Release v0.33.1 (#1166)

This PR prepares the release `v0.33.1`.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated container image tags and digests across multiple components to
newer patch versions, including cluster-autoscaler,
kubevirt-cloud-provider, kubevirt-csi-driver, cozystack installer, e2e
testing service, matchbox, s3manager, cozystackAPI,
cozystack-controller, dashboard, kubeapps, Kamaji, kubeovn-webhook,
kubeovn, and kubevirt-csi-node.
* Updated related configuration files to reflect the new image versions
and digests.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

internal/controller/system_helm_reconciler.go

@@ -11,9 +11,7 @@ import (
 	helmv2 "github.com/fluxcd/helm-controller/api/v2"
 	corev1 "k8s.io/api/core/v1"
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/event"
@@ -79,158 +77,6 @@ func (r *CozystackConfigReconciler) Reconcile(ctx context.Context, _ ctrl.Reques
 	}
 
 	log.Info("finished reconciliation", "updatedHelmReleases", updated)
-
-	// Check if oidc-enabled has changed from true to false
-	oidcDisabled, err := r.checkOIDCDisabledTransition(ctx)
-	if err != nil {
-		log.Error(err, "failed to check OIDC status")
-	}
-
-	if oidcDisabled {
-		type crdToDelete struct {
-			kind      string
-			name      string
-			namespace string
-			gvk       schema.GroupVersionKind
-		}
-
-		crds := []crdToDelete{
-			{
-				kind:      "ClusterKeycloak",
-				name:      "keycloak-cozy",
-				namespace: "cozy-keycloak",
-				gvk:       schema.GroupVersionKind{Group: "v1.edp.epam.com", Version: "v1alpha1", Kind: "ClusterKeycloak"},
-			},
-			{
-				kind:      "ClusterKeycloakRealm",
-				name:      "keycloakrealm-cozy",
-				namespace: "cozy-keycloak",
-				gvk:       schema.GroupVersionKind{Group: "v1.edp.epam.com", Version: "v1alpha1", Kind: "ClusterKeycloakRealm"},
-			},
-			{
-				kind:      "KeycloakClient",
-				name:      "keycloakclient",
-				namespace: "cozy-keycloak",
-				gvk:       schema.GroupVersionKind{Group: "v1.edp.epam.com", Version: "v1", Kind: "KeycloakClient"},
-			},
-			{
-				kind:      "KeycloakClient",
-				name:      "kubeapps-client",
-				namespace: "cozy-keycloak",
-				gvk:       schema.GroupVersionKind{Group: "v1.edp.epam.com", Version: "v1", Kind: "KeycloakClient"},
-			},
-			{
-				kind:      "KeycloakClientScope",
-				name:      "keycloakclientscope-cozy",
-				namespace: "cozy-keycloak",
-				gvk:       schema.GroupVersionKind{Group: "v1.edp.epam.com", Version: "v1", Kind: "KeycloakClientScope"},
-			},
-			{
-				kind:      "KeycloakClientScope",
-				name:      "kubernetes-client",
-				namespace: "cozy-keycloak",
-				gvk:       schema.GroupVersionKind{Group: "v1.edp.epam.com", Version: "v1", Kind: "KeycloakClientScope"},
-			},
-			{
-				kind:      "KeycloakRealmGroup",
-				name:      "cozystack-cluster-admin",
-				namespace: "cozy-system",
-				gvk:       schema.GroupVersionKind{Group: "v1.edp.epam.com", Version: "v1", Kind: "KeycloakRealmGroup"},
-			},
-		}
-
-		for _, crd := range crds {
-			u := &unstructured.Unstructured{}
-			u.SetGroupVersionKind(crd.gvk)
-			u.SetName(crd.name)
-			u.SetNamespace(crd.namespace)
-
-			if err := r.Get(ctx, client.ObjectKeyFromObject(u), u); err != nil {
-				if kerrors.IsNotFound(err) {
-					continue
-				}
-				log.Error(err, "failed to get "+crd.kind, "name", crd.name)
-				continue
-			}
-
-			if finalizers := u.GetFinalizers(); len(finalizers) > 0 {
-				u.SetFinalizers(nil)
-				if err := r.Update(ctx, u); err != nil {
-					log.Error(err, "failed to remove finalizers from "+crd.kind, "name", crd.name)
-					continue
-				}
-				log.Info("removed finalizers from "+crd.kind, "name", crd.name)
-			}
-
-			if err := r.Delete(ctx, u); err != nil && !kerrors.IsNotFound(err) {
-				log.Error(err, "failed to delete "+crd.kind, "name", crd.name)
-				continue
-			}
-			log.Info("deleted "+crd.kind, "name", crd.name)
-		}
-
-		for _, name := range []string{"keycloak-configure", "keycloak-operator", "keycloak"} {
-			hr := &helmv2.HelmRelease{}
-			key := client.ObjectKey{Name: name, Namespace: "cozy-keycloak"}
-
-			err := r.Get(ctx, key, hr)
-			if err != nil {
-				if kerrors.IsNotFound(err) {
-					log.Info("HelmRelease already deleted", "name", name)
-					continue
-				}
-				log.Error(err, "failed to get HelmRelease", "name", name)
-				return ctrl.Result{}, err
-			}
-
-			if err := r.Delete(ctx, hr); err != nil {
-				log.Error(err, "failed to delete HelmRelease", "name", name)
-				return ctrl.Result{}, err
-			}
-			log.Info("deletion requested for HelmRelease", "name", name)
-
-			timeout := time.After(30 * time.Second)
-			tick := time.Tick(1 * time.Second)
-		WAIT_LOOP:
-			for {
-				select {
-				case <-timeout:
-					log.Error(fmt.Errorf("timeout"), "waiting for HelmRelease to be deleted", "name", name)
-					return ctrl.Result{RequeueAfter: 10 * time.Second}, nil
-				case <-tick:
-					err := r.Get(ctx, key, &helmv2.HelmRelease{})
-					if kerrors.IsNotFound(err) {
-						log.Info("HelmRelease deletion confirmed", "name", name)
-						break WAIT_LOOP
-					} else if err != nil {
-						log.Error(err, "error checking HelmRelease deletion", "name", name)
-						return ctrl.Result{}, err
-					}
-				}
-			}
-		}
-		ns := &corev1.Namespace{}
-		nsKey := client.ObjectKey{Name: "cozy-keycloak"}
-
-		if err := r.Get(ctx, nsKey, ns); err != nil {
-			if kerrors.IsNotFound(err) {
-				log.Info("Namespace cozy-keycloak already deleted")
-			} else {
-				log.Error(err, "failed to get namespace cozy-keycloak")
-				return ctrl.Result{}, err
-			}
-		} else {
-			if ns.DeletionTimestamp == nil {
-				if err := r.Delete(ctx, ns); err != nil {
-					log.Error(err, "failed to delete namespace cozy-keycloak")
-					return ctrl.Result{}, err
-				}
-				log.Info("deletion requested for namespace cozy-keycloak")
-			} else {
-				log.Info("namespace cozy-keycloak is already being deleted")
-			}
-		}
-	}
 	return ctrl.Result{}, nil
 }
 
