1971 Commits

Author SHA1 Message Date
Andrei Kvapil
dd76166e44 Add factory for ingress resources
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
2025-09-25 19:01:07 +02:00
Andrei Kvapil
ef7dcabe64 always prefill name in dashboard
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
2025-09-25 19:01:06 +02:00
Andrei Kvapil
b4c9ca36a9 fix keysAndTags for info
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
2025-09-25 19:01:06 +02:00
Andrei Kvapil
37f9065d55 Introduce module parameter
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
2025-09-25 19:01:06 +02:00
Andrei Kvapil
f130895b30 fix sidebars
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
2025-09-25 19:00:39 +02:00
Andrei Kvapil
907dcb5e8b [dashboard] Fix API group for the applications
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
2025-09-25 17:14:35 +02:00
Andrei Kvapil
d52a2fbe94 [dashboard] Fix /docs redirect (#1462)
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

## What this PR does


### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[]
```
2025-09-25 17:04:21 +02:00
Andrei Kvapil
f41ab0d251 [dashboard] Fix /docs redirect
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
2025-09-25 17:03:55 +02:00
Andrei Kvapil
58b7a6456c [dashboard] Add branding config (#1460)
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

## What this PR does


### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[]
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- New Features
- Introduces dynamic branding support. Tenant name, footer text, title,
logo text, logo SVG, and icon SVG can now be customized via cluster
configuration.
- Branding values are pulled automatically at runtime, enabling
per-tenant look and feel without app redeploys.
- Ensures consistent, centralized control over visual identity across
the dashboard.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-09-25 17:01:49 +02:00
Andrei Kvapil
772d663bc1 [cozystack-api] Specify tenantmodules labels (#1461)
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

## What this PR does


### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[]
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- New Features
- Tenant components are now consistently tagged as modules, enabling
clearer grouping, filtering, and management in dashboards and APIs.
- Improves discoverability and automation by making module scope
explicit across tenant services.

- Chores
- Standardized an internal module label across tenant releases and
system resource definitions (etcd, ingress, monitoring, SeaweedFS, info)
for consistency.
  - Metadata-only update with no runtime behavior changes.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-09-25 17:01:34 +02:00
Andrei Kvapil
e5c1cf97bd [cozystack-api] Specify tenantmodules labels
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
2025-09-25 16:37:19 +02:00
Andrei Kvapil
7605df5f29 [dashboard] Add branding config
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
2025-09-25 16:17:58 +02:00
Andrei Kvapil
df89117fa1 [dashboard] refactor dashboard configuration (#1457)
- Refactor code for dashboard resources creation
- Move dashboard-config helm chart to dynamic dashboard controller

<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

## What this PR does


### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[]
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Static dashboard resources (breadcrumbs, factories, forms, marketplace
panels, table mappings) are initialized at startup and materialized
automatically.

* **Improvements**
* Unified UI construction with consistent badges, headers and
deterministic IDs.
  * Automatic cleanup of stale/orphaned dashboard resources.
  * Increased controller client throughput for faster operations.

* **Refactor**
* Consolidated static dashboard resource generation into a unified,
config-driven flow.

* **Chores**
* Removed legacy dashboard-config templates; updated controller and
dashboard image digests.
  * Added dashboard ConfigMap and wired UI env vars to it.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-09-25 16:16:50 +02:00
Andrei Kvapil
9873011ebf [dashboard] refactor dashboard configuration
- Refactor code for dashboard resources creation
- Move dashboard-config helm chart to dynamic dashboard controller
- Move white-label configuration to separate configmap

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
2025-09-25 14:57:33 +02:00
Andrei Kvapil
b25aa10243 [dashboard] fix listing namespaces as unprivileged user (#1456)
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

## What this PR does


### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[]
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Improvements**
* Updated namespace data source to a new API, ensuring tenant namespaces
display correctly and stay in sync.

* **Bug Fixes**
* Improved reliability of streamed requests by removing problematic
headers, preventing errors during form-based operations.

* **Chores**
* Adjusted image build process to apply patches during build, enabling
quicker delivery of fixes without altering runtime behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-09-25 14:30:58 +02:00
Andrei Kvapil
f3b317ceea Update Cozystack screenshot (#1459)
ref https://github.com/cozystack/website/pull/335

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

## What this PR does


### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[]
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Updated README screenshot to use the dark-theme image, improving
visual consistency for viewers using dark mode.
* Purely presentational change — no impact on application behavior or
public interfaces.
* Clarifies repository appearance for users browsing in different
themes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-09-25 14:30:21 +02:00
Andrei Kvapil
16496e238a Update Cozystack screenshot
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
2025-09-25 14:28:22 +02:00
Timofei Larkin
c282d03330 [platform] Update lineage labels at upgrade (#1452)
## What this PR does

1. Since the VictoriaMetrics operator aggressively manages the metadata on
all owned components, the addition of labels by the lineage webhook
causes non-stop updates sent to the k8s API server. We mitigate this by
modifying the Monitoring Helm chart to set the `managedMetadata` field
on all VictoriaMetrics custom resources, where applicable.

2. This patch adds a migration script, that adds an annotation to all
resources that may be of interest, triggering an update event on the
lineage webhook. This will analyze the ancestor tree of these resources
and add labels to them, referencing their managing application.

3. This patch makes sure that migration #20 really uses the very latest
chart versions by forcing a reconcile with cozypkg, instead of
annotating the underlying HelmRelease.

### Release note

