Remove user-facing config of limits and requests

This patch introduces reusable library charts that provide backward-compatibility for users that specify their resources as explicit requests and limits for cpu, however this input is processed so that limits are set equal to requests except for CPU which only gets requests. Users can now embrace the new form by directly specifying resources in the first level of nesting (e.g. resources.cpu=100m instead of .resources.requests.cpu=100m). The order of precedence is top-level, then requests, then limits, ensuring that nothing will break in terms of scheduling, however workloads that specified limits much higher than requests might get a performance hit, now that they cannot use all this excess capacity. This should only affect memory-hungry workloads in low-contention environments. Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
Don't overcommit memory or throttle CPU
2026-04-05 08:05:38 +00:00 · 2025-05-12 19:00:01 +03:00 · 2025-05-12 15:59:28 +03:00 · 2025-05-12 13:08:00 +04:00 · 2025-05-08 19:04:48 +03:00 · 2025-05-08 19:04:48 +03:00
100 changed files with 713 additions and 692 deletions
--- a/2
+++ b/2
@@ -20,7 +20,6 @@ build: build-deps
 	make -C packages/system/kubeovn image
 	make -C packages/system/kubeovn-webhook image
 	make -C packages/system/dashboard image
-	make -C packages/system/metallb image
 	make -C packages/system/kamaji image
 	make -C packages/system/bucket image
 	make -C packages/core/testing image
@@ -29,6 +28,7 @@ build: build-deps

 repos:
 	rm -rf _out
+	make -C packages/library check-version-map
 	make -C packages/apps check-version-map
 	make -C packages/extra check-version-map
 	make -C packages/system repo
--- a/hack/e2e.sh
+++ b/hack/e2e.sh
@@ -334,8 +334,8 @@ if ! kubectl wait --timeout=2m --for=condition=ready -n tenant-root hr monitorin
  kubectl wait --timeout=2m --for=condition=ready -n tenant-root hr monitoring
 fi

-kubectl patch -n cozy-system cm cozystack --type=merge -p '{"data":{
-  "expose-services": "api,dashboard,cdi-uploadproxy,vm-exportproxy,keycloak"
+kubectl patch -n tenant-root ingresses.apps.cozystack.io ingress --type=merge -p '{"spec":{
+  "dashboard": true
 }}'

 # Wait for nginx-ingress-controller
--- a/packages/apps/clickhouse/Chart.yaml
+++ b/packages/apps/clickhouse/Chart.yaml
@@ -16,10 +16,15 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.8.0
+version: 0.9.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
 appVersion: "24.9.2"
+
+dependencies:
+  - name: cozy-lib
+    version: 0.1.0
+    repository: "http://cozystack.cozy-system.svc/repos/library"
--- a/packages/apps/clickhouse/Makefile
+++ b/packages/apps/clickhouse/Makefile
@@ -7,10 +7,8 @@ generate:
 	readme-generator -v values.yaml -s values.schema.json -r README.md

 image:
-	docker buildx build images/clickhouse-backup \
+	docker buildx build --platform linux/amd64 --build-arg ARCH=amd64 images/clickhouse-backup \
 		--provenance false \
-		--builder=$(BUILDER) \
-		--platform=$(PLATFORM) \
 		--tag $(REGISTRY)/clickhouse-backup:$(call settag,$(CLICKHOUSE_BACKUP_TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/clickhouse-backup:latest \
 		--cache-to type=inline \
--- a/packages/apps/clickhouse/charts/cozy-lib
+++ b/packages/apps/clickhouse/charts/cozy-lib
@@ -0,0 +1 @@
+../../../library/cozy-lib
--- a/packages/apps/clickhouse/templates/clickhouse.yaml
+++ b/packages/apps/clickhouse/templates/clickhouse.yaml
@@ -122,9 +122,9 @@ spec:
            - name: clickhouse
              image: clickhouse/clickhouse-server:24.9.2.42
              {{- if .Values.resources }}
-              resources: {{- toYaml .Values.resources | nindent 16 }}
+              resources: {{- include "cozy-lib.resources.sanitize" .Values.resources | nindent 16 }}
              {{- else if ne .Values.resourcesPreset "none" }}
-              resources: {{- include "resources.preset" (dict "type" .Values.resourcesPreset "Release" .Release) | nindent 16 }}
+              resources: {{- include "cozy-lib.resources.preset" .Values.resourcesPreset | nindent 16 }}
              {{- end }}
              volumeMounts:
                - name: data-volume-template
--- a/packages/apps/http-cache/Makefile
+++ b/packages/apps/http-cache/Makefile
@@ -6,10 +6,8 @@ include ../../../scripts/package.mk
 image: image-nginx

 image-nginx:
-	docker buildx build images/nginx-cache \
+	docker buildx build --platform linux/amd64 --build-arg ARCH=amd64 images/nginx-cache \
 		--provenance false \
-		--builder=$(BUILDER) \
-		--platform=$(PLATFORM) \
 		--tag $(REGISTRY)/nginx-cache:$(call settag,$(NGINX_CACHE_TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/nginx-cache:latest \
 		--cache-to type=inline \
--- a/packages/apps/http-cache/images/nginx-cache/Dockerfile
+++ b/packages/apps/http-cache/images/nginx-cache/Dockerfile
@@ -1,4 +1,4 @@
-FROM ubuntu:22.04 AS stage
+FROM ubuntu:22.04 as stage

 ARG NGINX_VERSION=1.25.3
 ARG IP2LOCATION_C_VERSION=8.6.1
@@ -9,15 +9,11 @@ ARG FIFTYONEDEGREES_NGINX_VERSION=3.2.21.1
 ARG NGINX_CACHE_PURGE_VERSION=2.5.3
 ARG NGINX_VTS_VERSION=0.2.2

-ARG TARGETOS
-ARG TARGETARCH
-
 # Install required packages for development
-RUN apt update -q \
- && apt install -yq --no-install-recommends \
-    ca-certificates \
+RUN apt-get update -q \
+ && apt-get install -yq \
    unzip \
-    automake \
+    autoconf \
    build-essential \
    libtool \
    libpcre3 \
@@ -72,7 +68,7 @@ RUN checkinstall \
  --default \
  --pkgname=ip2location-c \
  --pkgversion=${IP2LOCATION_C_VERSION} \
-  --pkgarch=${TARGETARCH} \
+  --pkgarch=amd64 \
  --pkggroup=lib \
  --pkgsource="https://github.com/chrislim2888/IP2Location-C-Library" \
  --maintainer="Eduard Generalov <eduard@generalov.net>" \
@@ -101,7 +97,7 @@ RUN checkinstall \
  --default \
  --pkgname=ip2proxy-c \
  --pkgversion=${IP2PROXY_C_VERSION} \
-  --pkgarch=${TARGETARCH} \
+  --pkgarch=amd64 \
  --pkggroup=lib \
  --pkgsource="https://github.com/ip2location/ip2proxy-c" \
  --maintainer="Eduard Generalov <eduard@generalov.net>" \
@@ -148,7 +144,7 @@ RUN checkinstall \
  --default \
  --pkgname=nginx \
  --pkgversion=$VERS \
-  --pkgarch=${TARGETARCH} \
+  --pkgarch=amd64 \
  --pkggroup=web \
  --provides=nginx \
  --requires=ip2location-c,ip2proxy-c,libssl3,libc-bin,libc6,libzstd1,libpcre++0v5,libpcre16-3,libpcre2-8-0,libpcre3,libpcre32-3,libpcrecpp0v5,libmaxminddb0 \
@@ -169,9 +165,10 @@ COPY nginx-reloader.sh /usr/bin/nginx-reloader.sh
 RUN set -x \
 && groupadd --system --gid 101 nginx \
 && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \
- && apt update -q \
- && apt install -yq --no-install-recommends --no-install-suggests gnupg1 ca-certificates inotify-tools \
- && apt install -y /packages/*.deb \
+ && apt update \
+ && apt-get install --no-install-recommends --no-install-suggests -y gnupg1 ca-certificates inotify-tools \
+ && apt -y install /packages/*.deb \
+ && apt-get clean \
 && rm -rf /var/lib/apt/lists/* \
 && mkdir -p /var/lib/nginx /var/log/nginx \
 && ln -sf /dev/stdout /var/log/nginx/access.log \
--- a/packages/apps/kubernetes/Chart.yaml
+++ b/packages/apps/kubernetes/Chart.yaml
@@ -22,4 +22,4 @@ version: 0.20.0
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: 1.32.4
+appVersion: 1.31.0
--- a/packages/apps/kubernetes/Makefile
+++ b/packages/apps/kubernetes/Makefile
@@ -14,10 +14,8 @@ generate:
 image: image-ubuntu-container-disk image-kubevirt-cloud-provider image-kubevirt-csi-driver image-cluster-autoscaler

 image-ubuntu-container-disk:
-	docker buildx build images/ubuntu-container-disk \
+	docker buildx build --platform linux/amd64 --build-arg ARCH=amd64 images/ubuntu-container-disk \
 		--provenance false \
-		--builder=$(BUILDER) \
-		--platform=$(PLATFORM) \
 		--build-arg KUBERNETES_VERSION=${KUBERNETES_VERSION} \
 		--tag $(REGISTRY)/ubuntu-container-disk:$(call settag,$(KUBERNETES_VERSION)) \
 		--tag $(REGISTRY)/ubuntu-container-disk:$(call settag,$(KUBERNETES_VERSION)-$(TAG)) \
@@ -32,10 +30,8 @@ image-ubuntu-container-disk:
 	rm -f images/ubuntu-container-disk.json

 image-kubevirt-cloud-provider:
-	docker buildx build images/kubevirt-cloud-provider \
+	docker buildx build --platform linux/amd64 --build-arg ARCH=amd64 images/kubevirt-cloud-provider \
 		--provenance false \
-		--builder=$(BUILDER) \
-		--platform=$(PLATFORM) \
 		--tag $(REGISTRY)/kubevirt-cloud-provider:$(call settag,$(KUBERNETES_PKG_TAG)) \
 		--tag $(REGISTRY)/kubevirt-cloud-provider:$(call settag,$(KUBERNETES_PKG_TAG)-$(TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/kubevirt-cloud-provider:latest \
@@ -49,10 +45,8 @@ image-kubevirt-cloud-provider:
 	rm -f images/kubevirt-cloud-provider.json

 image-kubevirt-csi-driver:
-	docker buildx build images/kubevirt-csi-driver \
+	docker buildx build --platform linux/amd64 --build-arg ARCH=amd64 images/kubevirt-csi-driver \
 		--provenance false \
-		--builder=$(BUILDER) \
-		--platform=$(PLATFORM) \
 		--tag $(REGISTRY)/kubevirt-csi-driver:$(call settag,$(KUBERNETES_PKG_TAG)) \
 		--tag $(REGISTRY)/kubevirt-csi-driver:$(call settag,$(KUBERNETES_PKG_TAG)-$(TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/kubevirt-csi-driver:latest \
@@ -67,10 +61,8 @@ image-kubevirt-csi-driver:


 image-cluster-autoscaler:
-	docker buildx build images/cluster-autoscaler \
+	docker buildx build --platform linux/amd64 --build-arg ARCH=amd64 images/cluster-autoscaler \
 		--provenance false \
-		--builder=$(BUILDER) \
-		--platform=$(PLATFORM) \
 		--tag $(REGISTRY)/cluster-autoscaler:$(call settag,$(KUBERNETES_PKG_TAG)) \
 		--tag $(REGISTRY)/cluster-autoscaler:$(call settag,$(KUBERNETES_PKG_TAG)-$(TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/cluster-autoscaler:latest \
--- a/packages/apps/kubernetes/images/cluster-autoscaler/Dockerfile
+++ b/packages/apps/kubernetes/images/cluster-autoscaler/Dockerfile
@@ -1,14 +1,7 @@
 # Source: https://raw.githubusercontent.com/kubernetes/autoscaler/refs/heads/master/cluster-autoscaler/Dockerfile.amd64
 ARG builder_image=docker.io/library/golang:1.23.4
-ARG BASEIMAGE=gcr.io/distroless/static:nonroot-${TARGETARCH}
-
+ARG BASEIMAGE=gcr.io/distroless/static:nonroot-amd64
 FROM ${builder_image} AS builder
-
-ARG TARGETOS
-ARG TARGETARCH
-ENV GOOS=$TARGETOS
-ENV GOARCH=$TARGETARCH
-
 RUN git clone https://github.com/kubernetes/autoscaler /src/autoscaler \
 && cd /src/autoscaler/cluster-autoscaler \
 && git checkout cluster-autoscaler-1.32.0
@@ -21,8 +14,6 @@ RUN make build
 FROM $BASEIMAGE
 LABEL maintainer="Marcin Wielgus <mwielgus@google.com>"

-ARG TARGETARCH
-
-COPY --from=builder /src/autoscaler/cluster-autoscaler/cluster-autoscaler-${TARGETARCH} /cluster-autoscaler
+COPY --from=builder /src/autoscaler/cluster-autoscaler/cluster-autoscaler-amd64 /cluster-autoscaler
 WORKDIR /
 CMD ["/cluster-autoscaler"]
--- a/packages/apps/kubernetes/images/kubevirt-cloud-provider/Dockerfile
+++ b/packages/apps/kubernetes/images/kubevirt-cloud-provider/Dockerfile
@@ -1,10 +1,5 @@
 # Source: https://github.com/kubevirt/cloud-provider-kubevirt/blob/main/build/images/kubevirt-cloud-controller-manager/Dockerfile
-FROM golang:1.20.6 AS builder
-
-ARG TARGETOS
-ARG TARGETARCH
-ENV GOOS=$TARGETOS
-ENV GOARCH=$TARGETARCH
+FROM --platform=linux/amd64 golang:1.20.6 AS builder

 RUN git clone https://github.com/kubevirt/cloud-provider-kubevirt /go/src/kubevirt.io/cloud-provider-kubevirt \
 && cd /go/src/kubevirt.io/cloud-provider-kubevirt \
@@ -19,7 +14,7 @@ RUN go get 'k8s.io/endpointslice/util@v0.28' 'k8s.io/apiserver@v0.28'
 RUN go mod tidy
 RUN go mod vendor

-RUN CGO_ENABLED=0 go build -mod=vendor -ldflags="-s -w" -o bin/kubevirt-cloud-controller-manager ./cmd/kubevirt-cloud-controller-manager
+RUN	CGO_ENABLED=0 GOOS=linux go build -mod=vendor -ldflags="-s -w" -o bin/kubevirt-cloud-controller-manager ./cmd/kubevirt-cloud-controller-manager

 FROM registry.access.redhat.com/ubi9/ubi-micro
 COPY --from=builder /go/src/kubevirt.io/cloud-provider-kubevirt/bin/kubevirt-cloud-controller-manager /bin/kubevirt-cloud-controller-manager
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver/Dockerfile
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/Dockerfile
@@ -5,11 +5,6 @@ RUN git clone https://github.com/kubevirt/csi-driver /src/kubevirt-csi-driver \
 && cd /src/kubevirt-csi-driver \
 && git checkout 35836e0c8b68d9916d29a838ea60cdd3fc6199cf

-ARG TARGETOS
-ARG TARGETARCH
-ENV GOOS=$TARGETOS
-ENV GOARCH=$TARGETARCH
-
 WORKDIR /src/kubevirt-csi-driver
 RUN make build

--- a/packages/apps/kubernetes/images/ubuntu-container-disk/Dockerfile
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk/Dockerfile
@@ -1,5 +1,5 @@
 # TODO: Here we use ubuntu:22.04, as guestfish has some network issues running in ubuntu:24.04
-FROM ubuntu:22.04 AS guestfish
+FROM ubuntu:22.04 as guestfish

 ARG DEBIAN_FRONTEND=noninteractive
 RUN apt-get update \
@@ -8,17 +8,15 @@ RUN apt-get update \
     linux-image-generic \
     wget \
     make \
-     bash-completion
+     bash-completion \
+ && apt-get clean

 WORKDIR /build

-FROM guestfish AS builder
-
-ARG TARGETOS
-ARG TARGETARCH
+FROM guestfish as builder

 # noble is a code name for the Ubuntu 24.04 LTS release
-RUN wget -O image.img https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-${TARGETARCH}.img --show-progress --output-file /dev/stdout --progress=dot:giga 2>/dev/null
+RUN wget -O image.img https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img --show-progress --output-file /dev/stdout --progress=dot:giga 2>/dev/null

