Release v0.32.0 (#1074 )

This PR prepares the release `v0.32.0`.
[tests] fix avaiting for vm-disk
2026-02-04 16:05:52 +00:00 · 2025-06-17 11:30:28 +02:00 · 2025-06-17 10:32:59 +02:00 · 2025-06-16 23:54:35 +00:00 · 2025-06-17 01:50:32 +02:00 · 2025-06-17 01:38:17 +02:00
113 changed files with 982 additions and 389 deletions
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -30,12 +30,13 @@ jobs:
        run: |
          sudo apt update
          sudo apt install curl -y
-          curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash -
          sudo apt install nodejs -y
-          git clone https://github.com/bitnami/readme-generator-for-helm
+          sudo apt install npm -y
+
+          git clone --branch 2.7.0 --depth 1 https://github.com/bitnami/readme-generator-for-helm.git
          cd ./readme-generator-for-helm
          npm install
-          npm install -g pkg
+          npm install -g @yao-pkg/pkg
          pkg . -o /usr/local/bin/readme-generator

      - name: Run pre-commit hooks
--- a/README.md
+++ b/README.md
@@ -12,11 +12,15 @@

 **Cozystack** is a free PaaS platform and framework for building clouds.

+Cozystack is a [CNCF Sandbox Level Project](https://www.cncf.io/sandbox-projects/) that was originally built and sponsored by [Ænix](https://aenix.io/).
+
 With Cozystack, you can transform a bunch of servers into an intelligent system with a simple REST API for spawning Kubernetes clusters,
 Database-as-a-Service, virtual machines, load balancers, HTTP caching services, and other services with ease.

 Use Cozystack to build your own cloud or provide a cost-effective development environment.  

+![Cozystack user interface](https://cozystack.io/img/screenshot.png)
+
 ## Use-Cases

 * [**Using Cozystack to build a public cloud**](https://cozystack.io/docs/guides/use-cases/public-cloud/)  
@@ -28,9 +32,6 @@ You can use Cozystack as a platform to build a private cloud powered by Infrastr
 * [**Using Cozystack as a Kubernetes distribution**](https://cozystack.io/docs/guides/use-cases/kubernetes-distribution/)  
 You can use Cozystack as a Kubernetes distribution for Bare Metal

-## Screenshot
-
-![Cozystack screenshot](https://cozystack.io/img/screenshot.png)

 ## Documentation

@@ -59,7 +60,10 @@ Commits are used to generate the changelog, and their author will be referenced

 If you have **Feature Requests** please use the [Discussion's Feature Request section](https://github.com/cozystack/cozystack/discussions/categories/feature-requests).

-You are welcome to join our weekly community meetings (just add this events to your [Google Calendar](https://calendar.google.com/calendar?cid=ZTQzZDIxZTVjOWI0NWE5NWYyOGM1ZDY0OWMyY2IxZTFmNDMzZTJlNjUzYjU2ZGJiZGE3NGNhMzA2ZjBkMGY2OEBncm91cC5jYWxlbmRhci5nb29nbGUuY29t) or [iCal](https://calendar.google.com/calendar/ical/e43d21e5c9b45a95f28c5d649c2cb1e1f433e2e653b56dbbda74ca306f0d0f68%40group.calendar.google.com/public/basic.ics)) or [Telegram group](https://t.me/cozystack).
+## Community
+
+You are welcome to join our [Telegram group](https://t.me/cozystack) and come to our weekly community meetings.
+Add them to your [Google Calendar](https://calendar.google.com/calendar?cid=ZTQzZDIxZTVjOWI0NWE5NWYyOGM1ZDY0OWMyY2IxZTFmNDMzZTJlNjUzYjU2ZGJiZGE3NGNhMzA2ZjBkMGY2OEBncm91cC5jYWxlbmRhci5nb29nbGUuY29t) or [iCal](https://calendar.google.com/calendar/ical/e43d21e5c9b45a95f28c5d649c2cb1e1f433e2e653b56dbbda74ca306f0d0f68%40group.calendar.google.com/public/basic.ics) for convenience.

 ## License

--- a/hack/e2e-apps.bats
+++ b/hack/e2e-apps.bats
@@ -1,4 +1,5 @@
 #!/usr/bin/env bats
+
 # -----------------------------------------------------------------------------
 # Cozystack end‑to‑end provisioning test (Bats)
 # -----------------------------------------------------------------------------
@@ -92,3 +93,247 @@ EOF
  kubectl wait machinedeployment kubernetes-test-md0 -n tenant-test --timeout=1m --for=jsonpath='{.status.replicas}'=2
  kubectl wait machinedeployment kubernetes-test-md0 -n tenant-test --timeout=10m --for=jsonpath='{.status.v1beta2.readyReplicas}'=2
 }
+
+@test "Create a VM Disk" {
+  name='test'
+  kubectl create -f - <<EOF
+apiVersion: apps.cozystack.io/v1alpha1
+kind: VMDisk
+metadata:
+  name: $name
+  namespace: tenant-test
+spec:
+  source:
+    http:
+      url: https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img
+  optical: false
+  storage: 5Gi
+  storageClass: replicated
+EOF
+  sleep 5
+  kubectl -n tenant-test wait hr vm-disk-$name --timeout=5s --for=condition=ready
+  kubectl -n tenant-test annotate pvc vm-disk-test cdi.kubevirt.io/storage.bind.immediate.requested=true
+  kubectl -n tenant-test wait dv vm-disk-$name --timeout=100s --for=condition=ready
+  kubectl -n tenant-test wait pvc vm-disk-$name --timeout=100s --for=jsonpath='{.status.phase}'=Bound
+}
+
+@test "Create a VM Instance" {
+  diskName='test'
+  name='test'
+  kubectl create -f - <<EOF
+apiVersion: apps.cozystack.io/v1alpha1
+kind: VMInstance
+metadata:
+  name: $name
+  namespace: tenant-test
+spec:
+  external: false
+  externalMethod: PortList
+  externalPorts:
+  - 22
+  running: true
+  instanceType: "u1.medium"
+  instanceProfile: ubuntu
+  disks:
+    - name: $diskName
+  gpus: []
+  resources:
+    cpu: ""
+    memory: ""
+  sshKeys:
+  - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPht0dPk5qQ+54g1hSX7A6AUxXJW5T6n/3d7Ga2F8gTF
+    test@test
+  cloudInit: |
+    #cloud-config
+    users:
+      - name: test
+        shell: /bin/bash
+        sudo: ['ALL=(ALL) NOPASSWD: ALL']
+        groups: sudo
+        ssh_authorized_keys:
+          - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPht0dPk5qQ+54g1hSX7A6AUxXJW5T6n/3d7Ga2F8gTF test@test
+  cloudInitSeed: ""
+EOF
+  sleep 5
+  timeout 20 sh -ec "until kubectl -n tenant-test get vmi vm-instance-$name -o jsonpath='{.status.interfaces[0].ipAddress}' | grep -q '[0-9]'; do sleep 5; done"
+  kubectl -n tenant-test wait hr vm-instance-$name --timeout=5s --for=condition=ready
+  kubectl -n tenant-test wait vm vm-instance-$name --timeout=20s --for=condition=ready
+}
+
+@test "Create a Virtual Machine" {
+  name='test'
+  kubectl create -f - <<EOF
+apiVersion: apps.cozystack.io/v1alpha1
+kind: VirtualMachine
+metadata:
+  name: $name
+  namespace: tenant-test
+spec:
+  external: false
+  externalMethod: PortList
+  externalPorts:
+  - 22
+  instanceType: "u1.medium"
+  instanceProfile: ubuntu
+  systemDisk:
+    image: ubuntu
+    storage: 5Gi
+    storageClass: replicated
+  gpus: []
+  resources:
+    cpu: ""
+    memory: ""
+  sshKeys:
+  - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPht0dPk5qQ+54g1hSX7A6AUxXJW5T6n/3d7Ga2F8gTF
+    test@test
+  cloudInit: |
+    #cloud-config
+    users:
+      - name: test
+        shell: /bin/bash
+        sudo: ['ALL=(ALL) NOPASSWD: ALL']
+        groups: sudo
+        ssh_authorized_keys:
+          - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPht0dPk5qQ+54g1hSX7A6AUxXJW5T6n/3d7Ga2F8gTF test@test
+  cloudInitSeed: ""
+EOF
+  sleep 5
+  kubectl -n tenant-test wait hr virtual-machine-$name --timeout=10s --for=condition=ready
+  kubectl -n tenant-test wait dv virtual-machine-$name --timeout=100s --for=condition=ready
+  kubectl -n tenant-test wait pvc virtual-machine-$name --timeout=100s --for=jsonpath='{.status.phase}'=Bound
+  kubectl -n tenant-test wait vm virtual-machine-$name --timeout=100s --for=condition=ready
+  timeout 120 sh -ec "until kubectl -n tenant-test get vmi virtual-machine-$name -o jsonpath='{.status.interfaces[0].ipAddress}' | grep -q '[0-9]'; do sleep 10; done"
+}
+
+@test "Create DB PostgreSQL" {
+  name='test'
+  kubectl create -f - <<EOF
+apiVersion: apps.cozystack.io/v1alpha1
+kind: Postgres
+metadata:
+  name: $name
+  namespace: tenant-test
+spec:
+  external: false
+  size: 10Gi
+  replicas: 2
+  storageClass: ""
+  postgresql:
+    parameters:
+      max_connections: 100
+  quorum:
+    minSyncReplicas: 0
+    maxSyncReplicas: 0
+  users:
+    testuser:
+      password: xai7Wepo
+  databases:
+    testdb:
+      roles:
+        admin:
+        - testuser
+  backup:
+    enabled: false
+    s3Region: us-east-1
+    s3Bucket: s3.example.org/postgres-backups
+    schedule: "0 2 * * *"
+    cleanupStrategy: "--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
+    s3AccessKey: oobaiRus9pah8PhohL1ThaeTa4UVa7gu
+    s3SecretKey: ju3eum4dekeich9ahM1te8waeGai0oog
+    resticPassword: ChaXoveekoh6eigh4siesheeda2quai0
+  resources: {}
+  resourcesPreset: "nano"
+EOF
+  sleep 5
+  kubectl -n tenant-test wait hr postgres-$name --timeout=50s --for=condition=ready
+  kubectl -n tenant-test wait job.batch postgres-$name-init-job --timeout=50s --for=condition=Complete
+  timeout 40 sh -ec "until kubectl -n tenant-test get svc postgres-$name-r -o jsonpath='{.spec.ports[0].port}' | grep -q '5432'; do sleep 10; done"
+  timeout 40 sh -ec "until kubectl -n tenant-test get svc postgres-$name-ro -o jsonpath='{.spec.ports[0].port}' | grep -q '5432'; do sleep 10; done"
+  timeout 40 sh -ec "until kubectl -n tenant-test get svc postgres-$name-rw -o jsonpath='{.spec.ports[0].port}' | grep -q '5432'; do sleep 10; done"
+  timeout 120 sh -ec "until kubectl -n tenant-test get endpoints postgres-$name-r -o jsonpath='{.subsets[*].addresses[*].ip}' | grep -q '[0-9]'; do sleep 10; done"
+  timeout 120 sh -ec "until kubectl -n tenant-test get endpoints postgres-$name-ro -o jsonpath='{.subsets[*].addresses[*].ip}' | grep -q '[0-9]'; do sleep 10; done"
+  timeout 120 sh -ec "until kubectl -n tenant-test get endpoints postgres-$name-rw -o jsonpath='{.subsets[*].addresses[*].ip}' | grep -q '[0-9]'; do sleep 10; done"
+}
+
+@test "Create DB MySQL" {
+  name='test'
+  kubectl create -f- <<EOF
+apiVersion: apps.cozystack.io/v1alpha1
+kind: MySQL
+metadata:
+  name: $name
+  namespace: tenant-test
+spec:
+  external: false
+  size: 10Gi
+  replicas: 2
+  storageClass: ""
+  users:
+    testuser:
+      maxUserConnections: 1000
+      password: xai7Wepo
+  databases:
+    testdb:
+      roles:
+        admin:
+        - testuser
+  backup:
+    enabled: false
+    s3Region: us-east-1
+    s3Bucket: s3.example.org/postgres-backups
+    schedule: "0 2 * * *"
+    cleanupStrategy: "--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
+    s3AccessKey: oobaiRus9pah8PhohL1ThaeTa4UVa7gu
+    s3SecretKey: ju3eum4dekeich9ahM1te8waeGai0oog
+    resticPassword: ChaXoveekoh6eigh4siesheeda2quai0
+  resources: {}
+  resourcesPreset: "nano"
+EOF
+  sleep 5
+  kubectl -n tenant-test wait hr mysql-$name --timeout=30s --for=condition=ready
+  timeout 80 sh -ec "until kubectl -n tenant-test get svc mysql-$name -o jsonpath='{.spec.ports[0].port}' | grep -q '3306'; do sleep 10; done"
+  timeout 40 sh -ec "until kubectl -n tenant-test get endpoints mysql-$name -o jsonpath='{.subsets[*].addresses[*].ip}' | grep -q '[0-9]'; do sleep 10; done"
+  kubectl -n tenant-test wait statefulset.apps/mysql-$name --timeout=110s --for=jsonpath='{.status.replicas}'=2
+  timeout 80 sh -ec "until kubectl -n tenant-test get svc mysql-$name-metrics -o jsonpath='{.spec.ports[0].port}' | grep -q '9104'; do sleep 10; done"
+  timeout 40 sh -ec "until kubectl -n tenant-test get endpoints mysql-$name-metrics -o jsonpath='{.subsets[*].addresses[*].ip}' | grep -q '[0-9]'; do sleep 10; done"
+  kubectl -n tenant-test wait deployment.apps/mysql-$name-metrics --timeout=90s --for=jsonpath='{.status.replicas}'=1
+}
+
+@test "Create DB ClickHouse" {
+  name='test'
+  kubectl create -f- <<EOF
+apiVersion: apps.cozystack.io/v1alpha1
+kind: ClickHouse
+metadata:
+  name: $name
+  namespace: tenant-test
+spec:
+  size: 10Gi
+  logStorageSize: 2Gi
+  shards: 1
+  replicas: 2
+  storageClass: ""
+  logTTL: 15
+  users:
+    testuser:
+      password: xai7Wepo
+  backup:
+    enabled: false
+    s3Region: us-east-1
+    s3Bucket: s3.example.org/clickhouse-backups
+    schedule: "0 2 * * *"
+    cleanupStrategy: "--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
+    s3AccessKey: oobaiRus9pah8PhohL1ThaeTa4UVa7gu
+    s3SecretKey: ju3eum4dekeich9ahM1te8waeGai0oog
+    resticPassword: ChaXoveekoh6eigh4siesheeda2quai0
+  resources: {}
+  resourcesPreset: "nano"
+EOF
+  sleep 5
+  kubectl -n tenant-test wait hr clickhouse-$name --timeout=20s --for=condition=ready
+  timeout 100 sh -ec "until kubectl -n tenant-test get svc chendpoint-clickhouse-$name -o jsonpath='{.spec.ports[*].port}' | grep -q '8123 9000'; do sleep 10; done"
+  kubectl -n tenant-test wait statefulset.apps/chi-clickhouse-$name-clickhouse-0-0 --timeout=120s --for=jsonpath='{.status.replicas}'=2
+  timeout 80 sh -ec "until kubectl -n tenant-test get endpoints chi-clickhouse-$name-clickhouse-0-0 -o jsonpath='{.subsets[*].addresses[*].ip}' | grep -q '[0-9]'; do sleep 10; done"
+  timeout 100 sh -ec "until kubectl -n tenant-test get svc chi-clickhouse-$name-clickhouse-0-0 -o jsonpath='{.spec.ports[0].port}' | grep -q '9000 8123 9009'; do sleep 10; done"
+  kubectl -n tenant-test wait statefulset.apps/chi-clickhouse-$name-clickhouse-0-1 --timeout=140s --for=jsonpath='{.status.replicas}'=2
+}
--- a/hack/e2e-cluster.bats
+++ b/hack/e2e-cluster.bats
@@ -102,7 +102,7 @@ EOF