@@ -242,11 +88,12 @@ func (r *CozystackConfigReconciler) computeDigest(ctx context.Context) (string,
 		err := r.Get(ctx, client.ObjectKey{Namespace: configMapNamespace, Name: name}, &cm)
 		if err != nil {
 			if kerrors.IsNotFound(err) {
-				continue
+				continue // ignore missing
 			}
 			return "", err
 		}
 
+		// Sort keys for consistent hashing
 		var keys []string
 		for k := range cm.Data {
 			keys = append(keys, k)
@@ -290,34 +137,3 @@ func contains(slice []string, val string) bool {
 	}
 	return false
 }
-
-func (r *CozystackConfigReconciler) checkOIDCDisabledTransition(ctx context.Context) (bool, error) {
-	const configName = "cozystack"
-	const fieldKey = "oidc-enabled"
-	const lastOIDCStateAnnotation = "cozystack.io/last-oidc-enabled"
-
-	var cm corev1.ConfigMap
-	if err := r.Get(ctx, client.ObjectKey{Namespace: configMapNamespace, Name: configName}, &cm); err != nil {
-		return false, err
-	}
-
-	current := cm.Data[fieldKey]
-	if current != "false" && current != "true" {
-		return false, nil
-	}
-
-	last := cm.Annotations[lastOIDCStateAnnotation]
-
-	if cm.Annotations == nil {
-		cm.Annotations = map[string]string{}
-	}
-	if last != current {
-		patch := client.MergeFrom(cm.DeepCopy())
-		cm.Annotations[lastOIDCStateAnnotation] = current
-		if err := r.Patch(ctx, &cm, patch); err != nil {
-			return false, fmt.Errorf("failed to update oidc-enabled annotation: %w", err)
-		}
-	}
-
-	return last == "true" && current == "false", nil
-}

