Talos Linux: update firmwares

2026-02-05 08:17:59 +00:00 · 2025-01-27 19:49:11 +01:00
184 changed files with 3565 additions and 16605 deletions
--- a/1
+++ b/1
@@ -36,7 +36,6 @@ assets:
 	make -C packages/core/installer/ assets

 test:
-	test -f _out/assets/nocloud-amd64.raw.xz || make -C packages/core/installer talos-nocloud
 	make -C packages/core/testing apply
 	make -C packages/core/testing test
 	make -C packages/core/testing test-applications
--- a/dashboards/control-plane/kube-etcd.json
+++ b/dashboards/control-plane/kube-etcd.json
--- a/dashboards/control-plane/kube-etcd3.json
+++ b/dashboards/control-plane/kube-etcd3.json
--- a/dashboards/flux/flux-control-plane.json
+++ b/dashboards/flux/flux-control-plane.json
--- a/dashboards/flux/flux-stats.json
+++ b/dashboards/flux/flux-stats.json
--- a/dashboards/goldpinger/goldpinger.json
+++ b/dashboards/goldpinger/goldpinger.json
--- a/dashboards/kafka/strimzi-kafka.json
+++ b/dashboards/kafka/strimzi-kafka.json
--- a/hack/download-dashboards.sh
+++ b/hack/download-dashboards.sh
@@ -21,7 +21,7 @@ fix_d8() {
 }

 swap_pvc_overview() {
- jq '(.panels[] | select(.title=="PVC Detailed") | .panels[] | select(.title=="Overview")) as $a | del(.panels[] | select(.title=="PVC Detailed").panels[] | select(.title=="Overview")) | ( (.panels[] | select(.title=="PVC Detailed"))) as $b | del( .panels[] | select(.title=="PVC Detailed")) | (.panels[.panels|length]=($a|.gridPos.y=$b.gridPos.y)) | (.panels[.panels|length]=($b|.gridPos.y=$a.gridPos.y))'
+ jq '(.panels[] | select(.title=="PVC Detailed") | .panels[] | select(.title=="Overview")) as $a | del(.panels[] | select(.title=="PVC Detailed").panels[] | select(.title=="Overview")) | ( (.panels[] | select(.title=="PVC Detailed"))) as $b | del( .panels[] | select(.title=="PVC Detailed")) | (.panels[.panels|length]=($a|.gridPos.y=$b.gridPos.y)) | (.panels[.panels|length]=($b|.gridPos.y=$a.gridPos.y))' 
 }

 deprectaed_remove_faq() {
@@ -68,7 +68,7 @@ modules/402-ingress-nginx/monitoring/grafana-dashboards/ingress-nginx/namespace/
 modules/402-ingress-nginx/monitoring/grafana-dashboards/ingress-nginx/vhost/vhost_detail.json
 modules/402-ingress-nginx/monitoring/grafana-dashboards/ingress-nginx/vhost/vhosts.json
 modules/340-monitoring-kubernetes-control-plane/monitoring/grafana-dashboards/kubernetes-cluster/control-plane-status.json
-modules/340-monitoring-kubernetes-control-plane/monitoring/grafana-dashboards/kubernetes-cluster/kube-etcd.json                #TODO
+modules/340-monitoring-kubernetes-control-plane/monitoring/grafana-dashboards/kubernetes-cluster/kube-etcd3.json                #TODO
 modules/340-monitoring-kubernetes-control-plane/monitoring/grafana-dashboards/kubernetes-cluster/deprecated-resources.json
 modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//kubernetes-cluster/nodes/ntp.json                              #TODO
 modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//kubernetes-cluster/nodes/nodes.json
@@ -78,10 +78,6 @@ modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//main/pod.json
 modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//main/namespace/namespaces.json
 modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//main/namespace/namespace.json
 modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//main/capacity-planning/capacity-planning.json
-modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//flux/flux-control-plane.json
-modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//flux/flux-stats.json
-modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//kafka/strimzi-kafka.json
-modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//goldpinger/goldpinger.json
 EOT


@@ -113,3 +109,4 @@ done <<\EOT
 	https://raw.githubusercontent.com/dotdc/grafana-dashboards-kubernetes/master/dashboards/k8s-views-namespaces.json
 	https://raw.githubusercontent.com/dotdc/grafana-dashboards-kubernetes/master/dashboards/k8s-views-pods.json
 EOT
+
--- a/manifests/cozystack-installer.yaml
+++ b/manifests/cozystack-installer.yaml
@@ -68,7 +68,7 @@ spec:
      serviceAccountName: cozystack
      containers:
      - name: cozystack
-        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.26.1"
+        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.23.1"
        env:
        - name: KUBERNETES_SERVICE_HOST
          value: localhost
@@ -86,12 +86,13 @@ spec:
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
-      - name: assets
-        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.26.1"
+      - name: darkhttpd
+        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.23.1"
        command:
-        - /usr/bin/cozystack-assets-server
-        - "-dir=/cozystack/assets"
-        - "-address=:8123"
+        - /usr/bin/darkhttpd
+        - /cozystack/assets
+        - --port
+        - "8123"
        ports:
        - name: http
          containerPort: 8123
--- a/packages/apps/ferretdb/images/postgres-backup.tag
+++ b/packages/apps/ferretdb/images/postgres-backup.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/postgres-backup:0.8.0@sha256:d1f7692b6761f46f24687d885ec335330280346ae4a9ff28b3179681b36106b7
+ghcr.io/aenix-io/cozystack/postgres-backup:0.8.0@sha256:6a8ec7e7052f2d02ec5457d7cbac6ee52b3ed93a883988a192d1394fc7c88117
--- a/packages/apps/http-cache/images/nginx-cache.tag
+++ b/packages/apps/http-cache/images/nginx-cache.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/nginx-cache:0.3.1@sha256:854b3908114de1876038eb9902577595cce93553ce89bf75ac956d22f1e8b8cc
+ghcr.io/aenix-io/cozystack/nginx-cache:0.3.1@sha256:a3c25199acb8e8426e6952658ccc4acaadb50fe2cfa6359743b64e5166b3fc70
--- a/packages/apps/kafka/Chart.yaml
+++ b/packages/apps/kafka/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.3.2
+version: 0.3.1

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/kafka/templates/kafka.yaml
+++ b/packages/apps/kafka/templates/kafka.yaml
@@ -57,12 +57,6 @@ spec:
        class: {{ . }}
        {{- end }}
        deleteClaim: true
-    metricsConfig:
-      type: jmxPrometheusExporter
-      valueFrom:
-        configMapKeyRef:
-          name: {{ .Release.Name }}-metrics
-          key: kafka-metrics-config.yml
  zookeeper:
    replicas: {{ .Values.zookeeper.replicas }}
    storage:
@@ -74,12 +68,6 @@ spec:
      class: {{ . }}
      {{- end }}
      deleteClaim: false
-    metricsConfig:
-      type: jmxPrometheusExporter
-      valueFrom:
-        configMapKeyRef:
-          name: {{ .Release.Name }}-metrics
-          key: kafka-metrics-config.yml
  entityOperator:
    topicOperator: {}
    userOperator: {}
--- a/packages/apps/kafka/templates/metrics-configmap.yaml
+++ b/packages/apps/kafka/templates/metrics-configmap.yaml
@@ -1,198 +0,0 @@
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: {{ .Release.Name }}-metrics
-data:
-  kafka-metrics-config.yml: |
-    # See https://github.com/prometheus/jmx_exporter for more info about JMX Prometheus Exporter metrics
-    lowercaseOutputName: true
-    rules:
-    # Special cases and very specific rules
-    - pattern: kafka.server<type=(.+), name=(.+), clientId=(.+), topic=(.+), partition=(.*)><>Value
-      name: kafka_server_$1_$2
-      type: GAUGE
-      labels:
-        clientId: "$3"
-        topic: "$4"
-        partition: "$5"
-    - pattern: kafka.server<type=(.+), name=(.+), clientId=(.+), brokerHost=(.+), brokerPort=(.+)><>Value
-      name: kafka_server_$1_$2
-      type: GAUGE
-      labels:
-        clientId: "$3"
-        broker: "$4:$5"
-    - pattern: kafka.server<type=(.+), cipher=(.+), protocol=(.+), listener=(.+), networkProcessor=(.+)><>connections
-      name: kafka_server_$1_connections_tls_info
-      type: GAUGE
-      labels:
-        cipher: "$2"
-        protocol: "$3"
-        listener: "$4"
-        networkProcessor: "$5"
-    - pattern: kafka.server<type=(.+), clientSoftwareName=(.+), clientSoftwareVersion=(.+), listener=(.+), networkProcessor=(.+)><>connections
-      name: kafka_server_$1_connections_software
-      type: GAUGE
-      labels:
-        clientSoftwareName: "$2"
-        clientSoftwareVersion: "$3"
-        listener: "$4"
-        networkProcessor: "$5"
-    - pattern: "kafka.server<type=(.+), listener=(.+), networkProcessor=(.+)><>(.+-total):"
-      name: kafka_server_$1_$4
-      type: COUNTER
-      labels:
-        listener: "$2"
-        networkProcessor: "$3"
-    - pattern: "kafka.server<type=(.+), listener=(.+), networkProcessor=(.+)><>(.+):"
-      name: kafka_server_$1_$4
-      type: GAUGE
-      labels:
-        listener: "$2"
-        networkProcessor: "$3"
-    - pattern: kafka.server<type=(.+), listener=(.+), networkProcessor=(.+)><>(.+-total)
-      name: kafka_server_$1_$4
-      type: COUNTER
-      labels:
-        listener: "$2"
-        networkProcessor: "$3"
-    - pattern: kafka.server<type=(.+), listener=(.+), networkProcessor=(.+)><>(.+)
-      name: kafka_server_$1_$4
-      type: GAUGE
-      labels:
-        listener: "$2"
-        networkProcessor: "$3"
-    # Some percent metrics use MeanRate attribute
-    # Ex) kafka.server<type=(KafkaRequestHandlerPool), name=(RequestHandlerAvgIdlePercent)><>MeanRate
-    - pattern: kafka.(\w+)<type=(.+), name=(.+)Percent\w*><>MeanRate
-      name: kafka_$1_$2_$3_percent
-      type: GAUGE
-    # Generic gauges for percents
-    - pattern: kafka.(\w+)<type=(.+), name=(.+)Percent\w*><>Value
-      name: kafka_$1_$2_$3_percent
-      type: GAUGE
-    - pattern: kafka.(\w+)<type=(.+), name=(.+)Percent\w*, (.+)=(.+)><>Value
-      name: kafka_$1_$2_$3_percent
-      type: GAUGE
-      labels:
-        "$4": "$5"
-    # Generic per-second counters with 0-2 key/value pairs
-    - pattern: kafka.(\w+)<type=(.+), name=(.+)PerSec\w*, (.+)=(.+), (.+)=(.+)><>Count
-      name: kafka_$1_$2_$3_total
-      type: COUNTER
-      labels:
-        "$4": "$5"
-        "$6": "$7"
-    - pattern: kafka.(\w+)<type=(.+), name=(.+)PerSec\w*, (.+)=(.+)><>Count
-      name: kafka_$1_$2_$3_total
-      type: COUNTER
-      labels:
-        "$4": "$5"
-    - pattern: kafka.(\w+)<type=(.+), name=(.+)PerSec\w*><>Count
-      name: kafka_$1_$2_$3_total
-      type: COUNTER
-    # Generic gauges with 0-2 key/value pairs
-    - pattern: kafka.(\w+)<type=(.+), name=(.+), (.+)=(.+), (.+)=(.+)><>Value
-      name: kafka_$1_$2_$3
-      type: GAUGE
-      labels:
-        "$4": "$5"
-        "$6": "$7"
-    - pattern: kafka.(\w+)<type=(.+), name=(.+), (.+)=(.+)><>Value
-      name: kafka_$1_$2_$3
-      type: GAUGE
-      labels:
-        "$4": "$5"
-    - pattern: kafka.(\w+)<type=(.+), name=(.+)><>Value
-      name: kafka_$1_$2_$3
-      type: GAUGE
-    # Emulate Prometheus 'Summary' metrics for the exported 'Histogram's.
-    # Note that these are missing the '_sum' metric!
-    - pattern: kafka.(\w+)<type=(.+), name=(.+), (.+)=(.+), (.+)=(.+)><>Count
-      name: kafka_$1_$2_$3_count
-      type: COUNTER
-      labels:
-        "$4": "$5"
-        "$6": "$7"
-    - pattern: kafka.(\w+)<type=(.+), name=(.+), (.+)=(.*), (.+)=(.+)><>(\d+)thPercentile
-      name: kafka_$1_$2_$3
-      type: GAUGE
-      labels:
-        "$4": "$5"
-        "$6": "$7"
-        quantile: "0.$8"
-    - pattern: kafka.(\w+)<type=(.+), name=(.+), (.+)=(.+)><>Count
-      name: kafka_$1_$2_$3_count
-      type: COUNTER
-      labels:
-        "$4": "$5"
-    - pattern: kafka.(\w+)<type=(.+), name=(.+), (.+)=(.*)><>(\d+)thPercentile
-      name: kafka_$1_$2_$3
-      type: GAUGE
-      labels:
-        "$4": "$5"
-        quantile: "0.$6"
-    - pattern: kafka.(\w+)<type=(.+), name=(.+)><>Count
-      name: kafka_$1_$2_$3_count
-      type: COUNTER
-    - pattern: kafka.(\w+)<type=(.+), name=(.+)><>(\d+)thPercentile
-      name: kafka_$1_$2_$3
-      type: GAUGE
-      labels:
-        quantile: "0.$4"
-    # KRaft overall related metrics
-    # distinguish between always increasing COUNTER (total and max) and variable GAUGE (all others) metrics
-    - pattern: "kafka.server<type=raft-metrics><>(.+-total|.+-max):"
-      name: kafka_server_raftmetrics_$1
-      type: COUNTER
-    - pattern: "kafka.server<type=raft-metrics><>(current-state): (.+)"
-      name: kafka_server_raftmetrics_$1
-      value: 1
-      type: UNTYPED
-      labels:
-        $1: "$2"
-    - pattern: "kafka.server<type=raft-metrics><>(.+):"
-      name: kafka_server_raftmetrics_$1
-      type: GAUGE
-    # KRaft "low level" channels related metrics
-    # distinguish between always increasing COUNTER (total and max) and variable GAUGE (all others) metrics
-    - pattern: "kafka.server<type=raft-channel-metrics><>(.+-total|.+-max):"
-      name: kafka_server_raftchannelmetrics_$1
-      type: COUNTER
-    - pattern: "kafka.server<type=raft-channel-metrics><>(.+):"
-      name: kafka_server_raftchannelmetrics_$1
-      type: GAUGE
-    # Broker metrics related to fetching metadata topic records in KRaft mode
-    - pattern: "kafka.server<type=broker-metadata-metrics><>(.+):"
-      name: kafka_server_brokermetadatametrics_$1
-      type: GAUGE
-  zookeeper-metrics-config.yml: |
-    # See https://github.com/prometheus/jmx_exporter for more info about JMX Prometheus Exporter metrics
-    lowercaseOutputName: true
-    rules:
-    # replicated Zookeeper
-    - pattern: "org.apache.ZooKeeperService<name0=ReplicatedServer_id(\\d+)><>(\\w+)"
-      name: "zookeeper_$2"
-      type: GAUGE
-    - pattern: "org.apache.ZooKeeperService<name0=ReplicatedServer_id(\\d+), name1=replica.(\\d+)><>(\\w+)"
-      name: "zookeeper_$3"
-      type: GAUGE
-      labels:
-        replicaId: "$2"
-    - pattern: "org.apache.ZooKeeperService<name0=ReplicatedServer_id(\\d+), name1=replica.(\\d+), name2=(\\w+)><>(Packets\\w+)"
-      name: "zookeeper_$4"
-      type: COUNTER
-      labels:
-        replicaId: "$2"
-        memberType: "$3"
-    - pattern: "org.apache.ZooKeeperService<name0=ReplicatedServer_id(\\d+), name1=replica.(\\d+), name2=(\\w+)><>(\\w+)"
-      name: "zookeeper_$4"
-      type: GAUGE
-      labels:
-        replicaId: "$2"
-        memberType: "$3"
-    - pattern: "org.apache.ZooKeeperService<name0=ReplicatedServer_id(\\d+), name1=replica.(\\d+), name2=(\\w+), name3=(\\w+)><>(\\w+)"
-      name: "zookeeper_$4_$5"
-      type: GAUGE
-      labels:
-        replicaId: "$2"
-        memberType: "$3"
--- a/packages/apps/kafka/templates/podscrape.yaml
+++ b/packages/apps/kafka/templates/podscrape.yaml
@@ -1,40 +0,0 @@
-apiVersion: operator.victoriametrics.com/v1beta1
-kind: VMPodScrape
-metadata:
-  name: {{ .Release.Name }}
-spec:
-  podMetricsEndpoints:
-    - port: tcp-prometheus
-      scheme: http
-      relabelConfigs:
-      - separator: ;
-        regex: __meta_kubernetes_pod_label_(strimzi_io_.+)
-        replacement: $1
-        action: labelmap
-      - sourceLabels: [__meta_kubernetes_namespace]
-        separator: ;
-        regex: (.*)
-        targetLabel: namespace
-        replacement: $1
-        action: replace
-      - sourceLabels: [__meta_kubernetes_pod_name]
-        separator: ;
-        regex: (.*)
-        targetLabel: pod
-        replacement: $1
-        action: replace
-      - sourceLabels: [__meta_kubernetes_pod_node_name]
-        separator: ;
-        regex: (.*)
-        targetLabel: node
-        replacement: $1
-        action: replace
-      - sourceLabels: [__meta_kubernetes_pod_host_ip]
-        separator: ;
-        regex: (.*)
-        targetLabel: node_ip
-        replacement: $1
-        action: replace
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: {{ .Release.Name }}
--- a/packages/apps/kubernetes/Chart.yaml
+++ b/packages/apps/kubernetes/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.15.1
+version: 0.15.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/kubernetes/images/cluster-autoscaler.tag
+++ b/packages/apps/kubernetes/images/cluster-autoscaler.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/cluster-autoscaler:0.15.1@sha256:73701e37727eedaafdf9efe4baefcf0835f064ee8731219f0c0186c0d0781a5c
+ghcr.io/aenix-io/cozystack/cluster-autoscaler:0.15.0@sha256:538ee308f16c9e627ed16ee7c4aaa65919c2e6c4c2778f964a06e4797610d1cd
--- a/packages/apps/kubernetes/images/kubevirt-cloud-provider.tag
+++ b/packages/apps/kubernetes/images/kubevirt-cloud-provider.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/kubevirt-cloud-provider:0.15.1@sha256:02037bb7a75b35ca1e34924f13e7fa7b25bac2017ddbd7e9ed004c0ff368cce3
+ghcr.io/aenix-io/cozystack/kubevirt-cloud-provider:0.15.0@sha256:7716c88947d13dc90ccfcc3e60bfdd6e6fa9b201339a75e9c84bf825c76e2b1f
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/kubevirt-csi-driver:0.15.1@sha256:a86d8a4722b81e89820ead959874524c4cc86654c22ad73c421bbf717d62c3f3
+ghcr.io/aenix-io/cozystack/kubevirt-csi-driver:0.15.0@sha256:be5e0eef92dada3ace5cddda5c68b30c9fe4682774c5e6e938ed31efba11ebbf
--- a/packages/apps/kubernetes/images/ubuntu-container-disk.tag
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/ubuntu-container-disk:v1.30.1@sha256:6f19f3f8a68372c5b212e98a79ff132cc20641bc46fc4b8d359158945dc04043
+ghcr.io/aenix-io/cozystack/ubuntu-container-disk:v1.30.1@sha256:8392f00a7182294ce6fd417d254f7c2aa09fb9203d829dec70344a8050369430
--- a/packages/apps/kubernetes/templates/cluster.yaml
+++ b/packages/apps/kubernetes/templates/cluster.yaml
@@ -118,7 +118,7 @@ spec:
    ingress:
      extraAnnotations:
        nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-      hostname: {{ .Values.host | default (printf "%s.%s" .Release.Name $host) }}
+      hostname: {{ .Values.host | default (printf "%s.%s" .Release.Name $host) }}:443
      className: "{{ $ingress }}"
  deployment:
    podAdditionalMetadata:
--- a/packages/apps/mysql/images/mariadb-backup.tag
+++ b/packages/apps/mysql/images/mariadb-backup.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/mariadb-backup:0.5.2@sha256:9f0b2bc5135e10b29edb2824309059f5b4c4e8b744804b2cf55381171f335675
+ghcr.io/aenix-io/cozystack/mariadb-backup:0.5.2@sha256:4bbfbb397bd7ecea45507ca47989c51429c4a24f40853ac92583e5b5b352fbea
--- a/packages/apps/postgres/images/postgres-backup.tag
+++ b/packages/apps/postgres/images/postgres-backup.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/postgres-backup:0.8.0@sha256:d1f7692b6761f46f24687d885ec335330280346ae4a9ff28b3179681b36106b7
+ghcr.io/aenix-io/cozystack/postgres-backup:0.8.0@sha256:6a8ec7e7052f2d02ec5457d7cbac6ee52b3ed93a883988a192d1394fc7c88117
--- a/packages/apps/tenant/Chart.yaml
+++ b/packages/apps/tenant/Chart.yaml
@@ -4,4 +4,4 @@ description: Separated tenant namespace
 icon: /logos/tenant.svg