 ARG KUBERNETES_VERSION

@@ -31,21 +29,19 @@ RUN qemu-img resize image.img 5G \
 && guestfish --remote command "resize2fs /dev/sda1" \
 # docker repo
 && guestfish --remote sh "curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg" \
- && guestfish --remote sh 'echo "deb [signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list' \
+ && guestfish --remote sh 'echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list' \
 # kubernetes repo
 && guestfish --remote sh "curl -fsSL https://pkgs.k8s.io/core:/stable:/${KUBERNETES_VERSION}/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg" \
 && guestfish --remote sh "echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/${KUBERNETES_VERSION}/deb/ /' | tee /etc/apt/sources.list.d/kubernetes.list" \
- && guestfish --remote command "apt-get check -q" \
 # install containerd
- && guestfish --remote command "apt-get update -q" \
- && guestfish --remote command "apt-get install -yq containerd.io" \
+ && guestfish --remote command "apt-get update -y" \
+ && guestfish --remote command "apt-get install -y containerd.io" \
 # configure containerd
 && guestfish --remote command "mkdir -p /etc/containerd" \
 && guestfish --remote sh "containerd config default | tee /etc/containerd/config.toml" \
 && guestfish --remote command "sed -i '/SystemdCgroup/ s/=.*/= true/' /etc/containerd/config.toml" \
- && guestfish --remote command "containerd config dump >/dev/null" \
 # install kubernetes
- && guestfish --remote command "apt-get install -yq kubelet kubeadm" \
+ && guestfish --remote command "apt-get install -y kubelet kubeadm" \
 # clean apt cache
 && guestfish --remote sh 'apt-get clean && rm -rf /var/lib/apt/lists/*' \
 # write system configuration
--- a/packages/apps/kubernetes/templates/cluster.yaml
+++ b/packages/apps/kubernetes/templates/cluster.yaml
@@ -150,14 +150,14 @@ spec:
    ingress:
      extraAnnotations:
        nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-      hostname: {{ .Values.host | default (printf "%s.%s" .Release.Name $host) }}:443
+      hostname: {{ .Values.host | default (printf "%s.%s" .Release.Name $host) }}
      className: "{{ $ingress }}"
  deployment:
    podAdditionalMetadata:
      labels:
        policy.cozystack.io/allow-to-etcd: "true"
  replicas: 2
-  version: {{ $.Chart.AppVersion }}
+  version: 1.30.1
 ---
 apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
@@ -283,7 +283,7 @@ spec:
        kind: KubevirtMachineTemplate
        name: {{ $.Release.Name }}-{{ $groupName }}-{{ $kubevirtmachinetemplateHash }}
        namespace: {{ $.Release.Namespace }}
-      version: v{{ $.Chart.AppVersion }}
+      version: v1.32.3
 ---
 apiVersion: cluster.x-k8s.io/v1beta1
 kind: MachineHealthCheck
--- a/packages/apps/mysql/Makefile
+++ b/packages/apps/mysql/Makefile
@@ -7,10 +7,8 @@ generate:
 	readme-generator -v values.yaml -s values.schema.json -r README.md

 image:
-	docker buildx build images/mariadb-backup \
+	docker buildx build --platform linux/amd64 --build-arg ARCH=amd64 images/mariadb-backup \
 		--provenance false \
-		--builder=$(BUILDER) \
-		--platform=$(PLATFORM) \
 		--tag $(REGISTRY)/mariadb-backup:$(call settag,$(MARIADB_BACKUP_TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/mariadb-backup:latest \
 		--cache-to type=inline \
--- a/packages/apps/postgres/Makefile
+++ b/packages/apps/postgres/Makefile
@@ -7,10 +7,8 @@ generate:
 	readme-generator -v values.yaml -s values.schema.json -r README.md

 image:
-	docker buildx build images/postgres-backup \
+	docker buildx build --platform linux/amd64 --build-arg ARCH=amd64 images/postgres-backup \
 		--provenance false \
-		--builder=$(BUILDER) \
-		--platform=$(PLATFORM) \
 		--tag $(REGISTRY)/postgres-backup:$(call settag,$(POSTGRES_BACKUP_TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/postgres-backup:latest \
 		--cache-to type=inline \
--- a/packages/apps/versions_map
+++ b/packages/apps/versions_map
@@ -9,7 +9,7 @@ clickhouse 0.6.0 1ec10165
 clickhouse 0.6.1 c62a83a7
 clickhouse 0.6.2 8267072d
 clickhouse 0.7.0 93bdf411
-clickhouse 0.8.0 HEAD
+clickhouse 0.9.0 HEAD
 ferretdb 0.1.0 e9716091
 ferretdb 0.1.1 91b0499a
 ferretdb 0.2.0 6c5cf5bf
--- a/packages/core/installer/images/talos/profiles/initramfs.yaml
+++ b/packages/core/installer/images/talos/profiles/initramfs.yaml
@@ -3,24 +3,24 @@
 arch: amd64
 platform: metal
 secureboot: false
-version: v1.10.1
+version: v1.9.5
 input:
  kernel:
    path: /usr/install/amd64/vmlinuz
  initramfs:
    path: /usr/install/amd64/initramfs.xz
  baseInstaller:
-    imageRef: ghcr.io/siderolabs/installer:v1.10.1
+    imageRef: ghcr.io/siderolabs/installer:v1.9.5
  systemExtensions:
-    - imageRef: ghcr.io/siderolabs/amd-ucode:20250410
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20250311
    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20241110
-    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20250410
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20250311
    - imageRef: ghcr.io/siderolabs/i915-ucode:20241110
-    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250410
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250311
    - imageRef: ghcr.io/siderolabs/intel-ucode:20250211
-    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250410
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.13-v1.10.1
-    - imageRef: ghcr.io/siderolabs/zfs:2.3.1-v1.10.1
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250311
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.12-v1.9.5
+    - imageRef: ghcr.io/siderolabs/zfs:2.2.7-v1.9.5
 output:
  kind: initramfs
  imageOptions: {}
--- a/packages/core/installer/images/talos/profiles/installer.yaml
+++ b/packages/core/installer/images/talos/profiles/installer.yaml
@@ -3,24 +3,24 @@
 arch: amd64
 platform: metal
 secureboot: false
-version: v1.10.1
+version: v1.9.5
 input:
  kernel:
    path: /usr/install/amd64/vmlinuz
  initramfs:
    path: /usr/install/amd64/initramfs.xz
  baseInstaller:
-    imageRef: ghcr.io/siderolabs/installer:v1.10.1
+    imageRef: ghcr.io/siderolabs/installer:v1.9.5
  systemExtensions:
-    - imageRef: ghcr.io/siderolabs/amd-ucode:20250410
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20250311
    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20241110
-    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20250410
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20250311
    - imageRef: ghcr.io/siderolabs/i915-ucode:20241110
-    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250410
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250311
    - imageRef: ghcr.io/siderolabs/intel-ucode:20250211
-    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250410
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.13-v1.10.1
-    - imageRef: ghcr.io/siderolabs/zfs:2.3.1-v1.10.1
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250311
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.12-v1.9.5
+    - imageRef: ghcr.io/siderolabs/zfs:2.2.7-v1.9.5
 output:
  kind: installer
  imageOptions: {}
--- a/packages/core/installer/images/talos/profiles/iso.yaml
+++ b/packages/core/installer/images/talos/profiles/iso.yaml
@@ -3,24 +3,24 @@
 arch: amd64
 platform: metal
 secureboot: false
-version: v1.10.1
+version: v1.9.5
 input:
  kernel:
    path: /usr/install/amd64/vmlinuz
  initramfs:
    path: /usr/install/amd64/initramfs.xz
  baseInstaller:
-    imageRef: ghcr.io/siderolabs/installer:v1.10.1
+    imageRef: ghcr.io/siderolabs/installer:v1.9.5
  systemExtensions:
-    - imageRef: ghcr.io/siderolabs/amd-ucode:20250410
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20250311
    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20241110
-    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20250410
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20250311
    - imageRef: ghcr.io/siderolabs/i915-ucode:20241110
-    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250410
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250311
    - imageRef: ghcr.io/siderolabs/intel-ucode:20250211
-    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250410
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.13-v1.10.1
-    - imageRef: ghcr.io/siderolabs/zfs:2.3.1-v1.10.1
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250311
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.12-v1.9.5
+    - imageRef: ghcr.io/siderolabs/zfs:2.2.7-v1.9.5
 output:
  kind: iso
  imageOptions: {}
--- a/packages/core/installer/images/talos/profiles/kernel.yaml
+++ b/packages/core/installer/images/talos/profiles/kernel.yaml
@@ -3,24 +3,24 @@
 arch: amd64
 platform: metal
 secureboot: false
-version: v1.10.1
+version: v1.9.5
 input:
  kernel:
    path: /usr/install/amd64/vmlinuz
  initramfs:
    path: /usr/install/amd64/initramfs.xz
  baseInstaller:
-    imageRef: ghcr.io/siderolabs/installer:v1.10.1
+    imageRef: ghcr.io/siderolabs/installer:v1.9.5
  systemExtensions:
-    - imageRef: ghcr.io/siderolabs/amd-ucode:20250410
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20250311
    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20241110
-    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20250410
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20250311
    - imageRef: ghcr.io/siderolabs/i915-ucode:20241110
-    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250410
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250311
    - imageRef: ghcr.io/siderolabs/intel-ucode:20250211
-    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250410
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.13-v1.10.1
-    - imageRef: ghcr.io/siderolabs/zfs:2.3.1-v1.10.1
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250311
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.12-v1.9.5
+    - imageRef: ghcr.io/siderolabs/zfs:2.2.7-v1.9.5
 output:
  kind: kernel
  imageOptions: {}
--- a/packages/core/installer/images/talos/profiles/metal.yaml
+++ b/packages/core/installer/images/talos/profiles/metal.yaml
@@ -3,24 +3,24 @@
 arch: amd64
 platform: metal
 secureboot: false
-version: v1.10.1
+version: v1.9.5
 input:
  kernel:
    path: /usr/install/amd64/vmlinuz
  initramfs:
    path: /usr/install/amd64/initramfs.xz
  baseInstaller:
-    imageRef: ghcr.io/siderolabs/installer:v1.10.1
+    imageRef: ghcr.io/siderolabs/installer:v1.9.5
  systemExtensions:
-    - imageRef: ghcr.io/siderolabs/amd-ucode:20250410
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20250311
    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20241110
-    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20250410
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20250311
    - imageRef: ghcr.io/siderolabs/i915-ucode:20241110
-    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250410
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250311
    - imageRef: ghcr.io/siderolabs/intel-ucode:20250211
-    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250410
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.13-v1.10.1
-    - imageRef: ghcr.io/siderolabs/zfs:2.3.1-v1.10.1
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250311
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.12-v1.9.5
+    - imageRef: ghcr.io/siderolabs/zfs:2.2.7-v1.9.5
 output:
  kind: image
  imageOptions: { diskSize: 1306525696, diskFormat: raw }
--- a/packages/core/installer/images/talos/profiles/nocloud.yaml
+++ b/packages/core/installer/images/talos/profiles/nocloud.yaml
@@ -3,24 +3,24 @@
 arch: amd64
 platform: nocloud
 secureboot: false
-version: v1.10.1
+version: v1.9.5
 input:
  kernel:
    path: /usr/install/amd64/vmlinuz
  initramfs:
    path: /usr/install/amd64/initramfs.xz
  baseInstaller:
-    imageRef: ghcr.io/siderolabs/installer:v1.10.1
+    imageRef: ghcr.io/siderolabs/installer:v1.9.5
  systemExtensions:
-    - imageRef: ghcr.io/siderolabs/amd-ucode:20250410
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20250311
    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20241110
-    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20250410
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20250311
    - imageRef: ghcr.io/siderolabs/i915-ucode:20241110
-    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250410
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250311
    - imageRef: ghcr.io/siderolabs/intel-ucode:20250211
-    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250410
-    - imageRef: ghcr.io/siderolabs/drbd:9.2.13-v1.10.1
-    - imageRef: ghcr.io/siderolabs/zfs:2.3.1-v1.10.1
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250311
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.12-v1.9.5
+    - imageRef: ghcr.io/siderolabs/zfs:2.2.7-v1.9.5
 output:
  kind: image
  imageOptions: { diskSize: 1306525696, diskFormat: raw }
--- a/packages/core/platform/bundles/paas-full.yaml
+++ b/packages/core/platform/bundles/paas-full.yaml
@@ -260,15 +260,72 @@ releases:
  releaseName: dashboard
  chart: cozy-dashboard
  namespace: cozy-dashboard
+  dependsOn: [cilium,kubeovn,keycloak-configure]
  values:
-    {{- $dashboardKCconfig := lookup "v1" "ConfigMap" "cozy-dashboard" "kubeapps-auth-config" }}
-    {{- $dashboardKCValues := dig "data" "values.yaml" "" $dashboardKCconfig | fromYaml }}
-    {{- toYaml (deepCopy $dashboardKCValues | mergeOverwrite (fromYaml (include "cozystack.defaultDashboardValues" .))) | nindent 4 }}
-  dependsOn:
-  - cilium
-  - kubeovn
+    kubeapps:
+    {{- if .Capabilities.APIVersions.Has "source.toolkit.fluxcd.io/v1" }}
+    {{- with (lookup "source.toolkit.fluxcd.io/v1" "HelmRepository" "cozy-public" "").items }}
+      redis:
+        master:
+          podAnnotations:
+            {{- range $index, $repo := . }}
+            {{- with (($repo.status).artifact).revision }}
+            repository.cozystack.io/{{ $repo.metadata.name }}: {{ quote . }}
+            {{- end }}
+            {{- end }}
+    {{- end }}
+    {{- end }}
+      frontend:
+        resourcesPreset: "none"
+      dashboard:
+        resourcesPreset: "none"
+        {{- $cozystackBranding:= lookup "v1" "ConfigMap" "cozy-system" "cozystack-branding" }}
+        {{- $branding := dig "data" "branding" "" $cozystackBranding }}
+        {{- if $branding }}
+        customLocale:
+          "Kubeapps": {{ $branding }}
+        {{- end }}
+        customStyle: |
+          {{- $logoImage := dig "data" "logo" "" $cozystackBranding }}
+          {{- if $logoImage }}
+          .kubeapps-logo {
+            background-image: {{ $logoImage }}
+          }
+          {{- end }}
+          #serviceaccount-selector {
+            display: none;
+          }
+          .login-moreinfo {
+            display: none;
+          }
+          a[href="#/docs"] {
+            display: none;
+          }
+          .login-group .clr-form-control .clr-control-label {
+            display: none;
+          }
+          .appview-separator div.appview-first-row div.center {
+            display: none;
+          }
+          .appview-separator div.appview-first-row section[aria-labelledby="app-secrets"] {
+            display: none;
+          }
+          .appview-first-row section[aria-labelledby="access-urls-title"] {
+            width: 100%;
+          }
+  {{- $dashboardKCconfig := lookup "v1" "ConfigMap" "cozy-dashboard" "kubeapps-auth-config" }}
+  {{- $dashboardKCValues := dig "data" "values.yaml" "" $dashboardKCconfig }}
+  {{- if $dashboardKCValues }}
+  valuesFrom:
+  - kind: ConfigMap
+    name: kubeapps-auth-config
+    valuesKey: values.yaml
+  {{- end }}
+
  {{- if eq $oidcEnabled "true" }}
-  - keycloak-configure
+  dependsOn: [keycloak-configure]
+  {{- else }}
+  dependsOn: []
  {{- end }}