@test "Boot QEMU VMs" {
  for i in 1 2 3; do
-    qemu-system-x86_64 -machine type=pc,accel=kvm -cpu host -smp 8 -m 16384 \
+    qemu-system-x86_64 -machine type=pc,accel=kvm -cpu host -smp 8 -m 24576 \
      -device virtio-net,netdev=net0,mac=52:54:00:12:34:5${i} \
      -netdev tap,id=net0,ifname=cozy-srv${i},script=no,downscript=no \
      -drive file=srv${i}/system.img,if=virtio,format=raw \
--- a/packages/apps/bucket/Chart.yaml
+++ b/packages/apps/bucket/Chart.yaml
@@ -16,10 +16,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.0
+version: 0.2.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "0.1.0"
+appVersion: "0.2.0"
--- a/packages/apps/bucket/charts/cozy-lib
+++ b/packages/apps/bucket/charts/cozy-lib
@@ -0,0 +1 @@
+../../../library/cozy-lib
--- a/packages/apps/bucket/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/bucket/templates/dashboard-resourcemap.yaml
@@ -18,3 +18,14 @@ rules:
  resourceNames:
  - {{ .Release.Name }}-ui
  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
--- a/packages/apps/clickhouse/Chart.yaml
+++ b/packages/apps/clickhouse/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.9.2
+version: 0.10.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/clickhouse/README.md
+++ b/packages/apps/clickhouse/README.md
@@ -1,32 +1,35 @@
 # Managed Clickhouse Service

+ClickHouse is an open source high-performance and column-oriented SQL database management system (DBMS).
+It is used for online analytical processing (OLAP).
+Cozystack platform uses Altinity operator to provide ClickHouse.
+
 ### How to restore backup:

-find snapshot:
-```
-restic -r s3:s3.example.org/clickhouse-backups/table_name snapshots
-```
+1. Find a snapshot:
+    ```
+    restic -r s3:s3.example.org/clickhouse-backups/table_name snapshots
+    ```

-restore:
-```
-restic -r s3:s3.example.org/clickhouse-backups/table_name restore latest --target /tmp/
-```
+2.  Restore it:
+    ```
+    restic -r s3:s3.example.org/clickhouse-backups/table_name restore latest --target /tmp/
+    ```

-more details:
- https://itnext.io/restic-effective-backup-from-stdin-4bc1e8f083c1
+For more details, read [Restic: Effective Backup from Stdin](https://blog.aenix.io/restic-effective-backup-from-stdin-4bc1e8f083c1).

 ## Parameters

 ### Common parameters

-| Name             | Description                         | Value  |
-| ---------------- | ----------------------------------- | ------ |
-| `size`           | Persistent Volume size              | `10Gi` |
-| `logStorageSize` | Persistent Volume for logs size     | `2Gi`  |
-| `shards`         | Number of Clickhouse replicas       | `1`    |
-| `replicas`       | Number of Clickhouse shards         | `2`    |
-| `storageClass`   | StorageClass used to store the data | `""`   |
-| `logTTL`         | for query_log and query_thread_log  | `15`   |
+| Name             | Description                                              | Value  |
+| ---------------- | -------------------------------------------------------- | ------ |
+| `size`           | Size of Persistent Volume for data                       | `10Gi` |
+| `logStorageSize` | Size of Persistent Volume for logs                       | `2Gi`  |
+| `shards`         | Number of Clickhouse shards                              | `1`    |
+| `replicas`       | Number of Clickhouse replicas                            | `2`    |
+| `storageClass`   | StorageClass used to store the data                      | `""`   |
+| `logTTL`         | TTL (expiration time) for query_log and query_thread_log | `15`   |

 ### Configuration parameters

@@ -36,15 +39,32 @@ more details:

 ### Backup parameters

-| Name                     | Description                                                                                                                                                                                                       | Value                                                  |
-| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------ |
-| `backup.enabled`         | Enable pereiodic backups                                                                                                                                                                                          | `false`                                                |
-| `backup.s3Region`        | The AWS S3 region where backups are stored                                                                                                                                                                        | `us-east-1`                                            |
-| `backup.s3Bucket`        | The S3 bucket used for storing backups                                                                                                                                                                            | `s3.example.org/clickhouse-backups`                    |
-| `backup.schedule`        | Cron schedule for automated backups                                                                                                                                                                               | `0 2 * * *`                                            |
-| `backup.cleanupStrategy` | The strategy for cleaning up old backups                                                                                                                                                                          | `--keep-last=3 --keep-daily=3 --keep-within-weekly=1m` |
-| `backup.s3AccessKey`     | The access key for S3, used for authentication                                                                                                                                                                    | `oobaiRus9pah8PhohL1ThaeTa4UVa7gu`                     |
-| `backup.s3SecretKey`     | The secret key for S3, used for authentication                                                                                                                                                                    | `ju3eum4dekeich9ahM1te8waeGai0oog`                     |
-| `backup.resticPassword`  | The password for Restic backup encryption                                                                                                                                                                         | `ChaXoveekoh6eigh4siesheeda2quai0`                     |
-| `resources`              | Resources                                                                                                                                                                                                         | `{}`                                                   |
-| `resourcesPreset`        | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production). | `nano`                                                 |
+| Name                     | Description                                                                 | Value                                                  |
+| ------------------------ | --------------------------------------------------------------------------- | ------------------------------------------------------ |
+| `backup.enabled`         | Enable periodic backups                                                     | `false`                                                |
+| `backup.s3Region`        | AWS S3 region where backups are stored                                      | `us-east-1`                                            |
+| `backup.s3Bucket`        | S3 bucket used for storing backups                                          | `s3.example.org/clickhouse-backups`                    |
+| `backup.schedule`        | Cron schedule for automated backups                                         | `0 2 * * *`                                            |
+| `backup.cleanupStrategy` | Retention strategy for cleaning up old backups                              | `--keep-last=3 --keep-daily=3 --keep-within-weekly=1m` |
+| `backup.s3AccessKey`     | Access key for S3, used for authentication                                  | `oobaiRus9pah8PhohL1ThaeTa4UVa7gu`                     |
+| `backup.s3SecretKey`     | Secret key for S3, used for authentication                                  | `ju3eum4dekeich9ahM1te8waeGai0oog`                     |
+| `backup.resticPassword`  | Password for Restic backup encryption                                       | `ChaXoveekoh6eigh4siesheeda2quai0`                     |
+| `resources`              | Explicit CPU/memory resource requests and limits for the Clickhouse service | `{}`                                                   |
+| `resourcesPreset`        | Use a common resources preset when `resources` is not set explicitly.       | `nano`                                                 |
+
+
+In production environments, it's recommended to set `resources` explicitly.
+Example of `resources`:
+
+```yaml
+resources:
+  limits:
+    cpu: 4000m
+    memory: 4Gi
+  requests:
+    cpu: 100m
+    memory: 512Mi
+```
+
+Allowed values for `resourcesPreset` are `none`, `nano`, `micro`, `small`, `medium`, `large`, `xlarge`, `2xlarge`.
+This value is ignored if `resources` value is set. 
--- a/packages/apps/clickhouse/images/clickhouse-backup.tag
+++ b/packages/apps/clickhouse/images/clickhouse-backup.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/clickhouse-backup:0.9.2@sha256:3faf7a4cebf390b9053763107482de175aa0fdb88c1e77424fd81100b1c3a205
+ghcr.io/cozystack/cozystack/clickhouse-backup:0.10.0@sha256:3faf7a4cebf390b9053763107482de175aa0fdb88c1e77424fd81100b1c3a205
--- a/packages/apps/clickhouse/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/clickhouse/templates/dashboard-resourcemap.yaml
@@ -24,3 +24,14 @@ rules:
  resourceNames:
  - {{ .Release.Name }}
  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
--- a/packages/apps/clickhouse/values.schema.json
+++ b/packages/apps/clickhouse/values.schema.json
@@ -4,22 +4,22 @@
    "properties": {
        "size": {
            "type": "string",
-            "description": "Persistent Volume size",
+            "description": "Size of Persistent Volume for data",
            "default": "10Gi"
        },
        "logStorageSize": {
            "type": "string",
-            "description": "Persistent Volume for logs size",
+            "description": "Size of Persistent Volume for logs",
            "default": "2Gi"
        },
        "shards": {
            "type": "number",
-            "description": "Number of Clickhouse replicas",
+            "description": "Number of Clickhouse shards",
            "default": 1
        },
        "replicas": {
            "type": "number",
-            "description": "Number of Clickhouse shards",
+            "description": "Number of Clickhouse replicas",
            "default": 2
        },
        "storageClass": {
@@ -29,7 +29,7 @@
        },
        "logTTL": {
            "type": "number",
-            "description": "for query_log and query_thread_log",
+            "description": "TTL (expiration time) for query_log and query_thread_log",
            "default": 15
        },
        "backup": {
@@ -37,17 +37,17 @@
            "properties": {
                "enabled": {
                    "type": "boolean",
-                    "description": "Enable pereiodic backups",
+                    "description": "Enable periodic backups",
                    "default": false
                },
                "s3Region": {
                    "type": "string",
-                    "description": "The AWS S3 region where backups are stored",
+                    "description": "AWS S3 region where backups are stored",
                    "default": "us-east-1"
                },
                "s3Bucket": {
                    "type": "string",
-                    "description": "The S3 bucket used for storing backups",
+                    "description": "S3 bucket used for storing backups",
                    "default": "s3.example.org/clickhouse-backups"
                },
                "schedule": {
@@ -57,34 +57,34 @@
                },
                "cleanupStrategy": {
                    "type": "string",
-                    "description": "The strategy for cleaning up old backups",
+                    "description": "Retention strategy for cleaning up old backups",
                    "default": "--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
                },
                "s3AccessKey": {
                    "type": "string",
-                    "description": "The access key for S3, used for authentication",
+                    "description": "Access key for S3, used for authentication",
                    "default": "oobaiRus9pah8PhohL1ThaeTa4UVa7gu"
                },
                "s3SecretKey": {
                    "type": "string",
-                    "description": "The secret key for S3, used for authentication",
+                    "description": "Secret key for S3, used for authentication",
                    "default": "ju3eum4dekeich9ahM1te8waeGai0oog"
                },
                "resticPassword": {
                    "type": "string",
-                    "description": "The password for Restic backup encryption",
+                    "description": "Password for Restic backup encryption",
                    "default": "ChaXoveekoh6eigh4siesheeda2quai0"
                }
            }
        },
        "resources": {
            "type": "object",
-            "description": "Resources",
+            "description": "Explicit CPU/memory resource requests and limits for the Clickhouse service",
            "default": {}
        },
        "resourcesPreset": {
            "type": "string",
-            "description": "Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production).",
+            "description": "Use a common resources preset when `resources` is not set explicitly.",
            "default": "nano"
        }
    }
--- a/packages/apps/clickhouse/values.yaml
+++ b/packages/apps/clickhouse/values.yaml
@@ -1,11 +1,11 @@
 ## @section Common parameters

