diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index a1ce6d2a8ff1..5fe944736cee 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -22,7 +22,7 @@ jobs:
           fetch-depth: 0
       - name: Get changed files
         id: changed-files
-        uses: tj-actions/changed-files@c65cd883420fd2eb864698a825fc4162dd94482c # tag=v44.5.7
+        uses: tj-actions/changed-files@40853de9f8ce2d6cfdc73c1b96f14e22ba44aec4 # tag=v45.0.0
       - name: Get release version
         id: release-version
         run: |
diff --git a/api/v1beta1/condition_types.go b/api/v1beta1/condition_types.go
index 7f0983e4beeb..a66cf9bc838c 100644
--- a/api/v1beta1/condition_types.go
+++ b/api/v1beta1/condition_types.go
@@ -74,7 +74,7 @@ type Condition struct {
 
 	// The reason for the condition's last transition in CamelCase.
 	// The specific API may choose whether or not this field is considered a guaranteed API.
-	// This field may not be empty.
+	// This field may be empty.
 	// +optional
 	Reason string `json:"reason,omitempty"`
 
diff --git a/api/v1beta1/zz_generated.openapi.go b/api/v1beta1/zz_generated.openapi.go
index 6e5427eef548..4e1017dec6d6 100644
--- a/api/v1beta1/zz_generated.openapi.go
+++ b/api/v1beta1/zz_generated.openapi.go
@@ -968,7 +968,7 @@ func schema_sigsk8sio_cluster_api_api_v1beta1_Condition(ref common.ReferenceCall
 					},
 					"reason": {
 						SchemaProps: spec.SchemaProps{
-							Description: "The reason for the condition's last transition in CamelCase. The specific API may choose whether or not this field is considered a guaranteed API. This field may not be empty.",
+							Description: "The reason for the condition's last transition in CamelCase. The specific API may choose whether or not this field is considered a guaranteed API. This field may be empty.",
 							Type:        []string{"string"},
 							Format:      "",
 						},
diff --git a/bootstrap/kubeadm/config/crd/bases/bootstrap.cluster.x-k8s.io_kubeadmconfigs.yaml b/bootstrap/kubeadm/config/crd/bases/bootstrap.cluster.x-k8s.io_kubeadmconfigs.yaml
index aded538ea067..07d4fbdee075 100644
--- a/bootstrap/kubeadm/config/crd/bases/bootstrap.cluster.x-k8s.io_kubeadmconfigs.yaml
+++ b/bootstrap/kubeadm/config/crd/bases/bootstrap.cluster.x-k8s.io_kubeadmconfigs.yaml
@@ -3723,7 +3723,7 @@ spec:
                       description: |-
                         The reason for the condition's last transition in CamelCase.
                         The specific API may choose whether or not this field is considered a guaranteed API.
-                        This field may not be empty.
+                        This field may be empty.
                       type: string
                     severity:
                       description: |-
diff --git a/bootstrap/kubeadm/internal/controllers/kubeadmconfig_controller.go b/bootstrap/kubeadm/internal/controllers/kubeadmconfig_controller.go
index af698cad812f..b67c3f020370 100644
--- a/bootstrap/kubeadm/internal/controllers/kubeadmconfig_controller.go
+++ b/bootstrap/kubeadm/internal/controllers/kubeadmconfig_controller.go
@@ -157,11 +157,11 @@ func (r *KubeadmConfigReconciler) Reconcile(ctx context.Context, req ctrl.Reques
 
 	// Look up the owner of this kubeadm config if there is one
 	configOwner, err := bsutil.GetTypedConfigOwner(ctx, r.Client, config)
-	if apierrors.IsNotFound(err) {
-		// Could not find the owner yet, this is not an error and will rereconcile when the owner gets set.
-		return ctrl.Result{}, nil
-	}
 	if err != nil {
+		if apierrors.IsNotFound(err) {
+			// Could not find the owner yet, this is not an error and will rereconcile when the owner gets set.
+			return ctrl.Result{}, nil
+		}
 		return ctrl.Result{}, errors.Wrapf(err, "failed to get owner")
 	}
 	if configOwner == nil {
diff --git a/cmd/clusterctl/client/config/cert_manager_client.go b/cmd/clusterctl/client/config/cert_manager_client.go
index c80f85b669ed..66785599e987 100644
--- a/cmd/clusterctl/client/config/cert_manager_client.go
+++ b/cmd/clusterctl/client/config/cert_manager_client.go
@@ -29,7 +29,7 @@ const (
 	CertManagerConfigKey = "cert-manager"
 
 	// CertManagerDefaultVersion defines the default cert-manager version to be used by clusterctl.
-	CertManagerDefaultVersion = "v1.15.2"
+	CertManagerDefaultVersion = "v1.15.3"
 
 	// CertManagerDefaultURL defines the default cert-manager repository url to be used by clusterctl.
 	// NOTE: At runtime CertManagerDefaultVersion may be replaced with the
diff --git a/config/crd/bases/addons.cluster.x-k8s.io_clusterresourcesets.yaml b/config/crd/bases/addons.cluster.x-k8s.io_clusterresourcesets.yaml
index b16b67e35013..889a31ed0739 100644
--- a/config/crd/bases/addons.cluster.x-k8s.io_clusterresourcesets.yaml
+++ b/config/crd/bases/addons.cluster.x-k8s.io_clusterresourcesets.yaml
@@ -497,7 +497,7 @@ spec:
                       description: |-
                         The reason for the condition's last transition in CamelCase.
                         The specific API may choose whether or not this field is considered a guaranteed API.
-                        This field may not be empty.
+                        This field may be empty.
                       type: string
                     severity:
                       description: |-
diff --git a/config/crd/bases/cluster.x-k8s.io_clusterclasses.yaml b/config/crd/bases/cluster.x-k8s.io_clusterclasses.yaml
index 7af8daf7b424..80cd56ba7d17 100644
--- a/config/crd/bases/cluster.x-k8s.io_clusterclasses.yaml
+++ b/config/crd/bases/cluster.x-k8s.io_clusterclasses.yaml
@@ -1974,7 +1974,7 @@ spec:
                       description: |-
                         The reason for the condition's last transition in CamelCase.
                         The specific API may choose whether or not this field is considered a guaranteed API.
-                        This field may not be empty.
+                        This field may be empty.
                       type: string
                     severity:
                       description: |-
diff --git a/config/crd/bases/cluster.x-k8s.io_clusters.yaml b/config/crd/bases/cluster.x-k8s.io_clusters.yaml
index c265e4b5bedd..cc62b73a7dd9 100644
--- a/config/crd/bases/cluster.x-k8s.io_clusters.yaml
+++ b/config/crd/bases/cluster.x-k8s.io_clusters.yaml
@@ -1686,7 +1686,7 @@ spec:
                       description: |-
                         The reason for the condition's last transition in CamelCase.
                         The specific API may choose whether or not this field is considered a guaranteed API.
-                        This field may not be empty.
+                        This field may be empty.
                       type: string
                     severity:
                       description: |-
diff --git a/config/crd/bases/cluster.x-k8s.io_machinedeployments.yaml b/config/crd/bases/cluster.x-k8s.io_machinedeployments.yaml
index 55a0dfd736f4..96b88497ba05 100644
--- a/config/crd/bases/cluster.x-k8s.io_machinedeployments.yaml
+++ b/config/crd/bases/cluster.x-k8s.io_machinedeployments.yaml
@@ -1542,7 +1542,7 @@ spec:
                       description: |-
                         The reason for the condition's last transition in CamelCase.
                         The specific API may choose whether or not this field is considered a guaranteed API.
-                        This field may not be empty.
+                        This field may be empty.
                       type: string
                     severity:
                       description: |-
diff --git a/config/crd/bases/cluster.x-k8s.io_machinehealthchecks.yaml b/config/crd/bases/cluster.x-k8s.io_machinehealthchecks.yaml
index 014c74c17737..e8deecb8ed2c 100644
--- a/config/crd/bases/cluster.x-k8s.io_machinehealthchecks.yaml
+++ b/config/crd/bases/cluster.x-k8s.io_machinehealthchecks.yaml
@@ -816,7 +816,7 @@ spec:
                       description: |-
                         The reason for the condition's last transition in CamelCase.
                         The specific API may choose whether or not this field is considered a guaranteed API.
-                        This field may not be empty.
+                        This field may be empty.
                       type: string
                     severity:
                       description: |-
diff --git a/config/crd/bases/cluster.x-k8s.io_machinepools.yaml b/config/crd/bases/cluster.x-k8s.io_machinepools.yaml
index 941e3bbdce10..801658b64dda 100644
--- a/config/crd/bases/cluster.x-k8s.io_machinepools.yaml
+++ b/config/crd/bases/cluster.x-k8s.io_machinepools.yaml
@@ -1308,7 +1308,7 @@ spec:
                       description: |-
                         The reason for the condition's last transition in CamelCase.
                         The specific API may choose whether or not this field is considered a guaranteed API.
-                        This field may not be empty.
+                        This field may be empty.
                       type: string
                     severity:
                       description: |-
diff --git a/config/crd/bases/cluster.x-k8s.io_machines.yaml b/config/crd/bases/cluster.x-k8s.io_machines.yaml
index f4ab78688104..493d6aca6646 100644
--- a/config/crd/bases/cluster.x-k8s.io_machines.yaml
+++ b/config/crd/bases/cluster.x-k8s.io_machines.yaml
@@ -1090,7 +1090,7 @@ spec:
                       description: |-
                         The reason for the condition's last transition in CamelCase.
                         The specific API may choose whether or not this field is considered a guaranteed API.
-                        This field may not be empty.
+                        This field may be empty.
                       type: string
                     severity:
                       description: |-
diff --git a/config/crd/bases/cluster.x-k8s.io_machinesets.yaml b/config/crd/bases/cluster.x-k8s.io_machinesets.yaml
index 4922987566d6..a1ddfd4ebe8e 100644
--- a/config/crd/bases/cluster.x-k8s.io_machinesets.yaml
+++ b/config/crd/bases/cluster.x-k8s.io_machinesets.yaml
@@ -1280,7 +1280,7 @@ spec:
                       description: |-
                         The reason for the condition's last transition in CamelCase.
                         The specific API may choose whether or not this field is considered a guaranteed API.
-                        This field may not be empty.
+                        This field may be empty.
                       type: string
                     severity:
                       description: |-
diff --git a/config/crd/bases/ipam.cluster.x-k8s.io_ipaddressclaims.yaml b/config/crd/bases/ipam.cluster.x-k8s.io_ipaddressclaims.yaml
index a320e57ce58a..f05f04474d99 100644
--- a/config/crd/bases/ipam.cluster.x-k8s.io_ipaddressclaims.yaml
+++ b/config/crd/bases/ipam.cluster.x-k8s.io_ipaddressclaims.yaml
@@ -118,7 +118,7 @@ spec:
                       description: |-
                         The reason for the condition's last transition in CamelCase.
                         The specific API may choose whether or not this field is considered a guaranteed API.
-                        This field may not be empty.
+                        This field may be empty.
                       type: string
                     severity:
                       description: |-
@@ -253,7 +253,7 @@ spec:
                       description: |-
                         The reason for the condition's last transition in CamelCase.
                         The specific API may choose whether or not this field is considered a guaranteed API.
-                        This field may not be empty.
+                        This field may be empty.
                       type: string
                     severity:
                       description: |-
diff --git a/config/crd/bases/runtime.cluster.x-k8s.io_extensionconfigs.yaml b/config/crd/bases/runtime.cluster.x-k8s.io_extensionconfigs.yaml
index 5b0f2a4f2dc9..b66fbce4ac04 100644
--- a/config/crd/bases/runtime.cluster.x-k8s.io_extensionconfigs.yaml
+++ b/config/crd/bases/runtime.cluster.x-k8s.io_extensionconfigs.yaml
@@ -190,7 +190,7 @@ spec:
                       description: |-
                         The reason for the condition's last transition in CamelCase.