 - name: kamaji
--- a/packages/core/platform/bundles/paas-hosted.yaml
+++ b/packages/core/platform/bundles/paas-hosted.yaml
@@ -155,9 +155,66 @@ releases:
  chart: cozy-dashboard
  namespace: cozy-dashboard
  values:
-    {{- $dashboardKCconfig := lookup "v1" "ConfigMap" "cozy-dashboard" "kubeapps-auth-config" }}
-    {{- $dashboardKCValues := dig "data" "values.yaml" (dict) $dashboardKCconfig }}
-    {{- toYaml (deepCopy $dashboardKCValues | mergeOverwrite (fromYaml (include "cozystack.defaultDashboardValues" .))) | nindent 4 }}
+    kubeapps:
+    {{- if .Capabilities.APIVersions.Has "source.toolkit.fluxcd.io/v1" }}
+    {{- with (lookup "source.toolkit.fluxcd.io/v1" "HelmRepository" "cozy-public" "").items }}
+      redis:
+        master:
+          podAnnotations:
+            {{- range $index, $repo := . }}
+            {{- with (($repo.status).artifact).revision }}
+            repository.cozystack.io/{{ $repo.metadata.name }}: {{ quote . }}
+            {{- end }}
+            {{- end }}
+    {{- end }}
+    {{- end }}
+      frontend:
+        resourcesPreset: "none"
+      dashboard:
+        resourcesPreset: "none"
+        {{- $cozystackBranding:= lookup "v1" "ConfigMap" "cozy-system" "cozystack-branding" }}
+        {{- $branding := dig "data" "branding" "" $cozystackBranding }}
+        {{- if $branding }}
+        customLocale:
+          "Kubeapps": {{ $branding }}
+        {{- end }}
+        customStyle: |
+          {{- $logoImage := dig "data" "logo" "" $cozystackBranding }}
+          {{- if $logoImage }}
+          .kubeapps-logo {
+            background-image: {{ $logoImage }}
+          }
+          {{- end }}
+          #serviceaccount-selector {
+            display: none;
+          }
+          .login-moreinfo {
+            display: none;
+          }
+          a[href="#/docs"] {
+            display: none;
+          }
+          .login-group .clr-form-control .clr-control-label {
+            display: none;
+          }
+          .appview-separator div.appview-first-row div.center {
+            display: none;
+          }
+          .appview-separator div.appview-first-row section[aria-labelledby="app-secrets"] {
+            display: none;
+          }
+          .appview-first-row section[aria-labelledby="access-urls-title"] {
+            width: 100%;
+          }
+  {{- $dashboardKCconfig := lookup "v1" "ConfigMap" "cozy-dashboard" "kubeapps-auth-config" }}
+  {{- $dashboardKCValues := dig "data" "values.yaml" "" $dashboardKCconfig }}
+  {{- if $dashboardKCValues }}
+  valuesFrom:
+  - kind: ConfigMap
+    name: kubeapps-auth-config
+    valuesKey: values.yaml
+  {{- end }}
+
  {{- if eq $oidcEnabled "true" }}
  dependsOn: [keycloak-configure]
  {{- else }}
--- a/packages/core/platform/templates/_helpers.tpl
+++ b/packages/core/platform/templates/_helpers.tpl
@@ -16,57 +16,3 @@ Get IP-addresses of master nodes
 {{- end -}}
 {{ join "," $ips }}
 {{- end -}}
-
-{{- define "cozystack.defaultDashboardValues" -}}
-kubeapps:
-{{- if .Capabilities.APIVersions.Has "source.toolkit.fluxcd.io/v1" }}
-{{- with (lookup "source.toolkit.fluxcd.io/v1" "HelmRepository" "cozy-public" "").items }}
-  redis:
-    master:
-      podAnnotations:
-        {{- range $index, $repo := . }}
-        {{- with (($repo.status).artifact).revision }}
-        repository.cozystack.io/{{ $repo.metadata.name }}: {{ quote . }}
-        {{- end }}
-        {{- end }}
-{{- end }}
-{{- end }}
-  frontend:
-    resourcesPreset: "none"
-  dashboard:
-    resourcesPreset: "none"
-    {{- $cozystackBranding:= lookup "v1" "ConfigMap" "cozy-system" "cozystack-branding" }}
-    {{- $branding := dig "data" "branding" "" $cozystackBranding }}
-    {{- if $branding }}
-    customLocale:
-      "Kubeapps": {{ $branding }}
-    {{- end }}
-    customStyle: |
-      {{- $logoImage := dig "data" "logo" "" $cozystackBranding }}
-      {{- if $logoImage }}
-      .kubeapps-logo {
-        background-image: {{ $logoImage }}
-      }
-      {{- end }}
-      #serviceaccount-selector {
-        display: none;
-      }
-      .login-moreinfo {
-        display: none;
-      }
-      a[href="#/docs"] {
-        display: none;
-      }
-      .login-group .clr-form-control .clr-control-label {
-        display: none;
-      }
-      .appview-separator div.appview-first-row div.center {
-        display: none;
-      }
-      .appview-separator div.appview-first-row section[aria-labelledby="app-secrets"] {
-        display: none;
-      }
-      .appview-first-row section[aria-labelledby="access-urls-title"] {
-        width: 100%;
-      }
-{{- end }}
--- a/packages/core/platform/templates/helmreleases.yaml
+++ b/packages/core/platform/templates/helmreleases.yaml
@@ -72,6 +72,17 @@ spec:
    {{- toYaml . | nindent 4}}
  {{- end }}

+  {{- if $x.valuesFrom }}
+  valuesFrom:
+  {{- range $source := $x.valuesFrom }}
+  - kind: {{ $source.kind }}
+    name: {{ $source.name }}
+    {{- if $source.valuesKey }}
+    valuesKey: {{ $source.valuesKey }}
+    {{- end }}
+  {{- end }}
+  {{- end }}
+
  {{- with $x.dependsOn }}
  dependsOn:
  {{-   range $dep := . }}
--- a/packages/core/testing/Makefile
+++ b/packages/core/testing/Makefile
@@ -17,8 +17,6 @@ image: image-e2e-sandbox
 image-e2e-sandbox:
 	docker buildx build -f images/e2e-sandbox/Dockerfile ../../.. \
 		--provenance false \
-		--builder=$(BUILDER) \
-		--platform=$(PLATFORM) \
 		--tag $(REGISTRY)/e2e-sandbox:$(call settag,$(TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/e2e-sandbox:latest \
 		--cache-to type=inline \
--- a/packages/core/testing/images/e2e-sandbox/Dockerfile
+++ b/packages/core/testing/images/e2e-sandbox/Dockerfile
@@ -4,16 +4,14 @@ ARG KUBECTL_VERSION=1.32.0
 ARG TALOSCTL_VERSION=1.9.5
 ARG HELM_VERSION=3.16.4

-ARG TARGETOS
-ARG TARGETARCH
-
-RUN apt update -q
-RUN apt install -yq --no-install-recommends genisoimage ca-certificates qemu-kvm qemu-utils iproute2 iptables wget xz-utils netcat curl jq make git
-RUN curl -sSL "https://github.com/siderolabs/talos/releases/download/v${TALOSCTL_VERSION}/talosctl-${TARGETOS}-${TARGETARCH}" -o /usr/local/bin/talosctl \
- && chmod +x /usr/local/bin/talosctl
-RUN curl -sSL "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/${TARGETOS}/${TARGETARCH}/kubectl" -o /usr/local/bin/kubectl \
- && chmod +x /usr/local/bin/kubectl
-RUN curl -sSL "https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3" | bash -s - --version "v${HELM_VERSION}"
-RUN curl -sSL "https://github.com/mikefarah/yq/releases/download/v4.44.3/yq_${TARGETOS}_${TARGETARCH}" -o /usr/local/bin/yq \
- && chmod +x /usr/local/bin/yq
-RUN curl -sSL "https://fluxcd.io/install.sh" | bash
+RUN apt-get update
+RUN apt-get -y install genisoimage qemu-kvm qemu-utils iproute2 iptables wget xz-utils netcat curl jq make git
+RUN curl -LO "https://github.com/siderolabs/talos/releases/download/v${TALOSCTL_VERSION}/talosctl-linux-amd64" \
+ && chmod +x talosctl-linux-amd64 \
+ && mv talosctl-linux-amd64 /usr/local/bin/talosctl
+RUN curl -LO "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
+ && chmod +x kubectl \
+ && mv kubectl /usr/local/bin/kubectl
+RUN curl -sSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash -s - --version "v${HELM_VERSION}"
+RUN wget https://github.com/mikefarah/yq/releases/download/v4.44.3/yq_linux_amd64 -O /usr/local/bin/yq && chmod +x /usr/local/bin/yq
+RUN curl -s https://fluxcd.io/install.sh | bash
--- a/packages/extra/ingress/Chart.yaml
+++ b/packages/extra/ingress/Chart.yaml
@@ -3,4 +3,4 @@ name: ingress
 description: NGINX Ingress Controller
 icon: /logos/ingress-nginx.svg
 type: application
-version: 1.6.0
+version: 1.5.1
--- a/packages/extra/ingress/README.md
+++ b/packages/extra/ingress/README.md
@@ -4,10 +4,13 @@

 ### Common parameters

-| Name             | Description                                                       | Value   |
-| ---------------- | ----------------------------------------------------------------- | ------- |
-| `replicas`       | Number of ingress-nginx replicas                                  | `2`     |
-| `externalIPs`    | List of externalIPs for service.                                  | `[]`    |
-| `whitelist`      | List of client networks                                           | `[]`    |
-| `clouflareProxy` | Restoring original visitor IPs when Cloudflare proxied is enabled | `false` |
+| Name              | Description                                                       | Value   |
+| ----------------- | ----------------------------------------------------------------- | ------- |
+| `replicas`        | Number of ingress-nginx replicas                                  | `2`     |
+| `externalIPs`     | List of externalIPs for service.                                  | `[]`    |
+| `whitelist`       | List of client networks                                           | `[]`    |
+| `clouflareProxy`  | Restoring original visitor IPs when Cloudflare proxied is enabled | `false` |
+| `dashboard`       | Should ingress serve Cozystack service dashboard                  | `false` |
+| `cdiUploadProxy`  | Should ingress serve CDI upload proxy                             | `false` |
+| `virtExportProxy` | Should ingress serve KubeVirt export proxy                        | `false` |

--- a/packages/extra/ingress/templates/cdi-uploadproxy.yaml
+++ b/packages/extra/ingress/templates/cdi-uploadproxy.yaml
@@ -0,0 +1,37 @@
+{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
+{{- $issuerType := (index $cozyConfig.data "clusterissuer") | default "http01" }}
+
+{{- $myNS := lookup "v1" "Namespace" "" .Release.Namespace }}
+{{- $host := index $myNS.metadata.annotations "namespace.cozystack.io/host" }}
+
+{{- if .Values.cdiUploadProxy }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    {{- if eq $issuerType "cloudflare" }} 
+    {{- else }}
+    acme.cert-manager.io/http01-ingress-class: {{ .Release.Namespace }}
+    {{- end }}
+  name: cdi-uploadproxy-{{ .Release.Namespace }}
+  namespace: cozy-kubevirt-cdi
+spec:
+  ingressClassName: {{ .Release.Namespace }}
+  rules:
+  - host: cdi-uploadproxy.{{ $host }}
+    http:
+      paths:
+      - backend:
+          service:
+            name: cdi-uploadproxy
+            port:
+              number: 443
+        path: /
+        pathType: Prefix
+  tls:
+  - hosts:
+    - cdi-uploadproxy.{{ $host }}
+    secretName: cdi-uploadproxy-{{ .Release.Namespace }}-tls
+{{- end }}
--- a/packages/system/dashboard/templates/dashboard-ingress.yaml
+++ b/packages/system/dashboard/templates/dashboard-ingress.yaml
@@ -1,10 +1,19 @@
 {{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
 {{- $issuerType := (index $cozyConfig.data "clusterissuer") | default "http01" }}
-{{- $host := index $cozyConfig.data "root-host" }}
-{{- $exposeServices := splitList "," ((index $cozyConfig.data "expose-services") | default "") }}
-{{- $exposeIngress := index $cozyConfig.data "expose-ingress" | default "tenant-root" }}

-{{- if and (has "dashboard" $exposeServices) }}
+{{- $myNS := lookup "v1" "Namespace" "" .Release.Namespace }}
+{{- $host := index $myNS.metadata.annotations "namespace.cozystack.io/host" }}
+
+{{- $tenantRoot := dict }}
+{{- if .Capabilities.APIVersions.Has "helm.toolkit.fluxcd.io/v2" }}
+{{- $tenantRoot = lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" "tenant-root" "tenant-root" }}
+{{- end }}
+{{- if and $tenantRoot $tenantRoot.spec $tenantRoot.spec.values $tenantRoot.spec.values.host }}
+{{- $host = $tenantRoot.spec.values.host }}
+{{- else }}
+{{- end }}
+
+{{- if .Values.dashboard }}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -12,16 +21,16 @@ metadata:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    {{- if eq $issuerType "cloudflare" }}
    {{- else }}
-    acme.cert-manager.io/http01-ingress-class: {{ $exposeIngress }}
-    {{- end }}
+    acme.cert-manager.io/http01-ingress-class: {{ .Release.Namespace }}
    nginx.ingress.kubernetes.io/proxy-body-size: 100m
    nginx.ingress.kubernetes.io/proxy-buffer-size: 100m
    nginx.ingress.kubernetes.io/proxy-buffers-number: "4"
    nginx.ingress.kubernetes.io/client-max-body-size: 100m
-  name: dashboard
+    {{- end }}
+  name: dashboard-{{ .Release.Namespace }}
  namespace: cozy-dashboard
 spec:
-  ingressClassName: {{ $exposeIngress }}
+  ingressClassName: {{ .Release.Namespace }}
  rules:
  - host: dashboard.{{ $host }}
    http:
@@ -36,5 +45,5 @@ spec:
  tls:
  - hosts:
    - dashboard.{{ $host }}
-    secretName: dashboard-tls
+    secretName: dashboard-{{ .Release.Namespace }}-tls
 {{- end }}
--- a/packages/extra/ingress/templates/nginx-ingress.yaml
+++ b/packages/extra/ingress/templates/nginx-ingress.yaml
@@ -1,6 +1,3 @@
-{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
-{{- $exposeIngress := index $cozyConfig.data "expose-ingress" | default "tenant-root" }}
-{{- $exposeExternalIPs := (index $cozyConfig.data "expose-external-ips") | default "" }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -34,9 +31,9 @@ spec:
          enabled: false
        {{- end }}
        service:
-          {{- if and (eq $exposeIngress .Release.Namespace) $exposeExternalIPs }}
+          {{- if .Values.externalIPs }}
          externalIPs:
-            {{- toYaml (splitList "," $exposeExternalIPs) | nindent 12 }}
+            {{- toYaml .Values.externalIPs | nindent 12 }}
          type: ClusterIP
          externalTrafficPolicy: Cluster
          {{- else }}
--- a/packages/extra/ingress/values.schema.json
+++ b/packages/extra/ingress/values.schema.json
@@ -25,6 +25,21 @@
            "type": "boolean",
            "description": "Restoring original visitor IPs when Cloudflare proxied is enabled",
            "default": false
+        },
+        "dashboard": {
+            "type": "boolean",
+            "description": "Should ingress serve Cozystack service dashboard",
+            "default": false
+        },
+        "cdiUploadProxy": {
+            "type": "boolean",
+            "description": "Should ingress serve CDI upload proxy",
+            "default": false
+        },
+        "virtExportProxy": {
+            "type": "boolean",
+            "description": "Should ingress serve KubeVirt export proxy",
+            "default": false
        }
    }
 }
--- a/packages/extra/ingress/values.yaml
+++ b/packages/extra/ingress/values.yaml
@@ -4,6 +4,17 @@
 ##
 replicas: 2

+## @param externalIPs [array] List of externalIPs for service.
+## Optional. If not specified will use LoadBalancer service by default.
+## 
+## e.g:
+## externalIPs:
+##   - "11.22.33.44"
+##   - "11.22.33.45"
+##   - "11.22.33.46"
+##
+externalIPs: []
+
 ## @param whitelist List of client networks
 ## Example:
 ## whitelist:
@@ -13,3 +24,12 @@ whitelist: []

 ## @param clouflareProxy Restoring original visitor IPs when Cloudflare proxied is enabled
 clouflareProxy: false
+
+## @param dashboard Should ingress serve Cozystack service dashboard
+dashboard: false
+
+## @param cdiUploadProxy Should ingress serve CDI upload proxy
+cdiUploadProxy: false
+
+## @param virtExportProxy Should ingress serve KubeVirt export proxy
+virtExportProxy: false
--- a/packages/extra/ingress/vm-exportproxy.yaml
+++ b/packages/extra/ingress/vm-exportproxy.yaml
@@ -0,0 +1,37 @@
+{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
+{{- $issuerType := (index $cozyConfig.data "clusterissuer") | default "http01" }}
+
+{{- $myNS := lookup "v1" "Namespace" "" .Release.Namespace }}
+{{- $host := index $myNS.metadata.annotations "namespace.cozystack.io/host" }}
+
+{{- if .Values.virtExportProxy }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    {{- if eq $issuerType "cloudflare" }} 
+    {{- else }}
+    acme.cert-manager.io/http01-ingress-class: {{ .Release.Namespace }}
+    {{- end }}
+  name: virt-exportproxy-{{ .Release.Namespace }}
+  namespace: cozy-kubevirt
+spec:
+  ingressClassName: {{ .Release.Namespace }}
+  rules:
+  - host: virt-exportproxy.{{ $host }}
+    http:
+      paths:
+      - backend:
+          service:
+            name: virt-exportproxy
+            port:
+              number: 443
+        path: /
+        pathType: ImplementationSpecific
+  tls:
+  - hosts:
+    virt-exportproxy.{{ $host }}
+    secretName: virt-exportproxy-{{ .Release.Namespace }}-tls
+{{- end }}
--- a/packages/extra/monitoring/Makefile
+++ b/packages/extra/monitoring/Makefile
@@ -13,10 +13,8 @@ generate:
 	rm -f values.schema.json.tmp