-## @param size Persistent Volume size
-## @param logStorageSize Persistent Volume for logs size
-## @param shards Number of Clickhouse replicas
-## @param replicas Number of Clickhouse shards
+## @param size Size of Persistent Volume for data
+## @param logStorageSize Size of Persistent Volume for logs
+## @param shards Number of Clickhouse shards
+## @param replicas Number of Clickhouse replicas
 ## @param storageClass StorageClass used to store the data
-## @param logTTL for query_log and query_thread_log
+## @param logTTL TTL (expiration time) for query_log and query_thread_log
 ##
 size: 10Gi
 logStorageSize: 2Gi
@@ -29,14 +29,14 @@ users: {}

 ## @section Backup parameters

-## @param backup.enabled Enable pereiodic backups
-## @param backup.s3Region The AWS S3 region where backups are stored
-## @param backup.s3Bucket The S3 bucket used for storing backups
+## @param backup.enabled Enable periodic backups
+## @param backup.s3Region AWS S3 region where backups are stored
+## @param backup.s3Bucket S3 bucket used for storing backups
 ## @param backup.schedule Cron schedule for automated backups
-## @param backup.cleanupStrategy The strategy for cleaning up old backups
-## @param backup.s3AccessKey The access key for S3, used for authentication
-## @param backup.s3SecretKey The secret key for S3, used for authentication
-## @param backup.resticPassword The password for Restic backup encryption
+## @param backup.cleanupStrategy Retention strategy for cleaning up old backups
+## @param backup.s3AccessKey Access key for S3, used for authentication
+## @param backup.s3SecretKey Secret key for S3, used for authentication
+## @param backup.resticPassword Password for Restic backup encryption
 backup:
  enabled: false
  s3Region: us-east-1
@@ -47,7 +47,7 @@ backup:
  s3SecretKey: ju3eum4dekeich9ahM1te8waeGai0oog
  resticPassword: ChaXoveekoh6eigh4siesheeda2quai0

-## @param resources Resources
+## @param resources Explicit CPU/memory resource requests and limits for the Clickhouse service
 resources: {}
 # resources:
 #   limits:
@@ -56,6 +56,6 @@ resources: {}
 #   requests:
 #     cpu: 100m
 #     memory: 512Mi
- 
-## @param resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production).
+
+## @param resourcesPreset Use a common resources preset when `resources` is not set explicitly.
 resourcesPreset: "nano"
--- a/packages/apps/ferretdb/Chart.yaml
+++ b/packages/apps/ferretdb/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.6.1
+version: 0.7.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/ferretdb/images/postgres-backup.tag
+++ b/packages/apps/ferretdb/images/postgres-backup.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/postgres-backup:0.12.1@sha256:10179ed56457460d95cd5708db2a00130901255fa30c4dd76c65d2ef5622b61f
+ghcr.io/cozystack/cozystack/postgres-backup:0.14.0@sha256:10179ed56457460d95cd5708db2a00130901255fa30c4dd76c65d2ef5622b61f
--- a/packages/apps/ferretdb/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/ferretdb/templates/dashboard-resourcemap.yaml
@@ -24,3 +24,14 @@ rules:
  resourceNames:
  - {{ .Release.Name }}
  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
--- a/packages/apps/kafka/Chart.yaml
+++ b/packages/apps/kafka/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.6.1
+version: 0.7.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/kafka/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/kafka/templates/dashboard-resourcemap.yaml
@@ -25,3 +25,14 @@ rules:
  - {{ .Release.Name }}
  - {{ $.Release.Name }}-zookeeper
  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
--- a/packages/apps/kubernetes/Chart.yaml
+++ b/packages/apps/kubernetes/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.23.2
+version: 0.24.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/kubernetes/README.md
+++ b/packages/apps/kubernetes/README.md
@@ -110,16 +110,16 @@ See the reference for components utilized in this service:

 ### Kubernetes Control Plane Configuration

-| Name                                               | Description                                                                  | Value   |
-| -------------------------------------------------- | ---------------------------------------------------------------------------- | ------- |
-| `controlPlane.apiServer.resources`                 | Explicit CPU/memory resource requests and limits for the API server.         | `{}`    |
-| `controlPlane.apiServer.resourcesPreset`           | Use a common resources preset when `resources` is not set explicitly.        | `small` |
-| `controlPlane.controllerManager.resources`         | Explicit CPU/memory resource requests and limits for the controller manager. | `{}`    |
-| `controlPlane.controllerManager.resourcesPreset`   | Use a common resources preset when `resources` is not set explicitly.        | `micro` |
-| `controlPlane.scheduler.resources`                 | Explicit CPU/memory resource requests and limits for the scheduler.          | `{}`    |
-| `controlPlane.scheduler.resourcesPreset`           | Use a common resources preset when `resources` is not set explicitly.        | `micro` |
-| `controlPlane.konnectivity.server.resources`       | Explicit CPU/memory resource requests and limits for the Konnectivity.       | `{}`    |
-| `controlPlane.konnectivity.server.resourcesPreset` | Use a common resources preset when `resources` is not set explicitly.        | `micro` |
+| Name                                               | Description                                                                  | Value    |
+| -------------------------------------------------- | ---------------------------------------------------------------------------- | -------- |
+| `controlPlane.apiServer.resources`                 | Explicit CPU/memory resource requests and limits for the API server.         | `{}`     |
+| `controlPlane.apiServer.resourcesPreset`           | Use a common resources preset when `resources` is not set explicitly.        | `medium` |
+| `controlPlane.controllerManager.resources`         | Explicit CPU/memory resource requests and limits for the controller manager. | `{}`     |
+| `controlPlane.controllerManager.resourcesPreset`   | Use a common resources preset when `resources` is not set explicitly.        | `micro`  |
+| `controlPlane.scheduler.resources`                 | Explicit CPU/memory resource requests and limits for the scheduler.          | `{}`     |
+| `controlPlane.scheduler.resourcesPreset`           | Use a common resources preset when `resources` is not set explicitly.        | `micro`  |
+| `controlPlane.konnectivity.server.resources`       | Explicit CPU/memory resource requests and limits for the Konnectivity.       | `{}`     |
+| `controlPlane.konnectivity.server.resourcesPreset` | Use a common resources preset when `resources` is not set explicitly.        | `micro`  |

 In production environments, it's recommended to set `resources` explicitly.
 Example of `controlPlane.*.resources`:
--- a/packages/apps/kubernetes/charts/cozy-lib
+++ b/packages/apps/kubernetes/charts/cozy-lib
@@ -0,0 +1 @@
+../../../library/cozy-lib
--- a/packages/apps/kubernetes/images/cluster-autoscaler.tag
+++ b/packages/apps/kubernetes/images/cluster-autoscaler.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/cluster-autoscaler:0.23.1@sha256:7315850634728a5864a3de3150c12f0e1454f3f1ce33cdf21a278f57611dd5e9
+ghcr.io/cozystack/cozystack/cluster-autoscaler:0.24.0@sha256:3a8170433e1632e5cc2b6d9db34d0605e8e6c63c158282c38450415e700e932e
--- a/packages/apps/kubernetes/images/kubevirt-cloud-provider.tag
+++ b/packages/apps/kubernetes/images/kubevirt-cloud-provider.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-cloud-provider:0.23.1@sha256:6962bdf51ab2ff40b420b9cff7c850aeea02187da2a65a67f10e0471744649d7
+ghcr.io/cozystack/cozystack/kubevirt-cloud-provider:0.24.0@sha256:b478952fab735f85c3ba15835012b1de8af5578b33a8a2670eaf532ffc17681e
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.23.1@sha256:b1525163cd21938ac934bb1b860f2f3151464fa463b82880ab058167aeaf3e29
+ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.24.0@sha256:4d3728b2050d4e0adb00b9f4abbb4a020b29e1a39f24ca1447806fc81f110fa6
--- a/packages/apps/kubernetes/images/ubuntu-container-disk.tag
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.32@sha256:290264eba144c5c58f68009b17f59a5990f6fafbf768f9cbefd7050c34733930
+ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.32@sha256:e53f2394c7aa76ad10818ffb945e40006cd77406999e47e036d41b8b0bf094cc
--- a/packages/apps/kubernetes/templates/cluster.yaml
+++ b/packages/apps/kubernetes/templates/cluster.yaml
@@ -121,21 +121,21 @@ metadata:
 spec:
  apiServer:
    {{- if .Values.controlPlane.apiServer.resources }}
-    resources: {{- toYaml .Values.controlPlane.apiServer.resources | nindent 6 }}
+    resources: {{- include "cozy-lib.resources.sanitize" (list .Values.controlPlane.apiServer.resources $) | nindent 6 }}
    {{- else if ne .Values.controlPlane.apiServer.resourcesPreset "none" }}
-    resources: {{- include "resources.preset" (dict "type" .Values.controlPlane.apiServer.resourcesPreset "Release" .Release) | nindent 6 }}
+    resources: {{- include "cozy-lib.resources.preset" (list .Values.controlPlane.apiServer.resourcesPreset $) | nindent 6 }}
    {{- end }}
  controllerManager:
    {{- if .Values.controlPlane.controllerManager.resources }}
-    resources: {{- toYaml .Values.controlPlane.controllerManager.resources | nindent 6 }}
+    resources: {{- include "cozy-lib.resources.sanitize" (list .Values.controlPlane.controllerManager.resources $) | nindent 6 }}
    {{- else if ne .Values.controlPlane.controllerManager.resourcesPreset "none" }}
-    resources: {{- include "resources.preset" (dict "type" .Values.controlPlane.controllerManager.resourcesPreset "Release" .Release) | nindent 6 }}
+    resources: {{- include "cozy-lib.resources.preset" (list .Values.controlPlane.controllerManager.resourcesPreset $) | nindent 6 }}
    {{- end }}
  scheduler:
    {{- if .Values.controlPlane.scheduler.resources }}
-    resources: {{- toYaml .Values.controlPlane.scheduler.resources | nindent 6 }}
+    resources: {{- include "cozy-lib.resources.sanitize" (list .Values.controlPlane.scheduler.resources $) | nindent 6 }}
    {{- else if ne .Values.controlPlane.scheduler.resourcesPreset "none" }}
-    resources: {{- include "resources.preset" (dict "type" .Values.controlPlane.scheduler.resourcesPreset "Release" .Release) | nindent 6 }}
+    resources: {{- include "cozy-lib.resources.preset" (list .Values.controlPlane.scheduler.resourcesPreset $) | nindent 6 }}
    {{- end }}
  dataStoreName: "{{ $etcd }}"
  addons:
@@ -146,9 +146,9 @@ spec:
      server:
        port: 8132
        {{- if .Values.controlPlane.konnectivity.server.resources }}
-        resources: {{- toYaml .Values.controlPlane.konnectivity.server.resources | nindent 10 }}
+        resources: {{- include "cozy-lib.resources.sanitize" (list .Values.controlPlane.konnectivity.server.resources $) | nindent 10 }}
        {{- else if ne .Values.controlPlane.konnectivity.server.resourcesPreset "none" }}
-        resources: {{- include "resources.preset" (dict "type" .Values.controlPlane.konnectivity.server.resourcesPreset "Release" .Release) | nindent 10 }}
+        resources: {{- include "cozy-lib.resources.preset" (list .Values.controlPlane.konnectivity.server.resourcesPreset $) | nindent 10 }}
        {{- end }}
  kubelet:
    cgroupfs: systemd
--- a/packages/apps/kubernetes/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/kubernetes/templates/dashboard-resourcemap.yaml
@@ -34,3 +34,14 @@ rules:
  - {{ $.Release.Name }}-{{ $groupName }}
  {{- end }}
  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
--- a/packages/apps/kubernetes/values.schema.json
+++ b/packages/apps/kubernetes/values.schema.json
@@ -26,7 +26,7 @@
            "resourcesPreset": {
              "type": "string",
              "description": "Use a common resources preset when `resources` is not set explicitly.",
-              "default": "small",
+              "default": "medium",
              "enum": [
                "none",
                "nano",
--- a/packages/apps/kubernetes/values.yaml
+++ b/packages/apps/kubernetes/values.yaml
@@ -123,7 +123,7 @@ controlPlane:
    ##     cpu: 100m
    ##     memory: 512Mi
    ##
-    resourcesPreset: "small"
+    resourcesPreset: "medium"
    resources: {}