                         The specific API may choose whether or not this field is considered a guaranteed API.
-                        This field may not be empty.
+                        This field may be empty.
                       type: string
                     severity:
                       description: |-
diff --git a/config/metrics/crd-metrics-config.yaml b/config/metrics/crd-metrics-config.yaml
index 718af5a9bd9f..907df17aa0d2 100644
--- a/config/metrics/crd-metrics-config.yaml
+++ b/config/metrics/crd-metrics-config.yaml
@@ -64,6 +64,7 @@ spec:
           - conditions
           valueFrom:
           - status
+          nilIsZero: true
         type: StateSet
     - name: status_condition_last_transition_time
       help: The condition last transition time of a clusterclass.
@@ -79,6 +80,7 @@ spec:
           - conditions
           valueFrom:
           - lastTransitionTime
+          nilIsZero: true
         type: Gauge
     - name: owner
       help: Owner references.
@@ -175,6 +177,7 @@ spec:
           path:
           - status
           - phase
+          nilIsZero: true
         type: StateSet
     - name: created
       help: Unix creation timestamp.
@@ -212,6 +215,7 @@ spec:
           - conditions
           valueFrom:
           - status
+          nilIsZero: true
         type: StateSet
     - name: status_condition_last_transition_time
       help: The condition last transition time of a cluster.
@@ -227,6 +231,7 @@ spec:
           - conditions
           valueFrom:
           - lastTransitionTime
+          nilIsZero: true
         type: Gauge
   - groupVersionKind:
       group: controlplane.cluster.x-k8s.io
@@ -348,6 +353,7 @@ spec:
           - conditions
           valueFrom:
           - status
+          nilIsZero: true
         type: StateSet
     - name: status_condition_last_transition_time
       help: The condition last transition time of a kubeadmcontrolplane.
@@ -363,6 +369,7 @@ spec:
           - conditions
           valueFrom:
           - lastTransitionTime
+          nilIsZero: true
         type: Gauge
     - name: owner
       help: Owner references.
@@ -447,6 +454,7 @@ spec:
           - conditions
           valueFrom:
           - status
+          nilIsZero: true
         type: StateSet
     - name: status_condition_last_transition_time
       help: The condition last transition time of a kubeadmconfig.
@@ -462,6 +470,7 @@ spec:
           - conditions
           valueFrom:
           - lastTransitionTime
+          nilIsZero: true
         type: Gauge
     - name: owner
       help: Owner references.
@@ -609,6 +618,7 @@ spec:
           path:
           - status
           - phase
+          nilIsZero: true
         type: StateSet
     - name: created
       help: Unix creation timestamp.
@@ -646,6 +656,7 @@ spec:
           - conditions
           valueFrom:
           - status
+          nilIsZero: true
         type: StateSet
     - name: status_condition_last_transition_time
       help: The condition last transition time of a machine.
@@ -661,6 +672,7 @@ spec:
           - conditions
           valueFrom:
           - lastTransitionTime
+          nilIsZero: true
         type: Gauge
     - name: owner
       help: Owner references.
@@ -868,6 +880,7 @@ spec:
           - conditions
           valueFrom:
           - status
+          nilIsZero: true
         type: StateSet
     - name: status_condition_last_transition_time
       help: The condition last transition time of a machinedeployment.
@@ -883,6 +896,7 @@ spec:
           - conditions
           valueFrom:
           - lastTransitionTime
+          nilIsZero: true
         type: Gauge
     - name: owner
       help: Owner references.
@@ -937,6 +951,7 @@ spec:
           path:
           - status
           - currentHealthy
+          nilIsZero: true
         type: Gauge
     - name: status_expected_machines
       help: Total number of pods counted by this machinehealthcheck.
@@ -945,6 +960,7 @@ spec:
           path:
           - status
           - expectedMachines
+          nilIsZero: true
         type: Gauge
     - name: status_remediations_allowed
       help: Number of machine remediations that are currently allowed.
@@ -953,6 +969,7 @@ spec:
           path:
           - status
           - remediationsAllowed
+          nilIsZero: true
         type: Gauge
     - name: created
       help: Unix creation timestamp.
@@ -990,6 +1007,7 @@ spec:
           - conditions
           valueFrom:
           - status
+          nilIsZero: true
         type: StateSet
     - name: status_condition_last_transition_time
       help: The condition last transition time of a machinehealthcheck.
@@ -1005,6 +1023,7 @@ spec:
           - conditions
           valueFrom:
           - lastTransitionTime
+          nilIsZero: true
         type: Gauge
     - name: owner
       help: Owner references.
@@ -1104,6 +1123,7 @@ spec:
           path:
           - status
           - fullyLabeledReplicas
+          nilIsZero: true
         type: Gauge
     - name: status_replicas_ready
       help: The number of ready replicas per machineset.
@@ -1159,6 +1179,7 @@ spec:
           - conditions
           valueFrom:
           - status
+          nilIsZero: true
         type: StateSet
     - name: status_condition_last_transition_time
       help: The condition last transition time of a machineset.
@@ -1174,6 +1195,7 @@ spec:
           - conditions
           valueFrom:
           - lastTransitionTime
+          nilIsZero: true
         type: Gauge
     - name: owner
       help: Owner references.
@@ -1310,6 +1332,7 @@ spec:
           path:
           - status
           - phase
+          nilIsZero: true
         type: StateSet
     - name: created
       help: Unix creation timestamp.
@@ -1347,6 +1370,7 @@ spec:
           - conditions
           valueFrom:
           - status
+          nilIsZero: true
         type: StateSet
     - name: status_condition_last_transition_time
       help: The condition last transition time of a machinepool.
@@ -1362,6 +1386,7 @@ spec:
           - conditions
           valueFrom:
           - lastTransitionTime
+          nilIsZero: true
         type: Gauge
     - name: owner
       help: Owner references.
diff --git a/config/metrics/templates/cluster.yaml b/config/metrics/templates/cluster.yaml
index f1e91daa6b57..137ac88178ef 100644
--- a/config/metrics/templates/cluster.yaml
+++ b/config/metrics/templates/cluster.yaml
@@ -76,4 +76,5 @@
           path:
           - status
           - phase
+          nilIsZero: true
         type: StateSet
diff --git a/config/metrics/templates/common_metrics.yaml b/config/metrics/templates/common_metrics.yaml
index 073631b9c88b..feb17f969d09 100644
--- a/config/metrics/templates/common_metrics.yaml
+++ b/config/metrics/templates/common_metrics.yaml
@@ -34,6 +34,7 @@
           - conditions
           valueFrom:
           - status
+          nilIsZero: true
         type: StateSet
     - name: status_condition_last_transition_time
       help: The condition last transition time of a ${RESOURCE}.
@@ -49,4 +50,5 @@
           - conditions
           valueFrom:
           - lastTransitionTime
+          nilIsZero: true
         type: Gauge
diff --git a/config/metrics/templates/machine.yaml b/config/metrics/templates/machine.yaml
index b49b1d3b7c7e..fe8d012d4880 100644
--- a/config/metrics/templates/machine.yaml
+++ b/config/metrics/templates/machine.yaml
@@ -127,4 +127,5 @@
           path:
           - status
           - phase
+          nilIsZero: true
         type: StateSet
diff --git a/config/metrics/templates/machinehealthcheck.yaml b/config/metrics/templates/machinehealthcheck.yaml
index a14a164be72b..22c7d4e49a98 100644
--- a/config/metrics/templates/machinehealthcheck.yaml
+++ b/config/metrics/templates/machinehealthcheck.yaml
@@ -34,6 +34,7 @@
           path:
           - status
           - currentHealthy
+          nilIsZero: true
         type: Gauge
     - name: status_expected_machines
       help: Total number of pods counted by this machinehealthcheck.
@@ -42,6 +43,7 @@
           path:
           - status
           - expectedMachines
+          nilIsZero: true
         type: Gauge
     - name: status_remediations_allowed
       help: Number of machine remediations that are currently allowed.
@@ -50,4 +52,5 @@
           path:
           - status
           - remediationsAllowed
+          nilIsZero: true
         type: Gauge
diff --git a/config/metrics/templates/machinepool.yaml b/config/metrics/templates/machinepool.yaml
index a4dbb4aa7254..83c56fe6a8d5 100644
--- a/config/metrics/templates/machinepool.yaml
+++ b/config/metrics/templates/machinepool.yaml
@@ -116,4 +116,5 @@
           path:
           - status
           - phase
+          nilIsZero: true
         type: StateSet
diff --git a/config/metrics/templates/machineset.yaml b/config/metrics/templates/machineset.yaml
index e2bde1ecde6e..fc3b19b5b421 100644
--- a/config/metrics/templates/machineset.yaml
+++ b/config/metrics/templates/machineset.yaml
@@ -79,6 +79,7 @@
           path:
           - status
           - fullyLabeledReplicas
+          nilIsZero: true
         type: Gauge
     - name: status_replicas_ready
       help: The number of ready replicas per machineset.
diff --git a/controlplane/kubeadm/config/crd/bases/controlplane.cluster.x-k8s.io_kubeadmcontrolplanes.yaml b/controlplane/kubeadm/config/crd/bases/controlplane.cluster.x-k8s.io_kubeadmcontrolplanes.yaml
index dae1ca24836a..cb4668d56d03 100644
--- a/controlplane/kubeadm/config/crd/bases/controlplane.cluster.x-k8s.io_kubeadmcontrolplanes.yaml
+++ b/controlplane/kubeadm/config/crd/bases/controlplane.cluster.x-k8s.io_kubeadmcontrolplanes.yaml
@@ -4429,7 +4429,7 @@ spec:
                       description: |-
                         The reason for the condition's last transition in CamelCase.
                         The specific API may choose whether or not this field is considered a guaranteed API.
-                        This field may not be empty.
+                        This field may be empty.
                       type: string
                     severity:
                       description: |-
diff --git a/controlplane/kubeadm/internal/controllers/controller.go b/controlplane/kubeadm/internal/controllers/controller.go
index a77071841c34..39e5a7bb908d 100644
--- a/controlplane/kubeadm/internal/controllers/controller.go
+++ b/controlplane/kubeadm/internal/controllers/controller.go
@@ -145,19 +145,21 @@ func (r *KubeadmControlPlaneReconciler) Reconcile(ctx context.Context, req ctrl.
 		if apierrors.IsNotFound(err) {
 			return ctrl.Result{}, nil
 		}
-		return ctrl.Result{Requeue: true}, nil
+		return ctrl.Result{}, err
 	}
 
 	// Fetch the Cluster.
 	cluster, err := util.GetOwnerCluster(ctx, r.Client, kcp.ObjectMeta)
 	if err != nil {
-		log.Error(err, "Failed to retrieve owner Cluster from the API Server")
-		return ctrl.Result{}, err
+		// It should be an issue to be investigated if the controller get the NotFound status.
+		// So, it should return the error.
+		return ctrl.Result{}, errors.Wrapf(err, "failed to retrieve owner Cluster")
 	}
 	if cluster == nil {
 		log.Info("Cluster Controller has not yet set OwnerRef")
 		return ctrl.Result{}, nil
 	}
+
 	log = log.WithValues("Cluster", klog.KObj(cluster))
 	ctx = ctrl.LoggerInto(ctx, log)
 
diff --git a/docs/book/src/clusterctl/commands/init.md b/docs/book/src/clusterctl/commands/init.md
index 1bccbbaa9814..b2973898f930 100644
--- a/docs/book/src/clusterctl/commands/init.md
+++ b/docs/book/src/clusterctl/commands/init.md
@@ -194,7 +194,7 @@ If this happens, there are no guarantees about the proper functioning of `cluste
 Cluster API providers require a cert-manager version supporting the `cert-manager.io/v1` API to be installed in the cluster.
