fix network-policies

2026-01-28 18:18:41 +00:00 · 2024-08-09 04:47:00 +02:00
28 changed files with 107 additions and 132 deletions
--- a/manifests/cozystack-installer.yaml
+++ b/manifests/cozystack-installer.yaml
@@ -68,7 +68,7 @@ spec:
      serviceAccountName: cozystack
      containers:
      - name: cozystack
-        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.10.4"
+        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.10.3"
        env:
        - name: KUBERNETES_SERVICE_HOST
          value: localhost
@@ -87,7 +87,7 @@ spec:
            fieldRef:
              fieldPath: metadata.name
      - name: darkhttpd
-        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.10.4"
+        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.10.3"
        command:
        - /usr/bin/darkhttpd
        - /cozystack/assets
--- a/packages/apps/ferretdb/Chart.yaml
+++ b/packages/apps/ferretdb/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.1
+version: 0.1.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/ferretdb/templates/postgres.yaml
+++ b/packages/apps/ferretdb/templates/postgres.yaml
@@ -16,10 +16,6 @@ spec:
  storage:
    size: {{ required ".Values.size is required" .Values.size }}

-  inheritedMetadata:
-    labels:
-      policy.cozystack.io/allow-to-apiserver: "true"
-
  {{- if .Values.users }}
  managed:
    roles:
--- a/packages/apps/http-cache/images/nginx-cache.json
+++ b/packages/apps/http-cache/images/nginx-cache.json
@@ -32,7 +32,7 @@
      }
    }
  },
-  "buildx.build.ref": "buildkit/buildkit0/u67issjnvf8mayitrr0yjhyvg",
+  "buildx.build.ref": "cozystack/cozystack0/spml9ia4vkl6wxfboxgso9jnd",
  "containerimage.config.digest": "sha256:4bfe7bdc746d0f7db6d8fccb4ef68c8b1dc2306c27e2716f589dee951bf86a03",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
@@ -44,5 +44,5 @@
    }
  },
  "containerimage.digest": "sha256:6b5dbb5319ddcf9f545ba0f7b8b3f2117e85bc96e684b5e3adf23e0fef5dde8d",
-  "image.name": "ghcr.io/aenix-io/cozystack/nginx-cache:v0.1.0,ghcr.io/aenix-io/cozystack/nginx-cache:v0.1.0-v0.10.4"
+  "image.name": "ghcr.io/aenix-io/cozystack/nginx-cache:v0.1.0,ghcr.io/aenix-io/cozystack/nginx-cache:v0.1.0-v0.10.3"
 }
--- a/packages/apps/kafka/Chart.yaml
+++ b/packages/apps/kafka/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.3
+version: 0.2.2

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/kafka/templates/kafka.yaml
+++ b/packages/apps/kafka/templates/kafka.yaml
@@ -65,8 +65,3 @@ spec:
  entityOperator:
    topicOperator: {}
    userOperator: {}
-    template:
-      pod:
-        metadata:
-         labels:
-           policy.cozystack.io/allow-to-apiserver: "true"
--- a/packages/apps/kubernetes/images/ubuntu-container-disk.json
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk.json
@@ -32,7 +32,7 @@
      }
    }
  },
-  "buildx.build.ref": "buildkit/buildkit0/h1ysl3ux1rjq5dtblsuuc54l9",
+  "buildx.build.ref": "cozystack/cozystack0/zie1df5xk0xb5lj1fmedk76qx",
  "containerimage.config.digest": "sha256:c144c5f12a47af7880ee5f056b14177c07b585b8ab1e68b7e7900e1c923083cf",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
