Add alerts from kubermatic

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

.github/workflows/pre-commit.yml

@@ -1,35 +0,0 @@
-name: Pre-Commit Checks
-
-on: [push, pull_request]
-
-jobs:
-  pre-commit:
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Set up Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.11'
-
-      - name: Install pre-commit
-        run: pip install pre-commit
-
-      - name: Run pre-commit hooks
-        run: |
-          git fetch origin main || git fetch origin master
-          base_commit=$(git rev-parse --verify origin/main || git rev-parse --verify origin/master || echo "")
-
-          if [ -z "$base_commit" ]; then
-            files=$(git ls-files '*.yaml' '*.md')
-          else
-            files=$(git diff --name-only "$base_commit" -- '*.yaml' '*.md')
-          fi
-
-          if [ -n "$files" ]; then
-            echo "$files" | xargs pre-commit run --files
-          else
-            echo "No YAML or Markdown files to lint"
-          fi

.pre-commit-config.yaml

@@ -1,25 +0,0 @@
-repos:
-- repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v4.5.0
-  hooks:
-    - id: end-of-file-fixer
-    - id: trailing-whitespace
-    - id: mixed-line-ending
-      args: [--fix=lf]
-    - id: check-yaml
-      exclude: .*/init-script\.yaml$
-      args: [--unsafe]
-- repo: https://github.com/igorshubovych/markdownlint-cli
-  rev: v0.41.0
-  hooks:
-    - id: markdownlint
-      args: [--fix, --disable, MD013, MD041, --]
--   repo: local
-    hooks:
-    - id: gen-versions-map
-      name: Generate versions map and check for changes
-      entry: bash -c 'cd packages/apps && make check-version-map'
-      language: system
-      types: [file]
-      pass_filenames: false
-      description: Run the script and fail if it generates changes

Makefile

@@ -10,7 +10,6 @@ build:
 	make -C packages/system/kubeovn image
 	make -C packages/system/dashboard image
 	make -C packages/system/kamaji image
-	make -C packages/system/bucket image
 	make -C packages/core/testing image
 	make -C packages/core/installer image
 	make manifests

hack/Makefile

@@ -1,16 +0,0 @@
-.PHONY: test clean help
-
-SCRIPT=./e2e.applications.sh
-PRECHECKS=./pre-checks.sh
-
-help:
-	@echo "Usage: make {test|clean}"
-	@echo "  test  - Run the end-to-end tests."
-	@echo "  clean - Clean up resources."
-
-test:
-	@bash $(PRECHECKS) test
-	@bash $(SCRIPT) test
-
-clean:
-	@bash $(SCRIPT) clean

hack/e2e.applications.sh

@@ -1,47 +0,0 @@
-for file in ./modules/*.sh; do
-    source "$file"
-done
-
-ROOT_NS="tenant-root"
-TEST_TENANT="tenant-e2e"
-
-function test() {
-    install_tenant $TEST_TENANT $ROOT_NS
-    check_helmrelease_status $TEST_TENANT $ROOT_NS
-
-    install_all_apps "../packages/apps" "$TEST_TENANT" cozystack-apps cozy-public
-
-    if true; then
-        echo -e "${GREEN}All tests passed!${RESET}"
-        return 0
-    else
-        echo -e "${RED}Some tests failed!${RESET}"
-        return 1
-    fi
-}
-
-function clean() {
-    kubectl delete helmrelease.helm.toolkit.fluxcd.io $TEST_TENANT -n $ROOT_NS
-    if true; then
-        echo -e "${GREEN}Cleanup successful!${RESET}"
-        return 0
-    else
-        echo -e "${RED}Cleanup failed!${RESET}"
-        return 1
-    fi
-}
-
-case "$1" in
-    test)
-        echo -e "${YELLOW}Running tests...${RESET}"
-        test
-        ;;
-    clean)
-        echo -e "${YELLOW}Cleaning up...${RESET}"
-        clean
-        ;;
-    *)
-        echo -e "${RED}Usage: $0 {test|clean}${RESET}"
-        exit 1
-        ;;
-esac

hack/e2e.sh

@@ -36,7 +36,7 @@ mkdir -p srv1 srv2 srv3
 
 # Prepare cloud-init
 for i in 1 2 3; do
-  echo "hostname: srv$i" > "srv$i/meta-data"
+  echo "local-hostname: srv$i" > "srv$i/meta-data"
   echo '#cloud-config' > "srv$i/user-data"
   cat > "srv$i/network-config" <<EOT
 version: 2
@@ -114,7 +114,7 @@ machine:
     - name: zfs
     - name: spl
   install:
-    image: ghcr.io/aenix-io/cozystack/talos:v1.8.0
+    image: ghcr.io/aenix-io/cozystack/talos:v1.7.1
   files:
   - content: |
       [plugins]
@@ -182,7 +182,7 @@ timeout 60 sh -c 'until nc -nzv 192.168.123.11 50000 && nc -nzv 192.168.123.12 5
 talosctl bootstrap -n 192.168.123.11 -e 192.168.123.11
 
 # Wait for etcd
-timeout 180 sh -c 'while talosctl etcd members -n 192.168.123.11,192.168.123.12,192.168.123.13 -e 192.168.123.10 2>&1 | grep "rpc error"; do sleep 1; done'
+timeout 120 sh -c 'while talosctl etcd members -n 192.168.123.11,192.168.123.12,192.168.123.13 -e 192.168.123.10 2>&1 | grep "rpc error"; do sleep 1; done'
 
 rm -f kubeconfig
 talosctl kubeconfig kubeconfig -e 192.168.123.10 -n 192.168.123.10
@@ -217,10 +217,6 @@ timeout 60 sh -c 'until kubectl get hr -A | grep cozy; do sleep 1; done'
 sleep 5
 
 kubectl get hr -A | awk 'NR>1 {print "kubectl wait --timeout=15m --for=condition=ready -n " $1 " hr/" $2 " &"} END{print "wait"}' | sh -x
-
-# Wait for Cluster-API providers
-kubectl wait deploy --timeout=30s --for=condition=available -n cozy-cluster-api capi-controller-manager capi-kamaji-controller-manager capi-kubeadm-bootstrap-controller-manager capi-operator-cluster-api-operator capk-controller-manager
-
 # Wait for linstor controller
 kubectl wait deploy --timeout=5m --for=condition=available -n cozy-linstor linstor-controller
 

hack/modules/check_helmrelease_status.sh

@@ -1,32 +0,0 @@
-#!/bin/bash
-
-source ./modules/colors.sh
-
-function check_helmrelease_status() {
-    local release_name="$1"
-    local namespace="$2"
-    local timeout=300  # Timeout in seconds
-    local interval=5   # Interval between checks in seconds
-    local elapsed=0
-
-    while [[ $elapsed -lt $timeout ]]; do
-        local status_output
-        status_output=$(kubectl get helmrelease "$release_name" -n "$namespace" -o json | jq -r '.status.conditions[-1].reason')
-
-        if [[ "$status_output" == "InstallSucceeded" ]]; then
-            echo -e "${GREEN}Helm release '$release_name' is ready.${RESET}"
-            return 0
-        elif [[ "$status_output" == "InstallFailed" ]]; then
-          echo -e "${RED}Helm release '$release_name': InstallFailed${RESET}"
-          exit 1
-        else
-            echo -e "${YELLOW}Helm release '$release_name' is not ready. Current status: $status_output${RESET}"
-        fi
-
-        sleep "$interval"
-        elapsed=$((elapsed + interval))
-    done
-
-    echo -e "${RED}Timeout reached. Helm release '$release_name' is still not ready after $timeout seconds.${RESET}"
-    exit 1
-}

hack/modules/colors.sh

@@ -1,6 +0,0 @@
-#!/bin/bash
-
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-RESET='\033[0m'
-YELLOW='\033[0;33m'

hack/modules/ignored_charts

@@ -1,6 +0,0 @@
-tenant
-http-cache
-mysql
-rabbitmq
-virtual-machine
-vpn

hack/modules/install_all_apps.sh

@@ -1,66 +0,0 @@
-#!/bin/bash
-
-source ./modules/colors.sh
-
-# Function to load ignored charts from a file
-function load_ignored_charts() {
-    local ignore_file="$1"
-    local ignored_charts=()
-
-    if [[ -f "$ignore_file" ]]; then
-        while IFS= read -r chart; do
-            ignored_charts+=("$chart")
-        done < "$ignore_file"
-    else
-        echo "Ignore file not found: $ignore_file"
-    fi
-
-    # Return the array of ignored charts
-    echo "${ignored_charts[@]}"
-}
-
-# Function to check if a chart is in the ignored list
-function is_chart_ignored() {
-    local chart_name="$1"
-    shift
-    local ignored_charts=("$@")
-
-    for ignored_chart in "${ignored_charts[@]}"; do
-        if [[ "$ignored_chart" == "$chart_name" ]]; then
-            return 0
-        fi
-    done
-    return 1
-}
-
-function install_all_apps() {
-    local charts_dir="$1"
-    local namespace="$2"
-    local repo_name="$3"
-    local repo_ns="$4"
-
-    local ignore_file="./modules/ignored_charts"
-    local ignored_charts
-    ignored_charts=($(load_ignored_charts "$ignore_file"))
-
-    for chart_path in "$charts_dir"/*; do
-        if [[ -d "$chart_path" ]]; then
-            local chart_name
-            chart_name=$(basename "$chart_path")
-            # Check if the chart is in the ignored list
-            if is_chart_ignored "$chart_name" "${ignored_charts[@]}"; then
-                echo "Skipping chart: $chart_name (listed in ignored charts)"
-                continue
-            fi
-
-            release_name="$chart_name-e2e"
-            echo "Installing release: $release_name"
-            install_helmrelease "$release_name" "$namespace" "$chart_name" "$repo_name" "$repo_ns"
-
-            echo "Checking status for HelmRelease: $release_name"
-            check_helmrelease_status "$release_name" "$namespace"
-        else
-            echo "$chart_path is not a directory. Skipping."
-        fi
-    done
-}

hack/modules/install_chart.sh

@@ -1,60 +0,0 @@
-#!/bin/bash
-
-source ./modules/colors.sh
-
-function install_helmrelease() {
-    local release_name="$1"
-    local namespace="$2"
-    local chart_path="$3"
-    local repo_name="$4"
-    local repo_ns="$5"
-    local values_file="$6"
-
-    if [[ -z "$release_name" ]]; then
-        echo -e "${RED}Error: Release name is required.${RESET}"
-        exit 1
-    fi
-
-    if [[ -z "$namespace" ]]; then
-        echo -e "${RED}Error: Namespace name is required.${RESET}"
-        exit 1
-    fi
-
-    if [[ -z "$chart_path" ]]; then
-        echo -e "${RED}Error: Chart path name is required.${RESET}"
-        exit 1
-    fi
-
-    local helmrelease_file=$(mktemp /tmp/HelmRelease.XXXXXX.yaml)
-
-    {
-        echo "apiVersion: helm.toolkit.fluxcd.io/v2"
-        echo "kind: HelmRelease"
-        echo "metadata:"
-        echo "  labels:"
-        echo "    cozystack.io/ui: \"true\""
-        echo "  name: \"$release_name\""
-        echo "  namespace: \"$namespace\""
-        echo "spec:"
-        echo "  chart:"
-        echo "    spec:"
-        echo "      chart: \"$chart_path\""
-        echo "      reconcileStrategy: Revision"
-        echo "      sourceRef:"
-        echo "        kind: HelmRepository"
-        echo "        name: \"$repo_name\""
-        echo "        namespace: \"$repo_ns\""
-        echo "      version: '*'"
-        echo "  interval: 1m0s"
-        echo "  timeout: 5m0s"
-
-        if [[ -n "$values_file" && -f "$values_file" ]]; then
-            echo "  values:"
-            cat "$values_file" | sed 's/^/    /'
-        fi
-    } > "$helmrelease_file"
-
-    kubectl apply -f "$helmrelease_file"
-
-    rm -f "$helmrelease_file"
-}

hack/modules/install_tenant.sh

@@ -1,11 +0,0 @@
-#!/bin/bash
-
-function install_tenant (){
-    local release_name="$1"
-    local namespace="$2"
-    local values_file="${3:-tenant.yaml}"
-    local repo_name="cozystack-apps"
-    local repo_ns="cozy-public"
-
-    install_helmrelease "$release_name" "$namespace" "tenant" "$repo_name" "$repo_ns" "$values_file"
-}

hack/pre-checks.sh

@@ -1,23 +0,0 @@
-#!/bin/bash
-
-YQ_VERSION="v4.35.1"
-RED='\033[31m'
-RESET='\033[0m'
-
-check-yq-version() {
-    current_version=$(yq -V | awk '$(NF-1) == "version" {print $NF}')
-    if [ -z "$current_version" ]; then
-        echo "yq is not installed or version cannot be determined."
-        exit 1
-    fi
-    echo "Current yq version: $current_version"
-
-    if [ "$(printf '%s\n' "$YQ_VERSION" "$current_version" | sort -V | head -n1)" = "$YQ_VERSION" ]; then
-        echo "Greater than or equal to $YQ_VERSION"
-    else
-        echo -e "${RED}ERROR: yq version less than $YQ_VERSION${RESET}"
-        exit 1
-    fi
-}
-
-check-yq-version

hack/values/tenant.yaml

@@ -1,6 +0,0 @@
-host: ""
-etcd: false
-monitoring: true
-ingress: false
-seaweedfs: true
-isolated: true

manifests/cozystack-installer.yaml

@@ -68,7 +68,7 @@ spec:
       serviceAccountName: cozystack
       containers:
       - name: cozystack
-        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.16.5"
+        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.15.0"
         env:
         - name: KUBERNETES_SERVICE_HOST
           value: localhost
@@ -87,7 +87,7 @@ spec:
             fieldRef:
               fieldPath: metadata.name
       - name: darkhttpd
-        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.16.5"
+        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.15.0"
         command:
         - /usr/bin/darkhttpd
         - /cozystack/assets

packages/apps/README.md

@@ -1,9 +0,0 @@
-### How to test packages local
-
-```bash
-cd packages/core/installer
-make image-cozystack REGISTRY=YOUR_CUSTOM_REGISTRY
-make apply
-kubectl delete pod dashboard-redis-master-0 -n cozy-dashboard
-kubectl delete po -l app=source-controller -n cozy-fluxcd
-```

packages/apps/bucket/templates/dashboard-resourcemap.yaml

@@ -9,12 +9,4 @@ rules:
   - secrets
   resourceNames:
   - {{ .Release.Name }}
-  - {{ .Release.Name }}-credentials
-  verbs: ["get", "list", "watch"]
-- apiGroups:
-  - networking.k8s.io
-  resources:
-  - ingresses
-  resourceNames:
-  - {{ .Release.Name }}-ui
   verbs: ["get", "list", "watch"]

packages/apps/bucket/templates/helmrelease.yaml

@@ -1,18 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: {{ .Release.Name }}-system
-spec:
-  chart:
-    spec:
-      chart: cozy-bucket
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '*'
-  interval: 1m0s
-  timeout: 5m0s
-  values:
-    bucketName: {{ .Release.Name }}

packages/apps/ferretdb/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.4.1
+version: 0.4.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

packages/apps/ferretdb/images/postgres-backup.tag

@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/postgres-backup:0.7.0@sha256:d2015c6dba92293bda652d055e97d1be80e8414c2dc78037c12812d1a2e2cba1
+ghcr.io/aenix-io/cozystack/postgres-backup:0.6.2@sha256:d2015c6dba92293bda652d055e97d1be80e8414c2dc78037c12812d1a2e2cba1

