Merge pull request #678 from aenix-io/release-v0.27.0

Prepare release v0.27.0
2026-01-28 18:18:41 +00:00 · 2025-03-06 22:17:33 +04:00 · 2025-03-06 18:54:54 +03:00 · 2025-03-06 15:24:12 +01:00 · 2025-03-06 14:44:58 +01:00 · 2025-03-05 18:49:05 +01:00
180 changed files with 22635 additions and 791 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1 +1 @@
-* @kvaps
+* @kvaps @lllamnyp
--- a/dashboards/clickhouse/altinity-clickhouse-operator-dashboard.json
+++ b/dashboards/clickhouse/altinity-clickhouse-operator-dashboard.json
--- a/dashboards/goldpinger/goldpinger.json
+++ b/dashboards/goldpinger/goldpinger.json
--- a/dashboards/storage/linstor.json
+++ b/dashboards/storage/linstor.json
--- a/hack/download-dashboards.sh
+++ b/hack/download-dashboards.sh
@@ -81,6 +81,7 @@ modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//main/capacity-p
 modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//flux/flux-control-plane.json
 modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//flux/flux-stats.json
 modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//kafka/strimzi-kafka.json
+modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//goldpinger/goldpinger.json
 EOT


--- a/manifests/cozystack-installer.yaml
+++ b/manifests/cozystack-installer.yaml
@@ -68,7 +68,7 @@ spec:
      serviceAccountName: cozystack
      containers:
      - name: cozystack
-        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.25.1"
+        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.27.0"
        env:
        - name: KUBERNETES_SERVICE_HOST
          value: localhost
@@ -87,7 +87,7 @@ spec:
            fieldRef:
              fieldPath: metadata.name
      - name: assets
-        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.25.1"
+        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.27.0"
        command:
        - /usr/bin/cozystack-assets-server
        - "-dir=/cozystack/assets"
--- a/packages/apps/clickhouse/Chart.yaml
+++ b/packages/apps/clickhouse/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.6.1
+version: 0.6.2

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/clickhouse/images/clickhouse-backup.tag
+++ b/packages/apps/clickhouse/images/clickhouse-backup.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/clickhouse-backup:0.6.1@sha256:7a99cabdfd541f863aa5d1b2f7b49afd39838fb94c8448986634a1dc9050751c
+ghcr.io/aenix-io/cozystack/clickhouse-backup:0.6.2@sha256:7a99cabdfd541f863aa5d1b2f7b49afd39838fb94c8448986634a1dc9050751c
--- a/packages/apps/clickhouse/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/clickhouse/templates/dashboard-resourcemap.yaml
@@ -17,3 +17,10 @@ rules:
  resourceNames:
  - {{ .Release.Name }}-credentials
  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - cozystack.io
+  resources:
+  - workloadmonitors
+  resourceNames:
+  - {{ .Release.Name }}
+  verbs: ["get", "list", "watch"]
--- a/packages/apps/clickhouse/templates/workloadmonitor.yaml
+++ b/packages/apps/clickhouse/templates/workloadmonitor.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: WorkloadMonitor
+metadata:
+  name: {{ $.Release.Name }}
+spec:
+  replicas: {{ .Values.replicas }}
+  minReplicas: 1
+  kind: clickhouse
+  type: clickhouse
+  selector:
+    clickhouse.altinity.com/chi: {{ $.Release.Name }}
+  version: {{ $.Chart.Version }}
--- a/packages/apps/ferretdb/Chart.yaml
+++ b/packages/apps/ferretdb/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.4.1
+version: 0.4.2

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/ferretdb/images/postgres-backup.tag
+++ b/packages/apps/ferretdb/images/postgres-backup.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/postgres-backup:0.8.0@sha256:6a8ec7e7052f2d02ec5457d7cbac6ee52b3ed93a883988a192d1394fc7c88117
+ghcr.io/aenix-io/cozystack/postgres-backup:0.9.0@sha256:6cc07280c0e2432ed37b2646faf82efe9702c6d93504844744aa505b890cac6f
--- a/packages/apps/ferretdb/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/ferretdb/templates/dashboard-resourcemap.yaml
@@ -17,3 +17,10 @@ rules:
  resourceNames:
  - {{ .Release.Name }}-credentials
  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - cozystack.io
+  resources:
+  - workloadmonitors
+  resourceNames:
+  - {{ .Release.Name }}
+  verbs: ["get", "list", "watch"]
--- a/packages/apps/ferretdb/templates/postgres.yaml
+++ b/packages/apps/ferretdb/templates/postgres.yaml
@@ -6,7 +6,13 @@ metadata:
 spec:
  instances: {{ .Values.replicas }}
  enableSuperuserAccess: true
-
+  {{- $configMap := lookup "v1" "ConfigMap" "cozy-system" "cozystack-scheduling" }}
+  {{- if $configMap }}
+  {{- $rawConstraints := get $configMap.data "globalAppTopologySpreadConstraints" }}
+  {{- if $rawConstraints }}
+  {{- $rawConstraints | fromYaml | toYaml | nindent 2 }}
+  {{- end }}
+  {{- end }}
  minSyncReplicas: {{ .Values.quorum.minSyncReplicas }}
  maxSyncReplicas: {{ .Values.quorum.maxSyncReplicas }}

--- a/packages/apps/ferretdb/templates/workloadmonitor.yaml
+++ b/packages/apps/ferretdb/templates/workloadmonitor.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: WorkloadMonitor
+metadata:
+  name: {{ $.Release.Name }}
+spec:
+  replicas: {{ .Values.replicas }}
+  minReplicas: 1
+  kind: ferretdb
+  type: ferretdb
+  selector:
+    app: {{ $.Release.Name }}
+  version: {{ $.Chart.Version }}
--- a/packages/apps/http-cache/images/nginx-cache.tag
+++ b/packages/apps/http-cache/images/nginx-cache.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/nginx-cache:0.3.1@sha256:4c79017b6663f894812d8c3d4f9e03ef44e4d4032ad8bb91945c92c7cce6a0b0
+ghcr.io/aenix-io/cozystack/nginx-cache:0.3.1@sha256:72ced2b1d8da2c784d6231af6cb0752170f6ea845c73effb11adb006b7a7fbb2
--- a/packages/apps/kafka/Chart.yaml
+++ b/packages/apps/kafka/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.3.2
+version: 0.3.3

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/kafka/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/kafka/templates/dashboard-resourcemap.yaml
@@ -17,3 +17,11 @@ rules:
  resourceNames:
  - {{ .Release.Name }}-clients-ca
  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - cozystack.io
+  resources:
+  - workloadmonitors
+  resourceNames:
+  - {{ .Release.Name }}
+  - {{ $.Release.Name }}-zookeeper
+  verbs: ["get", "list", "watch"]
--- a/packages/apps/kafka/templates/workloadmonitor.yaml
+++ b/packages/apps/kafka/templates/workloadmonitor.yaml
@@ -0,0 +1,30 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: WorkloadMonitor
+metadata:
+  name: {{ $.Release.Name }}
+spec:
+  replicas: {{ .Values.replicas }}
+  minReplicas: 1
+  kind: kafka
+  type: kafka
+  selector:
+    app.kubernetes.io/instance: {{ $.Release.Name }}
+    app.kubernetes.io/name: kafka
+  version: {{ $.Chart.Version }}
+
+---
+
+apiVersion: cozystack.io/v1alpha1
+kind: WorkloadMonitor
+metadata:
+  name: {{ $.Release.Name }}-zookeeper
+spec:
+  replicas: {{ .Values.replicas }}
+  minReplicas: 1
+  kind: kafka
+  type: zookeeper
+  selector:
+    app.kubernetes.io/instance: {{ $.Release.Name }}
+    app.kubernetes.io/name: zookeeper
+  version: {{ $.Chart.Version }}
--- a/packages/apps/kubernetes/Chart.yaml
+++ b/packages/apps/kubernetes/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.15.0
+version: 0.15.2

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/kubernetes/images/cluster-autoscaler.tag
+++ b/packages/apps/kubernetes/images/cluster-autoscaler.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/cluster-autoscaler:0.15.0@sha256:50efa0d1e807c50d10e8fcece332e4eb7de464e98b23db6e3be02a1ef740821f
+ghcr.io/aenix-io/cozystack/cluster-autoscaler:0.15.2@sha256:077023fc24d466ac18f8d43fec41b9a14c0b3d32c0013e836e7448e7a1e7d661
--- a/packages/apps/kubernetes/images/kubevirt-cloud-provider.tag
+++ b/packages/apps/kubernetes/images/kubevirt-cloud-provider.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/kubevirt-cloud-provider:0.15.0@sha256:461aee26669a15aa8febee5de43e1e5ec72b924ab3fe3fde2a0725ceef08a09b
+ghcr.io/aenix-io/cozystack/kubevirt-cloud-provider:0.15.2@sha256:5ef7198eaaa4e422caa5f3d8f906c908046f1fbaf2d7a1e72b5a98627db3bda8
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/kubevirt-csi-driver:0.15.0@sha256:7b206eb9c1b44cead6e0e4931c569612fa8034f026d845469ebd2d2ef46b85ab
+ghcr.io/aenix-io/cozystack/kubevirt-csi-driver:0.15.2@sha256:f862c233399b213e376628ffbb55304f08d171e991371d5bde067b47890cc959
--- a/packages/apps/kubernetes/images/ubuntu-container-disk.tag
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/ubuntu-container-disk:v1.30.1@sha256:c2c26e7a61208415b044d32872c8692bb46e9b62746ce45166d6cb7bd15c597b
+ghcr.io/aenix-io/cozystack/ubuntu-container-disk:v1.30.1@sha256:7ce5467b8f34ef7897141b0ca96c455459c2729cae5824a2c20f32b01a841f90
--- a/packages/apps/kubernetes/templates/cluster.yaml
+++ b/packages/apps/kubernetes/templates/cluster.yaml
@@ -118,7 +118,7 @@ spec:
    ingress:
      extraAnnotations:
        nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-      hostname: {{ .Values.host | default (printf "%s.%s" .Release.Name $host) }}:443
+      hostname: {{ .Values.host | default (printf "%s.%s" .Release.Name $host) }}
      className: "{{ $ingress }}"
  deployment:
    podAdditionalMetadata:
@@ -250,7 +250,7 @@ spec:
        apiVersion: infrastructure.cluster.x-k8s.io/v1alpha1
        kind: KubevirtMachineTemplate
        name: {{ $.Release.Name }}-{{ $groupName }}-{{ $kubevirtmachinetemplateHash }}
-        namespace: default
+        namespace: {{ $.Release.Namespace }}
      version: v1.30.1
 ---
 apiVersion: cluster.x-k8s.io/v1beta1
--- a/packages/apps/mysql/Chart.yaml
+++ b/packages/apps/mysql/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.5.2
+version: 0.5.3

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/mysql/images/mariadb-backup.tag
+++ b/packages/apps/mysql/images/mariadb-backup.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/mariadb-backup:0.5.2@sha256:4bbfbb397bd7ecea45507ca47989c51429c4a24f40853ac92583e5b5b352fbea
+ghcr.io/aenix-io/cozystack/mariadb-backup:0.5.3@sha256:89641695e0c1f4ad7b82697c27a2245bb4a1bc403845235ed0df98e04aa9a71f
--- a/packages/apps/mysql/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/mysql/templates/dashboard-resourcemap.yaml
@@ -18,3 +18,10 @@ rules:
  resourceNames:
  - {{ .Release.Name }}-credentials
  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - cozystack.io
+  resources:
+  - workloadmonitors
+  resourceNames:
+  - {{ .Release.Name }}
+  verbs: ["get", "list", "watch"]
--- a/packages/apps/mysql/templates/workloadmonitor.yaml
+++ b/packages/apps/mysql/templates/workloadmonitor.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: WorkloadMonitor
+metadata:
+  name: {{ $.Release.Name }}
+spec:
+  replicas: {{ .Values.replicas }}
+  minReplicas: 1
+  kind: mysql
+  type: mysql
+  selector:
+    app.kubernetes.io/instance: {{ $.Release.Name }}
+  version: {{ $.Chart.Version }}
--- a/packages/apps/nats/Chart.yaml
+++ b/packages/apps/nats/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.4.0
+version: 0.4.1

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/nats/templates/resourcemap.yaml
+++ b/packages/apps/nats/templates/resourcemap.yaml
@@ -17,3 +17,10 @@ rules:
  resourceNames:
  - {{ .Release.Name }}-credentials
  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - cozystack.io
+  resources:
+  - workloadmonitors
+  resourceNames:
+  - {{ .Release.Name }}
+  verbs: ["get", "list", "watch"]
--- a/packages/apps/nats/templates/workloadmonitor.yaml
+++ b/packages/apps/nats/templates/workloadmonitor.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: WorkloadMonitor
+metadata:
+  name: {{ $.Release.Name }}
+spec:
+  replicas: {{ .Values.replicas }}
+  minReplicas: 1
+  kind: nats
+  type: nats
+  selector:
+    app.kubernetes.io/instance: {{ $.Release.Name }}-system
+  version: {{ $.Chart.Version }}
--- a/packages/apps/postgres/Chart.yaml
+++ b/packages/apps/postgres/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.8.0
+version: 0.9.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/postgres/images/postgres-backup.tag
+++ b/packages/apps/postgres/images/postgres-backup.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/postgres-backup:0.8.0@sha256:6a8ec7e7052f2d02ec5457d7cbac6ee52b3ed93a883988a192d1394fc7c88117
+ghcr.io/aenix-io/cozystack/postgres-backup:0.9.0@sha256:6cc07280c0e2432ed37b2646faf82efe9702c6d93504844744aa505b890cac6f
--- a/packages/apps/postgres/templates/db.yaml
+++ b/packages/apps/postgres/templates/db.yaml
@@ -6,7 +6,13 @@ metadata:
 spec:
  instances: {{ .Values.replicas }}
  enableSuperuserAccess: true
-
+  {{- $configMap := lookup "v1" "ConfigMap" "cozy-system" "cozystack-scheduling" }}
+  {{- if $configMap }}
+  {{- $rawConstraints := get $configMap.data "globalAppTopologySpreadConstraints" }}
+  {{- if $rawConstraints }}
+  {{- $rawConstraints | fromYaml | toYaml | nindent 2 }}
+  {{- end }}
+  {{- end }}
  postgresql:
    parameters:
      max_wal_senders: "30"
--- a/packages/apps/rabbitmq/Chart.yaml
+++ b/packages/apps/rabbitmq/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.4.3
+version: 0.4.4