 type: application
-version: 1.8.0
+version: 1.6.7
--- a/packages/apps/tenant/README.md
+++ b/packages/apps/tenant/README.md
@@ -50,12 +50,11 @@ tenant-u1

 ### Common parameters

-| Name             | Description                                                                                                                 | Value   |
-| ---------------- | --------------------------------------------------------------------------------------------------------------------------- | ------- |
-| `host`           | The hostname used to access tenant services (defaults to using the tenant name as a subdomain for it's parent tenant host). | `""`    |
-| `etcd`           | Deploy own Etcd cluster                                                                                                     | `false` |
-| `monitoring`     | Deploy own Monitoring Stack                                                                                                 | `false` |
-| `ingress`        | Deploy own Ingress Controller                                                                                               | `false` |
-| `seaweedfs`      | Deploy own SeaweedFS                                                                                                        | `false` |
-| `isolated`       | Enforce tenant namespace with network policies                                                                              | `false` |
-| `resourceQuotas` | Define resource quotas for the tenant                                                                                       | `{}`    |
+| Name         | Description                                                                                                                 | Value   |
+| ------------ | --------------------------------------------------------------------------------------------------------------------------- | ------- |
+| `host`       | The hostname used to access tenant services (defaults to using the tenant name as a subdomain for it's parent tenant host). | `""`    |
+| `etcd`       | Deploy own Etcd cluster                                                                                                     | `false` |
+| `monitoring` | Deploy own Monitoring Stack                                                                                                 | `false` |
+| `ingress`    | Deploy own Ingress Controller                                                                                               | `false` |
+| `seaweedfs`  | Deploy own SeaweedFS                                                                                                        | `false` |
+| `isolated`   | Enforce tenant namespace with network policies                                                                              | `false` |
--- a/packages/apps/tenant/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/tenant/templates/dashboard-resourcemap.yaml
@@ -1,12 +1,13 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: info-dashboard-resources
+  name: {{ include "tenant.name" . }}-dashboard-resources
+  namespace: {{ .Release.namespace }}
 rules:
 - apiGroups:
  - ""
  resources:
  - secrets
  resourceNames:
-  - kubeconfig-{{ .Release.Namespace }}
+  - kubeconfig-{{ include "tenant.name" . }}
  verbs: ["get", "list", "watch"]
--- a/packages/apps/tenant/templates/info.yaml
+++ b/packages/apps/tenant/templates/info.yaml
@@ -1,27 +0,0 @@
-{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
-{{- $oidcEnabled := index $cozyConfig.data "oidc-enabled" }}
-{{- if $oidcEnabled }}
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: info
-  namespace: {{ include "tenant.name" . }}
-  annotations:
-    helm.sh/resource-policy: keep
-  labels:
-    cozystack.io/ui: "true"
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
-spec:
-  chart:
-    spec:
-      chart: info
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-extra
-        namespace: cozy-public
-      version: "*"
-  interval: 1m0s
-  timeout: 5m0s
-{{- end }}
--- a/packages/apps/tenant/templates/kubeconfig.yaml
+++ b/packages/apps/tenant/templates/kubeconfig.yaml
@@ -15,7 +15,8 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: kubeconfig-{{ .Release.Namespace }}
+  name: kubeconfig-{{ include "tenant.name" . }}
+  namespace: tenant-root
 stringData:
  kubeconfig: |
    apiVersion: v1
@@ -27,10 +28,10 @@ stringData:
    contexts:
    - context:
        cluster: cluster
-        namespace: {{ .Release.Namespace }}
+        namespace: {{ include "tenant.name" . }}
        user: keycloak
-      name: {{ .Release.Namespace }}
-    current-context: {{ .Release.Namespace }}
+      name: {{ include "tenant.name" . }}
+    current-context: {{ include "tenant.name" . }}
    users:
    - name: keycloak
      user:
--- a/packages/apps/tenant/templates/quota.yaml
+++ b/packages/apps/tenant/templates/quota.yaml
@@ -1,10 +0,0 @@
-{{- if .Values.resourceQuotas }}
-apiVersion: v1
-kind: ResourceQuota
-metadata:
-  name: tenant-quota
-  namespace: {{ include "tenant.name" . }}
-spec:
-  hard:
-    {{- toYaml .Values.resourceQuotas | nindent 4 }}
-{{- end }}
--- a/packages/apps/tenant/templates/tenant.yaml
+++ b/packages/apps/tenant/templates/tenant.yaml
@@ -34,11 +34,7 @@ rules:
 - apiGroups: ["apps.cozystack.io"]
  resources: ['*']
  verbs: ['*']
- apiGroups:
-  - cozystack.io
-  resources:
-  - workloadmonitors
-  verbs: ["get", "list", "watch"]
+
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -107,11 +103,6 @@ rules:
      - get
      - list
      - watch
-  - apiGroups:
-    - cozystack.io
-    resources:
-    - workloadmonitors
-    verbs: ["get", "list", "watch"]
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
@@ -184,11 +175,6 @@ rules:
    verbs:
    - get
    - list
-  - apiGroups:
-    - cozystack.io
-    resources:
-    - workloadmonitors
-    verbs: ["get", "list", "watch"]
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
@@ -272,7 +258,6 @@ rules:
    - virtualmachines
    - vmdisks
    - vminstances
-    - infos
    verbs:
    - get
    - list
@@ -281,11 +266,6 @@ rules:
    - update
    - patch
    - delete
-  - apiGroups:
-    - cozystack.io
-    resources:
-    - workloadmonitors
-    verbs: ["get", "list", "watch"]
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
@@ -354,11 +334,6 @@ rules:
    - '*'
    verbs:
    - '*'
-  - apiGroups:
-    - cozystack.io
-    resources:
-    - workloadmonitors
-    verbs: ["get", "list", "watch"]
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
--- a/packages/apps/tenant/values.schema.json
+++ b/packages/apps/tenant/values.schema.json
@@ -31,11 +31,6 @@
            "type": "boolean",
            "description": "Enforce tenant namespace with network policies",
            "default": false
-        },
-        "resourceQuotas": {
-            "type": "object",
-            "description": "Define resource quotas for the tenant",
-            "default": {}
        }
    }
 }
--- a/packages/apps/tenant/values.yaml
+++ b/packages/apps/tenant/values.yaml
@@ -6,18 +6,9 @@
 ## @param ingress Deploy own Ingress Controller
 ## @param seaweedfs Deploy own SeaweedFS
 ## @param isolated Enforce tenant namespace with network policies
-## @param resourceQuotas Define resource quotas for the tenant
 host: ""
 etcd: false
 monitoring: false
 ingress: false
 seaweedfs: false
 isolated: false
-resourceQuotas: {}
-# resourceQuotas:
-#   requests.cpu: "1"
-#   requests.memory: "1Gi"
-#   limits.cpu: "2"
-#   limits.memory: "2Gi"
-#   requests.nvidia.com/gpu: 4
-#   requests.storage: 100Gi
--- a/packages/apps/versions_map
+++ b/packages/apps/versions_map
@@ -23,8 +23,7 @@ kafka 0.2.1 3ac17018
 kafka 0.2.2 d0758692
 kafka 0.2.3 5ca8823
 kafka 0.3.0 c07c4bbd
-kafka 0.3.1 b7375f73
-kafka 0.3.2 HEAD
+kafka 0.3.1 HEAD
 kubernetes 0.1.0 f642698
 kubernetes 0.2.0 7cd7de73
 kubernetes 0.3.0 7caccec1
@@ -44,8 +43,7 @@ kubernetes 0.12.1 28fca4e
 kubernetes 0.13.0 ced8e5b9
 kubernetes 0.14.0 bfbde07c
 kubernetes 0.14.1 fde4bcfa
-kubernetes 0.15.0 cb7b8158
-kubernetes 0.15.1 HEAD
+kubernetes 0.15.0 HEAD
 mysql 0.1.0 f642698
 mysql 0.2.0 8b975ff0
 mysql 0.3.0 5ca8823
@@ -102,10 +100,7 @@ tenant 1.6.3 2057bb96
 tenant 1.6.4 3c9e50a4
 tenant 1.6.5 f1e11451
 tenant 1.6.6 d4634797
-tenant 1.6.7 06afcf27
-tenant 1.6.8 4cc48e6f
-tenant 1.7.0 6c73e3f3
-tenant 1.8.0 HEAD
+tenant 1.6.7 HEAD
 virtual-machine 0.1.4 f2015d6
 virtual-machine 0.1.5 7cd7de7
 virtual-machine 0.2.0 5ca8823
@@ -114,18 +109,13 @@ virtual-machine 0.4.0 4746d51
 virtual-machine 0.5.0 cad9cde
 virtual-machine 0.6.0 0e728870
 virtual-machine 0.7.0 af58018a
-virtual-machine 0.7.1 05857b95
-virtual-machine 0.8.0 3fa4dd3
-virtual-machine 0.8.1 3fa4dd3a
-virtual-machine 0.8.2 HEAD
+virtual-machine 0.7.1 HEAD
 vm-disk 0.1.0 HEAD
 vm-instance 0.1.0 ced8e5b9
 vm-instance 0.2.0 4f767ee3
 vm-instance 0.3.0 0e728870
 vm-instance 0.4.0 af58018a
-vm-instance 0.4.1 05857b95
-vm-instance 0.5.0 3fa4dd3
-vm-instance 0.5.1 HEAD
+vm-instance 0.4.1 HEAD
 vpn 0.1.0 f642698
 vpn 0.2.0 7151424
 vpn 0.3.0 a2bcf100
--- a/packages/apps/virtual-machine/Chart.yaml
+++ b/packages/apps/virtual-machine/Chart.yaml
@@ -17,10 +17,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.8.2
+version: 0.7.1

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "0.8.2"
+appVersion: "0.7.1"
--- a/packages/apps/virtual-machine/Makefile
+++ b/packages/apps/virtual-machine/Makefile
@@ -8,4 +8,3 @@ generate:
 	  && yq -i -o json ".properties.instanceProfile.optional=true | .properties.instanceProfile.enum = $${PREFERENCES}" values.schema.json
 	yq -i -o json '.properties.externalPorts.items.type = "integer"' values.schema.json
 	yq -i -o json '.properties.systemDisk.properties.image.enum = ["ubuntu", "cirros", "alpine", "fedora", "talos"]' values.schema.json
-	yq -i -o json '.properties.externalMethod.enum = ["WholeIP", "PortList"]' values.schema.json
--- a/packages/apps/virtual-machine/README.md
+++ b/packages/apps/virtual-machine/README.md
@@ -39,7 +39,6 @@ virtctl ssh <user>@<vm>
 | Name                      | Description                                                                                                | Value            |
 | ------------------------- | ---------------------------------------------------------------------------------------------------------- | ---------------- |
 | `external`                | Enable external access from outside the cluster                                                            | `false`          |
-| `externalMethod`          | specify method to passthrough the traffic to the virtual machine. Allowed values: `WholeIP` and `PortList` | `WholeIP`        |
 | `externalPorts`           | Specify ports to forward from outside the cluster                                                          | `[]`             |
 | `running`                 | Determines if the virtual machine should be running                                                        | `true`           |
 | `instanceType`            | Virtual Machine instance type                                                                              | `u1.medium`      |
--- a/packages/apps/virtual-machine/templates/service.yaml
+++ b/packages/apps/virtual-machine/templates/service.yaml
@@ -6,24 +6,16 @@ metadata:
  name: {{ include "virtual-machine.fullname" . }}
  labels:
    {{- include "virtual-machine.labels" . | nindent 4 }}
-  {{- if eq .Values.externalMethod "WholeIP" }}
-  annotations:
-    networking.cozystack.io/wholeIP: "true"
-  {{- end }}
 spec:
  type: {{ ternary "LoadBalancer" "ClusterIP" .Values.external }}
  externalTrafficPolicy: Local
  allocateLoadBalancerNodePorts: false
  selector:
-    {{- include "virtual-machine.selectorLabels" . | nindent 4 }}
+    {{- include "virtual-machine.labels" . | nindent 4 }}
  ports:
-    {{- if eq .Values.externalMethod "WholeIP" }}
-    - port: 65535
-    {{- else }}
    {{- range .Values.externalPorts }}
    - name: port-{{ . }}
      port: {{ . }}
      targetPort: {{ . }}
    {{- end }}
-    {{- end }}
 {{- end }}
--- a/packages/apps/virtual-machine/values.schema.json
+++ b/packages/apps/virtual-machine/values.schema.json
@@ -7,15 +7,6 @@
      "description": "Enable external access from outside the cluster",
      "default": false
    },
-    "externalMethod": {
-      "type": "string",
-      "description": "specify method to passthrough the traffic to the virtual machine. Allowed values: `WholeIP` and `PortList`",
-      "default": "WholeIP",
-      "enum": [
-        "WholeIP",
-        "PortList"
-      ]
-    },
    "externalPorts": {
      "type": "array",
      "description": "Specify ports to forward from outside the cluster",
--- a/packages/apps/virtual-machine/values.yaml
+++ b/packages/apps/virtual-machine/values.yaml
@@ -1,10 +1,8 @@
 ## @section Common parameters