packages/apps/ferretdb/templates/init-script.yaml

@@ -34,9 +34,6 @@ stringData:
   init.sh: |
     #!/bin/bash
     set -e
-
-    until pg_isready ; do sleep 5; done
-
     echo "== create users"
     {{- if .Values.users }}
     psql -v ON_ERROR_STOP=1 <<\EOT
@@ -63,7 +60,7 @@ stringData:
     DROP USER $user;
     EOT
     done
-
+    
     echo "== create roles"
     psql -v ON_ERROR_STOP=1 --echo-all <<\EOT
     SELECT 'CREATE ROLE app_admin NOINHERIT;'
@@ -83,7 +80,7 @@ stringData:
         FOR schema_record IN SELECT schema_name FROM information_schema.schemata WHERE schema_name NOT IN ('pg_catalog', 'information_schema') LOOP
             -- Changing Schema Ownership
             EXECUTE format('ALTER SCHEMA %I OWNER TO %I', schema_record.schema_name, 'app_admin');
-
+    
             -- Add rights for the admin role
             EXECUTE format('GRANT ALL ON SCHEMA %I TO %I', schema_record.schema_name, 'app_admin');
             EXECUTE format('GRANT ALL ON ALL TABLES IN SCHEMA %I TO %I', schema_record.schema_name, 'app_admin');

packages/apps/http-cache/images/nginx-cache.tag

@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/nginx-cache:0.3.1@sha256:cd744b2d1d50191f4908f2db83079b32973d1c009fe9468627be72efbfa0a107
+ghcr.io/aenix-io/cozystack/nginx-cache:0.3.1@sha256:556bc8d29ee9e90b3d64d0481dcfc66483d055803315bba3d9ece17c0d97f32b

packages/apps/kafka/templates/kafka.yaml

@@ -76,5 +76,3 @@ spec:
         metadata:
          labels:
            policy.cozystack.io/allow-to-apiserver: "true"
-      spec:
-        enableServiceLinks: false

packages/apps/kubernetes/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.12.1
+version: 0.11.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

packages/apps/kubernetes/images/cluster-autoscaler.tag

@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/cluster-autoscaler:0.12.1@sha256:7f617de5a24de790a15d9e97c6287ff2b390922e6e74c7a665cbf498f634514d
+ghcr.io/aenix-io/cozystack/cluster-autoscaler:latest@sha256:7f617de5a24de790a15d9e97c6287ff2b390922e6e74c7a665cbf498f634514d

packages/apps/kubernetes/images/kubevirt-cloud-provider.tag

@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/kubevirt-cloud-provider:0.12.1@sha256:ca606d6039ed43a48d4dfd98a91fd3cec120f08c1e221cd4e99ea94239389742
+ghcr.io/aenix-io/cozystack/kubevirt-cloud-provider:latest@sha256:735aa8092501fc0f2904b685b15bc0137ea294cb08301ca1185d3dec5f467f0f

packages/apps/kubernetes/images/kubevirt-csi-driver.tag

@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/kubevirt-csi-driver:0.12.1@sha256:86029548078960feecca116087b2135230d676b83c503f292eb50e1199be2790
+ghcr.io/aenix-io/cozystack/kubevirt-csi-driver:latest@sha256:e56b46591cdf9140e97c3220a0c2681aadd4a4b3f7ea8473fb2504dc96e8b53a

packages/apps/kubernetes/images/ubuntu-container-disk.tag

@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/ubuntu-container-disk:v1.30.1@sha256:1f249fbe52821a62f706c6038b13401234e1b758ac498e53395b8f9a642b015f
+ghcr.io/aenix-io/cozystack/ubuntu-container-disk:v1.30.1@sha256:5ce80a453073c4f44347409133fc7b15f1d2f37a564d189871a4082fc552ff0f

packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml

@@ -16,7 +16,6 @@ spec:
         app: {{ .Release.Name }}-cluster-autoscaler
         policy.cozystack.io/allow-to-apiserver: "true"
     spec:
-      enableServiceLinks: false
       tolerations:
         - key: CriticalAddonsOnly
           operator: Exists

packages/apps/kubernetes/templates/cluster.yaml

@@ -210,26 +210,6 @@ spec:
         name: {{ $.Release.Name }}-{{ $groupName }}-{{ $kubevirtmachinetemplateHash }}
         namespace: default
       version: v1.30.1
----
-apiVersion: cluster.x-k8s.io/v1beta1
-kind: MachineHealthCheck
-metadata:
-  name: {{ $.Release.Name }}-{{ $groupName }}
-  namespace: {{ $.Release.Namespace }}
-spec:
-  clusterName: {{ $.Release.Name }}
-  nodeStartupTimeout: 10m
-  selector:
-    matchLabels:
-      cluster.x-k8s.io/cluster-name: {{ $.Release.Name }}
-      cluster.x-k8s.io/deployment-name: {{ $.Release.Name }}-{{ $groupName }}
-  unhealthyConditions:
-  - type: Ready
-    status: Unknown
-    timeout: 30s
-  - type: Ready
-    status: "False"
-    timeout: 300s
 {{- end }}
 ---
 {{- /*

packages/apps/kubernetes/templates/csi/deploy.yaml

@@ -15,7 +15,6 @@ spec:
         app: {{ .Release.Name }}-kcsi-driver
         policy.cozystack.io/allow-to-apiserver: "true"
     spec:
-      enableServiceLinks: false
       serviceAccountName: {{ .Release.Name }}-kcsi
       priorityClassName: system-cluster-critical
       tolerations:

packages/apps/kubernetes/templates/helmreleases/cilium.yaml

@@ -30,6 +30,7 @@ spec:
       retries: -1
   values:
     cilium:
+      tunnel: disabled
       k8sServiceHost: {{ .Release.Name }}.{{ .Release.Namespace }}.svc
       k8sServicePort: 6443
       routingMode: tunnel

packages/apps/kubernetes/templates/kccm/manager.yaml

@@ -15,7 +15,6 @@ spec:
         k8s-app: {{ .Release.Name }}-kccm
         policy.cozystack.io/allow-to-apiserver: "true"
     spec:
-      enableServiceLinks: false
       tolerations:
         - key: CriticalAddonsOnly
           operator: Exists

packages/apps/mysql/images/mariadb-backup.tag

@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/mariadb-backup:0.5.1@sha256:793edb25a29cbc00781e40af883815ca36937e736e2b0d202ea9c9619fb6ca11
+ghcr.io/aenix-io/cozystack/mariadb-backup:0.5.1@sha256:fa2b3195521cffa55eb6d71a50b875d3c234a45e5dff71b2b9002674175bea93

packages/apps/postgres/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.7.1
+version: 0.7.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

packages/apps/postgres/README.md

@@ -6,34 +6,30 @@ PostgreSQL is currently the leading choice among relational databases, known for
 
 This managed service is controlled by the CloudNativePG operator, ensuring efficient management and seamless operation.
 
-- Docs: <https://cloudnative-pg.io/docs/>
-- Github: <https://github.com/cloudnative-pg/cloudnative-pg>
+- Docs: https://cloudnative-pg.io/docs/
+- Github: https://github.com/cloudnative-pg/cloudnative-pg
 
 ## HowTos
 
 ### How to switch master/slave replica
 
 See:
+- https://cloudnative-pg.io/documentation/1.15/rolling_update/#manual-updates-supervised
 
-- <https://cloudnative-pg.io/documentation/1.15/rolling_update/#manual-updates-supervised>
-
-### How to restore backup
+### How to restore backup:
 
 find snapshot:
-
-```bash
+```
 restic -r s3:s3.example.org/postgres-backups/database_name snapshots
 ```
 
 restore:
-
-```bash
+```
 restic -r s3:s3.example.org/postgres-backups/database_name restore latest --target /tmp/
 ```
 
 more details:
-
-- <https://itnext.io/restic-effective-backup-from-stdin-4bc1e8f083c1>
+- https://itnext.io/restic-effective-backup-from-stdin-4bc1e8f083c1
 
 ## Parameters
 
@@ -68,3 +64,5 @@ more details:
 | `backup.s3AccessKey`     | The access key for S3, used for authentication | `oobaiRus9pah8PhohL1ThaeTa4UVa7gu`                     |
 | `backup.s3SecretKey`     | The secret key for S3, used for authentication | `ju3eum4dekeich9ahM1te8waeGai0oog`                     |
 | `backup.resticPassword`  | The password for Restic backup encryption      | `ChaXoveekoh6eigh4siesheeda2quai0`                     |
+
+

packages/apps/postgres/images/postgres-backup.tag

@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/postgres-backup:0.7.0@sha256:d2015c6dba92293bda652d055e97d1be80e8414c2dc78037c12812d1a2e2cba1
+ghcr.io/aenix-io/cozystack/postgres-backup:0.6.2@sha256:d2015c6dba92293bda652d055e97d1be80e8414c2dc78037c12812d1a2e2cba1

packages/apps/postgres/templates/db.yaml

@@ -10,9 +10,7 @@ spec:
   postgresql:
     parameters:
       max_wal_senders: "30"
-      {{- with .Values.postgresql.parameters.max_connections }}
-      max_connections: "{{ . }}"
-      {{- end }}
+      max_connections: “{{ .Values.postgresql.parameters.max_connections }}”
 
   minSyncReplicas: {{ .Values.quorum.minSyncReplicas }}
   maxSyncReplicas: {{ .Values.quorum.maxSyncReplicas }}

packages/apps/postgres/templates/init-script.yaml

@@ -34,9 +34,6 @@ stringData:
   init.sh: |
     #!/bin/bash
     set -e
-
-    until pg_isready ; do sleep 5; done
-
     echo "== create users"
     {{- if .Values.users }}
     psql -v ON_ERROR_STOP=1 <<\EOT
@@ -63,7 +60,7 @@ stringData:
     DROP USER $user;
     EOT
     done
-
+    
     echo "== create databases and roles"
     {{- if .Values.databases }}
     psql -v ON_ERROR_STOP=1 --echo-all <<\EOT
@@ -95,7 +92,7 @@ stringData:
         FOR schema_record IN SELECT schema_name FROM information_schema.schemata WHERE schema_name NOT IN ('pg_catalog', 'information_schema') LOOP
             -- Changing Schema Ownership
             EXECUTE format('ALTER SCHEMA %I OWNER TO %I', schema_record.schema_name, '{{ $database }}_admin');
-
+    
             -- Add rights for the admin role
             EXECUTE format('GRANT ALL ON SCHEMA %I TO %I', schema_record.schema_name, '{{ $database }}_admin');
             EXECUTE format('GRANT ALL ON ALL TABLES IN SCHEMA %I TO %I', schema_record.schema_name, '{{ $database }}_admin');
@@ -104,7 +101,7 @@ stringData:
             EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON TABLES TO %I', schema_record.schema_name, '{{ $database }}_admin');
             EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON SEQUENCES TO %I', schema_record.schema_name, '{{ $database }}_admin');
             EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON FUNCTIONS TO %I', schema_record.schema_name, '{{ $database }}_admin');
-
+    
             -- Add rights for the readonly role
             EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', schema_record.schema_name, '{{ $database }}_readonly');
             EXECUTE format('GRANT SELECT ON ALL TABLES IN SCHEMA %I TO %I', schema_record.schema_name, '{{ $database }}_readonly');
@@ -122,9 +119,9 @@ stringData:
     CREATE OR REPLACE FUNCTION auto_grant_schema_privileges()
     RETURNS event_trigger LANGUAGE plpgsql AS $$
     DECLARE
-        obj record;
+      obj record;
     BEGIN
-        FOR obj IN SELECT * FROM pg_event_trigger_ddl_commands() WHERE command_tag = 'CREATE SCHEMA' LOOP
+      FOR obj IN SELECT * FROM pg_event_trigger_ddl_commands() WHERE command_tag = 'CREATE SCHEMA' LOOP
         EXECUTE format('ALTER SCHEMA %I OWNER TO %I', obj.object_identity, '{{ $database }}_admin');
         EXECUTE format('GRANT ALL ON SCHEMA %I TO %I', obj.object_identity, '{{ $database }}_admin');
         EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', obj.object_identity, '{{ $database }}_readonly');
@@ -149,7 +146,7 @@ stringData:
         EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT SELECT ON TABLES TO %I', obj.object_identity, '{{ $database }}_readonly');
         EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT USAGE ON SEQUENCES TO %I', obj.object_identity, '{{ $database }}_readonly');
         EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT EXECUTE ON FUNCTIONS TO %I', obj.object_identity, '{{ $database }}_readonly');
-        END LOOP;
+      END LOOP;
     END;
     $$;
 

packages/apps/postgres/values.schema.json

@@ -29,9 +29,9 @@
                     "type": "object",
                     "properties": {
                         "max_connections": {
-                            "type": "number",
+                            "type": "string",
                             "description": "Determines the maximum number of concurrent connections to the database server. The default is typically 100 connections",
-                            "default": 100
+                            "default": "100"
                         }
                     }
                 }
@@ -103,4 +103,4 @@
             }
         }
     }
-}
+}

packages/apps/postgres/values.yaml

@@ -14,7 +14,7 @@ storageClass: ""
 ## @param postgresql.parameters.max_connections Determines the maximum number of concurrent connections to the database server. The default is typically 100 connections
 postgresql:
   parameters:
-    max_connections: 100
+    max_connections: "100"
 
 ## Configuration for the quorum-based synchronous replication
 ## @param quorum.minSyncReplicas Minimum number of synchronous replicas that must acknowledge a transaction before it is considered committed.

packages/apps/rabbitmq/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.4.2
+version: 0.4.1
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

packages/apps/rabbitmq/templates/rabbitmq.yaml

@@ -16,8 +16,6 @@ spec:
     statefulSet:
       spec:
         template:
-          spec:
-            enableServiceLinks: false
           metadata:
             labels:
               policy.cozystack.io/allow-to-apiserver: "true"
@@ -49,7 +47,7 @@ metadata:
     config: '{{ printf "%s %s" $user $password | sha256sum }}'
 spec:
   importCredentialsSecret:
-    name: {{ $.Release.Name }}-{{ kebabcase $user }}-credentials
+    name: {{ $.Release.Name }}-{{ $user }}-credentials
   rabbitmqClusterReference:
     name: {{ $.Release.Name }}
 ---

packages/apps/versions_map

@@ -9,8 +9,7 @@ ferretdb 0.1.0 4ffa8615
 ferretdb 0.1.1 5ca8823
 ferretdb 0.2.0 adaf603
 ferretdb 0.3.0 aa2f553
-ferretdb 0.4.0 def2eb0f
-ferretdb 0.4.1 HEAD
+ferretdb 0.4.0 HEAD
 http-cache 0.1.0 a956713
 http-cache 0.2.0 5ca8823
 http-cache 0.3.0 fab5940
@@ -32,11 +31,7 @@ kubernetes 0.8.0 ac11056e
 kubernetes 0.8.1 e54608d8
 kubernetes 0.8.2 5ca8823
 kubernetes 0.9.0 9b6dd19
-kubernetes 0.10.0 ac5c38b
-kubernetes 0.11.0 4eaca42
-kubernetes 0.11.1 4f430a90
-kubernetes 0.12.0 74649f8
-kubernetes 0.12.1 HEAD
+kubernetes 0.10.0 HEAD
 mysql 0.1.0 f642698
 mysql 0.2.0 8b975ff0
 mysql 0.3.0 5ca8823
@@ -53,15 +48,12 @@ postgres 0.4.0 ec283c33
 postgres 0.4.1 5ca8823
 postgres 0.5.0 c07c4bbd
 postgres 0.6.0 2a4768a
-postgres 0.6.2 54fd61c
-postgres 0.7.0 dc9d8bb
-postgres 0.7.1 HEAD
+postgres 0.6.2 HEAD
 rabbitmq 0.1.0 f642698
 rabbitmq 0.2.0 5ca8823
 rabbitmq 0.3.0 9e33dc0
 rabbitmq 0.4.0 36d8855
-rabbitmq 0.4.1 35536bb
-rabbitmq 0.4.2 HEAD
+rabbitmq 0.4.1 HEAD
 redis 0.1.1 f642698
 redis 0.2.0 5ca8823
 redis 0.3.0 HEAD

packages/core/installer/Makefile

@@ -5,9 +5,6 @@ TALOS_VERSION=$(shell awk '/^version:/ {print $$2}' images/talos/profiles/instal
 
 include ../../../scripts/common-envs.mk
 
-pre-checks:
-	../../../hack/pre-checks.sh
-
 show:
 	helm template -n $(NAMESPACE) $(NAME) .
 