@@ -44,5 +44,5 @@
    }
  },
  "containerimage.digest": "sha256:81caf89efe252ae2ca1990d08a3a314552d70ff36bcd4022b173c7150fbec805",
-  "image.name": "ghcr.io/aenix-io/cozystack/ubuntu-container-disk:v1.30.1,ghcr.io/aenix-io/cozystack/ubuntu-container-disk:v1.30.1-v0.10.4"
+  "image.name": "ghcr.io/aenix-io/cozystack/ubuntu-container-disk:v1.30.1,ghcr.io/aenix-io/cozystack/ubuntu-container-disk:v1.30.1-v0.10.3"
 }
--- a/packages/apps/postgres/Chart.yaml
+++ b/packages/apps/postgres/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.4.1
+version: 0.4.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/postgres/templates/db.yaml
+++ b/packages/apps/postgres/templates/db.yaml
@@ -19,7 +19,3 @@ spec:

  storage:
    size: {{ required ".Values.size is required" .Values.size }}
-
-  inheritedMetadata:
-    labels:
-      policy.cozystack.io/allow-to-apiserver: "true"
--- a/packages/apps/tenant/templates/namespace.yaml
+++ b/packages/apps/tenant/templates/namespace.yaml
@@ -1,20 +1,3 @@
-{{- define "cozystack.namespace-anotations" }}
-{{- $context := index . 0 }}
-{{- $existingNS := index . 1 }}
-{{- range $x := list "etcd" "monitoring" "ingress" }}
-{{- if (index $context.Values $x) }}
-namespace.cozystack.io/{{ $x }}: "{{ include "tenant.name" $context }}"
-{{- else }}
-namespace.cozystack.io/{{ $x }}: "{{ index $existingNS.metadata.annotations (printf "namespace.cozystack.io/%s" $x) | required (printf "namespace %s has no namespace.cozystack.io/%s annotation" $context.Release.Namespace $x) }}"
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{- $existingNS := lookup "v1" "Namespace" "" .Release.Namespace }}
-{{- if not $existingNS }}
-{{- fail (printf "error lookup existing namespace: %s" .Release.Namespace) }}
-{{- end }}
-
 {{- if ne (include "tenant.name" .) "tenant-root" }}
 ---
 apiVersion: v1
@@ -22,16 +5,23 @@ kind: Namespace
 metadata:
  name: {{ include "tenant.name" . }}
  {{- if hasPrefix "tenant-" .Release.Namespace }}
+  {{- $existingNS := lookup "v1" "Namespace" "" .Release.Namespace }}
+  {{- if $existingNS }}
  annotations:
    {{- if .Values.host }}
    namespace.cozystack.io/host: "{{ .Values.host }}"
    {{- else }}
-    {{ $parentHost := index $existingNS.metadata.annotations "namespace.cozystack.io/host" | required (printf "namespace %s has no namespace.cozystack.io/host annotation" .Release.Namespace) }}
+    {{ $parentHost := index $existingNS.metadata.annotations "namespace.cozystack.io/host" | required (printf "namespace %s has no namespace.cozystack.io/host annotation" $.Release.Namespace) }}
    namespace.cozystack.io/host: "{{ splitList "-" (include "tenant.name" .) | last }}.{{ $parentHost }}"
    {{- end }}
-    {{- include "cozystack.namespace-anotations" (list . $existingNS) | nindent 4 }}
+    {{- range $x := list "etcd" "monitoring" "ingress" }}
+    {{- if (index $.Values $x) }}
+    namespace.cozystack.io/{{ $x }}: "{{ include "tenant.name" $ }}"
+    {{- else }}
+    namespace.cozystack.io/{{ $x }}: "{{ index $existingNS.metadata.annotations (printf "namespace.cozystack.io/%s" $x) | required (printf "namespace %s has no namespace.cozystack.io/%s annotation" $.Release.Namespace $x) }}"