 
 While doing init, clusterctl checks if there is a version of cert-manager already installed. If not, clusterctl will
-install a default version (currently cert-manager v1.15.2). See [clusterctl configuration](../configuration.md) for
+install a default version (currently cert-manager v1.15.3). See [clusterctl configuration](../configuration.md) for
 available options to customize this operation.
 
 <aside class="note warning">
diff --git a/docs/book/src/developer/guide.md b/docs/book/src/developer/guide.md
index 0418f29c05b0..da8d6145acda 100644
--- a/docs/book/src/developer/guide.md
+++ b/docs/book/src/developer/guide.md
@@ -81,7 +81,7 @@ The generated binary can be found at ./hack/tools/bin/envsubst
 You'll need to deploy [cert-manager] components on your [management cluster][mcluster], using `kubectl`
 
 ```bash
-kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.15.2/cert-manager.yaml
+kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.15.3/cert-manager.yaml
 ```
 
 Ensure the cert-manager webhook service is ready before creating the Cluster API components.
diff --git a/docs/book/src/reference/labels_and_annotations.md b/docs/book/src/reference/labels_and_annotations.md
index 9d268fb29b72..cd8810902d31 100644
--- a/docs/book/src/reference/labels_and_annotations.md
+++ b/docs/book/src/reference/labels_and_annotations.md
@@ -1,62 +1,62 @@
 **Supported Labels:**
 
 
-| Label                                     | Note                                                                                                                                                                                                                        |
-|:------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| cluster.x-k8s.io/cluster-name             | It is set on machines linked to a cluster and external objects(bootstrap and infrastructure providers).                                                                                                                     |
-| topology.cluster.x-k8s.io/owned           | It is set on all the object which are managed as part of a ClusterTopology.                                                                                                                                                 |
-| topology.cluster.x-k8s.io/deployment-name | It is set on the generated MachineDeployment objects to track the name of the MachineDeployment topology it represents.                                                                                                     |
-| cluster.x-k8s.io/provider                 | It is set on components in the provider manifest. The label allows one to easily identify all the components belonging to a provider. The clusterctl tool uses this label for implementing provider's lifecycle operations. |
-| cluster.x-k8s.io/watch-filter             | It can be applied to any Cluster API object. Controllers which allow for selective reconciliation may check this label and proceed with reconciliation of the object only if this label and a configured value is present.  |
-| cluster.x-k8s.io/interruptible            | It is used to mark the nodes that run on interruptible instances.                                                                                                                                                           |
-| cluster.x-k8s.io/control-plane            | It is set on machines or related objects that are part of a control plane.                                                                                                                                                  |
-| cluster.x-k8s.io/set-name                 | It is set on machines if they're controlled by MachineSet. The value of this label may be a hash if the MachineSet name is longer than 63 characters.                                                                       |
-| cluster.x-k8s.io/control-plane-name       | It is set on machines if they're controlled by a control plane. The value of this label may be a hash if the control plane name is longer than 63 characters.                                                               |
-| cluster.x-k8s.io/deployment-name          | It is set on machines if they're controlled by a MachineDeployment.                                                                                                                                                         |
-| cluster.x-k8s.io/pool-name                | It is set on machines if they're controlled by a MachinePool.                                                                                                                                                               |
-| machine-template-hash                     | It is applied to Machines in a MachineDeployment containing the hash of the template.                                                                                                                                       |
+| Label                                     | Note           | Managed by | Applies to |
+|:------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------------------------|:--------------------------------------------|
+| cluster.x-k8s.io/cluster-name             | It is set on machines linked to a cluster and external objects(bootstrap and infrastructure providers).     |    User |   Machines  |
+| cluster.x-k8s.io/control-plane            | It is set on machines or related objects that are part of a control plane.   |  Cluster API   | Machines |
+| cluster.x-k8s.io/control-plane-name       | It is set on machines if they're controlled by a control plane. The value of this label may be a hash if the control plane name is longer than 63 characters. | Cluster API  | Machines  | 
+| cluster.x-k8s.io/deployment-name          | It is set on machines if they're controlled by a MachineDeployment.  | Cluster API    |  Machines   |
+| cluster.x-k8s.io/interruptible            | It is used to mark the nodes that run on interruptible instances.    | User  |  Nodes   |
+| cluster.x-k8s.io/pool-name                | It is set on machines if they're controlled by a MachinePool.     |   Cluster API |  Machines  |
+| cluster.x-k8s.io/provider                 | It is set on components in the provider manifest. The label allows one to easily identify all the components belonging to a provider. The clusterctl tool uses this label for implementing provider's lifecycle operations. | User   |  Provider Components   |
+| cluster.x-k8s.io/set-name                 | It is set on machines if they're controlled by MachineSet. The value of this label may be a hash if the MachineSet name is longer than 63 characters.    | Cluster API  |  Machines   |
+| cluster.x-k8s.io/watch-filter             | It can be applied to any Cluster API object. Controllers which allow for selective reconciliation may check this label and proceed with reconciliation of the object only if this label and a configured value is present.  |  Cluster API     |  All Cluster API objects     |
+| machine-template-hash   | It is applied to Machines in a MachineDeployment containing the hash of the template.    |  Cluster API  |  Machine    |
+| topology.cluster.x-k8s.io/deployment-name | It is set on the generated MachineDeployment objects to track the name of the MachineDeployment topology it represents.        | Cluster API  | MachineDeployment objects |
+| topology.cluster.x-k8s.io/owned           | It is set on all the object which are managed as part of a ClusterTopology.       | Cluster API |  ClusterTopology objects  |
 <br>
 
 
 **Supported Annotations:**
 
-| Annotation                                                       | Note                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-|:-----------------------------------------------------------------|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| clusterctl.cluster.x-k8s.io/skip-crd-name-preflight-check        | Can be placed on provider CRDs, so that clusterctl doesn't emit an error if the CRD doesn't comply with Cluster APIs naming scheme. Only CRDs that are referenced by core Cluster API CRDs have to comply with the naming scheme.                                                                                                                                                                                                                                                                                                                           |
-| clusterctl.cluster.x-k8s.io/delete-for-move                      | DeleteForMoveAnnotation will be set to objects that are going to be deleted from the source cluster after being moved to the target cluster during the clusterctl move operation. It will help any validation webhook to take decision based on it.                                                                                                                                                                                                                                                                                                         |
-| clusterctl.cluster.x-k8s.io/block-move                           | BlockMoveAnnotation prevents the cluster move operation from starting if it is defined on at least one of the objects in scope. Provider controllers are expected to set the annotation on resources that cannot be instantaneously paused and remove the annotation when the resource has been actually paused.                                                                                                                                                                                                                                            |
-| unsafe.topology.cluster.x-k8s.io/disable-update-class-name-check | It can be used to disable the webhook check on update that disallows a pre-existing Cluster to be populated with Topology information and Class.                                                                                                                                                                                                                                                                                                                                                                                                            |
-| unsafe.topology.cluster.x-k8s.io/disable-update-version-check    | It can be used to disable the webhook checks on update that disallows updating the `.topology.spec.version` on certain conditions.                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| cluster.x-k8s.io/cluster-name                                    | It is set on nodes identifying the name of the cluster the node belongs to.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| cluster.x-k8s.io/cluster-namespace                               | It is set on nodes identifying the namespace of the cluster the node belongs to.                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| cluster.x-k8s.io/machine                                         | It is set on nodes identifying the machine the node belongs to.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| cluster.x-k8s.io/owner-kind                                      | It is set on nodes identifying the owner kind.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| cluster.x-k8s.io/owner-name                                      | It is set on nodes identifying the owner name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| cluster.x-k8s.io/paused                                          | It can be applied to any Cluster API object to prevent a controller from processing a resource. Controllers working with Cluster API objects must check the existence of this annotation on the reconciled object.                                                                                                                                                                                                                                                                                                                                          |
-| cluster.x-k8s.io/disable-machine-create                          | It can be used to signal a MachineSet to stop creating new machines. It is utilized in the OnDelete MachineDeploymentStrategy to allow the MachineDeployment controller to scale down older MachineSets when Machines are deleted and add the new replicas to the latest MachineSet.                                                                                                                                                                                                                                                                        |
-| cluster.x-k8s.io/delete-machine                                  | It marks control plane and worker nodes that will be given priority for deletion when KCP or a MachineSet scales down. It is given top priority on all delete policies.                                                                                                                                                                                                                                                                                                                                                                                     |
-| cluster.x-k8s.io/cloned-from-name                                | It is the infrastructure machine annotation that stores the name of the infrastructure template resource that was cloned for the machine. This annotation is set only during cloning a template. Older/adopted machines will not have this annotation.                                                                                                                                                                                                                                                                                                      |
-| cluster.x-k8s.io/cloned-from-groupkind                           | It is the infrastructure machine annotation that stores the group-kind of the infrastructure template resource that was cloned for the machine. This annotation is set only during cloning a template. Older/adopted machines will not have this annotation.                                                                                                                                                                                                                                                                                                |
-| cluster.x-k8s.io/skip-remediation                                | It is used to mark the machines that should not be considered for remediation by MachineHealthCheck reconciler.                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| cluster.x-k8s.io/remediate-machine                               | It can be applied to a machine to manually mark it for remediation by MachineHealthCheck reconciler.                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| cluster.x-k8s.io/managed-by                                      | It can be applied to InfraCluster resources to signify that some external system is managing the cluster infrastructure. Provider InfraCluster controllers will ignore resources with this annotation. An external controller must fulfill the contract of the InfraCluster resource. External infrastructure providers should ensure that the annotation, once set, cannot be removed.                                                                                                                                                                     |
-| cluster.x-k8s.io/replicas-managed-by                             | It can be applied to MachinePool resources to signify that some external system is managing infrastructure scaling for that pool. See [the MachinePool documentation](../developer/architecture/controllers/machine-pool.md#externally-managed-autoscaler) for more details.                                                                                                                                                                                                                                                                                |
-| cluster.x-k8s.io/skip-machineset-preflight-checks                | It can be applied on MachineDeployment and MachineSet resources to specify a comma-separated list of preflight checks that should be skipped during MachineSet reconciliation. Supported preflight checks are: All, KubeadmVersionSkew, KubernetesVersionSkew, ControlPlaneIsStable.                                                                                                                                                                                                                                                                        |
-| topology.cluster.x-k8s.io/defer-upgrade                          | It can be used to defer the Kubernetes upgrade of a single MachineDeployment topology. If the annotation is set on a MachineDeployment topology in Cluster.spec.topology.workers, the Kubernetes upgrade for this MachineDeployment topology is deferred. It doesn't affect other MachineDeployment topologies.                                                                                                                                                                                                                                             |
-| topology.cluster.x-k8s.io/dry-run                                | It is an annotation that gets set on objects by the topology controller only during a server side dry run apply operation. It is used for validating update webhooks for objects which get updated by template rotation (e.g. InfrastructureMachineTemplate). When the annotation is set and the admission request is a dry run, the webhook should skip validation due to immutability. By that the request will succeed (without any changes to the actual object because it is a dry run) and the topology controller will receive the resulting object. |