 ## @param external Enable external access from outside the cluster
-## @param externalMethod specify method to passthrough the traffic to the virtual machine. Allowed values: `WholeIP` and `PortList`
 ## @param externalPorts [array] Specify ports to forward from outside the cluster
 external: false
-externalMethod: WholeIP
 externalPorts:
 - 22

--- a/packages/apps/vm-instance/Chart.yaml
+++ b/packages/apps/vm-instance/Chart.yaml
@@ -17,10 +17,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.5.1
+version: 0.4.1

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "0.5.1"
+appVersion: "0.4.1"
--- a/packages/apps/vm-instance/Makefile
+++ b/packages/apps/vm-instance/Makefile
@@ -8,4 +8,3 @@ generate:
 	PREFERENCES=$$(yq e '.metadata.name' -o=json -r ../../system/kubevirt-instancetypes/templates/preferences.yaml | yq 'split(" ") | . + [""]' -o json) \
 	  && yq -i -o json ".properties.instanceProfile.optional=true | .properties.instanceProfile.enum = $${PREFERENCES}" values.schema.json
 	yq -i -o json '.properties.externalPorts.items.type = "integer"' values.schema.json
-	yq -i -o json '.properties.externalMethod.enum = ["WholeIP", "PortList"]' values.schema.json
--- a/packages/apps/vm-instance/README.md
+++ b/packages/apps/vm-instance/README.md
@@ -36,19 +36,18 @@ virtctl ssh <user>@<vm>

 ### Common parameters

-| Name               | Description                                                                                                | Value            |
-| ------------------ | ---------------------------------------------------------------------------------------------------------- | ---------------- |
-| `external`         | Enable external access from outside the cluster                                                            | `false`          |
-| `externalMethod`   | specify method to passthrough the traffic to the virtual machine. Allowed values: `WholeIP` and `PortList` | `WholeIP`        |
-| `externalPorts`    | Specify ports to forward from outside the cluster                                                          | `[]`             |
-| `running`          | Determines if the virtual machine should be running                                                        | `true`           |
-| `instanceType`     | Virtual Machine instance type                                                                              | `u1.medium`      |
-| `instanceProfile`  | Virtual Machine prefferences profile                                                                       | `ubuntu`         |
-| `disks`            | List of disks to attach                                                                                    | `[]`             |
-| `resources.cpu`    | The number of CPU cores allocated to the virtual machine                                                   | `""`             |
-| `resources.memory` | The amount of memory allocated to the virtual machine                                                      | `""`             |
-| `sshKeys`          | List of SSH public keys for authentication. Can be a single key or a list of keys.                         | `[]`             |
-| `cloudInit`        | cloud-init user data config. See cloud-init documentation for more details.                                | `#cloud-config
+| Name               | Description                                                                        | Value            |
+| ------------------ | ---------------------------------------------------------------------------------- | ---------------- |
+| `external`         | Enable external access from outside the cluster                                    | `false`          |
+| `externalPorts`    | Specify ports to forward from outside the cluster                                  | `[]`             |
+| `running`          | Determines if the virtual machine should be running                                | `true`           |
+| `instanceType`     | Virtual Machine instance type                                                      | `u1.medium`      |
+| `instanceProfile`  | Virtual Machine prefferences profile                                               | `ubuntu`         |
+| `disks`            | List of disks to attach                                                            | `[]`             |
+| `resources.cpu`    | The number of CPU cores allocated to the virtual machine                           | `""`             |
+| `resources.memory` | The amount of memory allocated to the virtual machine                              | `""`             |
+| `sshKeys`          | List of SSH public keys for authentication. Can be a single key or a list of keys. | `[]`             |
+| `cloudInit`        | cloud-init user data config. See cloud-init documentation for more details.        | `#cloud-config
 ` |

 ## U Series
--- a/packages/apps/vm-instance/templates/service.yaml
+++ b/packages/apps/vm-instance/templates/service.yaml
@@ -6,24 +6,16 @@ metadata:
  name: {{ include "virtual-machine.fullname" . }}
  labels:
    {{- include "virtual-machine.labels" . | nindent 4 }}
-  {{- if eq .Values.externalMethod "WholeIP" }}
-  annotations:
-    networking.cozystack.io/wholeIP: "true"
-  {{- end }}
 spec:
  type: {{ ternary "LoadBalancer" "ClusterIP" .Values.external }}
  externalTrafficPolicy: Local
  allocateLoadBalancerNodePorts: false
  selector:
-    {{- include "virtual-machine.selectorLabels" . | nindent 4 }}
+    {{- include "virtual-machine.labels" . | nindent 4 }}
  ports:
-    {{- if eq .Values.externalMethod "WholeIP" }}
-    - port: 65535
-    {{- else }}
    {{- range .Values.externalPorts }}
    - name: port-{{ . }}
      port: {{ . }}
      targetPort: {{ . }}
    {{- end }}
-    {{- end }}
 {{- end }}
--- a/packages/apps/vm-instance/templates/vm.yaml
+++ b/packages/apps/vm-instance/templates/vm.yaml
@@ -12,7 +12,7 @@ metadata:
  labels:
    {{- include "virtual-machine.labels" . | nindent 4 }}
 spec:
-  running: {{ .Values.running }}
+  running: {{ .Values.running | default "true" }}
  {{- with .Values.instanceType }}
  instancetype:
    kind: VirtualMachineClusterInstancetype
--- a/packages/apps/vm-instance/values.schema.json
+++ b/packages/apps/vm-instance/values.schema.json
@@ -7,15 +7,6 @@
      "description": "Enable external access from outside the cluster",
      "default": false
    },
-    "externalMethod": {
-      "type": "string",
-      "description": "specify method to passthrough the traffic to the virtual machine. Allowed values: `WholeIP` and `PortList`",
-      "default": "WholeIP",
-      "enum": [
-        "WholeIP",
-        "PortList"
-      ]
-    },
    "externalPorts": {
      "type": "array",
      "description": "Specify ports to forward from outside the cluster",
--- a/packages/apps/vm-instance/values.yaml
+++ b/packages/apps/vm-instance/values.yaml
@@ -1,10 +1,8 @@
 ## @section Common parameters

 ## @param external Enable external access from outside the cluster
-## @param externalMethod specify method to passthrough the traffic to the virtual machine. Allowed values: `WholeIP` and `PortList`
 ## @param externalPorts [array] Specify ports to forward from outside the cluster
 external: false
-externalMethod: WholeIP
 externalPorts:
 - 22

--- a/packages/core/builder/values.yaml
+++ b/packages/core/builder/values.yaml
@@ -1,3 +1,3 @@
 talos:
  imager:
-    image: ghcr.io/siderolabs/imager:v1.9.3
+    image: ghcr.io/siderolabs/imager:v1.9.2
--- a/packages/core/installer/Makefile
+++ b/packages/core/installer/Makefile
@@ -30,7 +30,7 @@ image-cozystack: run-builder
 		--provenance false \
 		--tag $(REGISTRY)/cozystack:$(call settag,$(TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/cozystack:latest \
-		--platform linux/amd64 \
+		--platform linux/amd64,linux/arm64 \
 		--cache-to type=inline \
 		--metadata-file images/cozystack.json \
 		--push=$(PUSH) \
@@ -43,7 +43,7 @@ image-talos: run-builder
 	test -f ../../../_out/assets/installer-amd64.tar || make talos-installer
 	skopeo copy docker-archive:../../../_out/assets/installer-amd64.tar docker://$(REGISTRY)/talos:$(call settag,$(TALOS_VERSION))

-image-matchbox: run-builder
+image-matchbox:  run-builder
 	test -f ../../../_out/assets/kernel-amd64 || make talos-kernel
 	test -f ../../../_out/assets/initramfs-metal-amd64.xz || make talos-initramfs
 	docker buildx build -f images/matchbox/Dockerfile ../../.. \
--- a/packages/core/installer/images/talos/profiles/initramfs.yaml
+++ b/packages/core/installer/images/talos/profiles/initramfs.yaml
@@ -3,14 +3,14 @@
 arch: amd64
 platform: metal
 secureboot: false
-version: v1.9.3
+version: v1.9.2
 input:
  kernel:
    path: /usr/install/amd64/vmlinuz
  initramfs:
    path: /usr/install/amd64/initramfs.xz
  baseInstaller:
-    imageRef: ghcr.io/siderolabs/installer:v1.9.3
+    imageRef: ghcr.io/siderolabs/installer:v1.9.2
  systemExtensions:
    - imageRef: ghcr.io/siderolabs/amd-ucode:20250109
    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20241110
@@ -19,8 +19,8 @@ input:
    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250109
    - imageRef: ghcr.io/siderolabs/intel-ucode:20241112
    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250109
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.12-v1.9.3
-    - imageRef: ghcr.io/siderolabs/zfs:2.2.7-v1.9.3
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.12-v1.9.2
+    - imageRef: ghcr.io/siderolabs/zfs:2.2.7-v1.9.2
 output:
  kind: initramfs
  imageOptions: {}
--- a/packages/core/installer/images/talos/profiles/installer.yaml
+++ b/packages/core/installer/images/talos/profiles/installer.yaml
@@ -3,14 +3,14 @@
 arch: amd64
 platform: metal
 secureboot: false
-version: v1.9.3
+version: v1.9.2
 input:
  kernel:
    path: /usr/install/amd64/vmlinuz
  initramfs:
    path: /usr/install/amd64/initramfs.xz
  baseInstaller:
-    imageRef: ghcr.io/siderolabs/installer:v1.9.3
+    imageRef: ghcr.io/siderolabs/installer:v1.9.2
  systemExtensions:
    - imageRef: ghcr.io/siderolabs/amd-ucode:20250109
    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20241110
@@ -19,8 +19,8 @@ input:
    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250109
    - imageRef: ghcr.io/siderolabs/intel-ucode:20241112
    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250109
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.12-v1.9.3
-    - imageRef: ghcr.io/siderolabs/zfs:2.2.7-v1.9.3
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.12-v1.9.2
+    - imageRef: ghcr.io/siderolabs/zfs:2.2.7-v1.9.2
 output:
  kind: installer
  imageOptions: {}
--- a/packages/core/installer/images/talos/profiles/iso.yaml
+++ b/packages/core/installer/images/talos/profiles/iso.yaml
@@ -3,14 +3,14 @@
 arch: amd64
 platform: metal
 secureboot: false
-version: v1.9.3
+version: v1.9.2
 input:
  kernel:
    path: /usr/install/amd64/vmlinuz
  initramfs:
    path: /usr/install/amd64/initramfs.xz
  baseInstaller:
-    imageRef: ghcr.io/siderolabs/installer:v1.9.3
+    imageRef: ghcr.io/siderolabs/installer:v1.9.2
  systemExtensions:
    - imageRef: ghcr.io/siderolabs/amd-ucode:20250109
    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20241110
@@ -19,8 +19,8 @@ input:
    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250109
    - imageRef: ghcr.io/siderolabs/intel-ucode:20241112
    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250109
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.12-v1.9.3
-    - imageRef: ghcr.io/siderolabs/zfs:2.2.7-v1.9.3
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.12-v1.9.2
+    - imageRef: ghcr.io/siderolabs/zfs:2.2.7-v1.9.2
 output:
  kind: iso
  imageOptions: {}
--- a/packages/core/installer/images/talos/profiles/kernel.yaml
+++ b/packages/core/installer/images/talos/profiles/kernel.yaml
@@ -3,14 +3,14 @@
 arch: amd64
 platform: metal
 secureboot: false
-version: v1.9.3
+version: v1.9.2
 input:
  kernel:
    path: /usr/install/amd64/vmlinuz
  initramfs:
    path: /usr/install/amd64/initramfs.xz
  baseInstaller:
-    imageRef: ghcr.io/siderolabs/installer:v1.9.3
+    imageRef: ghcr.io/siderolabs/installer:v1.9.2
  systemExtensions:
    - imageRef: ghcr.io/siderolabs/amd-ucode:20250109
    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20241110
@@ -19,8 +19,8 @@ input:
    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250109
    - imageRef: ghcr.io/siderolabs/intel-ucode:20241112
    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250109
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.12-v1.9.3
-    - imageRef: ghcr.io/siderolabs/zfs:2.2.7-v1.9.3
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.12-v1.9.2
+    - imageRef: ghcr.io/siderolabs/zfs:2.2.7-v1.9.2
 output:
  kind: kernel
  imageOptions: {}
--- a/packages/core/installer/images/talos/profiles/metal.yaml
+++ b/packages/core/installer/images/talos/profiles/metal.yaml
@@ -3,14 +3,14 @@
 arch: amd64
 platform: metal
 secureboot: false
-version: v1.9.3
+version: v1.9.2
 input:
  kernel:
    path: /usr/install/amd64/vmlinuz
  initramfs:
    path: /usr/install/amd64/initramfs.xz
  baseInstaller:
-    imageRef: ghcr.io/siderolabs/installer:v1.9.3
+    imageRef: ghcr.io/siderolabs/installer:v1.9.2
  systemExtensions:
    - imageRef: ghcr.io/siderolabs/amd-ucode:20250109
    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20241110
@@ -19,8 +19,8 @@ input:
    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250109
    - imageRef: ghcr.io/siderolabs/intel-ucode:20241112
    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250109
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.12-v1.9.3
-    - imageRef: ghcr.io/siderolabs/zfs:2.2.7-v1.9.3
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.12-v1.9.2
+    - imageRef: ghcr.io/siderolabs/zfs:2.2.7-v1.9.2
 output:
  kind: image
  imageOptions: { diskSize: 1306525696, diskFormat: raw }
--- a/packages/core/installer/images/talos/profiles/nocloud.yaml
+++ b/packages/core/installer/images/talos/profiles/nocloud.yaml
@@ -3,14 +3,14 @@
 arch: amd64
 platform: nocloud
 secureboot: false
-version: v1.9.3
+version: v1.9.2
 input:
  kernel:
    path: /usr/install/amd64/vmlinuz
  initramfs:
    path: /usr/install/amd64/initramfs.xz
  baseInstaller:
-    imageRef: ghcr.io/siderolabs/installer:v1.9.3
+    imageRef: ghcr.io/siderolabs/installer:v1.9.2
  systemExtensions:
    - imageRef: ghcr.io/siderolabs/amd-ucode:20250109
    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20241110
@@ -19,8 +19,8 @@ input:
    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250109
    - imageRef: ghcr.io/siderolabs/intel-ucode:20241112
    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250109
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.12-v1.9.3
-    - imageRef: ghcr.io/siderolabs/zfs:2.2.7-v1.9.3
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.12-v1.9.2
+    - imageRef: ghcr.io/siderolabs/zfs:2.2.7-v1.9.2
 output:
  kind: image
  imageOptions: { diskSize: 1306525696, diskFormat: raw }
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -1,2 +1,2 @@
 cozystack:
-  image: ghcr.io/aenix-io/cozystack/cozystack:v0.26.1@sha256:67c6eb4da3baf2208df9b2ed24cbf758a2180bb3a071ce53141c21b8d17263cf
+  image: ghcr.io/aenix-io/cozystack/cozystack:v0.23.1@sha256:dfa803a3e02ec9ea221029d361aa9d7aef0b5eb0a36d66c949b265d4ac4fc114
--- a/packages/core/platform/bundles/distro-full.yaml
+++ b/packages/core/platform/bundles/distro-full.yaml
@@ -31,13 +31,6 @@ releases:
      autoDirectNodeRoutes: true
      routingMode: native