+    {{- end }}
+    {{- end }}
  labels:
-    tenant.cozystack.io/{{ include "tenant.name" $ }}: ""
    {{- if hasPrefix "tenant-" .Release.Namespace }}
    {{- $parts := splitList "-" .Release.Namespace }}
    {{- range $i, $v := $parts }}
@@ -40,7 +30,6 @@ metadata:
    {{- end }}
    {{- end }}
    {{- end }}
-    {{- include "cozystack.namespace-anotations" (list $ $existingNS) | nindent 4 }}
  ownerReferences:
  - apiVersion: v1
    blockOwnerDeletion: true
@@ -48,5 +37,8 @@ metadata:
    kind: Namespace
    name: {{ .Release.Namespace }}
    uid: {{ $existingNS.metadata.uid }}
+  {{- else }}
+  {{- fail (printf "error lookup exiting namespace: %s" .Release.Namespace) }}
+  {{- end }}
  {{- end }}
 {{- end }}
--- a/packages/apps/tenant/templates/networkpolicy.yaml
+++ b/packages/apps/tenant/templates/networkpolicy.yaml
@@ -28,19 +28,34 @@ spec:
  - toEntities:
      - world
 ---
+{{- if ne (include "tenant.name" .) "tenant-root" }}
 apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
+kind: CiliumNetworkPolicy
 metadata:
-  name: {{ include "tenant.name" . }}-egress
+  name: allow-from-upper-tenants
+  namespace: {{ include "tenant.name" . }}
 spec:
-  endpointSelector:
-    matchLabels:
-      "k8s:io.kubernetes.pod.namespace": "{{ include "tenant.name" . }}"
-  egress:
-  - toEndpoints:
+  endpointSelector: {}
+  ingress:
+  - fromEndpoints:
+    {{- if hasPrefix "tenant-" .Release.Namespace }}
+    {{- $parts := splitList "-" .Release.Namespace }}
+    {{- range $i, $v := $parts }}
+    {{- if ne $i 0 }}
    - matchLabels:
-        "k8s:io.cilium.k8s.namespace.labels.tenant.cozystack.io/{{ include "tenant.name" . }}": ""
-  {{- if ne (include "tenant.name" .) "tenant-root" }}
+        "k8s:io.kubernetes.pod.namespace": {{ join "-" (slice $parts 0 (add $i 1)) }}
+    {{- end }}
+    {{- end }}
+    {{- end }}
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-to-upper-tenants
+  namespace: {{ include "tenant.name" . }}
+spec:
+  endpointSelector: {}
+  egress:
  - toEndpoints:
    {{- if hasPrefix "tenant-" .Release.Namespace }}
    {{- $parts := splitList "-" .Release.Namespace }}
@@ -51,53 +66,35 @@ spec:
    {{- end }}
    {{- end }}
    {{- end }}
-  {{- end }}
+{{- end }}
 ---
 apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
-  name: {{ include "tenant.name" . }}-ingress
+  name: "allow-to-down-labels-{{ include "tenant.name" . }}"
 spec:
  endpointSelector:
    matchLabels:
-      "k8s:io.kubernetes.pod.namespace": "{{ include "tenant.name" . }}"
-  ingress:
-  - fromEntities:
-    - kube-apiserver
-  - fromEndpoints:
-      - matchLabels:
-          "k8s:io.cilium.k8s.namespace.labels.cozystack.io/system": "true"
-  - fromEndpoints:
-      - matchLabels:
-          "k8s:io.kubernetes.pod.namespace": kube-system
-  {{- if ne (include "tenant.name" .) "tenant-root" }}
-  - fromEndpoints:
-    {{- if hasPrefix "tenant-" .Release.Namespace }}
-    {{- $parts := splitList "-" .Release.Namespace }}
-    {{- range $i, $v := $parts }}
-    {{- if ne $i 0 }}
+      k8s:io.kubernetes.pod.namespace: "{{ include "tenant.name" . }}"