-| topology.cluster.x-k8s.io/hold-upgrade-sequence                  | It can be used to hold the entire MachineDeployment upgrade sequence. If the annotation is set on a MachineDeployment topology in Cluster.spec.topology.workers, the Kubernetes upgrade for this MachineDeployment topology and all subsequent ones is deferred.                                                                                                                                                                                                                                                                                            |
-| topology.cluster.x-k8s.io/upgrade-concurrency                    | It can be used to configure the maximum concurrency while upgrading MachineDeployments of a classy Cluster. It is set as a top level annotation on the Cluster object. The value should be >= 1. If unspecified the upgrade concurrency will default to 1.                                                                                                                                                                                                                                                                                                  |
-| machine.cluster.x-k8s.io/certificates-expiry                     | It captures the expiry date of the machine certificates in RFC3339 format. It is used to trigger rollout of control plane machines before certificates expire. It can be set on BootstrapConfig and Machine objects. The value set on Machine object takes precedence. The annotation is only used by control plane machines.                                                                                                                                                                                                                               |
-| machine.cluster.x-k8s.io/exclude-node-draining                   | It explicitly skips node draining if set.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| machine.cluster.x-k8s.io/exclude-wait-for-node-volume-detach     | It explicitly skips the waiting for node volume detaching if set.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| pre-drain.delete.hook.machine.cluster.x-k8s.io                   | It specifies the prefix we search each annotation for during the pre-drain.delete lifecycle hook to pause reconciliation of deletion. These hooks will prevent removal of draining the associated node until all are removed.                                                                                                                                                                                                                                                                                                                               |
-| pre-terminate.delete.hook.machine.cluster.x-k8s.io               | It specifies the prefix we search each annotation for during the pre-terminate.delete lifecycle hook to pause reconciliation of deletion. These hooks will prevent removal of an instance from an infrastructure provider until all are removed.                                                                                                                                                                                                                                                                                                            |
-| machinedeployment.clusters.x-k8s.io/revision                     | It is the revision annotation of a machine deployment's machine sets which records its rollout sequence.                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| machinedeployment.clusters.x-k8s.io/revision-history             | It maintains the history of all old revisions that a machine set has served for a machine deployment.                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| machinedeployment.clusters.x-k8s.io/desired-replicas             | It is the desired replicas for a machine deployment recorded as an annotation in its machine sets. Helps in separating scaling events from the rollout process and for determining if the new machine set for a deployment is really saturated.                                                                                                                                                                                                                                                                                                             |
-| machinedeployment.clusters.x-k8s.io/max-replicas                 | It is the maximum replicas a deployment can have at a given point, which is machinedeployment.spec.replicas + maxSurge. Used by the underlying machine sets to estimate their proportions in case the deployment has surge replicas.                                                                                                                                                                                                                                                                                                                        |
-| controlplane.cluster.x-k8s.io/skip-coredns                       | It explicitly skips reconciling CoreDNS if set.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| controlplane.cluster.x-k8s.io/skip-kube-proxy                    | It explicitly skips reconciling kube-proxy if set.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| controlplane.cluster.x-k8s.io/kubeadm-cluster-configuration      | It is a machine annotation that stores the json-marshalled string of KCP ClusterConfiguration. This annotation is used to detect any changes in ClusterConfiguration and trigger machine rollout in KCP.                                                                                                                                                                                                                                                                                                                                                    |
-| controlplane.cluster.x-k8s.io/remediation-in-progress            | It is a KCP annotation that tracks that the system is in between having deleted an unhealthy machine and recreating its replacement.                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| controlplane.cluster.x-k8s.io/remediation-for                    | It is a machine annotation that links a new machine to the unhealthy machine it is replacing.                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| Annotation                                                       | Note  | Managed By |  Applies to |
+|:------------------------------------------------------------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------------|:-------------------------------------------|
+| cluster.x-k8s.io/cloned-from-groupkind |	It is the annotation that stores the group-kind of the template from which the current resource has been cloned from. | Cluster API  | Any Cluster API resource cloned from a template |
+| cluster.x-k8s.io/cloned-from-name	 | It is the annotation that stores the name of the template from which the current resource has been cloned from. | Cluster API  | Any Cluster API resource cloned from a template |
+| cluster.x-k8s.io/cluster-name                                    | It is set on nodes identifying the name of the cluster the node belongs to.  | Cluster API | Nodes |
+| cluster.x-k8s.io/cluster-namespace                               | It is set on nodes identifying the namespace of the cluster the node belongs to.       | Cluster API | Nodes |
+| cluster.x-k8s.io/delete-machine                                  | It marks control plane and worker nodes that will be given priority for deletion when KCP or a MachineSet scales down. It is given top priority on all delete policies.   | User | Machines |
+| cluster.x-k8s.io/disable-machine-create                          | It can be used to signal a MachineSet to stop creating new machines. It is utilized in the OnDelete MachineDeploymentStrategy to allow the MachineDeployment controller to scale down older MachineSets when Machines are deleted and add the new replicas to the latest MachineSet.   |  Cluster API | Machineset |
+| cluster.x-k8s.io/managed-by                                      | It can be applied to InfraCluster resources to signify that some external system is managing the cluster infrastructure. Provider InfraCluster controllers will ignore resources with this annotation. An external controller must fulfill the contract of the InfraCluster resource. External infrastructure providers should ensure that the annotation, once set, cannot be removed.     | User | InfraCluster resources |
+| cluster.x-k8s.io/machine                                         | It is set on nodes identifying the machine the node belongs to. | Cluster API | Nodes |
+| cluster.x-k8s.io/owner-kind                                      | It is set on nodes identifying the machine's owner kind the node belongs to.     | Cluster API | Nodes |
+| cluster.x-k8s.io/owner-name                                      | It is set on nodes identifying the machine's owner name the node belongs to.    | Cluster API | Nodes |
+| cluster.x-k8s.io/paused                                          | It can be applied to any Cluster API object to prevent a controller from processing a resource. Controllers working with Cluster API objects must check the existence of this annotation on the reconciled object.  | User | Any Cluster API resource |
+| cluster.x-k8s.io/remediate-machine                               | It can be applied to a machine to manually mark it for remediation by MachineHealthCheck reconciler.   |    User          |    Machine         |
+| cluster.x-k8s.io/replicas-managed-by                             | It can be applied to MachinePool resources to signify that some external system is managing infrastructure scaling for that pool. See [the MachinePool documentation](../developer/architecture/controllers/machine-pool.md#externally-managed-autoscaler) for more details.  | Infrastructure Providers | MachinePool resources |
+| cluster.x-k8s.io/skip-remediation                                | It is used to mark the machines that should not be considered for remediation by MachineHealthCheck reconciler.  | User | Machines |
+| clusterctl.cluster.x-k8s.io/block-move                           | BlockMoveAnnotation prevents the cluster move operation from starting if it is defined on at least one of the objects in scope. Provider controllers are expected to set the annotation on resources that cannot be instantaneously paused and remove the annotation when the resource has been actually paused.   | Providers | Any Cluster API resource |
+| clusterctl.cluster.x-k8s.io/delete-for-move                      | DeleteForMoveAnnotation will be set to objects that are going to be deleted from the source cluster after being moved to the target cluster during the clusterctl move operation. It will help any validation webhook to take decision based on it.  | Cluster API | Any Cluster API resource |
+| clusterctl.cluster.x-k8s.io/skip-crd-name-preflight-check        | Can be placed on provider CRDs, so that clusterctl doesn't emit an error if the CRD doesn't comply with Cluster APIs naming scheme. Only CRDs that are referenced by core Cluster API CRDs have to comply with the naming scheme.      | Providers | CRDs |
+| controlplane.cluster.x-k8s.io/kubeadm-cluster-configuration      | It is a machine annotation that stores the json-marshalled string of KCP ClusterConfiguration. This annotation is used to detect any changes in ClusterConfiguration and trigger machine rollout in KCP.    | Cluster API | Machines |
+| controlplane.cluster.x-k8s.io/remediation-for                    | It is a machine annotation that links a new machine to the unhealthy machine it is replacing.      | Cluster API | Machines |
+| controlplane.cluster.x-k8s.io/remediation-in-progress            | It is a KCP annotation that tracks that the system is in between having deleted an unhealthy machine and recreating its replacement.     | Cluster API | KubeadmControlPlane |
+| controlplane.cluster.x-k8s.io/skip-coredns                       | It explicitly skips reconciling CoreDNS if set.   | User | KubeadmControlPlane |
+| controlplane.cluster.x-k8s.io/skip-kube-proxy                    | It explicitly skips reconciling kube-proxy if set.  | User | KubeadmControlPlane |
+| machine.cluster.x-k8s.io/certificates-expiry                     | It captures the expiry date of the machine certificates in RFC3339 format. It is used to trigger rollout of control plane machines before certificates expire. It can be set on BootstrapConfig and Machine objects. The value set on Machine object takes precedence. The annotation is only used by control plane machines.      | Cluster API/User | BootstrapConfig/Machine |
+| machine.cluster.x-k8s.io/exclude-node-draining                   | It explicitly skips node draining if set.    | User | Machines |
+| machine.cluster.x-k8s.io/exclude-wait-for-node-volume-detach     | It explicitly skips the waiting for node volume detaching if set.      | User | Machines |
+| machinedeployment.clusters.x-k8s.io/desired-replicas             | It is the desired replicas for a machine deployment recorded as an annotation in its machine sets. Helps in separating scaling events from the rollout process and for determining if the new machine set for a deployment is really saturated.   |    Cluster API | MachineSets |
+| machinedeployment.clusters.x-k8s.io/max-replicas                 | It is the maximum replicas a deployment can have at a given point, which is machinedeployment.spec.replicas + maxSurge. Used by the underlying machine sets to estimate their proportions in case the deployment has surge replicas.  |     Cluster API    | MachineSets |
+| machinedeployment.clusters.x-k8s.io/revision                     | It is the revision annotation of a machine deployment's machine sets which records its rollout sequence.         |  Cluster API  | MachineSet |
+| machinedeployment.clusters.x-k8s.io/revision-history             | It maintains the history of all old revisions that a machine set has served for a machine deployment.   | Cluster API | MachineSets |
+| machineset.cluster.x-k8s.io/skip-preflight-checks                | It can be applied on MachineDeployment and MachineSet resources to specify a comma-separated list of preflight checks that should be skipped during MachineSet reconciliation. Supported preflight checks are: All, KubeadmVersionSkew, KubernetesVersionSkew, ControlPlaneIsStable.   | User | MachineDeployment and MachineSet resources |
+| pre-drain.delete.hook.machine.cluster.x-k8s.io                   | It specifies the prefix we search each annotation for during the pre-drain.delete lifecycle hook to pause reconciliation of deletion. These hooks will prevent removal of draining the associated node until all are removed.   | User | Machines |
+| pre-terminate.delete.hook.machine.cluster.x-k8s.io               | It specifies the prefix we search each annotation for during the pre-terminate.delete lifecycle hook to pause reconciliation of deletion. These hooks will prevent removal of an instance from an infrastructure provider until all are removed.   | User | Machines |
+| topology.cluster.x-k8s.io/defer-upgrade                          | It can be used to defer the Kubernetes upgrade of a single MachineDeployment topology. If the annotation is set on a MachineDeployment topology in Cluster.spec.topology.workers, the Kubernetes upgrade for this MachineDeployment topology is deferred. It doesn't affect other MachineDeployment topologies.                                                                                               | Cluster API |	MachineDeployments in Cluster.topology |
+| topology.cluster.x-k8s.io/dry-run	                               | It is an annotation that gets set on objects by the topology controller only during a server side dry run apply operation. It is used for validating update webhooks for objects which get updated by template rotation (e.g. InfrastructureMachineTemplate). When the annotation is set and the admission request is a dry run, the webhook should deny validation due to immutability. By that the request will succeed (without any changes to the actual object because it is a dry run) and the topology controller will receive the resulting object. |	Cluster API	| Template rotation objects |
+| topology.cluster.x-k8s.io/hold-upgrade-sequence	               | It can be used to hold the entire MachineDeployment upgrade sequence. If the annotation is set on a MachineDeployment topology in Cluster.spec.topology.workers, the Kubernetes upgrade for this MachineDeployment topology and all subsequent ones is deferred.	| Cluster API	| MachineDeployments in Cluster.topology |
+| topology.cluster.x-k8s.io/upgrade-concurrency	                   | It can be used to configure the maximum concurrency while upgrading MachineDeployments of a classy Cluster. It is set as a top level annotation on the Cluster object. The value should be >= 1. If unspecified the upgrade concurrency will default to 1. |	Cluster API | Cluster |
+| unsafe.topology.cluster.x-k8s.io/disable-update-class-name-check | It can be used to disable the webhook check on update that disallows a pre-existing Cluster to be populated with Topology information and Class. | User     |   Cluster      |
+| unsafe.topology.cluster.x-k8s.io/disable-update-version-check    | It can be used to disable the webhook checks on update that disallows updating the .topology.spec.version on certain conditions. | User | Cluster |
diff --git a/docs/book/src/user/quick-start.md b/docs/book/src/user/quick-start.md
index a81422414f4b..4d70f07e2909 100644
--- a/docs/book/src/user/quick-start.md
+++ b/docs/book/src/user/quick-start.md
@@ -1538,7 +1538,7 @@ Install the official cloud-provider-azure Helm chart on the workload cluster:
 helm install --kubeconfig=./capi-quickstart.kubeconfig --repo https://raw.githubusercontent.com/kubernetes-sigs/cloud-provider-azure/master/helm/repo cloud-provider-azure --generate-name --set infra.clusterName=capi-quickstart --set cloudControllerManager.clusterCIDR="192.168.0.0/16"
 ```
 
-For more information, see the [CAPZ book](https://capz.sigs.k8s.io/topics/addons.html).