```release-note
[monitoring] Explicitly set lineage labels on VictoriaMetrics' resources
known not to play nice when something modifies their owned resources in
flight.
[platform] Add migration script to update pre-existing resources with
lineage labels.
[installer] Update cozypkg in installer and use it to bulletproof the
20th migration script by reconciling the HelmReleases with the
--with-source flag.
```

Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
2025-09-25 15:55:32 +04:00
Timofei Larkin
0f8a9ac9ef [installer] Update cozypkg and improve migration 20
This patch makes sure that migration #20 really uses the very latest
chart versions by forcing a reconcile with cozypkg, instead of
annotating the underlying HelmRelease.

```release-note
[installer] Update cozypkg in installer and use it to bulletproof the
20th migration script by reconciling the HelmReleases with the
--with-source flag.
```

Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
2025-09-25 12:03:22 +03:00
Timofei Larkin
21ca1349c4 [monitoring] Add lineage labels to VM components
Since the VictoriaMetrics operator aggressively manages the metadata on
all owned components, the addition of labels by the lineage webhook
causes non-stop updates sent to the k8s API server. We mitigate this by
modifying the Monitoring Helm chart to set the `managedMetadata` field
on all VictoriaMetrics custom resources, where applicable.

```release-note
[monitoring] Explicitly set lineage labels on VictoriaMetrics' resources
known not to play nice when something modifies their owned resources in
flight.
```

Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
2025-09-25 10:53:34 +03:00
Andrei Kvapil
23e59ea654 New dashboard based on OpenAPI schema (#1269)
A new dashboard based on https://github.com/PRO-Robotech/openapi-ui
project

<img width="1720" height="1373" alt="Screenshot 2025-08-01 at 09-01-00
OpenAPI UI"
src="https://github.com/user-attachments/assets/7ae04789-24ec-4e4b-830b-6f16e96513eb"
/>
<img width="1720" height="1373" alt="Screenshot 2025-08-01 at 09-01-14
OpenAPI UI"
src="https://github.com/user-attachments/assets/ca5aa85d-43f0-4b5b-b87a-3bc237834f10"
/>
<img width="1720" height="1373" alt="Screenshot 2025-08-01 at 09-02-05
OpenAPI UI"
src="https://github.com/user-attachments/assets/ebee7bfa-c3ac-4fe6-b5e1-43e9e7042c6a"
/>

<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[cozystack-api] Implement TenantNamespace, TenantModules, TenantSecret and TenantSecretsTable resources
[cozystack-controller] Introduce new dashboard-controller
[dashboard] Introduce new dashboard based on openapi-ui
```

Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
2025-09-25 00:07:07 +03:00
Andrei Kvapil
c81a1aa2b0 [dashboard] fix listing namespaces as unprivileged user
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
2025-09-24 21:38:12 +02:00
Andrei Kvapil
bb653e5a87 New dashboard based on OpenAPI schema (#1269)
A new dashboard based on https://github.com/PRO-Robotech/openapi-ui
project