packages/apps/kubernetes/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.25.0
+version: 0.25.1
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

packages/apps/kubernetes/Makefile

@@ -64,6 +64,8 @@ image-kubevirt-csi-driver:
 		--load=$(LOAD)
 	echo "$(REGISTRY)/kubevirt-csi-driver:$(call settag,$(KUBERNETES_PKG_TAG))@$$(yq e '."containerimage.digest"' images/kubevirt-csi-driver.json -o json -r)" \
 		> images/kubevirt-csi-driver.tag
+	IMAGE=$$(cat images/kubevirt-csi-driver.tag) \
+		yq -i '.csiDriver.image = strenv(IMAGE)' ../../system/kubevirt-csi-node/values.yaml
 	rm -f images/kubevirt-csi-driver.json
 
 

packages/apps/kubernetes/images/cluster-autoscaler.tag

@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/cluster-autoscaler:0.25.0@sha256:3a8170433e1632e5cc2b6d9db34d0605e8e6c63c158282c38450415e700e932e
+ghcr.io/cozystack/cozystack/cluster-autoscaler:0.25.1@sha256:3a8170433e1632e5cc2b6d9db34d0605e8e6c63c158282c38450415e700e932e

packages/apps/kubernetes/images/kubevirt-cloud-provider.tag

@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-cloud-provider:0.25.0@sha256:412ed2b3c77249bd1b973e6dc9c87976d31863717fb66ba74ccda573af737eb1
+ghcr.io/cozystack/cozystack/kubevirt-cloud-provider:0.25.1@sha256:412ed2b3c77249bd1b973e6dc9c87976d31863717fb66ba74ccda573af737eb1

packages/apps/kubernetes/images/kubevirt-csi-driver.tag

@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.25.0@sha256:445c2727b04ac68595b43c988ff17b3d69a7b22b0644fde3b10c65b47a7bc036
+ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.25.1@sha256:445c2727b04ac68595b43c988ff17b3d69a7b22b0644fde3b10c65b47a7bc036

packages/apps/kubernetes/templates/csi/infra-cluster-service-account.yaml

@@ -13,11 +13,17 @@ rules:
   resources: ["datavolumes"]
   verbs: ["get", "create", "delete"]
 - apiGroups: ["kubevirt.io"]
-  resources: ["virtualmachineinstances"]
+  resources: ["virtualmachineinstances", "virtualmachines"]
   verbs: ["list", "get"]
 - apiGroups: ["subresources.kubevirt.io"]
-  resources: ["virtualmachineinstances/addvolume", "virtualmachineinstances/removevolume"]
+  resources: ["virtualmachines/addvolume", "virtualmachines/removevolume"]
   verbs: ["update"]
+- apiGroups: ["snapshot.storage.k8s.io"]
+  resources: ["volumesnapshots"]
+  verbs: ["get", "create", "delete"]
+- apiGroups: [""]
+  resources: ["persistentvolumeclaims"]
+  verbs: ["get", "patch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding

packages/apps/postgres/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.16.0
+version: 0.17.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

packages/apps/postgres/templates/init-script.yaml

@@ -38,7 +38,7 @@ stringData:
     until pg_isready ; do sleep 5; done
 
     echo "== create users"
-    {{- if .Values.users }}
+    {{- if and .Values.users (not (hasKey .Values.users "postgres")) }}
     psql -v ON_ERROR_STOP=1 <<\EOT
     {{- range $user, $u := .Values.users }}
     SELECT 'CREATE ROLE "{{ $user }}" LOGIN INHERIT;'
@@ -47,6 +47,8 @@ stringData:
     COMMENT ON ROLE "{{ $user }}" IS 'user managed by helm';
     {{- end }}
     EOT
+    {{- else if and .Values.users (hasKey .Values.users "postgres") }}
+    {{- fail "`users.postgres` is forbidden by policy. Use a different username." }}
     {{- end }}
 