+For more information, see the [CAPZ book](https://capz.sigs.k8s.io/self-managed/addons.html).
 
 {{#/tab }}
 {{#tab OpenStack}}
@@ -1778,7 +1778,7 @@ kind delete cluster
 [Akamai (Linode) provider]: https://linode.github.io/cluster-api-provider-linode/introduction.html
 [AWS provider prerequisites]: https://cluster-api-aws.sigs.k8s.io/topics/using-clusterawsadm-to-fulfill-prerequisites.html
 [AWS provider releases]: https://github.com/kubernetes-sigs/cluster-api-provider-aws/releases
-[Azure Provider Prerequisites]: https://capz.sigs.k8s.io/topics/getting-started.html#prerequisites
+[Azure Provider Prerequisites]: https://capz.sigs.k8s.io/getting-started.html#prerequisites
 [bootstrap cluster]: ../reference/glossary.md#bootstrap-cluster
 [capa]: https://cluster-api-aws.sigs.k8s.io
 [capv-upload-images]: https://github.com/kubernetes-sigs/cluster-api-provider-vsphere/blob/master/docs/getting_started.md#uploading-the-machine-images
diff --git a/hack/tools/go.mod b/hack/tools/go.mod
index 7556ef59bbbe..00976e083b60 100644
--- a/hack/tools/go.mod
+++ b/hack/tools/go.mod
@@ -16,7 +16,7 @@ require (
 	github.com/spf13/pflag v1.0.5
 	github.com/valyala/fastjson v1.6.4
 	golang.org/x/oauth2 v0.22.0
-	google.golang.org/api v0.193.0
+	google.golang.org/api v0.194.0
 	k8s.io/api v0.31.0
 	k8s.io/apiextensions-apiserver v0.31.0
 	k8s.io/apimachinery v0.31.0
@@ -34,7 +34,7 @@ require (
 )
 
 require (
-	cloud.google.com/go/auth v0.9.0 // indirect
+	cloud.google.com/go/auth v0.9.1 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.4 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
@@ -160,7 +160,7 @@ require (
 	golang.org/x/mod v0.20.0 // indirect
 	golang.org/x/net v0.28.0 // indirect
 	golang.org/x/sync v0.8.0 // indirect
-	golang.org/x/sys v0.23.0 // indirect
+	golang.org/x/sys v0.24.0 // indirect
 	golang.org/x/term v0.23.0 // indirect
 	golang.org/x/text v0.17.0 // indirect
 	golang.org/x/time v0.6.0 // indirect
diff --git a/hack/tools/go.sum b/hack/tools/go.sum
index 3d851383fc2a..fb228b084543 100644
--- a/hack/tools/go.sum
+++ b/hack/tools/go.sum
@@ -1,8 +1,8 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.115.1 h1:Jo0SM9cQnSkYfp44+v+NQXHpcHqlnRJk2qxh6yvxxxQ=
 cloud.google.com/go v0.115.1/go.mod h1:DuujITeaufu3gL68/lOFIirVNJwQeyf5UXyi+Wbgknc=
-cloud.google.com/go/auth v0.9.0 h1:cYhKl1JUhynmxjXfrk4qdPc6Amw7i+GC9VLflgT0p5M=
-cloud.google.com/go/auth v0.9.0/go.mod h1:2HsApZBr9zGZhC9QAXsYVYaWk8kNUt37uny+XVKi7wM=
+cloud.google.com/go/auth v0.9.1 h1:+pMtLEV2k0AXKvs/tGZojuj6QaioxfUjOpMsG5Gtx+w=
+cloud.google.com/go/auth v0.9.1/go.mod h1:Sw8ocT5mhhXxFklyhT12Eiy0ed6tTrPMCJjSI8KhYLk=
 cloud.google.com/go/auth/oauth2adapt v0.2.4 h1:0GWE/FUsXhf6C+jAkWgYm7X9tK8cuEIfy19DBn6B6bY=
 cloud.google.com/go/auth/oauth2adapt v0.2.4/go.mod h1:jC/jOpwFP6JBxhB3P5Rr0a9HLMC/Pe3eaL4NmdvqPtc=
 cloud.google.com/go/compute/metadata v0.5.0 h1:Zr0eK8JbFv6+Wi4ilXAR8FJ3wyNdpxHKJNPos6LTZOY=
@@ -463,8 +463,8 @@ golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.23.0 h1:YfKFowiIMvtgl1UERQoTPPToxltDeZfbj4H7dVUCwmM=
-golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg=
+golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
@@ -501,8 +501,8 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
 gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
-google.golang.org/api v0.193.0 h1:eOGDoJFsLU+HpCBaDJex2fWiYujAw9KbXgpOAMePoUs=
-google.golang.org/api v0.193.0/go.mod h1:Po3YMV1XZx+mTku3cfJrlIYR03wiGrCOsdpC67hjZvw=
+google.golang.org/api v0.194.0 h1:dztZKG9HgtIpbI35FhfuSNR/zmaMVdxNlntHj1sIS4s=
+google.golang.org/api v0.194.0/go.mod h1:AgvUFdojGANh3vI+P7EVnxj3AISHllxGCJSFmggmnd0=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
diff --git a/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go b/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go
index 0065a969f560..ce7a18cc10f4 100644
--- a/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go
+++ b/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go
@@ -126,7 +126,6 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (_ ctrl.Re
 		}
 
 		// Error reading the object - requeue the request.
-		log.Error(err, "Failed to fetch MachineHealthCheck")
 		return ctrl.Result{}, err
 	}
 
diff --git a/scripts/ci-e2e-lib.sh b/scripts/ci-e2e-lib.sh
index e171b9128590..6eb2b45fabae 100644
--- a/scripts/ci-e2e-lib.sh
+++ b/scripts/ci-e2e-lib.sh
@@ -270,9 +270,9 @@ EOL
 # the actual test run less sensible to the network speed.
 kind:prepullAdditionalImages () {
   # Pulling cert manager images so we can pre-load in kind nodes
-  kind::prepullImage "quay.io/jetstack/cert-manager-cainjector:v1.15.2"
-  kind::prepullImage "quay.io/jetstack/cert-manager-webhook:v1.15.2"
-  kind::prepullImage "quay.io/jetstack/cert-manager-controller:v1.15.2"
+  kind::prepullImage "quay.io/jetstack/cert-manager-cainjector:v1.15.3"
+  kind::prepullImage "quay.io/jetstack/cert-manager-webhook:v1.15.3"
+  kind::prepullImage "quay.io/jetstack/cert-manager-controller:v1.15.3"
 }
 
 # kind:prepullImage pre-pull a docker image if no already present locally.
diff --git a/test/e2e/autoscaler.go b/test/e2e/autoscaler.go
index 99f9a83c24da..5092dba69ce5 100644
--- a/test/e2e/autoscaler.go
+++ b/test/e2e/autoscaler.go
@@ -62,8 +62,17 @@ type AutoscalerSpecInput struct {
 	InfrastructureMachineTemplateKind     string
 	InfrastructureMachinePoolTemplateKind string
 	InfrastructureMachinePoolKind         string
+	InfrastructureAPIGroup                string
 	AutoscalerVersion                     string
 
+	// InstallOnManagementCluster steers if the autoscaler should get installed to the management or workload cluster.
+	// Depending on the CI environments, there may be no connectivity from the workload to the management cluster.
+	InstallOnManagementCluster bool
+
+	// ScaleToAndFromZero enables tests to scale to and from zero.
+	// Note: This is only implemented for MachineDeployments.
+	ScaleToAndFromZero bool
+
 	// Allows to inject a function to be run after test namespace is created.
 	// If not specified, this is a no-op.
 	PostNamespaceCreated func(managementClusterProxy framework.ClusterProxy, workloadClusterNamespace string)
@@ -115,6 +124,8 @@ func AutoscalerSpec(ctx context.Context, inputGetter func() AutoscalerSpecInput)
 			infrastructureProvider = *input.InfrastructureProvider
 		}
 
+		hasMachinePool := input.InfrastructureMachinePoolTemplateKind != ""
+
 		clusterctl.ApplyClusterTemplateAndWait(ctx, clusterctl.ApplyClusterTemplateAndWaitInput{
 			ClusterProxy: input.BootstrapClusterProxy,
 			ConfigCluster: clusterctl.ConfigClusterInput{
@@ -137,6 +148,7 @@ func AutoscalerSpec(ctx context.Context, inputGetter func() AutoscalerSpecInput)
 		}, clusterResources)
 
 		Expect(clusterResources.Cluster.Spec.Topology).NotTo(BeNil(), "Autoscaler test expected a Classy Cluster")
+
 		// Ensure the MachineDeploymentTopology has the autoscaler annotations.
 		mdTopology := clusterResources.Cluster.Spec.Topology.Workers.MachineDeployments[0]
 		Expect(mdTopology.Metadata.Annotations).NotTo(BeNil(), "MachineDeployment is expected to have autoscaler annotations")
@@ -145,21 +157,27 @@ func AutoscalerSpec(ctx context.Context, inputGetter func() AutoscalerSpecInput)
 		mdNodeGroupMaxSize, ok := mdTopology.Metadata.Annotations[clusterv1.AutoscalerMaxSizeAnnotation]
 		Expect(ok).To(BeTrue(), "MachineDeploymentTopology %s does not have the %q autoscaler annotation", mdTopology.Name, clusterv1.AutoscalerMaxSizeAnnotation)
 
-		// Ensure the MachinePoolTopology does NOT have the autoscaler annotations so we can test MachineDeployments first.
