 	Host string `json:"host"`
 
 	// Port is the port on which the API server is serving.
-	// Defaults to 6443 if not set.
 	Port int `json:"port"`
 }
 
diff --git a/test/infrastructure/docker/api/v1beta1/dockercluster_webhook.go b/test/infrastructure/docker/api/v1beta1/dockercluster_webhook.go
index 97c4af588..9cfeb6db7 100644
--- a/test/infrastructure/docker/api/v1beta1/dockercluster_webhook.go
+++ b/test/infrastructure/docker/api/v1beta1/dockercluster_webhook.go
@@ -61,11 +61,7 @@ func (c *DockerCluster) ValidateDelete() error {
 	return nil
 }
 
-func defaultDockerClusterSpec(s *DockerClusterSpec) {
-	if s.ControlPlaneEndpoint.Port == 0 {
-		s.ControlPlaneEndpoint.Port = 6443
-	}
-}
+func defaultDockerClusterSpec(_ *DockerClusterSpec) {}
 
 func validateDockerClusterSpec(_ DockerClusterSpec) field.ErrorList {
 	return nil
diff --git a/test/infrastructure/docker/api/v1beta1/dockerclustertemplate_types.go b/test/infrastructure/docker/api/v1beta1/dockerclustertemplate_types.go
index 52ccf5cde..8ce477f05 100644
--- a/test/infrastructure/docker/api/v1beta1/dockerclustertemplate_types.go
+++ b/test/infrastructure/docker/api/v1beta1/dockerclustertemplate_types.go
@@ -27,7 +27,6 @@ type DockerClusterTemplateSpec struct {
 	Template DockerClusterTemplateResource `json:"template"`
 }
 
-// +kubebuilder:resource:path=dockerclustertemplates,scope=Namespaced,categories=cluster-api
 // +kubebuilder:object:root=true
 // +kubebuilder:storageversion
 // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description="Time duration since creation of DockerClusterTemplate"
@@ -41,6 +40,7 @@ type DockerClusterTemplate struct {
 }
 
 // +kubebuilder:object:root=true
+// +kubebuilder:resource:path=dockerclustertemplates,scope=Namespaced,categories=cluster-api
 