- name: cozy-proxy
-  releaseName: cozystack
-  chart: cozy-cozy-proxy
-  namespace: cozy-system
-  optional: true
-  dependsOn: [cilium]
-
 - name: cert-manager-crds
  releaseName: cert-manager-crds
  chart: cozy-cert-manager-crds
@@ -82,10 +75,6 @@ releases:
  privileged: true
  optional: true
  dependsOn: [cilium,victoria-metrics-operator]
-  values:
-    scrapeRules:
-      etcd:
-        enabled: true

 - name: metallb
  releaseName: metallb
@@ -174,7 +163,7 @@ releases:
  chart: cozy-linstor
  namespace: cozy-linstor
  privileged: true
-  dependsOn: [piraeus-operator,cilium,cert-manager,snapshot-controller]
+  dependsOn: [piraeus-operator,cilium,cert-manager]

 - name: telepresence
  releaseName: traffic-manager
--- a/packages/core/platform/bundles/distro-hosted.yaml
+++ b/packages/core/platform/bundles/distro-hosted.yaml
@@ -58,10 +58,6 @@ releases:
  privileged: true
  optional: true
  dependsOn: [victoria-metrics-operator]
-  values:
-    scrapeRules:
-      etcd:
-        enabled: true

 - name: etcd-operator
  releaseName: etcd-operator
--- a/packages/core/platform/bundles/paas-full.yaml
+++ b/packages/core/platform/bundles/paas-full.yaml
@@ -50,12 +50,6 @@ releases:
        SVC_CIDR: "{{ index $cozyConfig.data "ipv4-svc-cidr" }}"
        JOIN_CIDR: "{{ index $cozyConfig.data "ipv4-join-cidr" }}"

- name: cozy-proxy
-  releaseName: cozystack
-  chart: cozy-cozy-proxy
-  namespace: cozy-system
-  dependsOn: [cilium,kubeovn]
-
 - name: cert-manager-crds
  releaseName: cert-manager-crds
  chart: cozy-cert-manager-crds
@@ -103,10 +97,6 @@ releases:
  namespace: cozy-monitoring
  privileged: true
  dependsOn: [cilium,kubeovn,victoria-metrics-operator]
-  values:
-    scrapeRules:
-      etcd:
-        enabled: true

 - name: kubevirt-operator
  releaseName: kubevirt-operator
@@ -205,7 +195,7 @@ releases:
  chart: cozy-linstor
  namespace: cozy-linstor
  privileged: true
-  dependsOn: [piraeus-operator,cilium,kubeovn,cert-manager,snapshot-controller]
+  dependsOn: [piraeus-operator,cilium,kubeovn,cert-manager]

 - name: snapshot-controller
  releaseName: snapshot-controller
@@ -232,62 +222,24 @@ releases:
  namespace: cozy-dashboard
  dependsOn: [cilium,kubeovn,keycloak-configure]
  values:
-    kubeapps:
    {{- if .Capabilities.APIVersions.Has "source.toolkit.fluxcd.io/v1" }}
    {{- with (lookup "source.toolkit.fluxcd.io/v1" "HelmRepository" "cozy-public" "").items }}
-      redis:
-        master:
-          podAnnotations:
-            {{- range $index, $repo := . }}
-            {{- with (($repo.status).artifact).revision }}
-            repository.cozystack.io/{{ $repo.metadata.name }}: {{ quote . }}
-            {{- end }}
-            {{- end }}
-    {{- end }}
-    {{- end }}
-      dashboard:
-        {{- $cozystackBranding:= lookup "v1" "ConfigMap" "cozy-system" "cozystack-branding" }}
-        {{- $branding := dig "data" "branding" "" $cozystackBranding }}
-        {{- if $branding }}
-        customLocale:
-          "Kubeapps": {{ $branding }}
-        {{- end }}
-        customStyle: |
-          {{- $logoImage := dig "data" "logo" "" $cozystackBranding }}
-          {{- if $logoImage }}
-          .kubeapps-logo {
-            background-image: {{ $logoImage }}
-          }
+    redis:
+      master:
+        podAnnotations:
+          {{- range $index, $repo := . }}
+          {{- with (($repo.status).artifact).revision }}
+          repository.cozystack.io/{{ $repo.metadata.name }}: {{ quote . }}
          {{- end }}
-          #serviceaccount-selector {
-            display: none;
-          }
-          .login-moreinfo {
-            display: none;
-          }
-          a[href="#/docs"] {
-            display: none;
-          }
-          .login-group .clr-form-control .clr-control-label {
-            display: none;
-          }
-          .appview-separator div.appview-first-row div.center {
-            display: none;
-          }
-          .appview-separator div.appview-first-row section[aria-labelledby="app-secrets"] {
-            display: none;
-          }
-          .appview-first-row section[aria-labelledby="access-urls-title"] {
-            width: 100%;
-          }
-  {{- $dashboardKCconfig := lookup "v1" "ConfigMap" "cozy-dashboard" "kubeapps-auth-config" }}
-  {{- $dashboardKCValues := dig "data" "values.yaml" "" $dashboardKCconfig }}
-  {{- if $dashboardKCValues }}
-  valuesFrom:
-  - kind: ConfigMap
-    name: kubeapps-auth-config
-    valuesKey: values.yaml
-  {{- end }}
+          {{- end }}
+    {{- end }}
+    {{- end }}
+
+    {{- $dashboardKCconfig := lookup "v1" "ConfigMap" "cozy-dashboard" "kubeapps-auth-config" }}
+    {{- $dashboardKCValues := dig "data" "values.yaml" "" $dashboardKCconfig }}
+    {{- if $dashboardKCValues }}
+    {{- $dashboardKCValues | nindent 4 }}
+    {{- end }}

  {{- if eq $oidcEnabled "true" }}
  dependsOn: [keycloak-configure]
@@ -359,10 +311,3 @@ releases:
    cozystack:
      configHash: {{ $cozyConfig | toJson | sha256sum }}
 {{- end }}
-
- name: goldpinger
-  releaseName: goldpinger
-  chart: cozy-goldpinger
-  namespace: cozy-goldpinger
-  privileged: true
-  dependsOn: [monitoring-agents]
--- a/packages/core/platform/bundles/paas-hosted.yaml
+++ b/packages/core/platform/bundles/paas-hosted.yaml
@@ -70,10 +70,6 @@ releases:
  namespace: cozy-monitoring
  privileged: true
  dependsOn: [victoria-metrics-operator]
-  values:
-    scrapeRules:
-      etcd:
-        enabled: true

 - name: etcd-operator
  releaseName: etcd-operator
@@ -155,9 +151,9 @@ releases:
  chart: cozy-dashboard
  namespace: cozy-dashboard
  values:
-    kubeapps:
    {{- if .Capabilities.APIVersions.Has "source.toolkit.fluxcd.io/v1" }}
    {{- with (lookup "source.toolkit.fluxcd.io/v1" "HelmRepository" "cozy-public" "").items }}
+    kubeapps:
      redis:
        master:
          podAnnotations:
@@ -168,49 +164,12 @@ releases:
            {{- end }}
    {{- end }}
    {{- end }}
-      dashboard:
-        {{- $cozystackBranding:= lookup "v1" "ConfigMap" "cozy-system" "cozystack-branding" }}
-        {{- $branding := dig "data" "branding" "" $cozystackBranding }}
-        {{- if $branding }}
-        customLocale:
-          "Kubeapps": {{ $branding }}
-        {{- end }}
-        customStyle: |
-          {{- $logoImage := dig "data" "logo" "" $cozystackBranding }}
-          {{- if $logoImage }}
-          .kubeapps-logo {
-            background-image: {{ $logoImage }}
-          }
-          {{- end }}
-          #serviceaccount-selector {
-            display: none;
-          }
-          .login-moreinfo {
-            display: none;
-          }
-          a[href="#/docs"] {
-            display: none;
-          }
-          .login-group .clr-form-control .clr-control-label {
-            display: none;
-          }
-          .appview-separator div.appview-first-row div.center {
-            display: none;
-          }
-          .appview-separator div.appview-first-row section[aria-labelledby="app-secrets"] {
-            display: none;
-          }
-          .appview-first-row section[aria-labelledby="access-urls-title"] {
-            width: 100%;
-          }
-  {{- $dashboardKCconfig := lookup "v1" "ConfigMap" "cozy-dashboard" "kubeapps-auth-config" }}
-  {{- $dashboardKCValues := dig "data" "values.yaml" "" $dashboardKCconfig }}
-  {{- if $dashboardKCValues }}
-  valuesFrom:
-  - kind: ConfigMap
-    name: kubeapps-auth-config
-    valuesKey: values.yaml
-  {{- end }}
+
+    {{- $dashboardKCconfig := lookup "v1" "ConfigMap" "cozy-dashboard" "kubeapps-auth-config" }}
+    {{- $dashboardKCValues := dig "data" "values.yaml" "" $dashboardKCconfig }}
+    {{- if $dashboardKCValues }}
+    {{- $dashboardKCValues | nindent 4 }}
+    {{- end }}