+  egress:
+  - toEndpoints:
    - matchLabels:
-        "k8s:io.kubernetes.pod.namespace": {{ join "-" (slice $parts 0 (add $i 1)) }}
-    {{- end }}
-    {{- end }}
-    {{- end }}
-  {{- end }}
+        "k8s:io.cilium.k8s.namespace.labels.tenant.cozystack.io/{{ include "tenant.name" . }}": ""
 ---
 {{- if .Values.etcd }}
 apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
-  name: {{ include "tenant.name" . }}-ingress-etcd
+  name: "allow-to-etcd-{{ include "tenant.name" . }}"
 spec:
  endpointSelector:
    matchLabels:
-      "k8s:io.kubernetes.pod.namespace": "{{ include "tenant.name" . }}"
+      k8s:io.kubernetes.pod.namespace: "{{ include "tenant.name" . }}"
      cozystack.io/service: etcd
  ingress:
  - fromEndpoints:
    - matchLabels:
-        "k8s:io.cilium.k8s.namespace.labels.namespace.cozystack.io/etcd": "{{ include "tenant.name" . }}"
-        policy.cozystack.io/allow-to-etcd: "true"
+        k8s:io.cilium.k8s.namespace.labels.namespace.cozystack.io/etcd: "{{ include "tenant.name" . }}"
 {{- end }}
 ---
 apiVersion: cilium.io/v2
@@ -127,7 +124,7 @@ spec:
  egress:
  - toEndpoints:
    - matchLabels:
-        "k8s:io.kubernetes.pod.namespace": kube-system
+        k8s:io.kubernetes.pod.namespace: kube-system
        k8s-app: kube-dns
 ---
 apiVersion: cilium.io/v2
@@ -140,7 +137,7 @@ spec:
  egress:
  - toEndpoints:
      - matchLabels:
-          "k8s:io.kubernetes.pod.namespace": cozy-dashboard
+          k8s:io.kubernetes.pod.namespace: cozy-dashboard
 ---
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
--- a/packages/apps/versions_map
+++ b/packages/apps/versions_map
@@ -1,15 +1,13 @@
 clickhouse 0.1.0 ca79f72
 clickhouse 0.2.0 7cd7de73
 clickhouse 0.2.1 HEAD
-ferretdb 0.1.0 4ffa8615
-ferretdb 0.1.1 HEAD
+ferretdb 0.1.0 HEAD
 http-cache 0.1.0 a956713
 http-cache 0.2.0 HEAD
 kafka 0.1.0 760f86d2
 kafka 0.2.0 a2cc83d
 kafka 0.2.1 3ac17018
-kafka 0.2.2 d0758692
-kafka 0.2.3 HEAD
+kafka 0.2.2 HEAD
 kubernetes 0.1.0 f642698
 kubernetes 0.2.0 7cd7de73
 kubernetes 0.3.0 7caccec1
@@ -28,8 +26,7 @@ postgres 0.1.0 f642698
 postgres 0.2.0 7cd7de73
 postgres 0.2.1 4a97e297
 postgres 0.3.0 995dea6f
-postgres 0.4.0 ec283c33
-postgres 0.4.1 HEAD
+postgres 0.4.0 HEAD
 rabbitmq 0.1.0 f642698
 rabbitmq 0.2.0 HEAD
 redis 0.1.1 f642698
--- a/packages/core/installer/Makefile
+++ b/packages/core/installer/Makefile
@@ -26,7 +26,7 @@ image-cozystack:
 		--tag $(REGISTRY)/cozystack:$(call settag,$(TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/cozystack:latest \
 		--platform linux/amd64,linux/arm64 \
-		--cache-to type=inline,mode=max \
+		--cache-to type=inline \
 		--metadata-file images/cozystack.json \
 		--push=$(PUSH) \
 		--load=$(LOAD)
@@ -46,7 +46,7 @@ image-matchbox:
 		--tag $(REGISTRY)/matchbox:$(call settag,$(TAG)) \
 		--tag $(REGISTRY)/matchbox:$(call settag,$(TALOS_VERSION)-$(TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/matchbox:latest \
-		--cache-to type=inline,mode=max \
+		--cache-to type=inline \
 		--metadata-file images/matchbox.json \
 		--push=$(PUSH) \
 		--load=$(LOAD)
--- a/packages/core/installer/images/cozystack.json