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/rabbitmq/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/rabbitmq/templates/dashboard-resourcemap.yaml
@@ -20,3 +20,10 @@ rules:
  resourceNames:
  - {{ .Release.Name }}
  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - cozystack.io
+  resources:
+  - workloadmonitors
+  resourceNames:
+  - {{ .Release.Name }}
+  verbs: ["get", "list", "watch"]
--- a/packages/apps/rabbitmq/templates/workloadmonitor.yaml
+++ b/packages/apps/rabbitmq/templates/workloadmonitor.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: WorkloadMonitor
+metadata:
+  name: {{ $.Release.Name }}
+spec:
+  replicas: {{ .Values.replicas }}
+  minReplicas: 1
+  kind: rabbitmq
+  type: rabbitmq
+  selector:
+    app.kubernetes.io/name: {{ $.Release.Name }}
+  version: {{ $.Chart.Version }}
--- a/packages/apps/tenant/Chart.yaml
+++ b/packages/apps/tenant/Chart.yaml
@@ -4,4 +4,4 @@ description: Separated tenant namespace
 icon: /logos/tenant.svg

 type: application
-version: 1.6.7
+version: 1.8.0
--- a/packages/apps/tenant/README.md
+++ b/packages/apps/tenant/README.md
@@ -50,11 +50,12 @@ tenant-u1

 ### Common parameters

-| Name         | Description                                                                                                                 | Value   |
-| ------------ | --------------------------------------------------------------------------------------------------------------------------- | ------- |
-| `host`       | The hostname used to access tenant services (defaults to using the tenant name as a subdomain for it's parent tenant host). | `""`    |
-| `etcd`       | Deploy own Etcd cluster                                                                                                     | `false` |
-| `monitoring` | Deploy own Monitoring Stack                                                                                                 | `false` |
-| `ingress`    | Deploy own Ingress Controller                                                                                               | `false` |
-| `seaweedfs`  | Deploy own SeaweedFS                                                                                                        | `false` |
-| `isolated`   | Enforce tenant namespace with network policies                                                                              | `false` |
+| Name             | Description                                                                                                                 | Value   |
+| ---------------- | --------------------------------------------------------------------------------------------------------------------------- | ------- |
+| `host`           | The hostname used to access tenant services (defaults to using the tenant name as a subdomain for it's parent tenant host). | `""`    |
+| `etcd`           | Deploy own Etcd cluster                                                                                                     | `false` |
+| `monitoring`     | Deploy own Monitoring Stack                                                                                                 | `false` |
+| `ingress`        | Deploy own Ingress Controller                                                                                               | `false` |
+| `seaweedfs`      | Deploy own SeaweedFS                                                                                                        | `false` |
+| `isolated`       | Enforce tenant namespace with network policies                                                                              | `false` |
+| `resourceQuotas` | Define resource quotas for the tenant                                                                                       | `{}`    |
--- a/packages/apps/tenant/templates/info.yaml
+++ b/packages/apps/tenant/templates/info.yaml
@@ -0,0 +1,27 @@
+{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
+{{- $oidcEnabled := index $cozyConfig.data "oidc-enabled" }}
+{{- if $oidcEnabled }}
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: info
+  namespace: {{ include "tenant.name" . }}
+  annotations:
+    helm.sh/resource-policy: keep
+  labels:
+    cozystack.io/ui: "true"
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+spec:
+  chart:
+    spec:
+      chart: info
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-extra
+        namespace: cozy-public
+      version: "*"
+  interval: 1m0s
+  timeout: 5m0s
+{{- end }}
--- a/packages/apps/tenant/templates/quota.yaml
+++ b/packages/apps/tenant/templates/quota.yaml
@@ -0,0 +1,10 @@
+{{- if .Values.resourceQuotas }}
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: tenant-quota
+  namespace: {{ include "tenant.name" . }}
+spec:
+  hard:
+    {{- toYaml .Values.resourceQuotas | nindent 4 }}
+{{- end }}
--- a/packages/apps/tenant/templates/tenant.yaml
+++ b/packages/apps/tenant/templates/tenant.yaml
@@ -34,7 +34,11 @@ rules:
 - apiGroups: ["apps.cozystack.io"]
  resources: ['*']
  verbs: ['*']
-
+- apiGroups:
+  - cozystack.io
+  resources:
+  - workloadmonitors
+  verbs: ["get", "list", "watch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -103,6 +107,11 @@ rules:
      - get
      - list
      - watch
+  - apiGroups:
+    - cozystack.io
+    resources:
+    - workloadmonitors
+    verbs: ["get", "list", "watch"]
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
@@ -175,6 +184,11 @@ rules:
    verbs:
    - get
    - list
+  - apiGroups:
+    - cozystack.io
+    resources:
+    - workloadmonitors
+    verbs: ["get", "list", "watch"]
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
@@ -258,6 +272,7 @@ rules:
    - virtualmachines
    - vmdisks
    - vminstances
+    - infos
    verbs:
    - get
    - list
@@ -266,6 +281,11 @@ rules:
    - update
    - patch
    - delete
+  - apiGroups:
+    - cozystack.io
+    resources:
+    - workloadmonitors
+    verbs: ["get", "list", "watch"]
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
@@ -334,6 +354,11 @@ rules:
    - '*'
    verbs:
    - '*'
+  - apiGroups:
+    - cozystack.io
+    resources:
+    - workloadmonitors
+    verbs: ["get", "list", "watch"]
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
--- a/packages/apps/tenant/values.schema.json
+++ b/packages/apps/tenant/values.schema.json
@@ -31,6 +31,11 @@
            "type": "boolean",
            "description": "Enforce tenant namespace with network policies",
            "default": false
+        },
+        "resourceQuotas": {
+            "type": "object",
+            "description": "Define resource quotas for the tenant",
+            "default": {}
        }
    }
 }
--- a/packages/apps/tenant/values.yaml
+++ b/packages/apps/tenant/values.yaml
@@ -6,9 +6,18 @@
 ## @param ingress Deploy own Ingress Controller
 ## @param seaweedfs Deploy own SeaweedFS
 ## @param isolated Enforce tenant namespace with network policies
+## @param resourceQuotas Define resource quotas for the tenant
 host: ""
 etcd: false
 monitoring: false
 ingress: false
 seaweedfs: false
 isolated: false
+resourceQuotas: {}
+# resourceQuotas:
+#   requests.cpu: "1"
+#   requests.memory: "1Gi"
+#   limits.cpu: "2"
+#   limits.memory: "2Gi"
+#   requests.nvidia.com/gpu: 4
+#   requests.storage: 100Gi
--- a/packages/apps/versions_map
+++ b/packages/apps/versions_map
@@ -6,13 +6,15 @@ clickhouse 0.3.0 b00621e
 clickhouse 0.4.0 320fc32
 clickhouse 0.5.0 2a4768a5
 clickhouse 0.6.0 18bbdb67
-clickhouse 0.6.1 HEAD
+clickhouse 0.6.1 b7375f73
+clickhouse 0.6.2 HEAD
 ferretdb 0.1.0 4ffa8615
 ferretdb 0.1.1 5ca8823
 ferretdb 0.2.0 adaf603
 ferretdb 0.3.0 aa2f553
 ferretdb 0.4.0 def2eb0f
-ferretdb 0.4.1 HEAD
+ferretdb 0.4.1 a9555210
+ferretdb 0.4.2 HEAD
 http-cache 0.1.0 a956713
 http-cache 0.2.0 5ca8823
 http-cache 0.3.0 fab5940
@@ -24,7 +26,8 @@ kafka 0.2.2 d0758692
 kafka 0.2.3 5ca8823
 kafka 0.3.0 c07c4bbd
 kafka 0.3.1 b7375f73
-kafka 0.3.2 HEAD
+kafka 0.3.2 b75aaf17
+kafka 0.3.3 HEAD
 kubernetes 0.1.0 f642698
 kubernetes 0.2.0 7cd7de73
 kubernetes 0.3.0 7caccec1
@@ -44,19 +47,23 @@ kubernetes 0.12.1 28fca4e
 kubernetes 0.13.0 ced8e5b9
 kubernetes 0.14.0 bfbde07c
 kubernetes 0.14.1 fde4bcfa
-kubernetes 0.15.0 HEAD
+kubernetes 0.15.0 cb7b8158
+kubernetes 0.15.1 77df31e1
+kubernetes 0.15.2 HEAD
 mysql 0.1.0 f642698
 mysql 0.2.0 8b975ff0
 mysql 0.3.0 5ca8823
 mysql 0.4.0 93018c4
 mysql 0.5.0 4b84798
 mysql 0.5.1 fab5940b
-mysql 0.5.2 HEAD
+mysql 0.5.2 d8a92aa3
+mysql 0.5.3 HEAD
 nats 0.1.0 5ca8823
 nats 0.2.0 c07c4bbd
 nats 0.3.0 78366f19
 nats 0.3.1 b7375f73
-nats 0.4.0 HEAD
+nats 0.4.0 da1e705a
+nats 0.4.1 HEAD
 postgres 0.1.0 f642698
 postgres 0.2.0 7cd7de73
 postgres 0.2.1 4a97e297
@@ -68,14 +75,16 @@ postgres 0.6.0 2a4768a
 postgres 0.6.2 54fd61c
 postgres 0.7.0 dc9d8bb
 postgres 0.7.1 175a65f
-postgres 0.8.0 HEAD
+postgres 0.8.0 cb7b8158
+postgres 0.9.0 HEAD
 rabbitmq 0.1.0 f642698
 rabbitmq 0.2.0 5ca8823
 rabbitmq 0.3.0 9e33dc0
 rabbitmq 0.4.0 36d8855
 rabbitmq 0.4.1 35536bb
 rabbitmq 0.4.2 00b2834e
-rabbitmq 0.4.3 HEAD
+rabbitmq 0.4.3 d8a92aa3
+rabbitmq 0.4.4 HEAD
 redis 0.1.1 f642698
 redis 0.2.0 5ca8823
 redis 0.3.0 c07c4bbd
@@ -101,7 +110,10 @@ tenant 1.6.3 2057bb96
 tenant 1.6.4 3c9e50a4
 tenant 1.6.5 f1e11451
 tenant 1.6.6 d4634797
-tenant 1.6.7 HEAD
+tenant 1.6.7 06afcf27
+tenant 1.6.8 4cc48e6f
+tenant 1.7.0 6c73e3f3
+tenant 1.8.0 HEAD
 virtual-machine 0.1.4 f2015d6
 virtual-machine 0.1.5 7cd7de7
 virtual-machine 0.2.0 5ca8823
@@ -111,15 +123,16 @@ virtual-machine 0.5.0 cad9cde
 virtual-machine 0.6.0 0e728870
 virtual-machine 0.7.0 af58018a
 virtual-machine 0.7.1 05857b95
-virtual-machine 0.8.0 3fa4dd3a
-virtual-machine 0.8.1 HEAD
+virtual-machine 0.8.0 3fa4dd3
+virtual-machine 0.8.1 3fa4dd3a
+virtual-machine 0.8.2 HEAD
 vm-disk 0.1.0 HEAD
 vm-instance 0.1.0 ced8e5b9
 vm-instance 0.2.0 4f767ee3
 vm-instance 0.3.0 0e728870
 vm-instance 0.4.0 af58018a
 vm-instance 0.4.1 05857b95
-vm-instance 0.5.0 3fa4dd3a
+vm-instance 0.5.0 3fa4dd3
 vm-instance 0.5.1 HEAD
 vpn 0.1.0 f642698
 vpn 0.2.0 7151424
--- a/packages/apps/virtual-machine/Chart.yaml
+++ b/packages/apps/virtual-machine/Chart.yaml
@@ -17,10 +17,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.8.1
+version: 0.8.2

