Repository: kubernetes-sigs/cluster-api
Pull request #7394 (2022-10-11 15:51:44)

:bug: Ensure Kubeadmconfig is reconciled after datasecretname is set
Signed-off-by: killianmuldoon <kmuldoon@vmware.com>

This changes the order in which the bootstrap reconciliation is done in the Machine controller to ensure the ownerReference, and other changes, are set before the dataSecretName is checked. This is designed to help in backup and restore use cases, or any other case where the ownerReference is removed.

In the previous code once the dataSecretName is set the KubeadmConfigTemplate never has its ownerReferences and labels reconciled. This change makes the reconcile loop always attempt to make changes to the bootstrap object, even if the secret name has previously been set.

#6980 


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by:
**Once this PR has been reviewed and has the lgtm label**, please assign sbueringer for approval by writing `/assign @sbueringer` in a comment. For more information see:[The Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fcluster-api).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/kubernetes-sigs/cluster-api/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["sbueringer"]} -->
k8s-ci-robot: @killianmuldoon: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-cluster-api-test-main | 18549ff6afb5d43c1e6994407345364099f6bd59 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_cluster-api/7394/pull-cluster-api-test-main/1579862329309270016) | true | `/test pull-cluster-api-test-main`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=cluster-api&pr=7394). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Akillianmuldoon). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/cluster-api/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @killianmuldoon: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-cluster-api-test-main | 18549ff6afb5d43c1e6994407345364099f6bd59 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_cluster-api/7394/pull-cluster-api-test-main/1579862329309270016) | true | `/test pull-cluster-api-test-main`
pull-cluster-api-test-mink8s-main | 18549ff6afb5d43c1e6994407345364099f6bd59 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_cluster-api/7394/pull-cluster-api-test-mink8s-main/1579862329342824448) | true | `/test pull-cluster-api-test-mink8s-main`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=cluster-api&pr=7394). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Akillianmuldoon). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/cluster-api/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
sbueringer: > This changes the order in which the bootstrap reconciliation is done in the Machine controller to ensure the ownerReference, and other changes, are set after the dataSecretName has been set.

"are set after the dataSecretName has been set" should be "are set **before** the dataSecretName has been set", right?

killianmuldoon: > "are set after the dataSecretName has been set" should be "are set before the dataSecretName has been set", right? (or rather before we check for if dataSecretName is set and then just return)

Sorry for the ambiguity here - this was meant to mean after it's set on the object, rather than referencing when the check happens.
k8s-ci-robot: New changes are detected. LGTM label has been removed.
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by:
**Once this PR has been reviewed and has the lgtm label**, please ask for approval from fabriziopandini by writing `/assign @fabriziopandini` in a comment. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fcluster-api).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/kubernetes-sigs/cluster-api/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["fabriziopandini"]} -->
sbueringer: No worries! I understood what the plan was independent of the phrasing :) 

/lgtm

/assign @fabriziopandini 
for approval
k8s-ci-robot: New changes are detected. LGTM label has been removed.

Patch:
diff --git a/.golangci.yml b/.golangci.yml
index aa34d6e7a..903ee75b5 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -176,7 +176,7 @@ linters-settings:
       - name: errorf
       - name: empty-block
       - name: superfluous-else
-      - name: unused-parameter
+      #- name: unused-parameter  # TODO This is a recommended rule with many findings which may require it's own pr.
       - name: unreachable-code
       - name: redefines-builtin-id
       #
diff --git a/Makefile b/Makefile
index 9db1137af..ab04306cc 100644
--- a/Makefile
+++ b/Makefile
@@ -46,9 +46,6 @@ export KUBEBUILDER_CONTROLPLANE_STOP_TIMEOUT ?= 60s
 # This option is for running docker manifest command
 export DOCKER_CLI_EXPERIMENTAL := enabled
 
-# Enables shell script tracing. Enable by running: TRACE=1 make <target>
-TRACE ?= 0
-
 #
 # Directories.
 #
@@ -148,7 +145,7 @@ YQ_BIN := yq
 YQ :=  $(abspath $(TOOLS_BIN_DIR)/$(YQ_BIN)-$(YQ_VER))
 YQ_PKG := github.com/mikefarah/yq/v4
 
-GINGKO_VER := v2.4.0
+GINGKO_VER := v2.2.0
 GINKGO_BIN := ginkgo
 GINKGO := $(abspath $(TOOLS_BIN_DIR)/$(GINKGO_BIN)-$(GINGKO_VER))
 GINKGO_PKG := github.com/onsi/ginkgo/v2/ginkgo
@@ -559,7 +556,7 @@ lint-fix: $(GOLANGCI_LINT) ## Lint the codebase and run auto-fixers if supported
 
 .PHONY: tiltfile-fix
 tiltfile-fix: ## Format the Tiltfile
-	TRACE=$(TRACE) ./hack/verify-starlark.sh fix
+	./hack/verify-starlark.sh fix
 
 APIDIFF_OLD_COMMIT ?= $(shell git rev-parse origin/main)
 
@@ -596,23 +593,23 @@ verify-conversions: $(CONVERSION_VERIFIER)  ## Verifies expected API conversion
 
 .PHONY: verify-doctoc
 verify-doctoc:
-	TRACE=$(TRACE) ./hack/verify-doctoc.sh
+	./hack/verify-doctoc.sh
 
 .PHONY: verify-capi-book-summary
 verify-capi-book-summary:
-	TRACE=$(TRACE) ./hack/verify-capi-book-summary.sh
+	./hack/verify-capi-book-summary.sh
 
 .PHONY: verify-boilerplate
 verify-boilerplate: ## Verify boilerplate text exists in each file
-	TRACE=$(TRACE) ./hack/verify-boilerplate.sh
+	./hack/verify-boilerplate.sh
 
 .PHONY: verify-shellcheck
 verify-shellcheck: ## Verify shell files
-	TRACE=$(TRACE) ./hack/verify-shellcheck.sh
+	./hack/verify-shellcheck.sh
 
 .PHONY: verify-tiltfile
 verify-tiltfile: ## Verify Tiltfile format
-	TRACE=$(TRACE) ./hack/verify-starlark.sh
+	./hack/verify-starlark.sh
 
 ## --------------------------------------
 ## Binaries
diff --git a/api/v1alpha3/conversion.go b/api/v1alpha3/conversion.go
index 2f2df22f1..59a442204 100644
--- a/api/v1alpha3/conversion.go
+++ b/api/v1alpha3/conversion.go
@@ -277,13 +277,13 @@ func (dst *MachineHealthCheckList) ConvertFrom(srcRaw conversion.Hub) error {
 	return Convert_v1beta1_MachineHealthCheckList_To_v1alpha3_MachineHealthCheckList(src, dst, nil)
 }
 
-func Convert_v1beta1_MachineSetStatus_To_v1alpha3_MachineSetStatus(in *clusterv1.MachineSetStatus, out *MachineSetStatus, _ apiconversion.Scope) error {
+func Convert_v1beta1_MachineSetStatus_To_v1alpha3_MachineSetStatus(in *clusterv1.MachineSetStatus, out *MachineSetStatus, s apiconversion.Scope) error {
 	// Status.Conditions was introduced in v1alpha4, thus requiring a custom conversion function; the values is going to be preserved in an annotation thus allowing roundtrip without loosing informations
 	return autoConvert_v1beta1_MachineSetStatus_To_v1alpha3_MachineSetStatus(in, out, nil)
 }
 
 func Convert_v1beta1_ClusterSpec_To_v1alpha3_ClusterSpec(in *clusterv1.ClusterSpec, out *ClusterSpec, s apiconversion.Scope) error {
-	// NOTE: custom conversion func is required because spec.Topology does not exist in v1alpha3
+	// NOTE: custom conversion func is required because spec.Topology does not exists in v1alpha3
 	return autoConvert_v1beta1_ClusterSpec_To_v1alpha3_ClusterSpec(in, out, s)
 }
 
diff --git a/api/v1alpha4/conversion.go b/api/v1alpha4/conversion.go
index df357d49f..6106280b1 100644
--- a/api/v1alpha4/conversion.go
+++ b/api/v1alpha4/conversion.go
@@ -70,7 +70,6 @@ func (src *Cluster) ConvertTo(dstRaw conversion.Hub) error {
 				dst.Spec.Topology.Workers.MachineDeployments[i].NodeVolumeDetachTimeout = restored.Spec.Topology.Workers.MachineDeployments[i].NodeVolumeDetachTimeout
 				dst.Spec.Topology.Workers.MachineDeployments[i].NodeDeletionTimeout = restored.Spec.Topology.Workers.MachineDeployments[i].NodeDeletionTimeout
 				dst.Spec.Topology.Workers.MachineDeployments[i].MinReadySeconds = restored.Spec.Topology.Workers.MachineDeployments[i].MinReadySeconds
-				dst.Spec.Topology.Workers.MachineDeployments[i].Strategy = restored.Spec.Topology.Workers.MachineDeployments[i].Strategy
 				dst.Spec.Topology.Workers.MachineDeployments[i].MachineHealthCheck = restored.Spec.Topology.Workers.MachineDeployments[i].MachineHealthCheck
 			}
 		}
diff --git a/api/v1alpha4/zz_generated.conversion.go b/api/v1alpha4/zz_generated.conversion.go
index 4f7e6f5a3..7a4ddcaa5 100644
--- a/api/v1alpha4/zz_generated.conversion.go
+++ b/api/v1alpha4/zz_generated.conversion.go
@@ -1245,7 +1245,6 @@ func autoConvert_v1beta1_MachineDeploymentTopology_To_v1alpha4_MachineDeployment
 	// WARNING: in.NodeVolumeDetachTimeout requires manual conversion: does not exist in peer-type
 	// WARNING: in.NodeDeletionTimeout requires manual conversion: does not exist in peer-type
 	// WARNING: in.MinReadySeconds requires manual conversion: does not exist in peer-type
-	// WARNING: in.Strategy requires manual conversion: does not exist in peer-type
 	// WARNING: in.Variables requires manual conversion: does not exist in peer-type
 	return nil
 }
diff --git a/api/v1beta1/cluster_types.go b/api/v1beta1/cluster_types.go
index 4647c1af9..569fcfc2f 100644
--- a/api/v1beta1/cluster_types.go
+++ b/api/v1beta1/cluster_types.go
@@ -206,11 +206,6 @@ type MachineDeploymentTopology struct {
 	// +optional
 	MinReadySeconds *int32 `json:"minReadySeconds,omitempty"`
 
-	// The deployment strategy to use to replace existing machines with
-	// new ones.
-	// +optional
-	Strategy *MachineDeploymentStrategy `json:"strategy,omitempty"`
-
 	// Variables can be used to customize the MachineDeployment through patches.
 	// +optional
 	Variables *MachineDeploymentVariables `json:"variables,omitempty"`
diff --git a/api/v1beta1/zz_generated.deepcopy.go b/api/v1beta1/zz_generated.deepcopy.go
index f3f9b905a..aa350d205 100644
--- a/api/v1beta1/zz_generated.deepcopy.go
+++ b/api/v1beta1/zz_generated.deepcopy.go
@@ -1020,11 +1020,6 @@ func (in *MachineDeploymentTopology) DeepCopyInto(out *MachineDeploymentTopology
 		*out = new(int32)
 		**out = **in
 	}
-	if in.Strategy != nil {
-		in, out := &in.Strategy, &out.Strategy
-		*out = new(MachineDeploymentStrategy)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.Variables != nil {
 		in, out := &in.Variables, &out.Variables
 		*out = new(MachineDeploymentVariables)
diff --git a/api/v1beta1/zz_generated.openapi.go b/api/v1beta1/zz_generated.openapi.go
index ad2c4dc6b..8c1adb414 100644
--- a/api/v1beta1/zz_generated.openapi.go
+++ b/api/v1beta1/zz_generated.openapi.go
@@ -1751,12 +1751,6 @@ func schema_sigsk8sio_cluster_api_api_v1beta1_MachineDeploymentTopology(ref comm
 							Format:      "int32",
 						},
 					},
-					"strategy": {
-						SchemaProps: spec.SchemaProps{
-							Description: "The deployment strategy to use to replace existing machines with new ones.",
-							Ref:         ref("sigs.k8s.io/cluster-api/api/v1beta1.MachineDeploymentStrategy"),
-						},
-					},
 					"variables": {
 						SchemaProps: spec.SchemaProps{
 							Description: "Variables can be used to customize the MachineDeployment through patches.",
@@ -1768,7 +1762,7 @@ func schema_sigsk8sio_cluster_api_api_v1beta1_MachineDeploymentTopology(ref comm
 			},
 		},
 		Dependencies: []string{
-			"k8s.io/apimachinery/pkg/apis/meta/v1.Duration", "sigs.k8s.io/cluster-api/api/v1beta1.MachineDeploymentStrategy", "sigs.k8s.io/cluster-api/api/v1beta1.MachineDeploymentVariables", "sigs.k8s.io/cluster-api/api/v1beta1.MachineHealthCheckTopology", "sigs.k8s.io/cluster-api/api/v1beta1.ObjectMeta"},
+			"k8s.io/apimachinery/pkg/apis/meta/v1.Duration", "sigs.k8s.io/cluster-api/api/v1beta1.MachineDeploymentVariables", "sigs.k8s.io/cluster-api/api/v1beta1.MachineHealthCheckTopology", "sigs.k8s.io/cluster-api/api/v1beta1.ObjectMeta"},
 	}
 }
 
diff --git a/bootstrap/kubeadm/api/v1beta1/kubeadmconfig_webhook.go b/bootstrap/kubeadm/api/v1beta1/kubeadmconfig_webhook.go
index f718f7ec2..c77d6b594 100644
--- a/bootstrap/kubeadm/api/v1beta1/kubeadmconfig_webhook.go
+++ b/bootstrap/kubeadm/api/v1beta1/kubeadmconfig_webhook.go
@@ -70,7 +70,7 @@ func (c *KubeadmConfig) ValidateCreate() error {
 }
 
 // ValidateUpdate implements webhook.Validator so a webhook will be registered for the type.
-func (c *KubeadmConfig) ValidateUpdate(_ runtime.Object) error {
+func (c *KubeadmConfig) ValidateUpdate(old runtime.Object) error {
 	return c.Spec.validate(c.Name)
 }
 
diff --git a/bootstrap/kubeadm/api/v1beta1/kubeadmconfigtemplate_webhook.go b/bootstrap/kubeadm/api/v1beta1/kubeadmconfigtemplate_webhook.go
index a1c581fa6..e5fb051a8 100644
--- a/bootstrap/kubeadm/api/v1beta1/kubeadmconfigtemplate_webhook.go
+++ b/bootstrap/kubeadm/api/v1beta1/kubeadmconfigtemplate_webhook.go
@@ -49,7 +49,7 @@ func (r *KubeadmConfigTemplate) ValidateCreate() error {
 }
 
 // ValidateUpdate implements webhook.Validator so a webhook will be registered for the type.
-func (r *KubeadmConfigTemplate) ValidateUpdate(_ runtime.Object) error {
+func (r *KubeadmConfigTemplate) ValidateUpdate(old runtime.Object) error {
 	return r.Spec.validate(r.Name)
 }
 
diff --git a/cmd/clusterctl/client/cluster/internal/dryrun/client.go b/cmd/clusterctl/client/cluster/internal/dryrun/client.go
index bb76ab0ab..6640178db 100644
--- a/cmd/clusterctl/client/cluster/internal/dryrun/client.go
+++ b/cmd/clusterctl/client/cluster/internal/dryrun/client.go
@@ -248,7 +248,7 @@ func (c *Client) Delete(ctx context.Context, obj client.Object, opts ...client.D
 
 // Update updates the given obj in the internal object tracker.
 // NOTE: Topology reconciler does not use update, so we are skipping implementation for now.
-func (c *Client) Update(_ context.Context, _ client.Object, _ ...client.UpdateOption) error {
+func (c *Client) Update(ctx context.Context, obj client.Object, opts ...client.UpdateOption) error {
 	panic("Update method is not supported by the dryrun client")
 }
 
@@ -284,7 +284,7 @@ func (c *Client) Patch(ctx context.Context, obj client.Object, patch client.Patc
 
 // DeleteAllOf deletes all objects of the given type matching the given options.
 // NOTE: Topology reconciler does not use DeleteAllOf, so we are skipping implementation for now.
-func (c *Client) DeleteAllOf(_ context.Context, _ client.Object, _ ...client.DeleteAllOfOption) error {
+func (c *Client) DeleteAllOf(ctx context.Context, obj client.Object, opts ...client.DeleteAllOfOption) error {
 	panic("DeleteAllOf method is not supported by the dryrun client")
 }
 
diff --git a/cmd/clusterctl/client/cluster/topology.go b/cmd/clusterctl/client/cluster/topology.go
index 045f433cd..1ff67671b 100644
--- a/cmd/clusterctl/client/cluster/topology.go
+++ b/cmd/clusterctl/client/cluster/topology.go
@@ -631,9 +631,9 @@ func filterObjects(objs []*unstructured.Unstructured, gvks ...schema.GroupVersio
 
 type noOpRecorder struct{}
 
-func (nr *noOpRecorder) Event(_ runtime.Object, _, _, _ string)                    {}
-func (nr *noOpRecorder) Eventf(_ runtime.Object, _, _, _ string, _ ...interface{}) {}
-func (nr *noOpRecorder) AnnotatedEventf(_ runtime.Object, _ map[string]string, _, _, _ string, _ ...interface{}) {
+func (nr *noOpRecorder) Event(_ runtime.Object, _, _, _ string)                       {}
+func (nr *noOpRecorder) Eventf(_ runtime.Object, _, _, _ string, args ...interface{}) {}
+func (nr *noOpRecorder) AnnotatedEventf(_ runtime.Object, _ map[string]string, _, _, _ string, args ...interface{}) {
 }
 
 func objToRef(o *unstructured.Unstructured) *corev1.ObjectReference {
diff --git a/cmd/clusterctl/log/logger.go b/cmd/clusterctl/log/logger.go
index a64e2bb65..71ade25e1 100644
--- a/cmd/clusterctl/log/logger.go
+++ b/cmd/clusterctl/log/logger.go
@@ -67,7 +67,7 @@ type logger struct {
 
 var _ logr.LogSink = &logger{}
 
-func (l *logger) Init(_ logr.RuntimeInfo) {
+func (l *logger) Init(info logr.RuntimeInfo) {
 }
 