@@ -20,7 +17,7 @@ diff:
 update:
 	hack/gen-profiles.sh
 
-image: pre-checks image-cozystack image-talos image-matchbox
+image: image-cozystack image-talos image-matchbox
 
 image-cozystack:
 	make -C ../../.. repos

packages/core/installer/images/talos/profiles/initramfs.yaml

@@ -3,24 +3,24 @@
 arch: amd64
 platform: metal
 secureboot: false
-version: v1.8.0
+version: v1.7.6
 input:
   kernel:
     path: /usr/install/amd64/vmlinuz
   initramfs:
     path: /usr/install/amd64/initramfs.xz
   baseInstaller:
-    imageRef: ghcr.io/siderolabs/installer:v1.8.0
+    imageRef: ghcr.io/siderolabs/installer:v1.7.6
   systemExtensions:
-    - imageRef: ghcr.io/siderolabs/amd-ucode:20240909
-    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240909
-    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240909
-    - imageRef: ghcr.io/siderolabs/i915-ucode:20240909
-    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240909
-    - imageRef: ghcr.io/siderolabs/intel-ucode:20240910
-    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20240909
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.11-v1.8.0
-    - imageRef: ghcr.io/siderolabs/zfs:2.2.6-v1.8.0
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20240811
+    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240811
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240811
+    - imageRef: ghcr.io/siderolabs/i915-ucode:20240811
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240811
+    - imageRef: ghcr.io/siderolabs/intel-ucode:20240813
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20240811
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.8-v1.7.6
+    - imageRef: ghcr.io/siderolabs/zfs:2.2.4-v1.7.6
 output:
   kind: initramfs
   imageOptions: {}

packages/core/installer/images/talos/profiles/installer.yaml

@@ -3,24 +3,24 @@
 arch: amd64
 platform: metal
 secureboot: false
-version: v1.8.0
+version: v1.7.6
 input:
   kernel:
     path: /usr/install/amd64/vmlinuz
   initramfs:
     path: /usr/install/amd64/initramfs.xz
   baseInstaller:
-    imageRef: ghcr.io/siderolabs/installer:v1.8.0
+    imageRef: ghcr.io/siderolabs/installer:v1.7.6
   systemExtensions:
-    - imageRef: ghcr.io/siderolabs/amd-ucode:20240909
-    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240909
-    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240909
-    - imageRef: ghcr.io/siderolabs/i915-ucode:20240909
-    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240909
-    - imageRef: ghcr.io/siderolabs/intel-ucode:20240910
-    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20240909
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.11-v1.8.0
-    - imageRef: ghcr.io/siderolabs/zfs:2.2.6-v1.8.0
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20240811
+    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240811
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240811
+    - imageRef: ghcr.io/siderolabs/i915-ucode:20240811
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240811
+    - imageRef: ghcr.io/siderolabs/intel-ucode:20240813
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20240811
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.8-v1.7.6
+    - imageRef: ghcr.io/siderolabs/zfs:2.2.4-v1.7.6
 output:
   kind: installer
   imageOptions: {}

packages/core/installer/images/talos/profiles/iso.yaml

@@ -3,24 +3,24 @@
 arch: amd64
 platform: metal
 secureboot: false
-version: v1.8.0
+version: v1.7.6
 input:
   kernel:
     path: /usr/install/amd64/vmlinuz
   initramfs:
     path: /usr/install/amd64/initramfs.xz
   baseInstaller:
-    imageRef: ghcr.io/siderolabs/installer:v1.8.0
+    imageRef: ghcr.io/siderolabs/installer:v1.7.6
   systemExtensions:
-    - imageRef: ghcr.io/siderolabs/amd-ucode:20240909
-    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240909
-    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240909
-    - imageRef: ghcr.io/siderolabs/i915-ucode:20240909
-    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240909
-    - imageRef: ghcr.io/siderolabs/intel-ucode:20240910
-    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20240909
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.11-v1.8.0
-    - imageRef: ghcr.io/siderolabs/zfs:2.2.6-v1.8.0
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20240811
+    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240811
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240811
+    - imageRef: ghcr.io/siderolabs/i915-ucode:20240811
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240811
+    - imageRef: ghcr.io/siderolabs/intel-ucode:20240813
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20240811
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.8-v1.7.6
+    - imageRef: ghcr.io/siderolabs/zfs:2.2.4-v1.7.6
 output:
   kind: iso
   imageOptions: {}

packages/core/installer/images/talos/profiles/kernel.yaml

@@ -3,24 +3,24 @@
 arch: amd64
 platform: metal
 secureboot: false
-version: v1.8.0
+version: v1.7.6
 input:
   kernel:
     path: /usr/install/amd64/vmlinuz
   initramfs:
     path: /usr/install/amd64/initramfs.xz
   baseInstaller:
-    imageRef: ghcr.io/siderolabs/installer:v1.8.0
+    imageRef: ghcr.io/siderolabs/installer:v1.7.6
   systemExtensions:
-    - imageRef: ghcr.io/siderolabs/amd-ucode:20240909
-    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240909
-    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240909
-    - imageRef: ghcr.io/siderolabs/i915-ucode:20240909
-    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240909
-    - imageRef: ghcr.io/siderolabs/intel-ucode:20240910
-    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20240909
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.11-v1.8.0
-    - imageRef: ghcr.io/siderolabs/zfs:2.2.6-v1.8.0
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20240811
+    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240811
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240811
+    - imageRef: ghcr.io/siderolabs/i915-ucode:20240811
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240811
+    - imageRef: ghcr.io/siderolabs/intel-ucode:20240813
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20240811
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.8-v1.7.6
+    - imageRef: ghcr.io/siderolabs/zfs:2.2.4-v1.7.6
 output:
   kind: kernel
   imageOptions: {}

packages/core/installer/images/talos/profiles/metal.yaml

@@ -3,24 +3,24 @@
 arch: amd64
 platform: metal
 secureboot: false
-version: v1.8.0
+version: v1.7.6
 input:
   kernel:
     path: /usr/install/amd64/vmlinuz
   initramfs:
     path: /usr/install/amd64/initramfs.xz
   baseInstaller:
-    imageRef: ghcr.io/siderolabs/installer:v1.8.0
+    imageRef: ghcr.io/siderolabs/installer:v1.7.6
   systemExtensions:
-    - imageRef: ghcr.io/siderolabs/amd-ucode:20240909
-    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240909
-    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240909
-    - imageRef: ghcr.io/siderolabs/i915-ucode:20240909
-    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240909
-    - imageRef: ghcr.io/siderolabs/intel-ucode:20240910
-    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20240909
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.11-v1.8.0
-    - imageRef: ghcr.io/siderolabs/zfs:2.2.6-v1.8.0
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20240811
+    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240811
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240811
+    - imageRef: ghcr.io/siderolabs/i915-ucode:20240811
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240811
+    - imageRef: ghcr.io/siderolabs/intel-ucode:20240813
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20240811
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.8-v1.7.6
+    - imageRef: ghcr.io/siderolabs/zfs:2.2.4-v1.7.6
 output:
   kind: image
   imageOptions: { diskSize: 1306525696, diskFormat: raw }

packages/core/installer/images/talos/profiles/nocloud.yaml

@@ -3,24 +3,24 @@
 arch: amd64
 platform: nocloud
 secureboot: false
-version: v1.8.0
+version: v1.7.6
 input:
   kernel:
     path: /usr/install/amd64/vmlinuz
   initramfs:
     path: /usr/install/amd64/initramfs.xz
   baseInstaller:
-    imageRef: ghcr.io/siderolabs/installer:v1.8.0
+    imageRef: ghcr.io/siderolabs/installer:v1.7.6
   systemExtensions:
-    - imageRef: ghcr.io/siderolabs/amd-ucode:20240909
-    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240909
-    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240909
-    - imageRef: ghcr.io/siderolabs/i915-ucode:20240909
-    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240909
-    - imageRef: ghcr.io/siderolabs/intel-ucode:20240910
-    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20240909
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.11-v1.8.0
-    - imageRef: ghcr.io/siderolabs/zfs:2.2.6-v1.8.0
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20240811
+    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240811
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240811
+    - imageRef: ghcr.io/siderolabs/i915-ucode:20240811
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240811
+    - imageRef: ghcr.io/siderolabs/intel-ucode:20240813
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20240811
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.8-v1.7.6
+    - imageRef: ghcr.io/siderolabs/zfs:2.2.4-v1.7.6
 output:
   kind: image
   imageOptions: { diskSize: 1306525696, diskFormat: raw }

packages/core/installer/values.yaml

@@ -1,2 +1,2 @@
 cozystack:
-  image: ghcr.io/aenix-io/cozystack/cozystack:v0.16.5@sha256:5bd08ec86b8392d31a1df7cb496d7c861142771c323c302729f7728da9b49ae2
+  image: ghcr.io/aenix-io/cozystack/cozystack:v0.15.0@sha256:aeff26a80f84b4323578e613b3bf03caa842d617ec8d9ca98706867c1e70609f

packages/core/platform/bundles/distro-full.yaml

@@ -29,7 +29,6 @@ releases:
       enableIdentityMark: true
       ipv4NativeRoutingCIDR: "{{ index $cozyConfig.data "ipv4-pod-cidr" }}"
       autoDirectNodeRoutes: true
-      routingMode: native
 
 - name: cert-manager
   releaseName: cert-manager
@@ -140,19 +139,4 @@ releases:
   releaseName: traffic-manager
   chart: cozy-telepresence
   namespace: cozy-telepresence
-  optional: true
   dependsOn: []
-
-- name: external-dns
-  releaseName: external-dns
-  chart: cozy-external-dns
-  namespace: cozy-external-dns
-  optional: true
-  dependsOn: [cilium]
-
-- name: external-secrets-operator
-  releaseName: external-secrets-operator
-  chart: cozy-external-secrets-operator
-  namespace: cozy-external-secrets-operator
-  optional: true
-  dependsOn: [cilium]

packages/core/platform/bundles/distro-hosted.yaml

@@ -91,19 +91,4 @@ releases:
   releaseName: traffic-manager
   chart: cozy-telepresence
   namespace: cozy-telepresence
-  optional: true
-  dependsOn: []
-
-- name: external-dns
-  releaseName: external-dns
-  chart: cozy-external-dns
-  namespace: cozy-external-dns
-  optional: true
-  dependsOn: [] 
-
-- name: external-secrets-operator
-  releaseName: external-secrets-operator
-  chart: cozy-external-secrets-operator
-  namespace: cozy-external-secrets-operator
-  optional: true
   dependsOn: []

packages/core/platform/bundles/paas-full.yaml

@@ -175,7 +175,6 @@ releases:
   releaseName: traffic-manager
   chart: cozy-telepresence
   namespace: cozy-telepresence
-  optional: true
   dependsOn: [cilium,kubeovn]
 
 - name: dashboard
@@ -217,17 +216,3 @@ releases:
   namespace: cozy-cluster-api
   privileged: true
   dependsOn: [cilium,kubeovn,capi-operator]
-
-- name: external-dns
-  releaseName: external-dns
-  chart: cozy-external-dns
-  namespace: cozy-external-dns
-  optional: true
-  dependsOn: [cilium,kubeovn]
-
-- name: external-secrets-operator
-  releaseName: external-secrets-operator
-  chart: cozy-external-secrets-operator
-  namespace: cozy-external-secrets-operator
-  optional: true
-  dependsOn: [cilium,kubeovn]

packages/core/platform/bundles/paas-hosted.yaml

@@ -97,21 +97,6 @@ releases:
   releaseName: traffic-manager
   chart: cozy-telepresence
   namespace: cozy-telepresence
-  optional: true
-  dependsOn: []
-
-- name: external-dns
-  releaseName: external-dns
-  chart: cozy-external-dns
-  namespace: cozy-external-dns
-  optional: true
-  dependsOn: [cilium,kubeovn]
-
-- name: external-secrets-operator
-  releaseName: external-secrets-operator
-  chart: cozy-external-secrets-operator
-  namespace: cozy-external-secrets-operator
-  optional: true
   dependsOn: []
 
 - name: dashboard

packages/core/platform/templates/helmreleases.yaml

@@ -3,7 +3,6 @@
 {{- $bundle := tpl (.Files.Get (printf "bundles/%s.yaml" $bundleName)) . | fromYaml }}
 {{- $dependencyNamespaces := dict }}
 {{- $disabledComponents := splitList "," ((index $cozyConfig.data "bundle-disable") | default "") }}
-{{- $enabledComponents := splitList "," ((index $cozyConfig.data "bundle-enable") | default "") }}
 
 {{/* collect dependency namespaces from releases */}}
 {{- range $x := $bundle.releases }}
@@ -12,7 +11,6 @@
 
 {{- range $x := $bundle.releases }}
 {{- if not (has $x.name $disabledComponents) }}
-{{- if or (not $x.optional) (and ($x.optional) (has $x.name $enabledComponents)) }}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
@@ -67,4 +65,3 @@ spec:
   {{- end }}
 {{- end }}
 {{- end }}
-{{- end }}

packages/core/platform/templates/namespaces.yaml

@@ -1,23 +1,17 @@
 {{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
 {{- $bundleName := index $cozyConfig.data "bundle-name" }}
 {{- $bundle := tpl (.Files.Get (printf "bundles/%s.yaml" $bundleName)) . | fromYaml }}
-{{- $disabledComponents := splitList "," ((index $cozyConfig.data "bundle-disable") | default "") }}
-{{- $enabledComponents := splitList "," ((index $cozyConfig.data "bundle-enable") | default "") }}
 {{- $namespaces := dict }}
 
 {{/* collect namespaces from releases */}}
 {{- range $x := $bundle.releases }}
-  {{- if not (hasKey $namespaces $x.namespace) }}
-    {{- if not (has $x.name $disabledComponents) }}
-      {{- if and ($x.optional) (has $x.name $enabledComponents) }}
-        {{- $_ := set $namespaces $x.namespace false }}
-      {{- end }}
-    {{- end }}
-  {{- end }}
-  {{/* if at least one release requires a privileged namespace, then it should be privileged */}}
-  {{- if or $x.privileged (index $namespaces $x.namespace) }}
-    {{- $_ := set $namespaces $x.namespace true }}
-  {{- end }}
+{{- if not (hasKey $namespaces $x.namespace) }}
+{{- $_ := set $namespaces $x.namespace false }}
+{{- end }}
+{{/* if at least one release requires a privileged namespace, then it should be privileged */}}
+{{- if or $x.privileged (index $namespaces $x.namespace) }}
+{{- $_ := set $namespaces $x.namespace true }}
+{{- end }}
 {{- end }}
 