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "0.8.1"
+appVersion: "0.8.2"
--- a/packages/apps/virtual-machine/Makefile
+++ b/packages/apps/virtual-machine/Makefile
@@ -8,4 +8,4 @@ generate:
 	  && yq -i -o json ".properties.instanceProfile.optional=true | .properties.instanceProfile.enum = $${PREFERENCES}" values.schema.json
 	yq -i -o json '.properties.externalPorts.items.type = "integer"' values.schema.json
 	yq -i -o json '.properties.systemDisk.properties.image.enum = ["ubuntu", "cirros", "alpine", "fedora", "talos"]' values.schema.json
-	yq -i -o json '.properties.externalMethod.enum = ["wholeIP", "PortList"]' values.schema.json
+	yq -i -o json '.properties.externalMethod.enum = ["WholeIP", "PortList"]' values.schema.json
--- a/packages/apps/virtual-machine/values.schema.json
+++ b/packages/apps/virtual-machine/values.schema.json
@@ -12,7 +12,7 @@
      "description": "specify method to passthrough the traffic to the virtual machine. Allowed values: `WholeIP` and `PortList`",
      "default": "WholeIP",
      "enum": [
-        "wholeIP",
+        "WholeIP",
        "PortList"
      ]
    },
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -1,2 +1,2 @@
 cozystack:
-  image: ghcr.io/aenix-io/cozystack/cozystack:v0.25.1@sha256:bf74a003181ffb10c1a158b6920bb3d9be2cf06ecd41cb6519ad237ba52e9be1
+  image: ghcr.io/aenix-io/cozystack/cozystack:v0.27.0@sha256:aac04571e99e13653f08e6ccc2b2214032455af547f9a887d01f1483e30d2915
--- a/packages/core/platform/bundles/distro-full.yaml
+++ b/packages/core/platform/bundles/distro-full.yaml
@@ -174,7 +174,7 @@ releases:
  chart: cozy-linstor
  namespace: cozy-linstor
  privileged: true
-  dependsOn: [piraeus-operator,cilium,cert-manager]
+  dependsOn: [piraeus-operator,cilium,cert-manager,snapshot-controller]

 - name: telepresence
  releaseName: traffic-manager
--- a/packages/core/platform/bundles/paas-full.yaml
+++ b/packages/core/platform/bundles/paas-full.yaml
@@ -205,7 +205,7 @@ releases:
  chart: cozy-linstor
  namespace: cozy-linstor
  privileged: true
-  dependsOn: [piraeus-operator,cilium,kubeovn,cert-manager]
+  dependsOn: [piraeus-operator,cilium,kubeovn,cert-manager,snapshot-controller]

 - name: snapshot-controller
  releaseName: snapshot-controller
@@ -232,24 +232,62 @@ releases:
  namespace: cozy-dashboard
  dependsOn: [cilium,kubeovn,keycloak-configure]
  values:
+    kubeapps:
    {{- if .Capabilities.APIVersions.Has "source.toolkit.fluxcd.io/v1" }}
    {{- with (lookup "source.toolkit.fluxcd.io/v1" "HelmRepository" "cozy-public" "").items }}
-    redis:
-      master:
-        podAnnotations:
-          {{- range $index, $repo := . }}
-          {{- with (($repo.status).artifact).revision }}
-          repository.cozystack.io/{{ $repo.metadata.name }}: {{ quote . }}
+      redis:
+        master:
+          podAnnotations:
+            {{- range $index, $repo := . }}
+            {{- with (($repo.status).artifact).revision }}
+            repository.cozystack.io/{{ $repo.metadata.name }}: {{ quote . }}
+            {{- end }}
+            {{- end }}
+    {{- end }}
+    {{- end }}
+      dashboard:
+        {{- $cozystackBranding:= lookup "v1" "ConfigMap" "cozy-system" "cozystack-branding" }}
+        {{- $branding := dig "data" "branding" "" $cozystackBranding }}
+        {{- if $branding }}
+        customLocale:
+          "Kubeapps": {{ $branding }}
+        {{- end }}
+        customStyle: |
+          {{- $logoImage := dig "data" "logo" "" $cozystackBranding }}
+          {{- if $logoImage }}
+          .kubeapps-logo {
+            background-image: {{ $logoImage }}
+          }
          {{- end }}
-          {{- end }}
-    {{- end }}
-    {{- end }}
-
-    {{- $dashboardKCconfig := lookup "v1" "ConfigMap" "cozy-dashboard" "kubeapps-auth-config" }}
-    {{- $dashboardKCValues := dig "data" "values.yaml" "" $dashboardKCconfig }}
-    {{- if $dashboardKCValues }}
-    {{- $dashboardKCValues | nindent 4 }}
-    {{- end }}
+          #serviceaccount-selector {
+            display: none;
+          }
+          .login-moreinfo {
+            display: none;
+          }
+          a[href="#/docs"] {
+            display: none;
+          }
+          .login-group .clr-form-control .clr-control-label {
+            display: none;
+          }
+          .appview-separator div.appview-first-row div.center {
+            display: none;
+          }
+          .appview-separator div.appview-first-row section[aria-labelledby="app-secrets"] {
+            display: none;
+          }
+          .appview-first-row section[aria-labelledby="access-urls-title"] {
+            width: 100%;
+          }
+  {{- $dashboardKCconfig := lookup "v1" "ConfigMap" "cozy-dashboard" "kubeapps-auth-config" }}
+  {{- $dashboardKCValues := dig "data" "values.yaml" "" $dashboardKCconfig }}
+  {{- if $dashboardKCValues }}
+  valuesFrom:
+  - kind: ConfigMap
+    name: kubeapps-auth-config
+    valuesKey: values.yaml
+  {{- end }}

  {{- if eq $oidcEnabled "true" }}
  dependsOn: [keycloak-configure]
@@ -321,3 +359,10 @@ releases:
    cozystack:
      configHash: {{ $cozyConfig | toJson | sha256sum }}
 {{- end }}
+
+- name: goldpinger
+  releaseName: goldpinger
+  chart: cozy-goldpinger
+  namespace: cozy-goldpinger
+  privileged: true
+  dependsOn: [monitoring-agents]
--- a/packages/core/platform/bundles/paas-hosted.yaml
+++ b/packages/core/platform/bundles/paas-hosted.yaml
@@ -155,9 +155,9 @@ releases:
  chart: cozy-dashboard
  namespace: cozy-dashboard
  values:
+    kubeapps:
    {{- if .Capabilities.APIVersions.Has "source.toolkit.fluxcd.io/v1" }}
    {{- with (lookup "source.toolkit.fluxcd.io/v1" "HelmRepository" "cozy-public" "").items }}
-    kubeapps:
      redis:
        master:
          podAnnotations:
@@ -168,12 +168,49 @@ releases:
            {{- end }}
    {{- end }}
    {{- end }}
-
-    {{- $dashboardKCconfig := lookup "v1" "ConfigMap" "cozy-dashboard" "kubeapps-auth-config" }}
-    {{- $dashboardKCValues := dig "data" "values.yaml" "" $dashboardKCconfig }}
-    {{- if $dashboardKCValues }}
-    {{- $dashboardKCValues | nindent 4 }}
-    {{- end }}
+      dashboard:
+        {{- $cozystackBranding:= lookup "v1" "ConfigMap" "cozy-system" "cozystack-branding" }}
+        {{- $branding := dig "data" "branding" "" $cozystackBranding }}
+        {{- if $branding }}
+        customLocale:
+          "Kubeapps": {{ $branding }}
+        {{- end }}
+        customStyle: |
+          {{- $logoImage := dig "data" "logo" "" $cozystackBranding }}
+          {{- if $logoImage }}
+          .kubeapps-logo {
+            background-image: {{ $logoImage }}
+          }
+          {{- end }}
+          #serviceaccount-selector {
+            display: none;
+          }
+          .login-moreinfo {
+            display: none;
+          }
+          a[href="#/docs"] {
+            display: none;
+          }
+          .login-group .clr-form-control .clr-control-label {
+            display: none;
+          }
+          .appview-separator div.appview-first-row div.center {
+            display: none;
+          }
+          .appview-separator div.appview-first-row section[aria-labelledby="app-secrets"] {
+            display: none;
+          }
+          .appview-first-row section[aria-labelledby="access-urls-title"] {
+            width: 100%;
+          }
+  {{- $dashboardKCconfig := lookup "v1" "ConfigMap" "cozy-dashboard" "kubeapps-auth-config" }}
+  {{- $dashboardKCValues := dig "data" "values.yaml" "" $dashboardKCconfig }}
+  {{- if $dashboardKCValues }}
+  valuesFrom:
+  - kind: ConfigMap
+    name: kubeapps-auth-config
+    valuesKey: values.yaml
+  {{- end }}