 // Enabled tests whether this Logger is enabled.
diff --git a/config/crd/bases/cluster.x-k8s.io_clusters.yaml b/config/crd/bases/cluster.x-k8s.io_clusters.yaml
index d80982e2e..4f52e6dc2 100644
--- a/config/crd/bases/cluster.x-k8s.io_clusters.yaml
+++ b/config/crd/bases/cluster.x-k8s.io_clusters.yaml
@@ -1256,75 +1256,6 @@ spec:
                                 of this value.
                               format: int32
                               type: integer
-                            strategy:
-                              description: The deployment strategy to use to replace
-                                existing machines with new ones.
-                              properties:
-                                rollingUpdate:
-                                  description: Rolling update config params. Present
-                                    only if MachineDeploymentStrategyType = RollingUpdate.
-                                  properties:
-                                    deletePolicy:
-                                      description: DeletePolicy defines the policy
-                                        used by the MachineDeployment to identify
-                                        nodes to delete when downscaling. Valid values
-                                        are "Random, "Newest", "Oldest" When no value
-                                        is supplied, the default DeletePolicy of MachineSet
-                                        is used
-                                      enum:
-                                      - Random
-                                      - Newest
-                                      - Oldest
-                                      type: string
-                                    maxSurge:
-                                      anyOf:
-                                      - type: integer
-                                      - type: string
-                                      description: 'The maximum number of machines
-                                        that can be scheduled above the desired number
-                                        of machines. Value can be an absolute number
-                                        (ex: 5) or a percentage of desired machines
-                                        (ex: 10%). This can not be 0 if MaxUnavailable
-                                        is 0. Absolute number is calculated from percentage
-                                        by rounding up. Defaults to 1. Example: when
-                                        this is set to 30%, the new MachineSet can
-                                        be scaled up immediately when the rolling
-                                        update starts, such that the total number
-                                        of old and new machines do not exceed 130%
-                                        of desired machines. Once old machines have
-                                        been killed, new MachineSet can be scaled
-                                        up further, ensuring that total number of
-                                        machines running at any time during the update
-                                        is at most 130% of desired machines.'
-                                      x-kubernetes-int-or-string: true
-                                    maxUnavailable:
-                                      anyOf:
-                                      - type: integer
-                                      - type: string
-                                      description: 'The maximum number of machines
-                                        that can be unavailable during the update.
-                                        Value can be an absolute number (ex: 5) or
-                                        a percentage of desired machines (ex: 10%).
-                                        Absolute number is calculated from percentage
-                                        by rounding down. This can not be 0 if MaxSurge
-                                        is 0. Defaults to 0. Example: when this is
-                                        set to 30%, the old MachineSet can be scaled
-                                        down to 70% of desired machines immediately
-                                        when the rolling update starts. Once new machines
-                                        are ready, old MachineSet can be scaled down
-                                        further, followed by scaling up the new MachineSet,
-                                        ensuring that the total number of machines
-                                        available at all times during the update is
-                                        at least 70% of desired machines.'
-                                      x-kubernetes-int-or-string: true
-                                  type: object
-                                type:
-                                  description: Type of deployment. Default is RollingUpdate.
-                                  enum:
-                                  - RollingUpdate
-                                  - OnDelete
-                                  type: string
-                              type: object
                             variables:
                               description: Variables can be used to customize the
                                 MachineDeployment through patches.
diff --git a/controllers/remote/fake/cluster.go b/controllers/remote/fake/cluster.go
index 7247d8fd0..237ce2503 100644
--- a/controllers/remote/fake/cluster.go
+++ b/controllers/remote/fake/cluster.go
@@ -25,6 +25,6 @@ import (
 
 // NewClusterClient returns the same client passed as input, as output. It is assumed that the client is a
 // fake controller-runtime client.
-func NewClusterClient(_ context.Context, _ string, c client.Client, _ client.ObjectKey) (client.Client, error) {
+func NewClusterClient(_ context.Context, sourceName string, c client.Client, _ client.ObjectKey) (client.Client, error) {
 	return c, nil
 }
diff --git a/controlplane/kubeadm/internal/proxy/dial.go b/controlplane/kubeadm/internal/proxy/dial.go
index e4c1024ff..87467ea36 100644
--- a/controlplane/kubeadm/internal/proxy/dial.go
+++ b/controlplane/kubeadm/internal/proxy/dial.go
@@ -84,7 +84,7 @@ func (d *Dialer) DialContextWithAddr(ctx context.Context, addr string) (net.Conn
 
 // DialContext creates proxied port-forwarded connections.
 // ctx is currently unused, but fulfils the type signature used by GRPC.
-func (d *Dialer) DialContext(_ context.Context, _ string, addr string) (net.Conn, error) {
+func (d *Dialer) DialContext(_ context.Context, network string, addr string) (net.Conn, error) {
 	req := d.clientset.CoreV1().RESTClient().
 		Post().
 		Resource(d.proxy.Kind).
diff --git a/controlplane/kubeadm/internal/workload_cluster_conditions.go b/controlplane/kubeadm/internal/workload_cluster_conditions.go
index bdb960e4d..6fd2b5ff5 100644
--- a/controlplane/kubeadm/internal/workload_cluster_conditions.go
+++ b/controlplane/kubeadm/internal/workload_cluster_conditions.go
@@ -47,7 +47,7 @@ func (w *Workload) UpdateEtcdConditions(ctx context.Context, controlPlane *Contr
 	w.updateExternalEtcdConditions(ctx, controlPlane)
 }
 
-func (w *Workload) updateExternalEtcdConditions(_ context.Context, controlPlane *ControlPlane) {
+func (w *Workload) updateExternalEtcdConditions(ctx context.Context, controlPlane *ControlPlane) { //nolint:unparam
 	// When KCP is not responsible for external etcd, we are reporting only health at KCP level.
 	conditions.MarkTrue(controlPlane.KCP, controlplanev1.EtcdClusterHealthyCondition)
 
diff --git a/docs/book/src/developer/providers/v1.2-to-v1.3.md b/docs/book/src/developer/providers/v1.2-to-v1.3.md
index 784e3a3c7..57e43d00a 100644
--- a/docs/book/src/developer/providers/v1.2-to-v1.3.md
+++ b/docs/book/src/developer/providers/v1.2-to-v1.3.md
@@ -47,7 +47,7 @@ The default value is 0, meaning that the volume can be detached without any time
 
 - The Kubernetes default registry has been changed from `k8s.gcr.io` to `registry.k8s.io`. Kubernetes image promotion currently publishes to both registries. Please
   consider publishing manifests which reference the controller images from the new registry (for reference [Cluster API PR](https://github.com/kubernetes-sigs/cluster-api/pull/7478)).
-- e2e tests are upgraded to use Ginkgo v2 (v2.4.0) and Gomega v1.22.1. Providers who use the test framework from this release will also need to upgrade, because Ginkgo v2 can't be imported alongside v1. Please see the [Ginkgo upgrade guide](https://onsi.github.io/ginkgo/MIGRATING_TO_V2), and note:
+- e2e tests are upgraded to use Ginkgo v2 (v2.2.0) and Gomega v1.20.1. Providers who use the test framework from this release will also need to upgrade, because Ginkgo v2 can't be imported alongside v1. Please see the [Ginkgo upgrade guide](https://onsi.github.io/ginkgo/MIGRATING_TO_V2), and note:
   * the default test timeout has been [changed to 1h](https://onsi.github.io/ginkgo/MIGRATING_TO_V2#timeout-behavior)
   * the `--junit-report` argument [replaces JUnit custom reporter](https://onsi.github.io/ginkgo/MIGRATING_TO_V2#improved-reporting-infrastructure) code
   * see the ["Update tests to Ginkgo v2" PR](https://github.com/kubernetes-sigs/cluster-api/pull/6906) for a reference example
diff --git a/docs/book/src/security/pod-security-standards.md b/docs/book/src/security/pod-security-standards.md
index 0f39a98fb..cf979b68f 100644
--- a/docs/book/src/security/pod-security-standards.md
+++ b/docs/book/src/security/pod-security-standards.md
@@ -98,7 +98,7 @@ spec:
               plugins:
               - name: PodSecurity
                 configuration:
-                  apiVersion: pod-security.admission.config.k8s.io/v1{{ if semverCompare "< v1.25" .builtin.controlPlane.version }}beta1{{ end }}
+                  apiVersion: pod-security.admission.config.k8s.io/v1beta1
                   kind: PodSecurityConfiguration
                   defaults:
                     enforce: "{{ .podSecurity.enforce }}"
@@ -164,7 +164,7 @@ spec:
                 plugins:
                 - name: PodSecurity
                   configuration:
-                    apiVersion: pod-security.admission.config.k8s.io/v1{{ if semverCompare "< v1.25" .builtin.controlPlane.version }}beta1{{ end }}
+                    apiVersion: pod-security.admission.config.k8s.io/v1beta1
                     kind: PodSecurityConfiguration
                     defaults:
                       enforce: "{{ .podSecurity.enforce }}"
diff --git a/exp/addons/internal/controllers/predicates/resource_predicates.go b/exp/addons/internal/controllers/predicates/resource_predicates.go
index 7db6a76b7..517832aa7 100644
--- a/exp/addons/internal/controllers/predicates/resource_predicates.go
+++ b/exp/addons/internal/controllers/predicates/resource_predicates.go
@@ -24,7 +24,7 @@ import (
 )
 
 // ResourceCreate returns a predicate that returns true for a create event.
-func ResourceCreate(_ logr.Logger) predicate.Funcs {
+func ResourceCreate(logger logr.Logger) predicate.Funcs {
 	return predicate.Funcs{
 		CreateFunc:  func(e event.CreateEvent) bool { return true },
 		UpdateFunc:  func(e event.UpdateEvent) bool { return false },
diff --git a/exp/ipam/internal/webhooks/ipaddress.go b/exp/ipam/internal/webhooks/ipaddress.go
index 45c4f5cf0..b2478d959 100644
--- a/exp/ipam/internal/webhooks/ipaddress.go
+++ b/exp/ipam/internal/webhooks/ipaddress.go
@@ -62,7 +62,7 @@ func (webhook *IPAddress) ValidateCreate(ctx context.Context, obj runtime.Object
 }
 
 // ValidateUpdate implements webhook.CustomValidator.
-func (webhook *IPAddress) ValidateUpdate(_ context.Context, oldObj, newObj runtime.Object) error {
+func (webhook *IPAddress) ValidateUpdate(ctx context.Context, oldObj, newObj runtime.Object) error {
 	oldIP, ok := oldObj.(*ipamv1.IPAddress)
 	if !ok {
 		return apierrors.NewBadRequest(fmt.Sprintf("expected an IPAddress but got a %T", oldObj))
@@ -79,7 +79,7 @@ func (webhook *IPAddress) ValidateUpdate(_ context.Context, oldObj, newObj runti
 }
 
 // ValidateDelete implements webhook.CustomValidator.
-func (webhook *IPAddress) ValidateDelete(_ context.Context, _ runtime.Object) error {
+func (webhook *IPAddress) ValidateDelete(ctx context.Context, obj runtime.Object) error {
 	return nil
 }
 
diff --git a/exp/ipam/internal/webhooks/ipaddressclaim.go b/exp/ipam/internal/webhooks/ipaddressclaim.go
index c009eb239..5daf69cc4 100644
--- a/exp/ipam/internal/webhooks/ipaddressclaim.go
+++ b/exp/ipam/internal/webhooks/ipaddressclaim.go
@@ -47,7 +47,7 @@ type IPAddressClaim struct {
 var _ webhook.CustomValidator = &IPAddressClaim{}
 
 // ValidateCreate implements webhook.CustomValidator.
-func (webhook *IPAddressClaim) ValidateCreate(_ context.Context, obj runtime.Object) error {
+func (webhook *IPAddressClaim) ValidateCreate(ctx context.Context, obj runtime.Object) error {
 	claim, ok := obj.(*ipamv1.IPAddressClaim)
 	if !ok {
 		return apierrors.NewBadRequest(fmt.Sprintf("expected an IPAddressClaim but got a %T", obj))
@@ -64,7 +64,7 @@ func (webhook *IPAddressClaim) ValidateCreate(_ context.Context, obj runtime.Obj
 }
 
 // ValidateUpdate implements webhook.CustomValidator.
-func (webhook *IPAddressClaim) ValidateUpdate(_ context.Context, oldObj, newObj runtime.Object) error {
+func (webhook *IPAddressClaim) ValidateUpdate(ctx context.Context, oldObj, newObj runtime.Object) error {
 	oldClaim, ok := oldObj.(*ipamv1.IPAddressClaim)
 	if !ok {
 		return apierrors.NewBadRequest(fmt.Sprintf("expected an IPAddressClaim but got a %T", oldObj))
@@ -84,6 +84,6 @@ func (webhook *IPAddressClaim) ValidateUpdate(_ context.Context, oldObj, newObj
 }
 
 // ValidateDelete implements webhook.CustomValidator.
-func (webhook *IPAddressClaim) ValidateDelete(_ context.Context, _ runtime.Object) error {
+func (webhook *IPAddressClaim) ValidateDelete(ctx context.Context, obj runtime.Object) error {
 	return nil
 }
diff --git a/go.mod b/go.mod
index 65f26026c..1fb728712 100644
--- a/go.mod
+++ b/go.mod
@@ -20,8 +20,8 @@ require (
 	github.com/google/go-github/v45 v45.2.0
 	github.com/google/gofuzz v1.2.0
 	github.com/mattn/go-runewidth v0.0.13 // indirect
-	github.com/onsi/ginkgo/v2 v2.4.0
-	github.com/onsi/gomega v1.22.1
+	github.com/onsi/ginkgo/v2 v2.2.0
+	github.com/onsi/gomega v1.20.1
 	github.com/pkg/errors v0.9.1
 	github.com/spf13/cobra v1.5.0
 	github.com/spf13/pflag v1.0.5
@@ -29,7 +29,7 @@ require (
 	github.com/valyala/fastjson v1.6.3
 	go.etcd.io/etcd/api/v3 v3.5.4
 	go.etcd.io/etcd/client/v3 v3.5.4
-	golang.org/x/net v0.1.0 // indirect
+	golang.org/x/net v0.0.0-20220909164309-bea034e7d591 // indirect
 	golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1
 	google.golang.org/grpc v1.47.0
 	k8s.io/api v0.25.0
@@ -42,7 +42,7 @@ require (
 	k8s.io/klog/v2 v2.80.1
 	k8s.io/kubectl v0.25.0
 	k8s.io/utils v0.0.0-20220823124924-e9cbc92d1a73
-	sigs.k8s.io/controller-runtime v0.13.1
+	sigs.k8s.io/controller-runtime v0.13.0
 	sigs.k8s.io/yaml v1.3.0
 )
 