  controllerManager:
--- a/packages/apps/mysql/Chart.yaml
+++ b/packages/apps/mysql/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.7.1
+version: 0.8.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/mysql/images/mariadb-backup.tag
+++ b/packages/apps/mysql/images/mariadb-backup.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/mariadb-backup:0.7.1@sha256:cfd1c37d8ad24e10681d82d6e6ce8a641b4602c1b0ffa8516ae15b4958bb12d4
+ghcr.io/cozystack/cozystack/mariadb-backup:0.8.0@sha256:cfd1c37d8ad24e10681d82d6e6ce8a641b4602c1b0ffa8516ae15b4958bb12d4
--- a/packages/apps/mysql/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/mysql/templates/dashboard-resourcemap.yaml
@@ -25,3 +25,14 @@ rules:
  resourceNames:
  - {{ .Release.Name }}
  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
--- a/packages/apps/nats/Chart.yaml
+++ b/packages/apps/nats/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.6.1
+version: 0.7.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/nats/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/nats/templates/dashboard-resourcemap.yaml
@@ -24,3 +24,14 @@ rules:
  resourceNames:
  - {{ .Release.Name }}
  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
--- a/packages/apps/postgres/Chart.yaml
+++ b/packages/apps/postgres/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.12.1
+version: 0.14.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/postgres/images/postgres-backup.tag
+++ b/packages/apps/postgres/images/postgres-backup.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/postgres-backup:0.12.1@sha256:10179ed56457460d95cd5708db2a00130901255fa30c4dd76c65d2ef5622b61f
+ghcr.io/cozystack/cozystack/postgres-backup:0.14.0@sha256:10179ed56457460d95cd5708db2a00130901255fa30c4dd76c65d2ef5622b61f
--- a/packages/apps/postgres/templates/_postgresjobs.tpl
+++ b/packages/apps/postgres/templates/_postgresjobs.tpl
@@ -0,0 +1,11 @@
+{{/*
+Generate resource requirements based on ResourceQuota named as the namespace.
+*/}}
+{{- define "postgresjobs.defaultResources" }}
+cpu: "1"
+memory: 512Mi
+{{- end }}
+{{- define "postgresjobs.resources" }}
+resources:
+{{ include "cozy-lib.resources.sanitize" (list (include "postgresjobs.defaultResources" $ | fromYaml) $) | nindent 2 }}
+{{- end }}
--- a/packages/apps/postgres/templates/backup-cronjob.yaml
+++ b/packages/apps/postgres/templates/backup-cronjob.yaml
@@ -81,6 +81,7 @@ spec:
              privileged: false
              readOnlyRootFilesystem: true
              runAsNonRoot: true
+            {{- include "postgresjobs.resources" . | nindent 12 }}
          volumes:
          - name: scripts
            secret:
--- a/packages/apps/postgres/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/postgres/templates/dashboard-resourcemap.yaml
@@ -26,3 +26,14 @@ rules:
  resourceNames:
  - {{ .Release.Name }}
  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
--- a/packages/apps/postgres/templates/init-job.yaml
+++ b/packages/apps/postgres/templates/init-job.yaml
@@ -50,6 +50,7 @@ spec:
          name: secret
        - mountPath: /scripts
          name: scripts
+        {{- include "postgresjobs.resources" . | nindent 8 }}
      securityContext:
        fsGroup: 26
        runAsGroup: 26
--- a/packages/apps/rabbitmq/Chart.yaml
+++ b/packages/apps/rabbitmq/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.6.0
+version: 0.7.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/rabbitmq/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/rabbitmq/templates/dashboard-resourcemap.yaml
@@ -27,3 +27,14 @@ rules:
  resourceNames:
  - {{ .Release.Name }}
  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
--- a/packages/apps/redis/Chart.yaml
+++ b/packages/apps/redis/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.7.1
+version: 0.8.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/redis/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/redis/templates/dashboard-resourcemap.yaml
@@ -28,3 +28,14 @@ rules:
  - {{ .Release.Name }}-redis
  - {{ .Release.Name }}-sentinel
  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
--- a/packages/apps/tenant/Chart.yaml
+++ b/packages/apps/tenant/Chart.yaml
@@ -4,4 +4,4 @@ description: Separated tenant namespace
 icon: /logos/tenant.svg