  {{- if eq $oidcEnabled "true" }}
  dependsOn: [keycloak-configure]
@@ -240,10 +199,3 @@ releases:
    cozystack:
      configHash: {{ $cozyConfig | toJson | sha256sum }}
 {{- end }}
-
- name: goldpinger
-  releaseName: goldpinger
-  chart: cozy-goldpinger
-  namespace: cozy-goldpinger
-  privileged: true
-  dependsOn: [monitoring-agents]
--- a/packages/core/testing/values.yaml
+++ b/packages/core/testing/values.yaml
@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/aenix-io/cozystack/e2e-sandbox:v0.26.1@sha256:e034c6d4232ffe6f87c24ae44100a63b1869210e484c929efac33ffcf60b18b1
+  image: ghcr.io/aenix-io/cozystack/e2e-sandbox:v0.23.1@sha256:0f4ffa7f23d6cdc633c0c4a0b852fde9710edbce96486fd9bd29c7d0d7710380
--- a/packages/extra/bootbox/images/matchbox.tag
+++ b/packages/extra/bootbox/images/matchbox.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/matchbox:v0.26.1@sha256:f5d1e0f439f49e980888ed53a4bcc65fa97b1c4bc0df86abaa17de1a5a1f71a3
+ghcr.io/aenix-io/cozystack/matchbox:v0.23.1
--- a/packages/extra/etcd/Chart.yaml
+++ b/packages/extra/etcd/Chart.yaml
@@ -3,4 +3,4 @@ name: etcd
 description: Storage for Kubernetes clusters
 icon: /logos/etcd.svg
 type: application
-version: 2.6.0
+version: 2.4.0
--- a/packages/extra/etcd/templates/etcd-cluster.yaml
+++ b/packages/extra/etcd/templates/etcd-cluster.yaml
@@ -40,12 +40,6 @@ spec:
      labels:
        cozystack.io/service: etcd
    spec:
-      containers:
-      - name: etcd
-        ports:
-        - name: metrics
-          containerPort: 2381
-          protocol: TCP
      topologySpreadConstraints:
      - maxSkew: 1
        topologyKey: "kubernetes.io/hostname"
@@ -73,12 +67,11 @@ spec:
  - "key encipherment"
  - "cert sign"
  commonName: etcd-peer-ca
-  duration: 87600h
  subject:
    organizations:
-      - {{ .Release.Namespace }}
+      - ACME Inc.
    organizationalUnits:
-      - {{ .Release.Name }}
+      - Widgets
  secretName: etcd-peer-ca-tls
  privateKey:
    algorithm: RSA
@@ -99,12 +92,11 @@ spec:
  - "key encipherment"
  - "cert sign"
  commonName: etcd-ca
-  duration: 87600h
  subject:
    organizations:
-      - {{ .Release.Namespace }}
+      - ACME Inc.
    organizationalUnits:
-      - {{ .Release.Name }}
+      - Widgets
  secretName: etcd-ca-tls
  privateKey:
    algorithm: RSA
@@ -135,16 +127,9 @@ kind: Certificate
 metadata:
  name: etcd-server
 spec:
-  commonName: etcd-server
  secretName: etcd-server-tls
-  subject:
-    organizations:
-      - {{ .Release.Namespace }}
-    organizationalUnits:
-      - {{ .Release.Name }}
  isCA: false
  usages:
-    - "client auth"
    - "server auth"
    - "signing"
    - "key encipherment"
@@ -155,7 +140,6 @@ spec:
  - etcd-{{ $i }}.etcd-headless.{{ $.Release.Namespace }}.svc
  {{- end }}
  - localhost
-  ipAddresses:
  - "127.0.0.1"
  privateKey:
    rotationPolicy: Always
@@ -169,13 +153,7 @@ kind: Certificate
 metadata:
  name: etcd-peer
 spec:
-  commonName: etcd-peer
  secretName: etcd-peer-tls
-  subject:
-    organizations:
-      - {{ .Release.Namespace }}
-    organizationalUnits:
-      - {{ .Release.Name }}
  isCA: false
  usages:
    - "server auth"
@@ -189,7 +167,6 @@ spec:
  - etcd-{{ $i }}.etcd-headless.{{ $.Release.Namespace }}.svc
  {{- end }}
  - localhost
-  ipAddresses:
  - "127.0.0.1"
  privateKey:
    rotationPolicy: Always
@@ -205,11 +182,6 @@ metadata:
 spec:
  commonName: root
  secretName: etcd-client-tls
-  subject:
-    organizations:
-      - {{ .Release.Namespace }}
-    organizationalUnits:
-      - {{ .Release.Name }}
  usages:
  - "signing"
  - "key encipherment"
--- a/packages/extra/etcd/templates/podscrape.yaml
+++ b/packages/extra/etcd/templates/podscrape.yaml
@@ -1,11 +0,0 @@
-apiVersion: operator.victoriametrics.com/v1beta1
-kind: VMPodScrape
-metadata:
-  name: etcd-pod-scrape
-spec:
-  podMetricsEndpoints:
-    - port: metrics
-      scheme: http
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: etcd
--- a/packages/extra/etcd/templates/prometheus-rules.yaml
+++ b/packages/extra/etcd/templates/prometheus-rules.yaml
@@ -1,132 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: etcd-rules
-spec:
-  groups:
-  - name: etcd
-    rules:
-    - alert: etcdInsufficientMembers
-      annotations:
-        summary: "etcd cluster '{{`{{ $labels.job }}`}}': insufficient members '{{`{{ $value }}`}}'."
-      expr: |
-        sum(up{job=~".*etcd.*"} == bool 1) by (job) < ((count(up{job=~".*etcd.*"}) by (job) + 1) / 2)
-      for: 3m
-      labels:
-        severity: critical
-
-    - alert: etcdNoLeader
-      annotations:
-        summary: "etcd cluster '{{`{{ $labels.job }}`}}': member '{{`{{ $labels.instance }}`}}' has no leader."
-      expr: |
-        etcd_server_has_leader{job=~".*etcd.*"} == 0
-      for: 1m
-      labels:
-        severity: critical
-
-    - alert: etcdHighNumberOfLeaderChanges
-      annotations:
-        summary: "etcd cluster '{{`{{ $labels.job }}`}}': instance '{{`{{ $labels.instance }}`}}' has seen '{{`{{ $value }}`}}' leader changes within the last hour."
-      expr: |
-        rate(etcd_server_leader_changes_seen_total{job=~".*etcd.*"}[15m]) > 3
-      for: 15m
-      labels:
-        severity: warning
-
-    - alert: etcdHighNumberOfFailedGRPCRequests
-      annotations:
-        summary: "etcd cluster '{{`{{ $labels.job }}`}}': '{{`{{ $value }}`}}' of requests for '{{`{{ $labels.grpc_method }}`}}' failed on etcd instance '{{`{{ $labels.instance }}`}}'."
-      expr: |
-        100 * sum(rate(grpc_server_handled_total{job=~".*etcd.*", grpc_code!="OK"}[5m])) BY (job, instance, grpc_service, grpc_method)
-          /
-        sum(rate(grpc_server_handled_total{job=~".*etcd.*"}[5m])) BY (job, instance, grpc_service, grpc_method)
-          > 1
-      for: 10m
-      labels:
-        severity: warning
-
-    - alert: etcdHighNumberOfFailedGRPCRequests
-      annotations:
-        summary: "etcd cluster '{{`{{ $labels.job }}`}}': '{{`{{ $value }}`}}' of requests for '{{`{{ $labels.grpc_method }}`}}' failed on etcd instance '{{`{{ $labels.instance }}`}}'."
-      expr: |
-        100 * sum(rate(grpc_server_handled_total{job=~".*etcd.*", grpc_code!="OK"}[5m])) BY (job, instance, grpc_service, grpc_method)
-          /
-        sum(rate(grpc_server_handled_total{job=~".*etcd.*"}[5m])) BY (job, instance, grpc_service, grpc_method)
-          > 5
-      for: 5m
-      labels:
-        severity: critical
-
-    - alert: etcdGRPCRequestsSlow
-      annotations:
-        summary: "etcd cluster '{{`{{ $labels.job }}`}}': gRPC requests to '{{`{{ $labels.grpc_method }}`}}' are taking '{{`{{ $value }}`}}' on etcd instance '{{`{{ $labels.instance }}`}}'."
-      expr: |
-        histogram_quantile(0.99, sum(rate(grpc_server_handling_seconds_bucket{job=~".*etcd.*", grpc_type="unary"}[5m])) by (job, instance, grpc_service, grpc_method, le))
-        > 0.15
-      for: 10m
-      labels:
-        severity: critical
-
-    - alert: etcdMemberCommunicationSlow
-      annotations:
-        summary: "etcd cluster '{{`{{ $labels.job }}`}}': member communication with '{{`{{ $labels.To }}`}}' is taking '{{`{{ $value }}`}}' on etcd instance '{{`{{ $labels.instance }}`}}'."
-      expr: |
-        histogram_quantile(0.99, rate(etcd_network_peer_round_trip_time_seconds_bucket{job=~".*etcd.*"}[5m]))
-        > 0.15
-      for: 10m
-      labels:
-        severity: warning
-
-    - alert: etcdHighNumberOfFailedProposals
-      annotations:
-        summary: "etcd cluster '{{`{{ $labels.job }}`}}': '{{`{{ $value }}`}}' proposal failures within the last hour on etcd instance '{{`{{ $labels.instance }}`}}'."
-      expr: |
-        rate(etcd_server_proposals_failed_total{job=~".*etcd.*"}[15m]) > 5
-      for: 15m
-      labels:
-        severity: warning
-
-    - alert: etcdHighNumberOfFailedHTTPRequests
-      annotations:
-        summary: "'{{`{{ $value }}`}}' of requests for '{{`{{ $labels.method }}`}}' failed on etcd instance '{{`{{ $labels.instance }}`}}'."
-      expr: |
-        sum(rate(etcd_http_failed_total{job=~".*etcd.*", code!="404"}[5m])) BY (method) / sum(rate(etcd_http_received_total{job=~".*etcd.*"}[5m])) BY (method) > 0.01
-      for: 10m
-      labels:
-        severity: warning
-
-    - alert: etcdHighNumberOfFailedHTTPRequests
-      annotations:
-        summary: "'{{`{{ $value }}`}}' of requests for '{{`{{ $labels.method }}`}}' failed on etcd instance '{{`{{ $labels.instance }}`}}'."
-      expr: |
-        sum(rate(etcd_http_failed_total{job=~".*etcd.*", code!="404"}[5m])) BY (method) / sum(rate(etcd_http_received_total{job=~".*etcd.*"}[5m])) BY (method) > 0.05
-      for: 10m
-      labels:
-        severity: critical
-
-    - alert: etcdHTTPRequestsSlow
-      annotations:
-        summary: "etcd instance '{{`{{ $labels.instance }}`}}' HTTP requests to '{{`{{ $labels.method }}`}}' are slow."
-      expr: |
-        histogram_quantile(0.99, rate(etcd_http_successful_duration_seconds_bucket[5m]))
-        > 0.15
-      for: 10m
-      labels:
-        severity: warning
-
-    - alert: etcdMembersDown
-      annotations:
-        summary: "etcd cluster '{{`{{ $labels.job }}`}}' members are down."
-        description: 'etcd cluster "{{`{{ $labels.job }}`}}": members are down {{`{{ $value }}`}}.'
-      expr: |
-        max without (endpoint) (
-          sum without (instance, pod) (up{job=~".*etcd.*"} == bool 0)
-        or
-          count without (To) (
-            sum without (instance, pod) (rate(etcd_network_peer_sent_failures_total{job=~".*etcd.*"}[120s])) > 0.01
-          )
-        )
-        > 0
-      for: 10m
-      labels:
-        severity: critical
--- a/packages/extra/etcd/values.schema.json
+++ b/packages/extra/etcd/values.schema.json
@@ -18,4 +18,4 @@
            "default": 3
        }
    }
-}
+}
--- a/packages/extra/info/.helmignore
+++ b/packages/extra/info/.helmignore
@@ -1,2 +0,0 @@
-.helmignore
-/logos
--- a/packages/extra/info/Chart.yaml
+++ b/packages/extra/info/Chart.yaml
@@ -1,6 +0,0 @@
-apiVersion: v2
-name: info
-description: Info
-icon: /logos/info.svg
-type: application
-version: 1.0.0
--- a/packages/extra/info/Makefile
+++ b/packages/extra/info/Makefile
@@ -1,3 +0,0 @@
-NAME=etcd
-
-include ../../../scripts/package.mk
--- a/packages/extra/info/README.md
+++ b/packages/extra/info/README.md
@@ -1,18 +0,0 @@
-# Info
-
-### Kubeconfig for tenant 
-
-### Kubelogin
-
-For using kubeconfig need install kubelogin.
-
-```bash
-# Homebrew (macOS and Linux)
-brew install int128/kubelogin/kubelogin
-
-# Krew (macOS, Linux, Windows and ARM)
-kubectl krew install oidc-login
-
-# Chocolatey (Windows)
-choco install kubelogin
-```
--- a/packages/extra/info/logos/info.svg
+++ b/packages/extra/info/logos/info.svg
@@ -1,15 +0,0 @@
-<svg width="144" height="144" viewBox="0 0 144 144" fill="none" xmlns="http://www.w3.org/2000/svg">
-<rect width="144" height="144" rx="24" fill="url(#paint0_radial_144_3)"/>
-<g clip-path="url(#clip0_144_3)">
-<path d="M77.6407 97.0844L82.833 97.3604V104.637H61.1728V97.7197L64.1771 97.4495C65.8101 97.2684 66.8106 96.7193 66.8106 94.5343V69.2314C66.8106 67.2217 66.2701 66.5864 64.5365 66.5864L61.3568 66.4081V58.8584H77.6465L77.6407 97.0844ZM71.2726 39.363C75.2804 39.363 78.187 42.3731 78.187 46.1883C78.187 50.0149 75.2718 52.8381 71.1778 52.8381C66.9975 52.8381 64.2663 50.0149 64.2663 46.1883C64.2663 42.3731 66.9975 39.363 71.2726 39.363ZM72 118C46.6368 118 26 97.3632 26 72C26 46.6368 46.6368 26 72 26C97.3575 26 118 46.6368 118 72C118 97.3632 97.3575 118 72 118ZM72 34.625C51.392 34.625 34.625 51.392 34.625 72C34.625 92.608 51.392 109.375 72 109.375C92.608 109.375 109.375 92.608 109.375 72C109.375 51.392 92.608 34.625 72 34.625Z" fill="white"/>
-</g>
-<defs>
-<radialGradient id="paint0_radial_144_3" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1.32298e-05 -7.50001) rotate(44.7178) scale(215.317 312.455)">
-<stop stop-color="#00B5E7"/>
-<stop offset="1" stop-color="#003984"/>
-</radialGradient>
-<clipPath id="clip0_144_3">
-<rect width="92" height="92" fill="white" transform="translate(26 26)"/>
-</clipPath>
-</defs>
-</svg>
--- a/packages/extra/info/values.schema.json
+++ b/packages/extra/info/values.schema.json
@@ -1 +0,0 @@
-{}
--- a/packages/extra/info/values.yaml
+++ b/packages/extra/info/values.yaml
--- a/packages/extra/monitoring/dashboards.list
+++ b/packages/extra/monitoring/dashboards.list
@@ -30,9 +30,5 @@ main/nodes
 control-plane/control-plane-status
 control-plane/deprecated-resources
 control-plane/dns-coredns
-control-plane/kube-etcd
+control-plane/kube-etcd3
 kubevirt/kubevirt-control-plane
-flux/flux-control-plane
-flux/flux-stats
-kafka/strimzi-kafka
-goldpinger/goldpinger
--- a/packages/extra/monitoring/images/grafana.tag
+++ b/packages/extra/monitoring/images/grafana.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/grafana:1.8.0@sha256:0377abd3cb2c6e27b12ac297f1859aa4d550f1aa14989f824f2315d0dfd1a5b2
+ghcr.io/aenix-io/cozystack/grafana:latest@sha256:0377abd3cb2c6e27b12ac297f1859aa4d550f1aa14989f824f2315d0dfd1a5b2
--- a/packages/extra/versions_map
+++ b/packages/extra/versions_map
@@ -5,10 +5,7 @@ etcd 2.0.1 6fc1cc7d
 etcd 2.1.0 2b00fcf8
 etcd 2.2.0 5ca8823
 etcd 2.3.0 b908400d
-etcd 2.4.0 cb7b8158
-etcd 2.5.0 861e6c46
-etcd 2.6.0 HEAD
-info 1.0.0 HEAD
+etcd 2.4.0 HEAD
 ingress 1.0.0 f642698
 ingress 1.1.0 838bee5d
 ingress 1.2.0 ced8e5b
--- a/packages/system/bootbox/Chart.yaml
+++ b/packages/system/bootbox/Chart.yaml
@@ -1,3 +1,3 @@
 apiVersion: v2
-name: cozy-bootbox
+name: cozy-smee
 version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
--- a/packages/system/bucket/images/s3manager.tag
+++ b/packages/system/bucket/images/s3manager.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/s3manager:v0.5.0@sha256:efd4a57f1b4b74871181d676dddfcac95c3a3a1e7cc244e21647c6114a0e6438
+ghcr.io/aenix-io/cozystack/s3manager:v0.5.0@sha256:35e9a8ba7e1a3b0cee634f6d2bd92d2b08c47c7ed3316559c9ea25ff733eb5d5
--- a/packages/system/capi-providers/templates/providers.yaml
+++ b/packages/system/capi-providers/templates/providers.yaml
@@ -14,13 +14,6 @@ metadata:
 spec:
  # https://github.com/clastix/cluster-api-control-plane-provider-kamaji
  version: v0.11.0
-  deployment:
-    containers:
-    - name: manager
-      resources:
-        limits:
-          cpu: 1024m
-          memory: 1024Mi
 ---
 apiVersion: operator.cluster.x-k8s.io/v1alpha2
 kind: BootstrapProvider
--- a/packages/system/cilium/charts/cilium/Chart.yaml
+++ b/packages/system/cilium/charts/cilium/Chart.yaml
@@ -79,7 +79,7 @@ annotations:
    Pod IP Pool\n  description: |\n    CiliumPodIPPool defines an IP pool that can
    be used for pooled IPAM (i.e. the multi-pool IPAM mode).\n"
 apiVersion: v2
-appVersion: 1.16.7
+appVersion: 1.16.5
 description: eBPF-based Networking, Security, and Observability
 home: https://cilium.io/
 icon: https://cdn.jsdelivr.net/gh/cilium/cilium@main/Documentation/images/logo-solo.svg
@@ -95,4 +95,4 @@ kubeVersion: '>= 1.21.0-0'
 name: cilium
 sources:
 - https://github.com/cilium/cilium
-version: 1.16.7
+version: 1.16.5
--- a/packages/system/cilium/charts/cilium/README.md
+++ b/packages/system/cilium/charts/cilium/README.md
@@ -1,6 +1,6 @@
 # cilium

-![Version: 1.16.7](https://img.shields.io/badge/Version-1.16.7-informational?style=flat-square) ![AppVersion: 1.16.7](https://img.shields.io/badge/AppVersion-1.16.7-informational?style=flat-square)
+![Version: 1.16.5](https://img.shields.io/badge/Version-1.16.5-informational?style=flat-square) ![AppVersion: 1.16.5](https://img.shields.io/badge/AppVersion-1.16.5-informational?style=flat-square)