@@ -130,9 +130,9 @@ require (
 	go.uber.org/zap v1.21.0 // indirect
 	go4.org v0.0.0-20201209231011-d4a079459e60 // indirect
 	golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4 // indirect
-	golang.org/x/sys v0.1.0 // indirect
-	golang.org/x/term v0.1.0 // indirect
-	golang.org/x/text v0.4.0
+	golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec // indirect
+	golang.org/x/term v0.0.0-20220722155259-a9ba230a4035 // indirect
+	golang.org/x/text v0.3.7
 	golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
diff --git a/go.sum b/go.sum
index b22cfbd01..6f2f47c74 100644
--- a/go.sum
+++ b/go.sum
@@ -482,10 +482,10 @@ github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
-github.com/onsi/ginkgo/v2 v2.4.0 h1:+Ig9nvqgS5OBSACXNk15PLdp0U9XPYROt9CFzVdFGIs=
-github.com/onsi/ginkgo/v2 v2.4.0/go.mod h1:iHkDK1fKGcBoEHT5W7YBq4RFWaQulw+caOMkAt4OrFo=
-github.com/onsi/gomega v1.22.1 h1:pY8O4lBfsHKZHM/6nrxkhVPUznOlIu3quZcKP/M20KI=
-github.com/onsi/gomega v1.22.1/go.mod h1:x6n7VNe4hw0vkyYUM4mjIXx3JbLiPaBPNgB7PRQ1tuM=
+github.com/onsi/ginkgo/v2 v2.2.0 h1:3ZNA3L1c5FYDFTTxbFeVGGD8jYvjYauHD30YgLxVsNI=
+github.com/onsi/ginkgo/v2 v2.2.0/go.mod h1:MEH45j8TBi6u9BMogfbp0stKC5cdGjumZj5Y7AG4VIk=
+github.com/onsi/gomega v1.20.1 h1:PA/3qinGoukvymdIDV8pii6tiZgC8kbmJO6Z5+b002Q=
+github.com/onsi/gomega v1.20.1/go.mod h1:DtrZpjmvpn2mPm4YWQa0/ALMDj9v4YxLgojwPeREyVo=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
@@ -755,8 +755,8 @@ golang.org/x/net v0.0.0-20220325170049-de3da57026de/go.mod h1:CfG3xpIq0wQ8r1q4Su
 golang.org/x/net v0.0.0-20220412020605-290c469a71a5/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.1.0 h1:hZ/3BUoy5aId7sCpA/Tc5lt8DkFgdVS2onTpJsZ/fl0=
-golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
+golang.org/x/net v0.0.0-20220909164309-bea034e7d591 h1:D0B/7al0LLrVC8aWF4+oxpv/m8bc7ViFfVS8/gXGdqI=
+golang.org/x/net v0.0.0-20220909164309-bea034e7d591/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -867,12 +867,12 @@ golang.org/x/sys v0.0.0-20220502124256-b6088ccd6cba/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
-golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec h1:BkDtF2Ih9xZ7le9ndzTA7KJow28VbQW3odyk/8drmuI=
+golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.1.0 h1:g6Z6vPFA9dYBAF7DWcH6sCcOntplXsDKcliusYijMlw=
-golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.0.0-20220722155259-a9ba230a4035 h1:Q5284mrmYTpACcm+eAKjKJH48BBwSyfJqmmGDTtT8Vc=
+golang.org/x/term v0.0.0-20220722155259-a9ba230a4035/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -881,9 +881,8 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.4.0 h1:BrVqGRd7+k1DiOgtnFvAkoQEWQvBc25ouMJM6429SFg=
-golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1201,8 +1200,8 @@ k8s.io/utils v0.0.0-20220823124924-e9cbc92d1a73/go.mod h1:jPW/WVKK9YHAvNhRxK0md/
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
-sigs.k8s.io/controller-runtime v0.13.1 h1:tUsRCSJVM1QQOOeViGeX3GMT3dQF1eePPw6sEE3xSlg=
-sigs.k8s.io/controller-runtime v0.13.1/go.mod h1:Zbz+el8Yg31jubvAEyglRZGdLAjplZl+PgtYNI6WNTI=
+sigs.k8s.io/controller-runtime v0.13.0 h1:iqa5RNciy7ADWnIc8QxCbOX5FEKVR3uxVxKHRMc2WIQ=
+sigs.k8s.io/controller-runtime v0.13.0/go.mod h1:Zbz+el8Yg31jubvAEyglRZGdLAjplZl+PgtYNI6WNTI=
 sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 h1:iXTIw73aPyC+oRdyqqvVJuloN1p0AC/kzH07hu3NE+k=
 sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
 sigs.k8s.io/kustomize/api v0.12.1 h1:7YM7gW3kYBwtKvoY216ZzY+8hM+lV53LUayghNRJ0vM=
diff --git a/hack/ensure-go.sh b/hack/ensure-go.sh
index c2288c9ec..fbccbb3d9 100755
--- a/hack/ensure-go.sh
+++ b/hack/ensure-go.sh
@@ -18,10 +18,6 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-if [[ "${TRACE-0}" == "1" ]]; then
-    set -o xtrace
-fi
-
 # Ensure the go tool exists and is a viable version.
 verify_go_version() {
   if [[ -z "$(command -v go)" ]]; then
diff --git a/hack/ensure-golangci-lint.sh b/hack/ensure-golangci-lint.sh
index 85164228e..66d22401e 100755
--- a/hack/ensure-golangci-lint.sh
+++ b/hack/ensure-golangci-lint.sh
@@ -18,10 +18,6 @@
 
 set -e
 
-if [[ "${TRACE-0}" == "1" ]]; then
-    set -o xtrace
-fi
-
 usage() {
   this=$1
   cat <<EOF
@@ -46,11 +42,12 @@ parse_args() {
   # over-ridden by flag below
 
   BINDIR=${BINDIR:-./bin}
-  while getopts "b:dh?" arg; do
+  while getopts "b:dh?x" arg; do
     case "$arg" in
       b) BINDIR="$OPTARG" ;;
       d) log_set_priority 10 ;;
       h | \?) usage "$0" ;;
+      x) set -x ;;
     esac
   done
   shift $((OPTIND - 1))
diff --git a/hack/ensure-kind.sh b/hack/ensure-kind.sh
index dc3cd008f..ee00c44ac 100755
--- a/hack/ensure-kind.sh
+++ b/hack/ensure-kind.sh
@@ -18,9 +18,7 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-if [[ "${TRACE-0}" == "1" ]]; then
-    set -o xtrace
-fi
+set -x
 
 GOPATH_BIN="$(go env GOPATH)/bin"
 MINIMUM_KIND_VERSION=v0.17.0
diff --git a/hack/ensure-kubectl.sh b/hack/ensure-kubectl.sh
index b1a031c52..afe62a39d 100755
--- a/hack/ensure-kubectl.sh
+++ b/hack/ensure-kubectl.sh
@@ -18,10 +18,6 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-if [[ "${TRACE-0}" == "1" ]]; then
-    set -o xtrace
-fi
-
 GOPATH_BIN="$(go env GOPATH)/bin/"
 MINIMUM_KUBECTL_VERSION=v1.19.0
 goarch="$(go env GOARCH)"
diff --git a/hack/get-project-maintainers.sh b/hack/get-project-maintainers.sh
index 935befdeb..469f93595 100755
--- a/hack/get-project-maintainers.sh
+++ b/hack/get-project-maintainers.sh
@@ -18,10 +18,6 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-if [[ "${TRACE-0}" == "1" ]]; then
-    set -o xtrace
-fi
-
 REPO_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 
 YQ_BIN=yq
diff --git a/hack/kind-install-for-capd.sh b/hack/kind-install-for-capd.sh
index 5c938142e..63a614181 100755
--- a/hack/kind-install-for-capd.sh
+++ b/hack/kind-install-for-capd.sh
@@ -26,10 +26,6 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-if [[ "${TRACE-0}" == "1" ]]; then
-    set -o xtrace
-fi
-
 KIND_CLUSTER_NAME=${CAPI_KIND_CLUSTER_NAME:-"capi-test"}
 
 if [[ "$(kind get clusters)" =~ .*"${KIND_CLUSTER_NAME}".* ]]; then
diff --git a/hack/pin-dependency.sh b/hack/pin-dependency.sh
index 0fbb0760a..a7ac52dce 100755
--- a/hack/pin-dependency.sh
+++ b/hack/pin-dependency.sh
@@ -18,10 +18,6 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-if [[ "${TRACE-0}" == "1" ]]; then
-    set -o xtrace
-fi
-
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 
 # Usage:
diff --git a/hack/tools/go.mod b/hack/tools/go.mod
index 5775a4bd3..a02c5c306 100644
--- a/hack/tools/go.mod
+++ b/hack/tools/go.mod
@@ -25,7 +25,7 @@ require (
 	k8s.io/utils v0.0.0-20220823124924-e9cbc92d1a73
 	sigs.k8s.io/cluster-api v0.0.0-00010101000000-000000000000
 	sigs.k8s.io/cluster-api/test v0.0.0-00010101000000-000000000000
-	sigs.k8s.io/controller-runtime v0.13.1
+	sigs.k8s.io/controller-runtime v0.13.0
 	sigs.k8s.io/controller-tools v0.10.0
 	sigs.k8s.io/kubebuilder/docs/book/utils v0.0.0-20211028165026-57688c578b5d
 	sigs.k8s.io/kustomize/api v0.12.1
@@ -106,7 +106,7 @@ require (
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/onsi/gomega v1.22.1 // indirect
+	github.com/onsi/gomega v1.20.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.3-0.20211202183452-c5a74bcca799 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
@@ -130,12 +130,12 @@ require (
 	go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect
 	golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e // indirect
 	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 // indirect
-	golang.org/x/net v0.1.0 // indirect
+	golang.org/x/net v0.0.0-20220909164309-bea034e7d591 // indirect
 	golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1 // indirect
 	golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4 // indirect
-	golang.org/x/sys v0.1.0 // indirect
-	golang.org/x/term v0.1.0 // indirect
-	golang.org/x/text v0.4.0 // indirect
+	golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec // indirect
+	golang.org/x/term v0.0.0-20220722155259-a9ba230a4035 // indirect
+	golang.org/x/text v0.3.7 // indirect
 	golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9 // indirect
 	golang.org/x/xerrors v0.0.0-20220609144429-65e65417b02f // indirect
 	gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
diff --git a/hack/tools/go.sum b/hack/tools/go.sum
index e0ef4d54c..bd83d6600 100644
--- a/hack/tools/go.sum
+++ b/hack/tools/go.sum
@@ -407,9 +407,9 @@ github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRW
 github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
-github.com/onsi/ginkgo/v2 v2.4.0 h1:+Ig9nvqgS5OBSACXNk15PLdp0U9XPYROt9CFzVdFGIs=
-github.com/onsi/gomega v1.22.1 h1:pY8O4lBfsHKZHM/6nrxkhVPUznOlIu3quZcKP/M20KI=
-github.com/onsi/gomega v1.22.1/go.mod h1:x6n7VNe4hw0vkyYUM4mjIXx3JbLiPaBPNgB7PRQ1tuM=
+github.com/onsi/ginkgo/v2 v2.2.0 h1:3ZNA3L1c5FYDFTTxbFeVGGD8jYvjYauHD30YgLxVsNI=
+github.com/onsi/gomega v1.20.1 h1:PA/3qinGoukvymdIDV8pii6tiZgC8kbmJO6Z5+b002Q=
+github.com/onsi/gomega v1.20.1/go.mod h1:DtrZpjmvpn2mPm4YWQa0/ALMDj9v4YxLgojwPeREyVo=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.0.3-0.20211202183452-c5a74bcca799 h1:rc3tiVYb5z54aKaDfakKn0dDjIyPpTtszkjuMzyt7ec=
@@ -626,8 +626,8 @@ golang.org/x/net v0.0.0-20220325170049-de3da57026de/go.mod h1:CfG3xpIq0wQ8r1q4Su
 golang.org/x/net v0.0.0-20220412020605-290c469a71a5/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.1.0 h1:hZ/3BUoy5aId7sCpA/Tc5lt8DkFgdVS2onTpJsZ/fl0=
-golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
+golang.org/x/net v0.0.0-20220909164309-bea034e7d591 h1:D0B/7al0LLrVC8aWF4+oxpv/m8bc7ViFfVS8/gXGdqI=
+golang.org/x/net v0.0.0-20220909164309-bea034e7d591/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -736,12 +736,12 @@ golang.org/x/sys v0.0.0-20220502124256-b6088ccd6cba/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
-golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec h1:BkDtF2Ih9xZ7le9ndzTA7KJow28VbQW3odyk/8drmuI=
+golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.1.0 h1:g6Z6vPFA9dYBAF7DWcH6sCcOntplXsDKcliusYijMlw=
-golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.0.0-20220722155259-a9ba230a4035 h1:Q5284mrmYTpACcm+eAKjKJH48BBwSyfJqmmGDTtT8Vc=
+golang.org/x/term v0.0.0-20220722155259-a9ba230a4035/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -750,9 +750,8 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.4.0 h1:BrVqGRd7+k1DiOgtnFvAkoQEWQvBc25ouMJM6429SFg=
-golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1068,8 +1067,8 @@ oras.land/oras-go v1.2.0/go.mod h1:pFNs7oHp2dYsYMSS82HaX5l4mpnGO7hbpPN6EWH2ltc=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
-sigs.k8s.io/controller-runtime v0.13.1 h1:tUsRCSJVM1QQOOeViGeX3GMT3dQF1eePPw6sEE3xSlg=
-sigs.k8s.io/controller-runtime v0.13.1/go.mod h1:Zbz+el8Yg31jubvAEyglRZGdLAjplZl+PgtYNI6WNTI=
+sigs.k8s.io/controller-runtime v0.13.0 h1:iqa5RNciy7ADWnIc8QxCbOX5FEKVR3uxVxKHRMc2WIQ=
+sigs.k8s.io/controller-runtime v0.13.0/go.mod h1:Zbz+el8Yg31jubvAEyglRZGdLAjplZl+PgtYNI6WNTI=
 sigs.k8s.io/controller-tools v0.10.0 h1:0L5DTDTFB67jm9DkfrONgTGmfc/zYow0ZaHyppizU2U=
 sigs.k8s.io/controller-tools v0.10.0/go.mod h1:uvr0EW6IsprfB0jpQq6evtKy+hHyHCXNfdWI5ONPx94=
 sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 h1:iXTIw73aPyC+oRdyqqvVJuloN1p0AC/kzH07hu3NE+k=
diff --git a/hack/tools/tilt-prepare/main.go b/hack/tools/tilt-prepare/main.go
index bac2144d7..1225d89f3 100644
--- a/hack/tools/tilt-prepare/main.go
+++ b/hack/tools/tilt-prepare/main.go
@@ -82,12 +82,8 @@ type tiltSettings struct {
 }
 
 type providerSettings struct {
-	Name   string          `json:"name,omitempty"`
-	Config *providerConfig `json:"config,omitempty"`
-}
-
-type providerConfig struct {
-	Context *string `json:"context,omitempty"`
+	Name    string  `json:"name,omitempty"`
+	Context *string `json:"context"`
 }
 
 type debugConfig struct {
@@ -313,8 +309,8 @@ func loadProviders(r string) (map[string]string, error) {
 
 	providerContexts := map[string]string{}
 	for _, p := range providerData {
-		if p.Config != nil && p.Config.Context != nil {
-			contextPath = r + "/" + *p.Config.Context
+		if p.Context != nil {
+			contextPath = r + "/" + *p.Context
 		} else {
 			contextPath = r
 		}
diff --git a/hack/verify-boilerplate.sh b/hack/verify-boilerplate.sh
index 25a8592b5..19283371c 100755
--- a/hack/verify-boilerplate.sh
+++ b/hack/verify-boilerplate.sh
@@ -18,10 +18,6 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-if [[ "${TRACE-0}" == "1" ]]; then
-    set -o xtrace
-fi
-
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 
 boilerDir="${KUBE_ROOT}/hack/boilerplate"
diff --git a/hack/verify-capi-book-summary.sh b/hack/verify-capi-book-summary.sh
index f59923db3..1f620e6b9 100755
--- a/hack/verify-capi-book-summary.sh
+++ b/hack/verify-capi-book-summary.sh
@@ -18,10 +18,6 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-if [[ "${TRACE-0}" == "1" ]]; then
-    set -o xtrace
-fi
-
 RESULT=0
 SUMMARY=$(cat ./docs/book/src/SUMMARY.md)
 
diff --git a/hack/verify-doctoc.sh b/hack/verify-doctoc.sh
index 0c510fb9d..f9824ae3f 100755
--- a/hack/verify-doctoc.sh
+++ b/hack/verify-doctoc.sh
@@ -18,10 +18,6 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-if [[ "${TRACE-0}" == "1" ]]; then
-    set -o xtrace
-fi
-
 command -v doctoc || echo "doctoc is not available on your system, skipping verification" && exit 0
 
 doctoc_files="README.md \
diff --git a/hack/verify-shellcheck.sh b/hack/verify-shellcheck.sh
index b3e9ca25c..a2bf9ac7f 100755
--- a/hack/verify-shellcheck.sh
+++ b/hack/verify-shellcheck.sh
@@ -17,10 +17,6 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-if [[ "${TRACE-0}" == "1" ]]; then
-    set -o xtrace
-fi
-
 VERSION="v0.8.0"
 
 OS="unknown"
diff --git a/hack/verify-starlark.sh b/hack/verify-starlark.sh
index bc6d7c028..c2ba3e8ff 100755
--- a/hack/verify-starlark.sh
+++ b/hack/verify-starlark.sh
@@ -17,10 +17,6 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-if [[ "${TRACE-0}" == "1" ]]; then
-    set -o xtrace
-fi
-
 SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"
 ROOT_PATH="$(cd "${SCRIPT_DIR}"/.. && pwd)"
 
diff --git a/hack/version.sh b/hack/version.sh
index 4c40b23e1..7f22394af 100755
--- a/hack/version.sh
+++ b/hack/version.sh
@@ -17,10 +17,6 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-if [[ "${TRACE-0}" == "1" ]]; then
-    set -o xtrace
-fi
-
 version::get_version_vars() {
     # shellcheck disable=SC1083
     GIT_COMMIT="$(git rev-parse HEAD^{commit})"
diff --git a/internal/contract/bootstrap.go b/internal/contract/bootstrap.go
deleted file mode 100644
index d042d1a5e..000000000
--- a/internal/contract/bootstrap.go
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
-Copyright 2022 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package contract
-
-import "sync"
-
-// BootstrapContract encodes information about the Cluster API contract for bootstrap objects.
-type BootstrapContract struct{}
-
-var bootstrap *BootstrapContract
-var onceBootstrap sync.Once
-
-// Bootstrap provide access to the information about the Cluster API contract for bootstrap objects.
-func Bootstrap() *BootstrapContract {
-	onceBootstrap.Do(func() {
-		bootstrap = &BootstrapContract{}
-	})
-	return bootstrap
-}
-
-// Ready provide access to status.ready field in a bootstrap object.
-func (b *BootstrapContract) Ready() *Bool {
-	return &Bool{
-		path: []string{"status", "ready"},
-	}
-}
-
-// DataSecretName provide access to status.dataSecretName field in a bootstrap object.
-func (b *BootstrapContract) DataSecretName() *String {
-	return &String{
-		path: []string{"status", "dataSecretName"},
-	}
-}
-
-// FailureReason provides access to the status.failureReason field in an bootstrap object. Note that this field is optional.
-func (b *BootstrapContract) FailureReason() *String {
-	return &String{
-		path: []string{"status", "failureReason"},
-	}
-}
-
-// FailureMessage provides access to the status.failureMessage field in an bootstrap object. Note that this field is optional.
-func (b *BootstrapContract) FailureMessage() *String {
-	return &String{
-		path: []string{"status", "failureMessage"},
-	}
-}
diff --git a/internal/contract/controlplane.go b/internal/contract/controlplane.go
index 788e0e476..f51dff644 100644
--- a/internal/contract/controlplane.go
+++ b/internal/contract/controlplane.go
@@ -49,7 +49,7 @@ func (c *ControlPlaneContract) MachineTemplate() *ControlPlaneMachineTemplate {
 	return &ControlPlaneMachineTemplate{}
 }
 