 image:
-	docker buildx build images/grafana \
+	docker buildx build --platform linux/amd64 images/grafana \
 		--provenance false \
-		--builder=$(BUILDER) \
-		--platform=$(PLATFORM) \
 		--tag $(REGISTRY)/grafana:$(call settag,$(GRAFANA_TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/grafana:latest \
 		--cache-to type=inline \
--- a/packages/extra/versions_map
+++ b/packages/extra/versions_map
@@ -19,7 +19,7 @@ ingress 1.2.0 28fca4ef
 ingress 1.3.0 fde4bcfa
 ingress 1.4.0 fd240701
 ingress 1.5.0 93bdf411
-ingress 1.6.0 HEAD
+ingress 1.5.1 HEAD
 monitoring 1.0.0 d7cfa53c
 monitoring 1.1.0 25221fdc
 monitoring 1.2.0 f81be075
--- a/packages/library/Makefile
+++ b/packages/library/Makefile
@@ -0,0 +1,21 @@
+OUT=../../_out/repos/library
+TMP=../../_out/repos/library/historical
+
+repo:
+	rm -rf "$(OUT)"
+	mkdir -p "$(OUT)"
+	awk '$$3 != "HEAD" {print "mkdir -p $(TMP)/" $$1 "-" $$2}' versions_map | sh -ex
+	awk '$$3 != "HEAD" {print "git archive " $$3 " " $$1 " | tar -xf- --strip-components=1 -C $(TMP)/" $$1 "-" $$2 }' versions_map | sh -ex
+	helm package -d "$(OUT)" $$(find . $(TMP) -mindepth 2 -maxdepth 2 -name Chart.yaml | awk 'sub("/Chart.yaml", "")' | sort -V)
+	cd "$(OUT)" && helm repo index . --url http://cozystack.cozy-system.svc/repos/library
+	rm -rf "$(TMP)"
+
+fix-chartnames:
+	find . -maxdepth 2 -name Chart.yaml  | awk -F/ '{print $$2}' | while read i; do sed -i "s/^name: .*/name: $$i/" "$$i/Chart.yaml"; done
+
+gen-versions-map: fix-chartnames
+	../../hack/gen_versions_map.sh
+
+check-version-map: gen-versions-map
+	git diff --exit-code -- versions_map
+
--- a/packages/library/cozy-lib/.helmignore
+++ b/packages/library/cozy-lib/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
--- a/packages/library/cozy-lib/Chart.yaml
+++ b/packages/library/cozy-lib/Chart.yaml
@@ -0,0 +1,18 @@
+apiVersion: v2
+name: cozy-lib
+description: Common Cozystack templates
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: library
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
--- a/packages/library/cozy-lib/Makefile
+++ b/packages/library/cozy-lib/Makefile
@@ -0,0 +1,6 @@
+include ../../../scripts/common-envs.mk
+include ../../../scripts/package.mk
+
+generate:
+	readme-generator -v values.yaml -s values.schema.json -r README.md
+
--- a/packages/library/cozy-lib/README.md
+++ b/packages/library/cozy-lib/README.md
@@ -0,0 +1 @@
+## Parameters
--- a/packages/library/cozy-lib/templates/_resourcepresets.tpl
+++ b/packages/library/cozy-lib/templates/_resourcepresets.tpl
@@ -0,0 +1,49 @@
+{{/*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{/* vim: set filetype=mustache: */}}
+
+{{/*
+Return a resource request/limit object based on a given preset.
+These presets are for basic testing and not meant to be used in production
+{{ include "cozy-lib.resources.preset" "nano" -}}
+*/}}
+{{- define "cozy-lib.resources.preset" -}}
+{{- $presets := dict 
+  "nano" (dict 
+      "requests" (dict "cpu" "100m" "memory" "128Mi" "ephemeral-storage" "50Mi")
+      "limits" (dict "memory" "128Mi" "ephemeral-storage" "2Gi")
+   )
+  "micro" (dict 
+      "requests" (dict "cpu" "250m" "memory" "256Mi" "ephemeral-storage" "50Mi")
+      "limits" (dict "memory" "256Mi" "ephemeral-storage" "2Gi")
+   )
+  "small" (dict 
+      "requests" (dict "cpu" "500m" "memory" "512Mi" "ephemeral-storage" "50Mi")
+      "limits" (dict "memory" "512Mi" "ephemeral-storage" "2Gi")
+   )
+  "medium" (dict 
+      "requests" (dict "cpu" "500m" "memory" "1Gi" "ephemeral-storage" "50Mi")
+      "limits" (dict "memory" "1Gi" "ephemeral-storage" "2Gi")
+   )
+  "large" (dict 
+      "requests" (dict "cpu" "1" "memory" "2Gi" "ephemeral-storage" "50Mi")
+      "limits" (dict "memory" "2Gi" "ephemeral-storage" "2Gi")
+   )
+  "xlarge" (dict 
+      "requests" (dict "cpu" "2" "memory" "4Gi" "ephemeral-storage" "50Mi")
+      "limits" (dict "memory" "4Gi" "ephemeral-storage" "2Gi")
+   )
+  "2xlarge" (dict 
+      "requests" (dict "cpu" "4" "memory" "8Gi" "ephemeral-storage" "50Mi")
+      "limits" (dict "memory" "8Gi" "ephemeral-storage" "2Gi")
+   )
+ }}
+{{- if hasKey $presets . -}}
+{{- index $presets . | toYaml -}}
+{{- else -}}
+{{- printf "ERROR: Preset key '%s' invalid. Allowed values are %s" . (join "," (keys $presets)) | fail -}}
+{{- end -}}
+{{- end -}}
--- a/packages/library/cozy-lib/templates/_resources.tpl
+++ b/packages/library/cozy-lib/templates/_resources.tpl
@@ -0,0 +1,53 @@
+{{- /*
+  A sanitized resource map is a dict with resource-name => resource-quantity.
+  If not in such a form, requests are used, then limits. All resources are set
+  to have equal requests and limits, except CPU, that has only requests. The
+  template expects to receive a dict {"requests":{...}, "limits":{...}} as
+  input, e.g. {{ include "cozy-lib.resources.sanitize" .Values.resources }}.
+  Example input:
+  ==============
+  limits:
+    cpu: 100m
+    memory: 1024Mi
+  requests:
+    cpu: 200m
+    memory: 512Mi
+  memory: 256Mi
+  devices.com/nvidia: "1"
+
+  Example output:
+  ===============
+  limits:
+    devices.com/nvidia: "1"
+    memory: 256Mi
+  requests:
+    cpu: 200m
+    devices.com/nvidia: "1"
+    memory: 256Mi
+*/}}
+{{- define "cozy-lib.resources.sanitize" }}
+{{-   $sanitizedMap := dict }}
+{{-   if hasKey . "limits" }}
+{{-     range $k, $v := .limits }}
+{{-       $_ := set $sanitizedMap $k $v }}
+{{-     end }}
+{{-   end }}
+{{-   if hasKey . "requests" }}
+{{-     range $k, $v := .requests }}
+{{-       $_ := set $sanitizedMap $k $v }}
+{{-     end }}
+{{-   end }}
+{{-   range $k, $v := . }}
+{{-     if not (or (eq $k "requests") (eq $k "limits")) }}
+{{-       $_ := set $sanitizedMap $k $v }}
+{{-     end }}
+{{-   end }}
+{{-   $output := dict "requests" dict "limits" dict }}
+{{-   range $k, $v := $sanitizedMap }}
+{{-     $_ := set $output.requests $k $v }}
+{{-     if not (eq $k "cpu") }}
+{{-       $_ := set $output.limits $k $v }}
+{{-     end }}
+{{-   end }}
+{{-   $output | toYaml }}
+{{- end  }}
--- a/packages/library/cozy-lib/values.schema.json
+++ b/packages/library/cozy-lib/values.schema.json
@@ -0,0 +1,5 @@
+{
+    "title": "Chart Values",
+    "type": "object",
+    "properties": {}
+}
--- a/packages/library/cozy-lib/values.yaml
+++ b/packages/library/cozy-lib/values.yaml
@@ -0,0 +1 @@
+{}
--- a/packages/library/versions_map
+++ b/packages/library/versions_map
@@ -0,0 +1 @@
+cozy-lib 0.1.0 HEAD
--- a/packages/system/bucket/Makefile
+++ b/packages/system/bucket/Makefile
@@ -6,15 +6,14 @@ include ../../../scripts/common-envs.mk
 include ../../../scripts/package.mk

 update:
-	@echo Nothing to update
+	rm -rf charts
+	helm pull oci://ghcr.io/aenix-io/charts/etcd-operator --untar --untardir charts

 image: image-s3manager

 image-s3manager:
-	docker buildx build images/s3manager \
+	docker buildx build --platform linux/amd64 --build-arg ARCH=amd64 images/s3manager \
 		--provenance false \
-		--builder=$(BUILDER) \
-		--platform=$(PLATFORM) \
 		--tag $(REGISTRY)/s3manager:$(call settag,$(S3MANAGER_TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/s3manager:latest \
 		--cache-to type=inline \
--- a/packages/system/bucket/images/s3manager/Dockerfile
+++ b/packages/system/bucket/images/s3manager/Dockerfile
@@ -1,15 +1,11 @@
 # Source: https://github.com/cloudlena/s3manager/blob/main/Dockerfile

 FROM docker.io/library/golang:1 AS builder
-
-ARG TARGETOS
-ARG TARGETARCH
-
 WORKDIR /usr/src/app
 RUN wget -O- https://github.com/cloudlena/s3manager/archive/9a7c8e446b422f8973b8c461990f39fdafee9c27.tar.gz | tar -xzf- --strip 1
 ADD cozystack.patch /
 RUN git apply /cozystack.patch
-RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build -ldflags="-s -w" -a -installsuffix cgo -o bin/s3manager
+RUN CGO_ENABLED=0 go build -ldflags="-s -w" -a -installsuffix cgo -o bin/s3manager

 FROM docker.io/library/alpine:latest
 WORKDIR /usr/src/app
--- a/packages/system/bucket/values.yaml
+++ b/packages/system/bucket/values.yaml
@@ -1 +1 @@
-bucketName: "cozystack"
+bucketName: ""
--- a/packages/system/capi-operator/Makefile
+++ b/packages/system/capi-operator/Makefile
@@ -1,11 +1,11 @@
 export NAME=capi-operator
 export NAMESPACE=cozy-cluster-api
-export REPO_NAME=capi-operator
-export REPO_URL=https://kubernetes-sigs.github.io/cluster-api-operator
-export CHART_NAME=cluster-api-operator 
-export CHART_VERSION=^0.19

 include ../../../scripts/package.mk

-update: clean capi-operator-update
-	rm -rf charts/cluster-api-operator/charts/
+update:
+	rm -rf charts
+	helm repo add capi-operator https://kubernetes-sigs.github.io/cluster-api-operator
+	helm repo update capi-operator
+	helm pull capi-operator/cluster-api-operator --untar --untardir charts
+	rm -rf charts/cluster-api-operator/charts
--- a/packages/system/capi-providers/templates/providers.yaml
+++ b/packages/system/capi-providers/templates/providers.yaml
@@ -5,7 +5,7 @@ metadata:
  name: cluster-api
 spec:
  # https://github.com/kubernetes-sigs/cluster-api
-  version: v1.10.1
+  version: v1.10.0
 ---
 apiVersion: operator.cluster.x-k8s.io/v1alpha2
 kind: ControlPlaneProvider
@@ -13,7 +13,7 @@ metadata:
  name: kamaji
 spec:
  # https://github.com/clastix/cluster-api-control-plane-provider-kamaji
-  version: v0.15.1
+  version: v0.14.2
  deployment:
    containers:
    - name: manager
@@ -31,7 +31,7 @@ metadata:
  name: kubeadm
 spec:
  # https://github.com/kubernetes-sigs/cluster-api
-  version: v1.10.1
+  version: v1.10.0
 ---
 apiVersion: operator.cluster.x-k8s.io/v1alpha2
 kind: InfrastructureProvider
--- a/packages/system/cilium/Makefile
+++ b/packages/system/cilium/Makefile
@@ -18,8 +18,6 @@ update:
 image:
 	docker buildx build images/cilium \
 		--provenance false \
-		--builder=$(BUILDER) \
-		--platform=$(PLATFORM) \
 		--tag $(REGISTRY)/cilium:$(call settag,$(CILIUM_TAG)) \
 		--tag $(REGISTRY)/cilium:$(call settag,$(CILIUM_TAG)-$(TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/cilium:latest \
--- a/packages/system/cozystack-api/Makefile
+++ b/packages/system/cozystack-api/Makefile
@@ -9,8 +9,6 @@ image: image-cozystack-api
 image-cozystack-api:
 	docker buildx build -f images/cozystack-api/Dockerfile ../../.. \
 		--provenance false \
-		--builder=$(BUILDER) \
-		--platform=$(PLATFORM) \
 		--tag $(REGISTRY)/cozystack-api:$(call settag,$(TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/cozystack-api:latest \
 		--cache-to type=inline \
--- a/packages/system/cozystack-api/images/cozystack-api/Dockerfile
+++ b/packages/system/cozystack-api/images/cozystack-api/Dockerfile
@@ -1,19 +1,16 @@
-FROM golang:1.23-alpine AS builder
-
-ARG TARGETOS
-ARG TARGETARCH
+FROM golang:1.23-alpine as builder

 WORKDIR /workspace

 COPY go.mod go.sum ./
-RUN GOOS=$TARGETOS GOARCH=$TARGETARCH go mod download
+RUN go mod download

 COPY api api/
 COPY pkg pkg/
 COPY cmd cmd/
 COPY internal internal/

-RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build -ldflags="-extldflags=-static" -o /cozystack-api cmd/cozystack-api/main.go
+RUN CGO_ENABLED=0 go build -ldflags="-extldflags=-static" -o /cozystack-api cmd/cozystack-api/main.go

 FROM scratch

--- a/packages/system/cozystack-api/templates/api-ingress.yaml
+++ b/packages/system/cozystack-api/templates/api-ingress.yaml
@@ -1,28 +0,0 @@
-{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
-{{- $host := index $cozyConfig.data "root-host" }}
-{{- $exposeServices := splitList "," ((index $cozyConfig.data "expose-services") | default "") }}
-{{- $exposeIngress := index $cozyConfig.data "expose-ingress" | default "tenant-root" }}
-
-{{- if and (has "api" $exposeServices) }}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
-    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-  name: kubernetes
-  namespace: default
-spec:
-  ingressClassName: {{ $exposeIngress }}
-  rules:
-  - host: api.{{ $host }}
-    http:
-      paths:
-      - backend:
-          service:
-            name: kubernetes
-            port:
-              number: 443
-        path: /
-        pathType: Prefix
-{{- end }}
--- a/packages/system/cozystack-controller/images/cozystack-controller/Dockerfile
+++ b/packages/system/cozystack-controller/images/cozystack-controller/Dockerfile
@@ -1,19 +1,16 @@
-FROM golang:1.23-alpine AS builder
-
-ARG TARGETOS
-ARG TARGETARCH
+FROM golang:1.23-alpine as builder

 WORKDIR /workspace

 COPY go.mod go.sum ./
-RUN GOOS=$TARGETOS GOARCH=$TARGETARCH go mod download
+RUN go mod download

 COPY api api/
 COPY pkg pkg/
 COPY cmd cmd/
 COPY internal internal/

-RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build -ldflags="-extldflags=-static" -o /cozystack-controller cmd/cozystack-controller/main.go
+RUN CGO_ENABLED=0 go build -ldflags="-extldflags=-static" -o /cozystack-controller cmd/cozystack-controller/main.go

 FROM scratch

--- a/packages/system/dashboard/Makefile
+++ b/packages/system/dashboard/Makefile
@@ -17,8 +17,7 @@ update-chart:
 	patch --no-backup-if-mismatch charts/kubeapps/templates/frontend/configmap.yaml < patches/logos.patch

 update-dockerfiles:
-	@echo Update dockerfiles manually
-	#tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/vmware-tanzu/kubeapps  | awk -F'[/^]' 'END{print $$3}') && \
+	tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/vmware-tanzu/kubeapps  | awk -F'[/^]' 'END{print $$3}') && \
 	wget https://github.com/vmware-tanzu/kubeapps/raw/$${tag}/cmd/kubeapps-apis/Dockerfile -O images/kubeapps-apis/Dockerfile && \
 	patch --no-backup-if-mismatch images/kubeapps-apis/Dockerfile < images/kubeapps-apis/dockerfile.diff && \
 	node_image=$$(wget -O- https://github.com/vmware-tanzu/kubeapps/raw/main/dashboard/Dockerfile | awk '/FROM bitnami\/node/ {print $$2}') && \
@@ -29,8 +28,6 @@ update-dockerfiles:
 image-dashboard: update-version
 	docker buildx build images/dashboard \
 		--provenance false \
-		--builder=$(BUILDER) \
-		--platform=$(PLATFORM) \
 		--tag $(REGISTRY)/dashboard:$(call settag,$(TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/dashboard:latest \
 		--cache-to type=inline \
@@ -51,8 +48,6 @@ image-dashboard: update-version
 image-kubeapps-apis: update-version
 	docker buildx build images/kubeapps-apis \
 		--provenance false \
-		--builder=$(BUILDER) \
-		--platform=$(PLATFORM) \
 		--tag $(REGISTRY)/kubeapps-apis:$(call settag,$(TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/kubeapps-apis:latest \
 		--cache-to type=inline \
--- a/packages/system/dashboard/images/kubeapps-apis/Dockerfile
+++ b/packages/system/dashboard/images/kubeapps-apis/Dockerfile
@@ -3,7 +3,7 @@

 # syntax = docker/dockerfile:1

-FROM alpine AS source
+FROM alpine as source
 ARG COMMIT_REF=dd02680d796c962b8dcc4e5ea70960a846c1acdc
 RUN apk add --no-cache patch
 WORKDIR /source
@@ -12,9 +12,8 @@ RUN wget -O- https://github.com/cozystack/kubeapps/archive/${COMMIT_REF}.tar.gz
 FROM bitnami/golang:1.23.4 AS builder
 WORKDIR /go/src/github.com/vmware-tanzu/kubeapps
 COPY --from=source /source/go.mod /source/go.sum ./
-ARG TARGETOS
-ARG TARGETARCH
 ARG VERSION="devel"
+ARG TARGETARCH

 # If true, run golangci-lint to detect issues
 ARG lint
@@ -30,12 +29,10 @@ ARG GRPC_HEALTH_PROBE_VERSION="0.4.34"

 # Install lint tools
 RUN if [ ! -z ${lint:-} ]; then \
-    GOOS=$TARGETOS GOARCH=$TARGETARCH go install github.com/golangci/golangci-lint/cmd/golangci-lint@v$GOLANGCILINT_VERSION; \
+    go install github.com/golangci/golangci-lint/cmd/golangci-lint@v$GOLANGCILINT_VERSION; \
    fi