 Cilium is open source software for providing and transparently securing
 network connectivity and loadbalancing between application workloads such as
@@ -83,7 +83,7 @@ contributors across the globe, there is almost always someone available to help.
 | authentication.mutual.spire.install.agent.tolerations | list | `[{"effect":"NoSchedule","key":"node.kubernetes.io/not-ready"},{"effect":"NoSchedule","key":"node-role.kubernetes.io/master"},{"effect":"NoSchedule","key":"node-role.kubernetes.io/control-plane"},{"effect":"NoSchedule","key":"node.cloudprovider.kubernetes.io/uninitialized","value":"true"},{"key":"CriticalAddonsOnly","operator":"Exists"}]` | SPIRE agent tolerations configuration By default it follows the same tolerations as the agent itself to allow the Cilium agent on this node to connect to SPIRE. ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
 | authentication.mutual.spire.install.enabled | bool | `true` | Enable SPIRE installation. This will only take effect only if authentication.mutual.spire.enabled is true |
 | authentication.mutual.spire.install.existingNamespace | bool | `false` | SPIRE namespace already exists. Set to true if Helm should not create, manage, and import the SPIRE namespace. |
-| authentication.mutual.spire.install.initImage | object | `{"digest":"sha256:71b79694b71639e633452f57fd9de40595d524de308349218d9a6a144b40be02","override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/library/busybox","tag":"1.36.1","useDigest":true}` | init container image of SPIRE agent and server |
+| authentication.mutual.spire.install.initImage | object | `{"digest":"sha256:d75b758a4fea99ffff4db799e16f853bbde8643671b5b72464a8ba94cbe3dbe3","override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/library/busybox","tag":"1.36.1","useDigest":true}` | init container image of SPIRE agent and server |
 | authentication.mutual.spire.install.namespace | string | `"cilium-spire"` | SPIRE namespace to install into |
 | authentication.mutual.spire.install.server.affinity | object | `{}` | SPIRE server affinity configuration |
 | authentication.mutual.spire.install.server.annotations | object | `{}` | SPIRE server annotations |
@@ -182,7 +182,7 @@ contributors across the globe, there is almost always someone available to help.
 | clustermesh.apiserver.extraVolumeMounts | list | `[]` | Additional clustermesh-apiserver volumeMounts. |
 | clustermesh.apiserver.extraVolumes | list | `[]` | Additional clustermesh-apiserver volumes. |
 | clustermesh.apiserver.healthPort | int | `9880` | TCP port for the clustermesh-apiserver health API. |
-| clustermesh.apiserver.image | object | `{"digest":"sha256:8e7eda5b194d45c3b1607f5bf31cbb3fecd0f1cf85ce32b41f93b2bd832bf02f","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.16.7","useDigest":true}` | Clustermesh API server image. |
+| clustermesh.apiserver.image | object | `{"digest":"sha256:37a7fdbef806b78ef63df9f1a9828fdddbf548d1f0e43b8eb10a6bdc8fa03958","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.16.5","useDigest":true}` | Clustermesh API server image. |
 | clustermesh.apiserver.kvstoremesh.enabled | bool | `true` | Enable KVStoreMesh. KVStoreMesh caches the information retrieved from the remote clusters in the local etcd instance. |
 | clustermesh.apiserver.kvstoremesh.extraArgs | list | `[]` | Additional KVStoreMesh arguments. |
 | clustermesh.apiserver.kvstoremesh.extraEnv | list | `[]` | Additional KVStoreMesh environment variables. |
@@ -353,11 +353,10 @@ contributors across the globe, there is almost always someone available to help.
 | envoy.extraVolumes | list | `[]` | Additional envoy volumes. |
 | envoy.healthPort | int | `9878` | TCP port for the health API. |
 | envoy.idleTimeoutDurationSeconds | int | `60` | Set Envoy upstream HTTP idle connection timeout seconds. Does not apply to connections with pending requests. Default 60s |
-| envoy.image | object | `{"digest":"sha256:fc708bd36973d306412b2e50c924cd8333de67e0167802c9b48506f9d772f521","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.31.5-1739264036-958bef243c6c66fcfd73ca319f2eb49fff1eb2ae","useDigest":true}` | Envoy container image. |
+| envoy.image | object | `{"digest":"sha256:709c08ade3d17d52da4ca2af33f431360ec26268d288d9a6cd1d98acc9a1dced","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.30.8-1733837904-eaae5aca0fb988583e5617170a65ac5aa51c0aa8","useDigest":true}` | Envoy container image. |
 | envoy.initialFetchTimeoutSeconds | int | `30` | Time in seconds after which the initial fetch on an xDS stream is considered timed out |
 | envoy.livenessProbe.failureThreshold | int | `10` | failure threshold of liveness probe |
 | envoy.livenessProbe.periodSeconds | int | `30` | interval between checks of the liveness probe |
-| envoy.log.accessLogBufferSize | int | `4096` | Size of the Envoy access log buffer created within the agent in bytes. Tune this value up if you encounter "Envoy: Discarded truncated access log message" errors. Large request/response header sizes (e.g. 16KiB) will require a larger buffer size. |
 | envoy.log.format | string | `"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v"` | The format string to use for laying out the log message metadata of Envoy. |
 | envoy.log.path | string | `""` | Path to a separate Envoy log file, if any. Defaults to /dev/stdout. |
 | envoy.maxConnectionDurationSeconds | int | `0` | Set Envoy HTTP option max_connection_duration seconds. Default 0 (disable) |
@@ -486,7 +485,7 @@ contributors across the globe, there is almost always someone available to help.
 | hubble.relay.extraVolumes | list | `[]` | Additional hubble-relay volumes. |
 | hubble.relay.gops.enabled | bool | `true` | Enable gops for hubble-relay |
 | hubble.relay.gops.port | int | `9893` | Configure gops listen port for hubble-relay |
-| hubble.relay.image | object | `{"digest":"sha256:8f408ed921cd534394aa1c57b313741cec6aec03a14ea243b2173cbf2c88c91e","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.16.7","useDigest":true}` | Hubble-relay container image. |
+| hubble.relay.image | object | `{"digest":"sha256:6cfae1d1afa566ba941f03d4d7e141feddd05260e5cd0a1509aba1890a45ef00","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.16.5","useDigest":true}` | Hubble-relay container image. |
 | hubble.relay.listenHost | string | `""` | Host to listen to. Specify an empty string to bind to all the interfaces. |
 | hubble.relay.listenPort | string | `"4245"` | Port to listen to. |
 | hubble.relay.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
@@ -592,7 +591,7 @@ contributors across the globe, there is almost always someone available to help.
 | hubble.ui.updateStrategy | object | `{"rollingUpdate":{"maxUnavailable":1},"type":"RollingUpdate"}` | hubble-ui update strategy. |
 | identityAllocationMode | string | `"crd"` | Method to use for identity allocation (`crd` or `kvstore`). |
 | identityChangeGracePeriod | string | `"5s"` | Time to wait before using new identity on endpoint identity change. |
-| image | object | `{"digest":"sha256:294d2432507fed393b26e9fbfacb25c2e37095578cb34dabac7312b66ed0782e","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.16.7","useDigest":true}` | Agent container image. |
+| image | object | `{"digest":"sha256:758ca0793f5995bb938a2fa219dcce63dc0b3fa7fc4ce5cc851125281fb7361d","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.16.5","useDigest":true}` | Agent container image. |
 | imagePullSecrets | list | `[]` | Configure image pull secrets for pulling container images |
 | ingressController.default | bool | `false` | Set cilium ingress controller to be the default ingress controller This will let cilium ingress controller route entries without ingress class set |
 | ingressController.defaultSecretName | string | `nil` | Default secret name for ingresses without .spec.tls[].secretName set. |
@@ -719,7 +718,7 @@ contributors across the globe, there is almost always someone available to help.
 | operator.hostNetwork | bool | `true` | HostNetwork setting |
 | operator.identityGCInterval | string | `"15m0s"` | Interval for identity garbage collection. |
 | operator.identityHeartbeatTimeout | string | `"30m0s"` | Timeout for identity heartbeats. |
-| operator.image | object | `{"alibabacloudDigest":"sha256:dbdc856303e1ab6734538e29791fdfc4fe2c1295fd7bbce8fa006cd3165f85c8","awsDigest":"sha256:110d922337bdbfc3cd4d7d71b85b2c8f72c1d9925e9b61b4cd73ff990799d7ba","azureDigest":"sha256:4e7e64cc505676d402c68043934e2c8efc75b294245514d7611a58d06b5e0f69","genericDigest":"sha256:25a41ac50bcebfb780ed2970e55a5ba1a5f26996850ed5a694dc69b312e0b5a0","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.16.7","useDigest":true}` | cilium-operator image. |
+| operator.image | object | `{"alibabacloudDigest":"sha256:c0edf4c8d089e76d6565d3c57128b98bc6c73d14bb4590126ee746aeaedba5e0","awsDigest":"sha256:97e1fe0c2b522583033138eb10c170919d8de49d2788ceefdcff229a92210476","azureDigest":"sha256:265e2b78f572c76b523f91757083ea5f0b9b73b82f2d9714e5a8fb848e4048f9","genericDigest":"sha256:f7884848483bbcd7b1e0ccfd34ba4546f258b460cb4b7e2f06a1bcc96ef88039","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.16.5","useDigest":true}` | cilium-operator image. |
 | operator.nodeGCInterval | string | `"5m0s"` | Interval for cilium node garbage collection. |
 | operator.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for cilium-operator pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | operator.podAnnotations | object | `{}` | Annotations to be added to cilium-operator pods |
@@ -769,7 +768,7 @@ contributors across the globe, there is almost always someone available to help.
 | preflight.extraEnv | list | `[]` | Additional preflight environment variables. |
 | preflight.extraVolumeMounts | list | `[]` | Additional preflight volumeMounts. |
 | preflight.extraVolumes | list | `[]` | Additional preflight volumes. |
-| preflight.image | object | `{"digest":"sha256:294d2432507fed393b26e9fbfacb25c2e37095578cb34dabac7312b66ed0782e","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.16.7","useDigest":true}` | Cilium pre-flight image. |
+| preflight.image | object | `{"digest":"sha256:758ca0793f5995bb938a2fa219dcce63dc0b3fa7fc4ce5cc851125281fb7361d","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.16.5","useDigest":true}` | Cilium pre-flight image. |
 | preflight.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for preflight pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | preflight.podAnnotations | object | `{}` | Annotations to be added to preflight pods |
 | preflight.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
--- a/packages/system/cilium/charts/cilium/files/cilium-envoy/configmap/bootstrap-config.json
+++ b/packages/system/cilium/charts/cilium/files/cilium-envoy/configmap/bootstrap-config.json
@@ -0,0 +1,471 @@
+{
+  "node": {
+    "id": "host~127.0.0.1~no-id~localdomain",
+    "cluster": "ingress-cluster"
+  },
+  "staticResources": {
+    "listeners": [
+      {{- if .Values.envoy.prometheus.enabled }}
+      {
+        "name": "envoy-prometheus-metrics-listener",
+        "address": {
+          "socket_address": {
+            "address": "0.0.0.0",
+            "port_value": {{ .Values.envoy.prometheus.port }}
+          }
+        },
+        "filter_chains": [
+          {
+            "filters": [
+              {
+                "name": "envoy.filters.network.http_connection_manager",
+                "typed_config": {
+                  "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
+                  "stat_prefix": "envoy-prometheus-metrics-listener",
+                  "route_config": {
+                    "virtual_hosts": [
+                      {
+                        "name": "prometheus_metrics_route",
+                        "domains": [
+                          "*"
+                        ],
+                        "routes": [
+                          {
+                            "name": "prometheus_metrics_route",
+                            "match": {
+                              "prefix": "/metrics"
+                            },
+                            "route": {
+                              "cluster": "/envoy-admin",
+                              "prefix_rewrite": "/stats/prometheus"
+                            }
+                          }
+                        ]
+                      }
+                    ]
+                  },
+                  "http_filters": [
+                    {
+                      "name": "envoy.filters.http.router",
+                      "typed_config": {
+                        "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                      }
+                    }
+                  ],
+                  "internal_address_config": {
+                    "cidr_ranges": [
+                      {
+                        "address_prefix": "10.0.0.0",
+                        "prefix_len": 8
+                      },
+                      {
+                        "address_prefix": "172.16.0.0",
+                        "prefix_len": 12
+                      },
+                      {
+                        "address_prefix": "192.168.0.0",
+                        "prefix_len": 16
+                      },
+                      {
+                        "address_prefix": "127.0.0.1",
+                        "prefix_len": 32
+                      },
+                      {
+                        "address_prefix": "::1",
+                        "prefix_len": 128
+                      }
+                    ]
+                  },
+                  "stream_idle_timeout": "0s"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {{- end }}
+      {{- if and .Values.envoy.debug.admin.enabled }}
+      {
+        "name": "envoy-admin-listener",
+        "address": {
+          "socket_address": {
+            "address": {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }},
+            "port_value": {{ .Values.envoy.debug.admin.port }}
+          }
+        },
+        {{- if and .Values.ipv4.enabled .Values.ipv6.enabled }}
+        "additional_addresses": [
+          {
+            "address": {
+              "socket_address": {
+                "address": "::1",
+                "port_value": {{ .Values.envoy.debug.admin.port }}
+              }
+            }
+          }
+        ],
+        {{- end }}
+        "filter_chains": [
+          {
+            "filters": [
+              {
+                "name": "envoy.filters.network.http_connection_manager",
+                "typed_config": {
+                  "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
+                  "stat_prefix": "envoy-admin-listener",
+                  "route_config": {
+                    "virtual_hosts": [
+                      {
+                        "name": "admin_route",
+                        "domains": [
+                          "*"
+                        ],
+                        "routes": [
+                          {
+                            "name": "admin_route",
+                            "match": {
+                              "prefix": "/"
+                            },
+                            "route": {
+                              "cluster": "/envoy-admin",
+                              "prefix_rewrite": "/"
+                            }
+                          }
+                        ]
+                      }
+                    ]
+                  },
+                  "http_filters": [
+                    {
+                      "name": "envoy.filters.http.router",
+                      "typed_config": {
+                        "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                      }
+                    }
+                  ],
+                  "internal_address_config": {
+                    "cidr_ranges": [
+                      {
+                        "address_prefix": "10.0.0.0",
+                        "prefix_len": 8
+                      },
+                      {
+                        "address_prefix": "172.16.0.0",
+                        "prefix_len": 12
+                      },
+                      {
+                        "address_prefix": "192.168.0.0",
+                        "prefix_len": 16
+                      },
+                      {
+                        "address_prefix": "127.0.0.1",
+                        "prefix_len": 32
+                      },
+                      {
+                        "address_prefix": "::1",
+                        "prefix_len": 128
+                      }
+                    ]
+                  },
+                  "stream_idle_timeout": "0s"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {{- end }}
+      {
+        "name": "envoy-health-listener",
+        "address": {
+          "socket_address": {
+            "address": {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }},
+            "port_value": {{ .Values.envoy.healthPort }}
+          }
+        },
+        {{- if and .Values.ipv4.enabled .Values.ipv6.enabled }}
+        "additional_addresses": [
+          {
+            "address": {
+              "socket_address": {
+                "address": "::1",
+                "port_value": {{ .Values.envoy.healthPort }}
+              }
+            }
+          }
+        ],
+        {{- end }}
+        "filter_chains": [
+          {
+            "filters": [
+              {
+                "name": "envoy.filters.network.http_connection_manager",
+                "typed_config": {
+                  "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
+                  "stat_prefix": "envoy-health-listener",
+                  "route_config": {
+                    "virtual_hosts": [
+                      {
+                        "name": "health",
+                        "domains": [
+                          "*"
+                        ],
+                        "routes": [
+                          {
+                            "name": "health",
+                            "match": {
+                              "prefix": "/healthz"
+                            },
+                            "route": {
+                              "cluster": "/envoy-admin",
+                              "prefix_rewrite": "/ready"
+                            }
+                          }
+                        ]
+                      }
+                    ]
+                  },
+                  "http_filters": [
+                    {
+                      "name": "envoy.filters.http.router",
+                      "typed_config": {
+                        "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                      }
+                    }
+                  ],
+                  "internal_address_config": {
+                    "cidr_ranges": [
+                      {
+                        "address_prefix": "10.0.0.0",
+                        "prefix_len": 8
+                      },
+                      {
+                        "address_prefix": "172.16.0.0",
+                        "prefix_len": 12
+                      },
+                      {
+                        "address_prefix": "192.168.0.0",
+                        "prefix_len": 16
+                      },
+                      {
+                        "address_prefix": "127.0.0.1",
+                        "prefix_len": 32
+                      },
+                      {
+                        "address_prefix": "::1",
+                        "prefix_len": 128
+                      }
+                    ]
+                  },
+                  "stream_idle_timeout": "0s"
+                }
+              }
+            ]
+          }
+        ]
+      }
+    ],
+    "clusters": [
+      {
+        "name": "ingress-cluster",
+        "type": "ORIGINAL_DST",
+        "connectTimeout": "{{ .Values.envoy.connectTimeoutSeconds }}s",
+        "lbPolicy": "CLUSTER_PROVIDED",
+        "typedExtensionProtocolOptions": {
+          "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": {
+            "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+            "commonHttpProtocolOptions": {
+              "idleTimeout": "{{ .Values.envoy.idleTimeoutDurationSeconds }}s",
+              "maxConnectionDuration": "{{ .Values.envoy.maxConnectionDurationSeconds }}s",
+              "maxRequestsPerConnection": {{ .Values.envoy.maxRequestsPerConnection }}
+            },
+            "useDownstreamProtocolConfig": {}
+          }
+        },
+        "cleanupInterval": "{{ .Values.envoy.connectTimeoutSeconds }}.500s"
+      },
+      {
+        "name": "egress-cluster-tls",
+        "type": "ORIGINAL_DST",
+        "connectTimeout": "{{ .Values.envoy.connectTimeoutSeconds }}s",
+        "lbPolicy": "CLUSTER_PROVIDED",
+        "typedExtensionProtocolOptions": {
+          "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": {
+            "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+            "commonHttpProtocolOptions": {
+              "idleTimeout": "{{ .Values.envoy.idleTimeoutDurationSeconds }}s",
+              "maxConnectionDuration": "{{ .Values.envoy.maxConnectionDurationSeconds }}s",
+              "maxRequestsPerConnection": {{ .Values.envoy.maxRequestsPerConnection }}
+            },
+            "upstreamHttpProtocolOptions": {},
+            "useDownstreamProtocolConfig": {}
+          }
+        },
+        "cleanupInterval": "{{ .Values.envoy.connectTimeoutSeconds }}.500s",
+        "transportSocket": {
+          "name": "cilium.tls_wrapper",
+          "typedConfig": {
+            "@type": "type.googleapis.com/cilium.UpstreamTlsWrapperContext"
+          }
+        }
+      },
+      {
+        "name": "egress-cluster",
+        "type": "ORIGINAL_DST",
+        "connectTimeout": "{{ .Values.envoy.connectTimeoutSeconds }}s",
+        "lbPolicy": "CLUSTER_PROVIDED",
+        "typedExtensionProtocolOptions": {
+          "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": {
+            "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+            "commonHttpProtocolOptions": {
+              "idleTimeout": "{{ .Values.envoy.idleTimeoutDurationSeconds }}s",
+              "maxConnectionDuration": "{{ .Values.envoy.maxConnectionDurationSeconds }}s",
+              "maxRequestsPerConnection": {{ .Values.envoy.maxRequestsPerConnection }}
+            },
+            "useDownstreamProtocolConfig": {}
+          }
+        },
+        "cleanupInterval": "{{ .Values.envoy.connectTimeoutSeconds }}.500s"
+      },
+      {
+        "name": "ingress-cluster-tls",
+        "type": "ORIGINAL_DST",
+        "connectTimeout": "{{ .Values.envoy.connectTimeoutSeconds }}s",
+        "lbPolicy": "CLUSTER_PROVIDED",
+        "typedExtensionProtocolOptions": {
+          "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": {
+            "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+            "commonHttpProtocolOptions": {
+              "idleTimeout": "{{ .Values.envoy.idleTimeoutDurationSeconds }}s",
+              "maxConnectionDuration": "{{ .Values.envoy.maxConnectionDurationSeconds }}s",
+              "maxRequestsPerConnection": {{ .Values.envoy.maxRequestsPerConnection }}
+            },
+            "upstreamHttpProtocolOptions": {},
+            "useDownstreamProtocolConfig": {}
+          }
+        },
+        "cleanupInterval": "{{ .Values.envoy.connectTimeoutSeconds }}.500s",
+        "transportSocket": {
+          "name": "cilium.tls_wrapper",
+          "typedConfig": {
+            "@type": "type.googleapis.com/cilium.UpstreamTlsWrapperContext"
+          }
+        }
+      },
+      {
+        "name": "xds-grpc-cilium",
+        "type": "STATIC",
+        "connectTimeout": "{{ .Values.envoy.connectTimeoutSeconds }}s",
+        "loadAssignment": {
+          "clusterName": "xds-grpc-cilium",
+          "endpoints": [
+            {
+              "lbEndpoints": [
+                {
+                  "endpoint": {
+                    "address": {
+                      "pipe": {
+                        "path": "/var/run/cilium/envoy/sockets/xds.sock"
+                      }
+                    }
+                  }
+                }
+              ]
+            }
+          ]
+        },
+        "typedExtensionProtocolOptions": {
+          "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": {
+            "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+            "explicitHttpConfig": {
+              "http2ProtocolOptions": {}
+            }
+          }
+        }
+      },
+      {
+        "name": "/envoy-admin",
+        "type": "STATIC",
+        "connectTimeout": "{{ .Values.envoy.connectTimeoutSeconds }}s",
+        "loadAssignment": {
+          "clusterName": "/envoy-admin",
+          "endpoints": [
+            {
+              "lbEndpoints": [
+                {
+                  "endpoint": {
+                    "address": {
+                      "pipe": {
+                        "path": "/var/run/cilium/envoy/sockets/admin.sock"
+                      }
+                    }
+                  }
+                }
+              ]
+            }
+          ]
+        }
+      }
+    ]
+  },
+  "dynamicResources": {
+    "ldsConfig": {
+      "initialFetchTimeout": "{{ .Values.envoy.initialFetchTimeoutSeconds }}s",
+      "apiConfigSource": {
+        "apiType": "GRPC",
+        "transportApiVersion": "V3",
+        "grpcServices": [
+          {
+            "envoyGrpc": {
+              "clusterName": "xds-grpc-cilium"
+            }
+          }
+        ],
+        "setNodeOnFirstMessageOnly": true
+      },
+      "resourceApiVersion": "V3"
+    },
+    "cdsConfig": {
+      "initialFetchTimeout": "{{ .Values.envoy.initialFetchTimeoutSeconds }}s",
+      "apiConfigSource": {
+        "apiType": "GRPC",
+        "transportApiVersion": "V3",
+        "grpcServices": [
+          {
+            "envoyGrpc": {
+              "clusterName": "xds-grpc-cilium"
+            }
+          }
+        ],
+        "setNodeOnFirstMessageOnly": true
+      },
+      "resourceApiVersion": "V3"
+    }
+  },
+  "bootstrapExtensions": [
+    {
+      "name": "envoy.bootstrap.internal_listener",
+      "typed_config": {
+        "@type": "type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener"
+      }
+    }
+  ],
+  "overload_manager": {
+    "resource_monitors": [
+      {
+        "name": "envoy.resource_monitors.global_downstream_max_connections",
+        "typed_config": {
+          "@type": "type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig",
+          "max_active_downstream_connections": "50000"
+        }
+      }
+    ]
+  },
+  "admin": {
+    "address": {
+      "pipe": {
+        "path": "/var/run/cilium/envoy/sockets/admin.sock"
+      }
+    }
+  }
+}
--- a/packages/system/cilium/charts/cilium/files/cilium-envoy/configmap/bootstrap-config.yaml
+++ b/packages/system/cilium/charts/cilium/files/cilium-envoy/configmap/bootstrap-config.yaml
@@ -1,280 +0,0 @@
-node:
-  id: "host~127.0.0.1~no-id~localdomain"
-  cluster: "ingress-cluster"
-staticResources:
-  listeners:
-  {{- if .Values.envoy.prometheus.enabled }}
-  - name: "envoy-prometheus-metrics-listener"
-    address:
-      socketAddress:
-        address: "0.0.0.0"
-        portValue: {{ .Values.envoy.prometheus.port }}
-    filterChains:
-    - filters:
-      - name: "envoy.filters.network.http_connection_manager"
-        typedConfig:
-          "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
-          statPrefix: "envoy-prometheus-metrics-listener"
-          routeConfig:
-            virtualHosts:
-            - name: "prometheus_metrics_route"
-              domains:
-              - "*"
-              routes:
-              - name: "prometheus_metrics_route"
-                match:
-                  prefix: "/metrics"
-                route:
-                  cluster: "/envoy-admin"
-                  prefixRewrite: "/stats/prometheus"
-          httpFilters:
-          - name: "envoy.filters.http.router"
-            typedConfig:
-              "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
-          internalAddressConfig:
-            cidrRanges:
-            {{- if .Values.ipv4.enabled }}
-            - addressPrefix: "10.0.0.0"
-              prefixLen: 8
-            - addressPrefix: "172.16.0.0"
-              prefixLen: 12
-            - addressPrefix: "192.168.0.0"
-              prefixLen: 16
-            - addressPrefix: "127.0.0.1"
-              prefixLen: 32
-            {{- end }}
-            {{- if .Values.ipv6.enabled }}
-            - addressPrefix: "::1"
-              prefixLen: 128
-            {{- end }}
-          streamIdleTimeout: "0s"
-  {{- end }}
-  {{- if and .Values.envoy.debug.admin.enabled }}
-  - name: "envoy-admin-listener"
-    address:
-      socketAddress:
-        address: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }}
-        portValue: {{ .Values.envoy.debug.admin.port }}
-    {{- if and .Values.ipv4.enabled .Values.ipv6.enabled }}
-    additionalAddresses:
-    - address:
-        socketAddress:
-          address: "::1"
-          portValue: {{ .Values.envoy.debug.admin.port }}
-    {{- end }}
-    filterChains:
-    - filters:
-      - name: "envoy.filters.network.http_connection_manager"
-        typedConfig:
-          "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
-          statPrefix: "envoy-admin-listener"
-          routeConfig:
-            virtual_hosts:
-            - name: "admin_route"
-              domains:
-              - "*"
-              routes:
-              - name: "admin_route"
-                match:
-                  prefix: "/"
-                route:
-                  cluster: "/envoy-admin"
-                  prefixRewrite: "/"
-          httpFilters:
-          - name: "envoy.filters.http.router"
-            typedConfig:
-              "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
-          internalAddressConfig:
-            cidrRanges:
-            {{- if .Values.ipv4.enabled }}
-            - addressPrefix: "10.0.0.0"
-              prefixLen: 8
-            - addressPrefix: "172.16.0.0"
-              prefixLen: 12
-            - addressPrefix: "192.168.0.0"
-              prefixLen: 16
-            - addressPrefix: "127.0.0.1"
-              prefixLen: 32
-            {{- end }}
-            {{- if .Values.ipv6.enabled }}
-            - addressPrefix: "::1"
-              prefixLen: 128
-            {{- end }}
-          streamIdleTimeout: "0s"
-  {{- end }}
-  - name: "envoy-health-listener"
-    address:
-      socketAddress:
-        address: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }}
-        portValue: {{ .Values.envoy.healthPort }}
-    {{- if and .Values.ipv4.enabled .Values.ipv6.enabled }}
-    additionalAddresses:
-    - address:
-        socketAddress:
-          address: "::1"
-          portValue: {{ .Values.envoy.healthPort }}
-    {{- end }}
-    filterChains:
-    - filters:
-      - name: "envoy.filters.network.http_connection_manager"
-        typedConfig:
-          "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
-          statPrefix: "envoy-health-listener"
-          routeConfig:
-            virtual_hosts:
-            - name: "health"
-              domains:
-              - "*"
-              routes:
-              - name: "health"
-                match:
-                  prefix: "/healthz"
-                route:
-                  cluster: "/envoy-admin"
-                  prefixRewrite: "/ready"
-          httpFilters:
-          - name: "envoy.filters.http.router"
-            typedConfig:
-              "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
-          internalAddressConfig:
-            cidrRanges:
-            {{- if .Values.ipv4.enabled }}
-            - addressPrefix: "10.0.0.0"
-              prefixLen: 8
-            - addressPrefix: "172.16.0.0"
-              prefixLen: 12
-            - addressPrefix: "192.168.0.0"
-              prefixLen: 16
-            - addressPrefix: "127.0.0.1"
-              prefixLen: 32
-            {{- end }}
-            {{- if .Values.ipv6.enabled }}
-            - addressPrefix: "::1"
-              prefixLen: 128
-            {{- end }}
-          streamIdleTimeout: "0s"
-  clusters:
-  - name: "ingress-cluster"
-    type: "ORIGINAL_DST"
-    connectTimeout: "{{ .Values.envoy.connectTimeoutSeconds }}s"
-    lbPolicy: "CLUSTER_PROVIDED"
-    typedExtensionProtocolOptions:
-      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
-        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
-        commonHttpProtocolOptions:
-          idleTimeout: "{{ .Values.envoy.idleTimeoutDurationSeconds }}s"
-          maxConnectionDuration: "{{ .Values.envoy.maxConnectionDurationSeconds }}s"
-          maxRequestsPerConnection: {{ .Values.envoy.maxRequestsPerConnection }}
-        useDownstreamProtocolConfig: {}
-    cleanupInterval: "{{ .Values.envoy.connectTimeoutSeconds }}.500s"
-  - name: "egress-cluster-tls"
-    type: "ORIGINAL_DST"
-    connectTimeout: "{{ .Values.envoy.connectTimeoutSeconds }}s"
-    lbPolicy: "CLUSTER_PROVIDED"
-    typedExtensionProtocolOptions:
-      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
-        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
-        commonHttpProtocolOptions:
-          idleTimeout: "{{ .Values.envoy.idleTimeoutDurationSeconds }}s"
-          maxConnectionDuration: "{{ .Values.envoy.maxConnectionDurationSeconds }}s"
-          maxRequestsPerConnection: {{ .Values.envoy.maxRequestsPerConnection }}
-        upstreamHttpProtocolOptions: {}
-        useDownstreamProtocolConfig: {}
-    cleanupInterval: "{{ .Values.envoy.connectTimeoutSeconds }}.500s"
-    transportSocket:
-      name: "cilium.tls_wrapper"
-      typedConfig:
-        "@type": "type.googleapis.com/cilium.UpstreamTlsWrapperContext"
-  - name: "egress-cluster"
-    type: "ORIGINAL_DST"
-    connectTimeout: "{{ .Values.envoy.connectTimeoutSeconds }}s"
-    lbPolicy: "CLUSTER_PROVIDED"
-    typedExtensionProtocolOptions:
-      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
-        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
-        commonHttpProtocolOptions:
-          idleTimeout: "{{ .Values.envoy.idleTimeoutDurationSeconds }}s"
-          maxConnectionDuration: "{{ .Values.envoy.maxConnectionDurationSeconds }}s"
-          maxRequestsPerConnection: {{ .Values.envoy.maxRequestsPerConnection }}
-        useDownstreamProtocolConfig: {}
-    cleanupInterval: "{{ .Values.envoy.connectTimeoutSeconds }}.500s"
-  - name: "ingress-cluster-tls"
-    type: "ORIGINAL_DST"
-    connectTimeout: "{{ .Values.envoy.connectTimeoutSeconds }}s"
-    lbPolicy: "CLUSTER_PROVIDED"
-    typedExtensionProtocolOptions:
-      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
-        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
-        commonHttpProtocolOptions:
-          idleTimeout: "{{ .Values.envoy.idleTimeoutDurationSeconds }}s"
-          maxConnectionDuration: "{{ .Values.envoy.maxConnectionDurationSeconds }}s"
-          maxRequestsPerConnection: {{ .Values.envoy.maxRequestsPerConnection }}
-        upstreamHttpProtocolOptions: {}
-        useDownstreamProtocolConfig: {}
-    cleanupInterval: "{{ .Values.envoy.connectTimeoutSeconds }}.500s"
-    transportSocket:
-      name: "cilium.tls_wrapper"
-      typedConfig:
-        "@type": "type.googleapis.com/cilium.UpstreamTlsWrapperContext"
-  - name: "xds-grpc-cilium"
-    type: "STATIC"
-    connectTimeout: "{{ .Values.envoy.connectTimeoutSeconds }}s"
-    loadAssignment:
-      clusterName: "xds-grpc-cilium"
-      endpoints:
-      - lbEndpoints:
-        - endpoint:
-            address:
-              pipe:
-                path: "/var/run/cilium/envoy/sockets/xds.sock"
-    typedExtensionProtocolOptions:
-      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
-        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
-        explicitHttpConfig:
-          http2ProtocolOptions: {}
-  - name: "/envoy-admin"
-    type: "STATIC"
-    connectTimeout: "{{ .Values.envoy.connectTimeoutSeconds }}s"
-    loadAssignment:
-      clusterName: "/envoy-admin"
-      endpoints:
-      - lbEndpoints:
-        - endpoint:
-            address:
-              pipe:
-                path: "/var/run/cilium/envoy/sockets/admin.sock"
-dynamicResources:
-  ldsConfig:
-    initialFetchTimeout: "{{ .Values.envoy.initialFetchTimeoutSeconds }}s"
-    apiConfigSource:
-      apiType: "GRPC"
-      transportApiVersion: "V3"
-      grpcServices:
-      - envoyGrpc:
-          clusterName: "xds-grpc-cilium"
-      setNodeOnFirstMessageOnly: true
-    resourceApiVersion: "V3"
-  cdsConfig:
-    initialFetchTimeout: "{{ .Values.envoy.initialFetchTimeoutSeconds }}s"
-    apiConfigSource:
-      apiType: "GRPC"
-      transportApiVersion: "V3"
-      grpcServices:
-      - envoyGrpc:
-          clusterName: "xds-grpc-cilium"
-      setNodeOnFirstMessageOnly: true
-    resourceApiVersion: "V3"
-bootstrapExtensions:
- name: "envoy.bootstrap.internal_listener"
-  typedConfig:
-    "@type": "type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener"
-overloadManager:
-  resourceMonitors:
-  - name: "envoy.resource_monitors.global_downstream_max_connections"
-    typedConfig:
-      "@type": "type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig"
-      max_active_downstream_connections: "50000"
-admin:
-  address:
-    pipe:
-      path: "/var/run/cilium/envoy/sockets/admin.sock"
--- a/packages/system/cilium/charts/cilium/files/nodeinit/startup.bash
+++ b/packages/system/cilium/charts/cilium/files/nodeinit/startup.bash
@@ -116,8 +116,6 @@ else
  exec /home/kubernetes/bin/the-kubelet "${@}" --network-plugin=cni --cni-bin-dir={{ .Values.cni.binPath }}
 fi
 EOF
-    echo "Restarting the kubelet..."
-    systemctl restart kubelet
  else
    echo "Kubelet wrapper already exists, skipping..."
  fi
@@ -137,10 +135,10 @@ else
    echo "Changing kubelet configuration to --network-plugin=cni --cni-bin-dir={{ .Values.cni.binPath }}"
    mkdir -p {{ .Values.cni.binPath }}
    sed -i "s:--network-plugin=kubenet:--network-plugin=cni\ --cni-bin-dir={{ .Values.cni.binPath }}:g" "${KUBELET_DEFAULTS_FILE}"
-    echo "Restarting the kubelet..."
-    systemctl restart kubelet
  fi
 fi
+echo "Restarting the kubelet..."
+systemctl restart kubelet
 {{- end }}

