/cherry-pick release-1.9

@sbueringer: once the present PR merges, I will cherry-pick it on top of release-1.9 in a new PR and assign it to you.

/cherry-pick release-1.9

@sbueringer: once the present PR merges, I will cherry-pick it on top of release-1.9 in a new PR and assign it to you.

/test pull-cluster-api-e2e-main

lgtm pending linter fix.
Also, as a follow up, should we apply a similar fix to:

• cluster-api/controlplane/kubeadm/internal/controllers/controller.go

  Lines 786 to 806 in 1fc0d67

  	patchHelper, err := patch.NewHelper(m, r.Client)
  	if err != nil {
  	return err
  	}
  	// Set all other in-place mutable fields that impact the ability to tear down existing machines.
  	m.Spec.NodeDrainTimeout = controlPlane.KCP.Spec.MachineTemplate.NodeDrainTimeout
  	m.Spec.NodeDeletionTimeout = controlPlane.KCP.Spec.MachineTemplate.NodeDeletionTimeout
  	m.Spec.NodeVolumeDetachTimeout = controlPlane.KCP.Spec.MachineTemplate.NodeVolumeDetachTimeout
  	if err := patchHelper.Patch(ctx, m); err != nil {
  	return err
  	}
  	controlPlane.Machines[machineName] = m
  	patchHelper, err = patch.NewHelper(m, r.Client)
  	if err != nil {
  	return err
  	}
  	patchHelpers[machineName] = patchHelper
  	continue

• cluster-api/controlplane/kubeadm/internal/controllers/controller.go

  Lines 1289 to 1302 in 1fc0d67

  	patchHelper, err := patch.NewHelper(kubeadmConfig, r.Client)
  	if err != nil {
  	return errors.Wrapf(err, "failed to reconcile certificate expiry for Machine/%s", m.Name)
  	}
  	if annotations == nil {
  	annotations = map[string]string{}
  	}
  	annotations[clusterv1.MachineCertificatesExpiryDateAnnotation] = expiry
  	kubeadmConfig.SetAnnotations(annotations)
  	if err := patchHelper.Patch(ctx, kubeadmConfig); err != nil {
  	return errors.Wrapf(err, "failed to reconcile certificate expiry for Machine/%s", m.Name)
  	}

• cluster-api/controlplane/kubeadm/internal/controllers/controller.go

  Lines 1367 to 1380 in 1fc0d67

  	patchHelper, err := patch.NewHelper(m, r.Client)
  	if err != nil {
  	return err
  	}
  	if err := controllerutil.SetControllerReference(kcp, m, r.Client.Scheme()); err != nil {
  	return err
  	}
  	// Note that ValidateOwnerReferences() will reject this patch if another
  	// OwnerReference exists with controller=true.
  	if err := patchHelper.Patch(ctx, m); err != nil {
  	return err
  	}

• cluster-api/controlplane/kubeadm/internal/controllers/controller.go

  Lines 1427 to 1451 in 1fc0d67

  	patchHelper, err := patch.NewHelper(c.Secret, r.Client)
  	if err != nil {
  	return err
  	}
  	controller := metav1.GetControllerOf(c.Secret)
  	// If the current controller is KCP, ensure the owner reference is up to date.
  	// Note: This ensures secrets created prior to v1alpha4 are updated to have the correct owner reference apiVersion.
  	if controller != nil && controller.Kind == kubeadmControlPlaneKind {
  	c.Secret.SetOwnerReferences(util.EnsureOwnerRef(c.Secret.GetOwnerReferences(), owner))
  	}
  	// If the Type doesn't match the type used for secrets created by core components continue without altering the owner reference further.
  	// Note: This ensures that control plane related secrets created by KubeadmConfig are eventually owned by KCP.
  	// TODO: Remove this logic once standalone control plane machines are no longer allowed.
  	if c.Secret.Type == clusterv1.ClusterSecretType {
  	// Remove the current controller if one exists.
  	if controller != nil {
  	c.Secret.SetOwnerReferences(util.RemoveOwnerRef(c.Secret.GetOwnerReferences(), *controller))
  	}
  	c.Secret.SetOwnerReferences(util.EnsureOwnerRef(c.Secret.GetOwnerReferences(), owner))
  	}
  	if err := patchHelper.Patch(ctx, c.Secret); err != nil {
  	return errors.Wrapf(err, "failed to set ownerReference")
  	}

• cluster-api/exp/addons/internal/controllers/clusterresourceset_controller.go

  Lines 519 to 531 in 1fc0d67

  	obj := resource.DeepCopy()
  	patchHelper, err := patch.NewHelper(obj, r.Client)
  	if err != nil {
  	return err
  	}
  	newRef := metav1.OwnerReference{
  	APIVersion: addonsv1.GroupVersion.String(),
  	Kind: clusterResourceSet.GroupVersionKind().Kind,
  	Name: clusterResourceSet.GetName(),
  	UID: clusterResourceSet.GetUID(),
  	}
  	obj.SetOwnerReferences(util.EnsureOwnerRef(obj.GetOwnerReferences(), newRef))
  	return patchHelper.Patch(ctx, obj)

• cluster-api/internal/controllers/machineset/machineset_controller.go

  Lines 515 to 534 in 1fc0d67

  	patchHelper, err := patch.NewHelper(m, r.Client)
  	if err != nil {
  	return ctrl.Result{}, err
  	}
  	// Set all other in-place mutable fields that impact the ability to tear down existing machines.
  	m.Spec.ReadinessGates = machineSet.Spec.Template.Spec.ReadinessGates
  	m.Spec.NodeDrainTimeout = machineSet.Spec.Template.Spec.NodeDrainTimeout
  	m.Spec.NodeDeletionTimeout = machineSet.Spec.Template.Spec.NodeDeletionTimeout
  	m.Spec.NodeVolumeDetachTimeout = machineSet.Spec.Template.Spec.NodeVolumeDetachTimeout
  	// Set machine's up to date condition
  	if upToDateCondition != nil {
  	v1beta2conditions.Set(m, *upToDateCondition)
  	}
  	if err := patchHelper.Patch(ctx, m, patch.WithOwnedV1Beta2Conditions{Conditions: []string{clusterv1.MachineUpToDateV1Beta2Condition}}); err != nil {
  	return ctrl.Result{}, err
  	}
  	continue

• cluster-api/internal/controllers/machineset/machineset_controller.go

  Lines 541 to 548 in 1fc0d67

  	patchHelper, err := patch.NewHelper(m, r.Client)
  	if err != nil {
  	return ctrl.Result{}, err
  	}
  	v1beta2conditions.Set(m, *upToDateCondition)
  	if err := patchHelper.Patch(ctx, m, patch.WithOwnedV1Beta2Conditions{Conditions: []string{clusterv1.MachineUpToDateV1Beta2Condition}}); err != nil {
  	return ctrl.Result{}, err
  	}

@fabriziopandini I don't know if it's worth the additional complexity. I think these calls didn't show up in a relevant way in the memory profiles

/lgtm
/approve

LGTM label has been added.

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: fabriziopandini

The full list of commands accepted by this bot can be found here.

The pull request process is described here

@sbueringer: new pull request created: #11675