+++ b/packages/core/installer/images/cozystack.json
@@ -1,10 +1,10 @@
 {
-  "buildx.build.ref": "buildkit/buildkit0/n6lhtwop5zjb6wsgfaxvgm7wi",
+  "buildx.build.ref": "cozystack/cozystack0/90r2t47wnn545649ni2ch601y",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",
-    "digest": "sha256:629ce818af1441896a499120f62471934faf2fb8f7e9f922631f51c877de7b44",
+    "digest": "sha256:a9744f1928c13c2f3ca2ab87ebe0d0d4531e35827668f4b449fbf8e5074f6218",
    "size": 685
  },
-  "containerimage.digest": "sha256:629ce818af1441896a499120f62471934faf2fb8f7e9f922631f51c877de7b44",
-  "image.name": "ghcr.io/aenix-io/cozystack/cozystack:v0.10.4"
+  "containerimage.digest": "sha256:a9744f1928c13c2f3ca2ab87ebe0d0d4531e35827668f4b449fbf8e5074f6218",
+  "image.name": "ghcr.io/aenix-io/cozystack/cozystack:v0.10.3"
 }
--- a/packages/core/installer/images/cozystack.tag
+++ b/packages/core/installer/images/cozystack.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/cozystack:v0.10.4
+ghcr.io/aenix-io/cozystack/cozystack:v0.10.3
--- a/packages/core/installer/images/matchbox.json
+++ b/packages/core/installer/images/matchbox.json
@@ -29,17 +29,17 @@
      }
    }
  },
-  "buildx.build.ref": "buildkit/buildkit0/bloh5mrl9qylqab5x8nsx7c3w",
-  "containerimage.config.digest": "sha256:82ae30cc8115b1ff19eeaf9e99130268f25e4440ae285208aa48321da285c5ac",
+  "buildx.build.ref": "cozystack/cozystack0/4ksaiyxq8uqy5iuedn1qyljdc",
+  "containerimage.config.digest": "sha256:4c52be2a28c48ad39af2664140b6b0476438b17e7a82685930a43f72405e1b2e",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
-    "digest": "sha256:22a4a0d40c9101af9c934425438ac39ca8312456d8b22ddd8b92d506b15e3517",
+    "digest": "sha256:200a449e1559cc5f2a207444ac16d40f3c2b03f5a04c90e32f5cb83ba072f55c",
    "size": 1488,
    "platform": {
      "architecture": "amd64",
      "os": "linux"
    }
  },
-  "containerimage.digest": "sha256:22a4a0d40c9101af9c934425438ac39ca8312456d8b22ddd8b92d506b15e3517",
-  "image.name": "ghcr.io/aenix-io/cozystack/matchbox:v0.10.4,ghcr.io/aenix-io/cozystack/matchbox:v1.7.1-v0.10.4"
+  "containerimage.digest": "sha256:200a449e1559cc5f2a207444ac16d40f3c2b03f5a04c90e32f5cb83ba072f55c",
+  "image.name": "ghcr.io/aenix-io/cozystack/matchbox:v0.10.3,ghcr.io/aenix-io/cozystack/matchbox:v1.7.1-v0.10.3"
 }
--- a/packages/extra/monitoring/Chart.yaml
+++ b/packages/extra/monitoring/Chart.yaml
@@ -3,4 +3,4 @@ name: monitoring
 description: Monitoring and observability stack
 icon: /logos/monitoring.svg
 type: application
-version: 1.2.1
+version: 1.2.0
--- a/packages/extra/monitoring/templates/grafana/db.yaml
+++ b/packages/extra/monitoring/templates/grafana/db.yaml
@@ -6,7 +6,3 @@ spec:
  instances: 2
  storage:
    size: 10Gi
-
-  inheritedMetadata:
-    labels:
-      policy.cozystack.io/allow-to-apiserver: "true"
--- a/packages/extra/monitoring/templates/oncall/oncall-db.yaml
+++ b/packages/extra/monitoring/templates/oncall/oncall-db.yaml
@@ -8,8 +8,4 @@ spec:
  instances: 2
  storage:
    size: 10Gi
-
-  inheritedMetadata:
-    labels:
-      policy.cozystack.io/allow-to-apiserver: "true"
 {{- end }}