-RUN if [ $TARGETARCH = 'amd64' ]; then BUF_ARCH='x86_64'; elif [ $TARGETARCH = 'arm64' ]; then BUF_ARCH='aarch64'; fi && \
-    if [ $TARGETOS = 'linux' ]; then BUF_PLATFORM='Linux'; fi && \
-    curl -sSL "https://github.com/bufbuild/buf/releases/download/v${BUF_VERSION}/buf-${BUF_PLATFORM}-${BUF_ARCH}" -o "/tmp/buf" && chmod +x "/tmp/buf"
+RUN curl -sSL "https://github.com/bufbuild/buf/releases/download/v$BUF_VERSION/buf-Linux-x86_64" -o "/tmp/buf" && chmod +x "/tmp/buf"

 # TODO: Remove and instead use built-in gRPC container probes once we're supporting >= 1.24 only. https://kubernetes.io/blog/2022/05/13/grpc-probes-now-in-beta/
 RUN curl -sSL "https://github.com/grpc-ecosystem/grpc-health-probe/releases/download/v${GRPC_HEALTH_PROBE_VERSION}/grpc_health_probe-linux-${TARGETARCH}" -o "/bin/grpc_health_probe" && chmod +x "/bin/grpc_health_probe"
@@ -44,7 +41,7 @@ RUN curl -sSL "https://github.com/grpc-ecosystem/grpc-health-probe/releases/down
 # https://github.com/golang/go/issues/27719#issuecomment-514747274
 RUN --mount=type=cache,target=/go/pkg/mod  \
    --mount=type=cache,target=/root/.cache/go-build \
-    GOOS=$TARGETOS GOARCH=$TARGETARCH GOPROXY="https://proxy.golang.org,direct" go mod download
+    GOPROXY="https://proxy.golang.org,direct" go mod download

 # We don't copy the pkg and cmd directories until here so the above layers can
 # be reused.
@@ -63,7 +60,7 @@ RUN /tmp/buf lint ./cmd/kubeapps-apis
 # Build the main grpc server
 RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
-    GOOS=$TARGETOS GOARCH=$TARGETARCH GOPROXY="https://proxy.golang.org,direct" \
+    GOPROXY="https://proxy.golang.org,direct" \
    go build \
    -ldflags "-X github.com/vmware-tanzu/kubeapps/cmd/kubeapps-apis/cmd.version=$VERSION" \
    ./cmd/kubeapps-apis
@@ -71,7 +68,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 ## Build 'fluxv2' plugin, version 'v1alpha1'
 RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
-    GOOS=$TARGETOS GOARCH=$TARGETARCH GOPROXY="https://proxy.golang.org,direct" \
+    GOPROXY="https://proxy.golang.org,direct" \
    go build \
    -ldflags "-X github.com/vmware-tanzu/kubeapps/cmd/kubeapps-apis/cmd.version=$VERSION" \
    -o /fluxv2-packages-v1alpha1-plugin.so -buildmode=plugin \
@@ -80,7 +77,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 ## Build 'helm' plugin, version 'v1alpha1'
 RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
-    GOOS=$TARGETOS GOARCH=$TARGETARCH GOPROXY="https://proxy.golang.org,direct" \
+    GOPROXY="https://proxy.golang.org,direct" \
    go build \
    -ldflags "-X github.com/vmware-tanzu/kubeapps/cmd/kubeapps-apis/cmd.version=$VERSION" \
    -o /helm-packages-v1alpha1-plugin.so -buildmode=plugin \
@@ -89,7 +86,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 ## Build 'resources' plugin, version 'v1alpha1'
 RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
-    GOOS=$TARGETOS GOARCH=$TARGETARCH GOPROXY="https://proxy.golang.org,direct" \
+    GOPROXY="https://proxy.golang.org,direct" \
    go build \
    -ldflags "-X github.com/vmware-tanzu/kubeapps/cmd/kubeapps-apis/cmd.version=$VERSION" \
    -o /resources-v1alpha1-plugin.so -buildmode=plugin \
--- a/packages/system/fluxcd-operator/charts/flux-operator/Chart.yaml
+++ b/packages/system/fluxcd-operator/charts/flux-operator/Chart.yaml
@@ -8,7 +8,7 @@ annotations:
    - name: Upstream Project
      url: https://github.com/controlplaneio-fluxcd/flux-operator
 apiVersion: v2
-appVersion: v0.20.0
+appVersion: v0.19.0
 description: 'A Helm chart for deploying the Flux Operator. '
 home: https://github.com/controlplaneio-fluxcd
 icon: https://raw.githubusercontent.com/cncf/artwork/main/projects/flux/icon/color/flux-icon-color.png
@@ -25,4 +25,4 @@ sources:
 - https://github.com/controlplaneio-fluxcd/flux-operator
 - https://github.com/controlplaneio-fluxcd/charts
 type: application
-version: 0.20.0
+version: 0.19.0
--- a/packages/system/fluxcd-operator/charts/flux-operator/README.md
+++ b/packages/system/fluxcd-operator/charts/flux-operator/README.md
@@ -1,6 +1,6 @@
 # flux-operator

-![Version: 0.20.0](https://img.shields.io/badge/Version-0.20.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.20.0](https://img.shields.io/badge/AppVersion-v0.20.0-informational?style=flat-square)
+![Version: 0.19.0](https://img.shields.io/badge/Version-0.19.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.19.0](https://img.shields.io/badge/AppVersion-v0.19.0-informational?style=flat-square)

 The [Flux Operator](https://github.com/controlplaneio-fluxcd/flux-operator) provides a
 declarative API for the installation and upgrade of CNCF [Flux](https://fluxcd.io) and the
--- a/packages/system/fluxcd/charts/flux-instance/Chart.yaml
+++ b/packages/system/fluxcd/charts/flux-instance/Chart.yaml
@@ -8,7 +8,7 @@ annotations:
    - name: Upstream Project
      url: https://github.com/controlplaneio-fluxcd/flux-operator
 apiVersion: v2
-appVersion: v0.20.0
+appVersion: v0.19.0
 description: 'A Helm chart for deploying a Flux instance managed by Flux Operator. '
 home: https://github.com/controlplaneio-fluxcd
 icon: https://raw.githubusercontent.com/cncf/artwork/main/projects/flux/icon/color/flux-icon-color.png
@@ -25,4 +25,4 @@ sources:
 - https://github.com/controlplaneio-fluxcd/flux-operator
 - https://github.com/controlplaneio-fluxcd/charts
 type: application
-version: 0.20.0
+version: 0.19.0
--- a/packages/system/fluxcd/charts/flux-instance/README.md
+++ b/packages/system/fluxcd/charts/flux-instance/README.md
@@ -1,6 +1,6 @@
 # flux-instance

-![Version: 0.20.0](https://img.shields.io/badge/Version-0.20.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.20.0](https://img.shields.io/badge/AppVersion-v0.20.0-informational?style=flat-square)
+![Version: 0.19.0](https://img.shields.io/badge/Version-0.19.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.19.0](https://img.shields.io/badge/AppVersion-v0.19.0-informational?style=flat-square)

 This chart is a thin wrapper around the `FluxInstance` custom resource, which is
 used by the [Flux Operator](https://github.com/controlplaneio-fluxcd/flux-operator)
--- a/packages/system/fluxcd/values.yaml
+++ b/packages/system/fluxcd/values.yaml
@@ -4,7 +4,6 @@ flux-instance:
      networkPolicy: true
      domain: cozy.local # -- default value is overriden in patches
    distribution:
-      artifact: ""
      version: 2.5.x
      registry: ghcr.io/fluxcd
    components:
--- a/packages/system/kamaji/Makefile
+++ b/packages/system/kamaji/Makefile
@@ -14,8 +14,6 @@ update:
 image:
 	docker buildx build images/kamaji \
 		--provenance false \
-		--builder=$(BUILDER) \
-		--platform=$(PLATFORM) \
 		--tag $(REGISTRY)/kamaji:$(call settag,$(TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/kamaji:latest \
 		--cache-to type=inline \
--- a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml
+++ b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml
@@ -120,9 +120,6 @@ spec:
                    - PostgreSQL
                    - NATS
                  type: string
-                  x-kubernetes-validations:
-                    - message: Datastore driver is immutable
-                      rule: self == oldSelf
                endpoints:
                  description: |-
                    List of the endpoints to connect to the shared datastore.
@@ -266,21 +263,6 @@ spec:
                - driver
                - endpoints
              type: object
-              x-kubernetes-validations:
-                - message: certificateAuthority privateKey must have secretReference or content when driver is etcd
-                  rule: '(self.driver == "etcd") ? (self.tlsConfig != null && (has(self.tlsConfig.certificateAuthority.privateKey.secretReference) || has(self.tlsConfig.certificateAuthority.privateKey.content))) : true'
-                - message: clientCertificate must have secretReference or content when driver is etcd
-                  rule: '(self.driver == "etcd") ? (self.tlsConfig != null && (has(self.tlsConfig.clientCertificate.certificate.secretReference) || has(self.tlsConfig.clientCertificate.certificate.content))) : true'
-                - message: clientCertificate privateKey must have secretReference or content when driver is etcd
-                  rule: '(self.driver == "etcd") ? (self.tlsConfig != null && (has(self.tlsConfig.clientCertificate.privateKey.secretReference) || has(self.tlsConfig.clientCertificate.privateKey.content))) : true'
-                - message: When driver is not etcd and tlsConfig exists, clientCertificate must be null or contain valid content
-                  rule: '(self.driver != "etcd" && has(self.tlsConfig) && has(self.tlsConfig.clientCertificate)) ? (((has(self.tlsConfig.clientCertificate.certificate.secretReference) || has(self.tlsConfig.clientCertificate.certificate.content)))) : true'
-                - message: When driver is not etcd and basicAuth exists, username must have secretReference or content
-                  rule: '(self.driver != "etcd" && has(self.basicAuth)) ? ((has(self.basicAuth.username.secretReference) || has(self.basicAuth.username.content))) : true'
-                - message: When driver is not etcd and basicAuth exists, password must have secretReference or content
-                  rule: '(self.driver != "etcd" && has(self.basicAuth)) ? ((has(self.basicAuth.password.secretReference) || has(self.basicAuth.password.content))) : true'
-                - message: When driver is not etcd, either tlsConfig or basicAuth must be provided
-                  rule: '(self.driver != "etcd") ? (has(self.tlsConfig) || has(self.basicAuth)) : true'
            status:
              description: DataStoreStatus defines the observed state of DataStore.
              properties:
--- a/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
+++ b/packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
@@ -427,7 +427,7 @@ spec:
                                  Values defined by an Env with a duplicate key will take precedence.
                                  Cannot be updated.
                                items:
-                                  description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                                  description: EnvFromSource represents the source of a set of ConfigMaps
                                  properties:
                                    configMapRef:
                                      description: The ConfigMap to select from
@@ -447,7 +447,7 @@ spec:
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    prefix:
-                                      description: Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
+                                      description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                      type: string
                                    secretRef:
                                      description: The Secret to select from
@@ -696,12 +696,6 @@ spec:
                                          - port
                                        type: object
                                    type: object
-                                  stopSignal:
-                                    description: |-
-                                      StopSignal defines which signal will be sent to a container when it is being stopped.
-                                      If not specified, the default is defined by the container runtime in use.
-                                      StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                    type: string
                                type: object
                              livenessProbe:
                                description: |-
@@ -1798,7 +1792,7 @@ spec:
                                  Values defined by an Env with a duplicate key will take precedence.
                                  Cannot be updated.
                                items:
-                                  description: EnvFromSource represents the source of a set of ConfigMaps or Secrets
+                                  description: EnvFromSource represents the source of a set of ConfigMaps
                                  properties:
                                    configMapRef:
                                      description: The ConfigMap to select from
@@ -1818,7 +1812,7 @@ spec:
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    prefix:
-                                      description: Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
+                                      description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
                                      type: string
                                    secretRef:
                                      description: The Secret to select from
@@ -2067,12 +2061,6 @@ spec:
                                          - port
                                        type: object
                                    type: object
-                                  stopSignal:
-                                    description: |-
-                                      StopSignal defines which signal will be sent to a container when it is being stopped.
-                                      If not specified, the default is defined by the container runtime in use.
-                                      StopSignal can only be set for Pods with a non-empty .spec.os.name
-                                    type: string
                                type: object
                              livenessProbe:
                                description: |-
@@ -4099,7 +4087,7 @@ spec:
                                  The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
                                  The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
                                  The volume will be mounted read-only (ro) and non-executable files (noexec).
-                                  Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
+                                  Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
                                  The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
                                properties:
                                  pullPolicy:
@@ -5185,6 +5173,7 @@ spec:
                                              pod labels will be ignored. The default value is empty.
                                              The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                              Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                              This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                            items:
                                              type: string
                                            type: array
@@ -5199,6 +5188,7 @@ spec:
                                              pod labels will be ignored. The default value is empty.
                                              The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                              Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                              This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                            items:
                                              type: string
                                            type: array
@@ -5359,6 +5349,7 @@ spec:
                                          pod labels will be ignored. The default value is empty.
                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                        items:
                                          type: string
                                        type: array
@@ -5373,6 +5364,7 @@ spec:
                                          pod labels will be ignored. The default value is empty.
                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                        items:
                                          type: string
                                        type: array
@@ -5526,6 +5518,7 @@ spec:
                                              pod labels will be ignored. The default value is empty.
                                              The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                              Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                              This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                            items:
                                              type: string
                                            type: array
@@ -5540,6 +5533,7 @@ spec:
                                              pod labels will be ignored. The default value is empty.
                                              The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                              Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                              This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                            items:
                                              type: string
                                            type: array
@@ -5700,6 +5694,7 @@ spec:
                                          pod labels will be ignored. The default value is empty.
                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                        items:
                                          type: string
                                        type: array
@@ -5714,6 +5709,7 @@ spec:
                                          pod labels will be ignored. The default value is empty.
                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                        items:
                                          type: string
                                        type: array
@@ -6343,6 +6339,7 @@ spec:
                                  - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.

                                  If this value is nil, the behavior is equivalent to the Honor policy.
+                                  This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                                type: string
                              nodeTaintsPolicy:
                                description: |-
@@ -6353,6 +6350,7 @@ spec:
                                  - Ignore: node taints are ignored. All nodes are included.

                                  If this value is nil, the behavior is equivalent to the Ignore policy.
+                                  This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
                                type: string
                              topologyKey:
                                description: |-
@@ -7073,7 +7071,7 @@ spec:
                      description: KubernetesDeploymentStatus defines the status for the Tenant Control Plane Deployment in the management cluster.
                      properties:
                        availableReplicas:
-                          description: Total number of available non-terminating pods (ready for at least minReadySeconds) targeted by this deployment.
+                          description: Total number of available pods (ready for at least minReadySeconds) targeted by this deployment.
                          format: int32
                          type: integer
                        collisionCount:
@@ -7131,24 +7129,16 @@ spec:
                          format: int64
                          type: integer
                        readyReplicas:
-                          description: Total number of non-terminating pods targeted by this Deployment with a Ready Condition.
+                          description: readyReplicas is the number of pods targeted by this Deployment with a Ready Condition.
                          format: int32
                          type: integer
                        replicas:
-                          description: Total number of non-terminating pods targeted by this deployment (their labels match the selector).
+                          description: Total number of non-terminated pods targeted by this deployment (their labels match the selector).
                          format: int32
                          type: integer
                        selector:
                          description: Selector is the label selector used to group the Tenant Control Plane Pods used by the scale subresource.
                          type: string
-                        terminatingReplicas:
-                          description: |-
-                            Total number of terminating pods targeted by this deployment. Terminating pods have a non-null
-                            .metadata.deletionTimestamp and have not yet reached the Failed or Succeeded .status.phase.
-
-                            This is an alpha field. Enable DeploymentReplicaSetTerminatingReplicas to be able to use this field.
-                          format: int32
-                          type: integer
                        unavailableReplicas:
                          description: |-
                            Total number of unavailable pods targeted by this deployment. This is the total number of
@@ -7157,7 +7147,7 @@ spec:
                          format: int32
                          type: integer
                        updatedReplicas:
-                          description: Total number of non-terminating pods targeted by this deployment that have the desired template spec.
+                          description: Total number of non-terminated pods targeted by this deployment that have the desired template spec.
                          format: int32
                          type: integer
                      required:
@@ -7389,7 +7379,6 @@ spec:
                            - Migrating
                            - Ready
                            - NotReady
-                            - Sleeping
                          type: string
                        version:
                          description: Version is the running Kubernetes version of the Tenant Control Plane.
--- a/packages/system/kamaji/charts/kamaji/templates/controller.yaml
+++ b/packages/system/kamaji/charts/kamaji/templates/controller.yaml
@@ -19,6 +19,10 @@ spec:
      labels:
        {{- include "kamaji.selectorLabels" . | nindent 8 }}
    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      serviceAccountName: {{ include "kamaji.serviceAccountName" . }}
--- a/packages/system/kamaji/charts/kamaji/templates/rbac.yaml
+++ b/packages/system/kamaji/charts/kamaji/templates/rbac.yaml
@@ -9,10 +9,6 @@ metadata:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  namespace: {{ .Release.Namespace }}
-{{- with .Values.imagePullSecrets }}
-imagePullSecrets:
-  {{- toYaml . | nindent 2 }}
-{{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
--- a/packages/system/kamaji/images/kamaji/Dockerfile
+++ b/packages/system/kamaji/images/kamaji/Dockerfile
@@ -1,9 +1,8 @@
 # Build the manager binary
-FROM golang:1.24 as builder
+FROM golang:1.23 as builder