 {{/* Add extra namespaces */}}

packages/core/testing/values.yaml

@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/aenix-io/cozystack/e2e-sandbox:v0.16.5@sha256:25b298d621ec79431d106184d59849bbae634588742583d111628126ad8615c5
+  image: ghcr.io/aenix-io/cozystack/e2e-sandbox:v0.15.0@sha256:20cc84e4a11db31434881355c070113a7823501a28a6114ca02830b18607ad21

packages/extra/ingress/templates/dashboard.yaml

@@ -1,36 +1,29 @@
-{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}  
-{{- $issuerType := (index $cozyConfig.data "clusterissuer") | default "http01" }}  
-
-{{- $myNS := lookup "v1" "Namespace" "" .Release.Namespace }}  
-{{- $host := index $myNS.metadata.annotations "namespace.cozystack.io/host" }}  
-
-{{- if .Values.dashboard }}  
-apiVersion: networking.k8s.io/v1  
-kind: Ingress  
-metadata:  
-  annotations:  
-    cert-manager.io/cluster-issuer: letsencrypt-prod  
-    {{- if eq $issuerType "cloudflare" }} 
-    {{- else }}  
-    acme.cert-manager.io/http01-ingress-class: {{ .Release.Namespace }}  
-    {{- end }}  
-  name: dashboard-{{ .Release.Namespace }}  
-  namespace: cozy-dashboard  
-spec:  
-  ingressClassName: {{ .Release.Namespace }}  
-  rules:  
-  - host: dashboard.{{ $host }}  
-    http:  
-      paths:  
-      - backend:  
-          service:  
-            name: dashboard  
-            port:  
-              number: 80  
-        path: /  
-        pathType: Prefix  
-  tls:  
-  - hosts:  
-    - dashboard.{{ $host }}  
-    secretName: dashboard-{{ .Release.Namespace }}-tls  
+{{- $myNS := lookup "v1" "Namespace" "" .Release.Namespace }}
+{{- $host := index $myNS.metadata.annotations "namespace.cozystack.io/host" }}
+{{- if .Values.dashboard }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    acme.cert-manager.io/http01-ingress-class: tenant-root
+  name: dashboard-{{ .Release.Namespace }}
+  namespace: cozy-dashboard
+spec:
+  ingressClassName: {{ .Release.Namespace }}
+  rules:
+  - host: dashboard.{{ $host }}
+    http:
+      paths:
+      - backend:
+          service:
+            name: dashboard
+            port:
+              number: 80
+        path: /
+        pathType: Prefix
+  tls:
+  - hosts:
+    - dashboard.{{ $host }}
+    secretName: dashboard-{{ .Release.Namespace }}-tls
 {{- end }}

packages/extra/monitoring/Chart.yaml

@@ -3,4 +3,4 @@ name: monitoring
 description: Monitoring and observability stack
 icon: /logos/monitoring.svg
 type: application
-version: 1.5.0
+version: 1.4.0

packages/extra/monitoring/templates/alerta/alerta.yaml

@@ -1,6 +1,3 @@
-{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}  
-{{- $issuerType := (index $cozyConfig.data "clusterissuer") | default "http01" }}
-
 {{- $myNS := lookup "v1" "Namespace" "" .Release.Namespace }}
 {{- $ingress := index $myNS.metadata.annotations "namespace.cozystack.io/ingress" }}
 {{- $host := index $myNS.metadata.annotations "namespace.cozystack.io/host" }}
@@ -148,18 +145,16 @@ metadata:
   labels:
     app: alerta
   annotations:
-    {{- if ne $issuerType "cloudflare" }} 
     acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
-    {{- end }} 
     cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
   ingressClassName: {{ $ingress }}
   tls:
     - hosts:
-        - "{{ printf "alerta.%s" (.Values.host | default $host) }}"
+        - "{{ .Values.host | default (printf "alerta.%s" $host) }}"
       secretName: alerta-tls
   rules:
-    - host: "{{ printf "alerta.%s" (.Values.host | default $host) }}"
+    - host: "{{ .Values.host | default (printf "alerta.%s" $host) }}"
       http:
         paths:
           - path: /

packages/extra/monitoring/templates/grafana/grafana.yaml

@@ -1,6 +1,3 @@
-{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}  
-{{- $issuerType := (index $cozyConfig.data "clusterissuer") | default "http01" }} 
-
 {{- $myNS := lookup "v1" "Namespace" "" .Release.Namespace }}
 {{- $ingress := index $myNS.metadata.annotations "namespace.cozystack.io/ingress" }}
 {{- $host := index $myNS.metadata.annotations "namespace.cozystack.io/host" }}
@@ -25,7 +22,7 @@ spec:
       password: ${GF_DATABASE_PASSWORD}
       #ssl_mode: require
     server:
-      root_url: "https://{{ printf "grafana.%s" (.Values.host | default $host) }}"
+      root_url: "https://{{ .Values.host | default (printf "grafana.%s" $host) }}"
     security:
       admin_user: user
       admin_password: ${GF_PASSWORD}
@@ -93,14 +90,12 @@ spec:
   ingress:
     metadata:
       annotations:
-        {{- if ne $issuerType "cloudflare" }}
-        acme.cert-manager.io/http01-ingress-class: "{{ $ingress }}"  
-        {{- end }}
+        acme.cert-manager.io/http01-ingress-class: "{{ $ingress }}"
         cert-manager.io/cluster-issuer: letsencrypt-prod
     spec:
       ingressClassName: "{{ $ingress }}"
       rules:
-        - host: "{{ printf "grafana.%s" (.Values.host | default $host) }}"
+        - host: "{{ .Values.host | default (printf "grafana.%s" $host) }}"
           http:
             paths:
               - backend:
@@ -112,5 +107,5 @@ spec:
                 pathType: Prefix
       tls:
       - hosts:
-        - "{{ printf "grafana.%s" (.Values.host | default $host) }}"
+        - "{{ .Values.host | default (printf "grafana.%s" $host) }}"
         secretName: grafana-ingress-tls

packages/extra/seaweedfs/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.1
+version: 0.2.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

packages/extra/seaweedfs/templates/seaweedfs.yaml

@@ -38,10 +38,6 @@ spec:
           storageClass: {{ . }}
           {{- end }}
           maxVolumes: 0
-
-      filer:
-        s3:
-          domainName: {{ .Values.host | default (printf "s3.%s" $host) }}
       
       s3:
         ingress:

packages/extra/versions_map

@@ -12,8 +12,6 @@ monitoring 1.1.0 15478a88
 monitoring 1.2.0 c9e0d63b
 monitoring 1.2.1 4471b4ba
 monitoring 1.3.0 6c5cf5b
-monitoring 1.4.0 adaf603b
-monitoring 1.5.0 HEAD
+monitoring 1.4.0 HEAD
 seaweedfs 0.1.0 5ca8823
-seaweedfs 0.2.0 9e33dc0
-seaweedfs 0.2.1 HEAD
+seaweedfs 0.2.0 HEAD

packages/system/bucket/.helmignore

@@ -1,2 +0,0 @@
-hack
-.gitkeep

packages/system/bucket/Chart.yaml

@@ -1,3 +0,0 @@
-apiVersion: v2
-name: cozy-bucket
-version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process

packages/system/bucket/Makefile

@@ -1,25 +0,0 @@
-S3MANAGER_TAG=v0.5.0
-
-export NAME=s3manager-system
-
-include ../../../scripts/common-envs.mk
-include ../../../scripts/package.mk
-
-update:
-	rm -rf charts
-	helm pull oci://ghcr.io/aenix-io/charts/etcd-operator --untar --untardir charts
-
-image: image-s3manager
-
-image-s3manager:
-	docker buildx build --platform linux/amd64 --build-arg ARCH=amd64 images/s3manager \
-		--provenance false \
-		--tag $(REGISTRY)/s3manager:$(call settag,$(S3MANAGER_TAG)) \
-		--cache-from type=registry,ref=$(REGISTRY)/s3manager:latest \
-		--cache-to type=inline \
-		--metadata-file images/s3manager.json \
-		--push=$(PUSH) \
-		--load=$(LOAD)
-	echo "$(REGISTRY)/s3manager:$(call settag,$(S3MANAGER_TAG))@$$(yq e '."containerimage.digest"' images/s3manager.json -o json -r)" \
-		> images/s3manager.tag
-	rm -f images/s3manager.json

packages/system/bucket/images/s3manager.tag

@@ -1 +0,0 @@
-ghcr.io/aenix-io/cozystack/s3manager:latest@sha256:7a1a0864f823dc3343d79dffa44ab73f77f0e1b3642a0fe0fa29b280c3184a9b

packages/system/bucket/images/s3manager/Dockerfile

@@ -1,20 +0,0 @@
-# Source: https://github.com/cloudlena/s3manager/blob/main/Dockerfile
-
-FROM docker.io/library/golang:1 AS builder
-WORKDIR /usr/src/app
-RUN wget -O- https://github.com/cloudlena/s3manager/archive/9a7c8e446b422f8973b8c461990f39fdafee9c27.tar.gz | tar -xzf- --strip 1
-ADD cozystack.patch /
-RUN git apply /cozystack.patch
-RUN CGO_ENABLED=0 go build -ldflags="-s -w" -a -installsuffix cgo -o bin/s3manager
-
-FROM docker.io/library/alpine:latest
-WORKDIR /usr/src/app
-RUN addgroup -S s3manager && adduser -S s3manager -G s3manager
-RUN apk add --no-cache \
-  ca-certificates \
-  dumb-init
-COPY --from=builder --chown=s3manager:s3manager /usr/src/app/bin/s3manager ./
-USER s3manager
-EXPOSE 8080
-ENTRYPOINT [ "/usr/bin/dumb-init", "--" ]
-CMD [ "/usr/src/app/s3manager" ]

packages/system/bucket/images/s3manager/cozystack.patch

@@ -1,26 +0,0 @@
-diff --git a/web/template/bucket.html.tmpl b/web/template/bucket.html.tmpl
-index e2f8d28..87add13 100644
---- a/web/template/bucket.html.tmpl
-+++ b/web/template/bucket.html.tmpl
-@@ -13,7 +13,7 @@
- 
- <nav class="nav-extended">
-     <div class="nav-wrapper container">
--        <a href="/buckets/{{$.BucketName}}" class="brand-logo center"><i class="material-icons">folder_open</i>{{ .BucketName }}</a>
-+        <a href="/" class="brand-logo">Cozystack S3 Manager</a>
-         {{ if not .Objects }}
-         <ul class="right">
-             <li>
-diff --git a/web/template/buckets.html.tmpl b/web/template/buckets.html.tmpl
-index c7ea184..fb1dce7 100644
---- a/web/template/buckets.html.tmpl
-+++ b/web/template/buckets.html.tmpl
-@@ -1,7 +1,7 @@
- {{ define "content" }}
- <nav>
-     <div class="nav-wrapper container">
--        <a href="/" class="brand-logo">S3 Manager</a>
-+        <a href="/" class="brand-logo">Cozystack S3 Manager</a>
-     </div>
- </nav>
- 

packages/system/bucket/templates/deployment.yaml

@@ -1,35 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ .Values.bucketName }}-ui
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: {{ .Values.bucketName }}-ui
-  template:
-    metadata:
-      labels:
-        app: {{ .Values.bucketName }}-ui
-    spec:
-      containers:
-      - name: s3manager
-        image: "{{ $.Files.Get "images/s3manager.tag" | trim }}"
-        env:
-        - name: ENDPOINT
-          valueFrom:
-            secretKeyRef:
-              name: {{ .Values.bucketName }}-credentials
-              key: endpoint
-        - name: SKIP_SSL_VERIFICATION
-          value: "true"
-        - name: ACCESS_KEY_ID
-          valueFrom:
-            secretKeyRef:
-              name: {{ .Values.bucketName }}-credentials
-              key: accessKey
-        - name: SECRET_ACCESS_KEY
-          valueFrom:
-            secretKeyRef:
-              name: {{ .Values.bucketName }}-credentials
-              key: secretKey

packages/system/bucket/templates/ingress.yaml

@@ -1,37 +0,0 @@
-{{- $myNS := lookup "v1" "Namespace" "" .Release.Namespace }}
-{{- $host := index $myNS.metadata.annotations "namespace.cozystack.io/host" }}
-{{- $ingress := index $myNS.metadata.annotations "namespace.cozystack.io/ingress" }}
-{{- $issuerType := (index $cozyConfig.data "clusterissuer") | default "http01" }}
-
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: {{ .Values.bucketName }}-ui
-  annotations:
-    nginx.ingress.kubernetes.io/auth-type: "basic"
-    nginx.ingress.kubernetes.io/auth-secret: "{{ .Values.bucketName }}-ui-auth"
-    nginx.ingress.kubernetes.io/auth-realm: "Authentication Required"
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "99999"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "99999"
-    {{- if ne $issuerType "cloudflare" }}
-    acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
-    {{- end }}
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-spec:
-  ingressClassName: {{ $ingress }}
-  tls:
-    - hosts:
-        - "{{ .Values.bucketName }}.{{ $host }}"
-      secretName: {{ .Values.bucketName }}-ui-tls
-  rules:
-  - host: {{ .Values.bucketName }}.{{ $host }}
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: {{ .Values.bucketName }}-ui
-            port:
-              number: 8080

packages/system/bucket/templates/secret.yaml

@@ -1,22 +0,0 @@
-{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace .Values.bucketName }}
-{{- $bucketInfo := fromJson (b64dec (index $existingSecret.data "BucketInfo")) }}
-{{- $accessKeyID := index $bucketInfo.spec.secretS3 "accessKeyID" }}
-{{- $accessSecretKey := index $bucketInfo.spec.secretS3 "accessSecretKey" }}
-{{- $endpoint := index $bucketInfo.spec.secretS3 "endpoint" }}
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ .Values.bucketName }}-credentials
-type: Opaque
-stringData:
-  accessKey: {{ $accessKeyID | quote }}
-  secretKey: {{ $accessSecretKey | quote }}
-  endpoint: {{ trimPrefix "https://" $endpoint }}
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ .Values.bucketName }}-ui-auth
-data:
-  auth: {{ htpasswd $accessKeyID $accessSecretKey | b64enc | quote }}

packages/system/bucket/templates/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Values.bucketName }}-ui
-spec:
-  selector:
-    app: {{ .Values.bucketName }}-ui
-  ports:
-    - protocol: TCP
-      port: 8080
-      targetPort: 8080
-  type: ClusterIP

packages/system/bucket/values.yaml

@@ -1 +0,0 @@
-bucketName: ""

packages/system/capi-operator/values.yaml

@@ -1,9 +0,0 @@
-cluster-api-operator:
-  resources:
-    manager:
-      limits:
-        cpu: 200m
-        memory: 512Mi
-      requests:
-        cpu: 100m
-        memory: 100Mi