 type: application
-version: 1.9.3
+version: 1.10.0
--- a/packages/apps/tenant/charts/cozy-lib
+++ b/packages/apps/tenant/charts/cozy-lib
@@ -0,0 +1 @@
+../../../library/cozy-lib
--- a/packages/apps/tenant/templates/tenant.yaml
+++ b/packages/apps/tenant/templates/tenant.yaml
@@ -23,8 +23,8 @@ metadata:
  namespace: {{ include "tenant.name" . }}
 rules:
 - apiGroups: [""]
-  resources: ["*"]
-  verbs: ["get", "list", "watch", "create", "update", "patch"]
+  resources: ["pods", "services", "persistentvolumes", "endpoints", "events", "resourcequotas"]
+  verbs: ["get", "list", "watch"]
 - apiGroups: ["networking.k8s.io"]
  resources: ["ingresses"]
  verbs: ["get", "list", "watch"]
@@ -94,7 +94,12 @@ rules:
  - apiGroups:
      - ""
    resources:
-      - "*"
+      - pods
+      - services
+      - persistentvolumes
+      - endpoints
+      - events
+      - resourcequotas
    verbs:
      - get
      - list
@@ -119,24 +124,7 @@ metadata:
  name: {{ include "tenant.name" . }}-view
  namespace: {{ include "tenant.name" . }}
 subjects:
-{{- if ne .Release.Namespace "tenant-root" }}
- kind: Group
-  name: tenant-root-view
-  apiGroup: rbac.authorization.k8s.io
-{{- end }}
- kind: Group
-  name: {{ include "tenant.name" . }}-view
-  apiGroup: rbac.authorization.k8s.io
-{{- if hasPrefix "tenant-" .Release.Namespace }}
-{{- $parts := splitList "-" .Release.Namespace }}
-{{- range $i, $v := $parts }}
-{{- if ne $i 0 }}
- kind: Group
-  name: {{ join "-" (slice $parts 0 (add $i 1)) }}-view
-  apiGroup: rbac.authorization.k8s.io
-{{- end }}
-{{- end }}
-{{- end }}
+{{ include "cozy-lib.rbac.subjectsForTenant" (list "view" (include "tenant.name" .)) | nindent 2 }}
 roleRef:
  kind: Role
  name: {{ include "tenant.name" . }}-view
@@ -165,7 +153,12 @@ rules:
    - watch
  - apiGroups: [""]
    resources:
-    - "*"
+      - pods
+      - services
+      - persistentvolumes
+      - endpoints
+      - events
+      - resourcequotas
    verbs:
    - get
    - list
@@ -202,24 +195,7 @@ metadata:
  name: {{ include "tenant.name" . }}-use
  namespace: {{ include "tenant.name" . }}
 subjects:
-{{- if ne .Release.Namespace "tenant-root" }}
- kind: Group
-  name: tenant-root-use
-  apiGroup: rbac.authorization.k8s.io
-{{- end }}
- kind: Group
-  name: {{ include "tenant.name" . }}-use
-  apiGroup: rbac.authorization.k8s.io
-{{- if hasPrefix "tenant-" .Release.Namespace }}
-{{- $parts := splitList "-" .Release.Namespace }}
-{{- range $i, $v := $parts }}
-{{- if ne $i 0 }}
- kind: Group
-  name: {{ join "-" (slice $parts 0 (add $i 1)) }}-use
-  apiGroup: rbac.authorization.k8s.io
-{{- end }}
-{{- end }}
-{{- end }}
+{{ include "cozy-lib.rbac.subjectsForTenant" (list "use" (include "tenant.name" .)) | nindent 2 }}
 roleRef:
  kind: Role
  name: {{ include "tenant.name" . }}-use
@@ -240,7 +216,12 @@ rules:
    - get
  - apiGroups: [""]
    resources:
-    - "*"
+      - pods
+      - services
+      - persistentvolumes
+      - endpoints
+      - events
+      - resourcequotas
    verbs:
    - get
    - list
@@ -305,24 +286,7 @@ metadata:
  name: {{ include "tenant.name" . }}-admin
  namespace: {{ include "tenant.name" . }}
 subjects:
-{{- if ne .Release.Namespace "tenant-root" }}
- kind: Group
-  name: tenant-root-admin
-  apiGroup: rbac.authorization.k8s.io
-{{- end }}
- kind: Group
-  name: {{ include "tenant.name" . }}-admin
-  apiGroup: rbac.authorization.k8s.io
-{{- if hasPrefix "tenant-" .Release.Namespace }}
-{{- $parts := splitList "-" .Release.Namespace }}
-{{- range $i, $v := $parts }}
-{{- if ne $i 0 }}
- kind: Group
-  name: {{ join "-" (slice $parts 0 (add $i 1)) }}-admin
-  apiGroup: rbac.authorization.k8s.io
-{{- end }}
-{{- end }}
-{{- end }}
+{{ include "cozy-lib.rbac.subjectsForTenant" (list "admin" (include "tenant.name" .)) | nindent 2 }}
 roleRef:
  kind: Role
  name: {{ include "tenant.name" . }}-admin
@@ -343,7 +307,12 @@ rules:
    - get
  - apiGroups: [""]
    resources:
-    - "*"
+      - pods
+      - services
+      - persistentvolumes
+      - endpoints
+      - events
+      - resourcequotas
    verbs:
    - get
    - list
@@ -384,24 +353,7 @@ metadata:
  name: {{ include "tenant.name" . }}-super-admin
  namespace: {{ include "tenant.name" . }}
 subjects:
-{{- if ne .Release.Namespace "tenant-root" }}
- kind: Group
-  name: tenant-root-super-admin
-  apiGroup: rbac.authorization.k8s.io
-{{- end }}
- kind: Group
-  name: {{ include "tenant.name" . }}-super-admin
-  apiGroup: rbac.authorization.k8s.io
-{{- if hasPrefix "tenant-" .Release.Namespace }}
-{{- $parts := splitList "-" .Release.Namespace }}
-{{- range $i, $v := $parts }}
-{{- if ne $i 0 }}
- kind: Group
-  name: {{ join "-" (slice $parts 0 (add $i 1)) }}-super-admin
-  apiGroup: rbac.authorization.k8s.io
-{{- end }}
-{{- end }}
-{{- end }}
+{{ include "cozy-lib.rbac.subjectsForTenant" (list "super-admin" (include "tenant.name" .) ) | nindent 2 }}
 roleRef:
  kind: Role
  name: {{ include "tenant.name" . }}-super-admin
--- a/packages/apps/versions_map
+++ b/packages/apps/versions_map
@@ -1,4 +1,5 @@
-bucket 0.1.0 HEAD
+bucket 0.1.0 632224a3
+bucket 0.2.0 HEAD
 clickhouse 0.1.0 f7eaab0a
 clickhouse 0.2.0 53f2365e
 clickhouse 0.2.1 dfbc210b
@@ -10,7 +11,8 @@ clickhouse 0.6.1 c62a83a7
 clickhouse 0.6.2 8267072d
 clickhouse 0.7.0 93bdf411
 clickhouse 0.9.0 6130f43d
-clickhouse 0.9.2 HEAD
+clickhouse 0.9.2 632224a3
+clickhouse 0.10.0 HEAD
 ferretdb 0.1.0 e9716091
 ferretdb 0.1.1 91b0499a
 ferretdb 0.2.0 6c5cf5bf
@@ -20,7 +22,8 @@ ferretdb 0.4.1 1ec10165
 ferretdb 0.4.2 8267072d
 ferretdb 0.5.0 93bdf411
 ferretdb 0.6.0 6130f43d
-ferretdb 0.6.1 HEAD
+ferretdb 0.6.1 632224a3
+ferretdb 0.7.0 HEAD
 http-cache 0.1.0 263e47be
 http-cache 0.2.0 53f2365e
 http-cache 0.3.0 6c5cf5bf
@@ -40,39 +43,9 @@ kafka 0.3.3 8267072d
 kafka 0.4.0 85ec09b8
 kafka 0.5.0 93bdf411
 kafka 0.6.0 6130f43d
-kafka 0.6.1 HEAD
-kubernetes 0.1.0 263e47be
-kubernetes 0.2.0 53f2365e
-kubernetes 0.3.0 007d414f
-kubernetes 0.4.0 d7cfa53c
-kubernetes 0.5.0 dfbc210b
-kubernetes 0.6.0 5bbc488e
-kubernetes 0.7.0 e9716091
-kubernetes 0.8.0 ac11056e
-kubernetes 0.8.1 366bcafc
-kubernetes 0.8.2 f81be075
-kubernetes 0.9.0 6c5cf5bf
-kubernetes 0.10.0 b8e33d19
-kubernetes 0.11.0 4b90bf5a
-kubernetes 0.11.1 5fb9cfe3
-kubernetes 0.12.0 bb985806
-kubernetes 0.12.1 28fca4ef
-kubernetes 0.13.0 1ec10165
-kubernetes 0.14.0 bfbde07c
-kubernetes 0.14.1 898374b5
-kubernetes 0.15.0 4e68e65c
-kubernetes 0.15.1 160e4e2a
-kubernetes 0.15.2 8267072d
-kubernetes 0.16.0 077045b0
-kubernetes 0.17.0 1fbbfcd0
-kubernetes 0.17.1 fd240701
-kubernetes 0.18.0 721c12a7
-kubernetes 0.19.0 93bdf411
-kubernetes 0.20.0 609e7ede
-kubernetes 0.20.1 f9f8bb2f
-kubernetes 0.21.0 6130f43d
-kubernetes 0.23.1 632224a3
-kubernetes 0.23.2 HEAD
+kafka 0.6.1 632224a3
+kafka 0.7.0 HEAD
+kubernetes 0.24.0 HEAD
 mysql 0.1.0 263e47be
 mysql 0.2.0 c24a103f
 mysql 0.3.0 53f2365e
@@ -83,7 +56,8 @@ mysql 0.5.2 1ec10165
 mysql 0.5.3 8267072d
 mysql 0.6.0 93bdf411
 mysql 0.7.0 6130f43d
-mysql 0.7.1 HEAD
+mysql 0.7.1 632224a3
+mysql 0.8.0 HEAD
 nats 0.1.0 e9716091
 nats 0.2.0 6c5cf5bf
 nats 0.3.0 78366f19
@@ -92,7 +66,8 @@ nats 0.4.0 898374b5
 nats 0.4.1 8267072d
 nats 0.5.0 93bdf411
 nats 0.6.0 6130f43d
-nats 0.6.1 HEAD
+nats 0.6.1 632224a3
+nats 0.7.0 HEAD
 postgres 0.1.0 263e47be
 postgres 0.2.0 53f2365e
 postgres 0.2.1 d7cfa53c
@@ -110,7 +85,8 @@ postgres 0.10.0 721c12a7
 postgres 0.10.1 93bdf411
 postgres 0.11.0 f9f8bb2f
 postgres 0.12.0 6130f43d
-postgres 0.12.1 HEAD
+postgres 0.12.1 632224a3
+postgres 0.14.0 HEAD
 rabbitmq 0.1.0 263e47be
 rabbitmq 0.2.0 53f2365e
 rabbitmq 0.3.0 6c5cf5bf
@@ -120,7 +96,8 @@ rabbitmq 0.4.2 4b90bf5a
 rabbitmq 0.4.3 1ec10165
 rabbitmq 0.4.4 8267072d
 rabbitmq 0.5.0 93bdf411
-rabbitmq 0.6.0 HEAD
+rabbitmq 0.6.0 632224a3
+rabbitmq 0.7.0 HEAD
 redis 0.1.1 263e47be
 redis 0.2.0 53f2365e
 redis 0.3.0 6c5cf5bf
@@ -129,36 +106,14 @@ redis 0.4.0 84f3ccc0
 redis 0.5.0 4e68e65c
 redis 0.6.0 93bdf411
 redis 0.7.0 6130f43d
-redis 0.7.1 HEAD
+redis 0.7.1 632224a3
+redis 0.8.0 HEAD
 tcp-balancer 0.1.0 263e47be
 tcp-balancer 0.2.0 53f2365e
 tcp-balancer 0.3.0 93bdf411
 tcp-balancer 0.4.0 6130f43d
 tcp-balancer 0.4.1 HEAD
-tenant 0.1.4 afc997ef
-tenant 0.1.5 e3ab858a
-tenant 1.0.0 263e47be
-tenant 1.1.0 c0685f43
-tenant 1.2.0 dfbc210b
-tenant 1.3.0 e9716091
-tenant 1.3.1 91b0499a
-tenant 1.4.0 71514249
-tenant 1.5.0 1ec10165
-tenant 1.6.0 df448b99
-tenant 1.6.1 c62a83a7
-tenant 1.6.2 898374b5
-tenant 1.6.3 2057bb96
-tenant 1.6.4 84f3ccc0
-tenant 1.6.5 fde4bcfa
-tenant 1.6.6 4e68e65c
-tenant 1.6.7 0ab39f20
-tenant 1.6.8 bc95159a
-tenant 1.7.0 24fa7222
-tenant 1.8.0 160e4e2a
-tenant 1.9.0 728743db
-tenant 1.9.1 721c12a7
-tenant 1.9.2 6130f43d
-tenant 1.9.3 HEAD
+tenant 1.10.0 HEAD
 virtual-machine 0.1.4 f2015d65
 virtual-machine 0.1.5 263e47be
 virtual-machine 0.2.0 c0685f43
@@ -174,10 +129,12 @@ virtual-machine 0.8.2 de19450f
 virtual-machine 0.9.0 721c12a7
 virtual-machine 0.9.1 93bdf411
 virtual-machine 0.10.0 6130f43d
-virtual-machine 0.10.2 HEAD
+virtual-machine 0.10.2 632224a3
+virtual-machine 0.11.0 HEAD
 vm-disk 0.1.0 d971f2ff
 vm-disk 0.1.1 6130f43d
-vm-disk 0.1.2 HEAD
+vm-disk 0.1.2 632224a3
+vm-disk 0.2.0 HEAD
 vm-instance 0.1.0 1ec10165
 vm-instance 0.2.0 84f3ccc0
 vm-instance 0.3.0 4e68e65c
@@ -187,11 +144,13 @@ vm-instance 0.5.0 3fa4dd3a
 vm-instance 0.5.1 de19450f
 vm-instance 0.6.0 721c12a7
 vm-instance 0.7.0 6130f43d
-vm-instance 0.7.2 HEAD
+vm-instance 0.7.2 632224a3
+vm-instance 0.8.0 HEAD
 vpn 0.1.0 263e47be
 vpn 0.2.0 53f2365e
 vpn 0.3.0 6c5cf5bf
 vpn 0.3.1 1ec10165
 vpn 0.4.0 93bdf411
 vpn 0.5.0 6130f43d
-vpn 0.5.1 HEAD
+vpn 0.5.1 632224a3
+vpn 0.6.1 HEAD
--- a/packages/apps/virtual-machine/Chart.yaml
+++ b/packages/apps/virtual-machine/Chart.yaml
@@ -17,10 +17,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.10.2
+version: 0.11.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: 0.10.0
+appVersion: 0.11.0
--- a/packages/apps/virtual-machine/charts/cozy-lib
+++ b/packages/apps/virtual-machine/charts/cozy-lib
@@ -0,0 +1 @@
+../../../library/cozy-lib
--- a/packages/apps/virtual-machine/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/virtual-machine/templates/dashboard-resourcemap.yaml
@@ -11,6 +11,17 @@ rules:
  - {{ .Release.Name }}
  verbs: ["get", "list", "watch"]
 ---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
+---
 apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
--- a/packages/apps/vm-disk/Chart.yaml
+++ b/packages/apps/vm-disk/Chart.yaml
@@ -16,10 +16,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.2
+version: 0.2.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: 0.1.1
+appVersion: 0.2.0
--- a/packages/apps/vm-disk/charts/cozy-lib
+++ b/packages/apps/vm-disk/charts/cozy-lib
@@ -0,0 +1 @@
+../../../library/cozy-lib
--- a/packages/apps/vm-disk/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/vm-disk/templates/dashboard-resourcemap.yaml
@@ -10,3 +10,14 @@ rules:
  resourceNames:
  - {{ .Release.Name }}
  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
--- a/packages/apps/vm-instance/Chart.yaml
+++ b/packages/apps/vm-instance/Chart.yaml
@@ -17,10 +17,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.7.2
+version: 0.8.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: 0.7.0
+appVersion: 0.8.0
--- a/packages/apps/vm-instance/charts/cozy-lib
+++ b/packages/apps/vm-instance/charts/cozy-lib
@@ -0,0 +1 @@
+../../../library/cozy-lib
--- a/packages/apps/vm-instance/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/vm-instance/templates/dashboard-resourcemap.yaml
@@ -11,6 +11,17 @@ rules:
  - {{ .Release.Name }}
  verbs: ["get", "list", "watch"]
 ---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
+---
 apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
--- a/packages/apps/vpn/Chart.yaml
+++ b/packages/apps/vpn/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.5.1
+version: 0.6.1

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/vpn/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/vpn/templates/dashboard-resourcemap.yaml
@@ -17,3 +17,14 @@ rules:
  resourceNames:
  - {{ .Release.Name }}-vpn
  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
--- a/packages/core/installer/Makefile
+++ b/packages/core/installer/Makefile
@@ -9,13 +9,13 @@ pre-checks:
 	../../../hack/pre-checks.sh

 show:
-	helm template -n $(NAMESPACE) $(NAME) .
+	cozypkg show -n $(NAMESPACE) $(NAME) --plain

 apply:
-	helm template -n $(NAMESPACE) $(NAME) . | kubectl apply -f -
+	cozypkg show -n $(NAMESPACE) $(NAME) --plain | kubectl apply -f-

 diff:
-	helm template -n $(NAMESPACE) $(NAME) . | kubectl diff -f -
+	cozypkg show -n $(NAMESPACE) $(NAME) --plain | kubectl diff -f -

 update:
 	hack/gen-profiles.sh
@@ -23,7 +23,6 @@ update:
 image: pre-checks image-matchbox image-cozystack image-talos

 image-cozystack:
-	make -C ../../.. repos
 	docker buildx build -f images/cozystack/Dockerfile ../../.. \
 		--provenance false \
 		--tag $(REGISTRY)/installer:$(call settag,$(TAG)) \
--- a/packages/core/installer/images/cozystack/Dockerfile
+++ b/packages/core/installer/images/cozystack/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:alpine3.21 as k8s-await-election-builder
+FROM golang:1.24-alpine as k8s-await-election-builder