-// Version provide access to version field in a ControlPlane object, if any.
+// Version provide access to version field  in a ControlPlane object, if any.
 // NOTE: When working with unstructured there is no way to understand if the ControlPlane provider
 // do support a field in the type definition from the fact that a field is not set in a given instance.
 // This is why in we are deriving if version is required from the ClusterClass in the topology reconciler code.
@@ -59,28 +59,14 @@ func (c *ControlPlaneContract) Version() *String {
 	}
 }
 
-// StatusVersion provide access to the version field in a ControlPlane object status, if any.
+// StatusVersion provide access to version field  in a ControlPlane object status, if any.
 func (c *ControlPlaneContract) StatusVersion() *String {
 	return &String{
 		path: []string{"status", "version"},
 	}
 }
 
-// Ready provide access to the status.ready field in a ControlPlane object.
-func (c *ControlPlaneContract) Ready() *Bool {
-	return &Bool{
-		path: []string{"status", "ready"},
-	}
-}
-
-// Initialized provide access to status.initialized field in a ControlPlane object.
-func (c *ControlPlaneContract) Initialized() *Bool {
-	return &Bool{
-		path: []string{"status", "initialized"},
-	}
-}
-
-// Replicas provide access to replicas field in a ControlPlane object, if any.
+// Replicas provide access to replicas field  in a ControlPlane object, if any.
 // NOTE: When working with unstructured there is no way to understand if the ControlPlane provider
 // do support a field in the type definition from the fact that a field is not set in a given instance.
 // This is why in we are deriving if replicas is required from the ClusterClass in the topology reconciler code.
@@ -90,63 +76,27 @@ func (c *ControlPlaneContract) Replicas() *Int64 {
 	}
 }
 
-// StatusReplicas provide access to the status.replicas field in a ControlPlane object, if any. Applies to implementations using replicas.
+// StatusReplicas provide access to status.replicas field  in a ControlPlane object, if any.
 func (c *ControlPlaneContract) StatusReplicas() *Int64 {
 	return &Int64{
 		path: []string{"status", "replicas"},
 	}
 }
 
-// UpdatedReplicas provide access to the status.updatedReplicas field in a ControlPlane object, if any. Applies to implementations using replicas.
+// UpdatedReplicas provide access to status.updatedReplicas field  in a ControlPlane object, if any.
 func (c *ControlPlaneContract) UpdatedReplicas() *Int64 {
 	return &Int64{
 		path: []string{"status", "updatedReplicas"},
 	}
 }
 
-// ReadyReplicas provide access to the status.readyReplicas field in a ControlPlane object, if any. Applies to implementations using replicas.
+// ReadyReplicas provide access to status.readyReplicas field  in a ControlPlane object, if any.
 func (c *ControlPlaneContract) ReadyReplicas() *Int64 {
 	return &Int64{
 		path: []string{"status", "readyReplicas"},
 	}
 }
 
-// UnavailableReplicas provide access to the status.unavailableReplicas field in a ControlPlane object, if any. Applies to implementations using replicas.
-func (c *ControlPlaneContract) UnavailableReplicas() *Int64 {
-	return &Int64{
-		path: []string{"status", "unavailableReplicas"},
-	}
-}
-
-// Selector provide access to the status.selector field in a ControlPlane object, if any. Applies to implementations using replicas.
-func (c *ControlPlaneContract) Selector() *String {
-	return &String{
-		path: []string{"status", "selector"},
-	}
-}
-
-// FailureReason provides access to the status.failureReason field in an ControlPlane object. Note that this field is optional.
-func (c *ControlPlaneContract) FailureReason() *String {
-	return &String{
-		path: []string{"status", "failureReason"},
-	}
-}
-
-// FailureMessage provides access to the status.failureMessage field in an ControlPlane object. Note that this field is optional.
-func (c *ControlPlaneContract) FailureMessage() *String {
-	return &String{
-		path: []string{"status", "failureMessage"},
-	}
-}
-
-// ExternalManagedControlPlane provides access to the status.externalManagedControlPlane field in an ControlPlane object.
-// Note that this field is optional.
-func (c *ControlPlaneContract) ExternalManagedControlPlane() *Bool {
-	return &Bool{
-		path: []string{"status", "externalManagedControlPlane"},
-	}
-}
-
 // IsProvisioning returns true if the control plane is being created for the first time.
 // Returns false, if the control plane was already previously provisioned.
 func (c *ControlPlaneContract) IsProvisioning(obj *unstructured.Unstructured) (bool, error) {
diff --git a/internal/contract/infrastructure_cluster.go b/internal/contract/infrastructure_cluster.go
index e1055fea3..60710fc1c 100644
--- a/internal/contract/infrastructure_cluster.go
+++ b/internal/contract/infrastructure_cluster.go
@@ -17,18 +17,14 @@ limitations under the License.
 package contract
 
 import (
-	"encoding/json"
-	"strings"
 	"sync"
 
 	"github.com/pkg/errors"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-
-	clusterv1 "sigs.k8s.io/cluster-api/api/v1beta1"
 )
 
 // InfrastructureClusterContract encodes information about the Cluster API contract for InfrastructureCluster objects
-// like DockerClusters, AWS Clusters, etc.
+// like e.g the DockerCluster, AWS Cluster etc.
 type InfrastructureClusterContract struct{}
 
 var infrastructureCluster *InfrastructureClusterContract
@@ -65,34 +61,6 @@ func (c *InfrastructureClusterControlPlaneEndpoint) Port() *Int64 {
 	}
 }
 
-// Ready provides access to the status.ready field in an InfrastructureCluster object.
-func (c *InfrastructureClusterContract) Ready() *Bool {
-	return &Bool{
-		path: []string{"status", "ready"},
-	}
-}
-
-// FailureReason provides access to the status.failureReason field in an InfrastructureCluster object. Note that this field is optional.
-func (c *InfrastructureClusterContract) FailureReason() *String {
-	return &String{
-		path: []string{"status", "failureReason"},
-	}
-}
-
-// FailureMessage provides access to the status.failureMessage field in an InfrastructureCluster object. Note that this field is optional.
-func (c *InfrastructureClusterContract) FailureMessage() *String {
-	return &String{
-		path: []string{"status", "failureMessage"},
-	}
-}
-
-// FailureDomains provides access to the status.failureDomains field in an InfrastructureCluster object. Note that this field is optional.
-func (c *InfrastructureClusterContract) FailureDomains() *FailureDomains {
-	return &FailureDomains{
-		path: []string{"status", "failureDomains"},
-	}
-}
-
 // IgnorePaths returns a list of paths to be ignored when reconciling an InfrastructureCluster.
 // NOTE: The controlPlaneEndpoint struct currently contains two mandatory fields (host and port).
 // As the host and port fields are not using omitempty, they are automatically set to their zero values
@@ -119,54 +87,3 @@ func (c *InfrastructureClusterContract) IgnorePaths(infrastructureCluster *unstr
 
 	return ignorePaths, nil
 }
-
-// FailureDomains represents an accessor to a clusterv1.FailureDomains path value.
-type FailureDomains struct {
-	path Path
-}
-
-// Path returns the path to the clusterv1.FailureDomains value.
-func (d *FailureDomains) Path() Path {
-	return d.path
-}
-
-// Get gets the metav1.MachineAddressList value.
-func (d *FailureDomains) Get(obj *unstructured.Unstructured) (*clusterv1.FailureDomains, error) {
-	domainMap, ok, err := unstructured.NestedMap(obj.UnstructuredContent(), d.path...)
-	if err != nil {
-		return nil, errors.Wrapf(err, "failed to get %s from object", "."+strings.Join(d.path, "."))
-	}
-	if !ok {
-		return nil, errors.Wrapf(errNotFound, "path %s", "."+strings.Join(d.path, "."))
-	}
-
-	domains := make(clusterv1.FailureDomains, len(domainMap))
-	s, err := json.Marshal(domainMap)
-	if err != nil {
-		return nil, errors.Wrapf(err, "failed to marshall field at %s to json", "."+strings.Join(d.path, "."))
-	}
-	err = json.Unmarshal(s, &domains)
-	if err != nil {
-		return nil, errors.Wrapf(err, "failed to unmarshall field at %s to json", "."+strings.Join(d.path, "."))
-	}
-
-	return &domains, nil
-}
-
-// Set sets the clusterv1.FailureDomains value in the path.
-func (d *FailureDomains) Set(obj *unstructured.Unstructured, values clusterv1.FailureDomains) error {
-	domains := make(map[string]interface{}, len(values))
-	s, err := json.Marshal(values)
-	if err != nil {
-		return errors.Wrapf(err, "failed to marshall supplied values to json for path %s", "."+strings.Join(d.path, "."))
-	}
-	err = json.Unmarshal(s, &domains)
-	if err != nil {
-		return errors.Wrapf(err, "failed to unmarshall supplied values to json for path %s", "."+strings.Join(d.path, "."))
-	}
-
-	if err := unstructured.SetNestedField(obj.UnstructuredContent(), domains, d.path...); err != nil {
-		return errors.Wrapf(err, "failed to set path %s of object %v", "."+strings.Join(d.path, "."), obj.GroupVersionKind())
-	}
-	return nil
-}
diff --git a/internal/contract/infrastructure_machine.go b/internal/contract/infrastructure_machine.go
deleted file mode 100644
index 7a19bf13c..000000000
--- a/internal/contract/infrastructure_machine.go
+++ /dev/null
@@ -1,136 +0,0 @@
-/*
-Copyright 2022 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package contract
-
-import (
-	"encoding/json"
-	"strings"
-	"sync"
-
-	"github.com/pkg/errors"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-
-	clusterv1 "sigs.k8s.io/cluster-api/api/v1beta1"
-)
-
-// InfrastructureMachineContract encodes information about the Machine API contract for InfrastructureMachine objects
-// like DockerMachines, AWS Machines, etc.
-type InfrastructureMachineContract struct{}
-
-var infrastructureMachine *InfrastructureMachineContract
-var onceInfrastructureMachine sync.Once
-
-// InfrastructureMachine provide access to the information about the Machine API contract for InfrastructureMachine objects.
-func InfrastructureMachine() *InfrastructureMachineContract {
-	onceInfrastructureMachine.Do(func() {
-		infrastructureMachine = &InfrastructureMachineContract{}
-	})
-	return infrastructureMachine
-}
-
-// Ready provides access to status.ready field in an InfrastructureMachine object.
-func (m *InfrastructureMachineContract) Ready() *Bool {
-	return &Bool{
-		path: []string{"status", "ready"},
-	}
-}
-
-// FailureReason provides access to the status.failureReason field in an InfrastructureMachine object. Note that this field is optional.
-func (m *InfrastructureMachineContract) FailureReason() *String {
-	return &String{
-		path: []string{"status", "failureReason"},
-	}
-}
-
-// FailureMessage provides access to the status.failureMessage field in an InfrastructureMachine object. Note that this field is optional.
-func (m *InfrastructureMachineContract) FailureMessage() *String {
-	return &String{
-		path: []string{"status", "failureMessage"},
-	}
-}
-
-// Addresses provides access to the status.addresses field in an InfrastructureMachine object. Note that this field is optional.
-func (m *InfrastructureMachineContract) Addresses() *MachineAddresses {
-	return &MachineAddresses{
-		path: []string{"status", "addresses"},
-	}
-}
-
-// ProviderID provides access to the spec.providerID field in an InfrastructureMachine object.
-func (m *InfrastructureMachineContract) ProviderID() *String {
-	return &String{
-		path: []string{"spec", "providerID"},
-	}
-}
-
-// FailureDomain provides access to the spec.failureDomain field in an InfrastructureMachine object. Note that this field is optional.
-func (m *InfrastructureMachineContract) FailureDomain() *String {
-	return &String{
-		path: []string{"spec", "failureDomain"},
-	}
-}
-
-// MachineAddresses represents an accessor to a []clusterv1.MachineAddress path value.
-type MachineAddresses struct {
-	path Path
-}
-
-// Path returns the path to the []clusterv1.MachineAddress value.
-func (m *MachineAddresses) Path() Path {
-	return m.path
-}
-
-// Get gets the metav1.MachineAddressList value.
-func (m *MachineAddresses) Get(obj *unstructured.Unstructured) (*[]clusterv1.MachineAddress, error) {
-	slice, ok, err := unstructured.NestedSlice(obj.UnstructuredContent(), m.path...)
-	if err != nil {
-		return nil, errors.Wrapf(err, "failed to get %s from object", "."+strings.Join(m.path, "."))
-	}
-	if !ok {
-		return nil, errors.Wrapf(errNotFound, "path %s", "."+strings.Join(m.path, "."))
-	}
-
-	addresses := make([]clusterv1.MachineAddress, len(slice))
-	s, err := json.Marshal(slice)
-	if err != nil {
-		return nil, errors.Wrapf(err, "failed to marshall field at %s to json", "."+strings.Join(m.path, "."))
-	}
-	err = json.Unmarshal(s, &addresses)
-	if err != nil {
-		return nil, errors.Wrapf(err, "failed to unmarshall field at %s to json", "."+strings.Join(m.path, "."))
-	}
-
-	return &addresses, nil
-}
-
-// Set sets the []clusterv1.MachineAddress value in the path.
-func (m *MachineAddresses) Set(obj *unstructured.Unstructured, values []clusterv1.MachineAddress) error {
-	slice := make([]interface{}, len(values))
-	s, err := json.Marshal(values)
-	if err != nil {
-		return errors.Wrapf(err, "failed to marshall supplied values to json for path %s", "."+strings.Join(m.path, "."))
-	}
-	err = json.Unmarshal(s, &slice)
-	if err != nil {
-		return errors.Wrapf(err, "failed to unmarshall supplied values to json for path %s", "."+strings.Join(m.path, "."))
-	}
-
-	if err := unstructured.SetNestedField(obj.UnstructuredContent(), slice, m.path...); err != nil {
-		return errors.Wrapf(err, "failed to set path %s of object %v", "."+strings.Join(m.path, "."), obj.GroupVersionKind())
-	}
-	return nil
-}
diff --git a/internal/contract/types.go b/internal/contract/types.go
index a7a2b28fb..c93b93ede 100644
--- a/internal/contract/types.go
+++ b/internal/contract/types.go
@@ -101,36 +101,6 @@ func (i *Int64) Set(obj *unstructured.Unstructured, value int64) error {
 	return nil
 }
 
-// Bool represents an accessor to an bool path value.
-type Bool struct {
-	path Path
-}
-
-// Path returns the path to the bool value.
-func (b *Bool) Path() Path {
-	return b.path
-}
-
-// Get gets the bool value.
-func (b *Bool) Get(obj *unstructured.Unstructured) (*bool, error) {
-	value, ok, err := unstructured.NestedBool(obj.UnstructuredContent(), b.path...)
-	if err != nil {
-		return nil, errors.Wrapf(err, "failed to get %s from object", "."+strings.Join(b.path, "."))
-	}
-	if !ok {
-		return nil, errors.Wrapf(errNotFound, "path %s", "."+strings.Join(b.path, "."))
-	}
-	return &value, nil
-}
-
-// Set sets the bool value in the path.
-func (b *Bool) Set(obj *unstructured.Unstructured, value bool) error {
-	if err := unstructured.SetNestedField(obj.UnstructuredContent(), value, b.path...); err != nil {
-		return errors.Wrapf(err, "failed to set path %s of object %v", "."+strings.Join(b.path, "."), obj.GroupVersionKind())
-	}
-	return nil
-}
-
 // String represents an accessor to a string path value.
 type String struct {
 	path Path
diff --git a/internal/controllers/machine/machine_controller_phases.go b/internal/controllers/machine/machine_controller_phases.go
index 5e1e213ac..ec26bbb5d 100644
--- a/internal/controllers/machine/machine_controller_phases.go
+++ b/internal/controllers/machine/machine_controller_phases.go
@@ -175,13 +175,6 @@ func (r *Reconciler) reconcileExternal(ctx context.Context, cluster *clusterv1.C
 func (r *Reconciler) reconcileBootstrap(ctx context.Context, cluster *clusterv1.Cluster, m *clusterv1.Machine) (ctrl.Result, error) {
 	log := ctrl.LoggerFrom(ctx)
 
-	// If the bootstrap data is populated, set ready and return.
-	if m.Spec.Bootstrap.DataSecretName != nil {
-		m.Status.BootstrapReady = true
-		conditions.MarkTrue(m, clusterv1.BootstrapReadyCondition)
-		return ctrl.Result{}, nil
-	}
-
 	// If the Bootstrap ref is nil (and so the machine should use user generated data secret), return.
 	if m.Spec.Bootstrap.ConfigRef == nil {
 		return ctrl.Result{}, nil
@@ -192,10 +185,20 @@ func (r *Reconciler) reconcileBootstrap(ctx context.Context, cluster *clusterv1.
 	if err != nil {
 		return ctrl.Result{}, err
 	}
+
+	// If the external object is paused return.
+	if externalResult.Paused {
+		return ctrl.Result{}, nil
+	}
+
 	if externalResult.RequeueAfter > 0 {
 		return ctrl.Result{RequeueAfter: externalResult.RequeueAfter}, nil
 	}
-	if externalResult.Paused {
+
+	// If the bootstrap data is populated, set ready and return.
+	if m.Spec.Bootstrap.DataSecretName != nil {
+		m.Status.BootstrapReady = true
+		conditions.MarkTrue(m, clusterv1.BootstrapReadyCondition)
 		return ctrl.Result{}, nil
 	}
 	bootstrapConfig := externalResult.Result
diff --git a/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go b/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go
index ef9db6b19..01b8f2209 100644
--- a/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go
+++ b/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go
@@ -117,6 +117,7 @@ func (r *Reconciler) SetupWithManager(ctx context.Context, mgr ctrl.Manager, opt
 
 func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (_ ctrl.Result, reterr error) {
 	log := ctrl.LoggerFrom(ctx)
+	log.Info("Reconciling")
 