packages/system/cert-manager-issuers/templates/cluster-issuers.yaml

@@ -1,57 +1,35 @@
-{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}  
-{{- $issuerType := (index $cozyConfig.data "clusterissuer") | default "http01" }}  
-
-apiVersion: cert-manager.io/v1 
-kind: ClusterIssuer  
-metadata:  
-  name: letsencrypt-prod  
-spec:  
-  acme:  
-    privateKeySecretRef:  
-      name: letsencrypt-prod  
-    server: https://acme-v02.api.letsencrypt.org/directory  
-    solvers:  
-    - {{- if eq $issuerType "cloudflare" }}  
-        dns01:  
-          cloudflare:  
-            apiTokenSecretRef:  
-              name: cloudflare-api-token-secret  
-              key: api-token  
-      {{- else }}  
-        http01:  
-          ingress:  
-            class: nginx  
-      {{- end }}  
-
----  
-
-apiVersion: cert-manager.io/v1  
-kind: ClusterIssuer  
-metadata:  
-  name: letsencrypt-stage  
-spec:  
-  acme:  
-    privateKeySecretRef:  
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  annotations:
+  name: letsencrypt-prod
+spec:
+  acme:
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    server: https://acme-v02.api.letsencrypt.org/directory
+    solvers:
+    - http01:
+        ingress:
+          class: nginx
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-stage
+spec:
+  acme:
+    privateKeySecretRef:
       name: letsencrypt-stage
-    server: https://acme-staging-v02.api.letsencrypt.org/directory  
-    solvers:  
-    - {{- if eq $issuerType "cloudflare" }}  
-        dns01:  
-          cloudflare:  
-            apiTokenSecretRef:  
-              name: cloudflare-api-token-secret  
-              key: api-token  
-      {{- else }}  
-        http01:  
-          ingress:  
-            class: nginx  
-      {{- end }}  
-
----  
-
-apiVersion: cert-manager.io/v1  
-kind: ClusterIssuer  
-metadata:  
-  name: selfsigned-cluster-issuer  
-spec:  
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    solvers:
+    - http01:
+        ingress:
+          class: nginx
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned-cluster-issuer
+spec:
   selfSigned: {}

packages/system/cilium/charts/cilium/Chart.yaml

@@ -79,7 +79,7 @@ annotations:
     Pod IP Pool\n  description: |\n    CiliumPodIPPool defines an IP pool that can
     be used for pooled IPAM (i.e. the multi-pool IPAM mode).\n"
 apiVersion: v2
-appVersion: 1.16.2
+appVersion: 1.16.1
 description: eBPF-based Networking, Security, and Observability
 home: https://cilium.io/
 icon: https://cdn.jsdelivr.net/gh/cilium/cilium@main/Documentation/images/logo-solo.svg
@@ -95,4 +95,4 @@ kubeVersion: '>= 1.21.0-0'
 name: cilium
 sources:
 - https://github.com/cilium/cilium
-version: 1.16.2
+version: 1.16.1

packages/system/cilium/charts/cilium/README.md

@@ -1,6 +1,6 @@
 # cilium
 
-![Version: 1.16.2](https://img.shields.io/badge/Version-1.16.2-informational?style=flat-square) ![AppVersion: 1.16.2](https://img.shields.io/badge/AppVersion-1.16.2-informational?style=flat-square)
+![Version: 1.16.1](https://img.shields.io/badge/Version-1.16.1-informational?style=flat-square) ![AppVersion: 1.16.1](https://img.shields.io/badge/AppVersion-1.16.1-informational?style=flat-square)
 
 Cilium is open source software for providing and transparently securing
 network connectivity and loadbalancing between application workloads such as
@@ -83,7 +83,7 @@ contributors across the globe, there is almost always someone available to help.
 | authentication.mutual.spire.install.agent.tolerations | list | `[{"effect":"NoSchedule","key":"node.kubernetes.io/not-ready"},{"effect":"NoSchedule","key":"node-role.kubernetes.io/master"},{"effect":"NoSchedule","key":"node-role.kubernetes.io/control-plane"},{"effect":"NoSchedule","key":"node.cloudprovider.kubernetes.io/uninitialized","value":"true"},{"key":"CriticalAddonsOnly","operator":"Exists"}]` | SPIRE agent tolerations configuration By default it follows the same tolerations as the agent itself to allow the Cilium agent on this node to connect to SPIRE. ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
 | authentication.mutual.spire.install.enabled | bool | `true` | Enable SPIRE installation. This will only take effect only if authentication.mutual.spire.enabled is true |
 | authentication.mutual.spire.install.existingNamespace | bool | `false` | SPIRE namespace already exists. Set to true if Helm should not create, manage, and import the SPIRE namespace. |
-| authentication.mutual.spire.install.initImage | object | `{"digest":"sha256:c230832bd3b0be59a6c47ed64294f9ce71e91b327957920b6929a0caa8353140","override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/library/busybox","tag":"1.36.1","useDigest":true}` | init container image of SPIRE agent and server |
+| authentication.mutual.spire.install.initImage | object | `{"digest":"sha256:9ae97d36d26566ff84e8893c64a6dc4fe8ca6d1144bf5b87b2b85a32def253c7","override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/library/busybox","tag":"1.36.1","useDigest":true}` | init container image of SPIRE agent and server |
 | authentication.mutual.spire.install.namespace | string | `"cilium-spire"` | SPIRE namespace to install into |
 | authentication.mutual.spire.install.server.affinity | object | `{}` | SPIRE server affinity configuration |
 | authentication.mutual.spire.install.server.annotations | object | `{}` | SPIRE server annotations |
@@ -182,7 +182,7 @@ contributors across the globe, there is almost always someone available to help.
 | clustermesh.apiserver.extraVolumeMounts | list | `[]` | Additional clustermesh-apiserver volumeMounts. |
 | clustermesh.apiserver.extraVolumes | list | `[]` | Additional clustermesh-apiserver volumes. |
 | clustermesh.apiserver.healthPort | int | `9880` | TCP port for the clustermesh-apiserver health API. |
-| clustermesh.apiserver.image | object | `{"digest":"sha256:cc84190fed92e03a2b3a33bc670b2447b521ee258ad9b076baaad13be312ea73","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.16.2","useDigest":true}` | Clustermesh API server image. |
+| clustermesh.apiserver.image | object | `{"digest":"sha256:e9c77417cd474cc943b2303a76c5cf584ac7024dd513ebb8d608cb62fe28896f","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.16.1","useDigest":true}` | Clustermesh API server image. |
 | clustermesh.apiserver.kvstoremesh.enabled | bool | `true` | Enable KVStoreMesh. KVStoreMesh caches the information retrieved from the remote clusters in the local etcd instance. |
 | clustermesh.apiserver.kvstoremesh.extraArgs | list | `[]` | Additional KVStoreMesh arguments. |
 | clustermesh.apiserver.kvstoremesh.extraEnv | list | `[]` | Additional KVStoreMesh environment variables. |
@@ -353,7 +353,7 @@ contributors across the globe, there is almost always someone available to help.
 | envoy.extraVolumes | list | `[]` | Additional envoy volumes. |
 | envoy.healthPort | int | `9878` | TCP port for the health API. |
 | envoy.idleTimeoutDurationSeconds | int | `60` | Set Envoy upstream HTTP idle connection timeout seconds. Does not apply to connections with pending requests. Default 60s |
-| envoy.image | object | `{"digest":"sha256:9762041c3760de226a8b00cc12f27dacc28b7691ea926748f9b5c18862db503f","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.29.9-1726784081-a90146d13b4cd7d168d573396ccf2b3db5a3b047","useDigest":true}` | Envoy container image. |
+| envoy.image | object | `{"digest":"sha256:bd5ff8c66716080028f414ec1cb4f7dc66f40d2fb5a009fff187f4a9b90b566b","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.29.7-39a2a56bbd5b3a591f69dbca51d3e30ef97e0e51","useDigest":true}` | Envoy container image. |
 | envoy.livenessProbe.failureThreshold | int | `10` | failure threshold of liveness probe |
 | envoy.livenessProbe.periodSeconds | int | `30` | interval between checks of the liveness probe |
 | envoy.log.format | string | `"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v"` | The format string to use for laying out the log message metadata of Envoy. |
@@ -484,7 +484,7 @@ contributors across the globe, there is almost always someone available to help.
 | hubble.relay.extraVolumes | list | `[]` | Additional hubble-relay volumes. |
 | hubble.relay.gops.enabled | bool | `true` | Enable gops for hubble-relay |
 | hubble.relay.gops.port | int | `9893` | Configure gops listen port for hubble-relay |
-| hubble.relay.image | object | `{"digest":"sha256:4b559907b378ac18af82541dafab430a857d94f1057f2598645624e6e7ea286c","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.16.2","useDigest":true}` | Hubble-relay container image. |
+| hubble.relay.image | object | `{"digest":"sha256:2e1b4c739a676ae187d4c2bfc45c3e865bda2567cc0320a90cb666657fcfcc35","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.16.1","useDigest":true}` | Hubble-relay container image. |
 | hubble.relay.listenHost | string | `""` | Host to listen to. Specify an empty string to bind to all the interfaces. |
 | hubble.relay.listenPort | string | `"4245"` | Port to listen to. |
 | hubble.relay.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
@@ -590,7 +590,7 @@ contributors across the globe, there is almost always someone available to help.
 | hubble.ui.updateStrategy | object | `{"rollingUpdate":{"maxUnavailable":1},"type":"RollingUpdate"}` | hubble-ui update strategy. |
 | identityAllocationMode | string | `"crd"` | Method to use for identity allocation (`crd` or `kvstore`). |
 | identityChangeGracePeriod | string | `"5s"` | Time to wait before using new identity on endpoint identity change. |
-| image | object | `{"digest":"sha256:4386a8580d8d86934908eea022b0523f812e6a542f30a86a47edd8bed90d51ea","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.16.2","useDigest":true}` | Agent container image. |
+| image | object | `{"digest":"sha256:0b4a3ab41a4760d86b7fc945b8783747ba27f29dac30dd434d94f2c9e3679f39","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.16.1","useDigest":true}` | Agent container image. |
 | imagePullSecrets | list | `[]` | Configure image pull secrets for pulling container images |
 | ingressController.default | bool | `false` | Set cilium ingress controller to be the default ingress controller This will let cilium ingress controller route entries without ingress class set |
 | ingressController.defaultSecretName | string | `nil` | Default secret name for ingresses without .spec.tls[].secretName set. |
@@ -717,7 +717,7 @@ contributors across the globe, there is almost always someone available to help.
 | operator.hostNetwork | bool | `true` | HostNetwork setting |
 | operator.identityGCInterval | string | `"15m0s"` | Interval for identity garbage collection. |
 | operator.identityHeartbeatTimeout | string | `"30m0s"` | Timeout for identity heartbeats. |
-| operator.image | object | `{"alibabacloudDigest":"sha256:16e33abb6b8381e2f66388b6d7141399f06c9b51b9ffa08fd159b8d321929716","awsDigest":"sha256:b6a73ec94407a56cccc8a395225e2aecc3ca3611e7acfeec86201c19fc0727dd","azureDigest":"sha256:fde7cf8bb887e106cd388bb5c3327e92682b2ec3ab4f03bb57b87f495b99f727","genericDigest":"sha256:cccfd3b886d52cb132c06acca8ca559f0fce91a6bd99016219b1a81fdbc4813a","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.16.2","useDigest":true}` | cilium-operator image. |
+| operator.image | object | `{"alibabacloudDigest":"sha256:4381adf48d76ec482551183947e537d44bcac9b6c31a635a9ac63f696d978804","awsDigest":"sha256:e3876fcaf2d6ccc8d5b4aaaded7b1efa971f3f4175eaa2c8a499878d58c39df4","azureDigest":"sha256:e55c222654a44ceb52db7ade3a7b9e8ef05681ff84c14ad1d46fea34869a7a22","genericDigest":"sha256:3bc7e7a43bc4a4d8989cb7936c5d96675dd2d02c306adf925ce0a7c35aa27dc4","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.16.1","useDigest":true}` | cilium-operator image. |
 | operator.nodeGCInterval | string | `"5m0s"` | Interval for cilium node garbage collection. |
 | operator.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for cilium-operator pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | operator.podAnnotations | object | `{}` | Annotations to be added to cilium-operator pods |
@@ -767,7 +767,7 @@ contributors across the globe, there is almost always someone available to help.
 | preflight.extraEnv | list | `[]` | Additional preflight environment variables. |
 | preflight.extraVolumeMounts | list | `[]` | Additional preflight volumeMounts. |
 | preflight.extraVolumes | list | `[]` | Additional preflight volumes. |
-| preflight.image | object | `{"digest":"sha256:4386a8580d8d86934908eea022b0523f812e6a542f30a86a47edd8bed90d51ea","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.16.2","useDigest":true}` | Cilium pre-flight image. |
+| preflight.image | object | `{"digest":"sha256:0b4a3ab41a4760d86b7fc945b8783747ba27f29dac30dd434d94f2c9e3679f39","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.16.1","useDigest":true}` | Cilium pre-flight image. |
 | preflight.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for preflight pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | preflight.podAnnotations | object | `{}` | Annotations to be added to preflight pods |
 | preflight.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |

packages/system/cilium/charts/cilium/templates/cilium-envoy/daemonset.yaml

@@ -26,6 +26,10 @@ spec:
   template:
     metadata:
       annotations:
+        {{- if and .Values.envoy.prometheus.enabled (not .Values.envoy.prometheus.serviceMonitor.enabled) }}
+        prometheus.io/port: "{{ .Values.envoy.prometheus.port }}"
+        prometheus.io/scrape: "true"
+        {{- end }}
         {{- if .Values.envoy.rollOutPods }}
         # ensure pods roll when configmap updates
         cilium.io/cilium-envoy-configmap-checksum: {{ include (print $.Template.BasePath "/cilium-envoy/configmap.yaml") . | sha256sum | quote }}

packages/system/cilium/charts/cilium/templates/cilium-envoy/service.yaml

@@ -1,33 +0,0 @@
-{{- $envoyDS := eq (include "envoyDaemonSetEnabled" .) "true" -}}
-{{- if and $envoyDS (not .Values.preflight.enabled) .Values.envoy.prometheus.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: cilium-envoy
-  namespace: {{ .Release.Namespace }}
-  {{- if or (not .Values.envoy.prometheus.serviceMonitor.enabled) .Values.envoy.annotations }}
-  annotations:
-  {{- if not .Values.envoy.prometheus.serviceMonitor.enabled }}
-    prometheus.io/scrape: "true"
-    prometheus.io/port: {{ .Values.envoy.prometheus.port | quote }}
-  {{- end }}
-  {{- with .Values.envoy.annotations }}
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- end }}
-  labels:
-    k8s-app: cilium-envoy
-    app.kubernetes.io/name: cilium-envoy
-    app.kubernetes.io/part-of: cilium
-    io.cilium/app: proxy
-spec:
-  clusterIP: None
-  type: ClusterIP
-  selector:
-    k8s-app: cilium-envoy
-  ports:
-  - name: envoy-metrics
-    port: {{ .Values.envoy.prometheus.port }}
-    protocol: TCP
-    targetPort: envoy-metrics
-{{- end }}