 {{- if (and .Values.gke.enabled (or .Values.enableIPv4Masquerade .Values.gke.disableDefaultSnat))}}
--- a/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
@@ -315,9 +315,13 @@ spec:
        {{- end}}
        - name: cilium-run
          mountPath: /var/run/cilium
+        {{- /* mount the directory if socketLB.enabled is true and socketLB.terminatePodConnections is not explicitly set to false */ -}}
+        {{- if or (and (kindIs "invalid" .Values.socketLB.terminatePodConnections) .Values.socketLB.enabled)
+                  (and .Values.socketLB.enabled .Values.socketLB.terminatePodConnections)  }}
        - name: cilium-netns
          mountPath: /var/run/cilium/netns
          mountPropagation: HostToContainer
+        {{- end}}
        - name: etc-cni-netd
          mountPath: {{ .Values.cni.hostConfDirMountPath }}
        {{- if .Values.etcd.enabled }}
@@ -793,11 +797,14 @@ spec:
        hostPath:
          path: {{ .Values.daemon.runPath }}
          type: DirectoryOrCreate
+      {{- if or (and (kindIs "invalid" .Values.socketLB.terminatePodConnections) .Values.socketLB.enabled)
+                (and .Values.socketLB.enabled .Values.socketLB.terminatePodConnections)  }}
        # To exec into pod network namespaces
      - name: cilium-netns
        hostPath:
          path: /var/run/netns
          type: DirectoryOrCreate
+      {{- end }}
      {{- if .Values.bpf.autoMount.enabled }}
        # To keep state between restarts / upgrades for bpf maps
      - name: bpf-maps
--- a/packages/system/cilium/charts/cilium/templates/cilium-configmap.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-configmap.yaml
@@ -513,10 +513,10 @@ data:
  subnet-ids-filter: {{ .Values.eni.subnetIDsFilter | join " " | quote }}
 {{- end }}
 {{- if .Values.eni.subnetTagsFilter }}
-  subnet-tags-filter: {{ .Values.eni.subnetTagsFilter |  join "," | quote }}
+  subnet-tags-filter: {{ .Values.eni.subnetTagsFilter |  join " " | quote }}
 {{- end }}
 {{- if .Values.eni.instanceTagsFilter }}
-  instance-tags-filter: {{ .Values.eni.instanceTagsFilter | join "," | quote }}
+  instance-tags-filter: {{ .Values.eni.instanceTagsFilter | join " " | quote }}
 {{- end }}
 {{- end }}
 {{ if .Values.eni.gcInterval }}
@@ -718,6 +718,8 @@ data:
 {{- end }}
 {{- if hasKey $socketLB "terminatePodConnections" }}
  bpf-lb-sock-terminate-pod-connections: {{ $socketLB.terminatePodConnections | quote }}
+{{- else if hasKey $socketLB "enabled" }}
+  bpf-lb-sock-terminate-pod-connections: {{ $socketLB.enabled | quote }}
 {{- end }}
 {{- if hasKey $socketLB "tracing" }}
  trace-sock: {{ $socketLB.tracing | quote }}
@@ -1284,9 +1286,7 @@ data:
 {{- if .Values.envoy.log.path }}
  envoy-log: {{ .Values.envoy.log.path | quote }}
 {{- end }}
-{{- if .Values.envoy.log.accessLogBufferSize }}
-  envoy-access-log-buffer-size: {{ .Values.envoy.log.accessLogBufferSize | quote }}
-{{- end }}
+
  envoy-keep-cap-netbindservice: {{ .Values.envoy.securityContext.capabilities.keepCapNetBindService | quote }}