 // DockerClusterTemplateList contains a list of DockerClusterTemplate.
 type DockerClusterTemplateList struct {
diff --git a/test/infrastructure/docker/config/crd/bases/infrastructure.cluster.x-k8s.io_dockerclusters.yaml b/test/infrastructure/docker/config/crd/bases/infrastructure.cluster.x-k8s.io_dockerclusters.yaml
index 668271447..072029920 100644
--- a/test/infrastructure/docker/config/crd/bases/infrastructure.cluster.x-k8s.io_dockerclusters.yaml
+++ b/test/infrastructure/docker/config/crd/bases/infrastructure.cluster.x-k8s.io_dockerclusters.yaml
@@ -349,7 +349,6 @@ spec:
                     type: string
                   port:
                     description: Port is the port on which the API server is serving.
-                      Defaults to 6443 if not set.
                     type: integer
                 required:
                 - host
diff --git a/test/infrastructure/docker/config/crd/bases/infrastructure.cluster.x-k8s.io_dockerclustertemplates.yaml b/test/infrastructure/docker/config/crd/bases/infrastructure.cluster.x-k8s.io_dockerclustertemplates.yaml
index d1356009f..03bd90f6c 100644
--- a/test/infrastructure/docker/config/crd/bases/infrastructure.cluster.x-k8s.io_dockerclustertemplates.yaml
+++ b/test/infrastructure/docker/config/crd/bases/infrastructure.cluster.x-k8s.io_dockerclustertemplates.yaml
@@ -9,8 +9,6 @@ metadata:
 spec:
   group: infrastructure.cluster.x-k8s.io
   names:
-    categories:
-    - cluster-api
     kind: DockerClusterTemplate
     listKind: DockerClusterTemplateList
     plural: dockerclustertemplates
@@ -181,7 +179,7 @@ spec:
                             type: string
                           port:
                             description: Port is the port on which the API server
-                              is serving. Defaults to 6443 if not set.
+                              is serving.
                             type: integer
                         required:
                         - host
diff --git a/test/infrastructure/docker/examples/machine-pool.yaml b/test/infrastructure/docker/examples/machine-pool.yaml
index 4bade9328..37b29bbbd 100644
--- a/test/infrastructure/docker/examples/machine-pool.yaml
+++ b/test/infrastructure/docker/examples/machine-pool.yaml
@@ -35,7 +35,7 @@ metadata:
   namespace: default
 spec:
   replicas: 1
-  version: v1.26.0
+  version: v1.25.3
   machineTemplate:
     infrastructureRef:
       apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
@@ -80,7 +80,7 @@ spec:
   replicas: 2
   template:
     spec:
-      version: v1.26.0
+      version: v1.25.3
       clusterName: my-cluster
       bootstrap:
         configRef:
diff --git a/test/infrastructure/docker/examples/simple-cluster-ipv6.yaml b/test/infrastructure/docker/examples/simple-cluster-ipv6.yaml
index 95cda19c0..9bc992520 100644
--- a/test/infrastructure/docker/examples/simple-cluster-ipv6.yaml
+++ b/test/infrastructure/docker/examples/simple-cluster-ipv6.yaml
@@ -35,7 +35,7 @@ metadata:
   namespace: default
 spec:
   replicas: 1
-  version: v1.26.0
+  version: v1.25.3
   machineTemplate:
     infrastructureRef:
       apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
@@ -90,7 +90,7 @@ spec:
       cluster.x-k8s.io/cluster-name: my-cluster
   template:
     spec:
-      version: v1.26.0
+      version: v1.25.3
       clusterName: my-cluster
       bootstrap:
         configRef:
diff --git a/test/infrastructure/docker/examples/simple-cluster-without-kcp.yaml b/test/infrastructure/docker/examples/simple-cluster-without-kcp.yaml
index 10ca83cdc..e8ed00b26 100644
--- a/test/infrastructure/docker/examples/simple-cluster-without-kcp.yaml
+++ b/test/infrastructure/docker/examples/simple-cluster-without-kcp.yaml
@@ -32,7 +32,7 @@ metadata:
   name: controlplane-0
   namespace: default
 spec:
-  version: v1.26.0
+  version: v1.25.3
   clusterName: my-cluster
   bootstrap:
     configRef:
@@ -80,7 +80,7 @@ spec:
       cluster.x-k8s.io/cluster-name: my-cluster
   template:
     spec:
-      version: v1.26.0
+      version: v1.25.3
       clusterName: my-cluster
       bootstrap:
         configRef:
diff --git a/test/infrastructure/docker/examples/simple-cluster.yaml b/test/infrastructure/docker/examples/simple-cluster.yaml
index 38db43941..9d68f6b33 100644
--- a/test/infrastructure/docker/examples/simple-cluster.yaml
+++ b/test/infrastructure/docker/examples/simple-cluster.yaml
@@ -35,7 +35,7 @@ metadata:
   namespace: default
 spec:
   replicas: 1
-  version: v1.26.0
+  version: v1.25.3
   machineTemplate:
     infrastructureRef:
       apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
@@ -83,7 +83,7 @@ spec:
       cluster.x-k8s.io/cluster-name: my-cluster
   template:
     spec:
-      version: v1.26.0
+      version: v1.25.3
       clusterName: my-cluster
       bootstrap:
         configRef:
diff --git a/test/infrastructure/docker/internal/controllers/dockercluster_controller.go b/test/infrastructure/docker/internal/controllers/dockercluster_controller.go
index 18fd6ed44..f775d7d7a 100644
--- a/test/infrastructure/docker/internal/controllers/dockercluster_controller.go
+++ b/test/infrastructure/docker/internal/controllers/dockercluster_controller.go
@@ -153,10 +153,9 @@ func (r *DockerClusterReconciler) reconcileNormal(ctx context.Context, dockerClu
 		return ctrl.Result{}, errors.Wrap(err, "failed to get ip for the load balancer")
 	}
 