 ARG K8S_AWAIT_ELECTION_GITREPO=https://github.com/LINBIT/k8s-await-election
 ARG K8S_AWAIT_ELECTION_VERSION=0.4.1
@@ -13,7 +13,10 @@ RUN git clone ${K8S_AWAIT_ELECTION_GITREPO} /usr/local/go/k8s-await-election/ \
 && make \
 && mv ./out/k8s-await-election-${TARGETARCH} /k8s-await-election

-FROM golang:alpine3.21 as builder
+FROM golang:1.24-alpine as builder
+
+ARG TARGETOS
+ARG TARGETARCH

 RUN apk add --no-cache make git
 RUN apk add helm --repository=https://dl-cdn.alpinelinux.org/alpine/edge/community
@@ -21,26 +24,26 @@ RUN apk add helm --repository=https://dl-cdn.alpinelinux.org/alpine/edge/communi
 COPY . /src/
 WORKDIR /src

+RUN go mod download
+
 RUN go build -o /cozystack-assets-server -ldflags '-extldflags "-static" -w -s' ./cmd/cozystack-assets-server

-# Check that versions_map is not changed
 RUN make repos

-FROM alpine:3.21
+FROM alpine:3.22

-RUN apk add --no-cache make
-RUN apk add helm kubectl --repository=https://dl-cdn.alpinelinux.org/alpine/edge/community
-RUN apk add yq
-RUN apk add coreutils
+RUN wget -O- https://github.com/cozystack/cozypkg/raw/refs/heads/main/hack/install.sh | sh -s -- -v 1.1.0

-COPY scripts /cozystack/scripts
+RUN apk add --no-cache make kubectl coreutils
+
+COPY --from=builder /src/scripts /cozystack/scripts
 COPY --from=builder /src/packages/core /cozystack/packages/core
 COPY --from=builder /src/packages/system /cozystack/packages/system
 COPY --from=builder /src/_out/repos /cozystack/assets/repos
 COPY --from=builder /src/_out/logos /cozystack/assets/logos
 COPY --from=builder /cozystack-assets-server /usr/bin/cozystack-assets-server
 COPY --from=k8s-await-election-builder /k8s-await-election /usr/bin/k8s-await-election
-COPY dashboards /cozystack/assets/dashboards
+COPY --from=builder /src/dashboards /cozystack/assets/dashboards

 WORKDIR /cozystack
 ENTRYPOINT ["/usr/bin/k8s-await-election", "/cozystack/scripts/installer.sh" ]
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -1,2 +1,2 @@
 cozystack:
-  image: ghcr.io/cozystack/cozystack/installer:v0.32.0-beta.1@sha256:57e449187e4f76c3346de7646b4fe11c7136e63216b05ebd7171f8fd5cb077d2
+  image: ghcr.io/cozystack/cozystack/installer:v0.32.0@sha256:981f1a073fa654f878e448ea89ef324f50d2479f27d3228449e8b66fda7c567f
--- a/packages/core/platform/Makefile
+++ b/packages/core/platform/Makefile
@@ -1,23 +1,20 @@
 NAME=platform
 NAMESPACE=cozy-system

-API_VERSIONS_FLAGS=$(addprefix -a ,$(shell kubectl api-versions))
-
 show:
-	helm template -n $(NAMESPACE) $(NAME) . --dry-run=server $(API_VERSIONS_FLAGS)
+	cozypkg show -n $(NAMESPACE) $(NAME) --plain

 apply:
-	helm template -n $(NAMESPACE) $(NAME) . --dry-run=server $(API_VERSIONS_FLAGS) \
-		| kubectl apply -f-
+	cozypkg show -n $(NAMESPACE) $(NAME) --plain | kubectl apply -f-
 	kubectl delete helmreleases.helm.toolkit.fluxcd.io -l cozystack.io/marked-for-deletion=true -A

 reconcile: apply

 namespaces-show:
-	helm template -n $(NAMESPACE) $(NAME) . --dry-run=server $(API_VERSIONS_FLAGS) -s templates/namespaces.yaml
+	cozypkg show -n $(NAMESPACE) $(NAME) --plain -s templates/namespaces.yaml

 namespaces-apply:
-	helm template -n $(NAMESPACE) $(NAME) . --dry-run=server $(API_VERSIONS_FLAGS) -s templates/namespaces.yaml | kubectl apply -n $(NAMESPACE) -f-
+	cozypkg show -n $(NAMESPACE) $(NAME) --plain -s templates/namespaces.yaml | kubectl apply -f-

 diff:
-	helm template -n $(NAMESPACE) $(NAME) . --dry-run=server $(API_VERSIONS_FLAGS) | kubectl diff -f-
+	cozypkg show -n $(NAMESPACE) $(NAME) --plain | kubectl diff -f-
--- a/packages/core/platform/bundles/distro-full.yaml
+++ b/packages/core/platform/bundles/distro-full.yaml
@@ -179,7 +179,7 @@ releases:
  releaseName: snapshot-controller
  chart: cozy-snapshot-controller
  namespace: cozy-snapshot-controller
-  dependsOn: [cilium,cert-manager-issuers]
+  dependsOn: [cilium]