-		mpTopology := clusterResources.Cluster.Spec.Topology.Workers.MachinePools[0]
-		if mpTopology.Metadata.Annotations != nil {
-			_, ok = mpTopology.Metadata.Annotations[clusterv1.AutoscalerMinSizeAnnotation]
-			Expect(ok).To(BeFalse(), "MachinePoolTopology %s does have the %q autoscaler annotation", mpTopology.Name, clusterv1.AutoscalerMinSizeAnnotation)
-			_, ok = mpTopology.Metadata.Annotations[clusterv1.AutoscalerMaxSizeAnnotation]
-			Expect(ok).To(BeFalse(), "MachinePoolTopology %s does have the %q autoscaler annotation", mpTopology.Name, clusterv1.AutoscalerMaxSizeAnnotation)
+		if hasMachinePool {
+			// Ensure the MachinePoolTopology does NOT have the autoscaler annotations so we can test MachineDeployments first.
+			mpTopology := clusterResources.Cluster.Spec.Topology.Workers.MachinePools[0]
+			if mpTopology.Metadata.Annotations != nil {
+				_, ok = mpTopology.Metadata.Annotations[clusterv1.AutoscalerMinSizeAnnotation]
+				Expect(ok).To(BeFalse(), "MachinePoolTopology %s does have the %q autoscaler annotation", mpTopology.Name, clusterv1.AutoscalerMinSizeAnnotation)
+				_, ok = mpTopology.Metadata.Annotations[clusterv1.AutoscalerMaxSizeAnnotation]
+				Expect(ok).To(BeFalse(), "MachinePoolTopology %s does have the %q autoscaler annotation", mpTopology.Name, clusterv1.AutoscalerMaxSizeAnnotation)
+			}
 		}
 
 		// Get a ClusterProxy so we can interact with the workload cluster
 		workloadClusterProxy := input.BootstrapClusterProxy.GetWorkloadCluster(ctx, clusterResources.Cluster.Namespace, clusterResources.Cluster.Name)
 		mdOriginalReplicas := *clusterResources.MachineDeployments[0].Spec.Replicas
 		Expect(strconv.Itoa(int(mdOriginalReplicas))).To(Equal(mdNodeGroupMinSize), "MachineDeployment should have replicas as defined in %s", clusterv1.AutoscalerMinSizeAnnotation)
-		mpOriginalReplicas := *clusterResources.MachinePools[0].Spec.Replicas
-		Expect(int(mpOriginalReplicas)).To(Equal(1), "MachinePool should default to 1 replica via the MachinePool webhook")
+
+		var mpOriginalReplicas int32
+		if hasMachinePool {
+			mpOriginalReplicas = *clusterResources.MachinePools[0].Spec.Replicas
+			Expect(int(mpOriginalReplicas)).To(Equal(1), "MachinePool should default to 1 replica via the MachinePool webhook")
+		}
 
 		By("Installing the autoscaler on the workload cluster")
 		autoscalerWorkloadYAMLPath := input.E2EConfig.GetVariable(AutoscalerWorkloadYAMLPath)
@@ -168,11 +186,13 @@ func AutoscalerSpec(ctx context.Context, inputGetter func() AutoscalerSpecInput)
 			InfrastructureMachineTemplateKind:     input.InfrastructureMachineTemplateKind,
 			InfrastructureMachinePoolTemplateKind: input.InfrastructureMachinePoolTemplateKind,
 			InfrastructureMachinePoolKind:         input.InfrastructureMachinePoolKind,
+			InfrastructureAPIGroup:                input.InfrastructureAPIGroup,
 			WorkloadYamlPath:                      autoscalerWorkloadYAMLPath,
 			ManagementClusterProxy:                input.BootstrapClusterProxy,
 			WorkloadClusterProxy:                  workloadClusterProxy,
 			Cluster:                               clusterResources.Cluster,
 			AutoscalerVersion:                     input.AutoscalerVersion,
+			AutoscalerOnManagementCluster:         input.InstallOnManagementCluster,
 		}, input.E2EConfig.GetIntervals(specName, "wait-controllers")...)
 
 		By("Creating workload that forces the system to scale up")
@@ -226,6 +246,50 @@ func AutoscalerSpec(ctx context.Context, inputGetter func() AutoscalerSpecInput)
 			WaitForMachineDeployment: input.E2EConfig.GetIntervals(specName, "wait-controllers"),
 		})
 
+		if input.ScaleToAndFromZero {
+			By("Enabling autoscaler for the MachineDeployment to zero")
+			// Enable autoscaler on the MachineDeployment.
+			framework.EnableAutoscalerForMachineDeploymentTopologyAndWait(ctx, framework.EnableAutoscalerForMachineDeploymentTopologyAndWaitInput{
+				ClusterProxy:                input.BootstrapClusterProxy,
+				Cluster:                     clusterResources.Cluster,
+				NodeGroupMinSize:            "0",
+				NodeGroupMaxSize:            mdNodeGroupMaxSize,
+				WaitForAnnotationsToBeAdded: input.E2EConfig.GetIntervals(specName, "wait-autoscaler"),
+			})
+
+			By("Scaling the MachineDeployment scale up deployment to zero")
+			framework.ScaleScaleUpDeploymentAndWait(ctx, framework.ScaleScaleUpDeploymentAndWaitInput{
+				ClusterProxy: workloadClusterProxy,
+				// We need to sum up the expected number of MachineDeployment replicas and the current
+				// number of MachinePool replicas because otherwise the pods get scheduled on the MachinePool nodes.
+				Replicas: mpOriginalReplicas + 0,
+			}, input.E2EConfig.GetIntervals(specName, "wait-autoscaler")...)
+
+			By("Checking the MachineDeployment finished scaling down to zero")
+			framework.AssertMachineDeploymentReplicas(ctx, framework.AssertMachineDeploymentReplicasInput{
+				Getter:                   input.BootstrapClusterProxy.GetClient(),
+				MachineDeployment:        clusterResources.MachineDeployments[0],
+				Replicas:                 0,
+				WaitForMachineDeployment: input.E2EConfig.GetIntervals(specName, "wait-controllers"),
+			})
+
+			By("Scaling the MachineDeployment scale up deployment to 1")
+			framework.ScaleScaleUpDeploymentAndWait(ctx, framework.ScaleScaleUpDeploymentAndWaitInput{
+				ClusterProxy: workloadClusterProxy,
+				// We need to sum up the expected number of MachineDeployment replicas and the current
+				// number of MachinePool replicas because otherwise the pods get scheduled on the MachinePool nodes.
+				Replicas: mpOriginalReplicas + 1,
+			}, input.E2EConfig.GetIntervals(specName, "wait-autoscaler")...)
+
+			By("Checking the MachineDeployment finished scaling up")
+			framework.AssertMachineDeploymentReplicas(ctx, framework.AssertMachineDeploymentReplicasInput{
+				Getter:                   input.BootstrapClusterProxy.GetClient(),
+				MachineDeployment:        clusterResources.MachineDeployments[0],
+				Replicas:                 1,
+				WaitForMachineDeployment: input.E2EConfig.GetIntervals(specName, "wait-controllers"),
+			})
+		}
+
 		By("Disabling the autoscaler for MachineDeployments to test MachinePools")
 		framework.DisableAutoscalerForMachineDeploymentTopologyAndWait(ctx, framework.DisableAutoscalerForMachineDeploymentTopologyAndWaitInput{
 			ClusterProxy:                  input.BootstrapClusterProxy,
@@ -239,67 +303,69 @@ func AutoscalerSpec(ctx context.Context, inputGetter func() AutoscalerSpecInput)
 			WaitForDelete: input.E2EConfig.GetIntervals(specName, "wait-autoscaler"),
 		})
 
-		By("Enabling autoscaler for the MachinePool")
-		// Enable autoscaler on the MachinePool.
-		framework.EnableAutoscalerForMachinePoolTopologyAndWait(ctx, framework.EnableAutoscalerForMachinePoolTopologyAndWaitInput{
-			ClusterProxy:                input.BootstrapClusterProxy,
-			Cluster:                     clusterResources.Cluster,
-			NodeGroupMinSize:            mpNodeGroupMinSize,
-			NodeGroupMaxSize:            mpNodeGroupMaxSize,
-			WaitForAnnotationsToBeAdded: input.E2EConfig.GetIntervals(specName, "wait-autoscaler"),
-		})
-
-		By("Creating workload that forces the system to scale up")
-		framework.AddScaleUpDeploymentAndWait(ctx, framework.AddScaleUpDeploymentAndWaitInput{
-			ClusterProxy: workloadClusterProxy,
-		}, input.E2EConfig.GetIntervals(specName, "wait-autoscaler")...)
-
-		By("Checking the MachinePool is scaled up")
-		mpScaledUpReplicas := mpOriginalReplicas + 1
-		framework.AssertMachinePoolReplicas(ctx, framework.AssertMachinePoolReplicasInput{
-			Getter:             input.BootstrapClusterProxy.GetClient(),
-			MachinePool:        clusterResources.MachinePools[0],
-			Replicas:           mpScaledUpReplicas,
-			WaitForMachinePool: input.E2EConfig.GetIntervals(specName, "wait-autoscaler"),
-		})
-
-		By("Disabling the autoscaler")
-		framework.DisableAutoscalerForMachinePoolTopologyAndWait(ctx, framework.DisableAutoscalerForMachinePoolTopologyAndWaitInput{
-			ClusterProxy:                  input.BootstrapClusterProxy,
-			Cluster:                       clusterResources.Cluster,
-			WaitForAnnotationsToBeDropped: input.E2EConfig.GetIntervals(specName, "wait-controllers"),
-		})
-
-		By("Checking we can manually scale up the MachinePool")
-		// Scale up the MachinePool. Since autoscaler is disabled we should be able to do this.
-		mpExcessReplicas := mpScaledUpReplicas + 1
-		framework.ScaleMachinePoolTopologyAndWait(ctx, framework.ScaleMachinePoolTopologyAndWaitInput{
-			ClusterProxy:        input.BootstrapClusterProxy,
-			Cluster:             clusterResources.Cluster,
-			Replicas:            mpExcessReplicas,
-			WaitForMachinePools: input.E2EConfig.GetIntervals(specName, "wait-worker-nodes"),
-			Getter:              input.BootstrapClusterProxy.GetClient(),
-		})
-
-		By("Checking enabling autoscaler will scale down the MachinePool to correct size")
-		// Enable autoscaler on the MachinePool.
-		framework.EnableAutoscalerForMachinePoolTopologyAndWait(ctx, framework.EnableAutoscalerForMachinePoolTopologyAndWaitInput{
-			ClusterProxy:                input.BootstrapClusterProxy,
-			Cluster:                     clusterResources.Cluster,
-			NodeGroupMinSize:            mpNodeGroupMinSize,
-			NodeGroupMaxSize:            mpNodeGroupMaxSize,
-			WaitForAnnotationsToBeAdded: input.E2EConfig.GetIntervals(specName, "wait-autoscaler"),
-		})
-
-		By("Checking the MachinePool is scaled down")
-		// Since we scaled up the MachinePool manually and the workload has not changed auto scaler
-		// should detect that there are unneeded nodes and scale down the MachinePool.
-		framework.AssertMachinePoolReplicas(ctx, framework.AssertMachinePoolReplicasInput{
-			Getter:             input.BootstrapClusterProxy.GetClient(),
-			MachinePool:        clusterResources.MachinePools[0],
-			Replicas:           mpScaledUpReplicas,
-			WaitForMachinePool: input.E2EConfig.GetIntervals(specName, "wait-controllers"),
-		})
+		if hasMachinePool {
+			By("Enabling autoscaler for the MachinePool")
+			// Enable autoscaler on the MachinePool.