packages/system/cilium/charts/cilium/templates/cilium-operator/deployment.yaml

@@ -362,7 +362,7 @@ spec:
               name: cilium-clustermesh
               optional: true
               # note: items are not explicitly listed here, since the entries of this secret
-              # depend on the peers configured, and that would cause a restart of all operators
+              # depend on the peers configured, and that would cause a restart of all agents
               # at every addition/removal. Leaving the field empty makes each secret entry
               # to be automatically projected into the volume as a file whose name is the key.
           - secret:
@@ -384,28 +384,5 @@ spec:
               - key: {{ .Values.tls.caBundle.key }}
                 path: common-etcd-client-ca.crt
           {{- end }}
-          # note: we configure the volume for the kvstoremesh-specific certificate
-          # regardless of whether KVStoreMesh is enabled or not, so that it can be
-          # automatically mounted in case KVStoreMesh gets subsequently enabled,
-          # without requiring an operator restart.
-          - secret:
-              name: clustermesh-apiserver-local-cert
-              optional: true
-              items:
-              - key: tls.key
-                path: local-etcd-client.key
-              - key: tls.crt
-                path: local-etcd-client.crt
-          {{- if not .Values.tls.caBundle.enabled }}
-              - key: ca.crt
-                path: local-etcd-client-ca.crt
-          {{- else }}
-          - {{ .Values.tls.caBundle.useSecret | ternary "secret" "configMap" }}:
-              name: {{ .Values.tls.caBundle.name }}
-              optional: true
-              items:
-              - key: {{ .Values.tls.caBundle.key }}
-                path: local-etcd-client-ca.crt
-          {{- end }}
       {{- end }}
 {{- end }}

packages/system/cilium/charts/cilium/templates/validate.yaml

@@ -1,47 +1,3 @@
-{{/* validate deprecated options are not being used */}}
-
-{{/* Options deprecated in v1.15 and removed in v1.16 */}}
-{{- if or
-  (dig "encryption" "keyFile" "" .Values.AsMap)
-  (dig "encryption" "mountPath" "" .Values.AsMap)
-  (dig "encryption" "secretName" "" .Values.AsMap)
-  (dig "encryption" "interface" "" .Values.AsMap)
-}}
-  {{ fail "encryption.{keyFile,mountPath,secretName,interface} were deprecated in v1.14 and has been removed in v1.16. For details please refer to https://docs.cilium.io/en/v1.16/operations/upgrade/#helm-options" }}
-{{- end }}
-{{- if or
-  ((dig "proxy" "prometheus" "enabled" "" .Values.AsMap) | toString)
-  (dig "proxy" "prometheus" "port" "" .Values.AsMap)
-}}
-  {{ fail "proxy.prometheus.enabled and proxy.prometheus.port were deprecated in v1.14 and has been removed in v1.16. For details please refer to https://docs.cilium.io/en/v1.16/operations/upgrade/#helm-options" }}
-{{- end }}
-{{- if (dig "endpointStatus" "" .Values.AsMap) }}
-  {{ fail "endpointStatus has been removed in v1.16. For details please refer to https://docs.cilium.io/en/v1.16/operations/upgrade/#helm-options" }}
-{{- end }}
-{{- if (dig "remoteNodeIdentity" "" .Values.AsMap) }}
-  {{ fail "remoteNodeIdentity was deprecated in v1.15 and has been removed in v1.16. For details please refer to https://docs.cilium.io/en/v1.16/operations/upgrade/#helm-options" }}
-{{- end }}
-{{- if (dig "containerRuntime" "integration" "" .Values.AsMap) }}
-  {{ fail "containerRuntime.integration was deprecated in v1.14 and has been removed in v1.16. For details please refer to https://docs.cilium.io/en/v1.16/operations/upgrade/#helm-options" }}
-{{- end }}
-{{- if (dig "etcd" "managed" "" .Values.AsMap) }}
-  {{ fail "etcd.managed was deprecated in v1.10 has been removed in v1.16. For details please refer to https://docs.cilium.io/en/v1.16/operations/upgrade/#helm-options" }}
-{{- end }}
-
-{{/* Options deprecated in v1.14 and removed in v1.15 */}}
-{{- if .Values.tunnel }}
-  {{ fail "tunnel was deprecated in v1.14 and has been removed in v1.15. For details please refer to https://docs.cilium.io/en/v1.15/operations/upgrade/#helm-options" }}
-{{- end }}
-{{- if or (dig "clustermesh" "apiserver" "tls" "ca" "cert" "" .Values.AsMap) (dig "clustermesh" "apiserver" "tls" "ca" "key" "" .Values.AsMap) }}
-  {{ fail "clustermesh.apiserver.tls.ca.cert and clustermesh.apiserver.tls.ca.key were deprecated in v1.14 and has been removed in v1.15. For details please refer to https://docs.cilium.io/en/v1.15/operations/upgrade/#helm-options" }}
-{{- end }}
-{{- if .Values.enableK8sEventHandover }}
-  {{ fail "enableK8sEventHandover was deprecated in v1.14 and has been removed in v1.15. For details please refer to https://docs.cilium.io/en/v1.15/operations/upgrade/#helm-options" }}
-{{- end }}
-{{- if .Values.enableCnpStatusUpdates }}
-  {{ fail "enableCnpStatusUpdates was deprecated in v1.14 and has been removed in v1.15. For details please refer to https://docs.cilium.io/en/v1.15/operations/upgrade/#helm-options" }}
-{{- end }}
-
 {{/* validate hubble config */}}
 {{- if and .Values.hubble.ui.enabled (not .Values.hubble.ui.standalone.enabled) }}
   {{- if not .Values.hubble.relay.enabled }}

packages/system/cilium/charts/cilium/values.yaml

@@ -153,10 +153,10 @@ image:
   # @schema
   override: ~
   repository: "quay.io/cilium/cilium"
-  tag: "v1.16.2"
+  tag: "v1.16.1"
   pullPolicy: "IfNotPresent"
   # cilium-digest
-  digest: "sha256:4386a8580d8d86934908eea022b0523f812e6a542f30a86a47edd8bed90d51ea"
+  digest: "sha256:0b4a3ab41a4760d86b7fc945b8783747ba27f29dac30dd434d94f2c9e3679f39"
   useDigest: true
 # -- Affinity for cilium-agent.
 affinity:
@@ -1309,9 +1309,9 @@ hubble:
       # @schema
       override: ~
       repository: "quay.io/cilium/hubble-relay"
-      tag: "v1.16.2"
+      tag: "v1.16.1"
       # hubble-relay-digest
-      digest: "sha256:4b559907b378ac18af82541dafab430a857d94f1057f2598645624e6e7ea286c"
+      digest: "sha256:2e1b4c739a676ae187d4c2bfc45c3e865bda2567cc0320a90cb666657fcfcc35"
       useDigest: true
       pullPolicy: "IfNotPresent"
     # -- Specifies the resources for the hubble-relay pods
@@ -2158,9 +2158,9 @@ envoy:
     # @schema
     override: ~
     repository: "quay.io/cilium/cilium-envoy"
-    tag: "v1.29.9-1726784081-a90146d13b4cd7d168d573396ccf2b3db5a3b047"
+    tag: "v1.29.7-39a2a56bbd5b3a591f69dbca51d3e30ef97e0e51"
     pullPolicy: "IfNotPresent"
-    digest: "sha256:9762041c3760de226a8b00cc12f27dacc28b7691ea926748f9b5c18862db503f"
+    digest: "sha256:bd5ff8c66716080028f414ec1cb4f7dc66f40d2fb5a009fff187f4a9b90b566b"
     useDigest: true
   # -- Additional containers added to the cilium Envoy DaemonSet.
   extraContainers: []
@@ -2474,15 +2474,15 @@ operator:
     # @schema
     override: ~
     repository: "quay.io/cilium/operator"
-    tag: "v1.16.2"
+    tag: "v1.16.1"
     # operator-generic-digest
-    genericDigest: "sha256:cccfd3b886d52cb132c06acca8ca559f0fce91a6bd99016219b1a81fdbc4813a"
+    genericDigest: "sha256:3bc7e7a43bc4a4d8989cb7936c5d96675dd2d02c306adf925ce0a7c35aa27dc4"
     # operator-azure-digest
-    azureDigest: "sha256:fde7cf8bb887e106cd388bb5c3327e92682b2ec3ab4f03bb57b87f495b99f727"
+    azureDigest: "sha256:e55c222654a44ceb52db7ade3a7b9e8ef05681ff84c14ad1d46fea34869a7a22"
     # operator-aws-digest
-    awsDigest: "sha256:b6a73ec94407a56cccc8a395225e2aecc3ca3611e7acfeec86201c19fc0727dd"
+    awsDigest: "sha256:e3876fcaf2d6ccc8d5b4aaaded7b1efa971f3f4175eaa2c8a499878d58c39df4"
     # operator-alibabacloud-digest
-    alibabacloudDigest: "sha256:16e33abb6b8381e2f66388b6d7141399f06c9b51b9ffa08fd159b8d321929716"
+    alibabacloudDigest: "sha256:4381adf48d76ec482551183947e537d44bcac9b6c31a635a9ac63f696d978804"
     useDigest: true
     pullPolicy: "IfNotPresent"
     suffix: ""
@@ -2756,9 +2756,9 @@ preflight:
     # @schema
     override: ~
     repository: "quay.io/cilium/cilium"
-    tag: "v1.16.2"
+    tag: "v1.16.1"
     # cilium-digest
-    digest: "sha256:4386a8580d8d86934908eea022b0523f812e6a542f30a86a47edd8bed90d51ea"
+    digest: "sha256:0b4a3ab41a4760d86b7fc945b8783747ba27f29dac30dd434d94f2c9e3679f39"
     useDigest: true
     pullPolicy: "IfNotPresent"
   # -- The priority class to use for the preflight pod.
@@ -2905,9 +2905,9 @@ clustermesh:
       # @schema
       override: ~
       repository: "quay.io/cilium/clustermesh-apiserver"
-      tag: "v1.16.2"
+      tag: "v1.16.1"
       # clustermesh-apiserver-digest
-      digest: "sha256:cc84190fed92e03a2b3a33bc670b2447b521ee258ad9b076baaad13be312ea73"
+      digest: "sha256:e9c77417cd474cc943b2303a76c5cf584ac7024dd513ebb8d608cb62fe28896f"
       useDigest: true
       pullPolicy: "IfNotPresent"
     # -- TCP port for the clustermesh-apiserver health API.
@@ -3406,7 +3406,7 @@ authentication:
           override: ~
           repository: "docker.io/library/busybox"
           tag: "1.36.1"
-          digest: "sha256:c230832bd3b0be59a6c47ed64294f9ce71e91b327957920b6929a0caa8353140"
+          digest: "sha256:9ae97d36d26566ff84e8893c64a6dc4fe8ca6d1144bf5b87b2b85a32def253c7"
           useDigest: true
           pullPolicy: "IfNotPresent"
         # SPIRE agent configuration

packages/system/cilium/images/cilium/Dockerfile

@@ -1,2 +1,2 @@
-ARG VERSION=v1.16.2
+ARG VERSION=v1.16.1
 FROM quay.io/cilium/cilium:${VERSION}

packages/system/cilium/values-kubeovn.yaml

@@ -15,4 +15,4 @@ cilium:
   enableIdentityMark: false
   enableRuntimeDeviceDetection: true
   forceDeviceDetection: true
-  devices: "ovn0 genev_sys_6081"
+  devices: ovn0

packages/system/cilium/values.yaml

@@ -12,7 +12,7 @@ cilium:
     mode: "kubernetes"
   image:
     repository: ghcr.io/aenix-io/cozystack/cilium
-    tag: 1.16.2
-    digest: "sha256:534c5b04fef356a6be59234243c23c0c09702fe1e2c8872012afb391ce2965c4"
+    tag: 1.16.1
+    digest: "sha256:9593dbc3bd25487b52d8f43330d4a308e450605479a8384a32117e9613289892"
   envoy:
     enabled: false

packages/system/dashboard/values.yaml

@@ -33,11 +33,11 @@ kubeapps:
     image:
       registry: ghcr.io/aenix-io/cozystack
       repository: dashboard
-      tag: v0.16.5
+      tag: v0.15.0
       digest: "sha256:4818712e9fc9c57cc321512760c3226af564a04e69d4b3ec9229ab91fd39abeb"
   kubeappsapis:
     image:
       registry: ghcr.io/aenix-io/cozystack
       repository: kubeapps-apis
-      tag: v0.16.5
-      digest: "sha256:126bb6955ff142e7e00e712c037f3e97bd39b360641fba0b8ca8bc083d5e8224"
+      tag: v0.15.0
+      digest: "sha256:70c095c8f7e3ecfa11433a3a2c8f57f6ff5a0053f006939a2c171c180cc50baf"

packages/system/external-dns/.helmignore

@@ -1,3 +0,0 @@
-images
-hack
-.gitkeep

packages/system/external-dns/Chart.yaml

@@ -1,3 +0,0 @@
-apiVersion: v2
-name: cozy-external-dns
-version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process

packages/system/external-dns/Makefile

@@ -1,10 +0,0 @@
-export NAME=external-dns
-export NAMESPACE=cozy-$(NAME)
-
-include ../../../scripts/package.mk
-
-update:
-	rm -rf charts
-	helm repo add external-dns https://kubernetes-sigs.github.io/external-dns/
-	helm repo update external-dns
-	helm pull external-dns/external-dns --untar --untardir charts

packages/system/external-dns/charts/external-dns/.helmignore

@@ -1,23 +0,0 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*.orig
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/