 - name: objectstorage-controller
  releaseName: objectstorage-controller
--- a/packages/core/testing/images/e2e-sandbox/Dockerfile
+++ b/packages/core/testing/images/e2e-sandbox/Dockerfile
@@ -17,3 +17,5 @@ RUN curl -sSL "https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm
 RUN curl -sSL "https://github.com/mikefarah/yq/releases/download/v4.44.3/yq_${TARGETOS}_${TARGETARCH}" -o /usr/local/bin/yq \
 && chmod +x /usr/local/bin/yq
 RUN curl -sSL "https://fluxcd.io/install.sh" | bash
+RUN curl -sSL "https://github.com/cozystack/cozypkg/raw/refs/heads/main/hack/install.sh" | sh -s
+RUN curl -sSL "https://github.com/cozystack/cozypkg/raw/refs/heads/main/hack/install.sh" | sh -s -- -v 1.1.0
--- a/packages/core/testing/values.yaml
+++ b/packages/core/testing/values.yaml
@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v0.32.0-beta.1@sha256:bf067b3bb24b918d9840cadae26c112ee5d16a93d5f9b2e47af758a49d432040
+  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v0.32.0@sha256:454d5a01c30685ca451a6cd42bda5f4c1d80195642f9dd8ccf09369932ebb531
--- a/packages/extra/bootbox/Chart.yaml
+++ b/packages/extra/bootbox/Chart.yaml
@@ -3,4 +3,4 @@ name: bootbox
 description: PXE hardware provisioning
 icon: /logos/bootbox.svg
 type: application
-version: 0.1.1
+version: 0.2.0
--- a/packages/extra/bootbox/charts/cozy-lib
+++ b/packages/extra/bootbox/charts/cozy-lib
@@ -0,0 +1 @@
+../../../library/cozy-lib
--- a/packages/extra/bootbox/images/matchbox.tag
+++ b/packages/extra/bootbox/images/matchbox.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/matchbox:v0.32.0-beta.1@sha256:5a447d0533e2191b02c8f1cb8726641f291cabc8bf4d0ea90694fb6f594e0800
+ghcr.io/cozystack/cozystack/matchbox:v0.32.0@sha256:1c5173f0c368dd14e29dae95c3d576574af63c226b6f554c78d05c5f160084b5
--- a/packages/extra/bootbox/templates/dashboard-resourcemap.yaml
+++ b/packages/extra/bootbox/templates/dashboard-resourcemap.yaml
@@ -31,5 +31,14 @@ rules:
  resourceNames:
  - bootbox-matchbox
  verbs: ["get", "list", "watch"]
-
-
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "super-admin" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
--- a/packages/extra/etcd/Chart.yaml
+++ b/packages/extra/etcd/Chart.yaml
@@ -3,4 +3,4 @@ name: etcd
 description: Storage for Kubernetes clusters
 icon: /logos/etcd.svg
 type: application
-version: 2.7.0
+version: 2.8.0
--- a/packages/extra/etcd/charts/cozy-lib
+++ b/packages/extra/etcd/charts/cozy-lib
@@ -0,0 +1 @@
+../../../library/cozy-lib
--- a/packages/extra/etcd/templates/dashboard-resourcemap.yaml
+++ b/packages/extra/etcd/templates/dashboard-resourcemap.yaml
@@ -17,3 +17,14 @@ rules:
  resourceNames:
  - {{ .Release.Name }}
  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "super-admin" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
--- a/packages/extra/info/Chart.yaml
+++ b/packages/extra/info/Chart.yaml
@@ -3,4 +3,4 @@ name: info
 description: Info
 icon: /logos/info.svg
 type: application
-version: 1.0.1
+version: 1.1.0
--- a/packages/extra/info/charts/cozy-lib
+++ b/packages/extra/info/charts/cozy-lib
@@ -0,0 +1 @@
+../../../library/cozy-lib
--- a/packages/extra/info/templates/dashboard-resourcemap.yaml
+++ b/packages/extra/info/templates/dashboard-resourcemap.yaml
@@ -10,3 +10,14 @@ rules:
  resourceNames:
  - kubeconfig-{{ .Release.Namespace }}
  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "view" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
--- a/packages/extra/ingress/Chart.yaml
+++ b/packages/extra/ingress/Chart.yaml
@@ -3,4 +3,4 @@ name: ingress
 description: NGINX Ingress Controller
 icon: /logos/ingress-nginx.svg
 type: application
-version: 1.6.0
+version: 1.7.0
--- a/packages/extra/ingress/charts/cozy-lib
+++ b/packages/extra/ingress/charts/cozy-lib
@@ -0,0 +1 @@
+../../../library/cozy-lib
--- a/packages/extra/ingress/templates/dashboard-resourcemap.yaml
+++ b/packages/extra/ingress/templates/dashboard-resourcemap.yaml
@@ -17,3 +17,14 @@ rules:
  resourceNames:
  - {{ .Release.Name }}
  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "admin" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
--- a/packages/extra/monitoring/Chart.yaml
+++ b/packages/extra/monitoring/Chart.yaml
@@ -3,4 +3,4 @@ name: monitoring
 description: Monitoring and observability stack
 icon: /logos/monitoring.svg
 type: application
-version: 1.10.0
+version: 1.11.0
--- a/packages/extra/monitoring/charts/cozy-lib
+++ b/packages/extra/monitoring/charts/cozy-lib
@@ -0,0 +1 @@
+../../../library/cozy-lib
--- a/packages/extra/monitoring/images/grafana.tag
+++ b/packages/extra/monitoring/images/grafana.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/grafana:1.10.0@sha256:c63978e1ed0304e8518b31ddee56c4e8115541b997d8efbe1c0a74da57140399
+ghcr.io/cozystack/cozystack/grafana:1.11.0@sha256:c63978e1ed0304e8518b31ddee56c4e8115541b997d8efbe1c0a74da57140399
--- a/packages/extra/monitoring/templates/dashboard-resourcemap.yaml
+++ b/packages/extra/monitoring/templates/dashboard-resourcemap.yaml
@@ -49,5 +49,14 @@ rules:
  {{- break }}
  {{- end }}
  verbs: ["get", "list", "watch"]
-
-
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "admin" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
--- a/packages/extra/monitoring/templates/vpa.yaml
+++ b/packages/extra/monitoring/templates/vpa.yaml
@@ -18,8 +18,8 @@ spec:
          {{- if and .vminsert .vminsert.minAllowed }}
          {{- toYaml .vminsert.minAllowed | nindent 10 }}
          {{- else }}
-          cpu: 250m
-          memory: 256Mi
+          cpu: 25m
+          memory: 64Mi
          {{- end }}
        maxAllowed:
          {{- if and .vminsert .vminsert.maxAllowed }}
@@ -47,8 +47,8 @@ spec:
          {{- if and .vmselect .vmselect.minAllowed }}
          {{- toYaml .vmselect.minAllowed | nindent 10 }}
          {{- else }}
-          cpu: 250m
-          memory: 256Mi
+          cpu: 25m
+          memory: 64Mi
          {{- end }}
        maxAllowed:
          {{- if and .vmselect .vmselect.maxAllowed }}
@@ -76,8 +76,8 @@ spec:
          {{- if and .vmstorage .vmstorage.minAllowed }}
          {{- toYaml .vmstorage.minAllowed | nindent 10 }}
          {{- else }}
-          cpu: 100m
-          memory: 512Mi
+          cpu: 25m
+          memory: 64Mi
          {{- end }}
        maxAllowed:
          {{- if and .vmstorage .vmstorage.maxAllowed }}
--- a/packages/extra/seaweedfs/Chart.yaml
+++ b/packages/extra/seaweedfs/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.4.0
+version: 0.5.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/extra/seaweedfs/charts/cozy-lib
+++ b/packages/extra/seaweedfs/charts/cozy-lib
@@ -0,0 +1 @@
+../../../library/cozy-lib
--- a/packages/extra/seaweedfs/templates/dashboard-resourcemap.yaml
+++ b/packages/extra/seaweedfs/templates/dashboard-resourcemap.yaml
@@ -27,3 +27,14 @@ rules:
  - {{ $.Release.Name }}-volume
  - {{ $.Release.Name }}-db
  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "admin" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io
--- a/packages/extra/seaweedfs/templates/vpa.yaml
+++ b/packages/extra/seaweedfs/templates/vpa.yaml
@@ -13,8 +13,8 @@ spec:
    containerPolicies:
      - containerName: seaweedfs
        minAllowed:
-          cpu: 250m
-          memory: 256Mi
+          cpu: 25m
+          memory: 64Mi
        maxAllowed:
          cpu: "1"
          memory: 2048Mi
@@ -36,8 +36,8 @@ spec:
    containerPolicies:
      - containerName: seaweedfs
        minAllowed:
-          cpu: 250m
-          memory: 256Mi
+          cpu: 25m
+          memory: 64Mi
        maxAllowed:
          cpu: "1"
          memory: 2048Mi
@@ -59,8 +59,8 @@ spec:
    containerPolicies:
      - containerName: seaweedfs
        minAllowed:
-          cpu: 250m
-          memory: 256Mi
+          cpu: 25m
+          memory: 64Mi
        maxAllowed:
          cpu: "1"
          memory: 2048Mi
--- a/packages/extra/versions_map
+++ b/packages/extra/versions_map
@@ -1,5 +1,6 @@
 bootbox 0.1.0 45a7416c
-bootbox 0.1.1 HEAD
+bootbox 0.1.1 632224a3
+bootbox 0.2.0 HEAD
 etcd 1.0.0 ca79f725
 etcd 2.0.0 c0685f43
 etcd 2.0.1 007d414f
@@ -10,16 +11,19 @@ etcd 2.4.0 af48519d
 etcd 2.5.0 24fa7222
 etcd 2.6.0 8c460528
 etcd 2.6.1 45a7416c
-etcd 2.7.0 HEAD
+etcd 2.7.0 632224a3
+etcd 2.8.0 HEAD
 info 1.0.0 93bdf411
-info 1.0.1 HEAD
+info 1.0.1 632224a3
+info 1.1.0 HEAD
 ingress 1.0.0 d7cfa53c
 ingress 1.1.0 5bbc488e
 ingress 1.2.0 28fca4ef
 ingress 1.3.0 fde4bcfa
 ingress 1.4.0 fd240701
 ingress 1.5.0 93bdf411
-ingress 1.6.0 HEAD
+ingress 1.6.0 632224a3
+ingress 1.7.0 HEAD
 monitoring 1.0.0 d7cfa53c
 monitoring 1.1.0 25221fdc
 monitoring 1.2.0 f81be075
@@ -39,9 +43,13 @@ monitoring 1.8.1 8267072d
 monitoring 1.9.0 45a7416c
 monitoring 1.9.1 fd240701
 monitoring 1.9.2 f9f8bb2f
-monitoring 1.10.0 HEAD
+monitoring 1.10.0 632224a3
+monitoring 1.10.1 8c86905b
+monitoring 1.11.0 HEAD
 seaweedfs 0.1.0 71514249
 seaweedfs 0.2.0 5fb9cfe3
 seaweedfs 0.2.1 fde4bcfa
 seaweedfs 0.3.0 45a7416c
-seaweedfs 0.4.0 HEAD
+seaweedfs 0.4.0 632224a3
+seaweedfs 0.4.1 8c86905b
+seaweedfs 0.5.0 HEAD
--- a/packages/library/cozy-lib/templates/_rbac.tpl
+++ b/packages/library/cozy-lib/templates/_rbac.tpl
@@ -0,0 +1,106 @@
+{{- define "cozy-lib.rbac.accessLevelMap" }}
+view: 0
+use: 1
+admin: 2
+super-admin: 3
+{{- end }}
+
+{{- define "cozy-lib.rbac.accessLevelToInt" }}
+{{-   $accessMap := include "cozy-lib.rbac.accessLevelMap" "" | fromYaml }}
+{{-   $accessLevel := dig . -1 $accessMap | int }}
+{{-   if eq $accessLevel -1 }}
+{{-     printf "encountered access level of %s, allowed values are %s" . ($accessMap | keys) | fail }}
+{{-   end }}
+{{-   $accessLevel }}
+{{- end }}
+
+{{- define "cozy-lib.rbac.accessLevelsAtOrAbove" }}
+{{-   $minLevelInt := include "cozy-lib.rbac.accessLevelToInt" . | int }}
+{{-   range $k, $v := (include "cozy-lib.rbac.accessLevelMap" "" | fromYaml) }}
+{{-     if ge (int $v) $minLevelInt }}
+- {{ $k }}
+{{-     end }}
+{{-   end }}
+{{- end }}
+
+{{- define "cozy-lib.rbac.allParentTenantsAndThis" }}
+{{-   if not (hasPrefix "tenant-" .) }}
+{{-     printf "'%s' is not a valid tenant identifier" . | fail }}
+{{-   end }}
+{{-   $parts := append (splitList "-" .) "" }}
+{{-   $tenants := list }}
+{{-   range untilStep 2 (len $parts) 1 }}
+{{-     $tenants = append $tenants (slice $parts 0 . | join "-") }}
+{{-   end }}
+{{-   range $tenants }}
+- {{ . }}
+{{-   end }}
+{{-   if not (eq . "tenant-root") }}
+- tenant-root
+{{-   end }}
+{{- end }}
+
+{{- define "cozy-lib.rbac.groupSubject" -}}
+- kind: Group
+  name: {{ . }}
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}
+
+{{- define "cozy-lib.rbac.serviceAccountSubject" -}}
+- kind: ServiceAccount
+  name: {{ . }}
+  namespace: {{ . }}
+{{- end }}
+
+{{- /* 
+  A helper function to get a list of groups that should have access, given a
+  minimal access level and the tenant. Invoked as:
+  {{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" $) }}
+  For an example input of (list "use" $) and a .Release.Namespace of
+  tenant-abc-def it will return:
+  ---
+  - kind: Group
+    name: tenant-abc-admin
+    apiGroup: rbac.authorization.k8s.io
+  - kind: Group
+    name: tenant-abc-def-admin
+    apiGroup: rbac.authorization.k8s.io
+  - kind: Group
+    name: tenant-abc-super-admin
+    apiGroup: rbac.authorization.k8s.io
+  - kind: Group
+    name: tenant-abc-def-super-admin
+    apiGroup: rbac.authorization.k8s.io
+  - kind: Group
+    name: tenant-abc-use
+    apiGroup: rbac.authorization.k8s.io
+  - kind: Group
+    name: tenant-abc-def-use
+    apiGroup: rbac.authorization.k8s.io
+
+  in other words, all roles including use and higher and for tenant-abc-def, as
+  well as all parent, grandparent, etc. tenants.
+*/}}
+{{- define "cozy-lib.rbac.subjectsForTenantAndAccessLevel" }}
+{{-   include "cozy-lib.checkInput" . }}
+{{-   $level := index . 0 }}
+{{-   $tenant := index . 1 }}
+{{-   $levels := include "cozy-lib.rbac.accessLevelsAtOrAbove" $level | fromYamlArray }}
+{{-   $tenants := include "cozy-lib.rbac.allParentTenantsAndThis" $tenant | fromYamlArray }}
+{{-   range $t := $tenants }}
+{{-     include "cozy-lib.rbac.serviceAccountSubject" $t }}{{ printf "\n" }}
+{{-     range $l := $levels }}
+{{-       include "cozy-lib.rbac.groupSubject" (printf "%s-%s" $t $l) }}{{ printf "\n" }}
+{{-     end }}
+{{-   end}}
+{{- end }}
+
+{{- define "cozy-lib.rbac.subjectsForTenant" }}
+{{-   include "cozy-lib.checkInput" . }}
+{{-   $level := index . 0 }}
+{{-   $tenant := index . 1 }}
+{{-   $tenants := include "cozy-lib.rbac.allParentTenantsAndThis" $tenant | fromYamlArray }}
+{{-   range $t := $tenants }}
+{{-     include "cozy-lib.rbac.groupSubject" (printf "%s-%s" $t $level) }}{{ printf "\n" }}
+{{-   end}}
+{{- end }}
--- a/packages/system/bucket/images/s3manager.tag
+++ b/packages/system/bucket/images/s3manager.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/s3manager:v0.5.0@sha256:7f2078284453405b7826729d600abfe7082a2c116869137bd0ed9cccdd0e693d
+ghcr.io/cozystack/cozystack/s3manager:v0.5.0@sha256:17c867e1576da57bdee58142fa2b5d5fe5e5acb0a79322fbb0fb6e8723fad0d2
--- a/packages/system/cilium/values.yaml
+++ b/packages/system/cilium/values.yaml
@@ -14,7 +14,7 @@ cilium:
    mode: "kubernetes"
  image:
    repository: ghcr.io/cozystack/cozystack/cilium
-    tag: 1.17.3
-    digest: "sha256:f95e30fd8e7608f61c38344bb9f558f60f4d81bccb8e399836911e4feec2b40a"
+    tag: 1.17.4
+    digest: "sha256:91f628cbdc4652b4459af79c5a0501282cc0bc0a9fc11e3d8cb65e884f94e751"
  envoy:
    enabled: false
--- a/packages/system/cozystack-api/images/cozystack-api/Dockerfile
+++ b/packages/system/cozystack-api/images/cozystack-api/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.23-alpine AS builder
+FROM golang:1.24-alpine AS builder

 ARG TARGETOS
 ARG TARGETARCH
--- a/packages/system/cozystack-api/values.yaml
+++ b/packages/system/cozystack-api/values.yaml
@@ -1,2 +1,2 @@
 cozystackAPI:
-  image: ghcr.io/cozystack/cozystack/cozystack-api:v0.32.0-beta.1@sha256:8b81d7ac808589a5d664e74ca55a0b9fae8374536de7211a99bc97b840bccd21
+  image: ghcr.io/cozystack/cozystack/cozystack-api:v0.32.0@sha256:d9bee0e9f73a950784e43d907552c21044d01eed728e1185455308e49d00c00d
--- a/packages/system/cozystack-controller/images/cozystack-controller/Dockerfile
+++ b/packages/system/cozystack-controller/images/cozystack-controller/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.23-alpine AS builder
+FROM golang:1.24-alpine AS builder