--- a/packages/extra/versions_map
+++ b/packages/extra/versions_map
@@ -8,5 +8,4 @@ ingress 1.1.0 838bee5d
 ingress 1.2.0 HEAD
 monitoring 1.0.0 f642698
 monitoring 1.1.0 15478a88
-monitoring 1.2.0 c9e0d63b
-monitoring 1.2.1 HEAD
+monitoring 1.2.0 HEAD
--- a/packages/system/cilium/images/cilium.json
+++ b/packages/system/cilium/images/cilium.json
@@ -45,7 +45,7 @@
      }
    }
  },
-  "buildx.build.ref": "buildkit/buildkit0/t1ir71rh3wc8qnuoktu7d4esj",
+  "buildx.build.ref": "cozystack/cozystack0/s6wdt6414bz57mu5kdltf56s1",
  "containerimage.config.digest": "sha256:e4a2ffa097cfead78a8e7623cf186d5f594e72e139e4dda5a06bcd1c58c6838e",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
@@ -57,5 +57,5 @@
    }
  },
  "containerimage.digest": "sha256:8110f6b17ec98d87d9aebf3f4b99409f020840a958166e28c74b2d4e1bfb5a51",
-  "image.name": "ghcr.io/aenix-io/cozystack/cilium:1.15.5,ghcr.io/aenix-io/cozystack/cilium:1.15.5-v0.10.4"
+  "image.name": "ghcr.io/aenix-io/cozystack/cilium:1.15.5,ghcr.io/aenix-io/cozystack/cilium:1.15.5-v0.10.3"
 }
--- a/packages/system/cilium/templates/clusterwide-networkpolicies.yaml
+++ b/packages/system/cilium/templates/clusterwide-networkpolicies.yaml
@@ -0,0 +1,11 @@
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-from-system
+spec:
+  endpointSelector: {}
+  ingress:
+  - fromEndpoints:
+      - matchLabels:
+          "k8s:io.cilium.k8s.namespace.labels.cozystack.io/system": "true"
--- a/packages/system/dashboard/images/dashboard.json
+++ b/packages/system/dashboard/images/dashboard.json
@@ -35,17 +35,17 @@
      }
    }
  },
-  "buildx.build.ref": "buildkit/buildkit0/cwujns3lenpi0n9e0ippe836g",
-  "containerimage.config.digest": "sha256:975a58288a675b6fb7b1a8a10d52e0c6090ba0fb3185f618ade444ad0b3c9993",
+  "buildx.build.ref": "cozystack/cozystack0/k90p7qja1tca86jt2ozzg98a9",
+  "containerimage.config.digest": "sha256:27fc7abbe19e41a85443ae022a42f7166ef4334efba85a3e4059f92740f24620",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
-    "digest": "sha256:f6a14b2291c6750cb4cb4c1b8ddefdb5d32081a2a6af661d8b3bcfad731de695",
+    "digest": "sha256:8f206c2ae2bbaed8e76db45704c4f76945176d448a310ed77d1abbe1b89f8b7b",
    "size": 703,
    "platform": {
      "architecture": "amd64",
      "os": "linux"
    }
  },
-  "containerimage.digest": "sha256:f6a14b2291c6750cb4cb4c1b8ddefdb5d32081a2a6af661d8b3bcfad731de695",
-  "image.name": "ghcr.io/aenix-io/cozystack/dashboard:v0.10.4"
+  "containerimage.digest": "sha256:8f206c2ae2bbaed8e76db45704c4f76945176d448a310ed77d1abbe1b89f8b7b",
+  "image.name": "ghcr.io/aenix-io/cozystack/dashboard:v0.10.3"
 }
--- a/packages/system/dashboard/images/dashboard.tag
+++ b/packages/system/dashboard/images/dashboard.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/dashboard:v0.10.4
+ghcr.io/aenix-io/cozystack/dashboard:v0.10.3
--- a/packages/system/dashboard/images/kubeapps-apis.json
+++ b/packages/system/dashboard/images/kubeapps-apis.json
@@ -11,7 +11,7 @@
      {
        "uri": "pkg:docker/bitnami/minideb@bookworm?platform=linux%2Famd64",
        "digest": {
-          "sha256": "83bb31f8fcd1f639603350886a70a96204dc0de3368cb6b573170642c888cf82"