packages/system/external-dns/charts/external-dns/CHANGELOG.md

@@ -1,219 +0,0 @@
-# ExternalDNS Helm Chart Changelog
-
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
----
-
-<!--
-### Added - For new features.
-### Changed - For changes in existing functionality.
-### Deprecated - For soon-to-be removed features.
-### Removed - For now removed features.
-### Fixed - For any bug fixes.
-### Security - In case of vulnerabilities.
--->
-
-## [UNRELEASED]
-
-## [v1.15.0] - 2023-09-10
-
-### Changed
-
-- Updated _ExternalDNS_ OCI image version to [v0.15.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.15.0). ([#xxxx](https://github.com/kubernetes-sigs/external-dns/pull/xxxx)) _@stevehipwell_
-
-### Fixed
-
-- Fixed `provider.webhook.resources` behavior to correctly leverage resource limits. ([#4560](https://github.com/kubernetes-sigs/external-dns/pull/4560)) _@crutonjohn_
-- Fixed `provider.webhook.imagePullPolicy` behavior to correctly leverage pull policy. ([#4643](https://github.com/kubernetes-sigs/external-dns/pull/4643)) _@kimsondrup_
-- Fixed to add correct webhook metric port to `Service` and `ServiceMonitor`. ([#4643](https://github.com/kubernetes-sigs/external-dns/pull/4643)) _@kimsondrup_
-- Fixed to no longer require the unauthenticated webhook provider port to be exposed for health probes. ([#4691](https://github.com/kubernetes-sigs/external-dns/pull/4691)) _@kimsondrup_ & _@hatrx_
-
-## [v1.14.5] - 2023-06-10
-
-### Added
-
-- Added support for `extraContainers` argument. ([#4432](https://github.com/kubernetes-sigs/external-dns/pull/4432)) _@omerap12_
-- Added support for setting `excludeDomains` argument.  ([#4380](https://github.com/kubernetes-sigs/external-dns/pull/4380)) _@bford-evs_
-
-### Changed
-
-- Updated _ExternalDNS_ OCI image version to [v0.14.2](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.14.2). ([#4541](https://github.com/kubernetes-sigs/external-dns/pull/4541)) _@stevehipwell_
-- Updated `DNSEndpoint` CRD. ([#4541](https://github.com/kubernetes-sigs/external-dns/pull/4541)) _@stevehipwell_
-- Changed the implementation for `revisionHistoryLimit` to be more generic. ([#4541](https://github.com/kubernetes-sigs/external-dns/pull/4541)) _@stevehipwell_
-
-### Fixed
-
-- Fixed the `ServiceMonitor` job name to correctly use the instance label. ([#4541](https://github.com/kubernetes-sigs/external-dns/pull/4541)) _@stevehipwell_
-
-## [v1.14.4] - 2023-04-03
-
-### Added
-
-- Added support for setting `dnsConfig`. ([#4265](https://github.com/kubernetes-sigs/external-dns/pull/4265)) _@davhdavh_
-- Added support for `DNSEndpoint` CRD. ([#4322](https://github.com/kubernetes-sigs/external-dns/pull/4322)) _@onedr0p_
-
-### Changed
-
-- Updated _ExternalDNS_ OCI image version to [v0.14.1](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.14.1). ([#4357](https://github.com/kubernetes-sigs/external-dns/pull/4357)) _@stevehipwell_
-
-## [v1.14.3] - 2023-01-26
-
-### Fixed
-
-- Fixed args for webhook deployment. ([#4202](https://github.com/kubernetes-sigs/external-dns/pull/4202)) [@webwurst](https://github.com/webwurst)
-- Fixed support for `gateway-grpcroute`, `gateway-tlsroute`, `gateway-tcproute` & `gateway-udproute`. ([#4205](https://github.com/kubernetes-sigs/external-dns/pull/4205)) [@orenlevi111](https://github.com/orenlevi111)
-- Fixed incorrect implementation for setting the `automountServiceAccountToken`. ([#4208](https://github.com/kubernetes-sigs/external-dns/pull/4208)) [@stevehipwell](https://github.com/stevehipwell)
-
-## [v1.14.2] - 2024-01-22
-
-### Fixed
-
-- Restore template support in `.Values.provider` and `.Values.provider.name`
-
-## [v1.14.1] - 2024-01-11
-
-### Fixed
-
-- Fixed webhook install failure: `"http-webhook-metrics": must be no more than 15 characters`. ([#4173](https://github.com/kubernetes-sigs/external-dns/pull/4173)) [@gabe565](https://github.com/gabe565)
-
-## [v1.14.0] - 2024-01-10
-
-### Added
-
-- Added the option to explicitly enable or disable service account token automounting. ([#3983](https://github.com/kubernetes-sigs/external-dns/pull/3983)) [@gilles-gosuin](https://github.com/gilles-gosuin)
-- Added the option to configure revisionHistoryLimit on the K8s Deployment resource. ([#4008](https://github.com/kubernetes-sigs/external-dns/pull/4008)) [@arnisoph](https://github.com/arnisoph)
-- Added support for webhook providers, as a sidecar. ([#4032](https://github.com/kubernetes-sigs/external-dns/pull/4032) [@mloiseleur](https://github.com/mloiseleur)
-- Added the option to configure ipFamilyPolicy and ipFamilies of external-dns Service.  ([#4153](https://github.com/kubernetes-sigs/external-dns/pull/4153)) [@dongjiang1989](https://github.com/dongjiang1989)
-
-### Changed
-
-- Avoid unnecessary pod restart on each helm chart version. ([#4103](https://github.com/kubernetes-sigs/external-dns/pull/4103)) [@jkroepke](https://github.com/jkroepke)
-- Updated _ExternalDNS_ OCI image version to [v0.14.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.14.0). ([#4073](https://github.com/kubernetes-sigs/external-dns/pull/4073)) [@appkins](https://github.com/appkins)
-
-### Deprecated
-
-- The `secretConfiguration` value has been deprecated in favour of creating secrets external to the Helm chart and configuring their use via the `extraVolumes` & `extraVolumeMounts` values. ([#4161](https://github.com/kubernetes-sigs/external-dns/pull/4161)) [@stevehipwell](https://github.com/stevehipwell)
-
-## [v1.13.1] - 2023-09-07
-
-### Added
-
-- Added RBAC for Traefik to ClusterRole. ([#3325](https://github.com/kubernetes-sigs/external-dns/pull/3325)) [@ThomasK33](https://github.com/thomask33)
-- Added support for init containers. ([#3325](https://github.com/kubernetes-sigs/external-dns/pull/3838)) [@calvinbui](https://github.com/calvinbui)
-
-### Changed
-
-- Disallowed privilege escalation in container security context and set the seccomp profile type to `RuntimeDefault`. ([#3689](https://github.com/kubernetes-sigs/external-dns/pull/3689)) [@nrvnrvn](https://github.com/nrvnrvn)
-- Updated _ExternalDNS_ OCI image version to [v0.13.6](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.13.6). ([#3917](https://github.com/kubernetes-sigs/external-dns/pull/3917)) [@stevehipwell](https://github.com/stevehipwell)
-
-### Removed
-
-- Removed RBAC rule for already removed `contour-ingressroute` source. ([#3764](https://github.com/kubernetes-sigs/external-dns/pull/3764)) [@johngmyers](https://github.com/johngmyers)
-
-## [v1.13.0] - 2023-03-30
-
-### All Changes
-
-- Updated _ExternalDNS_ version to [v0.13.5](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.13.5). ([#3661](https://github.com/kubernetes-sigs/external-dns/pull/3661)) [@GMartinez-Sisti](https://github.com/GMartinez-Sisti)
-- Adding missing gateway-httproute cluster role permission. ([#3541](https://github.com/kubernetes-sigs/external-dns/pull/3541)) [@nicon89](https://github.com/nicon89)
-
-## [v1.12.2] - 2023-03-30
-
-### All Changes
-
-- Added support for ServiceMonitor relabelling. ([#3366](https://github.com/kubernetes-sigs/external-dns/pull/3366)) [@jkroepke](https://github.com/jkroepke)
-- Updated chart icon path. ([#3492](https://github.com/kubernetes-sigs/external-dns/pull/3494)) [kundan2707](https://github.com/kundan2707)
-- Added RBAC for Gateway-API resources to ClusterRole. ([#3499](https://github.com/kubernetes-sigs/external-dns/pull/3499)) [@michaelvl](https://github.com/MichaelVL)
-- Added RBAC for F5 VirtualServer to ClusterRole. ([#3503](https://github.com/kubernetes-sigs/external-dns/pull/3503)) [@mikejoh](https://github.com/mikejoh)
-- Added support for running ExternalDNS with namespaced scope. ([#3403](https://github.com/kubernetes-sigs/external-dns/pull/3403)) [@jkroepke](https://github.com/jkroepke)
-- Updated _ExternalDNS_ version to [v0.13.4](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.13.4). ([#3516](https://github.com/kubernetes-sigs/external-dns/pull/3516)) [@stevehipwell](https://github.com/stevehipwell)
-
-## [v1.12.1] - 2023-02-06
-
-### All Changes
-
-- Updated _ExternalDNS_ version to [v0.13.2](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.13.2). ([#3371](https://github.com/kubernetes-sigs/external-dns/pull/3371)) [@stevehipwell](https://github.com/stevehipwell)
-- Added `secretConfiguration.subPath` to mount specific files from secret as a sub-path. ([#3227](https://github.com/kubernetes-sigs/external-dns/pull/3227)) [@jkroepke](https://github.com/jkroepke)
-- Changed to use `registry.k8s.io` instead of `k8s.gcr.io`. ([#3261](https://github.com/kubernetes-sigs/external-dns/pull/3261)) [@johngmyers](https://github.com/johngmyers)
-
-## [v1.12.0] - 2022-11-29
-
-### All Changes
-
-- Added ability to provide ExternalDNS with secret configuration via `secretConfiguration`. ([#3144](https://github.com/kubernetes-sigs/external-dns/pull/3144)) [@jkroepke](https://github.com/jkroepke)
-- Added the ability to template `provider` & `extraArgs`. ([#3144](https://github.com/kubernetes-sigs/external-dns/pull/3144)) [@jkroepke](https://github.com/jkroepke)
-- Added the ability to customise the service account labels. ([#3145](https://github.com/kubernetes-sigs/external-dns/pull/3145)) [@jkroepke](https://github.com/jkroepke)
-- Updated _ExternalDNS_ version to [v0.13.1](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.13.1). ([#3197](https://github.com/kubernetes-sigs/external-dns/pull/3197)) [@stevehipwell](https://github.com/stevehipwell)
-
-## [v1.11.0] - 2022-08-10
-
-### Added
-
-- Added support to configure `dnsPolicy` on the Helm chart deployment. [@michelzanini](https://github.com/michelzanini)
-- Added ability to customise the deployment strategy. [mac-chaffee](https://github.com/mac-chaffee)
-
-### Changed
-
-- Updated _ExternalDNS_ version to [v0.12.2](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.12.2). [@stevehipwell](https://github.com/stevehipwell)
-- Changed default deployment strategy to `Recreate`. [mac-chaffee](https://github.com/mac-chaffee)
-
-## [v1.10.1] - 2022-07-11
-
-### Fixed
-
-- Fixed incorrect addition of `namespace` to `ClusterRole` & `ClusterRoleBinding`. [@stevehipwell](https://github.com/stevehipwell)
-
-## [v1.10.0] - 2022-07-08
-
-### Added
-
-- Added `commonLabels` value to allow the addition of labels to all resources. [@stevehipwell](https://github.com/stevehipwell)
-- Added support for [Process Namespace Sharing](https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/) via the `shareProcessNamespace`
- value. ([#2715](https://github.com/kubernetes-sigs/external-dns/pull/2715)) [@wolffberg](https://github.com/wolffberg)
-
-### Changed
-
-- Update _ExternalDNS_ version to [v0.12.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.12.0). [@vojtechmares](https://github.com/vojtechmares)
-- Set resource namespaces to `{{ .Release.Namespace }}` in the templates instead of waiting until apply time for inference. [@stevehipwell](https://github.com/stevehipwell)
-- Fixed `rbac.additionalPermissions` default value.([#2796](https://github.com/kubernetes-sigs/external-dns/pull/2796)) [@tamalsaha](https://github.com/tamalsaha)
-
-## [v1.9.0] - 2022-04-19
-
-### Changed
-
-- Update _ExternalDNS_ version to [v0.11.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.11.0). ([#2690](https://github.com/kubernetes-sigs/external-dns/pull/2690)) [@stevehipwell](https://github.com/stevehipwell)
-
-## [v1.8.0] - 2022-04-13
-
-### Added
-
-- Add annotations to Deployment. ([#2477](https://github.com/kubernetes-sigs/external-dns/pull/2477)) [@beastob](https://github.com/beastob)
-
-### Changed
-
-- Fix RBAC for `istio-virtualservice` source when `istio-gateway` isn't also added. ([#2564](https://github.com/kubernetes-sigs/external-dns/pull/2564)) [@mcwarman](https://github.com/mcwarman)
-
-<!--
-RELEASE LINKS
--->
-[UNRELEASED]: https://github.com/kubernetes-sigs/external-dns/tree/master/charts/external-dns
-[v1.15.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.15.0
-[v1.14.5]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.14.5
-[v1.14.4]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.14.4
-[v1.14.3]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.14.3
-[v1.14.2]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.14.2
-[v1.14.1]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.14.1
-[v1.14.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.14.0
-[v1.13.1]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.13.1
-[v1.13.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.13.0
-[v1.12.2]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.12.2
-[v1.12.1]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.12.1
-[v1.12.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.12.0
-[v1.11.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.11.0
-[v1.10.1]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.10.1
-[v1.10.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.10.0
-[v1.9.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.9.0
-[v1.8.0]: https://github.com/kubernetes-sigs/external-dns/releases/tag/external-dns-helm-chart-1.8.0

packages/system/external-dns/charts/external-dns/Chart.yaml

@@ -1,33 +0,0 @@
-annotations:
-  artifacthub.io/changes: |
-    - kind: changed
-      description: "Updated _ExternalDNS_ OCI image version to [v0.15.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.15.0)."
-    - kind: fixed
-      description: "Fixed `provider.webhook.resources` behavior to correctly leverage resource limits."
-    - kind: fixed
-      description: "Fixed `provider.webhook.imagePullPolicy` behavior to correctly leverage pull policy."
-    - kind: fixed
-      description: "Fixed to add correct webhook metric port to `Service` and `ServiceMonitor`."
-    - kind: fixed
-      description: "Fixed to no longer require the unauthenticated webhook provider port to be exposed for health probes."
-apiVersion: v2
-appVersion: 0.15.0
-description: ExternalDNS synchronizes exposed Kubernetes Services and Ingresses with
-  DNS providers.
-home: https://github.com/kubernetes-sigs/external-dns/
-icon: https://github.com/kubernetes-sigs/external-dns/raw/master/docs/img/external-dns.png
-keywords:
-- kubernetes
-- externaldns
-- external-dns
-- dns
-- service
-- ingress
-maintainers:
-- email: steve.hipwell@gmail.com
-  name: stevehipwell
-name: external-dns
-sources:
-- https://github.com/kubernetes-sigs/external-dns/
-type: application
-version: 1.15.0