 ARG TARGETOS
 ARG TARGETARCH
--- a/packages/system/cozystack-controller/values.yaml
+++ b/packages/system/cozystack-controller/values.yaml
@@ -1,5 +1,5 @@
 cozystackController:
-  image: ghcr.io/cozystack/cozystack/cozystack-controller:v0.32.0-beta.1@sha256:448384b434b817fea89ab09e52ad7acf6c36e34658f1ce58cd47525f04584208
+  image: ghcr.io/cozystack/cozystack/cozystack-controller:v0.32.0@sha256:a1fceb277007846bc85ceee0afd1f5d1122496174203c718c1275a1038cb07f6
  debug: false
  disableTelemetry: false
-  cozystackVersion: "v0.32.0-beta.1"
+  cozystackVersion: "v0.32.0"
--- a/packages/system/dashboard/charts/kubeapps/templates/dashboard/configmap.yaml
+++ b/packages/system/dashboard/charts/kubeapps/templates/dashboard/configmap.yaml
@@ -76,7 +76,7 @@ data:
      "kubeappsNamespace": {{ .Release.Namespace | quote }},
      "helmGlobalNamespace": {{ include "kubeapps.helmGlobalPackagingNamespace" . | quote }},
      "carvelGlobalNamespace": {{ .Values.kubeappsapis.pluginConfig.kappController.packages.v1alpha1.globalPackagingNamespace | quote }},
-      "appVersion": "v0.32.0-beta.1",
+      "appVersion": "v0.32.0",
      "authProxyEnabled": {{ .Values.authProxy.enabled }},
      "oauthLoginURI": {{ .Values.authProxy.oauthLoginURI | quote }},
      "oauthLogoutURI": {{ .Values.authProxy.oauthLogoutURI | quote }},
--- a/packages/system/dashboard/images/dashboard/Dockerfile
+++ b/packages/system/dashboard/images/dashboard/Dockerfile
@@ -1,7 +1,7 @@
 FROM bitnami/node:20.15.1 AS build
 WORKDIR /app

-ARG COMMIT_REF=d89e721fcb3130de6027251b1befb0208fdbeb85
+ARG COMMIT_REF=6856b66f9244ef1b2703a2f30899366e0ba040de
 RUN wget -O- https://github.com/cozystack/kubeapps/archive/${COMMIT_REF}.tar.gz | tar xzf - --strip-components=2 kubeapps-${COMMIT_REF}/dashboard

 RUN yarn install --frozen-lockfile
--- a/packages/system/dashboard/images/kubeapps-apis/Dockerfile
+++ b/packages/system/dashboard/images/kubeapps-apis/Dockerfile
@@ -4,7 +4,7 @@
 # syntax = docker/dockerfile:1

 FROM alpine AS source
-ARG COMMIT_REF=d89e721fcb3130de6027251b1befb0208fdbeb85
+ARG COMMIT_REF=6856b66f9244ef1b2703a2f30899366e0ba040de
 RUN apk add --no-cache patch
 WORKDIR /source
 RUN wget -O- https://github.com/cozystack/kubeapps/archive/${COMMIT_REF}.tar.gz | tar xzf - --strip-components=1
--- a/packages/system/dashboard/values.yaml
+++ b/packages/system/dashboard/values.yaml
@@ -19,15 +19,15 @@ kubeapps:
    image:
      registry: ghcr.io/cozystack/cozystack
      repository: dashboard
-      tag: v0.32.0-beta.1
-      digest: "sha256:7d63279eeca15435f34c58346726469d258e74fb7b14caa5eb4f9735e0b4ef8e"
+      tag: v0.32.0
+      digest: "sha256:5e514516bd3dc0c693bb346ddeb9740e0439a59deb2a56b87317286e3ce79ac9"
  redis:
    master:
      resourcesPreset: "none"
      resources:
        requests:
-          cpu: 200m
-          memory: 256Mi
+          cpu: 20m
+          memory: 32Mi
        limits:
          memory: 256Mi
  kubeappsapis:
@@ -37,8 +37,8 @@ kubeapps:
    image:
      registry: ghcr.io/cozystack/cozystack
      repository: kubeapps-apis
-      tag: v0.32.0-beta.1
-      digest: "sha256:fe665e4c177b986ae9fa440233949ad6377754d3b26748a99efcbde79a072b1e"
+      tag: v0.32.0
+      digest: "sha256:8ab96c9cd4f0c5452565f2ca1b7e1b644b112e534dd31c0fcef623ec3054d21e"
    pluginConfig:
      flux:
        packages:
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Andrei Kvapil	3ce6dbe850	Release v0.32.0 (#1074 ) This PR prepares the release `v0.32.0`.	2025-06-17 11:30:28 +02:00
Andrei Kvapil	8d5007919f	[tests] fix avaiting for vm-disk Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-06-17 10:32:59 +02:00
github-actions	08e569918b	Prepare release v0.32.0 Signed-off-by: github-actions <github-actions@github.com>	2025-06-16 23:54:35 +00:00
Andrei Kvapil	6498000721	[tests] VM Disk, VMI, VM, DBs (#1048 ) Add 'Apps' tests for Virtual Machine Disk Virtual Machine Instance Virtual Machine PostgreSQL MySQL ClickHouse <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit - Tests - Added new end-to-end tests for creating and validating VM disks, VM instances, virtual machines, and multiple database types (PostgreSQL, MySQL, ClickHouse), ensuring correct provisioning and readiness of these resources. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-06-17 01:50:32 +02:00
Andrei Kvapil	8486e6b3aa	[kubernetes] Fixes for resources and migration to v0.32.4 (#1073 ) Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-06-17 01:38:17 +02:00
Andrei Kvapil	3f6b6798f4	[kubernetes] Fixes for resources and migration to v0.32.4 Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-06-17 01:34:54 +02:00
Andrei Kvapil	c1b928b8ef	[cluster-api] Add missing migration for capi-providers (#1072 ) Signed-off-by: Andrei Kvapil <kvapss@gmail.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Chores - Introduced a new migration script to update the system version and manage related resources during the upgrade from version 14 to 15. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-06-17 01:34:11 +02:00
Andrei Kvapil	c2e8fba483	[cluster-api] Add missing migration for capi-providers Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-06-17 01:33:58 +02:00
Andrei Kvapil	62cb694d72	Release v0.32.0-beta.2 (#1049 ) This PR prepares the release `v0.32.0-beta.2`.	2025-06-16 21:36:04 +02:00
github-actions	c619343aa2	Prepare release v0.32.0-beta.2 Signed-off-by: github-actions <github-actions@github.com>	2025-06-16 19:06:14 +00:00
Ahmad Murzahmatov	75ad26989d	[tests] VM Disk, VMI, VM Add 'Apps' tests for Virtual Machine Disk Virtual Machine Instance Virtual Machine PostgreSQL MySQL ClickHouse Signed-off-by: Ahmad Murzahmatov <gwynbleidd2106@yandex.com>	2025-06-16 21:00:22 +02:00
Andrei Kvapil	c4fc8c18df	Use library chart with k8s managed app (#1026 ) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Refactor - Updated resource configuration rendering in cluster templates to use standardized resource handling from a shared library, improving consistency in resource definitions. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-06-16 20:55:57 +02:00
Timofei Larkin	8663dc940f	Use library chart with k8s managed app Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>	2025-06-16 20:54:30 +02:00
Andrei Kvapil	cf983a8f9c	[dashboard] Remove dependency on listing secrets (#1062 ) This change includes the following commit `6856b66f92` Signed-off-by: Andrei Kvapil <kvapss@gmail.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Chores - Updated the version of a core dependency used in the dashboard and related services to a newer commit. No user-facing changes. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-06-16 20:48:01 +02:00
Andrei Kvapil	ad6aa0ca94	Refactor roles and permissions for tenants (#1067 ) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Introduced advanced Helm template helpers for managing Kubernetes RBAC (Role-Based Access Control), including access level mapping, hierarchy-aware group subject generation, and tenant parsing. - Added dynamic RoleBinding resources across multiple applications to bind roles to appropriate subjects based on access levels and tenant namespaces. - Bug Fixes - Refined tenant application roles by restricting resource permissions to specific core Kubernetes resources, enhancing security and access control granularity. - Chores - Updated chart versions across numerous applications to reflect new releases. - Added reference files linking to the shared library in multiple application chart directories. - Pinned package versions to specific commits for improved version stability and tracking. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-06-16 20:47:09 +02:00
Andrei Kvapil	9dc5d62f47	[dashboard] Remove dependency on listing secrets Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-06-16 20:32:51 +02:00
Andrei Kvapil	3b8a9f9d2c	Configure all apps to use new function to generate subjects Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-06-16 20:32:11 +02:00
Andrei Kvapil	ab9926a177	Update cozypkg v1.1.0 (#1063 )	2025-06-16 20:12:21 +02:00
Andrei Kvapil	f83741eb09	Add extra helper function to generate subjects Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-06-16 20:11:41 +02:00
Timofei Larkin	028f2e4e8d	Add helper function to generate subjects Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>	2025-06-16 19:19:57 +03:00
Andrei Kvapil	255fa8cbe1	[docs] Review the Clickhouse app docs (#1059 ) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Documentation - Improved and clarified documentation for the Managed ClickHouse Service, including enhanced introductory content and clearer backup instructions. - Updated and corrected parameter descriptions for accuracy, especially regarding shards, replicas, storage sizes, and backup options. - Expanded explanations and examples for resource configuration in production environments. - Reformatted tables and notes for better readability and usability. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-06-16 18:14:02 +02:00
Andrei Kvapil	b42f5cdc01	[bugfix] fix distro full bundle (#1056 ) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Added a new template to automatically create a self-signed ClusterIssuer for certificate management if one does not already exist. - Chores - Updated dependency configuration for the snapshot-controller to simplify its setup process. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-06-16 18:13:44 +02:00
Andrei Kvapil	74633ad699	Update cozypkg v1.1.0 Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-06-16 18:11:27 +02:00
Nick Volynkin	980185ca2b	[docs] Review the Clickhouse app docs Signed-off-by: Nick Volynkin <nick.volynkin@gmail.com>	2025-06-16 08:40:46 +03:00
Andrei Kvapil	8eabe30548	[platform] Use cozypkg instead of helm (#1057 ) Signed-off-by: Andrei Kvapil <kvapss@gmail.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Introduced the use of the CozyPkg tool for package deployment and management, replacing previous Helm-based workflows across installer, platform, and system components. - Refactor - Updated Makefiles and scripts to use CozyPkg commands for showing, applying, diffing, suspending, resuming, and deleting packages. - Removed dynamic API version handling and simplified deployment command structures. - Chores - Updated Docker images to newer base versions and included CozyPkg installation steps. - Changed installer image references to use the latest available build. - Removed obsolete scripts and dependencies related to Helm and Kustomize. - Consolidated package installations and updated tooling in Dockerfiles for improved efficiency. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-06-14 20:50:12 +02:00
Andrei Kvapil	0c9c688e6d	[platform] decrease resources for system applications (#1054 ) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Added resource constraints for the flux-operator and multiple kube-ovn components, specifying CPU and memory requests and limits. - Improvements - Reduced default minimum CPU and memory requests for monitoring and seaweedfs components, as well as for the Redis master in the dashboard, to optimize resource usage. - Chores - Updated version numbers for monitoring and seaweedfs packages. - Refreshed version mappings to reflect new releases. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-06-14 08:21:32 +02:00
Andrei Kvapil	908c75927e	[platform] Use cozypkg instead of helm Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-06-13 19:02:15 +02:00
Andrei Kvapil	0a1f078384	[docs] Note that Cozystack is a CNCF Sandbox project in the readme (#1055 ) Fix a few other things in the readme <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Documentation - Updated the README to highlight Cozystack's CNCF Sandbox status and original sponsorship. - Moved the user interface screenshot to appear directly after the introduction. - Reorganized community information into a dedicated section with clearer invitations and calendar links for meetings. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-06-13 12:58:44 +02:00
kklinch0	6a713e5eb4	[bugfix] fix distro full bundle Signed-off-by: kklinch0 <kklinch0@gmail.com>	2025-06-13 10:59:14 +03:00
Nick Volynkin	8f0a28bad5	[docs] Note that Cozystack is a CNCF Sandbox project in the readme Fix a few other things in the readme Signed-off-by: Nick Volynkin <nick.volynkin@gmail.com>	2025-06-13 09:47:11 +03:00
kklinch0	0fa70d9d38	[platform] cut resources Signed-off-by: kklinch0 <kklinch0@gmail.com>	2025-06-13 01:06:05 +03:00
klinch0	b14c82d606	[bugfix] add-resource-quotas-for-pg-jobs-and-fix-install-generate (#1051 ) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Added default resource specifications for PostgreSQL jobs to ensure consistent CPU and memory allocation. - Chores - Updated the chart version for the PostgreSQL application. - Refreshed version mapping to reflect the latest release. - Improved Node.js setup and package installation in the pre-commit workflow. - Tests - Increased memory allocation for QEMU virtual machines in end-to-end tests. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-06-12 10:10:26 +03:00
kklinch0	8e79f24c5b	add rq for pg Signed-off-by: kklinch0 <kklinch0@gmail.com>	2025-06-11 22:48:09 +03:00