     echo "== delete users"

packages/apps/versions_map

@@ -54,7 +54,8 @@ kafka 0.7.0 6358fd7a
 kafka 0.7.1 4369b031
 kafka 0.8.0 HEAD
 kubernetes 0.24.0 62cb694d
-kubernetes 0.25.0 HEAD
+kubernetes 0.25.0 70f82667
+kubernetes 0.25.1 HEAD
 mysql 0.1.0 263e47be
 mysql 0.2.0 c24a103f
 mysql 0.3.0 53f2365e
@@ -101,7 +102,8 @@ postgres 0.12.0 6130f43d
 postgres 0.12.1 632224a3
 postgres 0.14.0 62cb694d
 postgres 0.15.1 4369b031
-postgres 0.16.0 HEAD
+postgres 0.16.0 70f82667
+postgres 0.17.0 HEAD
 rabbitmq 0.1.0 263e47be
 rabbitmq 0.2.0 53f2365e
 rabbitmq 0.3.0 6c5cf5bf

packages/core/installer/values.yaml

@@ -1,2 +1,2 @@
 cozystack:
-  image: ghcr.io/cozystack/cozystack/installer:v0.33.0@sha256:6cdc5d9062b536929152214e8a6a6b8096b64a17592e04a3633f58d21ff43a63
+  image: ghcr.io/cozystack/cozystack/installer:v0.33.1@sha256:03a0002be9cf5926643c295bbf05c3e250401b0f0595b9fcd147d53534f368f5

packages/core/platform/bundles/paas-full.yaml

@@ -354,7 +354,7 @@ releases:
   optional: true
   dependsOn: [cilium,kubeovn]
 
-{{- if eq $oidcEnabled "true" }}
+{{- if $oidcEnabled }}
 - name: keycloak
   releaseName: keycloak
   chart: cozy-keycloak

packages/core/platform/bundles/paas-hosted.yaml

@@ -182,7 +182,7 @@ releases:
   dependsOn: []
   {{- end }}
 
-{{- if eq $oidcEnabled "true" }}
+{{- if $oidcEnabled }}
 - name: keycloak
   releaseName: keycloak
   chart: cozy-keycloak

packages/core/testing/values.yaml

@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v0.33.0@sha256:fd169ae7ee7b0b10ee34f02353ae96c182ca7b6cede771c8fc6539894416104f
+  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v0.33.1@sha256:eed183a4104b1c142f6c4a358338749efe73baefddd53d7fe4c7149ecb892ce1

packages/extra/bootbox/images/matchbox.tag

@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/matchbox:v0.33.0@sha256:adc133234a48f3496441334348aeab400ee29b8514129c110b892fa1e0dff1d8
+ghcr.io/cozystack/cozystack/matchbox:v0.33.1@sha256:ca3638c620215ace26ace3f7e8b27391847ab2158b5a67f070f43dcbea071532

packages/system/bucket/images/s3manager.tag

@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/s3manager:v0.5.0@sha256:2759763d35ba35144ba10ba4d2b9effd875f4f0d01d9694b010f491ba6eb6d46
+ghcr.io/cozystack/cozystack/s3manager:v0.5.0@sha256:b748d9add5fc4080b143d8690ca1ad851d911948ac8eb296dd9005d53d153c05

packages/system/cozystack-api/values.yaml

@@ -1,2 +1,2 @@
 cozystackAPI:
-  image: ghcr.io/cozystack/cozystack/cozystack-api:v0.33.0@sha256:d9bee0e9f73a950784e43d907552c21044d01eed728e1185455308e49d00c00d
+  image: ghcr.io/cozystack/cozystack/cozystack-api:v0.33.1@sha256:ee6b71d3ab1c1484490ff1dc57a7df82813c4f18d6393f149d32acf656aa779d