  {{- if eq $oidcEnabled "true" }}
  dependsOn: [keycloak-configure]
@@ -203,3 +240,10 @@ releases:
    cozystack:
      configHash: {{ $cozyConfig | toJson | sha256sum }}
 {{- end }}
+
+- name: goldpinger
+  releaseName: goldpinger
+  chart: cozy-goldpinger
+  namespace: cozy-goldpinger
+  privileged: true
+  dependsOn: [monitoring-agents]
--- a/packages/core/testing/values.yaml
+++ b/packages/core/testing/values.yaml
@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/aenix-io/cozystack/e2e-sandbox:v0.25.1@sha256:eef99408647d4a427f971eed8a2ccd0ebc7f99b3c99f3f911bc87ffe34500661
+  image: ghcr.io/aenix-io/cozystack/e2e-sandbox:v0.27.0@sha256:1380b550c37c7316d924c9827122eb6fbb8e7da9aad8014f90b010b40f6c744d
--- a/packages/extra/bootbox/images/matchbox.tag
+++ b/packages/extra/bootbox/images/matchbox.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/matchbox:v0.25.1@sha256:a6febea70f863ad834695f729d9befde7d970a36c605f1902a4d79e40dfbbe72
+ghcr.io/aenix-io/cozystack/matchbox:v0.27.0@sha256:ef53e59943706fd9bce33b021b11ef469b44f97a184661f7ac24eb5f1b57fe9e
--- a/packages/extra/etcd/Chart.yaml
+++ b/packages/extra/etcd/Chart.yaml
@@ -3,4 +3,4 @@ name: etcd
 description: Storage for Kubernetes clusters
 icon: /logos/etcd.svg
 type: application
-version: 2.5.0
+version: 2.6.1
--- a/packages/extra/etcd/templates/etcd-cluster.yaml
+++ b/packages/extra/etcd/templates/etcd-cluster.yaml
@@ -73,11 +73,12 @@ spec:
  - "key encipherment"
  - "cert sign"
  commonName: etcd-peer-ca
+  duration: 87600h
  subject:
    organizations:
-      - ACME Inc.
+      - {{ .Release.Namespace }}
    organizationalUnits:
-      - Widgets
+      - {{ .Release.Name }}
  secretName: etcd-peer-ca-tls
  privateKey:
    algorithm: RSA
@@ -98,11 +99,12 @@ spec:
  - "key encipherment"
  - "cert sign"
  commonName: etcd-ca
+  duration: 87600h
  subject:
    organizations:
-      - ACME Inc.
+      - {{ .Release.Namespace }}
    organizationalUnits:
-      - Widgets
+      - {{ .Release.Name }}
  secretName: etcd-ca-tls
  privateKey:
    algorithm: RSA
@@ -133,9 +135,16 @@ kind: Certificate
 metadata:
  name: etcd-server
 spec:
+  commonName: etcd-server
  secretName: etcd-server-tls
+  subject:
+    organizations:
+      - {{ .Release.Namespace }}
+    organizationalUnits:
+      - {{ .Release.Name }}
  isCA: false
  usages:
+    - "client auth"
    - "server auth"
    - "signing"
    - "key encipherment"
@@ -146,6 +155,7 @@ spec:
  - etcd-{{ $i }}.etcd-headless.{{ $.Release.Namespace }}.svc
  {{- end }}
  - localhost
+  ipAddresses:
  - "127.0.0.1"
  privateKey:
    rotationPolicy: Always
@@ -159,7 +169,13 @@ kind: Certificate
 metadata:
  name: etcd-peer
 spec:
+  commonName: etcd-peer
  secretName: etcd-peer-tls
+  subject:
+    organizations:
+      - {{ .Release.Namespace }}
+    organizationalUnits:
+      - {{ .Release.Name }}
  isCA: false
  usages:
    - "server auth"
@@ -173,6 +189,7 @@ spec:
  - etcd-{{ $i }}.etcd-headless.{{ $.Release.Namespace }}.svc
  {{- end }}
  - localhost
+  ipAddresses:
  - "127.0.0.1"
  privateKey:
    rotationPolicy: Always
@@ -188,6 +205,11 @@ metadata:
 spec:
  commonName: root
  secretName: etcd-client-tls
+  subject:
+    organizations:
+      - {{ .Release.Namespace }}
+    organizationalUnits:
+      - {{ .Release.Name }}
  usages:
  - "signing"
  - "key encipherment"
--- a/packages/extra/etcd/templates/hook/job.yaml
+++ b/packages/extra/etcd/templates/hook/job.yaml
@@ -0,0 +1,39 @@
+{{- $shouldUpdateCerts := true }}
+{{- $configMap := lookup "v1" "ConfigMap" .Release.Namespace "etcd-deployed-version" }}
+{{- if $configMap }}
+  {{- $deployedVersion := index $configMap "data" "version" }}
+  {{- if $deployedVersion | semverCompare ">= 2.6.1" }}
+    {{- $shouldUpdateCerts = false }}
+  {{- end }}
+{{- end }}
+
+{{- if $shouldUpdateCerts }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: etcd-hook
+  annotations:
+    helm.sh/hook: post-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  template:
+    metadata:
+      labels:
+        policy.cozystack.io/allow-to-apiserver: "true"
+    spec:
+      serviceAccountName: etcd-hook
+      containers:
+        - name: kubectl
+          image: bitnami/kubectl:latest
+          command:
+          - sh
+          args:
+            - -exc
+            - |-
+              kubectl --namespace={{ .Release.Namespace }} delete secrets etcd-ca-tls etcd-peer-ca-tls 
+              sleep 10
+              kubectl --namespace={{ .Release.Namespace }} delete secrets etcd-client-tls etcd-peer-tls etcd-server-tls
+              kubectl --namespace={{ .Release.Namespace }} delete pods --selector=app.kubernetes.io/instance=etcd,app.kubernetes.io/managed-by=etcd-operator,app.kubernetes.io/name=etcd,cozystack.io/service=etcd
+      restartPolicy: Never
+{{- end }}
--- a/packages/extra/etcd/templates/hook/role.yaml
+++ b/packages/extra/etcd/templates/hook/role.yaml
@@ -0,0 +1,26 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  annotations:
+    helm.sh/hook: post-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+  name: etcd-hook
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+  - delete
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
--- a/packages/extra/etcd/templates/hook/rolebinding.yaml
+++ b/packages/extra/etcd/templates/hook/rolebinding.yaml
@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: etcd-hook
+  annotations:
+    helm.sh/hook: post-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: etcd-hook
+subjects:
+  - kind: ServiceAccount
+    name: etcd-hook
+    namespace: {{ .Release.Namespace | quote }}
--- a/packages/extra/etcd/templates/hook/serviceaccount.yaml
+++ b/packages/extra/etcd/templates/hook/serviceaccount.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: etcd-hook
+  annotations:
+    helm.sh/hook: post-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
--- a/packages/extra/etcd/templates/version.yaml
+++ b/packages/extra/etcd/templates/version.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: etcd-deployed-version
+data:
+  version: {{ .Chart.Version }}
--- a/packages/extra/etcd/values.schema.json
+++ b/packages/extra/etcd/values.schema.json
@@ -18,4 +18,4 @@
            "default": 3
        }
    }
-}
+}
--- a/packages/extra/info/.helmignore
+++ b/packages/extra/info/.helmignore
@@ -0,0 +1,2 @@
+.helmignore
+/logos
--- a/packages/extra/info/Chart.yaml
+++ b/packages/extra/info/Chart.yaml
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: info
+description: Info
+icon: /logos/info.svg
+type: application
+version: 1.0.0
--- a/packages/extra/info/Makefile
+++ b/packages/extra/info/Makefile
@@ -0,0 +1,3 @@
+NAME=etcd
+
+include ../../../scripts/package.mk
--- a/packages/extra/info/README.md
+++ b/packages/extra/info/README.md
@@ -0,0 +1,18 @@
+# Info
+
+### Kubeconfig for tenant 
+
+### Kubelogin
+
+For using kubeconfig need install kubelogin.
+
+```bash
+# Homebrew (macOS and Linux)
+brew install int128/kubelogin/kubelogin
+
+# Krew (macOS, Linux, Windows and ARM)
+kubectl krew install oidc-login
+
+# Chocolatey (Windows)
+choco install kubelogin
+```
--- a/packages/extra/info/logos/info.svg
+++ b/packages/extra/info/logos/info.svg
@@ -0,0 +1,15 @@
+<svg width="144" height="144" viewBox="0 0 144 144" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="144" height="144" rx="24" fill="url(#paint0_radial_144_3)"/>
+<g clip-path="url(#clip0_144_3)">
+<path d="M77.6407 97.0844L82.833 97.3604V104.637H61.1728V97.7197L64.1771 97.4495C65.8101 97.2684 66.8106 96.7193 66.8106 94.5343V69.2314C66.8106 67.2217 66.2701 66.5864 64.5365 66.5864L61.3568 66.4081V58.8584H77.6465L77.6407 97.0844ZM71.2726 39.363C75.2804 39.363 78.187 42.3731 78.187 46.1883C78.187 50.0149 75.2718 52.8381 71.1778 52.8381C66.9975 52.8381 64.2663 50.0149 64.2663 46.1883C64.2663 42.3731 66.9975 39.363 71.2726 39.363ZM72 118C46.6368 118 26 97.3632 26 72C26 46.6368 46.6368 26 72 26C97.3575 26 118 46.6368 118 72C118 97.3632 97.3575 118 72 118ZM72 34.625C51.392 34.625 34.625 51.392 34.625 72C34.625 92.608 51.392 109.375 72 109.375C92.608 109.375 109.375 92.608 109.375 72C109.375 51.392 92.608 34.625 72 34.625Z" fill="white"/>
+</g>
+<defs>
+<radialGradient id="paint0_radial_144_3" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1.32298e-05 -7.50001) rotate(44.7178) scale(215.317 312.455)">
+<stop stop-color="#00B5E7"/>
+<stop offset="1" stop-color="#003984"/>
+</radialGradient>
+<clipPath id="clip0_144_3">
+<rect width="92" height="92" fill="white" transform="translate(26 26)"/>
+</clipPath>
+</defs>
+</svg>
--- a/packages/apps/tenant/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/tenant/templates/dashboard-resourcemap.yaml
@@ -1,13 +1,12 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: {{ include "tenant.name" . }}-dashboard-resources
-  namespace: {{ .Release.namespace }}
+  name: info-dashboard-resources
 rules:
 - apiGroups:
  - ""
  resources:
  - secrets
  resourceNames:
-  - kubeconfig-{{ include "tenant.name" . }}
+  - kubeconfig-{{ .Release.Namespace }}
  verbs: ["get", "list", "watch"]
--- a/packages/apps/tenant/templates/kubeconfig.yaml
+++ b/packages/apps/tenant/templates/kubeconfig.yaml
@@ -15,8 +15,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: kubeconfig-{{ include "tenant.name" . }}
-  namespace: tenant-root
+  name: kubeconfig-{{ .Release.Namespace }}
 stringData:
  kubeconfig: |
    apiVersion: v1
@@ -28,10 +27,10 @@ stringData:
    contexts:
    - context:
        cluster: cluster
-        namespace: {{ include "tenant.name" . }}
+        namespace: {{ .Release.Namespace }}
        user: keycloak
-      name: {{ include "tenant.name" . }}
-    current-context: {{ include "tenant.name" . }}
+      name: {{ .Release.Namespace }}
+    current-context: {{ .Release.Namespace }}
    users:
    - name: keycloak
      user:
--- a/packages/extra/info/values.schema.json
+++ b/packages/extra/info/values.schema.json
@@ -0,0 +1 @@
+{}
--- a/packages/extra/info/values.yaml
+++ b/packages/extra/info/values.yaml
--- a/packages/extra/monitoring/Chart.yaml
+++ b/packages/extra/monitoring/Chart.yaml
@@ -3,4 +3,4 @@ name: monitoring
 description: Monitoring and observability stack
 icon: /logos/monitoring.svg
 type: application
-version: 1.8.0
+version: 1.8.1
--- a/packages/extra/monitoring/dashboards.list
+++ b/packages/extra/monitoring/dashboards.list
@@ -35,3 +35,6 @@ kubevirt/kubevirt-control-plane
 flux/flux-control-plane
 flux/flux-stats
 kafka/strimzi-kafka
+goldpinger/goldpinger
+clickhouse/altinity-clickhouse-operator-dashboard
+storage/linstor
--- a/packages/extra/monitoring/images/grafana.tag
+++ b/packages/extra/monitoring/images/grafana.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/grafana:1.8.0@sha256:0377abd3cb2c6e27b12ac297f1859aa4d550f1aa14989f824f2315d0dfd1a5b2
+ghcr.io/aenix-io/cozystack/grafana:1.8.1@sha256:0377abd3cb2c6e27b12ac297f1859aa4d550f1aa14989f824f2315d0dfd1a5b2
--- a/packages/extra/monitoring/templates/alerta/alerta-db.yaml
+++ b/packages/extra/monitoring/templates/alerta/alerta-db.yaml
@@ -5,6 +5,13 @@ metadata:
  name: alerta-db
 spec:
  instances: 2
+  {{- $configMap := lookup "v1" "ConfigMap" "cozy-system" "cozystack-scheduling" }}
+  {{- if $configMap }}
+  {{- $rawConstraints := get $configMap.data "globalAppTopologySpreadConstraints" }}
+  {{- if $rawConstraints }}
+  {{- $rawConstraints | fromYaml | toYaml | nindent 2 }}
+  {{- end }}
+  {{- end }}
  storage:
    size: {{ required ".Values.alerta.storage is required" .Values.alerta.storage }}
    {{- with .Values.alerta.storageClassName }}
--- a/packages/extra/monitoring/templates/grafana/db.yaml
+++ b/packages/extra/monitoring/templates/grafana/db.yaml
@@ -6,7 +6,13 @@ spec:
  instances: 2
  storage:
    size: {{ .Values.grafana.db.size }}
-
+  {{- $configMap := lookup "v1" "ConfigMap" "cozy-system" "cozystack-scheduling" }}
+  {{- if $configMap }}
+  {{- $rawConstraints := get $configMap.data "globalAppTopologySpreadConstraints" }}
+  {{- if $rawConstraints }}
+  {{- $rawConstraints | fromYaml | toYaml | nindent 2 }}
+  {{- end }}
+  {{- end }}
  monitoring:
    enablePodMonitor: true