 	// Fetch the MachineHealthCheck instance
 	m := &clusterv1.MachineHealthCheck{}
diff --git a/internal/controllers/topology/cluster/desired_state.go b/internal/controllers/topology/cluster/desired_state.go
index 8e2a89cec..8fb7f608d 100644
--- a/internal/controllers/topology/cluster/desired_state.go
+++ b/internal/controllers/topology/cluster/desired_state.go
@@ -603,7 +603,6 @@ func computeMachineDeployment(_ context.Context, s *scope.Scope, desiredControlP
 		Spec: clusterv1.MachineDeploymentSpec{
 			ClusterName:     s.Current.Cluster.Name,
 			MinReadySeconds: machineDeploymentTopology.MinReadySeconds,
-			Strategy:        machineDeploymentTopology.Strategy,
 			Template: clusterv1.MachineTemplateSpec{
 				ObjectMeta: clusterv1.ObjectMeta{
 					Labels:      mergeMap(machineDeploymentTopology.Metadata.Labels, machineDeploymentBlueprint.Metadata.Labels),
diff --git a/internal/runtime/client/fake/fake_client.go b/internal/runtime/client/fake/fake_client.go
index 09b913911..114d34dcd 100644
--- a/internal/runtime/client/fake/fake_client.go
+++ b/internal/runtime/client/fake/fake_client.go
@@ -92,7 +92,7 @@ type RuntimeClient struct {
 }
 
 // CallAllExtensions implements Client.
-func (fc *RuntimeClient) CallAllExtensions(ctx context.Context, hook runtimecatalog.Hook, _ metav1.Object, _ runtime.Object, response runtimehooksv1.ResponseObject) error {
+func (fc *RuntimeClient) CallAllExtensions(ctx context.Context, hook runtimecatalog.Hook, forObject metav1.Object, request runtime.Object, response runtimehooksv1.ResponseObject) error {
 	defer func() {
 		fc.callAllTracker[runtimecatalog.HookName(hook)]++
 	}()
@@ -120,7 +120,7 @@ func (fc *RuntimeClient) CallAllExtensions(ctx context.Context, hook runtimecata
 }
 
 // CallExtension implements Client.
-func (fc *RuntimeClient) CallExtension(ctx context.Context, _ runtimecatalog.Hook, _ metav1.Object, name string, _ runtime.Object, response runtimehooksv1.ResponseObject) error {
+func (fc *RuntimeClient) CallExtension(ctx context.Context, _ runtimecatalog.Hook, _ metav1.Object, name string, request runtime.Object, response runtimehooksv1.ResponseObject) error {
 	expectedResponse, ok := fc.callResponses[name]
 	if !ok {
 		// This should actually panic because an error here would mean a mistake in the test setup.
@@ -150,17 +150,17 @@ func (fc *RuntimeClient) IsReady() bool {
 }
 
 // Register implements Client.
-func (fc *RuntimeClient) Register(_ *runtimev1.ExtensionConfig) error {
+func (fc *RuntimeClient) Register(extensionConfig *runtimev1.ExtensionConfig) error {
 	panic("unimplemented")
 }
 
 // Unregister implements Client.
-func (fc *RuntimeClient) Unregister(_ *runtimev1.ExtensionConfig) error {
+func (fc *RuntimeClient) Unregister(extensionConfig *runtimev1.ExtensionConfig) error {
 	panic("unimplemented")
 }
 
 // WarmUp implements Client.
-func (fc *RuntimeClient) WarmUp(_ *runtimev1.ExtensionConfigList) error {
+func (fc *RuntimeClient) WarmUp(extensionConfigList *runtimev1.ExtensionConfigList) error {
 	panic("unimplemented")
 }
 
diff --git a/internal/webhooks/cluster.go b/internal/webhooks/cluster.go
index a4b66481c..b50f99beb 100644
--- a/internal/webhooks/cluster.go
+++ b/internal/webhooks/cluster.go
@@ -142,7 +142,7 @@ func (webhook *Cluster) ValidateUpdate(ctx context.Context, oldObj, newObj runti
 }
 
 // ValidateDelete implements webhook.CustomValidator so a webhook will be registered for the type.
-func (webhook *Cluster) ValidateDelete(_ context.Context, _ runtime.Object) error {
+func (webhook *Cluster) ValidateDelete(_ context.Context, obj runtime.Object) error {
 	return nil
 }
 
diff --git a/internal/webhooks/runtime/extensionconfig_webhook.go b/internal/webhooks/runtime/extensionconfig_webhook.go
index d9e49adcb..2112404ae 100644
--- a/internal/webhooks/runtime/extensionconfig_webhook.go
+++ b/internal/webhooks/runtime/extensionconfig_webhook.go
@@ -53,7 +53,7 @@ var _ webhook.CustomValidator = &ExtensionConfig{}
 var _ webhook.CustomDefaulter = &ExtensionConfig{}
 
 // Default implements webhook.Defaulter so a webhook will be registered for the type.
-func (webhook *ExtensionConfig) Default(_ context.Context, obj runtime.Object) error {
+func (webhook *ExtensionConfig) Default(ctx context.Context, obj runtime.Object) error {
 	extensionConfig, ok := obj.(*runtimev1.ExtensionConfig)
 	if !ok {
 		return apierrors.NewBadRequest(fmt.Sprintf("expected an ExtensionConfig but got a %T", obj))


Test patch:
diff --git a/bootstrap/kubeadm/api/v1alpha3/conversion_test.go b/bootstrap/kubeadm/api/v1alpha3/conversion_test.go
index cac6e82f4..67a5e7e4d 100644
--- a/bootstrap/kubeadm/api/v1alpha3/conversion_test.go
+++ b/bootstrap/kubeadm/api/v1alpha3/conversion_test.go
@@ -82,12 +82,12 @@ func clusterConfigurationFuzzer(obj *upstreamv1beta1.ClusterConfiguration, c fuz
 	obj.UseHyperKubeImage = false
 }
 
-func kubeadmBootstrapTokenStringFuzzerV1UpstreamBeta1(in *upstreamv1beta1.BootstrapTokenString, _ fuzz.Continue) {
+func kubeadmBootstrapTokenStringFuzzerV1UpstreamBeta1(in *upstreamv1beta1.BootstrapTokenString, c fuzz.Continue) {
 	in.ID = "abcdef"
 	in.Secret = "abcdef0123456789"
 }
 
-func kubeadmBootstrapTokenStringFuzzerV1Beta1(in *bootstrapv1.BootstrapTokenString, _ fuzz.Continue) {
+func kubeadmBootstrapTokenStringFuzzerV1Beta1(in *bootstrapv1.BootstrapTokenString, c fuzz.Continue) {
 	in.ID = "abcdef"
 	in.Secret = "abcdef0123456789"
 }
diff --git a/bootstrap/kubeadm/api/v1alpha4/conversion_test.go b/bootstrap/kubeadm/api/v1alpha4/conversion_test.go
index 714fd051d..3e37138ab 100644
--- a/bootstrap/kubeadm/api/v1alpha4/conversion_test.go
+++ b/bootstrap/kubeadm/api/v1alpha4/conversion_test.go
@@ -80,17 +80,17 @@ func clusterConfigurationFuzzer(obj *upstreamv1beta1.ClusterConfiguration, c fuz
 	obj.UseHyperKubeImage = false
 }
 
-func kubeadmBootstrapTokenStringFuzzerV1UpstreamBeta1(in *upstreamv1beta1.BootstrapTokenString, _ fuzz.Continue) {
+func kubeadmBootstrapTokenStringFuzzerV1UpstreamBeta1(in *upstreamv1beta1.BootstrapTokenString, c fuzz.Continue) {
 	in.ID = fakeID
 	in.Secret = fakeSecret
 }
 
-func kubeadmBootstrapTokenStringFuzzerV1Beta1(in *bootstrapv1.BootstrapTokenString, _ fuzz.Continue) {
+func kubeadmBootstrapTokenStringFuzzerV1Beta1(in *bootstrapv1.BootstrapTokenString, c fuzz.Continue) {
 	in.ID = fakeID
 	in.Secret = fakeSecret
 }
 
-func kubeadmBootstrapTokenStringFuzzerV1Alpha4(in *BootstrapTokenString, _ fuzz.Continue) {
+func kubeadmBootstrapTokenStringFuzzerV1Alpha4(in *BootstrapTokenString, c fuzz.Continue) {
 	in.ID = fakeID
 	in.Secret = fakeSecret
 }
diff --git a/cmd/clusterctl/client/client_test.go b/cmd/clusterctl/client/client_test.go
index 6da604f0e..6407986b7 100644
--- a/cmd/clusterctl/client/client_test.go
+++ b/cmd/clusterctl/client/client_test.go
@@ -38,7 +38,7 @@ import (
 )
 
 // TestNewFakeClient is a fake test to document fakeClient usage.
-func TestNewFakeClient(_ *testing.T) {
+func TestNewFakeClient(t *testing.T) {
 	// create a fake config with a provider named P1 and a variable named var
 	repository1Config := config.NewProvider("p1", "url", clusterctlv1.CoreProviderType)
 
diff --git a/cmd/clusterctl/client/cluster/inventory_test.go b/cmd/clusterctl/client/cluster/inventory_test.go
index 92916358c..a589d2ed9 100644
--- a/cmd/clusterctl/client/cluster/inventory_test.go
+++ b/cmd/clusterctl/client/cluster/inventory_test.go
@@ -31,7 +31,7 @@ import (
 	"sigs.k8s.io/cluster-api/cmd/clusterctl/internal/test"
 )
 
-func fakePollImmediateWaiter(_, _ time.Duration, _ wait.ConditionFunc) error {
+func fakePollImmediateWaiter(interval, timeout time.Duration, condition wait.ConditionFunc) error {
 	return nil
 }
 
diff --git a/cmd/clusterctl/client/cluster/topology_test.go b/cmd/clusterctl/client/cluster/topology_test.go
index c7ef04161..e8a5e4a38 100644
--- a/cmd/clusterctl/client/cluster/topology_test.go
+++ b/cmd/clusterctl/client/cluster/topology_test.go
@@ -349,11 +349,11 @@ func (m *topologyPlanOutputItemMatcher) Match(actual interface{}) (bool, error)
 	return true, nil
 }
 
-func (m *topologyPlanOutputItemMatcher) FailureMessage(_ interface{}) string {
+func (m *topologyPlanOutputItemMatcher) FailureMessage(actual interface{}) string {
 	return fmt.Sprintf("Expected item Kind=%s, Namespace=%s, Name(prefix)=%s to be present", m.kind, m.namespace, m.namePrefix)
 }
 
-func (m *topologyPlanOutputItemMatcher) NegatedFailureMessage(_ interface{}) string {
+func (m *topologyPlanOutputItemMatcher) NegatedFailureMessage(actual interface{}) string {
 	return fmt.Sprintf("Expected item Kind=%s, Namespace=%s, Name(prefix)=%s not to be present", m.kind, m.namespace, m.namePrefix)
 }
 
diff --git a/cmd/clusterctl/client/clusterclass_test.go b/cmd/clusterctl/client/clusterclass_test.go
index 0ab79e732..3d3e207d7 100644
--- a/cmd/clusterctl/client/clusterclass_test.go
+++ b/cmd/clusterctl/client/clusterclass_test.go
@@ -258,10 +258,10 @@ func (cm *clusterClassMatcher) Match(actual interface{}) (bool, error) {
 	return true, nil
 }
 
-func (cm *clusterClassMatcher) FailureMessage(_ interface{}) string {
+func (cm *clusterClassMatcher) FailureMessage(actual interface{}) string {
 	return fmt.Sprintf("Expected ClusterClass of name %v in namespace %v to be present", cm.name, cm.namespace)
 }
 
-func (cm *clusterClassMatcher) NegatedFailureMessage(_ interface{}) string {
+func (cm *clusterClassMatcher) NegatedFailureMessage(actual interface{}) string {
 	return fmt.Sprintf("Expected ClusterClass of name %v in namespace %v not to be present", cm.name, cm.namespace)
 }
diff --git a/cmd/clusterctl/client/config_test.go b/cmd/clusterctl/client/config_test.go
index fbc549c0b..bb8202840 100644
--- a/cmd/clusterctl/client/config_test.go
+++ b/cmd/clusterctl/client/config_test.go
@@ -1046,6 +1046,6 @@ v3: default3`,
 // errReader returns a non-EOF error on the first read.
 type errReader struct{}
 
-func (e *errReader) Read(_ []byte) (n int, err error) {
+func (e *errReader) Read(p []byte) (n int, err error) {
 	return 0, errors.New("read error")
 }
diff --git a/cmd/clusterctl/client/move_test.go b/cmd/clusterctl/client/move_test.go
index 3b9245cf2..8c2c82fbf 100644
--- a/cmd/clusterctl/client/move_test.go
+++ b/cmd/clusterctl/client/move_test.go
@@ -298,22 +298,22 @@ type fakeObjectMover struct {
 	fromDirectoryErr error
 }
 
-func (f *fakeObjectMover) Move(_ string, _ cluster.Client, _ bool) error {
+func (f *fakeObjectMover) Move(namespace string, toCluster cluster.Client, dryRun bool) error {
 	return f.moveErr
 }
 
-func (f *fakeObjectMover) ToDirectory(_ string, _ string) error {
+func (f *fakeObjectMover) ToDirectory(namespace string, directory string) error {
 	return f.toDirectoryErr
 }
 
-func (f *fakeObjectMover) Backup(_ string, _ string) error {
+func (f *fakeObjectMover) Backup(namespace string, directory string) error {
 	return f.toDirectoryErr
 }
 
-func (f *fakeObjectMover) FromDirectory(_ cluster.Client, _ string) error {
+func (f *fakeObjectMover) FromDirectory(toCluster cluster.Client, directory string) error {
 	return f.fromDirectoryErr
 }
 
-func (f *fakeObjectMover) Restore(_ cluster.Client, _ string) error {
+func (f *fakeObjectMover) Restore(toCluster cluster.Client, directory string) error {
 	return f.fromDirectoryErr
 }
diff --git a/cmd/clusterctl/internal/test/fake_processor.go b/cmd/clusterctl/internal/test/fake_processor.go
index 92a5dd229..376a24ed8 100644
--- a/cmd/clusterctl/internal/test/fake_processor.go
+++ b/cmd/clusterctl/internal/test/fake_processor.go
@@ -44,22 +44,22 @@ func (fp *FakeProcessor) WithProcessErr(e error) *FakeProcessor {
 	return fp
 }
 
-func (fp *FakeProcessor) GetTemplateName(_, _ string) string {
+func (fp *FakeProcessor) GetTemplateName(version, flavor string) string {
 	return fp.artifactName
 }
 
-func (fp *FakeProcessor) GetClusterClassTemplateName(_, name string) string {
+func (fp *FakeProcessor) GetClusterClassTemplateName(version, name string) string {
 	return fmt.Sprintf("clusterclass-%s.yaml", name)
 }
 
-func (fp *FakeProcessor) GetVariables(_ []byte) ([]string, error) {
+func (fp *FakeProcessor) GetVariables(raw []byte) ([]string, error) {
 	return nil, fp.errGetVariables
 }
 
-func (fp *FakeProcessor) GetVariableMap(_ []byte) (map[string]*string, error) {
+func (fp *FakeProcessor) GetVariableMap(raw []byte) (map[string]*string, error) {
 	return nil, fp.errGetVariableMap
 }
 
-func (fp *FakeProcessor) Process(_ []byte, _ func(string) (string, error)) ([]byte, error) {
+func (fp *FakeProcessor) Process(raw []byte, variablesGetter func(string) (string, error)) ([]byte, error) {
 	return nil, fp.errProcess
 }
diff --git a/cmd/clusterctl/internal/test/fake_proxy.go b/cmd/clusterctl/internal/test/fake_proxy.go
index 79ffe5c23..c3273f4f1 100644
--- a/cmd/clusterctl/internal/test/fake_proxy.go
+++ b/cmd/clusterctl/internal/test/fake_proxy.go
@@ -136,11 +136,11 @@ func (f *FakeProxy) ListResources(labels map[string]string, namespaces ...string
 	return ret, nil
 }
 
-func (f *FakeProxy) GetContexts(_ string) ([]string, error) {
+func (f *FakeProxy) GetContexts(prefix string) ([]string, error) {
 	return nil, nil
 }
 
-func (f *FakeProxy) GetResourceNames(_, _ string, _ []client.ListOption, _ string) ([]string, error) {
+func (f *FakeProxy) GetResourceNames(groupVersion, kind string, options []client.ListOption, prefix string) ([]string, error) {
 	return nil, nil
 }
 
diff --git a/cmd/clusterctl/internal/test/fake_reader.go b/cmd/clusterctl/internal/test/fake_reader.go
index 3fd8ea4c9..f33c672ca 100644
--- a/cmd/clusterctl/internal/test/fake_reader.go
+++ b/cmd/clusterctl/internal/test/fake_reader.go
@@ -55,7 +55,7 @@ type imageMeta struct {
 	Tag        string `json:"tag,omitempty"`
 }
 
-func (f *FakeReader) Init(_ string) error {
+func (f *FakeReader) Init(config string) error {
 	f.initialized = true
 	return nil
 }
diff --git a/controlplane/kubeadm/api/v1alpha3/conversion_test.go b/controlplane/kubeadm/api/v1alpha3/conversion_test.go
index 2d8217c19..0a2dc0a79 100644
--- a/controlplane/kubeadm/api/v1alpha3/conversion_test.go
+++ b/controlplane/kubeadm/api/v1alpha3/conversion_test.go
@@ -56,11 +56,11 @@ func fuzzFuncs(_ runtimeserializer.CodecFactory) []interface{} {
 	}
 }
 