 {{- if hasKey .Values.clustermesh "maxConnectedClusters" }}
--- a/packages/system/cilium/charts/cilium/templates/cilium-envoy/configmap.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-envoy/configmap.yaml
@@ -12,7 +12,6 @@ metadata:
    {{- toYaml . | nindent 4 }}
  {{- end }}
 data:
-  # Keep the key name as bootstrap-config.json to avoid breaking changes
-  bootstrap-config.json: |
-    {{- (tpl (.Files.Get "files/cilium-envoy/configmap/bootstrap-config.yaml") .) | fromYaml | toJson | nindent 4 }}
+{{- (tpl (.Files.Glob "files/cilium-envoy/configmap/bootstrap-config.json").AsConfig .) | nindent 2 }}
+
 {{- end }}
--- a/packages/system/cilium/charts/cilium/templates/hubble-ui/_nginx.tpl
+++ b/packages/system/cilium/charts/cilium/templates/hubble-ui/_nginx.tpl
@@ -13,12 +13,24 @@ server {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;

+        # CORS
+        add_header Access-Control-Allow-Methods "GET, POST, PUT, HEAD, DELETE, OPTIONS";
+        add_header Access-Control-Allow-Origin *;
+        add_header Access-Control-Max-Age 1728000;
+        add_header Access-Control-Expose-Headers content-length,grpc-status,grpc-message;
+        add_header Access-Control-Allow-Headers range,keep-alive,user-agent,cache-control,content-type,content-transfer-encoding,x-accept-content-transfer-encoding,x-accept-response-streaming,x-user-agent,x-grpc-web,grpc-timeout;
+        if ($request_method = OPTIONS) {
+            return 204;
+        }
+        # /CORS
+
        location {{ .Values.hubble.ui.baseUrl }}api {
            {{- if not (eq .Values.hubble.ui.baseUrl "/") }}
            rewrite ^{{ (trimSuffix "/" .Values.hubble.ui.baseUrl) }}(/.*)$ $1 break;
            {{- end }}
            proxy_http_version 1.1;
            proxy_pass_request_headers on;
+            proxy_hide_header Access-Control-Allow-Origin;
            {{- if eq .Values.hubble.ui.baseUrl "/" }}
            proxy_pass http://127.0.0.1:8090;
            {{- else }}
--- a/packages/system/cilium/charts/cilium/templates/validate.yaml
+++ b/packages/system/cilium/charts/cilium/templates/validate.yaml
@@ -151,7 +151,6 @@
  {{ fail "The cluster name is invalid: cannot use default value with cluster.id != 0" }}
 {{- end }}
 {{ if and
-    (ne (index .Values.extraConfig "allow-unsafe-policy-skb-usage") "true")
    (or (and (ge (int .Values.cluster.id) 128) (le (int .Values.cluster.id) 255)) (and (ge (int .Values.cluster.id) 384) (le (int .Values.cluster.id) 511)))
    (or .Values.eni.enabled .Values.alibabacloud.enabled (eq .Values.cni.chainingMode "aws-cni")) -}}
  {{ fail "Cilium is currently affected by a bug that causes traffic matched by network policies to be incorrectly dropped when running in either ENI mode (both AWS and AlibabaCloud) or AWS VPC CNI chaining mode, if the cluster ID is 128-255 (and 384-511 when maxConnectedClusters=511). Please refer to https://github.com/cilium/cilium/issues/21330 for additional details." }}
--- a/packages/system/cilium/charts/cilium/values.schema.json
+++ b/packages/system/cilium/charts/cilium/values.schema.json
@@ -1969,12 +1969,6 @@
        },
        "log": {
          "properties": {
-            "accessLogBufferSize": {
-              "type": [
-                "null",
-                "integer"
-              ]
-            },
            "format": {
              "type": "string"
            },
--- a/packages/system/cilium/charts/cilium/values.yaml
+++ b/packages/system/cilium/charts/cilium/values.yaml
@@ -153,10 +153,10 @@ image:
  # @schema
  override: ~
  repository: "quay.io/cilium/cilium"
-  tag: "v1.16.7"
+  tag: "v1.16.5"
  pullPolicy: "IfNotPresent"
  # cilium-digest
-  digest: "sha256:294d2432507fed393b26e9fbfacb25c2e37095578cb34dabac7312b66ed0782e"
+  digest: "sha256:758ca0793f5995bb938a2fa219dcce63dc0b3fa7fc4ce5cc851125281fb7361d"
  useDigest: true
 # -- Affinity for cilium-agent.
 affinity:
@@ -1314,9 +1314,9 @@ hubble:
      # @schema
      override: ~
      repository: "quay.io/cilium/hubble-relay"
-      tag: "v1.16.7"
+      tag: "v1.16.5"
      # hubble-relay-digest
-      digest: "sha256:8f408ed921cd534394aa1c57b313741cec6aec03a14ea243b2173cbf2c88c91e"
+      digest: "sha256:6cfae1d1afa566ba941f03d4d7e141feddd05260e5cd0a1509aba1890a45ef00"
      useDigest: true
      pullPolicy: "IfNotPresent"
    # -- Specifies the resources for the hubble-relay pods
@@ -2143,13 +2143,6 @@ envoy:
    format: "[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v"
    # -- Path to a separate Envoy log file, if any. Defaults to /dev/stdout.
    path: ""
-    # @schema
-    # type: [null, integer]
-    # @schema
-    # -- Size of the Envoy access log buffer created within the agent in bytes.
-    # Tune this value up if you encounter "Envoy: Discarded truncated access log message" errors.
-    # Large request/response header sizes (e.g. 16KiB) will require a larger buffer size.
-    accessLogBufferSize: 4096
  # -- Time in seconds after which a TCP connection attempt times out
  connectTimeoutSeconds: 2
  # -- Time in seconds after which the initial fetch on an xDS stream is considered timed out
@@ -2172,9 +2165,9 @@ envoy:
    # @schema
    override: ~
    repository: "quay.io/cilium/cilium-envoy"
-    tag: "v1.31.5-1739264036-958bef243c6c66fcfd73ca319f2eb49fff1eb2ae"
+    tag: "v1.30.8-1733837904-eaae5aca0fb988583e5617170a65ac5aa51c0aa8"
    pullPolicy: "IfNotPresent"
-    digest: "sha256:fc708bd36973d306412b2e50c924cd8333de67e0167802c9b48506f9d772f521"
+    digest: "sha256:709c08ade3d17d52da4ca2af33f431360ec26268d288d9a6cd1d98acc9a1dced"
    useDigest: true
  # -- Additional containers added to the cilium Envoy DaemonSet.
  extraContainers: []
@@ -2487,15 +2480,15 @@ operator:
    # @schema
    override: ~
    repository: "quay.io/cilium/operator"
-    tag: "v1.16.7"
+    tag: "v1.16.5"
    # operator-generic-digest
-    genericDigest: "sha256:25a41ac50bcebfb780ed2970e55a5ba1a5f26996850ed5a694dc69b312e0b5a0"
+    genericDigest: "sha256:f7884848483bbcd7b1e0ccfd34ba4546f258b460cb4b7e2f06a1bcc96ef88039"
    # operator-azure-digest
-    azureDigest: "sha256:4e7e64cc505676d402c68043934e2c8efc75b294245514d7611a58d06b5e0f69"
+    azureDigest: "sha256:265e2b78f572c76b523f91757083ea5f0b9b73b82f2d9714e5a8fb848e4048f9"
    # operator-aws-digest
-    awsDigest: "sha256:110d922337bdbfc3cd4d7d71b85b2c8f72c1d9925e9b61b4cd73ff990799d7ba"
+    awsDigest: "sha256:97e1fe0c2b522583033138eb10c170919d8de49d2788ceefdcff229a92210476"
    # operator-alibabacloud-digest
-    alibabacloudDigest: "sha256:dbdc856303e1ab6734538e29791fdfc4fe2c1295fd7bbce8fa006cd3165f85c8"
+    alibabacloudDigest: "sha256:c0edf4c8d089e76d6565d3c57128b98bc6c73d14bb4590126ee746aeaedba5e0"
    useDigest: true
    pullPolicy: "IfNotPresent"
    suffix: ""
@@ -2769,9 +2762,9 @@ preflight:
    # @schema
    override: ~
    repository: "quay.io/cilium/cilium"
-    tag: "v1.16.7"
+    tag: "v1.16.5"
    # cilium-digest
-    digest: "sha256:294d2432507fed393b26e9fbfacb25c2e37095578cb34dabac7312b66ed0782e"
+    digest: "sha256:758ca0793f5995bb938a2fa219dcce63dc0b3fa7fc4ce5cc851125281fb7361d"
    useDigest: true
    pullPolicy: "IfNotPresent"
  # -- The priority class to use for the preflight pod.
@@ -2918,9 +2911,9 @@ clustermesh:
      # @schema
      override: ~
      repository: "quay.io/cilium/clustermesh-apiserver"
-      tag: "v1.16.7"
+      tag: "v1.16.5"
      # clustermesh-apiserver-digest
-      digest: "sha256:8e7eda5b194d45c3b1607f5bf31cbb3fecd0f1cf85ce32b41f93b2bd832bf02f"
+      digest: "sha256:37a7fdbef806b78ef63df9f1a9828fdddbf548d1f0e43b8eb10a6bdc8fa03958"
      useDigest: true
      pullPolicy: "IfNotPresent"
    # -- TCP port for the clustermesh-apiserver health API.
@@ -3419,7 +3412,7 @@ authentication:
          override: ~
          repository: "docker.io/library/busybox"
          tag: "1.36.1"
-          digest: "sha256:71b79694b71639e633452f57fd9de40595d524de308349218d9a6a144b40be02"
+          digest: "sha256:d75b758a4fea99ffff4db799e16f853bbde8643671b5b72464a8ba94cbe3dbe3"
          useDigest: true
          pullPolicy: "IfNotPresent"
        # SPIRE agent configuration
--- a/packages/system/cilium/charts/cilium/values.yaml.tmpl
+++ b/packages/system/cilium/charts/cilium/values.yaml.tmpl
@@ -2157,13 +2157,6 @@ envoy:
    format: "[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v"
    # -- Path to a separate Envoy log file, if any. Defaults to /dev/stdout.
    path: ""
-    # @schema
-    # type: [null, integer]
-    # @schema
-    # -- Size of the Envoy access log buffer created within the agent in bytes.
-    # Tune this value up if you encounter "Envoy: Discarded truncated access log message" errors.
-    # Large request/response header sizes (e.g. 16KiB) will require a larger buffer size.
-    accessLogBufferSize: 4096
  # -- Time in seconds after which a TCP connection attempt times out
  connectTimeoutSeconds: 2
  # -- Time in seconds after which the initial fetch on an xDS stream is considered timed out
--- a/packages/system/cilium/images/cilium/Dockerfile
+++ b/packages/system/cilium/images/cilium/Dockerfile
@@ -1,2 +1,2 @@
-ARG VERSION=v1.16.7
+ARG VERSION=v1.16.5
 FROM quay.io/cilium/cilium:${VERSION}
--- a/packages/system/cilium/values.yaml
+++ b/packages/system/cilium/values.yaml
@@ -12,7 +12,7 @@ cilium:
    mode: "kubernetes"
  image:
    repository: ghcr.io/aenix-io/cozystack/cilium
-    tag: 1.16.7
-    digest: "sha256:d2d6f5675aa30c18c4d9c08c27448173416cfb4a84080d5b9765fa1bdc9b4c70"
+    tag: 1.16.5
+    digest: "sha256:eae9d5531c115f8946990a731bfaaebc905b020a2957559b3c9f2ce1c655a834"
  envoy:
    enabled: false
--- a/packages/system/cozy-proxy/Chart.yaml
+++ b/packages/system/cozy-proxy/Chart.yaml
@@ -1,3 +0,0 @@
-apiVersion: v2
-name: cozy-cozy-proxy
-version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
--- a/packages/system/cozy-proxy/Makefile
+++ b/packages/system/cozy-proxy/Makefile
@@ -1,11 +0,0 @@
-NAME=cozy-proxy
-NAMESPACE=cozy-system
-
-include ../../../scripts/common-envs.mk
-include ../../../scripts/package.mk
-
-update:
-	rm -rf charts
-	tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/aenix-io/cozy-proxy | awk -F'[/^]' 'END{print $$3}') && \
-	curl -sSL https://github.com/aenix-io/cozy-proxy/archive/refs/tags/$${tag}.tar.gz | \
-	tar xzvf - --strip 1 cozy-proxy-$${tag#*v}/charts
--- a/packages/system/cozy-proxy/charts/cozy-proxy/Chart.yaml
+++ b/packages/system/cozy-proxy/charts/cozy-proxy/Chart.yaml
@@ -1,6 +0,0 @@
-apiVersion: v2
-name: cozy-proxy
-description: A simple kube-proxy addon for 1:1 NAT services in Kubernetes using an NFT backend
-type: application
-version: 0.1.2
-appVersion: 0.1.2
--- a/packages/system/cozy-proxy/charts/cozy-proxy/templates/_helpers.tpl
+++ b/packages/system/cozy-proxy/charts/cozy-proxy/templates/_helpers.tpl
@@ -1,24 +0,0 @@
-{{- define "cozy-proxy.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{- define "cozy-proxy.fullname" -}}
-{{- $name := default .Chart.Name .Values.nameOverride -}}
-{{- if .Values.fullnameOverride -}}
-  {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-  {{- if eq .Release.Name $name }}
-    {{- .Release.Name | trunc 63 | trimSuffix "-" -}}
-  {{- else -}}
-    {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
-  {{- end -}}
-{{- end -}}
-{{- end -}}
-
-{{- define "cozy-proxy.labels" -}}
-helm.sh/chart: {{ include "cozy-proxy.name" . }}-{{ .Chart.Version | replace "+" "_" }}
-app.kubernetes.io/name: {{ include "cozy-proxy.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/version: {{ .Chart.AppVersion }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end -}}
--- a/packages/system/cozy-proxy/charts/cozy-proxy/templates/daemonset.yaml
+++ b/packages/system/cozy-proxy/charts/cozy-proxy/templates/daemonset.yaml
@@ -1,27 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: {{ include "cozy-proxy.fullname" . }}
-  labels:
-    {{- include "cozy-proxy.labels" . | nindent 4 }}
-spec:
-  selector:
-    matchLabels:
-      app: {{ include "cozy-proxy.name" . }}
-  template:
-    metadata:
-      labels:
-        app: {{ include "cozy-proxy.name" . }}
-      annotations:
-        {{- toYaml .Values.daemonset.podAnnotations | nindent 8 }}
-    spec:
-      serviceAccountName: {{ include "cozy-proxy.fullname" . }}
-      hostNetwork: {{ .Values.daemonset.hostNetwork }}
-      containers:
-        - name: cozy-proxy
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          securityContext:
-            privileged: true
-            capabilities:
-              add: ["NET_ADMIN"]
--- a/packages/system/cozy-proxy/charts/cozy-proxy/templates/role.yaml
+++ b/packages/system/cozy-proxy/charts/cozy-proxy/templates/role.yaml
@@ -1,12 +0,0 @@
-{{- if .Values.rbac.create }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "cozy-proxy.fullname" . }}
-  labels:
-    {{- include "cozy-proxy.labels" . | nindent 4 }}
-rules:
-  - apiGroups: [""]
-    resources: ["services", "endpoints"]
-    verbs: ["get", "list", "watch"]
-{{- end }}
--- a/Show More
+++ b/Show More