--- a/packages/extra/monitoring/templates/vm/vmcluster.yaml
+++ b/packages/extra/monitoring/templates/vm/vmcluster.yaml
@@ -8,29 +8,32 @@ spec:
  replicationFactor: 2
  retentionPeriod: {{ .retentionPeriod | quote }}
  vminsert:
+    extraArgs:
+      # kubevirt and other systems produce a lot of labels
+      # it's usually more than default 30
+      maxLabelsPerTimeseries: "60"
    replicaCount: 2
    resources:
-      {{- if and (hasKey . "vminsert") (hasKey .vminsert "resources") }}
-      {{- toYaml .vminsert.resources | nindent 6 }}
-      {{- else }}
      limits:
-        memory: 1000Mi
+        {{- with . | dig "vminsert" "resources" "limits" "cpu" nil }}
+        cpu: {{ . | quote }}
+        {{- end }}
+        memory: {{ . | dig "vminsert" "resources" "limits" "memory" "1000Mi" }}
      requests:
-        cpu: 100m
-        memory: 500Mi
-      {{- end }}
+        cpu: {{ . | dig "vminsert" "resources" "requests" "cpu" "500m" }}
+        memory: {{ . | dig "vminsert" "resources" "requests" "memory" "500Mi" }}
  vmselect:
    replicaCount: 2
    resources:
-      {{- if and (hasKey . "vmselect") (hasKey .vmselect "resources") }}
-      {{- toYaml .vmselect.resources | nindent 6 }}
-      {{- else }}
      limits:
-        memory: 1000Mi
+        # if we don't set the cpu limit, victoriametrics-operator will set 500m here, which is ridiculous small
+        # see internal/config/config.go in victoriametrics-operator
+        # 2 vcpu is the bare minimum for **single** Grafana user
+        cpu: {{ . | dig "vmselect" "resources" "limits" "cpu" "2000m" }}
+        memory: {{ . | dig "vmselect" "resources" "limits" "memory" "1000Mi" }}
      requests:
-        cpu: 100m
-        memory: 500Mi
-      {{- end }}
+        cpu: {{ . | dig "vmselect" "resources" "requests" "cpu" "500m" }}
+        memory: {{ . | dig "vmselect" "resources" "requests" "memory" "500Mi" }}
    extraArgs:
      search.maxUniqueTimeseries: "600000"
      vmalert.proxyURL: http://vmalert-{{ .name }}.{{ $.Release.Namespace }}.svc:8080
@@ -48,15 +51,14 @@ spec:
  vmstorage:
    replicaCount: 2
    resources:
-      {{- if and (hasKey . "vmstorage") (hasKey .vmstorage "resources") }}
-      {{- toYaml .vmstorage.resources | nindent 6 }}
-      {{- else }}
      limits:
-        memory: 2048Mi
+        {{- with . | dig "vmstorage" "resources" "limits" "cpu" nil }}
+        cpu: {{ . | quote }}
+        {{- end }}
+        memory: {{ . | dig "vmstorage" "resources" "limits" "memory" "2048Mi" }}
      requests:
-        cpu: 100m
-        memory: 500Mi
-      {{- end }}
+        cpu: {{ . | dig "vmstorage" "resources" "requests" "cpu" "100m" }}
+        memory: {{ . | dig "vmstorage" "resources" "requests" "memory" "500Mi" }}
    storage:
      volumeClaimTemplate:
        spec:
--- a/packages/extra/versions_map
+++ b/packages/extra/versions_map
@@ -6,7 +6,10 @@ etcd 2.1.0 2b00fcf8
 etcd 2.2.0 5ca8823
 etcd 2.3.0 b908400d
 etcd 2.4.0 cb7b8158
-etcd 2.5.0 HEAD
+etcd 2.5.0 861e6c46
+etcd 2.6.0 a7425b0
+etcd 2.6.1 HEAD
+info 1.0.0 HEAD
 ingress 1.0.0 f642698
 ingress 1.1.0 838bee5d
 ingress 1.2.0 ced8e5b
@@ -26,7 +29,8 @@ monitoring 1.5.4 d4634797
 monitoring 1.6.0 cb7b8158
 monitoring 1.6.1 3bb97596
 monitoring 1.7.0 749110aa
-monitoring 1.8.0 HEAD
+monitoring 1.8.0 80b4c151
+monitoring 1.8.1 HEAD
 seaweedfs 0.1.0 5ca8823
 seaweedfs 0.2.0 9e33dc0
 seaweedfs 0.2.1 249bf35
--- a/packages/system/bucket/images/s3manager.tag
+++ b/packages/system/bucket/images/s3manager.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/s3manager:v0.5.0@sha256:b4ea039e7a04edb1afb3dda86b5caf0fda6dcf826886118058560bf876c7197b
+ghcr.io/aenix-io/cozystack/s3manager:v0.5.0@sha256:3bf81b4cc5fdd5b99da40a663e15c649b2d992cd933bd56f8bb1bc9dd41a7b11
--- a/packages/system/capi-operator/charts/cluster-api-operator/Chart.yaml
+++ b/packages/system/capi-operator/charts/cluster-api-operator/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
-appVersion: 0.11.0
+appVersion: 0.17.0
 description: Cluster API Operator
 name: cluster-api-operator
 type: application
-version: 0.11.0
+version: 0.17.0
--- a/packages/system/capi-operator/charts/cluster-api-operator/templates/addon.yaml
+++ b/packages/system/capi-operator/charts/cluster-api-operator/templates/addon.yaml
@@ -26,7 +26,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
  annotations:
-    "helm.sh/hook": "post-install"
+    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "1"
    "argocd.argoproj.io/sync-wave": "1"
  name: {{ $addonNamespace }}
@@ -37,7 +37,7 @@ metadata:
  name: {{ $addonName }}
  namespace: {{ $addonNamespace }}
  annotations:
-    "helm.sh/hook": "post-install"
+    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "2"
    "argocd.argoproj.io/sync-wave": "2"
 {{- if or $addonVersion $.Values.secretName }}
--- a/packages/system/capi-operator/charts/cluster-api-operator/templates/bootstrap.yaml
+++ b/packages/system/capi-operator/charts/cluster-api-operator/templates/bootstrap.yaml
@@ -26,7 +26,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
  annotations:
-    "helm.sh/hook": "post-install"
+    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "1"
  name: {{ $bootstrapNamespace }}
 ---
@@ -36,7 +36,7 @@ metadata:
  name: {{ $bootstrapName }}
  namespace: {{ $bootstrapNamespace }}
  annotations:
-    "helm.sh/hook": "post-install"
+    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "2"
 {{- if or $bootstrapVersion $.Values.configSecret.name }}
 spec:
--- a/packages/system/capi-operator/charts/cluster-api-operator/templates/control-plane.yaml
+++ b/packages/system/capi-operator/charts/cluster-api-operator/templates/control-plane.yaml
@@ -26,7 +26,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
  annotations:
-    "helm.sh/hook": "post-install"
+    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "1"
  name: {{ $controlPlaneNamespace }}
 ---
@@ -36,14 +36,27 @@ metadata:
  name: {{ $controlPlaneName }}
  namespace: {{ $controlPlaneNamespace }}
  annotations:
-    "helm.sh/hook": "post-install"
+    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "2"
-{{- if or $controlPlaneVersion $.Values.configSecret.name }}
+{{- if or $controlPlaneVersion $.Values.configSecret.name $.Values.manager }}
 spec:
 {{- end}}
 {{- if $controlPlaneVersion }}
  version: {{ $controlPlaneVersion }}
 {{- end }}
+{{- if $.Values.manager }}
+{{- if hasKey $.Values.manager.featureGates $controlPlaneName }}
+  manager:
+{{- range $key, $value := $.Values.manager.featureGates }}
+  {{- if eq $key $controlPlaneName }}
+    featureGates:
+    {{- range $k, $v := $value }}
+      {{ $k }}: {{ $v }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
 {{- if $.Values.configSecret.name }}
  configSecret:
    name: {{ $.Values.configSecret.name }}
--- a/packages/system/capi-operator/charts/cluster-api-operator/templates/core-conditions.yaml
+++ b/packages/system/capi-operator/charts/cluster-api-operator/templates/core-conditions.yaml
@@ -6,7 +6,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
  annotations:
-    "helm.sh/hook": "post-install"
+    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "1"
  name: capi-system
 ---
@@ -16,7 +16,7 @@ metadata:
  name: cluster-api
  namespace: capi-system
  annotations:
-    "helm.sh/hook": "post-install"
+    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "2"
 {{- with .Values.configSecret }}
 spec:
--- a/packages/system/capi-operator/charts/cluster-api-operator/templates/core.yaml
+++ b/packages/system/capi-operator/charts/cluster-api-operator/templates/core.yaml
@@ -25,7 +25,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
  annotations:
-    "helm.sh/hook": "post-install"
+    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "1"
  name: {{ $coreNamespace }}
 ---
@@ -35,10 +35,10 @@ metadata:
  name: {{ $coreName }}
  namespace: {{ $coreNamespace }}
  annotations:
-    "helm.sh/hook": "post-install"
+    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "2"
    "argocd.argoproj.io/sync-wave": "2"
-{{- if or $coreVersion $.Values.configSecret.name }}
+{{- if or $coreVersion $.Values.configSecret.name $.Values.manager }}
 spec:
 {{- end}}
 {{- if $coreVersion }}
--- a/packages/system/capi-operator/charts/cluster-api-operator/templates/deployment.yaml
+++ b/packages/system/capi-operator/charts/cluster-api-operator/templates/deployment.yaml
@@ -47,6 +47,8 @@ spec:
      {{- toYaml . | nindent 8 }}
      {{- end }}
    spec:
+      serviceAccountName: capi-operator-manager
+      automountServiceAccountToken: true
      {{- with .Values.securityContext }}
      securityContext:
      {{- toYaml . | nindent 8 }}
@@ -63,15 +65,15 @@ spec:
        {{- if .Values.healthAddr }}
        - --health-addr={{ .Values.healthAddr }}
        {{- end }}
-        {{- if .Values.metricsBindAddr }}
-        - --metrics-bind-addr={{ .Values.metricsBindAddr }}
-        {{- end }}
        {{- if .Values.diagnosticsAddress }}
        - --diagnostics-address={{ .Values.diagnosticsAddress }}
        {{- end }}
        {{- if .Values.insecureDiagnostics }}
        - --insecure-diagnostics={{ .Values.insecureDiagnostics }}
        {{- end }}
+        {{- if .Values.watchConfigSecret }}
+        - --watch-configsecret
+        {{- end }}
        {{- with .Values.leaderElection }}
        - --leader-elect={{ .enabled }}
        {{- if .leaseDuration }}
@@ -95,9 +97,15 @@ spec:
        - containerPort: 9443
          name: webhook-server
          protocol: TCP
-        - containerPort: {{ ( split ":" $.Values.metricsBindAddr)._1 | int }}
+          {{- if $.Values.diagnosticsAddress }}
+          {{- $diagnosticsPort := $.Values.diagnosticsAddress }}
+          {{- if contains ":" $diagnosticsPort -}}
+          {{ $diagnosticsPort = ( split ":" $.Values.diagnosticsAddress)._1 | int }}
+          {{- end }}
+        - containerPort: {{ $diagnosticsPort | int }}
          name: metrics
          protocol: TCP
+          {{- end }}
        {{- with .Values.resources.manager }}
        resources:
        {{- toYaml . | nindent 12 }}
@@ -114,6 +122,31 @@ spec:
        volumeMounts:
        {{- toYaml . | nindent 12 }}
        {{- end }}
+        terminationMessagePolicy: FallbackToLogsOnError
+        {{- $healthAddr := $.Values.healthAddr }}
+        {{- if contains ":" $healthAddr -}}
+        {{ $healthAddr = ( split ":" $.Values.healthAddr)._1 | int }}
+        {{- end }}
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: {{ $healthAddr | default 9440 }}
+            scheme: HTTP
+          initialDelaySeconds: 15
+          periodSeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /readyz
+            port: {{ $healthAddr | default 9440 }}
+            scheme: HTTP
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
      terminationGracePeriodSeconds: 10
      {{- with .Values.volumes }}
      volumes:
--- a/packages/system/capi-operator/charts/cluster-api-operator/templates/infra-conditions.yaml
+++ b/packages/system/capi-operator/charts/cluster-api-operator/templates/infra-conditions.yaml
@@ -7,7 +7,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
  annotations:
-    "helm.sh/hook": "post-install"
+    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "1"
    "argocd.argoproj.io/sync-wave": "1"
  name: capi-kubeadm-bootstrap-system
@@ -18,7 +18,7 @@ metadata:
  name: kubeadm
  namespace: capi-kubeadm-bootstrap-system
  annotations:
-    "helm.sh/hook": "post-install"
+    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "2"
    "argocd.argoproj.io/sync-wave": "2"
 {{- with .Values.configSecret }}
@@ -37,7 +37,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
  annotations:
-    "helm.sh/hook": "post-install"
+    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "1"
    "argocd.argoproj.io/sync-wave": "1"
  name: capi-kubeadm-control-plane-system
@@ -48,11 +48,20 @@ metadata:
  name: kubeadm
  namespace: capi-kubeadm-control-plane-system
  annotations:
-    "helm.sh/hook": "post-install"
+    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "2"
    "argocd.argoproj.io/sync-wave": "2"
 {{- with .Values.configSecret }}
 spec:
+{{- if $.Values.manager }}
+  manager:
+{{- if and $.Values.manager.featureGates $.Values.manager.featureGates.kubeadm }}
+    featureGates:
+    {{- range $key, $value := $.Values.manager.featureGates.kubeadm }}
+      {{ $key }}: {{ $value }}
+    {{- end }}
+{{- end }}
+{{- end }}
  configSecret:
    name: {{ .name }}
    {{- if .namespace }}
--- a/packages/system/capi-operator/charts/cluster-api-operator/templates/infra.yaml
+++ b/packages/system/capi-operator/charts/cluster-api-operator/templates/infra.yaml
@@ -26,7 +26,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
  annotations:
-    "helm.sh/hook": "post-install"
+    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "1"
    "argocd.argoproj.io/sync-wave": "1"
  name: {{ $infrastructureNamespace }}
@@ -37,10 +37,10 @@ metadata:
  name: {{ $infrastructureName }}
  namespace: {{ $infrastructureNamespace }}
  annotations:
-    "helm.sh/hook": "post-install"
+    "helm.sh/hook": "post-install,post-upgrade"
    "helm.sh/hook-weight": "2"
    "argocd.argoproj.io/sync-wave": "2"
-{{- if or $infrastructureVersion $.Values.configSecret.name $.Values.manager }}
+{{- if or $infrastructureVersion $.Values.configSecret.name $.Values.manager $.Values.additionalDeployments }}
 spec:
 {{- end }}
 {{- if $infrastructureVersion }}
@@ -59,6 +59,16 @@ spec:
 {{- end }}
 {{- end }}
 {{- end }}
+{{- if and (kindIs "map" $.Values.fetchConfig) (hasKey $.Values.fetchConfig $infrastructureName) }}
+{{- range $key, $value := $.Values.fetchConfig }}
+  {{- if eq $key $infrastructureName }}
+  fetchConfig:
+    {{- range $k, $v := $value }}
+      {{ $k }}: {{ $v }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{- end }}
 {{- if $.Values.configSecret.name }}
  configSecret:
    name: {{ $.Values.configSecret.name }}
@@ -66,5 +76,8 @@ spec:
    namespace: {{ $.Values.configSecret.namespace }}
    {{- end }}
 {{- end }}
+{{- if $.Values.additionalDeployments }}
+  additionalDeployments: {{ toYaml $.Values.additionalDeployments | nindent 4 }}
+{{- end }}
 {{- end }}
 {{- end }}
--- a/packages/system/capi-operator/charts/cluster-api-operator/templates/ipam.yaml
+++ b/packages/system/capi-operator/charts/cluster-api-operator/templates/ipam.yaml
@@ -0,0 +1,73 @@
+# IPAM providers
+{{- if .Values.ipam }}
+{{- $ipams := split ";" .Values.ipam }}
+{{- $ipamNamespace := "" }}
+{{- $ipamName := "" }}
+{{- $ipamVersion := "" }}
+{{- range $ipam := $ipams }}
+{{- $ipamArgs := split ":" $ipam }}
+{{- $ipamArgsLen := len $ipamArgs }}
+{{-  if eq $ipamArgsLen 3 }}
+  {{- $ipamNamespace = $ipamArgs._0 }}
+  {{- $ipamName = $ipamArgs._1 }}
+  {{- $ipamVersion = $ipamArgs._2 }}
+{{-  else if eq $ipamArgsLen 2 }}
+  {{- $ipamNamespace = print $ipamArgs._0 "-ipam-system" }}
+  {{- $ipamName = $ipamArgs._0 }}
+  {{- $ipamVersion = $ipamArgs._1 }}
+{{-  else if eq $ipamArgsLen 1 }}
+  {{- $ipamNamespace = print $ipamArgs._0 "-ipam-system" }}
+  {{- $ipamName = $ipamArgs._0 }}
+{{- else }}
+  {{- fail "ipam provider argument should have the following format in-cluster:v1.0.0 or mynamespace:in-cluster:v1.0.0" }}
+{{- end }}
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    "helm.sh/hook": "post-install,post-upgrade"
+    "helm.sh/hook-weight": "1"
+    "argocd.argoproj.io/sync-wave": "1"
+  name: {{ $ipamNamespace }}
+---
+apiVersion: operator.cluster.x-k8s.io/v1alpha2
+kind: IPAMProvider
+metadata:
+  name: {{ $ipamName }}
+  namespace: {{ $ipamNamespace }}
+  annotations:
+    "helm.sh/hook": "post-install,post-upgrade"
+    "helm.sh/hook-weight": "2"
+    "argocd.argoproj.io/sync-wave": "2"
+{{- if or $ipamVersion $.Values.configSecret.name $.Values.manager $.Values.additionalDeployments }}
+spec:
+{{- end }}
+{{- if $ipamVersion }}
+  version: {{ $ipamVersion }}
+{{- end }}
+{{- if $.Values.manager }}
+  manager:
+{{- if and (kindIs "map" $.Values.manager.featureGates) (hasKey $.Values.manager.featureGates $ipamName) }}
+{{- range $key, $value := $.Values.manager.featureGates }}
+  {{- if eq $key $ipamName }}
+    featureGates:
+    {{- range $k, $v := $value }}
+      {{ $k }}: {{ $v }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- if $.Values.configSecret.name }}
+  configSecret:
+    name: {{ $.Values.configSecret.name }}
+    {{- if $.Values.configSecret.namespace }}
+    namespace: {{ $.Values.configSecret.namespace }}
+    {{- end }}
+{{- end }}
+{{- if $.Values.additionalDeployments }}
+  additionalDeployments: {{ toYaml $.Values.additionalDeployments | nindent 4 }}
+{{- end }}
+{{- end }}
+{{- end }}
--- a/packages/system/capi-operator/charts/cluster-api-operator/templates/operator-components.yaml
+++ b/packages/system/capi-operator/charts/cluster-api-operator/templates/operator-components.yaml
--- a/packages/system/capi-operator/charts/cluster-api-operator/values.yaml
+++ b/packages/system/capi-operator/charts/cluster-api-operator/values.yaml
@@ -5,8 +5,10 @@ core: ""
 bootstrap: ""
 controlPlane: ""
 infrastructure: ""
+ipam: ""
 addon: ""
 manager.featureGates: {}
+fetchConfig: {}
 # ---
 # Common configuration secret options
 configSecret: {}
@@ -19,14 +21,14 @@ leaderElection:
 image:
  manager:
    repository: registry.k8s.io/capi-operator/cluster-api-operator
-    tag: v0.11.0
+    tag: v0.17.0
    pullPolicy: IfNotPresent
 env:
  manager: []
-healthAddr: ":8081"
-metricsBindAddr: "127.0.0.1:8080"
-diagnosticsAddress: "8443"
+diagnosticsAddress: ":8443"
+healthAddr: ":9440"
 insecureDiagnostics: false
+watchConfigSecret: false
 imagePullSecrets: {}
 resources:
  manager:
--- a/packages/system/capi-providers/templates/providers.yaml
+++ b/packages/system/capi-providers/templates/providers.yaml
@@ -5,7 +5,7 @@ metadata:
  name: cluster-api
 spec:
  # https://github.com/kubernetes-sigs/cluster-api
-  version: v1.8.3
+  version: v1.9.5
 ---
 apiVersion: operator.cluster.x-k8s.io/v1alpha2
 kind: ControlPlaneProvider
@@ -13,7 +13,14 @@ metadata:
  name: kamaji
 spec:
  # https://github.com/clastix/cluster-api-control-plane-provider-kamaji
-  version: v0.11.0
+  version: v0.14.1
+  deployment:
+    containers:
+    - name: manager
+      resources:
+        limits:
+          cpu: 1024m
+          memory: 1024Mi
 ---
 apiVersion: operator.cluster.x-k8s.io/v1alpha2
 kind: BootstrapProvider
@@ -21,7 +28,7 @@ metadata:
  name: kubeadm
 spec:
  # https://github.com/kubernetes-sigs/cluster-api
-  version: v1.8.3
+  version: v1.9.5
 ---
 apiVersion: operator.cluster.x-k8s.io/v1alpha2
 kind: InfrastructureProvider
--- a/packages/system/cilium/charts/cilium/Chart.yaml
+++ b/packages/system/cilium/charts/cilium/Chart.yaml
@@ -79,7 +79,7 @@ annotations:
    Pod IP Pool\n  description: |\n    CiliumPodIPPool defines an IP pool that can
    be used for pooled IPAM (i.e. the multi-pool IPAM mode).\n"
 apiVersion: v2
-appVersion: 1.16.6
+appVersion: 1.16.7
 description: eBPF-based Networking, Security, and Observability
 home: https://cilium.io/
 icon: https://cdn.jsdelivr.net/gh/cilium/cilium@main/Documentation/images/logo-solo.svg
@@ -95,4 +95,4 @@ kubeVersion: '>= 1.21.0-0'
 name: cilium
 sources:
 - https://github.com/cilium/cilium
-version: 1.16.6
+version: 1.16.7
--- a/packages/system/cilium/charts/cilium/README.md
+++ b/packages/system/cilium/charts/cilium/README.md
@@ -1,6 +1,6 @@
 # cilium