-func kubeadmBootstrapTokenStringFuzzer(in *upstreamv1beta1.BootstrapTokenString, _ fuzz.Continue) {
+func kubeadmBootstrapTokenStringFuzzer(in *upstreamv1beta1.BootstrapTokenString, c fuzz.Continue) {
 	in.ID = "abcdef"
 	in.Secret = "abcdef0123456789"
 }
-func cabpkBootstrapTokenStringFuzzer(in *bootstrapv1.BootstrapTokenString, _ fuzz.Continue) {
+func cabpkBootstrapTokenStringFuzzer(in *bootstrapv1.BootstrapTokenString, c fuzz.Continue) {
 	in.ID = "abcdef"
 	in.Secret = "abcdef0123456789"
 }
diff --git a/controlplane/kubeadm/api/v1alpha4/conversion_test.go b/controlplane/kubeadm/api/v1alpha4/conversion_test.go
index 0c9bed520..40e2821d3 100644
--- a/controlplane/kubeadm/api/v1alpha4/conversion_test.go
+++ b/controlplane/kubeadm/api/v1alpha4/conversion_test.go
@@ -71,12 +71,12 @@ func fuzzFuncs(_ runtimeserializer.CodecFactory) []interface{} {
 	}
 }
 
-func kubeadmBootstrapTokenStringFuzzer(in *upstreamv1beta1.BootstrapTokenString, _ fuzz.Continue) {
+func kubeadmBootstrapTokenStringFuzzer(in *upstreamv1beta1.BootstrapTokenString, c fuzz.Continue) {
 	in.ID = fakeID
 	in.Secret = fakeSecret
 }
 
-func cabpkBootstrapTokenStringFuzzer(in *bootstrapv1.BootstrapTokenString, _ fuzz.Continue) {
+func cabpkBootstrapTokenStringFuzzer(in *bootstrapv1.BootstrapTokenString, c fuzz.Continue) {
 	in.ID = fakeID
 	in.Secret = fakeSecret
 }
@@ -84,11 +84,11 @@ func cabpkBootstrapTokenStringFuzzer(in *bootstrapv1.BootstrapTokenString, _ fuz
 func dnsFuzzer(obj *upstreamv1beta1.DNS, c fuzz.Continue) {
 	c.FuzzNoCustom(obj)
 
-	// DNS.Type does not exist in v1alpha4, so setting it to empty string in order to avoid v1alpha3 --> v1alpha4 --> v1alpha3 round trip errors.
+	// DNS.Type does not exists in v1alpha4, so setting it to empty string in order to avoid v1alpha3 --> v1alpha4 --> v1alpha3 round trip errors.
 	obj.Type = ""
 }
 
-func kubeadmBootstrapTokenStringFuzzerV1Alpha4(in *bootstrapv1alpha4.BootstrapTokenString, _ fuzz.Continue) {
+func kubeadmBootstrapTokenStringFuzzerV1Alpha4(in *bootstrapv1alpha4.BootstrapTokenString, c fuzz.Continue) {
 	in.ID = fakeID
 	in.Secret = fakeSecret
 }
diff --git a/controlplane/kubeadm/internal/cluster_test.go b/controlplane/kubeadm/internal/cluster_test.go
index 6fb7fb9a7..e01c3238e 100644
--- a/controlplane/kubeadm/internal/cluster_test.go
+++ b/controlplane/kubeadm/internal/cluster_test.go
@@ -291,7 +291,7 @@ type fakeClient struct {
 	listErr      error
 }
 
-func (f *fakeClient) Get(_ context.Context, key client.ObjectKey, obj client.Object, _ ...client.GetOption) error {
+func (f *fakeClient) Get(_ context.Context, key client.ObjectKey, obj client.Object, opts ...client.GetOption) error {
 	f.getCalled = true
 	if f.getErr != nil {
 		return f.getErr
diff --git a/controlplane/kubeadm/internal/controllers/fakes_test.go b/controlplane/kubeadm/internal/controllers/fakes_test.go
index 7f5a962e2..e83cfc9aa 100644
--- a/controlplane/kubeadm/internal/controllers/fakes_test.go
+++ b/controlplane/kubeadm/internal/controllers/fakes_test.go
@@ -80,7 +80,7 @@ func (f fakeWorkloadCluster) ForwardEtcdLeadership(_ context.Context, _ *cluster
 	return nil
 }
 
-func (f fakeWorkloadCluster) ReconcileEtcdMembers(_ context.Context, _ []string, _ semver.Version) ([]string, error) {
+func (f fakeWorkloadCluster) ReconcileEtcdMembers(ctx context.Context, nodeNames []string, version semver.Version) ([]string, error) {
 	return nil, nil
 }
 
@@ -92,35 +92,35 @@ func (f fakeWorkloadCluster) GetAPIServerCertificateExpiry(_ context.Context, _
 	return f.APIServerCertificateExpiry, nil
 }
 
-func (f fakeWorkloadCluster) AllowBootstrapTokensToGetNodes(_ context.Context) error {
+func (f fakeWorkloadCluster) AllowBootstrapTokensToGetNodes(ctx context.Context) error {
 	return nil
 }
 
-func (f fakeWorkloadCluster) ReconcileKubeletRBACRole(_ context.Context, _ semver.Version) error {
+func (f fakeWorkloadCluster) ReconcileKubeletRBACRole(ctx context.Context, version semver.Version) error {
 	return nil
 }
 
-func (f fakeWorkloadCluster) ReconcileKubeletRBACBinding(_ context.Context, _ semver.Version) error {
+func (f fakeWorkloadCluster) ReconcileKubeletRBACBinding(ctx context.Context, version semver.Version) error {
 	return nil
 }
 
-func (f fakeWorkloadCluster) UpdateKubernetesVersionInKubeadmConfigMap(_ context.Context, _ semver.Version) error {
+func (f fakeWorkloadCluster) UpdateKubernetesVersionInKubeadmConfigMap(ctx context.Context, version semver.Version) error {
 	return nil
 }
 
-func (f fakeWorkloadCluster) UpdateEtcdVersionInKubeadmConfigMap(_ context.Context, _, _ string, _ semver.Version) error {
+func (f fakeWorkloadCluster) UpdateEtcdVersionInKubeadmConfigMap(ctx context.Context, imageRepository, imageTag string, version semver.Version) error {
 	return nil
 }
 
-func (f fakeWorkloadCluster) UpdateKubeletConfigMap(_ context.Context, _ semver.Version) error {
+func (f fakeWorkloadCluster) UpdateKubeletConfigMap(ctx context.Context, version semver.Version) error {
 	return nil
 }
 
-func (f fakeWorkloadCluster) RemoveEtcdMemberForMachine(_ context.Context, _ *clusterv1.Machine) error {
+func (f fakeWorkloadCluster) RemoveEtcdMemberForMachine(ctx context.Context, machine *clusterv1.Machine) error {
 	return nil
 }
 
-func (f fakeWorkloadCluster) RemoveMachineFromKubeadmConfigMap(_ context.Context, _ *clusterv1.Machine, _ semver.Version) error {
+func (f fakeWorkloadCluster) RemoveMachineFromKubeadmConfigMap(ctx context.Context, machine *clusterv1.Machine, version semver.Version) error {
 	return nil
 }
 
@@ -134,7 +134,7 @@ type fakeMigrator struct {
 	migratedCorefile string
 }
 
-func (m *fakeMigrator) Migrate(_, _, _ string, _ bool) (string, error) {
+func (m *fakeMigrator) Migrate(current, to, corefile string, deprecations bool) (string, error) {
 	m.migrateCalled = true
 	if m.migrateErr != nil {
 		return "", m.migrateErr
diff --git a/controlplane/kubeadm/internal/workload_cluster_coredns_test.go b/controlplane/kubeadm/internal/workload_cluster_coredns_test.go
index 242aeb33c..c0bae6931 100644
--- a/controlplane/kubeadm/internal/workload_cluster_coredns_test.go
+++ b/controlplane/kubeadm/internal/workload_cluster_coredns_test.go
@@ -1639,7 +1639,7 @@ type fakeMigrator struct {
 	migratedCorefile string
 }
 
-func (m *fakeMigrator) Migrate(_, _, _ string, _ bool) (string, error) {
+func (m *fakeMigrator) Migrate(current, to, corefile string, deprecations bool) (string, error) {
 	m.migrateCalled = true
 	if m.migrateErr != nil {
 		return "", m.migrateErr
diff --git a/hack/setup-envtest-with-kind.sh b/hack/setup-envtest-with-kind.sh
index 4fd66286b..7f4f4e48c 100755
--- a/hack/setup-envtest-with-kind.sh
+++ b/hack/setup-envtest-with-kind.sh
@@ -18,10 +18,6 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-if [[ "${TRACE-0}" == "1" ]]; then
-    set -o xtrace
-fi
-
 os="unknown"
 if [[ "${OSTYPE}" == "linux"* ]]; then
   os="linux"
diff --git a/internal/contract/bootstrap_test.go b/internal/contract/bootstrap_test.go
deleted file mode 100644
index ab23468b5..000000000
--- a/internal/contract/bootstrap_test.go
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
-Copyright 2022 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package contract
-
-import (
-	"testing"
-
-	. "github.com/onsi/gomega"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-)
-
-func TestBootstrap(t *testing.T) {
-	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
-
-	t.Run("Manages status.ready", func(t *testing.T) {
-		g := NewWithT(t)
-
-		g.Expect(Bootstrap().Ready().Path()).To(Equal(Path{"status", "ready"}))
-
-		err := Bootstrap().Ready().Set(obj, true)
-		g.Expect(err).ToNot(HaveOccurred())
-
-		got, err := Bootstrap().Ready().Get(obj)
-		g.Expect(err).ToNot(HaveOccurred())
-		g.Expect(got).ToNot(BeNil())
-		g.Expect(*got).To(Equal(true))
-	})
-	t.Run("Manages status.dataSecretName", func(t *testing.T) {
-		g := NewWithT(t)
-
-		g.Expect(Bootstrap().DataSecretName().Path()).To(Equal(Path{"status", "dataSecretName"}))
-
-		err := Bootstrap().DataSecretName().Set(obj, "fake-data-secret-name")
-		g.Expect(err).ToNot(HaveOccurred())
-
-		got, err := Bootstrap().DataSecretName().Get(obj)
-		g.Expect(err).ToNot(HaveOccurred())
-		g.Expect(got).ToNot(BeNil())
-		g.Expect(*got).To(Equal("fake-data-secret-name"))
-	})
-	t.Run("Manages optional status.failureReason", func(t *testing.T) {
-		g := NewWithT(t)
-
-		g.Expect(Bootstrap().FailureReason().Path()).To(Equal(Path{"status", "failureReason"}))
-
-		err := Bootstrap().FailureReason().Set(obj, "fake-reason")
-		g.Expect(err).ToNot(HaveOccurred())
-
-		got, err := Bootstrap().FailureReason().Get(obj)
-		g.Expect(err).ToNot(HaveOccurred())
-		g.Expect(got).ToNot(BeNil())
-		g.Expect(*got).To(Equal("fake-reason"))
-	})
-	t.Run("Manages optional status.failureMessage", func(t *testing.T) {
-		g := NewWithT(t)
-
-		g.Expect(Bootstrap().FailureMessage().Path()).To(Equal(Path{"status", "failureMessage"}))
-
-		err := Bootstrap().FailureMessage().Set(obj, "fake-message")
-		g.Expect(err).ToNot(HaveOccurred())
-
-		got, err := Bootstrap().FailureMessage().Get(obj)
-		g.Expect(err).ToNot(HaveOccurred())
-		g.Expect(got).ToNot(BeNil())
-		g.Expect(*got).To(Equal("fake-message"))
-	})
-}
diff --git a/internal/contract/controlplane_test.go b/internal/contract/controlplane_test.go
index 4080cb837..48d5352bb 100644
--- a/internal/contract/controlplane_test.go
+++ b/internal/contract/controlplane_test.go
@@ -56,32 +56,6 @@ func TestControlPlane(t *testing.T) {
 		g.Expect(got).ToNot(BeNil())
 		g.Expect(*got).To(Equal("1.2.3"))
 	})
-	t.Run("Manages status.ready", func(t *testing.T) {
-		g := NewWithT(t)
-
-		g.Expect(ControlPlane().Ready().Path()).To(Equal(Path{"status", "ready"}))
-
-		err := ControlPlane().Ready().Set(obj, true)
-		g.Expect(err).NotTo(HaveOccurred())
-
-		got, err := ControlPlane().Ready().Get(obj)
-		g.Expect(err).ToNot(HaveOccurred())
-		g.Expect(got).ToNot(BeNil())
-		g.Expect(*got).To(Equal(true))
-	})
-	t.Run("Manages status.initialized", func(t *testing.T) {
-		g := NewWithT(t)
-
-		g.Expect(ControlPlane().Initialized().Path()).To(Equal(Path{"status", "initialized"}))
-
-		err := ControlPlane().Initialized().Set(obj, true)
-		g.Expect(err).NotTo(HaveOccurred())
-
-		got, err := ControlPlane().Initialized().Get(obj)
-		g.Expect(err).ToNot(HaveOccurred())
-		g.Expect(got).ToNot(BeNil())
-		g.Expect(*got).To(Equal(true))
-	})
 	t.Run("Manages spec.replicas", func(t *testing.T) {
 		g := NewWithT(t)
 
@@ -134,32 +108,6 @@ func TestControlPlane(t *testing.T) {
 		g.Expect(got).ToNot(BeNil())
 		g.Expect(*got).To(Equal(int64(3)))
 	})
-	t.Run("Manages status.unavailableReplicas", func(t *testing.T) {
-		g := NewWithT(t)
-
-		g.Expect(ControlPlane().UnavailableReplicas().Path()).To(Equal(Path{"status", "unavailableReplicas"}))
-
-		err := ControlPlane().UnavailableReplicas().Set(obj, int64(3))
-		g.Expect(err).ToNot(HaveOccurred())
-
-		got, err := ControlPlane().UnavailableReplicas().Get(obj)
-		g.Expect(err).ToNot(HaveOccurred())
-		g.Expect(got).ToNot(BeNil())
-		g.Expect(*got).To(Equal(int64(3)))
-	})
-	t.Run("Manages status.selector", func(t *testing.T) {
-		g := NewWithT(t)
-
-		g.Expect(ControlPlane().Selector().Path()).To(Equal(Path{"status", "selector"}))
-
-		err := ControlPlane().Selector().Set(obj, "my-selector")
-		g.Expect(err).ToNot(HaveOccurred())
-
-		got, err := ControlPlane().Selector().Get(obj)
-		g.Expect(err).ToNot(HaveOccurred())
-		g.Expect(got).ToNot(BeNil())
-		g.Expect(*got).To(Equal("my-selector"))
-	})
 	t.Run("Manages spec.machineTemplate.infrastructureRef", func(t *testing.T) {
 		g := NewWithT(t)
 
diff --git a/internal/contract/infrastructure_cluster_test.go b/internal/contract/infrastructure_cluster_test.go
index b642944c5..2dece3dd9 100644
--- a/internal/contract/infrastructure_cluster_test.go
+++ b/internal/contract/infrastructure_cluster_test.go
@@ -21,84 +21,9 @@ import (
 