 ARG VERSION=edge-25.3.2
-ARG TARGETOS
-ARG TARGETARCH
+ARG TARGETOS TARGETARCH

 WORKDIR /workspace

@@ -12,7 +11,7 @@ RUN curl -sSL https://github.com/clastix/kamaji/archive/refs/tags/${VERSION}.tar
 COPY patches /patches
 RUN git apply /patches/*.diff

-RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build \
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH go build \
    -ldflags "-X github.com/clastix/kamaji/internal.GitRepo=$GIT_REPO -X github.com/clastix/kamaji/internal.GitTag=$GIT_LAST_TAG -X github.com/clastix/kamaji/internal.GitCommit=$GIT_HEAD_COMMIT -X github.com/clastix/kamaji/internal.GitDirty=$GIT_MODIFIED -X github.com/clastix/kamaji/internal.BuildTime=$BUILD_DATE" \
    -a -o kamaji main.go

@@ -23,4 +22,4 @@ WORKDIR /
 COPY --from=builder /workspace/kamaji .
 USER 65532:65532

-ENTRYPOINT ["/kamaji"]
+ENTRYPOINT ["/kamaji"]
--- a/packages/system/kamaji/values.yaml
+++ b/packages/system/kamaji/values.yaml
@@ -3,7 +3,7 @@ kamaji:
    deploy: false
  image:
    pullPolicy: IfNotPresent
-    tag: latest@sha256:f6a33408df8d3c4223005392bcd8bae9d8c02fd73e2540bbaa911dedb7880ea8
+    tag: v0.31.0-rc.1@sha256:3ae6f1b2e42dcb9dcfbf8213029eb731197ccdbf27fdc30539d975caf32184d4
    repository: ghcr.io/cozystack/cozystack/kamaji
  resources:
    limits:
--- a/packages/system/keycloak-configure/templates/configure-kk.yaml
+++ b/packages/system/keycloak-configure/templates/configure-kk.yaml
@@ -4,6 +4,15 @@
 {{- $rootSaConfigMap := lookup "v1" "ConfigMap" "kube-system" "kube-root-ca.crt" }}
 {{- $k8sCa := index $rootSaConfigMap.data "ca.crt" | b64enc }}

+{{- $tenantRoot := dict }}
+{{- if .Capabilities.APIVersions.Has "helm.toolkit.fluxcd.io/v2" }}
+{{- $tenantRoot = lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" "tenant-root" "tenant-root" }}
+{{- end }}
+{{- if and $tenantRoot $tenantRoot.spec $tenantRoot.spec.values $tenantRoot.spec.values.host }}
+{{- $host = $tenantRoot.spec.values.host }}
+{{- else }}
+{{- end }}
+
 {{- $existingK8sSecret := lookup "v1" "Secret" .Release.Namespace "k8s-client" }}
 {{- $existingKubeappsSecret := lookup "v1" "Secret" .Release.Namespace "kubeapps-client" }}
 {{- $existingAuthConfig := lookup "v1" "Secret" "cozy-dashboard" "kubeapps-auth-config" }}
--- a/packages/system/keycloak/templates/ingress.yaml
+++ b/packages/system/keycloak/templates/ingress.yaml
@@ -1,7 +1,18 @@
 {{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
 {{- $host := index $cozyConfig.data "root-host" }}
 {{- $issuerType := (index $cozyConfig.data "clusterissuer") | default "http01" }}
-{{- $exposeIngress := index $cozyConfig.data "expose-ingress" | default "tenant-root" }}
+
+{{- $rootns := lookup "v1" "Namespace" "" "tenant-root" }}
+{{- $ingress := index $rootns.metadata.annotations "namespace.cozystack.io/ingress" }}
+
+{{- $tenantRoot := dict }}
+{{- if .Capabilities.APIVersions.Has "helm.toolkit.fluxcd.io/v2" }}
+{{- $tenantRoot = lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" "tenant-root" "tenant-root" }}
+{{- end }}
+{{- if and $tenantRoot $tenantRoot.spec $tenantRoot.spec.values $tenantRoot.spec.values.host }}
+{{- $host = $tenantRoot.spec.values.host }}
+{{- else }}
+{{- end }}

 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -10,13 +21,13 @@ metadata:
  {{- with .Values.ingress.annotations }}
  annotations:
    {{- if ne $issuerType "cloudflare" }}
-    acme.cert-manager.io/http01-ingress-class: {{ $exposeIngress }}
+    acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
    {{- end }}
    cert-manager.io/cluster-issuer: letsencrypt-prod
    {{- toYaml . | nindent 4 }}
  {{- end }}
 spec:
-  ingressClassName: {{ $exposeIngress }}
+  ingressClassName: {{ $ingress }}
  tls:
  - hosts:
      - keycloak.{{ $host }}
--- a/packages/system/keycloak/templates/sts.yaml
+++ b/packages/system/keycloak/templates/sts.yaml
@@ -7,6 +7,15 @@
  {{- $password = index $existingPassword.data "password" | b64dec }}
 {{- end }}

+{{- $tenantRoot := dict }}
+{{- if .Capabilities.APIVersions.Has "helm.toolkit.fluxcd.io/v2" }}
+{{- $tenantRoot = lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" "tenant-root" "tenant-root" }}
+{{- end }}
+{{- if and $tenantRoot $tenantRoot.spec $tenantRoot.spec.values $tenantRoot.spec.values.host }}
+{{- $host = $tenantRoot.spec.values.host }}
+{{- else }}
+{{- end }}
+
 apiVersion: v1
 kind: Secret
 metadata:
--- a/packages/system/kubeovn-webhook/Makefile
+++ b/packages/system/kubeovn-webhook/Makefile
@@ -7,8 +7,6 @@ include ../../../scripts/package.mk
 image:
 	docker buildx build images/kubeovn-webhook \
 		--provenance false \
-		--builder=$(BUILDER) \
-		--platform=$(PLATFORM) \
 		--tag $(REGISTRY)/kubeovn-webhook:$(call settag,$(TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/kubeovn-webhook:latest \
 		--cache-to type=inline \
--- a/packages/system/kubeovn-webhook/images/kubeovn-webhook/Dockerfile
+++ b/packages/system/kubeovn-webhook/images/kubeovn-webhook/Dockerfile
@@ -1,14 +1,11 @@
-FROM golang:1.23 AS builder
-
-ARG TARGETOS
-ARG TARGETARCH
+FROM golang:1.23 as builder

 WORKDIR /app
 COPY go.mod go.sum ./
-RUN GOOS=$TARGETOS GOARCH=$TARGETARCH go mod download
+RUN go mod download

 COPY . .
-RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build -o webhook .
+RUN CGO_ENABLED=0 GOOS=linux go build -o webhook .

 FROM alpine:3.21.3
 WORKDIR /app
--- a/packages/system/kubeovn/Makefile
+++ b/packages/system/kubeovn/Makefile
@@ -19,8 +19,6 @@ update:
 image:
 	docker buildx build images/kubeovn \
 		--provenance false \
-		--builder=$(BUILDER) \
-		--platform=$(PLATFORM) \
 		--tag $(REGISTRY)/kubeovn:$(call settag,$(KUBEOVN_TAG)) \
 		--tag $(REGISTRY)/kubeovn:$(call settag,$(KUBEOVN_TAG)-$(TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/kubeovn:latest \
--- a/packages/system/kubevirt-cdi/templates/cdi-uploadproxy-ingress.yaml
+++ b/packages/system/kubevirt-cdi/templates/cdi-uploadproxy-ingress.yaml
@@ -1,29 +0,0 @@
-{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
-{{- $host := index $cozyConfig.data "root-host" }}
-{{- $exposeServices := splitList "," ((index $cozyConfig.data "expose-services") | default "") }}
-{{- $exposeIngress := index $cozyConfig.data "expose-ingress" | default "tenant-root" }}
-
-
-{{- if and (has "cdi-uploadproxy" $exposeServices) }}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
-    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-  name: cdi-uploadproxy
-  namespace: cozy-kubevirt-cdi
-spec:
-  ingressClassName: {{ $exposeIngress }}
-  rules:
-  - host: cdi-uploadproxy.{{ $host }}
-    http:
-      paths:
-      - backend:
-          service:
-            name: cdi-uploadproxy
-            port:
-              number: 443
-        path: /
-        pathType: Prefix
-{{- end }}
--- a/packages/system/kubevirt/templates/vm-exportproxy-ingress.yaml
+++ b/packages/system/kubevirt/templates/vm-exportproxy-ingress.yaml
@@ -1,28 +0,0 @@
-{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
-{{- $host := index $cozyConfig.data "root-host" }}
-{{- $exposeServices := splitList "," ((index $cozyConfig.data "expose-services") | default "") }}
-{{- $exposeIngress := index $cozyConfig.data "expose-ingress" | default "tenant-root" }}
-
-{{- if and (has "vm-exportproxy" $exposeServices) }}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
-    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-  name: vm-exportproxy
-  namespace: cozy-kubevirt
-spec:
-  ingressClassName: {{ $exposeIngress }}
-  rules:
-  - host: vm-exportproxy.{{ $host }}
-    http:
-      paths:
-      - backend:
-          service:
-            name: vm-exportproxy
-            port:
-              number: 443
-        path: /
-        pathType: ImplementationSpecific
-{{- end }}
--- a/packages/system/metallb/Makefile
+++ b/packages/system/metallb/Makefile
@@ -1,7 +1,6 @@
 export NAME=metallb
 export NAMESPACE=cozy-$(NAME)

-include ../../../scripts/common-envs.mk
 include ../../../scripts/package.mk

 update:
@@ -10,25 +9,3 @@ update:
 	helm repo update metallb
 	helm pull metallb/metallb --untar --untardir charts
 	rm -rf charts/metallb/charts/frr-k8s
-
-image-controller image-speaker:
-	$(eval TARGET := $(subst image-,,$@))
-	$(eval VERSION := $(shell yq '.appVersion' charts/metallb/Chart.yaml))
-	docker buildx build images/metallb \
-		--provenance false \
-		--target $(TARGET) \
-		--build-arg VERSION=$(VERSION) \
-		--tag $(REGISTRY)/metallb-$(TARGET):$(VERSION) \
-		--cache-from type=registry,ref=$(REGISTRY)/metallb-$(TARGET):latest \
-		--cache-to type=inline \
-		--metadata-file images/$(TARGET).json \
-		--push=$(PUSH) \
-		--label "org.opencontainers.image.source=https://github.com/cozystack/cozystack"
-		--load=1
-	REPOSITORY="$(REGISTRY)/metallb-$(TARGET)" \
-		yq -i '.metallb.$(TARGET).image.repository = strenv(REPOSITORY)' values.yaml
-	TAG=$(VERSION)@$$(yq e '."containerimage.digest"' images/$(TARGET).json -o json -r) \
-		yq -i '.metallb.$(TARGET).image.tag = strenv(TAG)' values.yaml
-	rm -f images/$(TARGET).json
-
-image: image-controller image-speaker
--- a/packages/system/metallb/charts/metallb/Chart.lock
+++ b/packages/system/metallb/charts/metallb/Chart.lock
@@ -1,9 +1,9 @@
 dependencies:
 - name: crds
  repository: ""
-  version: 0.14.9
+  version: 0.14.8
 - name: frr-k8s
  repository: https://metallb.github.io/frr-k8s
-  version: 0.0.16
-digest: sha256:20d9a53af12c82d35168e7524ae337341b2c7cb43e2169545185f750a718466e
-generated: "2024-12-17T15:39:32.082324414+01:00"
+  version: 0.0.14
+digest: sha256:8dff488902a5b504a491bbd1a9ab0983a877ff214e163ed74106c73c939a9aa3
+generated: "2024-07-23T15:22:40.589621+03:00"
--- a/packages/system/metallb/charts/metallb/Chart.yaml
+++ b/packages/system/metallb/charts/metallb/Chart.yaml
@@ -1,14 +1,14 @@
 apiVersion: v2
-appVersion: v0.14.9
+appVersion: v0.14.8
 dependencies:
 - condition: crds.enabled
  name: crds
  repository: ""
-  version: 0.14.9
+  version: 0.14.8
 - condition: frrk8s.enabled
  name: frr-k8s
  repository: https://metallb.github.io/frr-k8s
-  version: 0.0.16
+  version: 0.0.14
 description: A network load-balancer implementation for Kubernetes using standard
  routing protocols
 home: https://metallb.universe.tf
@@ -18,4 +18,4 @@ name: metallb
 sources:
 - https://github.com/metallb/metallb
 type: application
-version: 0.14.9
+version: 0.14.8
--- a/packages/system/metallb/charts/metallb/README.md
+++ b/packages/system/metallb/charts/metallb/README.md
@@ -17,7 +17,7 @@ Kubernetes: `>= 1.19.0-0`
 | Repository | Name | Version |
 |------------|------|---------|
 |  | crds | 0.0.0 |
-| https://metallb.github.io/frr-k8s | frr-k8s | 0.0.16 |
+| https://metallb.github.io/frr-k8s | frr-k8s | 0.0.14 |