-![Version: 1.16.6](https://img.shields.io/badge/Version-1.16.6-informational?style=flat-square) ![AppVersion: 1.16.6](https://img.shields.io/badge/AppVersion-1.16.6-informational?style=flat-square)
+![Version: 1.16.7](https://img.shields.io/badge/Version-1.16.7-informational?style=flat-square) ![AppVersion: 1.16.7](https://img.shields.io/badge/AppVersion-1.16.7-informational?style=flat-square)

 Cilium is open source software for providing and transparently securing
 network connectivity and loadbalancing between application workloads such as
@@ -182,7 +182,7 @@ contributors across the globe, there is almost always someone available to help.
 | clustermesh.apiserver.extraVolumeMounts | list | `[]` | Additional clustermesh-apiserver volumeMounts. |
 | clustermesh.apiserver.extraVolumes | list | `[]` | Additional clustermesh-apiserver volumes. |
 | clustermesh.apiserver.healthPort | int | `9880` | TCP port for the clustermesh-apiserver health API. |
-| clustermesh.apiserver.image | object | `{"digest":"sha256:ab2070ea48a52a55d961b81b7b5fbac7d40a3f428be9b1b6b9071d47f194456a","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.16.6","useDigest":true}` | Clustermesh API server image. |
+| clustermesh.apiserver.image | object | `{"digest":"sha256:8e7eda5b194d45c3b1607f5bf31cbb3fecd0f1cf85ce32b41f93b2bd832bf02f","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.16.7","useDigest":true}` | Clustermesh API server image. |
 | clustermesh.apiserver.kvstoremesh.enabled | bool | `true` | Enable KVStoreMesh. KVStoreMesh caches the information retrieved from the remote clusters in the local etcd instance. |
 | clustermesh.apiserver.kvstoremesh.extraArgs | list | `[]` | Additional KVStoreMesh arguments. |
 | clustermesh.apiserver.kvstoremesh.extraEnv | list | `[]` | Additional KVStoreMesh environment variables. |
@@ -353,10 +353,11 @@ contributors across the globe, there is almost always someone available to help.
 | envoy.extraVolumes | list | `[]` | Additional envoy volumes. |
 | envoy.healthPort | int | `9878` | TCP port for the health API. |
 | envoy.idleTimeoutDurationSeconds | int | `60` | Set Envoy upstream HTTP idle connection timeout seconds. Does not apply to connections with pending requests. Default 60s |
-| envoy.image | object | `{"digest":"sha256:a69dfe0e54b24b0ff747385c8feeae0612cfbcae97bfcc8ee42a773bb3f69c88","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.30.9-1737073743-40a016d11c0d863b772961ed0168eea6fe6b10a5","useDigest":true}` | Envoy container image. |
+| envoy.image | object | `{"digest":"sha256:fc708bd36973d306412b2e50c924cd8333de67e0167802c9b48506f9d772f521","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.31.5-1739264036-958bef243c6c66fcfd73ca319f2eb49fff1eb2ae","useDigest":true}` | Envoy container image. |
 | envoy.initialFetchTimeoutSeconds | int | `30` | Time in seconds after which the initial fetch on an xDS stream is considered timed out |
 | envoy.livenessProbe.failureThreshold | int | `10` | failure threshold of liveness probe |
 | envoy.livenessProbe.periodSeconds | int | `30` | interval between checks of the liveness probe |
+| envoy.log.accessLogBufferSize | int | `4096` | Size of the Envoy access log buffer created within the agent in bytes. Tune this value up if you encounter "Envoy: Discarded truncated access log message" errors. Large request/response header sizes (e.g. 16KiB) will require a larger buffer size. |
 | envoy.log.format | string | `"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v"` | The format string to use for laying out the log message metadata of Envoy. |
 | envoy.log.path | string | `""` | Path to a separate Envoy log file, if any. Defaults to /dev/stdout. |
 | envoy.maxConnectionDurationSeconds | int | `0` | Set Envoy HTTP option max_connection_duration seconds. Default 0 (disable) |
@@ -485,7 +486,7 @@ contributors across the globe, there is almost always someone available to help.
 | hubble.relay.extraVolumes | list | `[]` | Additional hubble-relay volumes. |
 | hubble.relay.gops.enabled | bool | `true` | Enable gops for hubble-relay |
 | hubble.relay.gops.port | int | `9893` | Configure gops listen port for hubble-relay |
-| hubble.relay.image | object | `{"digest":"sha256:ca8dcaa5a81a37743b1397ba2221d16d5d63e4a47607584f1bf50a3b0882bf3b","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.16.6","useDigest":true}` | Hubble-relay container image. |
+| hubble.relay.image | object | `{"digest":"sha256:8f408ed921cd534394aa1c57b313741cec6aec03a14ea243b2173cbf2c88c91e","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.16.7","useDigest":true}` | Hubble-relay container image. |
 | hubble.relay.listenHost | string | `""` | Host to listen to. Specify an empty string to bind to all the interfaces. |
 | hubble.relay.listenPort | string | `"4245"` | Port to listen to. |
 | hubble.relay.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
@@ -591,7 +592,7 @@ contributors across the globe, there is almost always someone available to help.
 | hubble.ui.updateStrategy | object | `{"rollingUpdate":{"maxUnavailable":1},"type":"RollingUpdate"}` | hubble-ui update strategy. |
 | identityAllocationMode | string | `"crd"` | Method to use for identity allocation (`crd` or `kvstore`). |
 | identityChangeGracePeriod | string | `"5s"` | Time to wait before using new identity on endpoint identity change. |
-| image | object | `{"digest":"sha256:1e0896b1c4c188b4812c7e0bed7ec3f5631388ca88325c1391a0ef9172c448da","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.16.6","useDigest":true}` | Agent container image. |
+| image | object | `{"digest":"sha256:294d2432507fed393b26e9fbfacb25c2e37095578cb34dabac7312b66ed0782e","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.16.7","useDigest":true}` | Agent container image. |
 | imagePullSecrets | list | `[]` | Configure image pull secrets for pulling container images |
 | ingressController.default | bool | `false` | Set cilium ingress controller to be the default ingress controller This will let cilium ingress controller route entries without ingress class set |
 | ingressController.defaultSecretName | string | `nil` | Default secret name for ingresses without .spec.tls[].secretName set. |
@@ -718,7 +719,7 @@ contributors across the globe, there is almost always someone available to help.
 | operator.hostNetwork | bool | `true` | HostNetwork setting |
 | operator.identityGCInterval | string | `"15m0s"` | Interval for identity garbage collection. |
 | operator.identityHeartbeatTimeout | string | `"30m0s"` | Timeout for identity heartbeats. |
-| operator.image | object | `{"alibabacloudDigest":"sha256:0e3c7fbcb6bde9a247cd2dd3d25230e2859d40d2eb58aba6265a2aab216775a9","awsDigest":"sha256:d11ee1cfa3465defe2df7ec1c6e8a77bcaf280b44d2c61aa7496c58b29550f6d","azureDigest":"sha256:0a05d7aea760923897aabd715213ab11a706051673d41fab3874a37f897c1bdd","genericDigest":"sha256:13d32071d5a52c069fb7c35959a56009c6914439adc73e99e098917646d154fc","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.16.6","useDigest":true}` | cilium-operator image. |
+| operator.image | object | `{"alibabacloudDigest":"sha256:dbdc856303e1ab6734538e29791fdfc4fe2c1295fd7bbce8fa006cd3165f85c8","awsDigest":"sha256:110d922337bdbfc3cd4d7d71b85b2c8f72c1d9925e9b61b4cd73ff990799d7ba","azureDigest":"sha256:4e7e64cc505676d402c68043934e2c8efc75b294245514d7611a58d06b5e0f69","genericDigest":"sha256:25a41ac50bcebfb780ed2970e55a5ba1a5f26996850ed5a694dc69b312e0b5a0","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.16.7","useDigest":true}` | cilium-operator image. |
 | operator.nodeGCInterval | string | `"5m0s"` | Interval for cilium node garbage collection. |
 | operator.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for cilium-operator pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | operator.podAnnotations | object | `{}` | Annotations to be added to cilium-operator pods |
@@ -768,7 +769,7 @@ contributors across the globe, there is almost always someone available to help.
 | preflight.extraEnv | list | `[]` | Additional preflight environment variables. |
 | preflight.extraVolumeMounts | list | `[]` | Additional preflight volumeMounts. |
 | preflight.extraVolumes | list | `[]` | Additional preflight volumes. |
-| preflight.image | object | `{"digest":"sha256:1e0896b1c4c188b4812c7e0bed7ec3f5631388ca88325c1391a0ef9172c448da","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.16.6","useDigest":true}` | Cilium pre-flight image. |
+| preflight.image | object | `{"digest":"sha256:294d2432507fed393b26e9fbfacb25c2e37095578cb34dabac7312b66ed0782e","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.16.7","useDigest":true}` | Cilium pre-flight image. |
 | preflight.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for preflight pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | preflight.podAnnotations | object | `{}` | Annotations to be added to preflight pods |
 | preflight.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
--- a/packages/system/cilium/charts/cilium/files/nodeinit/startup.bash
+++ b/packages/system/cilium/charts/cilium/files/nodeinit/startup.bash
@@ -116,6 +116,8 @@ else
  exec /home/kubernetes/bin/the-kubelet "${@}" --network-plugin=cni --cni-bin-dir={{ .Values.cni.binPath }}
 fi
 EOF
+    echo "Restarting the kubelet..."
+    systemctl restart kubelet
  else
    echo "Kubelet wrapper already exists, skipping..."
  fi
@@ -135,10 +137,10 @@ else
    echo "Changing kubelet configuration to --network-plugin=cni --cni-bin-dir={{ .Values.cni.binPath }}"
    mkdir -p {{ .Values.cni.binPath }}
    sed -i "s:--network-plugin=kubenet:--network-plugin=cni\ --cni-bin-dir={{ .Values.cni.binPath }}:g" "${KUBELET_DEFAULTS_FILE}"
+    echo "Restarting the kubelet..."
+    systemctl restart kubelet
  fi
 fi
-echo "Restarting the kubelet..."
-systemctl restart kubelet
 {{- end }}