<img width="1720" height="1373" alt="Screenshot 2025-08-01 at 09-01-00
OpenAPI UI"
src="https://github.com/user-attachments/assets/7ae04789-24ec-4e4b-830b-6f16e96513eb"
/>
<img width="1720" height="1373" alt="Screenshot 2025-08-01 at 09-01-14
OpenAPI UI"
src="https://github.com/user-attachments/assets/ca5aa85d-43f0-4b5b-b87a-3bc237834f10"
/>
<img width="1720" height="1373" alt="Screenshot 2025-08-01 at 09-02-05
OpenAPI UI"
src="https://github.com/user-attachments/assets/ebee7bfa-c3ac-4fe6-b5e1-43e9e7042c6a"
/>




<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

## What this PR does


### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[cozystack-api] Implement TenantNamespace, TenantModules, TenantSecret and TenantSecretsTable resources
[cozystack-controller] Introduce new dashboard-controller
[dashboard] Introduce new dashboard based on openapi-ui
```
2025-09-24 20:11:41 +02:00
Andrei Kvapil
0afc3c1e86 [cozystack-api] Implement TenantNamespace, TenantModules, TenantSecret and TenantSecretsTable resources
[cozystack-controller] Introduce new dashboard-controller
[dashboard] Introduce new dashboard based on openapi-ui

Co-authored-by: kklinch0 <kklinch0@gmail.com>
Signed-off-by: kklinch0 <kklinch0@gmail.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
2025-09-24 18:27:54 +02:00
Andrei Kvapil
789666d53b Remove versions_map logic (#1453)
TBD: How can we ensure that migrations were completed **before**
updating user-charts

## What this PR does

This PR removes logic for user apps versioning.
It is not needed anymore for new dashboard and does not make sence for
cozystack-api server, which always validates values accourding to the
latest spec from CozystackResourceDefinition.

### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[]
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- Chores
- Removed legacy version maps and packaging scripts (including
gen_versions_map and package_chart); pre-commit hook for versions
removed.
- Makefiles updated to unified chart discovery and shared env includes;
logo copy step removed and installer image no longer bundles logos.
- Many charts’ version fields replaced with build-time placeholders
(0.0.0); appVersion metadata added.

- Refactor
  - Added standardized fix-charts and repo targets for packaging.
- HelmRelease defaults tightened: explicit version constraints, longer
intervals/timeouts, remediation retries, and upgrade.force.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-09-24 17:33:13 +02:00
Andrei Kvapil
152ab20a17 Update linage webhook configuration (#1454)
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

## What this PR does


### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[]
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Expanded lineage webhook coverage to include WorkloadMonitor
resources, enabling automatic mutation and consistent metadata across
these workloads.
* Added mutation support for Ingresses, helping propagate lineage
metadata across HTTP entrypoints for improved traceability and
governance.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-09-24 17:20:38 +02:00
Andrei Kvapil
9f9d8f8530 Allign timeouts for HelmReleases
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
2025-09-24 16:54:17 +02:00
Andrei Kvapil
97f1b29975 Update linage webhook configuration
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
2025-09-24 14:58:16 +02:00
Andrei Kvapil
f871fbdb1e Remove versions_map logic
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
2025-09-24 12:32:37 +02:00
Andrei Kvapil
5d76e6b626 Feat/webhook workload monitors (#1448)
## What this PR does

Many resources created as part of managed apps in cozystack (pods,
secrets, etc) do not carry predictable labels that unambiguously
indicate which app originally triggered their creation. Some resources
are managed by controllers and other custom resources and this
indirection can lead to loss of information. Other controllers sometimes
simply do not allow setting labels on controlled resources and the
latter do not inherit labels from the owner. This patch implements a
webhook that sidesteps this problem with a universal solution. On
creation of a pod/secret/PVC etc it walks through the owner references
until a HelmRelease is found that can be matched with a managed app
dynamically registered in the Cozystack API server. The pod is mutated
with labels identifying the managed app. This resubmission of the PR now
includes semantics to compare secrets to label selectors in
CozystackResourceDefinitions to determine, whether they should be marked
as user-facing or not.

### Release note

```release-note
[cozystack-controller] Add a mutating webhook to identify the Cozystack
managed app that ultimately owns low-level resources created in the
cluster and label these resources with a reference to said app.
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- New Features
- Adds a lineage mutating webhook that auto-applies ancestry labels to
core resources and VMCluster.
- Introduces secret include/exclude selectors in resource definitions
for fine-grained tenant secret visibility.
- Deploys webhook service with TLS via cert-manager (issuers,
certificates) and updates deployment to expose webhook port.

- Chores
- Updates numerous container images to latest tags and digests across
system and app components (controller, dashboard, kubeovn, cilium,
kamaji, storage, etc.).