 ## Values

@@ -79,17 +79,17 @@ Kubernetes: `>= 1.19.0-0`
 | prometheus.podMonitor.relabelings | list | `[]` |  |
 | prometheus.prometheusRule.additionalLabels | object | `{}` |  |
 | prometheus.prometheusRule.addressPoolExhausted.enabled | bool | `true` |  |
-| prometheus.prometheusRule.addressPoolExhausted.labels.severity | string | `"critical"` |  |
+| prometheus.prometheusRule.addressPoolExhausted.labels.severity | string | `"alert"` |  |
 | prometheus.prometheusRule.addressPoolUsage.enabled | bool | `true` |  |
 | prometheus.prometheusRule.addressPoolUsage.thresholds[0].labels.severity | string | `"warning"` |  |
 | prometheus.prometheusRule.addressPoolUsage.thresholds[0].percent | int | `75` |  |
 | prometheus.prometheusRule.addressPoolUsage.thresholds[1].labels.severity | string | `"warning"` |  |
 | prometheus.prometheusRule.addressPoolUsage.thresholds[1].percent | int | `85` |  |
-| prometheus.prometheusRule.addressPoolUsage.thresholds[2].labels.severity | string | `"critical"` |  |
+| prometheus.prometheusRule.addressPoolUsage.thresholds[2].labels.severity | string | `"alert"` |  |
 | prometheus.prometheusRule.addressPoolUsage.thresholds[2].percent | int | `95` |  |
 | prometheus.prometheusRule.annotations | object | `{}` |  |
 | prometheus.prometheusRule.bgpSessionDown.enabled | bool | `true` |  |
-| prometheus.prometheusRule.bgpSessionDown.labels.severity | string | `"critical"` |  |
+| prometheus.prometheusRule.bgpSessionDown.labels.severity | string | `"alert"` |  |
 | prometheus.prometheusRule.configNotLoaded.enabled | bool | `true` |  |
 | prometheus.prometheusRule.configNotLoaded.labels.severity | string | `"warning"` |  |
 | prometheus.prometheusRule.enabled | bool | `false` |  |
--- a/packages/system/metallb/charts/metallb/charts/crds/Chart.yaml
+++ b/packages/system/metallb/charts/metallb/charts/crds/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: v0.14.9
+appVersion: v0.14.8
 description: MetalLB CRDs
 home: https://metallb.universe.tf
 icon: https://metallb.universe.tf/images/logo/metallb-white.png
@@ -7,4 +7,4 @@ name: crds
 sources:
 - https://github.com/metallb/metallb
 type: application
-version: 0.14.9
+version: 0.14.8
--- a/packages/system/metallb/charts/metallb/charts/crds/templates/crds.yaml
+++ b/packages/system/metallb/charts/metallb/charts/crds/templates/crds.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.3
+    controller-gen.kubebuilder.io/version: v0.14.0
  name: bfdprofiles.metallb.io
 spec:
  group: metallb.io
@@ -123,7 +123,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.3
+    controller-gen.kubebuilder.io/version: v0.14.0
  name: bgpadvertisements.metallb.io
 spec:
  group: metallb.io
@@ -329,7 +329,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.3
+    controller-gen.kubebuilder.io/version: v0.14.0
  name: bgppeers.metallb.io
 spec:
  conversion:
@@ -365,8 +365,6 @@ spec:
        - jsonPath: .spec.ebgpMultiHop
          name: Multi Hops
          type: string
-      deprecated: true
-      deprecationWarning: v1beta1 is deprecated, please use v1beta2
      name: v1beta1
      schema:
        openAPIV3Schema:
@@ -528,26 +526,15 @@ spec:
                  default: false
                  description: To set if we want to disable MP BGP that will separate IPv4 and IPv6 route exchanges into distinct BGP sessions.
                  type: boolean
-                dynamicASN:
-                  description: |-
-                    DynamicASN detects the AS number to use for the remote end of the session
-                    without explicitly setting it via the ASN field. Limited to:
-                    internal - if the neighbor's ASN is different than MyASN connection is denied.
-                    external - if the neighbor's ASN is the same as MyASN the connection is denied.
-                    ASN and DynamicASN are mutually exclusive and one of them must be specified.
-                  enum:
-                    - internal
-                    - external
-                  type: string
                ebgpMultiHop:
                  description: To set if the BGPPeer is multi-hops away. Needed for FRR mode only.
                  type: boolean
                enableGracefulRestart:
                  description: |-
-                    EnableGracefulRestart allows BGP peer to continue to forward data packets
-                    along known routes while the routing protocol information is being
-                    restored. This field is immutable because it requires restart of the BGP
-                    session. Supported for FRR mode only.
+                    EnableGracefulRestart allows BGP peer to continue to forward data packets along
+                    known routes while the routing protocol information is being restored.
+                    This field is immutable because it requires restart of the BGP session
+                    Supported for FRR mode only.
                  type: boolean
                  x-kubernetes-validations:
                    - message: EnableGracefulRestart cannot be changed after creation
@@ -635,9 +622,7 @@ spec:
                  type: object
                  x-kubernetes-map-type: atomic
                peerASN:
-                  description: |-
-                    AS number to expect from the remote end of the session.
-                    ASN and DynamicASN are mutually exclusive and one of them must be specified.
+                  description: AS number to expect from the remote end of the session.
                  format: int32
                  maximum: 4294967295
                  minimum: 0
@@ -664,6 +649,7 @@ spec:
                  type: string
              required:
                - myASN
+                - peerASN
                - peerAddress
              type: object
            status:
@@ -679,7 +665,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.3
+    controller-gen.kubebuilder.io/version: v0.14.0
  name: communities.metallb.io
 spec:
  group: metallb.io
@@ -744,7 +730,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.3
+    controller-gen.kubebuilder.io/version: v0.14.0
  name: ipaddresspools.metallb.io
 spec:
  group: metallb.io
@@ -954,7 +940,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.3
+    controller-gen.kubebuilder.io/version: v0.14.0
  name: l2advertisements.metallb.io
 spec:
  group: metallb.io
@@ -1134,7 +1120,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.3
+    controller-gen.kubebuilder.io/version: v0.14.0
  name: servicel2statuses.metallb.io
 spec:
  group: metallb.io
--- a/packages/system/metallb/charts/metallb/templates/controller.yaml
+++ b/packages/system/metallb/charts/metallb/templates/controller.yaml
@@ -84,7 +84,7 @@ spec:
        - name: METALLB_DEPLOYMENT
          value: {{ template "metallb.fullname" . }}-controller
        {{- end }}
-        {{- if and .Values.speaker.enabled .Values.speaker.frr.enabled }}
+        {{- if .Values.speaker.frr.enabled }}
        - name: METALLB_BGP_TYPE
          value: frr
        {{- end }}
--- a/packages/system/metallb/charts/metallb/templates/podmonitor.yaml
+++ b/packages/system/metallb/charts/metallb/templates/podmonitor.yaml
@@ -36,7 +36,6 @@ spec:
    relabelings:
 {{- toYaml .Values.prometheus.podMonitor.relabelings | nindent 4 }}
 {{- end }}
-{{- if .Values.speaker.enabled }}
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: PodMonitor
@@ -75,7 +74,6 @@ spec:
    relabelings:
 {{- toYaml .Values.prometheus.podMonitor.relabelings | nindent 4 }}
 {{- end }}
-{{- end }}
 ---
 {{- if .Values.prometheus.rbacPrometheus }}
 apiVersion: rbac.authorization.k8s.io/v1
--- a/packages/system/metallb/charts/metallb/templates/prometheusrules.yaml
+++ b/packages/system/metallb/charts/metallb/templates/prometheusrules.yaml
@@ -19,8 +19,8 @@ spec:
    {{- if .Values.prometheus.prometheusRule.staleConfig.enabled }}
    - alert: MetalLBStaleConfig
      annotations:
-        summary: {{`'Stale config on {{ $labels.pod }}'`}}
-        description: {{`'{{ $labels.job }} - MetalLB {{ $labels.container }} on {{ $labels.pod }} has a stale config for > 1 minute'`}}
+        message: {{`'{{ $labels.job }} - MetalLB {{ $labels.container }} on {{ $labels.pod
+          }} has a stale config for > 1 minute'`}}
      expr: metallb_k8s_client_config_stale_bool{job=~"{{ template "metallb.fullname" . }}.*"} == 1
      for: 1m
      {{- with .Values.prometheus.prometheusRule.staleConfig.labels }}
@@ -31,8 +31,8 @@ spec:
    {{- if .Values.prometheus.prometheusRule.configNotLoaded.enabled }}
    - alert: MetalLBConfigNotLoaded
      annotations:
-        summary: {{`'Config on {{ $labels.pod }} has not been loaded'`}}
-        description: {{`'{{ $labels.job }} - MetalLB {{ $labels.container }} on {{ $labels.pod }} has not loaded for > 1 minute'`}}
+        message: {{`'{{ $labels.job }} - MetalLB {{ $labels.container }} on {{ $labels.pod
+          }} has not loaded for > 1 minute'`}}
      expr: metallb_k8s_client_config_loaded_bool{job=~"{{ template "metallb.fullname" . }}.*"} == 0
      for: 1m
      {{- with .Values.prometheus.prometheusRule.configNotLoaded.labels }}
@@ -43,8 +43,8 @@ spec:
    {{- if .Values.prometheus.prometheusRule.addressPoolExhausted.enabled }}
    - alert: MetalLBAddressPoolExhausted
      annotations:
-        summary: {{`'Exhausted address pool on {{ $labels.pod }}'`}}
-        description: {{`'{{ $labels.job }} - MetalLB {{ $labels.container }} on {{ $labels.pod }} has exhausted address pool {{ $labels.pool }} for > 1 minute'`}}
+        message: {{`'{{ $labels.job }} - MetalLB {{ $labels.container }} on {{ $labels.pod
+          }} has exhausted address pool {{ $labels.pool }} for > 1 minute'`}}
      expr: metallb_allocator_addresses_in_use_total >= on(pool) metallb_allocator_addresses_total
      for: 1m
      {{- with .Values.prometheus.prometheusRule.addressPoolExhausted.labels }}
@@ -57,8 +57,8 @@ spec:
    {{- range .Values.prometheus.prometheusRule.addressPoolUsage.thresholds }}
    - alert: MetalLBAddressPoolUsage{{ .percent }}Percent
      annotations:
-        summary: {{`'Exhausted address pool on {{ $labels.pod }}'`}}
-        message: {{`'{{ $labels.job }} - MetalLB {{ $labels.container }} on {{ $labels.pod }} has address pool {{ $labels.pool }} past `}}{{ .percent }}{{`% usage for > 1 minute'`}}
+        message: {{`'{{ $labels.job }} - MetalLB {{ $labels.container }} on {{ $labels.pod
+          }} has address pool {{ $labels.pool }} past `}}{{ .percent }}{{`% usage for > 1 minute'`}}
      expr: ( metallb_allocator_addresses_in_use_total / on(pool) metallb_allocator_addresses_total ) * 100 > {{ .percent }}
      {{- with .labels }}
      labels:
@@ -69,8 +69,8 @@ spec:
    {{- if .Values.prometheus.prometheusRule.bgpSessionDown.enabled }}
    - alert: MetalLBBGPSessionDown
      annotations:
-        summary:  {{`'BGP session down on {{ $labels.pod }}'`}}
-        message: {{`'{{ $labels.job }} - MetalLB {{ $labels.container }} on {{ $labels.pod }} has BGP session {{ $labels.peer }} down for > 1 minute'`}}
+        message: {{`'{{ $labels.job }} - MetalLB {{ $labels.container }} on {{ $labels.pod
+          }} has BGP session {{ $labels.peer }} down for > 1 minute'`}}
      expr: metallb_bgp_session_up{job=~"{{ template "metallb.fullname" . }}.*"} == 0
      for: 1m
      {{- with .Values.prometheus.prometheusRule.bgpSessionDown.labels }}
--- a/packages/system/metallb/charts/metallb/templates/rbac.yaml
+++ b/packages/system/metallb/charts/metallb/templates/rbac.yaml
@@ -19,11 +19,11 @@ rules:
  resources: ["events"]
  verbs: ["create", "patch"]
 - apiGroups: ["admissionregistration.k8s.io"]
-  resources: ["validatingwebhookconfigurations"]
+  resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
  resourceNames: ["metallb-webhook-configuration"]
  verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
 - apiGroups: ["admissionregistration.k8s.io"]
-  resources: ["validatingwebhookconfigurations"]
+  resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
  verbs: ["list", "watch"]
 - apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
@@ -41,7 +41,6 @@ rules:
  resources: ["subjectaccessreviews"]
  verbs: ["create"]
 {{- end }}
-{{- if .Values.speaker.enabled }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -73,7 +72,7 @@ rules:
 {{- if or .Values.frrk8s.enabled .Values.frrk8s.external }}
 - apiGroups: ["frrk8s.metallb.io"]
  resources: ["frrconfigurations"]
-  verbs: ["get", "list", "watch","create","update","delete"]
+  verbs: ["get", "list", "watch","create","update"]
 {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -110,7 +109,6 @@ rules:
 - apiGroups: ["metallb.io"]
  resources: ["communities"]
  verbs: ["get", "list", "watch"]
-{{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -119,7 +117,7 @@ metadata:
  namespace: {{ .Release.Namespace | quote }}
  labels: {{- include "metallb.labels" . | nindent 4 }}
 rules:
-{{- if and .Values.speaker.enabled .Values.speaker.memberlist.enabled }}
+{{- if .Values.speaker.memberlist.enabled }}
 - apiGroups: [""]
  resources: ["secrets"]
  verbs: ["create", "get", "list", "watch"]
@@ -168,7 +166,6 @@ roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ template "metallb.fullname" . }}:controller
-{{- if .Values.speaker.enabled }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -198,7 +195,6 @@ roleRef:
 subjects:
 - kind: ServiceAccount
  name: {{ include "metallb.speaker.serviceAccountName" . }}
-{{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
--- a/packages/system/metallb/charts/metallb/templates/service-accounts.yaml
+++ b/packages/system/metallb/charts/metallb/templates/service-accounts.yaml
@@ -13,7 +13,7 @@ metadata:
    {{- toYaml . | nindent 4 }}
  {{- end }}
 {{- end }}
-{{- if and .Values.speaker.enabled .Values.speaker.serviceAccount.create }}
+{{- if .Values.speaker.serviceAccount.create }}
 ---
 apiVersion: v1
 kind: ServiceAccount
--- a/packages/system/metallb/charts/metallb/templates/servicemonitor.yaml
+++ b/packages/system/metallb/charts/metallb/templates/servicemonitor.yaml
@@ -1,9 +1,4 @@
-{{- if and .Values.prometheus.serviceMonitor.enabled .Values.prometheus.podMonitor.enabled }}
-{{- fail "prometheus.serviceMonitor.enabled and prometheus.podMonitor.enabled cannot both be set" }}
-{{- end }}
-
 {{- if .Values.prometheus.serviceMonitor.enabled }}
-{{- if .Values.speaker.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
@@ -94,7 +89,6 @@ spec:
 {{- end }}
  sessionAffinity: None
  type: ClusterIP
-{{- end }}
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
@@ -103,6 +97,7 @@ metadata:
  namespace: {{ .Release.Namespace | quote }}
  labels:
    {{- include "metallb.labels" . | nindent 4 }}
+    app.kubernetes.io/component: speaker
    {{- if .Values.prometheus.serviceMonitor.controller.additionalLabels }}
 {{ toYaml .Values.prometheus.serviceMonitor.controller.additionalLabels | indent 4 }}
    {{- end }}
--- a/packages/system/metallb/charts/metallb/values.yaml
+++ b/packages/system/metallb/charts/metallb/values.yaml
@@ -42,7 +42,7 @@ prometheus:
  # certificate to be used.
  controllerMetricsTLSSecret: ""

-  # prometheus doesn't have the permission to scrape all namespaces so we give it permission to scrape metallb's one
+  # prometheus doens't have the permission to scrape all namespaces so we give it permission to scrape metallb's one
  rbacPrometheus: true

  # the service account used by prometheus
@@ -64,7 +64,7 @@ prometheus:
    # enable support for Prometheus Operator
    enabled: false

-    # optional additional labels for podMonitors
+    # optional additionnal labels for podMonitors
    additionalLabels: {}

    # optional annotations for podMonitors
@@ -143,7 +143,7 @@ prometheus:
    # enable alertmanager alerts
    enabled: false

-    # optional additional labels for prometheusRules
+    # optional additionnal labels for prometheusRules
    additionalLabels: {}

    # optional annotations for prometheusRules
@@ -165,7 +165,7 @@ prometheus:
    addressPoolExhausted:
      enabled: true
      labels:
-        severity: critical
+        severity: alert

    addressPoolUsage:
      enabled: true
@@ -178,13 +178,13 @@ prometheus:
            severity: warning
        - percent: 95
          labels:
-            severity: critical
+            severity: alert

    # MetalLBBGPSessionDown
    bgpSessionDown:
      enabled: true
      labels:
-        severity: critical
+        severity: alert

    extraAlerts: []

--- a/packages/system/metallb/images/metallb/Dockerfile
+++ b/packages/system/metallb/images/metallb/Dockerfile
@@ -1,87 +0,0 @@
-# syntax=docker/dockerfile:1.2
-
-FROM --platform=$BUILDPLATFORM docker.io/golang:1.22.7 AS builder
-
-ARG VERSION
-ARG GIT_COMMIT=dev
-ARG GIT_BRANCH=dev
-ARG TARGETARCH
-ARG TARGETOS
-ARG TARGETPLATFORM
-
-WORKDIR /go/go.universe.tf/metallb
-
-RUN --mount=type=cache,target=/go/pkg/mod \
-    curl -sSL https://github.com/metallb/metallb/archive/refs/tags/${VERSION}.tar.gz \
-    | tar -xzvf- --strip=1 
-
-RUN curl -sSLO https://github.com/metallb/metallb/pull/2726.diff && \
-    git apply 2726.diff
-
-RUN --mount=type=cache,target=/go/pkg/mod \
-    --mount=type=cache,target=/root/.cache/go-build \
-    go mod download -x
-
-RUN case ${TARGETPLATFORM} in \
-    "linux/arm/v6") export VARIANT="6" ;; \
-    "linux/arm/v7") export VARIANT="7" ;; \
-    *) export VARIANT="" ;; \
-    esac && \
-    CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH GOARM=$VARIANT \
-    go build -v -o /build/controller \
-    -ldflags "-X 'go.universe.tf/metallb/internal/version.gitCommit=${GIT_COMMIT}' \
-      -X 'go.universe.tf/metallb/internal/version.gitBranch=${GIT_BRANCH}'" \
-    ./controller \
-    && \
-    CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH GOARM=$VARIANT \
-    go build -v -o /build/frr-metrics \
-    -ldflags "-X 'go.universe.tf/metallb/internal/version.gitCommit=${GIT_COMMIT}' \
-      -X 'go.universe.tf/metallb/internal/version.gitBranch=${GIT_BRANCH}'" \
-    frr-tools/metrics/exporter.go \
-    && \
-    CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH GOARM=$VARIANT \
-    go build -v -o /build/cp-tool \
-    -ldflags "-X 'go.universe.tf/metallb/internal/version.gitCommit=${GIT_COMMIT}' \
-      -X 'go.universe.tf/metallb/internal/version.gitBranch=${GIT_BRANCH}'" \
-    frr-tools/cp-tool/cp-tool.go \
-    && \
-    CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH GOARM=$VARIANT \
-    go build -v -o /build/speaker \
-    -ldflags "-X 'go.universe.tf/metallb/internal/version.gitCommit=${GIT_COMMIT}' \
-      -X 'go.universe.tf/metallb/internal/version.gitBranch=${GIT_BRANCH}'" \
-    ./speaker
-
-FROM gcr.io/distroless/static:latest as controller
-
-COPY --from=builder /build/controller /controller
-
-LABEL org.opencontainers.image.authors="metallb" \
-    org.opencontainers.image.url="https://github.com/metallb/metallb" \
-    org.opencontainers.image.documentation="https://metallb.universe.tf" \
-    org.opencontainers.image.source="https://github.com/cozystack/cozystack" \
-    org.opencontainers.image.vendor="metallb" \
-    org.opencontainers.image.licenses="Apache-2.0" \
-    org.opencontainers.image.description="Metallb Controller" \
-    org.opencontainers.image.title="controller" \
-    org.opencontainers.image.base.name="gcr.io/distroless/static:latest"
-
-ENTRYPOINT ["/controller"]
-
-FROM gcr.io/distroless/static:latest as speaker
-
-COPY --from=builder /build/cp-tool /cp-tool
-COPY --from=builder /build/speaker /speaker
-COPY --from=builder /build/frr-metrics /frr-metrics
-COPY --from=builder /go/go.universe.tf/metallb/frr-tools/reloader/frr-reloader.sh /frr-reloader.sh
-
-LABEL org.opencontainers.image.authors="metallb" \
-  org.opencontainers.image.url="https://github.com/metallb/metallb" \
-  org.opencontainers.image.documentation="https://metallb.universe.tf" \
-  org.opencontainers.image.source="https://github.com/cozystack/cozystack" \
-  org.opencontainers.image.vendor="metallb" \
-  org.opencontainers.image.licenses="Apache-2.0" \
-  org.opencontainers.image.description="Metallb speaker" \
-  org.opencontainers.image.title="speaker" \
-  org.opencontainers.image.base.name="gcr.io/distroless/static:latest"
-
-ENTRYPOINT ["/speaker"]
--- a/packages/system/metallb/values.yaml
+++ b/packages/system/metallb/values.yaml
@@ -2,12 +2,5 @@ metallb:
  crds:
    enabled: true