 {{- if (and .Values.gke.enabled (or .Values.enableIPv4Masquerade .Values.gke.disableDefaultSnat))}}
--- a/packages/system/cilium/charts/cilium/templates/cilium-configmap.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-configmap.yaml
@@ -1284,7 +1284,9 @@ data:
 {{- if .Values.envoy.log.path }}
  envoy-log: {{ .Values.envoy.log.path | quote }}
 {{- end }}
-
+{{- if .Values.envoy.log.accessLogBufferSize }}
+  envoy-access-log-buffer-size: {{ .Values.envoy.log.accessLogBufferSize | quote }}
+{{- end }}
  envoy-keep-cap-netbindservice: {{ .Values.envoy.securityContext.capabilities.keepCapNetBindService | quote }}

 {{- if hasKey .Values.clustermesh "maxConnectedClusters" }}
--- a/packages/system/cilium/charts/cilium/templates/validate.yaml
+++ b/packages/system/cilium/charts/cilium/templates/validate.yaml
@@ -151,6 +151,7 @@
  {{ fail "The cluster name is invalid: cannot use default value with cluster.id != 0" }}
 {{- end }}
 {{ if and
+    (ne (index .Values.extraConfig "allow-unsafe-policy-skb-usage") "true")
    (or (and (ge (int .Values.cluster.id) 128) (le (int .Values.cluster.id) 255)) (and (ge (int .Values.cluster.id) 384) (le (int .Values.cluster.id) 511)))
    (or .Values.eni.enabled .Values.alibabacloud.enabled (eq .Values.cni.chainingMode "aws-cni")) -}}
  {{ fail "Cilium is currently affected by a bug that causes traffic matched by network policies to be incorrectly dropped when running in either ENI mode (both AWS and AlibabaCloud) or AWS VPC CNI chaining mode, if the cluster ID is 128-255 (and 384-511 when maxConnectedClusters=511). Please refer to https://github.com/cilium/cilium/issues/21330 for additional details." }}
--- a/packages/system/cilium/charts/cilium/values.schema.json
+++ b/packages/system/cilium/charts/cilium/values.schema.json
@@ -1969,6 +1969,12 @@
        },
        "log": {
          "properties": {
+            "accessLogBufferSize": {
+              "type": [
+                "null",
+                "integer"
+              ]
+            },
            "format": {
              "type": "string"
            },
--- a/packages/system/cilium/charts/cilium/values.yaml
+++ b/packages/system/cilium/charts/cilium/values.yaml
@@ -153,10 +153,10 @@ image:
  # @schema
  override: ~
  repository: "quay.io/cilium/cilium"
-  tag: "v1.16.6"
+  tag: "v1.16.7"
  pullPolicy: "IfNotPresent"
  # cilium-digest
-  digest: "sha256:1e0896b1c4c188b4812c7e0bed7ec3f5631388ca88325c1391a0ef9172c448da"
+  digest: "sha256:294d2432507fed393b26e9fbfacb25c2e37095578cb34dabac7312b66ed0782e"
  useDigest: true
 # -- Affinity for cilium-agent.
 affinity:
@@ -1314,9 +1314,9 @@ hubble:
      # @schema
      override: ~
      repository: "quay.io/cilium/hubble-relay"
-      tag: "v1.16.6"
+      tag: "v1.16.7"
      # hubble-relay-digest
-      digest: "sha256:ca8dcaa5a81a37743b1397ba2221d16d5d63e4a47607584f1bf50a3b0882bf3b"
+      digest: "sha256:8f408ed921cd534394aa1c57b313741cec6aec03a14ea243b2173cbf2c88c91e"
      useDigest: true
      pullPolicy: "IfNotPresent"
    # -- Specifies the resources for the hubble-relay pods
@@ -2143,6 +2143,13 @@ envoy:
    format: "[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v"
    # -- Path to a separate Envoy log file, if any. Defaults to /dev/stdout.
    path: ""
+    # @schema
+    # type: [null, integer]
+    # @schema
+    # -- Size of the Envoy access log buffer created within the agent in bytes.
+    # Tune this value up if you encounter "Envoy: Discarded truncated access log message" errors.
+    # Large request/response header sizes (e.g. 16KiB) will require a larger buffer size.
+    accessLogBufferSize: 4096
  # -- Time in seconds after which a TCP connection attempt times out
  connectTimeoutSeconds: 2
  # -- Time in seconds after which the initial fetch on an xDS stream is considered timed out
@@ -2165,9 +2172,9 @@ envoy:
    # @schema
    override: ~
    repository: "quay.io/cilium/cilium-envoy"
-    tag: "v1.30.9-1737073743-40a016d11c0d863b772961ed0168eea6fe6b10a5"
+    tag: "v1.31.5-1739264036-958bef243c6c66fcfd73ca319f2eb49fff1eb2ae"
    pullPolicy: "IfNotPresent"
-    digest: "sha256:a69dfe0e54b24b0ff747385c8feeae0612cfbcae97bfcc8ee42a773bb3f69c88"
+    digest: "sha256:fc708bd36973d306412b2e50c924cd8333de67e0167802c9b48506f9d772f521"
    useDigest: true
  # -- Additional containers added to the cilium Envoy DaemonSet.
  extraContainers: []
@@ -2480,15 +2487,15 @@ operator:
    # @schema
    override: ~
    repository: "quay.io/cilium/operator"
-    tag: "v1.16.6"
+    tag: "v1.16.7"
    # operator-generic-digest
-    genericDigest: "sha256:13d32071d5a52c069fb7c35959a56009c6914439adc73e99e098917646d154fc"
+    genericDigest: "sha256:25a41ac50bcebfb780ed2970e55a5ba1a5f26996850ed5a694dc69b312e0b5a0"
    # operator-azure-digest
-    azureDigest: "sha256:0a05d7aea760923897aabd715213ab11a706051673d41fab3874a37f897c1bdd"
+    azureDigest: "sha256:4e7e64cc505676d402c68043934e2c8efc75b294245514d7611a58d06b5e0f69"
    # operator-aws-digest
-    awsDigest: "sha256:d11ee1cfa3465defe2df7ec1c6e8a77bcaf280b44d2c61aa7496c58b29550f6d"
+    awsDigest: "sha256:110d922337bdbfc3cd4d7d71b85b2c8f72c1d9925e9b61b4cd73ff990799d7ba"
    # operator-alibabacloud-digest
-    alibabacloudDigest: "sha256:0e3c7fbcb6bde9a247cd2dd3d25230e2859d40d2eb58aba6265a2aab216775a9"
+    alibabacloudDigest: "sha256:dbdc856303e1ab6734538e29791fdfc4fe2c1295fd7bbce8fa006cd3165f85c8"
    useDigest: true
    pullPolicy: "IfNotPresent"
    suffix: ""
@@ -2762,9 +2769,9 @@ preflight:
    # @schema
    override: ~
    repository: "quay.io/cilium/cilium"
-    tag: "v1.16.6"
+    tag: "v1.16.7"
    # cilium-digest
-    digest: "sha256:1e0896b1c4c188b4812c7e0bed7ec3f5631388ca88325c1391a0ef9172c448da"
+    digest: "sha256:294d2432507fed393b26e9fbfacb25c2e37095578cb34dabac7312b66ed0782e"
    useDigest: true
    pullPolicy: "IfNotPresent"
  # -- The priority class to use for the preflight pod.
@@ -2911,9 +2918,9 @@ clustermesh:
      # @schema
      override: ~
      repository: "quay.io/cilium/clustermesh-apiserver"
-      tag: "v1.16.6"
+      tag: "v1.16.7"
      # clustermesh-apiserver-digest
-      digest: "sha256:ab2070ea48a52a55d961b81b7b5fbac7d40a3f428be9b1b6b9071d47f194456a"
+      digest: "sha256:8e7eda5b194d45c3b1607f5bf31cbb3fecd0f1cf85ce32b41f93b2bd832bf02f"
      useDigest: true
      pullPolicy: "IfNotPresent"
    # -- TCP port for the clustermesh-apiserver health API.
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Timofei Larkin	8267072da2	Merge pull request #678 from aenix-io/release-v0.27.0 Prepare release v0.27.0	2025-03-06 22:17:33 +04:00
Timofei Larkin	8dd8a718a7	Prepare release v0.27.0	2025-03-06 18:54:54 +03:00
Timofei Larkin	63358e3e6c	Recreate etcd pods and certificates on update (#675 ) Since updating from 2.5.0 to 2.6.0 renews all certificates including the trusted CAs for etcd, all etcd pods need a restart. As many people had problems with their etcds post-update, we decided to script the procedure, so the renewal of certs and pods is done automatically and in a predictable order. The hook fires when upgrading from <2.6.0 to >=2.6.1. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Introduced pre- and post-upgrade tasks for the etcd package. - Added supporting resources, including roles, role bindings, service accounts, and a ConfigMap to facilitate smoother upgrade operations. - Chores - Updated the application version from 2.6.0 to 2.6.1. - Revised version mapping entries to reflect the updated release. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-03-06 15:24:12 +01:00
xy2	063439ac94	Raise maxLabelsPerTimeseries for VictoriaMetrics vminsert. (#677 )	2025-03-06 14:44:58 +01:00
xy2	a7425b0caf	Add linstor plunger scripts as sidecars (#672 ) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Introduced new management scripts for automating controller maintenance tasks and satellite operations, including automatic cleanup and reconnection of resources. - Added dynamic configuration templates to streamline container image management and refine deployment settings for enhanced security and monitoring. - Rolled out updated configurations for satellite deployments, improving network performance and resource handling. - New YAML configurations for Linstor satellites have been added, enhancing TLS management and pod specifications. - Revert - Removed legacy configuration resources to consolidate and simplify system management. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-03-05 18:49:05 +01:00
Timofei Larkin	9ad81f2577	Patch kamaji to hardcode ControlplaneEndpoint port (#674 ) When the port number is omitted in TenantControlPlane.spec.controlPlane.ingress.hostname, Kamaji defaults to using the assigned port number from TenantControlPlane.status. But usually the internal port is 6443, while we expect to have 443 for external clients of the k8s API. If we explicitly do hostname:443, we run into clastix/kamaji#679, so for a quick hotfix we are temporarily hardcoding 443. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Chores - Updated the control plane connection configuration to consistently use the secure port 443, ensuring reliable and predictable endpoint behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-03-05 18:46:11 +01:00
Andrei Kvapil	485b1dffb7	Merge pull request #673 from aenix-io/KubevirtMachineTemplate Kubernetes: fix namespace for KubevirtMachineTemplate	2025-03-05 17:55:36 +01:00
Andrei Kvapil	1877f17ca1	Kubernetes: fix namespace for KubevirtMachineTemplate Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-03-05 16:28:38 +01:00
Andrei Kvapil	43e593c72d	Merge pull request #670 from aenix-io/upd-etcd-operator0.4.1 Update etcd-operator v0.4.1	2025-03-05 15:26:02 +01:00
Andrei Kvapil	159d0a2294	Update etcd-operator v0.4.1	2025-03-05 15:25:38 +01:00
Andrei Kvapil	6765f66e11	Merge pull request #669 from aenix-io/upd-cozy-proxy-0.1.3 Update cozy-proxy v0.1.3	2025-03-05 15:04:04 +01:00
Andrei Kvapil	73215dca16	Update cozy-proxy v0.1.3	2025-03-05 15:03:20 +01:00
Andrei Kvapil	85499e2bdc	Merge pull request #668 from aenix-io/bump-monitoring2 bump monitoring chart version	2025-03-05 15:00:41 +01:00
Andrei Kvapil	06daf34102	bump monitoring chart version	2025-03-05 15:00:14 +01:00
Andrei Kvapil	47dfaaafe1	Update Cluster-API and providers (#667 ) Signed-off-by: Andrei Kvapil <kvapss@gmail.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Introduced dynamic IP address management support. - Enabled comprehensive lifecycle hooks that trigger during both installation and upgrades. - Expanded configuration options with new fields for flexible deployments and customizations. - Chores - Upgraded the application and chart versions. - Improved deployment settings with enhanced health checks, diagnostic endpoints, and service account management. - Updated provider versions to enhance overall stability and performance. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-03-05 14:52:23 +01:00
xy2	c60b7c0730	Import Piraeus dashboard and alerts. (#658 ) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Expanded the monitored dashboards with a new storage dashboard entry. - Introduced proactive alert configurations that cover key storage components. - Added templated alert management to streamline dynamic configuration. - Enhanced metric collection by integrating monitoring endpoints for storage components. - Delivered a comprehensive dashboard offering real-time insights into storage performance. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Andrei Kvapil <kvapss@gmail.com> Co-authored-by: Andrei Kvapil <kvapss@gmail.com>	2025-03-05 14:51:23 +01:00
Andrei Kvapil	266d097cab	Fix regression for updating Kamaji (#665 ) This fix introduced Kamaji update https://github.com/aenix-io/cozystack/pull/633 But helm chart didn't actually updated This affected issue with creating new clusters. Ref https://github.com/clastix/kamaji/issues/623 Signed-off-by: Andrei Kvapil <kvapss@gmail.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Chores - Revised application and chart version information alongside updated dependency requirements. - New Features - Added new configuration options for tenant control planes, including enhanced network and load balancer settings. - Documentation - Updated version indicators and clarified configuration details for default datastore behavior. - Bug Fixes - Improved deployment stability by conditionally applying the default datastore setting to avoid potential errors. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-03-05 14:14:41 +01:00