 	. "github.com/onsi/gomega"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-
-	clusterv1 "sigs.k8s.io/cluster-api/api/v1beta1"
 )
 
 func TestInfrastructureCluster(t *testing.T) {
-	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
-
-	t.Run("Manages status.ready", func(t *testing.T) {
-		g := NewWithT(t)
-
-		g.Expect(InfrastructureCluster().Ready().Path()).To(Equal(Path{"status", "ready"}))
-
-		err := InfrastructureCluster().Ready().Set(obj, true)
-		g.Expect(err).ToNot(HaveOccurred())
-
-		got, err := InfrastructureCluster().Ready().Get(obj)
-		g.Expect(err).ToNot(HaveOccurred())
-		g.Expect(got).ToNot(BeNil())
-		g.Expect(*got).To(Equal(true))
-	})
-	t.Run("Manages optional status.failureReason", func(t *testing.T) {
-		g := NewWithT(t)
-
-		g.Expect(InfrastructureCluster().FailureReason().Path()).To(Equal(Path{"status", "failureReason"}))
-
-		err := InfrastructureCluster().FailureReason().Set(obj, "fake-reason")
-		g.Expect(err).ToNot(HaveOccurred())
-
-		got, err := InfrastructureCluster().FailureReason().Get(obj)
-		g.Expect(err).ToNot(HaveOccurred())
-		g.Expect(got).ToNot(BeNil())
-		g.Expect(*got).To(Equal("fake-reason"))
-	})
-	t.Run("Manages optional status.failureMessage", func(t *testing.T) {
-		g := NewWithT(t)
-
-		g.Expect(InfrastructureCluster().FailureMessage().Path()).To(Equal(Path{"status", "failureMessage"}))
-
-		err := InfrastructureCluster().FailureMessage().Set(obj, "fake-message")
-		g.Expect(err).ToNot(HaveOccurred())
-
-		got, err := InfrastructureCluster().FailureMessage().Get(obj)
-		g.Expect(err).ToNot(HaveOccurred())
-		g.Expect(got).ToNot(BeNil())
-		g.Expect(*got).To(Equal("fake-message"))
-	})
-	t.Run("Manages optional status.failureDomains", func(t *testing.T) {
-		g := NewWithT(t)
-
-		failureDomains := clusterv1.FailureDomains{
-			"domain1": clusterv1.FailureDomainSpec{
-				ControlPlane: true,
-				Attributes: map[string]string{
-					"key1": "value1",
-					"key2": "value2",
-				},
-			},
-			"domain2": clusterv1.FailureDomainSpec{
-				ControlPlane: false,
-				Attributes: map[string]string{
-					"key3": "value3",
-					"key4": "value4",
-				},
-			},
-		}
-		g.Expect(InfrastructureCluster().FailureDomains().Path()).To(Equal(Path{"status", "failureDomains"}))
-
-		err := InfrastructureCluster().FailureDomains().Set(obj, failureDomains)
-		g.Expect(err).ToNot(HaveOccurred())
-
-		got, err := InfrastructureCluster().FailureDomains().Get(obj)
-		g.Expect(err).ToNot(HaveOccurred())
-		g.Expect(got).ToNot(BeNil())
-		g.Expect(*got).To(Equal(failureDomains))
-	})
-}
-
-func TestInfrastructureClusterControlPlaneEndpoint(t *testing.T) {
 	tests := []struct {
 		name                  string
 		infrastructureCluster *unstructured.Unstructured
diff --git a/internal/contract/infrastructure_machine_test.go b/internal/contract/infrastructure_machine_test.go
deleted file mode 100644
index ba1d7ee61..000000000
--- a/internal/contract/infrastructure_machine_test.go
+++ /dev/null
@@ -1,119 +0,0 @@
-/*
-Copyright 2022 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package contract
-
-import (
-	"testing"
-
-	. "github.com/onsi/gomega"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-
-	clusterv1 "sigs.k8s.io/cluster-api/api/v1beta1"
-)
-
-func TestInfrastructureMachine(t *testing.T) {
-	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
-
-	t.Run("Manages spec.providerID", func(t *testing.T) {
-		g := NewWithT(t)
-
-		g.Expect(InfrastructureMachine().ProviderID().Path()).To(Equal(Path{"spec", "providerID"}))
-
-		err := InfrastructureMachine().ProviderID().Set(obj, "fake-provider-id")
-		g.Expect(err).ToNot(HaveOccurred())
-
-		got, err := InfrastructureMachine().ProviderID().Get(obj)
-		g.Expect(err).ToNot(HaveOccurred())
-		g.Expect(got).ToNot(BeNil())
-		g.Expect(*got).To(Equal("fake-provider-id"))
-	})
-	t.Run("Manages status.ready", func(t *testing.T) {
-		g := NewWithT(t)
-
-		g.Expect(InfrastructureMachine().Ready().Path()).To(Equal(Path{"status", "ready"}))
-
-		err := InfrastructureMachine().Ready().Set(obj, true)
-		g.Expect(err).ToNot(HaveOccurred())
-
-		got, err := InfrastructureMachine().Ready().Get(obj)
-		g.Expect(err).ToNot(HaveOccurred())
-		g.Expect(got).ToNot(BeNil())
-		g.Expect(*got).To(Equal(true))
-	})
-	t.Run("Manages optional status.failureReason", func(t *testing.T) {
-		g := NewWithT(t)
-
-		g.Expect(InfrastructureMachine().FailureReason().Path()).To(Equal(Path{"status", "failureReason"}))
-
-		err := InfrastructureMachine().FailureReason().Set(obj, "fake-reason")
-		g.Expect(err).ToNot(HaveOccurred())
-
-		got, err := InfrastructureMachine().FailureReason().Get(obj)
-		g.Expect(err).ToNot(HaveOccurred())
-		g.Expect(got).ToNot(BeNil())
-		g.Expect(*got).To(Equal("fake-reason"))
-	})
-	t.Run("Manages optional status.failureMessage", func(t *testing.T) {
-		g := NewWithT(t)
-
-		g.Expect(InfrastructureMachine().FailureMessage().Path()).To(Equal(Path{"status", "failureMessage"}))
-
-		err := InfrastructureMachine().FailureMessage().Set(obj, "fake-message")
-		g.Expect(err).ToNot(HaveOccurred())
-
-		got, err := InfrastructureMachine().FailureMessage().Get(obj)
-		g.Expect(err).ToNot(HaveOccurred())
-		g.Expect(got).ToNot(BeNil())
-		g.Expect(*got).To(Equal("fake-message"))
-	})
-	t.Run("Manages optional status.addresses", func(t *testing.T) {
-		g := NewWithT(t)
-
-		addresses := []clusterv1.MachineAddress{
-			{
-				Type:    clusterv1.MachineHostName,
-				Address: "fake-address-1",
-			},
-			{
-				Type:    clusterv1.MachineInternalIP,
-				Address: "fake-address-2",
-			},
-		}
-		g.Expect(InfrastructureMachine().Addresses().Path()).To(Equal(Path{"status", "addresses"}))
-
-		err := InfrastructureMachine().Addresses().Set(obj, addresses)
-		g.Expect(err).ToNot(HaveOccurred())
-
-		got, err := InfrastructureMachine().Addresses().Get(obj)
-		g.Expect(err).ToNot(HaveOccurred())
-		g.Expect(got).ToNot(BeNil())
-		g.Expect(*got).To(Equal(addresses))
-	})
-	t.Run("Manages optional spec.failureDomain", func(t *testing.T) {
-		g := NewWithT(t)
-
-		g.Expect(InfrastructureMachine().FailureDomain().Path()).To(Equal(Path{"spec", "failureDomain"}))
-
-		err := InfrastructureMachine().FailureDomain().Set(obj, "fake-failure-domain")
-		g.Expect(err).ToNot(HaveOccurred())
-
-		got, err := InfrastructureMachine().FailureDomain().Get(obj)
-		g.Expect(err).ToNot(HaveOccurred())
-		g.Expect(got).ToNot(BeNil())
-		g.Expect(*got).To(Equal("fake-failure-domain"))
-	})
-}
diff --git a/internal/controllers/topology/cluster/desired_state_test.go b/internal/controllers/topology/cluster/desired_state_test.go
index 562128504..db64ce894 100644
--- a/internal/controllers/topology/cluster/desired_state_test.go
+++ b/internal/controllers/topology/cluster/desired_state_test.go
@@ -1329,9 +1329,6 @@ func TestComputeMachineDeployment(t *testing.T) {
 	nodeVolumeDetachTimeout := metav1.Duration{Duration: 10 * time.Second}
 	nodeDeletionTimeout := metav1.Duration{Duration: 10 * time.Second}
 	minReadySeconds := int32(5)
-	strategy := clusterv1.MachineDeploymentStrategy{
-		Type: clusterv1.OnDeleteMachineDeploymentStrategyType,
-	}
 	mdTopology := clusterv1.MachineDeploymentTopology{
 		Metadata: clusterv1.ObjectMeta{
 			Labels: map[string]string{"foo": "baz"},
@@ -1344,7 +1341,6 @@ func TestComputeMachineDeployment(t *testing.T) {
 		NodeVolumeDetachTimeout: &nodeVolumeDetachTimeout,
 		NodeDeletionTimeout:     &nodeDeletionTimeout,
 		MinReadySeconds:         &minReadySeconds,
-		Strategy:                &strategy,
 	}
 
 	t.Run("Generates the machine deployment and the referenced templates", func(t *testing.T) {
@@ -1372,7 +1368,6 @@ func TestComputeMachineDeployment(t *testing.T) {
 		actualMd := actual.Object
 		g.Expect(*actualMd.Spec.Replicas).To(Equal(replicas))
 		g.Expect(*actualMd.Spec.MinReadySeconds).To(Equal(minReadySeconds))
-		g.Expect(*actualMd.Spec.Strategy).To(Equal(strategy))
 		g.Expect(*actualMd.Spec.Template.Spec.FailureDomain).To(Equal(failureDomain))
 		g.Expect(*actualMd.Spec.Template.Spec.NodeDrainTimeout).To(Equal(nodeDrainTimeout))
 		g.Expect(*actualMd.Spec.Template.Spec.NodeDeletionTimeout).To(Equal(nodeDeletionTimeout))
diff --git a/internal/runtime/client/client_test.go b/internal/runtime/client/client_test.go
index bfce5c718..876fcffba 100644
--- a/internal/runtime/client/client_test.go
+++ b/internal/runtime/client/client_test.go
@@ -208,7 +208,7 @@ func TestClient_httpCall(t *testing.T) {
 	}
 }
 
-func fakeHookHandler(w http.ResponseWriter, _ *http.Request) {
+func fakeHookHandler(w http.ResponseWriter, r *http.Request) {
 	response := &fakev1alpha1.FakeResponse{
 		TypeMeta: metav1.TypeMeta{
 			Kind:       "FakeHookResponse",
diff --git a/test/e2e/common.go b/test/e2e/common.go
index 19cd3fb38..fb95c909a 100644
--- a/test/e2e/common.go
+++ b/test/e2e/common.go
@@ -104,17 +104,17 @@ func HaveValidVersion(version string) types.GomegaMatcher {
 
 type validVersionMatcher struct{ version string }
 
-func (m *validVersionMatcher) Match(_ interface{}) (success bool, err error) {
+func (m *validVersionMatcher) Match(actual interface{}) (success bool, err error) {
 	if _, err := semver.ParseTolerant(m.version); err != nil {
 		return false, err
 	}
 	return true, nil
 }
 
-func (m *validVersionMatcher) FailureMessage(_ interface{}) (message string) {
+func (m *validVersionMatcher) FailureMessage(actual interface{}) (message string) {
 	return fmt.Sprintf("Expected\n%s\n%s", m.version, " to be a valid version ")
 }
 
-func (m *validVersionMatcher) NegatedFailureMessage(_ interface{}) (message string) {
+func (m *validVersionMatcher) NegatedFailureMessage(actual interface{}) (message string) {
 	return fmt.Sprintf("Expected\n%s\n%s", m.version, " not to be a valid version ")
 }
diff --git a/test/e2e/data/infrastructure-docker/v1beta1/main/bases/cluster-with-topology.yaml b/test/e2e/data/infrastructure-docker/v1beta1/main/bases/cluster-with-topology.yaml
index b54e06498..ab8a2664b 100644
--- a/test/e2e/data/infrastructure-docker/v1beta1/main/bases/cluster-with-topology.yaml
+++ b/test/e2e/data/infrastructure-docker/v1beta1/main/bases/cluster-with-topology.yaml
@@ -29,10 +29,6 @@ spec:
         minReadySeconds: 5
         replicas: ${WORKER_MACHINE_COUNT}
         failureDomain: fd4
-        strategy:
-          rollingUpdate:
-            maxSurge: "20%"
-            maxUnavailable: 0
     variables:
       # We set an empty value to use the default tag kubeadm init is using.
     - name: etcdImageTag
diff --git a/test/e2e/data/infrastructure-docker/v1beta1/main/clusterclass-quick-start.yaml b/test/e2e/data/infrastructure-docker/v1beta1/main/clusterclass-quick-start.yaml
index f11423db1..828bc6f61 100644
--- a/test/e2e/data/infrastructure-docker/v1beta1/main/clusterclass-quick-start.yaml
+++ b/test/e2e/data/infrastructure-docker/v1beta1/main/clusterclass-quick-start.yaml
@@ -246,52 +246,6 @@ spec:
       - op: add
         path: "/spec/template/spec/kubeadmConfigSpec/joinConfiguration/nodeRegistration/taints"
         value: []
-  - name: podSecurityStandard
-    description: "Adds an admission configuration for PodSecurity to the kube-apiserver."
-    definitions:
-    - selector:
-        apiVersion: controlplane.cluster.x-k8s.io/v1beta1
-        kind: KubeadmControlPlaneTemplate
-        matchResources:
-          controlPlane: true
-      jsonPatches:
-      - op: add
-        path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs"
-        value:
-          admission-control-config-file: "/etc/kubernetes/kube-apiserver-admission-pss.yaml"
-      - op: add
-        path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraVolumes"
-        value:
-        - name: admission-pss
-          hostPath: /etc/kubernetes/kube-apiserver-admission-pss.yaml
-          mountPath: /etc/kubernetes/kube-apiserver-admission-pss.yaml
-          readOnly: true
-          pathType: "File"
-      - op: add
-        path: "/spec/template/spec/kubeadmConfigSpec/files"
-        valueFrom:
-          template: |
-            - content: |
-                apiVersion: apiserver.config.k8s.io/v1
-                kind: AdmissionConfiguration
-                plugins:
-                - name: PodSecurity
-                  configuration:
-                    apiVersion: pod-security.admission.config.k8s.io/v1{{ if semverCompare "< v1.25" .builtin.controlPlane.version }}beta1{{ end }}
-                    kind: PodSecurityConfiguration
-                    defaults:
-                      enforce: "baseline"
-                      enforce-version: "latest"
-                      audit: "baseline"
-                      audit-version: "latest"
-                      warn: "baseline"
-                      warn-version: "latest"
-                    exemptions:
-                      usernames: []
-                      runtimeClasses: []
-                      namespaces: [kube-system]
-              path: /etc/kubernetes/kube-apiserver-admission-pss.yaml
-    enabledIf: '{{ semverCompare ">= v1.24" .builtin.controlPlane.version }}'
 ---
 apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
 kind: DockerClusterTemplate
diff --git a/test/framework/clusterctl/e2e_config.go b/test/framework/clusterctl/e2e_config.go
index 3603b1bdf..263feb13a 100644
--- a/test/framework/clusterctl/e2e_config.go
+++ b/test/framework/clusterctl/e2e_config.go
@@ -49,7 +49,7 @@ type LoadE2EConfigInput struct {
 }
 
 // LoadE2EConfig loads the configuration for the e2e test environment.
-func LoadE2EConfig(_ context.Context, input LoadE2EConfigInput) *E2EConfig {
+func LoadE2EConfig(ctx context.Context, input LoadE2EConfigInput) *E2EConfig {
 	configData, err := os.ReadFile(input.ConfigPath)
 	Expect(err).ToNot(HaveOccurred(), "Failed to read the e2e test config file")
 	Expect(configData).ToNot(BeEmpty(), "The e2e test config file should not be empty")
diff --git a/test/framework/clusterctl/logger/logger.go b/test/framework/clusterctl/logger/logger.go
index 67d5482b8..857152afa 100644
--- a/test/framework/clusterctl/logger/logger.go
+++ b/test/framework/clusterctl/logger/logger.go
@@ -35,14 +35,14 @@ type logger struct {
 
 var _ logr.LogSink = &logger{}
 
-func (l *logger) Init(_ logr.RuntimeInfo) {
+func (l *logger) Init(info logr.RuntimeInfo) {
 }
 
-func (l *logger) Enabled(_ int) bool {
+func (l *logger) Enabled(level int) bool {
 	return true
 }
 
-func (l *logger) Info(_ int, msg string, kvs ...interface{}) {
+func (l *logger) Info(level int, msg string, kvs ...interface{}) {
 	values := copySlice(l.values)
 	values = append(values, kvs...)
 	values = append(values, "msg", msg)
@@ -53,16 +53,16 @@ func (l *logger) Info(_ int, msg string, kvs ...interface{}) {
 	fmt.Fprintln(l.writer, f)
 }
 
-func (l *logger) Error(_ error, _ string, _ ...interface{}) {
+func (l *logger) Error(err error, msg string, kvs ...interface{}) {
 	panic("using log.Error is deprecated in clusterctl")
 }
 
-func (l *logger) V(_ int) logr.LogSink {
+func (l *logger) V(level int) logr.LogSink {
 	nl := l.clone()
 	return nl
 }
 
-func (l *logger) WithName(_ string) logr.LogSink {
+func (l *logger) WithName(name string) logr.LogSink {
 	panic("using log.WithName is deprecated in clusterctl")
 }
 
diff --git a/test/framework/docker_logcollector.go b/test/framework/docker_logcollector.go
index 0d3f80ddb..4d69338b0 100644
--- a/test/framework/docker_logcollector.go
+++ b/test/framework/docker_logcollector.go
@@ -46,7 +46,7 @@ func machineContainerName(cluster, machine string) string {
 	return fmt.Sprintf("%s-%s", cluster, machine)
 }
 
-func (k DockerLogCollector) CollectMachineLog(ctx context.Context, _ client.Client, m *clusterv1.Machine, outputPath string) error {
+func (k DockerLogCollector) CollectMachineLog(ctx context.Context, managementClusterClient client.Client, m *clusterv1.Machine, outputPath string) error {
 	containerName := machineContainerName(m.Spec.ClusterName, m.Name)
 	containerRuntime, err := container.NewDockerClient()
 	if err != nil {
@@ -56,7 +56,7 @@ func (k DockerLogCollector) CollectMachineLog(ctx context.Context, _ client.Clie
 	return k.collectLogsFromNode(ctx, outputPath, containerName)
 }
 