+          "sha256": "a43a80e7ccfee2af468eb2cb7fb9ab3a38a9c6a11d98556b7218674fa1a599a9"
        }
      },
      {
@@ -41,17 +41,17 @@
      }
    }
  },
-  "buildx.build.ref": "buildkit/buildkit0/p6nqttiwicifoqgamrjx2fdrq",
-  "containerimage.config.digest": "sha256:348ce29b9ea660f8f9c35d2b103cf164ce82b057935da06a79cae1822934b8f7",
+  "buildx.build.ref": "cozystack/cozystack0/umvwwe8i6d3s3gnn71z41y2c6",
+  "containerimage.config.digest": "sha256:a39c384b5a183e506c331f2fc1a4ab1b27f620bbc596407965fa9e7190a04ae4",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
-    "digest": "sha256:236fd33ce19599e06f3fedcc97a287880e1aab2354a6b17634e84a74d092e095",
-    "size": 1890,
+    "digest": "sha256:3151eb381f7b8fe6a9b9a0ee5c3d99cfda7d708b2b89931b4288d22169da67af",
+    "size": 1891,
    "platform": {
      "architecture": "amd64",
      "os": "linux"
    }
  },
-  "containerimage.digest": "sha256:236fd33ce19599e06f3fedcc97a287880e1aab2354a6b17634e84a74d092e095",
-  "image.name": "ghcr.io/aenix-io/cozystack/kubeapps-apis:v0.10.4"
+  "containerimage.digest": "sha256:3151eb381f7b8fe6a9b9a0ee5c3d99cfda7d708b2b89931b4288d22169da67af",
+  "image.name": "ghcr.io/aenix-io/cozystack/kubeapps-apis:v0.10.3"
 }
--- a/packages/system/dashboard/images/kubeapps-apis.tag
+++ b/packages/system/dashboard/images/kubeapps-apis.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/kubeapps-apis:v0.10.4
+ghcr.io/aenix-io/cozystack/kubeapps-apis:v0.10.3
--- a/packages/system/kamaji/values.yaml
+++ b/packages/system/kamaji/values.yaml
@@ -3,5 +3,5 @@ kamaji:
    deploy: false
  image:
    pullPolicy: IfNotPresent
-    tag: v0.10.4@sha256:f7e4036ed809176dafc671953a5c95a652dc7d637a67470142e625103f91ca3d
+    tag: v0.10.3@sha256:f7e4036ed809176dafc671953a5c95a652dc7d637a67470142e625103f91ca3d
    repository: ghcr.io/aenix-io/cozystack/kamaji
--- a/packages/system/kubeovn/images/kubeovn.json
+++ b/packages/system/kubeovn/images/kubeovn.json
@@ -35,17 +35,17 @@
      }
    }
  },
-  "buildx.build.ref": "buildkit/buildkit0/m5gbswwgqddc64uba1uy011fy",
-  "containerimage.config.digest": "sha256:050f4b7fe5e8812106c70cc8865b109258f55e9d32f5ab92f1a76347ff620144",
+  "buildx.build.ref": "cozystack/cozystack0/3kqxn3juk572lfi4come65181",
+  "containerimage.config.digest": "sha256:05764289191ef541c37c86ef63dec99e24a159fba3a657c8427627b021802a1f",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
-    "digest": "sha256:af48ff43d05006403f2dbc072a98a1b167a4ddd7ba6d90a7063c9a30401f4bc5",
+    "digest": "sha256:c658f94e663d41c2f88b41e2693009a55dfeaa39a7cbc1e88f33b9f4a6bda8d5",
    "size": 5015,
    "platform": {
      "architecture": "amd64",
      "os": "linux"
    }
  },
-  "containerimage.digest": "sha256:af48ff43d05006403f2dbc072a98a1b167a4ddd7ba6d90a7063c9a30401f4bc5",
-  "image.name": "ghcr.io/aenix-io/cozystack/kubeovn:v1.13.0,ghcr.io/aenix-io/cozystack/kubeovn:v1.13.0-v0.10.4"
+  "containerimage.digest": "sha256:c658f94e663d41c2f88b41e2693009a55dfeaa39a7cbc1e88f33b9f4a6bda8d5",
+  "image.name": "ghcr.io/aenix-io/cozystack/kubeovn:v1.13.0,ghcr.io/aenix-io/cozystack/kubeovn:v1.13.0-v0.10.3"
 }