Andrei Kvapil	d4452ea708	Merge pull request #660 from xy2/169-victoria-limits Increase VMSelect default cpu limit	2025-03-05 14:13:32 +01:00
Andrei Kvapil	ec603bc3ef	CAPI-operator: Remove the invalid caBundle (#666 ) Upstream: - https://github.com/kubernetes-sigs/cluster-api-operator/issues/590 - https://github.com/kubernetes-sigs/cluster-api-operator/pull/591 Signed-off-by: Andrei Kvapil <kvapss@gmail.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Chores - Removed an outdated internal configuration setting for webhook communication. This cleanup streamlines the system’s setup while keeping public functionality unchanged. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-03-05 14:05:47 +01:00
Timofei Larkin	48af411878	Merge pull request #664 from klinch0/feature/change-severity-cert-alerts feature/change-severity-for-kube-client-certificate-expiration	2025-03-05 13:56:23 +04:00
Timofei Larkin	57d0a236df	Merge pull request #656 from klinch0/feature/add-workloads feature/add-workloads	2025-03-05 13:46:19 +04:00
kklinch0	554d5dbbca	feature/change-severity-for-kube-client-certificate-expiration	2025-03-05 12:41:26 +03:00
kklinch0	0793b1eaf6	feature/add-workload-monitors	2025-03-05 12:15:23 +03:00
Timofei Larkin	425ce77f60	Merge pull request #655 from klinch0/feature/add-multi-dc feature/add-multi-dc-for-pg	2025-03-05 12:51:36 +04:00
kklinch0	88729e4124	rename globalAppTopologySpreadConstraints	2025-03-05 11:39:41 +03:00
Timofei Larkin	48f6a248c8	Merge pull request #663 from klinch0/bugfix/mv-ds-var bugfix/mv-ds-var-for-goldpinger	2025-03-05 12:08:32 +04:00
kklinch0	9714b130a8	bugfix/mv-ds-var-for-goldpinger	2025-03-05 11:05:59 +03:00
kklinch0	4cce138d31	feature/add-topologyspreadconstraints-pg	2025-03-05 10:41:43 +03:00
Timofei Larkin	e7d6f2dfa3	Merge pull request #661 from klinch0/feature/add-ch-monitoring feature/add-ch-dashboard	2025-03-04 20:22:15 +04:00
Timofei Larkin	b68a72614a	Add TL as codeowner (#662 ) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Chores - Updated internal team management roles to include an additional responsible contributor. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-03-04 17:19:21 +01:00
kklinch0	36b66a681d	feature/add-ch-dashboard	2025-03-04 10:53:51 +03:00
Denis Seleznev	3e273c03b6	Increase the default cpu limit for vminsert.	2025-03-03 19:31:27 +01:00
Denis Seleznev	da0437a774	Make it possible to set cpu limit too.	2025-03-03 19:31:05 +01:00
Denis Seleznev	78cff8c223	Change defaults calculation logic.	2025-03-03 19:18:24 +01:00
Andrei Kvapil	8c4605284c	Prepare release v0.26.1 (#659 ) Signed-off-by: Andrei Kvapil <kvapss@gmail.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Chores - Upgraded core platform components to version v0.26.1. - Refreshed container images for key services including backups, caching, autoscaling, dashboard integrations, and cloud providers. - These updates improve overall stability, consistency, and performance across the system. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-03-01 21:04:40 +01:00
Andrei Kvapil	f708dc2043	VirtualMachine: Fix WholeIP enum check (#657 ) Signed-off-by: Andrei Kvapil <kvapss@gmail.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Chores - Updated the virtual machine component to version 0.8.2, ensuring more reliable version references. - Standardized a configuration option's casing to maintain consistency. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-03-01 11:08:03 +01:00
Andrei Kvapil	160e4e2a32	Update installation manifests Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-02-27 14:06:50 +01:00
xy2	79eadda494	Escape mustaches in prometheus rules for Helm. (#645 ) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Introduced a dynamic alert configuration system that aggregates multiple alert settings into a single, streamlined document for easier management. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-02-27 13:16:54 +01:00
Timofei Larkin	3da1a4ed92	Merge pull request #654 from aenix-io/release-v0.26.0 Prepare release v0.26.0	2025-02-27 15:59:11 +04:00
Timofei Larkin	a5dc2d5382	Prepare release v0.26.0	2025-02-27 11:51:46 +03:00
Timofei Larkin	705eb06078	Merge pull request #651 from aenix-io/linstor-snapshots linstor: add basic snapshot functionality	2025-02-27 11:16:26 +04:00
Andrei Kvapil	e735f96555	kubevirt: Enable live-migration by default (#652 ) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Expanded configuration options now include the ability to enable live migration for virtual machine management, offering smoother transitions and enhanced flexibility. - Introduced a new eviction strategy for managing virtual machine evictions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-02-26 23:18:01 +01:00
Andrei Kvapil	f976ff8ed3	Upd cilium v1.16.7 (#653 ) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Introduced a configurable option for adjusting the Envoy access log buffer size, allowing users to better tune log handling. - Improved startup feedback with more prompt service restarts. - Chores - Upgraded all core components to version 1.16.7. - Updated documentation and configuration settings to reflect the latest release. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-02-26 23:17:34 +01:00
Andrei Kvapil	9ae6b2b0da	linstor: add basic snapshot functionality Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-02-26 19:44:42 +01:00
Andrei Kvapil	86bb64000e	Add new info logo in common style (#649 ) New info icon for Cozystack Signed-off-by: Andrei Kvapil <kvapss@gmail.com> Co-authored-by: Viktoriia Kvapil <159528100+kvapsova@users.noreply.github.com>	2025-02-25 15:12:06 +01:00
Kingdon Barrett	19e0e4c2dc	Flux Operator v0.15 (#631 ) A new release of the Flux Operator (v0.15.0) - to go with the newly created Flux v2.5.0 release (And to go with that, a new version of the flux-instance chart.) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit - New Features - Introduced enhanced operator capabilities by adding new resource types, including `ResourceSetInputProvider` and `ResourceSet`. - Expanded configuration options for deployments, including settings for artifact pull secrets and customizable synchronization intervals. - Added support for multitenancy and role-based access control configurations. - Documentation - Updated version information and badges to reflect the upgrade to version 0.15.0. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Kingdon B <kingdon@urmanac.com>	2025-02-25 14:57:49 +01:00
Kingdon Barrett	86724a6860	Upgrade to Flux 2.5.0 (#640 ) Flux v2.5 is out: * https://github.com/fluxcd/flux2/releases/tag/v2.5.0 * https://fluxcd.io/blog/2025/02/flux-v2.5.0/ 🎉 🏆 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Chores - Upgraded the FluxCD system from version 2.4.x to 2.5.x for improved integration and performance. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Kingdon B <kingdon@urmanac.com>	2025-02-25 14:56:48 +01:00
klinch0	a226fdd242	bugfix/fix-nil-pointer (#643 ) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Enhanced dashboard and identity management displays with updated branding and localization settings, ensuring a refreshed user interface and experience. - Style - Streamlined dashboard appearance by removing legacy custom styling, resulting in a more consistent and contemporary look. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-02-25 14:54:23 +01:00
klinch0	e2369bae68	feature/add-quota (#644 ) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Introduced a new configurable parameter for tenant resource quotas, enabling flexible CPU and memory management. - Added a new YAML template for Kubernetes ResourceQuota configuration. - Updated application version to 1.8.0. - Documentation - Added documentation for the new `resourceQuotas` parameter in tenant configuration. - Chores - Updated versioning entries for the tenant application. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-02-25 14:53:52 +01:00
Timofei Larkin	46f0bb2078	Merge pull request #620 from aenix-io/chore/improve-etcd-tls Improve TLS handling in etcd helm chart	2025-02-25 17:29:54 +04:00
Timofei Larkin	6ff8b527ea	Merge branch 'main' into chore/improve-etcd-tls	2025-02-25 13:38:58 +03:00
Timofei Larkin	0f87c73051	Improve TLS handling in etcd helm chart 1. Add a `commonName` to every certificate. 2. Move 127.0.0.1 from DNS names to IP Addresses in the certificate spec. 3. Add client auth usage to the etcd-server certificate (yes, that's necessary), because etcd queries itself using its [server cert as a client cert](https://github.com/etcd-io/etcd/issues/9785#issuecomment-432438748). 4. Default all CA certificates' durations to 10 years. 5. Set subject org to release namespace and OU to name so that subjects are unique	2025-02-25 13:36:46 +03:00
klinch0	d0d62e8847	feature/add-goldpinger (#648 ) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Introduced a comprehensive Grafana dashboard for Goldpinger, offering real-time insights into node health, error occurrences, and response times with intuitive filtering. - Expanded deployment configurations to include Goldpinger across environments, streamlining release management and dependency handling. - Launched a dedicated deployment package featuring customizable templates for secure, efficient Kubernetes deployments—including workloads, services, ingress, and monitoring integrations. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-02-25 10:08:08 +01:00
xy2	439381e474	Allow lookup function in 'make diff'. (#647 ) Many applications require the lookup function on the live server. Allow its usage as well as in `make show`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Chores - Updated the release diff operation to simulate the upgrade process on the server side, ensuring a safer preview without applying changes. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-02-25 09:54:18 +01:00
Timofei Larkin	a6a95b0091	Merge pull request #633 from aenix-io/119-update-kamaji Update kamaji version, fix kubernetes chart for compat with new kamaji version	2025-02-25 12:50:28 +04:00
Timofei Larkin	392cd862e9	Update scripts/migrations/9 Co-authored-by: Andrei Kvapil <kvapss@gmail.com>	2025-02-25 10:38:17 +03:00
Timofei Larkin	b32106484f	New schema version 10 BREAKING: all kuberneteses will be upgraded to chart version 0.15.1	2025-02-24 16:33:21 +03:00
Timofei Larkin	77df31e105	Merge branch 'main' into 119-update-kamaji	2025-02-24 13:15:28 +03:00
Timofei Larkin	24fa722276	Merge pull request #642 from aenix-io/release-0.25.3 Prepare release v0.25.3	2025-02-22 11:41:53 +04:00
Timofei Larkin	0211c57bed	Prepare release v0.25.3	2025-02-22 10:33:32 +03:00
Timofei Larkin	135b0609b4	Merge pull request #638 from klinch0/feature/move-kubeconfig feature/mv-kubeconfig	2025-02-21 13:57:33 +04:00
Floppy Disk	6c73e3f3ae	feature/mv-kubeconfig	2025-02-20 15:23:54 +03:00
Timofei Larkin	bc95159a80	Merge pull request #634 from aenix-io/release/v0.25.2 Prepare release v0.25.2	2025-02-18 21:03:29 +04:00
Timofei Larkin	0f68db6793	Merge pull request #635 from klinch0/feature/update-limits feature/add-more-resources	2025-02-18 20:01:09 +03:00
Floppy Disk	9a55747885	add more resources	2025-02-18 17:40:54 +03:00
Timofei Larkin	bd90eb267f	Prepare release v0.25.2	2025-02-18 17:22:41 +03:00
Timofei Larkin	a31c3a5796	Update kamaji version * Stripped port number from KamajiControlPlane hostname due to clastix/kamaji#679 * Bumped versions for kamaji and dependent charts	2025-02-18 10:52:15 +03:00
Timofei Larkin	7d5b22e662	Merge pull request #632 from klinch0/feature/add-white-label feature/add-wl	2025-02-17 14:03:25 +04:00
Floppy Disk	42f1dabc31	add wl	2025-02-14 17:47:37 +03:00
Timofei Larkin	eefef8b09f	Merge pull request #626 from klinch0/feature/add-workloadmonitors-roles feature/add-workloadmonitors-roles	2025-02-13 17:58:33 +04:00
Floppy Disk	4cc48e6f34	add-workloadmonitors-roles	2025-02-13 13:33:35 +03:00