+			framework.EnableAutoscalerForMachinePoolTopologyAndWait(ctx, framework.EnableAutoscalerForMachinePoolTopologyAndWaitInput{
+				ClusterProxy:                input.BootstrapClusterProxy,
+				Cluster:                     clusterResources.Cluster,
+				NodeGroupMinSize:            mpNodeGroupMinSize,
+				NodeGroupMaxSize:            mpNodeGroupMaxSize,
+				WaitForAnnotationsToBeAdded: input.E2EConfig.GetIntervals(specName, "wait-autoscaler"),
+			})
+
+			By("Creating workload that forces the system to scale up")
+			framework.AddScaleUpDeploymentAndWait(ctx, framework.AddScaleUpDeploymentAndWaitInput{
+				ClusterProxy: workloadClusterProxy,
+			}, input.E2EConfig.GetIntervals(specName, "wait-autoscaler")...)
+
+			By("Checking the MachinePool is scaled up")
+			mpScaledUpReplicas := mpOriginalReplicas + 1
+			framework.AssertMachinePoolReplicas(ctx, framework.AssertMachinePoolReplicasInput{
+				Getter:             input.BootstrapClusterProxy.GetClient(),
+				MachinePool:        clusterResources.MachinePools[0],
+				Replicas:           mpScaledUpReplicas,
+				WaitForMachinePool: input.E2EConfig.GetIntervals(specName, "wait-autoscaler"),
+			})
+
+			By("Disabling the autoscaler")
+			framework.DisableAutoscalerForMachinePoolTopologyAndWait(ctx, framework.DisableAutoscalerForMachinePoolTopologyAndWaitInput{
+				ClusterProxy:                  input.BootstrapClusterProxy,
+				Cluster:                       clusterResources.Cluster,
+				WaitForAnnotationsToBeDropped: input.E2EConfig.GetIntervals(specName, "wait-controllers"),
+			})
+
+			By("Checking we can manually scale up the MachinePool")
+			// Scale up the MachinePool. Since autoscaler is disabled we should be able to do this.
+			mpExcessReplicas := mpScaledUpReplicas + 1
+			framework.ScaleMachinePoolTopologyAndWait(ctx, framework.ScaleMachinePoolTopologyAndWaitInput{
+				ClusterProxy:        input.BootstrapClusterProxy,
+				Cluster:             clusterResources.Cluster,
+				Replicas:            mpExcessReplicas,
+				WaitForMachinePools: input.E2EConfig.GetIntervals(specName, "wait-worker-nodes"),
+				Getter:              input.BootstrapClusterProxy.GetClient(),
+			})
+
+			By("Checking enabling autoscaler will scale down the MachinePool to correct size")
+			// Enable autoscaler on the MachinePool.
+			framework.EnableAutoscalerForMachinePoolTopologyAndWait(ctx, framework.EnableAutoscalerForMachinePoolTopologyAndWaitInput{
+				ClusterProxy:                input.BootstrapClusterProxy,
+				Cluster:                     clusterResources.Cluster,
+				NodeGroupMinSize:            mpNodeGroupMinSize,
+				NodeGroupMaxSize:            mpNodeGroupMaxSize,
+				WaitForAnnotationsToBeAdded: input.E2EConfig.GetIntervals(specName, "wait-autoscaler"),
+			})
+
+			By("Checking the MachinePool is scaled down")
+			// Since we scaled up the MachinePool manually and the workload has not changed auto scaler
+			// should detect that there are unneeded nodes and scale down the MachinePool.
+			framework.AssertMachinePoolReplicas(ctx, framework.AssertMachinePoolReplicasInput{
+				Getter:             input.BootstrapClusterProxy.GetClient(),
+				MachinePool:        clusterResources.MachinePools[0],
+				Replicas:           mpScaledUpReplicas,
+				WaitForMachinePool: input.E2EConfig.GetIntervals(specName, "wait-controllers"),
+			})
+		}
 
 		By("PASSED!")
 	})
diff --git a/test/e2e/config/docker.yaml b/test/e2e/config/docker.yaml
index 4c9867b5a274..242055c0d64a 100644
--- a/test/e2e/config/docker.yaml
+++ b/test/e2e/config/docker.yaml
@@ -23,11 +23,11 @@ images:
   loadBehavior: tryLoad
 - name: gcr.io/k8s-staging-cluster-api/test-extension-{ARCH}:dev
   loadBehavior: tryLoad
-- name: quay.io/jetstack/cert-manager-cainjector:v1.15.2
+- name: quay.io/jetstack/cert-manager-cainjector:v1.15.3
   loadBehavior: tryLoad
-- name: quay.io/jetstack/cert-manager-webhook:v1.15.2
+- name: quay.io/jetstack/cert-manager-webhook:v1.15.3
   loadBehavior: tryLoad
-- name: quay.io/jetstack/cert-manager-controller:v1.15.2
+- name: quay.io/jetstack/cert-manager-controller:v1.15.3
   loadBehavior: tryLoad
 
 providers:
diff --git a/test/framework/autoscaler_helpers.go b/test/framework/autoscaler_helpers.go
index 4259b875281f..28b0f29a01df 100644
--- a/test/framework/autoscaler_helpers.go
+++ b/test/framework/autoscaler_helpers.go
@@ -52,6 +52,7 @@ type ApplyAutoscalerToWorkloadClusterInput struct {
 	InfrastructureMachineTemplateKind     string
 	InfrastructureMachinePoolTemplateKind string
 	InfrastructureMachinePoolKind         string
+	InfrastructureAPIGroup                string
 	// WorkloadYamlPath should point the yaml that will be applied on the workload cluster.
 	// The YAML file should:
 	//  - Be creating the autoscaler deployment in the workload cluster
@@ -74,6 +75,8 @@ type ApplyAutoscalerToWorkloadClusterInput struct {
 	ManagementClusterProxy ClusterProxy
 	Cluster                *clusterv1.Cluster
 	WorkloadClusterProxy   ClusterProxy
+
+	AutoscalerOnManagementCluster bool
 }
 
 // ApplyAutoscalerToWorkloadCluster installs autoscaler on the workload cluster.
@@ -88,11 +91,15 @@ func ApplyAutoscalerToWorkloadCluster(ctx context.Context, input ApplyAutoscaler
 	workloadYamlTemplate, err := os.ReadFile(input.WorkloadYamlPath)
 	Expect(err).ToNot(HaveOccurred(), "failed to load %s", workloadYamlTemplate)
 
+	if input.InfrastructureAPIGroup == "" {
+		input.InfrastructureAPIGroup = "infrastructure.cluster.x-k8s.io"
+	}
+
 	// Get a server address for the Management Cluster.
 	// This address should be accessible from the workload cluster.
 	serverAddr, mgtClusterCA := getServerAddrAndCA(ctx, input.ManagementClusterProxy)
 	// Generate a token with the required permission that can be used by the autoscaler.
-	token := getAuthenticationTokenForAutoscaler(ctx, input.ManagementClusterProxy, input.Cluster.Namespace, input.Cluster.Name, input.InfrastructureMachineTemplateKind, input.InfrastructureMachinePoolTemplateKind, input.InfrastructureMachinePoolKind)
+	token := getAuthenticationTokenForAutoscaler(ctx, input.ManagementClusterProxy, input.Cluster.Namespace, input.Cluster.Name, input.InfrastructureAPIGroup, input.InfrastructureMachineTemplateKind, input.InfrastructureMachinePoolTemplateKind, input.InfrastructureMachinePoolKind)
 
 	workloadYaml, err := ProcessYAML(&ProcessYAMLInput{
 		Template:             workloadYamlTemplate,
@@ -107,9 +114,8 @@ func ApplyAutoscalerToWorkloadCluster(ctx context.Context, input ApplyAutoscaler
 		},
 	})
 	Expect(err).ToNot(HaveOccurred(), "failed to parse %s", workloadYamlTemplate)
-	Expect(input.WorkloadClusterProxy.CreateOrUpdate(ctx, workloadYaml)).To(Succeed(), "failed to apply %s", workloadYamlTemplate)
 
-	By("Wait for the autoscaler deployment and collect logs")
+	autoscalerProxy := input.WorkloadClusterProxy
 	deployment := &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "cluster-autoscaler",
@@ -117,19 +123,27 @@ func ApplyAutoscalerToWorkloadCluster(ctx context.Context, input ApplyAutoscaler
 		},
 	}
 
-	Expect(input.WorkloadClusterProxy.GetClient().Get(ctx, client.ObjectKeyFromObject(deployment), deployment)).To(Succeed(), fmt.Sprintf("failed to get Deployment %s", klog.KObj(deployment)))
+	if input.AutoscalerOnManagementCluster {
+		autoscalerProxy = input.ManagementClusterProxy
+		deployment.Namespace = input.Cluster.Namespace
+	}
+
+	Expect(autoscalerProxy.CreateOrUpdate(ctx, workloadYaml)).To(Succeed(), "failed to apply %s", workloadYamlTemplate)
+
+	By("Wait for the autoscaler deployment and collect logs")
+	Expect(autoscalerProxy.GetClient().Get(ctx, client.ObjectKeyFromObject(deployment), deployment)).To(Succeed(), fmt.Sprintf("failed to get Deployment %s", klog.KObj(deployment)))
 	WaitForDeploymentsAvailable(ctx, WaitForDeploymentsAvailableInput{
-		Getter:     input.WorkloadClusterProxy.GetClient(),
+		Getter:     autoscalerProxy.GetClient(),
 		Deployment: deployment,
 	}, intervals...)
 
 	// Start streaming logs from the autoscaler deployment.
 	WatchDeploymentLogsByName(ctx, WatchDeploymentLogsByNameInput{
-		GetLister:  input.WorkloadClusterProxy.GetClient(),
-		Cache:      input.WorkloadClusterProxy.GetCache(ctx),
-		ClientSet:  input.WorkloadClusterProxy.GetClientSet(),
+		GetLister:  autoscalerProxy.GetClient(),
+		Cache:      autoscalerProxy.GetCache(ctx),
+		ClientSet:  autoscalerProxy.GetClientSet(),
 		Deployment: deployment,
-		LogPath:    filepath.Join(input.ArtifactFolder, "clusters", input.WorkloadClusterProxy.GetName(), "logs", deployment.GetNamespace()),
+		LogPath:    filepath.Join(input.ArtifactFolder, "clusters", autoscalerProxy.GetName(), "logs", deployment.GetNamespace()),
 	})
 }
 
@@ -143,7 +157,7 @@ type AddScaleUpDeploymentAndWaitInput struct {
 func AddScaleUpDeploymentAndWait(ctx context.Context, input AddScaleUpDeploymentAndWaitInput, intervals ...interface{}) {
 	By("Create a scale up deployment with resource requests to force scale up")
 	if input.ContainerImage == "" {
-		input.ContainerImage = "registry.k8s.io/pause"
+		input.ContainerImage = "registry.k8s.io/pause:3.10"
 	}
 
 	// gets the node size
@@ -247,6 +261,34 @@ func DeleteScaleUpDeploymentAndWait(ctx context.Context, input DeleteScaleUpDepl
 	}, input.WaitForDelete...).Should(Succeed())
 }
 
+// ScaleScaleUpDeploymentAndWaitInput is the input for ScaleScaleUpDeploymentAndWait.
+type ScaleScaleUpDeploymentAndWaitInput struct {
+	ClusterProxy ClusterProxy
+	Name         string
+	Replicas     int32
+}
+
+// ScaleScaleUpDeploymentAndWait scales the scale up deployment to a given value and waits for it to become ready.