-  controller:
-    image:
-      repository: ghcr.io/cozystack/cozystack/metallb/controller
-      tag: v0.14.9@sha256:c86418d1072d6037341d731917d11a2f281fb17559d5bb650962512f9894fd50
-
-  speaker:
-    image:
-      repository: ghcr.io/cozystack/cozystack/metallb/speaker
-      tag: v0.14.9@sha256:60fddc8fd6c125180186db31990993b4ebea5023ad410bf08ca9537a956e8279
+  #speaker:
+  #  tolerateMaster: false
--- a/scripts/migrations/11
+++ b/scripts/migrations/11
--- a/scripts/migrations/12
+++ b/scripts/migrations/12
@@ -1,35 +0,0 @@
-#!/bin/sh
-# Migration 12 --> 13
-
-# Copy configuration from ingress to cozystack configmap
-if kubectl get hr -n tenant-root tenant-root > /dev/null; then
-  expose_services=$(
-    kubectl get hr -n tenant-root ingress -o go-template='{{ with .spec }}{{ with .values }}{{ if .dashboard  }}dashboard,{{ end }}{{ if .cdiUploadProxy }}cdi-uploadproxy,{{ end }}{{ if .virtExportProxy }}vm-exportproxy,{{ end }}{{ end }}{{ end }}'
-  )
-  expose_services=$(echo "$expose_services" | awk '{sub(/,$/,""); print}')
-  
-  expose_external_ips=$(
-    kubectl get hr -n tenant-root ingress -o go-template='{{ with .spec }}{{ with .values }}{{ if .externalIPs  }}{{ range .externalIPs }}{{ . }},{{ end }}{{ end }}{{ end }}{{ end }}'
-  )
-  expose_external_ips=$(echo "$expose_external_ips" | awk '{sub(/,$/,""); print}')
-
-  existing_expose_external_ips=$(kubectl get cm -n cozy-system cozystack -o go-template='{{ index .data "expose-external-ips" }}')
-  existing_expose_services=$(kubectl get cm -n cozy-system cozystack -o go-template='{{ index .data "expose-services" }}')
-
-  if [ "$existing_expose_external_ips" == "<no value>" ]; then
-    kubectl patch cm -n cozy-system cozystack --type merge -p="{\"data\":{\"expose-external-ips\":\"$expose_external_ips\"}}"
-  fi
-
-  if [ "$existing_expose_services" == "<no value>" ]; then
-    kubectl patch cm -n cozy-system cozystack --type merge -p="{\"data\":{\"expose-services\":\"$expose_services\"}}"
-  fi
-
-  kubectl patch hr -n tenant-root ingress --type json -p='[{"op": "remove", "path": "/spec/values/dashboard"}]' || true
-  kubectl patch hr -n tenant-root ingress --type json -p='[{"op": "remove", "path": "/spec/values/cdiUploadProxy"}]' || true
-  kubectl patch hr -n tenant-root ingress --type json -p='[{"op": "remove", "path": "/spec/values/virtExportProxy"}]' || true
-  kubectl patch hr -n tenant-root ingress --type json -p='[{"op": "remove", "path": "/spec/values/externalIPs"}]' || true
-  kubectl patch hr -n tenant-root ingress --type merge -p='{"spec":{"chart":{"spec":{"version":"1.6.0"}}}}'
-fi
-
-# Write version to cozystack-version config
-kubectl create configmap -n cozy-system cozystack-version --from-literal=version=13 --dry-run=client -o yaml | kubectl apply -f-
--- a/scripts/package.mk
+++ b/scripts/package.mk
@@ -29,11 +29,3 @@ delete: check suspend ## Delete Helm release from a Kubernetes cluster
 check:
 	@if [ -z "$(NAME)" ]; then echo "env NAME is not set!" >&2; exit 1; fi
 	@if [ -z "$(NAMESPACE)" ]; then echo "env NAMESPACE is not set!" >&2; exit 1; fi
-
-clean:
-	rm -rf charts/
-
-%-update:
-	helm repo add $(REPO_NAME) $(REPO_URL)
-	helm repo update $(REPO_NAME)
-	helm pull $(REPO_NAME)/$(CHART_NAME) --untar --untardir charts --version "$(CHART_VERSION)"
Author	SHA1	Message	Date
Timofei Larkin	df07e7b95d	Remove user-facing config of limits and requests This patch introduces reusable library charts that provide backward-compatibility for users that specify their resources as explicit requests and limits for cpu, however this input is processed so that limits are set equal to requests except for CPU which only gets requests. Users can now embrace the new form by directly specifying resources in the first level of nesting (e.g. resources.cpu=100m instead of .resources.requests.cpu=100m). The order of precedence is top-level, then requests, then limits, ensuring that nothing will break in terms of scheduling, however workloads that specified limits much higher than requests might get a performance hit, now that they cannot use all this excess capacity. This should only affect memory-hungry workloads in low-contention environments. Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>	2025-05-12 19:00:01 +03:00
Timofei Larkin	db34f31175	Don't overcommit memory or throttle CPU This patch recreates the resource presets with a non-burstable memory allocation (request==limit) and without CPU limits. With the new presets the difference between the larger presets became meaningless, so their values were adjusted. Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>	2025-05-12 15:59:28 +03:00
Timofei Larkin	653e2bc774	[519] Cross-arch builds: builders variables (#907 ) Added PLATFORM variable to `common-envs.mk`: if not defined, it is calculated based on docker daemon arch. May be overridden by e.g. `make -e PLATFORM='linux/arm64' ...` Added the variable to a single Dockerfile for now.	2025-05-12 13:08:00 +04:00
Ubuntu	2349ff61c1	scripts/common-envs.mk: add PLATFORM calculation with json parsing Signed-off-by: nbykov0 <166552198+nbykov0@users.noreply.github.com>	2025-05-08 19:04:48 +03:00
Ubuntu	13139dd71d	Revert "Makefile: add buildx version requirement" This reverts commit 8d367533550236fc587bd5f236046c15f6b7609a. The check it introduced is not needed. Signed-off-by: nbykov0 <166552198+nbykov0@users.noreply.github.com>	2025-05-08 19:04:48 +03:00
nbykov0	57ac614865	Makefile: add buildx version requirement Signed-off-by: nbykov0 <166552198+nbykov0@users.noreply.github.com>	2025-05-08 19:04:48 +03:00
nbykov0	bbb93c647d	scripts/common-envs.mk: commit suggestions after a review Signed-off-by: nbykov0 <166552198+nbykov0@users.noreply.github.com>	2025-05-08 19:04:48 +03:00
nbykov0	951ba75d93	scripts/common-envs.mk: add --bootsrap flag to inspects Signed-off-by: nbykov0 <166552198+nbykov0@users.noreply.github.com>	2025-05-08 19:04:48 +03:00
nbykov0	15c9c4a068	system/cozystack-controller: add PLATFORM and BUILDER variables to Makefile Signed-off-by: nbykov0 <166552198+nbykov0@users.noreply.github.com>	2025-05-08 19:04:48 +03:00
nbykov0	57fefde732	scrips/common-envs.mk: add BUILDER and PLATFORM calculation Signed-off-by: nbykov0 <166552198+nbykov0@users.noreply.github.com>	2025-05-08 19:04:48 +03:00
nbykov0	b4a04df6f3	system/cozystack-controller: add PLATFORM variable to Makefile: syntax Signed-off-by: nbykov0 <166552198+nbykov0@users.noreply.github.com>	2025-05-08 19:04:48 +03:00
nbykov0	1e63b5e8ce	system/cozystack-controller: add PLATFORM variable to Makefile Signed-off-by: nbykov0 <166552198+nbykov0@users.noreply.github.com>	2025-05-08 19:04:48 +03:00
nbykov0	6ad30915eb	Add PLATFORM make variable; calculate it if undefined Signed-off-by: nbykov0 <166552198+nbykov0@users.noreply.github.com>	2025-05-08 19:04:48 +03:00
Timofei Larkin	557ffa536f	Update kube-ovn to latest version (#922 ) This commit bumps kube-ovn to 1.13.11 and does away with patching the code now that the fixes necessary for kube-ovn to work properly in Talos have been released in the upstream.	2025-05-08 16:33:17 +04:00
Andrei Kvapil	ae05d2f545	[kubernetes] Enable Cilium Gateway API #923 (#924 ) Implementation of Cilium Gateway API <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Added optional Gateway API addon for Kubernetes clusters, controlled by a new configuration flag. - Introduced automated deployment of Gateway API CRDs when the addon is enabled. - Documentation - Updated documentation to describe the new Gateway API addon and its configuration. - Chores - Added chart metadata and automation files for managing Gateway API CRDs. - Updated chart version to reflect new features. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-05-08 12:21:17 +02:00
Andrei Kvapil	563c643813	[kubernetes] refactor gatewayAPI option Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-05-08 12:19:07 +02:00
Zdenek Deu Janda	68c85ac9ef	[kubernetes] Enable Cilium Gateway API Signed-off-by: Zdenek Deu Janda <zdenek.janda@cloudevelops.com>	2025-05-08 12:18:40 +02:00
Timofei Larkin	3ac00ea4ec	Update kube-ovn to latest version This commit bumps kube-ovn to 1.13.11 and does away with patching the code now that the fixes necessary for kube-ovn to work properly in Talos have been released in the upstream. Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>	2025-05-07 14:35:00 +03:00
klinch0	29b49496f2	[platform] delete extra dependencies for piraeus operator (#856 ) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Chores - Updated dependency configuration so that piraeus-operator no longer depends on victoria-metrics-operator. - Refactor - Improved compatibility by ensuring certain resources (VMPodScrape and alert definitions) are only rendered if the required API versions are available in the Kubernetes cluster. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-05-07 12:30:31 +03:00
kklinch0	3c27192d3e	[platform] delete extra dependencies for piraeus operator Signed-off-by: kklinch0 <kklinch0@gmail.com>	2025-05-05 16:56:12 +03:00
klinch0	dca732cde0	[platform] add hr reconciler (#870 ) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Introduced a new controller to synchronize tenant HelmReleases and propagate configuration changes. - Added dynamic host value overrides in multiple Helm templates by conditionally retrieving values from the "tenant-root" HelmRelease. - Updated RBAC permissions to allow management of HelmRelease resources. - Improvements - Added support for Helm v2 API integration. - Enhanced HelmRelease reconciliation logic and configuration propagation for tenant environments. - Bug Fixes - Fixed periodic reconciliation for the "tenant-root" HelmRelease by setting its interval to zero. - Version Updates - Incremented version numbers for the "info" and "ingress" packages. - Chores - Updated version mappings and commit references. - Improved .gitignore to exclude the .vscode directory. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-05-05 16:41:34 +03:00
Timofei Larkin	0346dc05bb	Enable user-added params in tenant cluster Cilium (#917 ) Users requested the possibility of passing custom values to the Cilium HelmRelease in tenant k8s clusters to enable its latest features, such as support for the Gateway API. This customization is now available via the `valuesOverride` field under `addons.cilium` in the kubernetes' app values. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Added support for custom override values for the Cilium addon, allowing users to configure Cilium settings via the values file. - Chores - Updated the Kubernetes chart version to 0.20.0. - Updated version mappings to reflect the new chart version. - Documentation - Updated Kubernetes managed service docs to include configuration details for Cilium addon overrides. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-05-05 16:55:17 +04:00
Timofei Larkin	a03cdeff04	Enable user-added params in tenant cluster Cilium Users requested the possibility of passing custom values to the Cilium HelmRelease in tenant k8s clusters to enable its latest features, such as support for the Gateway API. This customization is now available via the `valuesOverride` field under `addons.cilium` in the kubernetes' app values. Additionally add dummy schema for S3 bucket, as it breaks the pre-commit checks. Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>	2025-05-05 15:37:34 +03:00
Nick Volynkin	062d72805a	[docs] Update release policy: Release Candidate versions (#897 ) Documentation* - Expanded the release documentation with a new section explaining Cozystack's staged release process, including details on Release Candidates, Regular Releases, and Patch Releases. - Clarified the workflow and purpose of Release Candidates and updated the explanation of how regular releases are created. Signed-off-by: Nick Volynkin <nick.volynkin@gmail.com>	2025-05-05 16:15:57 +07:00
Nick Volynkin	70fed8148d	[ci] Run pre-commit checks even on doc changes Pre-commit is now required to merge PRs, so let it run even on documentation updates. An alternative is to merge with administrator permissions, bypassing rules, which is not a good practice. Signed-off-by: Nick Volynkin <nick.volynkin@gmail.com>	2025-05-05 11:57:02 +03:00
Nick Volynkin	12c6df83f5	[docs] Update release policy: Release Candidate versions Signed-off-by: Nick Volynkin <nick.volynkin@gmail.com>	2025-05-05 11:52:06 +03:00
kklinch0	f61a7817e6	[platform] add hr reconciler Signed-off-by: kklinch0 <kklinch0@gmail.com>	2025-05-05 09:26:50 +03:00
Timofei Larkin	c482289b14	Make kubevirt's CPU allocation ratio configurable (#905 ) Kubevirt's default cpu-to-vcpu ration is 1:10, which might be a bit extreme for some users. This patch introduces a new key in the Cozystack configmap, "cpu-allocation-ratio" where admins of Cozystack can specify an alternative value, if needed. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Added support for optionally configuring a CPU allocation ratio for KubeVirt deployments when the relevant setting is provided. - Chores - Improved configuration flexibility for KubeVirt by allowing dynamic injection of CPU allocation settings. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-04-30 10:53:42 +04:00
Timofei Larkin	1e59e5fbb6	Fix virtual machine resource tracking (#904 ) * Count Workload resources for pods by requests, not limits * Do not count init container requests * Prefix Workloads for pods with `pod-`, just like the other types to prevent possible name collisions (closes #787) The previous version of the WorkloadMonitor controller incorrectly summed resource limits on pods, rather than requests. This prevented it from tracking the resource allocation for pods, which only had requests specified, which is particularly the case for kubevirt's virtual machine pods. Additionally, it counted the limits for all containers, including init containers, which are short-lived and do not contribute much to the total resource usage. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Bug Fixes - Improved handling of workloads with unrecognized prefixes by ensuring they are properly deleted and not processed further. - Corrected resource aggregation for Pods to sum container resource requests instead of limits, and now only includes normal containers. - New Features - Added support for monitoring workloads with names prefixed by "pod-". - Tests - Introduced unit tests to verify correct handling of workload name prefixes and monitored object creation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-04-30 10:52:17 +04:00
Timofei Larkin	6106a9fe51	Make kubevirt's CPU allocation ratio configurable Kubevirt's default cpu-to-vcpu ration is 1:10, which might be a bit extreme for some users. This patch introduces a new key in the Cozystack configmap, "cpu-allocation-ratio" where admins of Cozystack can specify an alternative value, if needed. Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>	2025-04-29 16:13:18 +03:00
Timofei Larkin	ec9e26c054	Fix virtual machine resource tracking * Count Workload resources for pods by requests, not limits * Do not count init container requests * Prefix Workloads for pods with `pod-`, just like the other types to prevent possible name collisions (closes #787) The previous version of the WorkloadMonitor controller incorrectly summed resource limits on pods, rather than requests. This prevented it from tracking the resource allocation for pods, which only had requests specified, which is particularly the case for kubevirt's virtual machine pods. Additionally, it counted the limits for all containers, including init containers, which are short-lived and do not contribute much to the total resource usage. Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>	2025-04-29 15:22:46 +03:00
Andrei Kvapil	108fc647ea	[ci] Use dots in release candidtate versions, as per SemVer (#901 ) This change also fixes `finalizing release` workflow https://github.com/cozystack/cozystack/pull/890#issuecomment-2830525103 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Chores - Updated release tag validation to require a dot between "rc" and the number (e.g., `v0.31.5-rc.1` instead of `v0.31.5-rc1`). - Adjusted error messages to reflect the new release tag format. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-04-25 17:01:13 +02:00
Andrei Kvapil	a9b235048d	[ci] Use dots in release candidtate versions, as per SemVer Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-04-25 16:54:41 +02:00
Andrei Kvapil	e1c14619d2	Revert "[ci] automatically trigger tests in releasing PR" (#900 ) Revert https://github.com/cozystack/cozystack/pull/894 due to fact this logic does not trigger checks in pull requests <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Chores - Removed support for manually triggering the pull request release workflow. - Simplified release workflow to run automatically only on labeled pull requests. - Eliminated the step in the tags workflow that triggered release verification via manual dispatch. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-04-25 16:50:06 +02:00
Andrei Kvapil	f644bf20c5	Revert "[ci] automatically trigger tests in releasing PR" Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2025-04-25 16:47:45 +02:00