-func (k DockerLogCollector) CollectMachinePoolLog(ctx context.Context, _ client.Client, m *expv1.MachinePool, outputPath string) error {
+func (k DockerLogCollector) CollectMachinePoolLog(ctx context.Context, managementClusterClient client.Client, m *expv1.MachinePool, outputPath string) error {
 	containerRuntime, err := container.NewDockerClient()
 	if err != nil {
 		return err
diff --git a/test/go.mod b/test/go.mod
index 88484c4be..fdfc0b89d 100644
--- a/test/go.mod
+++ b/test/go.mod
@@ -10,8 +10,8 @@ require (
 	github.com/docker/go-connections v0.4.0
 	github.com/flatcar/ignition v0.36.2
 	github.com/go-logr/logr v1.2.3
-	github.com/onsi/ginkgo/v2 v2.4.0
-	github.com/onsi/gomega v1.22.1
+	github.com/onsi/ginkgo/v2 v2.2.0
+	github.com/onsi/gomega v1.20.1
 	github.com/pkg/errors v0.9.1
 	github.com/spf13/pflag v1.0.5
 	github.com/vincent-petithory/dataurl v1.0.0
@@ -24,7 +24,7 @@ require (
 	k8s.io/klog/v2 v2.80.1
 	k8s.io/utils v0.0.0-20220823124924-e9cbc92d1a73
 	sigs.k8s.io/cluster-api v0.0.0-00010101000000-000000000000
-	sigs.k8s.io/controller-runtime v0.13.1
+	sigs.k8s.io/controller-runtime v0.13.0
 	sigs.k8s.io/kind v0.17.0
 	sigs.k8s.io/yaml v1.3.0
 )
@@ -110,11 +110,11 @@ require (
 	go.uber.org/multierr v1.6.0 // indirect
 	go.uber.org/zap v1.21.0 // indirect
 	golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4 // indirect
-	golang.org/x/net v0.1.0 // indirect
+	golang.org/x/net v0.0.0-20220909164309-bea034e7d591 // indirect
 	golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1 // indirect
-	golang.org/x/sys v0.1.0 // indirect
-	golang.org/x/term v0.1.0 // indirect
-	golang.org/x/text v0.4.0 // indirect
+	golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec // indirect
+	golang.org/x/term v0.0.0-20220722155259-a9ba230a4035 // indirect
+	golang.org/x/text v0.3.7 // indirect
 	golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20220616135557-88e70c0c3a90 // indirect
diff --git a/test/go.sum b/test/go.sum
index abe8a132a..c6187829b 100644
--- a/test/go.sum
+++ b/test/go.sum
@@ -434,10 +434,10 @@ github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLA
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
-github.com/onsi/ginkgo/v2 v2.4.0 h1:+Ig9nvqgS5OBSACXNk15PLdp0U9XPYROt9CFzVdFGIs=
-github.com/onsi/ginkgo/v2 v2.4.0/go.mod h1:iHkDK1fKGcBoEHT5W7YBq4RFWaQulw+caOMkAt4OrFo=
-github.com/onsi/gomega v1.22.1 h1:pY8O4lBfsHKZHM/6nrxkhVPUznOlIu3quZcKP/M20KI=
-github.com/onsi/gomega v1.22.1/go.mod h1:x6n7VNe4hw0vkyYUM4mjIXx3JbLiPaBPNgB7PRQ1tuM=
+github.com/onsi/ginkgo/v2 v2.2.0 h1:3ZNA3L1c5FYDFTTxbFeVGGD8jYvjYauHD30YgLxVsNI=
+github.com/onsi/ginkgo/v2 v2.2.0/go.mod h1:MEH45j8TBi6u9BMogfbp0stKC5cdGjumZj5Y7AG4VIk=
+github.com/onsi/gomega v1.20.1 h1:PA/3qinGoukvymdIDV8pii6tiZgC8kbmJO6Z5+b002Q=
+github.com/onsi/gomega v1.20.1/go.mod h1:DtrZpjmvpn2mPm4YWQa0/ALMDj9v4YxLgojwPeREyVo=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.0.2 h1:9yCKha/T5XdGtO0q9Q9a6T5NUCsTn/DrBg0D7ufOcFM=
@@ -688,8 +688,8 @@ golang.org/x/net v0.0.0-20220325170049-de3da57026de/go.mod h1:CfG3xpIq0wQ8r1q4Su
 golang.org/x/net v0.0.0-20220412020605-290c469a71a5/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.1.0 h1:hZ/3BUoy5aId7sCpA/Tc5lt8DkFgdVS2onTpJsZ/fl0=
-golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
+golang.org/x/net v0.0.0-20220909164309-bea034e7d591 h1:D0B/7al0LLrVC8aWF4+oxpv/m8bc7ViFfVS8/gXGdqI=
+golang.org/x/net v0.0.0-20220909164309-bea034e7d591/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -797,12 +797,12 @@ golang.org/x/sys v0.0.0-20220502124256-b6088ccd6cba/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
-golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec h1:BkDtF2Ih9xZ7le9ndzTA7KJow28VbQW3odyk/8drmuI=
+golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.1.0 h1:g6Z6vPFA9dYBAF7DWcH6sCcOntplXsDKcliusYijMlw=
-golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.0.0-20220722155259-a9ba230a4035 h1:Q5284mrmYTpACcm+eAKjKJH48BBwSyfJqmmGDTtT8Vc=
+golang.org/x/term v0.0.0-20220722155259-a9ba230a4035/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -811,9 +811,8 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.4.0 h1:BrVqGRd7+k1DiOgtnFvAkoQEWQvBc25ouMJM6429SFg=
-golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1125,8 +1124,8 @@ k8s.io/utils v0.0.0-20220823124924-e9cbc92d1a73/go.mod h1:jPW/WVKK9YHAvNhRxK0md/
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
-sigs.k8s.io/controller-runtime v0.13.1 h1:tUsRCSJVM1QQOOeViGeX3GMT3dQF1eePPw6sEE3xSlg=
-sigs.k8s.io/controller-runtime v0.13.1/go.mod h1:Zbz+el8Yg31jubvAEyglRZGdLAjplZl+PgtYNI6WNTI=
+sigs.k8s.io/controller-runtime v0.13.0 h1:iqa5RNciy7ADWnIc8QxCbOX5FEKVR3uxVxKHRMc2WIQ=
+sigs.k8s.io/controller-runtime v0.13.0/go.mod h1:Zbz+el8Yg31jubvAEyglRZGdLAjplZl+PgtYNI6WNTI=
 sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 h1:iXTIw73aPyC+oRdyqqvVJuloN1p0AC/kzH07hu3NE+k=
 sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
 sigs.k8s.io/kind v0.17.0 h1:CScmGz/wX66puA06Gj8OZb76Wmk7JIjgWf5JDvY7msM=
diff --git a/test/infrastructure/container/docker.go b/test/infrastructure/container/docker.go
index ca91467d3..9d8eeaa2e 100644
--- a/test/infrastructure/container/docker.go
+++ b/test/infrastructure/container/docker.go
@@ -161,7 +161,7 @@ func (d *dockerRuntime) GetHostPort(ctx context.Context, containerName, portAndP
 }
 
 // ExecContainer executes a command in a running container and writes any output to the provided writer.
-func (d *dockerRuntime) ExecContainer(_ context.Context, containerName string, config *ExecContainerInput, command string, args ...string) error {
+func (d *dockerRuntime) ExecContainer(ctxd context.Context, containerName string, config *ExecContainerInput, command string, args ...string) error {
 	ctx := context.Background() // Let the command finish, even if it takes longer than the default timeout
 	execConfig := types.ExecConfig{
 		// Run with privileges so we can remount etc..
diff --git a/test/infrastructure/container/fake.go b/test/infrastructure/container/fake.go
index 7b777a759..022d6fc3e 100644
--- a/test/infrastructure/container/fake.go
+++ b/test/infrastructure/container/fake.go
@@ -55,34 +55,34 @@ func NewFakeClient() (Runtime, error) {
 }
 
 // SaveContainerImage saves a Docker image to the file specified by dest.
-func (f *FakeRuntime) SaveContainerImage(_ context.Context, _, _ string) error {
+func (f *FakeRuntime) SaveContainerImage(ctx context.Context, image, dest string) error {
 	return nil
 }
 
 // PullContainerImageIfNotExists triggers the Docker engine to pull an image, but only if it doesn't
 // already exist. This is important when we're using locally built images in CI which
 // do not exist remotely.
-func (f *FakeRuntime) PullContainerImageIfNotExists(_ context.Context, _ string) error {
+func (f *FakeRuntime) PullContainerImageIfNotExists(ctx context.Context, image string) error {
 	return nil
 }
 
 // PullContainerImage triggers the Docker engine to pull an image.
-func (f *FakeRuntime) PullContainerImage(_ context.Context, _ string) error {
+func (f *FakeRuntime) PullContainerImage(ctx context.Context, image string) error {
 	return nil
 }
 
 // ImageExistsLocally returns if the specified image exists in local container image cache.
-func (f *FakeRuntime) ImageExistsLocally(_ context.Context, _ string) (bool, error) {
+func (f *FakeRuntime) ImageExistsLocally(ctx context.Context, image string) (bool, error) {
 	return false, nil
 }
 
 // GetHostPort looks up the host port bound for the port and protocol (e.g. "6443/tcp").
-func (f *FakeRuntime) GetHostPort(_ context.Context, _, _ string) (string, error) {
+func (f *FakeRuntime) GetHostPort(ctx context.Context, containerName, portAndProtocol string) (string, error) {
 	return "", nil
 }
 
 // ExecContainer executes a command in a running container and writes any output to the provided writer.
-func (f *FakeRuntime) ExecContainer(_ context.Context, containerName string, config *ExecContainerInput, command string, args ...string) error {
+func (f *FakeRuntime) ExecContainer(ctx context.Context, containerName string, config *ExecContainerInput, command string, args ...string) error {
 	execContainerCallLog = append(execContainerCallLog, ExecContainerArgs{
 		ContainerName: containerName,
 		Config:        config,
@@ -104,12 +104,12 @@ func (f *FakeRuntime) ResetExecContainerCallLogs() {
 }
 
 // ListContainers returns a list of all containers.
-func (f *FakeRuntime) ListContainers(_ context.Context, _ FilterBuilder) ([]Container, error) {
+func (f *FakeRuntime) ListContainers(ctx context.Context, filters FilterBuilder) ([]Container, error) {
 	return []Container{}, nil
 }
 
 // DeleteContainer will remove a container, forcing removal if still running.
-func (f *FakeRuntime) DeleteContainer(_ context.Context, containerName string) error {
+func (f *FakeRuntime) DeleteContainer(ctx context.Context, containerName string) error {
 	deleteContainerCallLog = append(deleteContainerCallLog, containerName)
 	return nil
 }
@@ -125,7 +125,7 @@ func (f *FakeRuntime) ResetDeleteContainerCallLogs() {
 }
 
 // KillContainer will kill a running container with the specified signal.
-func (f *FakeRuntime) KillContainer(_ context.Context, containerName, signal string) error {
+func (f *FakeRuntime) KillContainer(ctx context.Context, containerName, signal string) error {
 	killContainerCallLog = append(killContainerCallLog, KillContainerArgs{
 		Container: containerName,
 		Signal:    signal,
@@ -146,17 +146,17 @@ func (f *FakeRuntime) ResetKillContainerCallLogs() {
 // GetContainerIPs inspects a container to get its IPv4 and IPv6 IP addresses.
 // Will not error if there is no IP address assigned. Calling code will need to
 // determine whether that is an issue or not.
-func (f *FakeRuntime) GetContainerIPs(_ context.Context, containerName string) (string, string, error) {
+func (f *FakeRuntime) GetContainerIPs(ctx context.Context, containerName string) (string, string, error) {
 	return containerName + "IPv4", containerName + "IPv6", nil
 }
 
 // ContainerDebugInfo gets the container metadata and logs from the runtime (docker inspect, docker logs).
-func (f *FakeRuntime) ContainerDebugInfo(_ context.Context, _ string, _ io.Writer) error {
+func (f *FakeRuntime) ContainerDebugInfo(ctx context.Context, containerName string, w io.Writer) error {
 	return nil
 }
 
 // RunContainer will run a docker container with the given settings and arguments, returning any errors.
-func (f *FakeRuntime) RunContainer(_ context.Context, runConfig *RunContainerInput, output io.Writer) error {
+func (f *FakeRuntime) RunContainer(ctx context.Context, runConfig *RunContainerInput, output io.Writer) error {
 	runContainerCallLog = append(runContainerCallLog, RunContainerArgs{runConfig, output})
 	return nil
 }
diff --git a/test/infrastructure/docker/api/v1beta1/dockercluster_webhook.go b/test/infrastructure/docker/api/v1beta1/dockercluster_webhook.go
index 9cfeb6db7..95e801e10 100644
--- a/test/infrastructure/docker/api/v1beta1/dockercluster_webhook.go
+++ b/test/infrastructure/docker/api/v1beta1/dockercluster_webhook.go
@@ -52,7 +52,7 @@ func (c *DockerCluster) ValidateCreate() error {
 }
 
 // ValidateUpdate implements webhook.Validator so a webhook will be registered for the type.
-func (c *DockerCluster) ValidateUpdate(_ runtime.Object) error {
+func (c *DockerCluster) ValidateUpdate(old runtime.Object) error {
 	return nil
 }
 
@@ -61,8 +61,8 @@ func (c *DockerCluster) ValidateDelete() error {
 	return nil
 }
 
-func defaultDockerClusterSpec(_ *DockerClusterSpec) {}
+func defaultDockerClusterSpec(s *DockerClusterSpec) {}
 
-func validateDockerClusterSpec(_ DockerClusterSpec) field.ErrorList {
+func validateDockerClusterSpec(s DockerClusterSpec) field.ErrorList {
 	return nil
 }
diff --git a/test/infrastructure/docker/api/v1beta1/dockermachinetemplate_webhook.go b/test/infrastructure/docker/api/v1beta1/dockermachinetemplate_webhook.go
index adbbb231c..7a32da49f 100644
--- a/test/infrastructure/docker/api/v1beta1/dockermachinetemplate_webhook.go
+++ b/test/infrastructure/docker/api/v1beta1/dockermachinetemplate_webhook.go
@@ -49,7 +49,7 @@ type DockerMachineTemplateWebhook struct{}
 var _ webhook.CustomValidator = &DockerMachineTemplateWebhook{}
 
 // ValidateCreate implements webhook.Validator so a webhook will be registered for the type.
-func (*DockerMachineTemplateWebhook) ValidateCreate(_ context.Context, _ runtime.Object) error {
+func (*DockerMachineTemplateWebhook) ValidateCreate(ctx context.Context, _ runtime.Object) error {
 	return nil
 }
 
@@ -81,6 +81,6 @@ func (*DockerMachineTemplateWebhook) ValidateUpdate(ctx context.Context, oldRaw
 }
 
 // ValidateDelete implements webhook.Validator so a webhook will be registered for the type.
-func (*DockerMachineTemplateWebhook) ValidateDelete(_ context.Context, _ runtime.Object) error {
+func (*DockerMachineTemplateWebhook) ValidateDelete(ctx context.Context, _ runtime.Object) error {
 	return nil
 }
diff --git a/test/infrastructure/docker/config/default/namespace.yaml b/test/infrastructure/docker/config/default/namespace.yaml
index 50e4f9a5f..8b55c3cd8 100644
--- a/test/infrastructure/docker/config/default/namespace.yaml
+++ b/test/infrastructure/docker/config/default/namespace.yaml
@@ -3,8 +3,4 @@ kind: Namespace
 metadata:
   labels:
     control-plane: controller-manager
-    # CAPD requires the privileged policy because it needs to mount the docker socket using a hostPath.
-    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/warn: privileged
-    pod-security.kubernetes.io/audit: privileged
   name: system
diff --git a/test/infrastructure/docker/internal/docker/kind_manager.go b/test/infrastructure/docker/internal/docker/kind_manager.go
index 9d3cd01a1..1b86711d8 100644
--- a/test/infrastructure/docker/internal/docker/kind_manager.go
+++ b/test/infrastructure/docker/internal/docker/kind_manager.go
@@ -106,7 +106,7 @@ func (m *Manager) CreateWorkerNode(ctx context.Context, name, image, clusterName
 }
 
 // CreateExternalLoadBalancerNode will create a new container to act as the load balancer for external access.
-func (m *Manager) CreateExternalLoadBalancerNode(ctx context.Context, name, image, clusterName, listenAddress string, port int32, _ clusterv1.ClusterIPFamily) (*types.Node, error) {
+func (m *Manager) CreateExternalLoadBalancerNode(ctx context.Context, name, image, clusterName, listenAddress string, port int32, ipFamily clusterv1.ClusterIPFamily) (*types.Node, error) {
 	// gets a random host port for control-plane load balancer
 	// gets a random host port for the API server
 	if port == 0 {
diff --git a/test/infrastructure/docker/internal/docker/machine.go b/test/infrastructure/docker/internal/docker/machine.go
index 077da6751..3654ef6f9 100644
--- a/test/infrastructure/docker/internal/docker/machine.go
+++ b/test/infrastructure/docker/internal/docker/machine.go
@@ -297,19 +297,19 @@ func (m *Machine) PreloadLoadImages(ctx context.Context, images []string) error
 
 		err = containerRuntime.SaveContainerImage(ctx, image, imageTarPath)
 		if err != nil {
-			return errors.Wrapf(err, "failed to save image %q to %q", image, imageTarPath)
+			return errors.Wrap(err, "failed to save image")
 		}
 
 		f, err := os.Open(imageTarPath)
 		if err != nil {
-			return errors.Wrapf(err, "failed to open image %q from %q", image, imageTarPath)
+			return errors.Wrap(err, "failed to open image")
 		}
 		defer f.Close() //nolint:gocritic // No resource leak.
 
 		ps := m.container.Commander.Command("ctr", "--namespace=k8s.io", "images", "import", "-")
 		ps.SetStdin(f)
 		if err := ps.Run(ctx); err != nil {
-			return errors.Wrapf(err, "failed to load image %q", image)
+			return errors.Wrap(err, "failed to load image")
 		}
 	}
 	return nil
diff --git a/test/infrastructure/docker/templates/clusterclass-quick-start.yaml b/test/infrastructure/docker/templates/clusterclass-quick-start.yaml
index ab54f7f73..c2c193c72 100644
--- a/test/infrastructure/docker/templates/clusterclass-quick-start.yaml
+++ b/test/infrastructure/docker/templates/clusterclass-quick-start.yaml
@@ -219,7 +219,7 @@ spec:
                 plugins:
                 - name: PodSecurity
                   configuration:
-                    apiVersion: pod-security.admission.config.k8s.io/v1{{ if semverCompare "< v1.25" .builtin.controlPlane.version }}beta1{{ end }}
+                    apiVersion: pod-security.admission.config.k8s.io/v1beta1
                     kind: PodSecurityConfiguration
                     defaults:
                       enforce: "{{ .podSecurityStandard.enforce }}"