packages/system/cozystack-controller/values.yaml

@@ -1,5 +1,5 @@
 cozystackController:
-  image: ghcr.io/cozystack/cozystack/cozystack-controller:v0.33.0@sha256:a1fceb277007846bc85ceee0afd1f5d1122496174203c718c1275a1038cb07f6
+  image: ghcr.io/cozystack/cozystack/cozystack-controller:v0.33.1@sha256:4777488e14f0313b153b153388c78ab89e3a39582c30266f2321704df1976922
   debug: false
   disableTelemetry: false
-  cozystackVersion: "v0.33.0"
+  cozystackVersion: "v0.33.1"

packages/system/dashboard/charts/kubeapps/templates/dashboard/configmap.yaml

@@ -76,7 +76,7 @@ data:
       "kubeappsNamespace": {{ .Release.Namespace | quote }},
       "helmGlobalNamespace": {{ include "kubeapps.helmGlobalPackagingNamespace" . | quote }},
       "carvelGlobalNamespace": {{ .Values.kubeappsapis.pluginConfig.kappController.packages.v1alpha1.globalPackagingNamespace | quote }},
-      "appVersion": "v0.33.0",
+      "appVersion": "v0.33.1",
       "authProxyEnabled": {{ .Values.authProxy.enabled }},
       "oauthLoginURI": {{ .Values.authProxy.oauthLoginURI | quote }},
       "oauthLogoutURI": {{ .Values.authProxy.oauthLogoutURI | quote }},

packages/system/dashboard/values.yaml

@@ -19,7 +19,7 @@ kubeapps:
     image:
       registry: ghcr.io/cozystack/cozystack
       repository: dashboard
-      tag: v0.33.0
+      tag: v0.33.1
       digest: "sha256:5e514516bd3dc0c693bb346ddeb9740e0439a59deb2a56b87317286e3ce79ac9"
   redis:
     master:
@@ -37,8 +37,8 @@ kubeapps:
     image:
       registry: ghcr.io/cozystack/cozystack
       repository: kubeapps-apis
-      tag: v0.33.0
-      digest: "sha256:8c60134b9216e0cd8ffc044c14c872b76c1a95879b4cf7887541980ade9e8c65"
+      tag: v0.33.1
+      digest: "sha256:ea5b21a27c97b14880042d2a642670e3461e7d946c65b5b557d2eb8df9f03a87"
     pluginConfig:
       flux:
         packages:

packages/system/kamaji/values.yaml

@@ -3,7 +3,7 @@ kamaji:
     deploy: false
   image:
     pullPolicy: IfNotPresent
-    tag: v0.33.0@sha256:afaf5f003eb990377c21623d17bb00e7a95a1021e1c36b318cb451b80c8d37a2
+    tag: v0.33.1@sha256:09fc5c9aeb97880780abfc6d82c216725d6f79e13494bf2399766c882b88f66b
     repository: ghcr.io/cozystack/cozystack/kamaji
   resources:
     limits:

packages/system/kubeovn-webhook/values.yaml

@@ -1,3 +1,3 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v0.33.0@sha256:926fa45edd2149e4bc4bb54710832c8fb7aa46c85cf6adb7cd486e0b956cdbfa
+image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v0.33.1@sha256:595851560856e3ba7f408f259acf84599494984a9f0252de289bcb1a7fc5b9da

packages/system/kubeovn/values.yaml

@@ -64,4 +64,4 @@ global:
   images:
     kubeovn:
       repository: kubeovn
-      tag: v1.13.13@sha256:6315d11876b78f3c24e54a73063d05c63137c4210dcd7620bd983db5fedf469a
+      tag: v1.13.13@sha256:c0ffc9a0498b6f8fc392f8fc6ea43d0c7eedeeabda8ef96bca004ec4466a6bf2

packages/system/kubevirt-csi-node/templates/deploy.yaml

@@ -163,7 +163,7 @@ spec:
             privileged: true
             allowPrivilegeEscalation: true
           imagePullPolicy: Always
-          image: ghcr.io/kvaps/test:kubevirt-csi-driver
+          image: {{ .Values.csiDriver.image }}
           args:
             - "--endpoint=unix:/csi/csi.sock"
             - "--node-name=$(KUBE_NODE_NAME)"

packages/system/kubevirt-csi-node/values.yaml

@@ -1 +1,3 @@
 storageClass: replicated
+csiDriver:
+  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.25.1@sha256:445c2727b04ac68595b43c988ff17b3d69a7b22b0644fde3b10c65b47a7bc036