packages/system/external-dns/charts/external-dns/README.md

@@ -1,182 +0,0 @@
-# external-dns
-
-![Version: 1.15.0](https://img.shields.io/badge/Version-1.15.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.15.0](https://img.shields.io/badge/AppVersion-0.15.0-informational?style=flat-square)
-
-ExternalDNS synchronizes exposed Kubernetes Services and Ingresses with DNS providers.
-
-**Homepage:** <https://github.com/kubernetes-sigs/external-dns/>
-
-## Maintainers
-
-| Name | Email | Url |
-| ---- | ------ | --- |
-| stevehipwell | <steve.hipwell@gmail.com> |  |
-
-## Source Code
-
-* <https://github.com/kubernetes-sigs/external-dns/>
-
-## Installing the Chart
-
-Before you can install the chart you will need to add the `external-dns` repo to [Helm](https://helm.sh/).
-
-```shell
-helm repo add external-dns https://kubernetes-sigs.github.io/external-dns/
-```
-
-After you've installed the repo you can install the chart.
-
-```shell
-helm upgrade --install external-dns external-dns/external-dns --version 1.15.0
-```
-
-## Providers
-
-Configuring the _ExternalDNS_ provider should be done via the `provider.name` value with provider specific configuration being set via the `provider.<name>.<key>` values, where supported, and the `extraArgs` value. For legacy support `provider` can be set to the name of the provider with all additional configuration being set via the `extraArgs` value.
-See [documentation](https://kubernetes-sigs.github.io/external-dns/#new-providers) for more info on available providers and tutorials.
-
-### Providers with Specific Configuration Support
-
-| Provider               | Supported  |
-|------------------------|------------|
-| `webhook`              | ✅         |
-
-### Other Providers
-
-For set up for a specific provider using the Helm chart, see the following links:
-
-- [AWS](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/aws.md#using-helm-with-oidc)
-- [akamai-edgedns](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/akamai-edgedns.md#using-helm)
-- [cloudflare](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/cloudflare.md#using-helm)
-- [digitalocean](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/digitalocean.md#using-helm)
-- [godaddy](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/godaddy.md#using-helm)
-- [ns1](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/ns1.md#using-helm)
-- [plural](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/plural.md#using-helm)
-
-## Namespaced Scoped Installation
-
-external-dns supports running on a namespaced only scope, too.
-If `namespaced=true` is defined, the helm chart will setup `Roles` and `RoleBindings` instead `ClusterRoles` and `ClusterRoleBindings`.
-
-### Limited Supported
-
-Not all sources are supported in namespaced scope, since some sources depends on cluster-wide resources.
-For example: Source `node` isn't supported, since `kind: Node` has scope `Cluster`.
-Sources like `istio-virtualservice` only work, if all resources like `Gateway` and `VirtualService` are present in the same
-namespaces as `external-dns`.
-
-The annotation `external-dns.alpha.kubernetes.io/endpoints-type: NodeExternalIP` is not supported.
-
-If `namespaced` is set to `true`, please ensure that `sources` my only contains supported sources (Default: `service,ingress`).
-
-### Support Matrix
-
-| Source                 | Supported  | Infos                  |
-|------------------------|------------|------------------------|
-| `ingress`              | ✅         |                        |
-| `istio-gateway`        | ✅         |                        |
-| `istio-virtualservice` | ✅         |                        |
-| `crd`                  | ✅         |                        |
-| `kong-tcpingress`      | ✅         |                        |
-| `openshift-route`      | ✅         |                        |
-| `skipper-routegroup`   | ✅         |                        |
-| `gloo-proxy`           | ✅         |                        |
-| `contour-httpproxy`    | ✅         |                        |
-| `service`              | ⚠️️         | NodePort not supported |
-| `node`                 | ❌         |                        |
-| `pod`                  | ❌         |                        |
-
-## Values
-
-| Key | Type | Default | Description |
-|-----|------|---------|-------------|
-| affinity | object | `{}` | Affinity settings for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). If an explicit label selector is not provided for pod affinity or pod anti-affinity one will be created from the pod selector labels. |
-| automountServiceAccountToken | bool | `nil` | Set this to `false` to [opt out of API credential automounting](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the `Pod`. |
-| commonLabels | object | `{}` | Labels to add to all chart resources. |
-| deploymentAnnotations | object | `{}` | Annotations to add to the `Deployment`. |
-| deploymentStrategy | object | `{"type":"Recreate"}` | [Deployment Strategy](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy). |
-| dnsConfig | object | `nil` | [DNS config](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config) for the pod, if not set the default will be used. |
-| dnsPolicy | string | `nil` | [DNS policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy) for the pod, if not set the default will be used. |
-| domainFilters | list | `[]` |  |
-| env | list | `[]` | [Environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) for the `external-dns` container. |
-| excludeDomains | list | `[]` |  |
-| extraArgs | list | `[]` | Extra arguments to provide to _ExternalDNS_. |
-| extraContainers | object | `{}` | Extra containers to add to the `Deployment`. |
-| extraVolumeMounts | list | `[]` | Extra [volume mounts](https://kubernetes.io/docs/concepts/storage/volumes/) for the `external-dns` container. |
-| extraVolumes | list | `[]` | Extra [volumes](https://kubernetes.io/docs/concepts/storage/volumes/) for the `Pod`. |
-| fullnameOverride | string | `nil` | Override the full name of the chart. |
-| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy for the `external-dns` container. |
-| image.repository | string | `"registry.k8s.io/external-dns/external-dns"` | Image repository for the `external-dns` container. |
-| image.tag | string | `nil` | Image tag for the `external-dns` container, this will default to `.Chart.AppVersion` if not set. |
-| imagePullSecrets | list | `[]` | Image pull secrets. |
-| initContainers | list | `[]` | [Init containers](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) to add to the `Pod` definition. |
-| interval | string | `"1m"` | Interval for DNS updates. |
-| livenessProbe | object | See _values.yaml_ | [Liveness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `external-dns` container. |
-| logFormat | string | `"text"` | Log format. |
-| logLevel | string | `"info"` | Log level. |
-| nameOverride | string | `nil` | Override the name of the chart. |
-| namespaced | bool | `false` | if `true`, _ExternalDNS_ will run in a namespaced scope (`Role`` and `Rolebinding`` will be namespaced too). |
-| nodeSelector | object | `{}` | Node labels to match for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). |
-| podAnnotations | object | `{}` | Annotations to add to the `Pod`. |
-| podLabels | object | `{}` | Labels to add to the `Pod`. |
-| podSecurityContext | object | See _values.yaml_ | [Pod security context](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#podsecuritycontext-v1-core), this supports full customisation. |
-| policy | string | `"upsert-only"` | How DNS records are synchronized between sources and providers; available values are `sync` & `upsert-only`. |
-| priorityClassName | string | `nil` | Priority class name for the `Pod`. |
-| provider.name | string | `"aws"` | _ExternalDNS_ provider name; for the available providers and how to configure them see [README](https://github.com/kubernetes-sigs/external-dns/blob/master/charts/external-dns/README.md#providers). |
-| provider.webhook.args | list | `[]` | Extra arguments to provide for the `webhook` container. |
-| provider.webhook.env | list | `[]` | [Environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) for the `webhook` container. |
-| provider.webhook.extraVolumeMounts | list | `[]` | Extra [volume mounts](https://kubernetes.io/docs/concepts/storage/volumes/) for the `webhook` container. |
-| provider.webhook.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy for the `webhook` container. |
-| provider.webhook.image.repository | string | `nil` | Image repository for the `webhook` container. |
-| provider.webhook.image.tag | string | `nil` | Image tag for the `webhook` container. |
-| provider.webhook.livenessProbe | object | See _values.yaml_ | [Liveness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `external-dns` container. |
-| provider.webhook.readinessProbe | object | See _values.yaml_ | [Readiness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `webhook` container. |
-| provider.webhook.resources | object | `{}` | [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for the `webhook` container. |
-| provider.webhook.securityContext | object | See _values.yaml_ | [Pod security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) for the `webhook` container. |
-| provider.webhook.service.port | int | `8080` | Webhook exposed HTTP port for the service. |
-| provider.webhook.serviceMonitor | object | See _values.yaml_ | Optional [Service Monitor](https://prometheus-operator.dev/docs/operator/design/#servicemonitor) configuration for the `webhook` container. |
-| rbac.additionalPermissions | list | `[]` | Additional rules to add to the `ClusterRole`. |
-| rbac.create | bool | `true` | If `true`, create a `ClusterRole` & `ClusterRoleBinding` with access to the Kubernetes API. |
-| readinessProbe | object | See _values.yaml_ | [Readiness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) configuration for the `external-dns` container. |
-| registry | string | `"txt"` | Specify the registry for storing ownership and labels. Valid values are `txt`, `aws-sd`, `dynamodb` & `noop`. |
-| resources | object | `{}` | [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for the `external-dns` container. |
-| revisionHistoryLimit | int | `nil` | Specify the number of old `ReplicaSets` to retain to allow rollback of the `Deployment``. |
-| secretConfiguration.data | object | `{}` | `Secret` data. |
-| secretConfiguration.enabled | bool | `false` | If `true`, create a `Secret` to store sensitive provider configuration (**DEPRECATED**). |
-| secretConfiguration.mountPath | string | `nil` | Mount path for the `Secret`, this can be templated. |
-| secretConfiguration.subPath | string | `nil` | Sub-path for mounting the `Secret`, this can be templated. |
-| securityContext | object | See _values.yaml_ | [Security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) for the `external-dns` container. |
-| service.annotations | object | `{}` | Service annotations. |
-| service.ipFamilies | list | `[]` | Service IP families. |
-| service.ipFamilyPolicy | string | `nil` | Service IP family policy. |
-| service.port | int | `7979` | Service HTTP port. |
-| serviceAccount.annotations | object | `{}` | Annotations to add to the service account. |
-| serviceAccount.automountServiceAccountToken | string | `nil` | Set this to `false` to [opt out of API credential automounting](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the `ServiceAccount`. |
-| serviceAccount.create | bool | `true` | If `true`, create a new `ServiceAccount`. |
-| serviceAccount.labels | object | `{}` | Labels to add to the service account. |
-| serviceAccount.name | string | `nil` | If this is set and `serviceAccount.create` is `true` this will be used for the created `ServiceAccount` name, if set and `serviceAccount.create` is `false` then this will define an existing `ServiceAccount` to use. |
-| serviceMonitor.additionalLabels | object | `{}` | Additional labels for the `ServiceMonitor`. |
-| serviceMonitor.annotations | object | `{}` | Annotations to add to the `ServiceMonitor`. |
-| serviceMonitor.bearerTokenFile | string | `nil` | Provide a bearer token file for the `ServiceMonitor`. |
-| serviceMonitor.enabled | bool | `false` | If `true`, create a `ServiceMonitor` resource to support the _Prometheus Operator_. |
-| serviceMonitor.interval | string | `nil` | If set override the _Prometheus_ default interval. |
-| serviceMonitor.metricRelabelings | list | `[]` | [Metric relabel configs](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs) to apply to samples before ingestion. |
-| serviceMonitor.namespace | string | `nil` | If set create the `ServiceMonitor` in an alternate namespace. |
-| serviceMonitor.relabelings | list | `[]` | [Relabel configs](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config) to apply to samples before ingestion. |
-| serviceMonitor.scheme | string | `nil` | If set overrides the _Prometheus_ default scheme. |
-| serviceMonitor.scrapeTimeout | string | `nil` | If set override the _Prometheus_ default scrape timeout. |
-| serviceMonitor.targetLabels | list | `[]` | Provide target labels for the `ServiceMonitor`. |
-| serviceMonitor.tlsConfig | object | `{}` | Configure the `ServiceMonitor` [TLS config](https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#tlsconfig). |
-| shareProcessNamespace | bool | `false` | If `true`, the `Pod` will have [process namespace sharing](https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/) enabled. |
-| sources | list | `["service","ingress"]` | _Kubernetes_ resources to monitor for DNS entries. |
-| terminationGracePeriodSeconds | int | `nil` | Termination grace period for the `Pod` in seconds. |
-| tolerations | list | `[]` | Node taints which will be tolerated for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). |
-| topologySpreadConstraints | list | `[]` | Topology spread constraints for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). If an explicit label selector is not provided one will be created from the pod selector labels. |
-| triggerLoopOnEvent | bool | `false` | If `true`, triggers run loop on create/update/delete events in addition of regular interval. |
-| txtOwnerId | string | `nil` | Specify an identifier for this instance of _ExternalDNS_ wWhen using a registry other than `noop`. |
-| txtPrefix | string | `nil` | Specify a prefix for the domain names of TXT records created for the `txt` registry. Mutually exclusive with `txtSuffix`. |
-| txtSuffix | string | `nil` | Specify a suffix for the domain names of TXT records created for the `txt` registry. Mutually exclusive with `txtPrefix`. |
-
-----------------------------------------------
-
-Autogenerated from chart metadata using [helm-docs](https://github.com/norwoodj/helm-docs/).

packages/system/external-dns/charts/external-dns/README.md.gotmpl

@@ -1,91 +0,0 @@
-{{ template "chart.header" . }}
-{{ template "chart.deprecationWarning" . }}
-
-{{ template "chart.badgesSection" . }}
-
-{{ template "chart.description" . }}
-
-{{ template "chart.homepageLine" . }}
-
-{{ template "chart.maintainersSection" . }}
-
-{{ template "chart.sourcesSection" . }}
-
-## Installing the Chart
-
-Before you can install the chart you will need to add the `external-dns` repo to [Helm](https://helm.sh/).
-
-```shell
-helm repo add external-dns https://kubernetes-sigs.github.io/external-dns/
-```
-
-After you've installed the repo you can install the chart.
-
-```shell
-helm upgrade --install {{ template "chart.name" . }} external-dns/{{ template "chart.name" . }} --version {{ template "chart.version" . }}
-```
-
-## Providers
-
-Configuring the _ExternalDNS_ provider should be done via the `provider.name` value with provider specific configuration being set via the `provider.<name>.<key>` values, where supported, and the `extraArgs` value. For legacy support `provider` can be set to the name of the provider with all additional configuration being set via the `extraArgs` value.
-See [documentation](https://kubernetes-sigs.github.io/external-dns/#new-providers) for more info on available providers and tutorials.
-
-### Providers with Specific Configuration Support
-
-| Provider               | Supported  |
-|------------------------|------------|
-| `webhook`              | ✅         |
-
-### Other Providers
-
-For set up for a specific provider using the Helm chart, see the following links:
-
-- [AWS](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/aws.md#using-helm-with-oidc)
-- [akamai-edgedns](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/akamai-edgedns.md#using-helm)
-- [cloudflare](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/cloudflare.md#using-helm)
-- [digitalocean](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/digitalocean.md#using-helm)
-- [godaddy](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/godaddy.md#using-helm)
-- [ns1](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/ns1.md#using-helm)
-- [plural](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/plural.md#using-helm)
-
-## Namespaced Scoped Installation
-
-external-dns supports running on a namespaced only scope, too.
-If `namespaced=true` is defined, the helm chart will setup `Roles` and `RoleBindings` instead `ClusterRoles` and `ClusterRoleBindings`.
-
-### Limited Supported
-
-Not all sources are supported in namespaced scope, since some sources depends on cluster-wide resources.
-For example: Source `node` isn't supported, since `kind: Node` has scope `Cluster`.
-Sources like `istio-virtualservice` only work, if all resources like `Gateway` and `VirtualService` are present in the same
-namespaces as `external-dns`.
-
-The annotation `external-dns.alpha.kubernetes.io/endpoints-type: NodeExternalIP` is not supported.
-
-If `namespaced` is set to `true`, please ensure that `sources` my only contains supported sources (Default: `service,ingress`).
-
-### Support Matrix
-
-| Source                 | Supported  | Infos                  |
-|------------------------|------------|------------------------|
-| `ingress`              | ✅         |                        |
-| `istio-gateway`        | ✅         |                        |
-| `istio-virtualservice` | ✅         |                        |
-| `crd`                  | ✅         |                        |
-| `kong-tcpingress`      | ✅         |                        |
-| `openshift-route`      | ✅         |                        |
-| `skipper-routegroup`   | ✅         |                        |
-| `gloo-proxy`           | ✅         |                        |
-| `contour-httpproxy`    | ✅         |                        |
-| `service`              | ⚠️️         | NodePort not supported |
-| `node`                 | ❌         |                        |
-| `pod`                  | ❌         |                        |
-
-
-{{ template "chart.requirementsSection" . }}
-
-{{ template "chart.valuesSection" . }}
-
-----------------------------------------------
-
-Autogenerated from chart metadata using [helm-docs](https://github.com/norwoodj/helm-docs/).

packages/system/external-dns/charts/external-dns/RELEASE.md

@@ -1,10 +0,0 @@
-### Changed
-
-- Updated _ExternalDNS_ OCI image version to [v0.15.0](https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.15.0). ([#xxxx](https://github.com/kubernetes-sigs/external-dns/pull/xxxx)) _@stevehipwell_
-
-### Fixed
-
-- Fixed `provider.webhook.resources` behavior to correctly leverage resource limits. ([#4560](https://github.com/kubernetes-sigs/external-dns/pull/4560)) _@crutonjohn_
-- Fixed `provider.webhook.imagePullPolicy` behavior to correctly leverage pull policy. ([#4643](https://github.com/kubernetes-sigs/external-dns/pull/4643)) _@kimsondrup_
-- Fixed to add correct webhook metric port to `Service` and `ServiceMonitor`. ([#4643](https://github.com/kubernetes-sigs/external-dns/pull/4643)) _@kimsondrup_
-- Fixed to no longer require the unauthenticated webhook provider port to be exposed for health probes. ([#4691](https://github.com/kubernetes-sigs/external-dns/pull/4691)) _@kimsondrup_ & _@hatrx_

packages/system/external-dns/charts/external-dns/ci/ci-values.yaml

@@ -1,2 +0,0 @@
-provider:
-  name: inmemory