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-09-24 11:10:19 +02:00
Timofei Larkin
4620f7dfa1 [platform] Add secret selectors to CozyRDs
This patch populates existing CozystackResourceDefinitions with minimal
working examples of secret selectors to take advantage of the newest
revision of the ancestor tracking webhook.

```release-note
[platform] Specify secret selectors for existing managed apps in their
respective CozystackResourceDefinitions, which provides the last bit of
information necessary for the lineage webhook to correctly mark secrets
as user-facing or not.
```

Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
2025-09-24 12:07:21 +03:00
Timofei Larkin
562145e69b [cozystack-controller] Ancestor tracking webhook
Many resources created as part of managed apps in cozystack (pods,
secrets, etc) do not carry predictable labels that unambiguously
indicate which app originally triggered their creation. Some resources
are managed by controllers and other custom resources and this
indirection can lead to loss of information. Other controllers sometimes
simply do not allow setting labels on controlled resources and the
latter do not inherit labels from the owner. This patch implements a
webhook that sidesteps this problem with a universal solution. On
creation of a pod/secret/PVC etc it walks through the owner references
until a HelmRelease is found that can be matched with a managed app
dynamically registered in the Cozystack API server. The pod is mutated
with labels identifying the managed app.

```release-note
[cozystack-controller] Add a mutating webhook to identify the Cozystack
managed app that ultimately owns low-level resources created in the
cluster and label these resources with a reference to said app.
```

Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
2025-09-24 12:07:18 +03:00
Timofei Larkin
0e1f73999b [platform] Add secret selectors to app definitions
This patch expands the CozystackResourceDefinitions with new label
selector fields to include and exclude secrets by their labelsets.
This will enable application developers to selectively show or hide
application secrets to and from end-users.

```release-note
[platform] Add selectors for application secrets, offering developers
an API to control secret visibility for end users.
```

Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
2025-09-24 12:06:41 +03:00
Andrei Kvapil
744a0f3ca6 [platform] Mark some secrets as non-user-facing (#1446)
## What this PR does

Some k8s secrets created when deploying managed applications are
unhelpful to the end user or are outright not meant to be shown, because
they contain internal credentials not meant to be presented to the user.
This patch adds an `apps.cozystack.io/tenantresource=false` label to
such resources which will be later used to filter out such secrets in
the web UI.

### Release note

```release-note
[platform] Mark non-user-facing secrets as such to avoid clutter in the
dashboard and leaking internal credentials.
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Automatic creation of a ServiceAccount token Secret via the Info
add-on.

* **Improvements**
  * VPN TLS Secret CA field standardized to ca.crt for consistency.

* **Removals**
* Removed the explicit ServiceAccount token Secret from the Tenant app
(token now managed by Info).

* **Chores**
  * Added non-functional metadata labels to several Secrets.
  * Bumped chart/package metadata versions and updated version mappings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-09-24 11:04:54 +02:00
klinch0
3ac83ac48c [k8s] add expanding persistent volumes in tenant clusters (#1438)
<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

## What this PR does


### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
- add expanding persistent volumes in tenant clusters
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- New Features
- Enabled PersistentVolumeClaim expansion in the KubeVirt CSI
StorageClass.
- Added CSI resizer sidecar to the controller for online volume
resizing.
- Introduced cluster-scoped RBAC to allow required access to
PersistentVolumes.

- Chores
- Updated Kubernetes app chart to 0.29.2 and set app version to 1.32.6.
  - Upgraded KubeVirt CSI driver image to 0.37.0.
  - Refreshed versions map entries for the new release.
- Simplified CoreDNS configuration to use the default image repository.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-09-23 19:58:54 +03:00
Andrei Kvapil
d991c49254 [platform] Add secret selectors to app definitions (#1447)
## What this PR does

This patch expands the CozystackResourceDefinitions with new label
selector fields to include and exclude secrets by their labelsets. This
will enable application developers to selectively show or hide
application secrets to and from end-users.

### Release note

```release-note
[platform] Add selectors for application secrets, offering developers
an API to control secret visibility for end users.
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added support for configuring secret visibility on resource
definitions using include/exclude label selectors. This lets you
precisely control which secrets are considered without affecting
existing setups.
* The configuration is optional; if not set, behavior remains unchanged.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-09-23 18:29:56 +02:00
Timofei Larkin
48919c0cfe [platform] Add secret selectors to app definitions
This patch expands the CozystackResourceDefinitions with new label
selector fields to include and exclude secrets by their labelsets.
This will enable application developers to selectively show or hide
application secrets to and from end-users.

```release-note
[platform] Add selectors for application secrets, offering developers
an API to control secret visibility for end users.
```

Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
2025-09-23 17:37:26 +03:00
Timofei Larkin
7e4883dfcc [platform] Mark some secrets as non-user-facing
Some k8s secrets created when deploying managed applications are
unhelpful to the end user or are outright not meant to be shown, because
they contain internal credentials not meant to be presented to the user.
This patch adds an `apps.cozystack.io/tenantresource=false` label to
such resources which will be later used to filter out such secrets in
the web UI.

```release-note
[platform] Mark non-user-facing secrets as such to avoid clutter in the
dashboard and leaking internal credentials.
```

Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
2025-09-23 15:09:18 +03:00
Andrei Kvapil
66b53cb1ae [vm-disk] New SVG icon (#1435)
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Co-authored-by: Viktoriia Kvapil
<159528100+kvapsova@users.noreply.github.com>

<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

## What this PR does


### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[]
```
2025-09-22 16:29:58 +02:00
Andrei Kvapil
6005b76e96 [dashboard] Fix FerretDB spec (#1440)
## What this PR does

Due to a typo in the spec, the dashboard couldn't deploy or display
instances of FerretDB. This patch fixes the typo.

### Release note

```release-note
[dashboard] Fix FerretDB management in the web UI.
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- Bug Fixes
- Corrected FerretDB resource pluralization to “ferretdbs,” aligning
with Kubernetes conventions. This ensures resources display and behave
correctly in the dashboard, preventing discovery issues and errors in
listing, navigation, and management.
- Improves reliability of installs and upgrades with Flux/Helm workflows
by matching expected resource names. No other FerretDB settings were
changed, maintaining backward compatibility for existing configurations.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-09-22 16:29:17 +02:00
Timofei Larkin
e34d9613c7 [dashboard] Fix FerretDB spec
Due to a typo in the spec, the dashboard couldn't deploy or display
instances of FerretDB. This patch fixes the typo.

```release-note
[dashboard] Fix FerretDB management in the web UI.
```

Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
2025-09-22 16:15:18 +03:00
Nick Volynkin
2fcf975e6a [docs] Changelogs for v0.36.*
Signed-off-by: Nick Volynkin <nick.volynkin@gmail.com>
2025-09-22 09:46:16 +03:00
kklinch0
ca19529c7d [k8s] add expanding persistent volumes in tenant clusters
Signed-off-by: kklinch0 <kklinch0@gmail.com>
2025-09-20 14:10:00 +03:00
Andrei Kvapil
b3be1f4e1e [vm-disk] New SVG icon
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Co-authored-by: Viktoriia Kvapil <159528100+kvapsova@users.noreply.github.com>
2025-09-18 16:27:38 +02:00
Nick Volynkin
b7bebecb64 [docs] Changelogs for v0.35.*
Signed-off-by: Nick Volynkin <nick.volynkin@gmail.com>
2025-09-18 09:15:03 +03:00
Andrei Kvapil
53fbe7c2ee Release v0.36.1 (#1434)
This PR prepares the release `v0.36.1`.
2025-09-18 05:26:48 +02:00
cozystack-bot
18ff789256 Prepare release v0.36.1
Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
2025-09-18 02:58:44 +00:00
Andrei Kvapil
3d02fbfba4 [cozystack-api] Update defaulting API schemas (#1433)
## What this PR does


### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[cozystack-api] Update defaulting API schemas
```
2025-09-18 04:54:07 +02:00
Andrei Kvapil
8c6fc68367 [cozystack-api] Update defaulting API schemas
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
2025-09-18 04:49:50 +02:00
Andrei Kvapil
9d2fe2605f [cozystack-api] Implement Kubernetes-like defaulting (#1432)
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

## What this PR does


### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[]
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Application specs now get recursive, Kubernetes-like defaulting:
missing fields in nested objects and arrays are auto-populated safely
without mutating shared defaults.
- No changes to public APIs; existing manifests remain compatible while
gaining broader defaulting.

- **Tests**
- Added unit tests validating defaulting behavior, per-item defaults,
and non-creation of absent keys.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-09-18 03:01:39 +02:00