+func ScaleScaleUpDeploymentAndWait(ctx context.Context, input ScaleScaleUpDeploymentAndWaitInput, intervals ...interface{}) {
+	By("Retrieving the scale up deployment")
+	deployment := &appsv1.Deployment{}
+	deploymentName := "scale-up"
+	if input.Name != "" {
+		deploymentName = input.Name
+	}
+	Expect(input.ClusterProxy.GetClient().Get(ctx, client.ObjectKey{Name: deploymentName, Namespace: metav1.NamespaceDefault}, deployment)).To(Succeed(), "failed to get the scale up deployment")
+
+	By("Scaling the scale up deployment")
+	deployment.Spec.Replicas = &input.Replicas
+	Expect(input.ClusterProxy.GetClient().Update(ctx, deployment)).To(Succeed(), "failed to update the scale up deployment")
+
+	By("Wait for the scale up deployment to become ready (this implies machines to be created)")
+	WaitForDeploymentsAvailable(ctx, WaitForDeploymentsAvailableInput{
+		Getter:     input.ClusterProxy.GetClient(),
+		Deployment: deployment,
+	}, intervals...)
+}
+
 type ProcessYAMLInput struct {
 	Template             []byte
 	ClusterctlConfigPath string
@@ -493,7 +535,7 @@ func EnableAutoscalerForMachinePoolTopologyAndWait(ctx context.Context, input En
 
 // getAuthenticationTokenForAutoscaler returns a bearer authenticationToken with minimal RBAC permissions that will be used
 // by the autoscaler running on the workload cluster to access the management cluster.
-func getAuthenticationTokenForAutoscaler(ctx context.Context, managementClusterProxy ClusterProxy, namespace string, cluster string, infraMachineTemplateKind, infraMachinePoolTemplateKind, infraMachinePoolKind string) string {
+func getAuthenticationTokenForAutoscaler(ctx context.Context, managementClusterProxy ClusterProxy, namespace string, cluster string, infraAPIGroup, infraMachineTemplateKind, infraMachinePoolTemplateKind, infraMachinePoolKind string) string {
 	name := fmt.Sprintf("cluster-%s", cluster)
 	sa := &corev1.ServiceAccount{
 		ObjectMeta: metav1.ObjectMeta{
@@ -516,7 +558,7 @@ func getAuthenticationTokenForAutoscaler(ctx context.Context, managementClusterP
 			},
 			{
 				Verbs:     []string{"get", "list"},
-				APIGroups: []string{"infrastructure.cluster.x-k8s.io"},
+				APIGroups: []string{infraAPIGroup},
 				Resources: []string{infraMachineTemplateKind, infraMachinePoolTemplateKind, infraMachinePoolKind},
 			},
 		},
diff --git a/test/framework/deployment_helpers.go b/test/framework/deployment_helpers.go
index 5e4a0f946c63..a2b0c8c141a8 100644
--- a/test/framework/deployment_helpers.go
+++ b/test/framework/deployment_helpers.go
@@ -528,7 +528,7 @@ func DeployUnevictablePod(ctx context.Context, input DeployUnevictablePodInput)
 					Containers: []corev1.Container{
 						{
 							Name:  "web",
-							Image: "registry.k8s.io/pause:latest",
+							Image: "registry.k8s.io/pause:3.10",
 						},
 					},
 				},
diff --git a/test/framework/docker_logcollector.go b/test/framework/docker_logcollector.go
index 6655685cb2a2..6b63062d1f5b 100644
--- a/test/framework/docker_logcollector.go
+++ b/test/framework/docker_logcollector.go
@@ -35,7 +35,16 @@ import (
 )
 
 // DockerLogCollector collect logs from a CAPD workload cluster.
-type DockerLogCollector struct{}
+type DockerLogCollector struct {
+	AdditionalLogs []AdditionalLogs
+}
+
+// AdditionalLogs is a struct to hold instruction for additional logs that need to be collected.
+type AdditionalLogs struct {
+	OutputFileName string
+	Command        string
+	Args           []string
+}
 
 // machineContainerName return a container name using the same rule used in CAPD.
 // NOTE: if the cluster name is already included in the machine name, the cluster name is not add thus
@@ -149,7 +158,8 @@ func (k DockerLogCollector) collectLogsFromNode(ctx context.Context, outputPath
 			return osExec.Command("tar", "--extract", "--file", tempfileName, "--directory", outputDir).Run() //nolint:gosec // We don't care about command injection here.
 		}
 	}
-	return errors.AggregateConcurrent([]func() error{
+
+	collectFuncs := []func() error{
 		execToPathFn(
 			"journal.log",
 			"journalctl", "--no-pager", "--output=short-precise",
@@ -175,7 +185,13 @@ func (k DockerLogCollector) collectLogsFromNode(ctx context.Context, outputPath
 			"journalctl", "--no-pager", "--output=short-precise", "-u", "containerd.service",
 		),
 		copyDirFn("/var/log/pods", "pods"),
-	})
+	}
+
+	for _, additionalLogs := range k.AdditionalLogs {
+		collectFuncs = append(collectFuncs, execToPathFn(additionalLogs.OutputFileName, additionalLogs.Command, additionalLogs.Args...))
+	}
+
+	return errors.AggregateConcurrent(collectFuncs)
 }
 
 // fileOnHost is a helper to create a file at path
diff --git a/test/framework/machinedeployment_helpers.go b/test/framework/machinedeployment_helpers.go
index 3dc15faa8889..8a3f1ab422e2 100644
--- a/test/framework/machinedeployment_helpers.go
+++ b/test/framework/machinedeployment_helpers.go
@@ -648,5 +648,6 @@ func AssertMachineDeploymentReplicas(ctx context.Context, input AssertMachineDep
 		g.Expect(input.Getter.Get(ctx, key, md)).To(Succeed(), fmt.Sprintf("failed to get MachineDeployment %s", klog.KObj(input.MachineDeployment)))
 		g.Expect(md.Spec.Replicas).Should(Not(BeNil()), fmt.Sprintf("MachineDeployment %s replicas should not be nil", klog.KObj(md)))
 		g.Expect(*md.Spec.Replicas).Should(Equal(input.Replicas), fmt.Sprintf("MachineDeployment %s replicas should match expected replicas", klog.KObj(md)))
+		g.Expect(md.Status.Replicas).Should(Equal(input.Replicas), fmt.Sprintf("MachineDeployment %s status.replicas should match expected replicas", klog.KObj(md)))
 	}, input.WaitForMachineDeployment...).Should(Succeed())
 }
diff --git a/test/framework/machinepool_helpers.go b/test/framework/machinepool_helpers.go
index 760b942343d7..af143feae605 100644
--- a/test/framework/machinepool_helpers.go
+++ b/test/framework/machinepool_helpers.go
@@ -365,5 +365,6 @@ func AssertMachinePoolReplicas(ctx context.Context, input AssertMachinePoolRepli
 		g.Expect(input.Getter.Get(ctx, key, mp)).To(Succeed(), fmt.Sprintf("failed to get MachinePool %s", klog.KObj(input.MachinePool)))
 		g.Expect(mp.Spec.Replicas).Should(Not(BeNil()), fmt.Sprintf("MachinePool %s replicas should not be nil", klog.KObj(mp)))
 		g.Expect(*mp.Spec.Replicas).Should(Equal(input.Replicas), fmt.Sprintf("MachinePool %s replicas should match expected replicas", klog.KObj(mp)))
+		g.Expect(mp.Status.Replicas).Should(Equal(input.Replicas), fmt.Sprintf("MachinePool %s status.replicas should match expected replicas", klog.KObj(mp)))
 	}, input.WaitForMachinePool...).Should(Succeed())
 }
diff --git a/test/infrastructure/docker/config/crd/bases/infrastructure.cluster.x-k8s.io_dockerclusters.yaml b/test/infrastructure/docker/config/crd/bases/infrastructure.cluster.x-k8s.io_dockerclusters.yaml
index b47ddb66e270..944eaeff6ef6 100644
--- a/test/infrastructure/docker/config/crd/bases/infrastructure.cluster.x-k8s.io_dockerclusters.yaml
+++ b/test/infrastructure/docker/config/crd/bases/infrastructure.cluster.x-k8s.io_dockerclusters.yaml
@@ -466,7 +466,7 @@ spec:
                       description: |-
                         The reason for the condition's last transition in CamelCase.
                         The specific API may choose whether or not this field is considered a guaranteed API.
-                        This field may not be empty.
+                        This field may be empty.
                       type: string
                     severity:
                       description: |-
diff --git a/test/infrastructure/docker/config/crd/bases/infrastructure.cluster.x-k8s.io_dockermachinepools.yaml b/test/infrastructure/docker/config/crd/bases/infrastructure.cluster.x-k8s.io_dockermachinepools.yaml
index 9775fc7d5107..93d21b8b10af 100644
--- a/test/infrastructure/docker/config/crd/bases/infrastructure.cluster.x-k8s.io_dockermachinepools.yaml
+++ b/test/infrastructure/docker/config/crd/bases/infrastructure.cluster.x-k8s.io_dockermachinepools.yaml
@@ -510,7 +510,7 @@ spec:
                       description: |-
                         The reason for the condition's last transition in CamelCase.
                         The specific API may choose whether or not this field is considered a guaranteed API.
-                        This field may not be empty.
+                        This field may be empty.
                       type: string
                     severity:
                       description: |-
diff --git a/test/infrastructure/docker/config/crd/bases/infrastructure.cluster.x-k8s.io_dockermachines.yaml b/test/infrastructure/docker/config/crd/bases/infrastructure.cluster.x-k8s.io_dockermachines.yaml
index 806fe63086c3..8c7378d0f573 100644
--- a/test/infrastructure/docker/config/crd/bases/infrastructure.cluster.x-k8s.io_dockermachines.yaml
+++ b/test/infrastructure/docker/config/crd/bases/infrastructure.cluster.x-k8s.io_dockermachines.yaml
@@ -474,7 +474,7 @@ spec:
                       description: |-
                         The reason for the condition's last transition in CamelCase.
                         The specific API may choose whether or not this field is considered a guaranteed API.
-                        This field may not be empty.
+                        This field may be empty.
                       type: string
                     severity:
                       description: |-
diff --git a/test/infrastructure/inmemory/config/crd/bases/infrastructure.cluster.x-k8s.io_inmemoryclusters.yaml b/test/infrastructure/inmemory/config/crd/bases/infrastructure.cluster.x-k8s.io_inmemoryclusters.yaml
index ed16457f09c7..c2f5b343d221 100644
--- a/test/infrastructure/inmemory/config/crd/bases/infrastructure.cluster.x-k8s.io_inmemoryclusters.yaml
+++ b/test/infrastructure/inmemory/config/crd/bases/infrastructure.cluster.x-k8s.io_inmemoryclusters.yaml
@@ -92,7 +92,7 @@ spec:
                       description: |-
                         The reason for the condition's last transition in CamelCase.
                         The specific API may choose whether or not this field is considered a guaranteed API.
-                        This field may not be empty.
+                        This field may be empty.
                       type: string
                     severity:
                       description: |-
diff --git a/test/infrastructure/inmemory/config/crd/bases/infrastructure.cluster.x-k8s.io_inmemorymachines.yaml b/test/infrastructure/inmemory/config/crd/bases/infrastructure.cluster.x-k8s.io_inmemorymachines.yaml
index fa1c9efae859..10ac09a960fe 100644
--- a/test/infrastructure/inmemory/config/crd/bases/infrastructure.cluster.x-k8s.io_inmemorymachines.yaml
+++ b/test/infrastructure/inmemory/config/crd/bases/infrastructure.cluster.x-k8s.io_inmemorymachines.yaml
@@ -190,7 +190,7 @@ spec:
                       description: |-
                         The reason for the condition's last transition in CamelCase.
                         The specific API may choose whether or not this field is considered a guaranteed API.
-                        This field may not be empty.
+                        This field may be empty.
                       type: string
                     severity:
                       description: |-