-	if dockerCluster.Spec.ControlPlaneEndpoint.Host == "" {
-		// Surface the control plane endpoint
-		// Note: the control plane port is already set by the user or defaulted by the dockerCluster webhook.
-		dockerCluster.Spec.ControlPlaneEndpoint.Host = lbIP
+	dockerCluster.Spec.ControlPlaneEndpoint = infrav1.APIEndpoint{
+		Host: lbIP,
+		Port: 6443,
 	}
 
 	// Mark the dockerCluster ready
diff --git a/test/infrastructure/docker/internal/docker/kind_manager_test.go b/test/infrastructure/docker/internal/docker/kind_manager_test.go
index 58bf2d86e..0a616611e 100644
--- a/test/infrastructure/docker/internal/docker/kind_manager_test.go
+++ b/test/infrastructure/docker/internal/docker/kind_manager_test.go
@@ -135,6 +135,4 @@ func TestCreateExternalLoadBalancerNode(t *testing.T) {
 	g.Expect(runConfig).ToNot(BeNil())
 	g.Expect(runConfig.Labels).To(HaveLen(2))
 	g.Expect(runConfig.Labels["io.x-k8s.kind.role"]).To(Equal(constants.ExternalLoadBalancerNodeRoleValue))
-	g.Expect(runConfig.PortMappings).To(HaveLen(1))
-	g.Expect(runConfig.PortMappings[0].ContainerPort).To(Equal(int32(ControlPlanePort)))
 }
diff --git a/test/infrastructure/docker/internal/docker/loadbalancer.go b/test/infrastructure/docker/internal/docker/loadbalancer.go
index 1508ad4df..e29e16310 100644
--- a/test/infrastructure/docker/internal/docker/loadbalancer.go
+++ b/test/infrastructure/docker/internal/docker/loadbalancer.go
@@ -38,12 +38,11 @@ type lbCreator interface {
 
 // LoadBalancer manages the load balancer for a specific docker cluster.
 type LoadBalancer struct {
-	name             string
-	image            string
-	container        *types.Node
-	ipFamily         clusterv1.ClusterIPFamily
-	lbCreator        lbCreator
-	controlPlanePort int
+	name      string
+	image     string
+	container *types.Node
+	ipFamily  clusterv1.ClusterIPFamily
+	lbCreator lbCreator
 }
 
 // NewLoadBalancer returns a new helper for managing a docker loadbalancer with a given name.
@@ -72,12 +71,11 @@ func NewLoadBalancer(ctx context.Context, cluster *clusterv1.Cluster, dockerClus
 	image := getLoadBalancerImage(dockerCluster)
 
 	return &LoadBalancer{
-		name:             cluster.Name,
-		image:            image,
-		container:        container,
-		ipFamily:         ipFamily,
-		lbCreator:        &Manager{},
-		controlPlanePort: dockerCluster.Spec.ControlPlaneEndpoint.Port,
+		name:      cluster.Name,
+		image:     image,
+		container: container,
+		ipFamily:  ipFamily,
+		lbCreator: &Manager{},
 	}, nil
 }
 
@@ -168,7 +166,7 @@ func (s *LoadBalancer) UpdateConfiguration(ctx context.Context) error {
 	}
 
 	loadBalancerConfig, err := loadbalancer.Config(&loadbalancer.ConfigData{
-		ControlPlanePort: s.controlPlanePort,
+		ControlPlanePort: 6443,
 		BackendServers:   backendServers,
 		IPv6:             s.ipFamily == clusterv1.IPv6IPFamily,
 	})
diff --git a/test/infrastructure/docker/internal/docker/machine.go b/test/infrastructure/docker/internal/docker/machine.go
index 65df223db..9c85391be 100644
--- a/test/infrastructure/docker/internal/docker/machine.go
+++ b/test/infrastructure/docker/internal/docker/machine.go
@@ -50,7 +50,7 @@ import (
 
 const (
 	defaultImageName = "kindest/node"
-	defaultImageTag  = "v1.26.0"
+	defaultImageTag  = "v1.25.3"
 )
 
 type nodeCreator interface {