Prepare release v0.30.5

Signed-off-by: github-actions <github-actions@github.com>
2026-04-03 00:04:52 +00:00 · 2025-05-05 14:22:08 +00:00
45 changed files with 157 additions and 371 deletions
--- a/1
+++ b/1
@@ -20,7 +20,6 @@ build: build-deps
 	make -C packages/system/kubeovn image
 	make -C packages/system/kubeovn-webhook image
 	make -C packages/system/dashboard image
-	make -C packages/system/metallb image
 	make -C packages/system/kamaji image
 	make -C packages/system/bucket image
 	make -C packages/core/testing image
--- a/packages/apps/bucket/README.md
+++ b/packages/apps/bucket/README.md
@@ -1,3 +0,0 @@
-# S3 bucket
-
-## Parameters
--- a/packages/apps/bucket/values.schema.json
+++ b/packages/apps/bucket/values.schema.json
@@ -1,5 +0,0 @@
-{
-    "title": "Chart Values",
-    "type": "object",
-    "properties": {}
-}
--- a/packages/apps/bucket/values.yaml
+++ b/packages/apps/bucket/values.yaml
@@ -1 +0,0 @@
-{}
--- a/packages/apps/http-cache/images/nginx-cache.tag
+++ b/packages/apps/http-cache/images/nginx-cache.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/nginx-cache:0.4.0@sha256:2e72835a1dcf222038fb5cb343d59f7e60b5c1adf1bf93ca123a8a660e27bcbc
+ghcr.io/cozystack/cozystack/nginx-cache:0.4.0@sha256:529650c1aa6ee4ceba74af35b526e4e6f4ad44d9a8a75d1f2f2dbb015cbf194c
--- a/packages/apps/kubernetes/README.md
+++ b/packages/apps/kubernetes/README.md
@@ -27,44 +27,20 @@ How to access to deployed cluster:
 kubectl get secret -n <namespace> kubernetes-<clusterName>-admin-kubeconfig -o go-template='{{ printf "%s\n" (index .data "super-admin.conf" | base64decode) }}' > test
 ```

-## Parameters
+# Series

-### Common parameters
+<!-- source: https://github.com/kubevirt/common-instancetypes/blob/main/README.md -->

-| Name                    | Description                                                                                                                            | Value        |
-| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | ------------ |
-| `host`                  | The hostname used to access the Kubernetes cluster externally (defaults to using the cluster name as a subdomain for the tenant host). | `""`         |
-| `controlPlane.replicas` | Number of replicas for Kubernetes contorl-plane components                                                                             | `2`          |
-| `storageClass`          | StorageClass used to store user data                                                                                                   | `replicated` |
-| `nodeGroups`            | nodeGroups configuration                                                                                                               | `{}`         |
-
-### Cluster Addons
-
-| Name                                          | Description                                                                                                                                                       | Value   |
-| --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
-| `addons.certManager.enabled`                  | Enables the cert-manager                                                                                                                                          | `false` |
-| `addons.certManager.valuesOverride`           | Custom values to override                                                                                                                                         | `{}`    |
-| `addons.ingressNginx.enabled`                 | Enable Ingress-NGINX controller (expect nodes with 'ingress-nginx' role)                                                                                          | `false` |
-| `addons.ingressNginx.valuesOverride`          | Custom values to override                                                                                                                                         | `{}`    |
-| `addons.ingressNginx.hosts`                   | List of domain names that should be passed through to the cluster by upper cluster                                                                                | `[]`    |
-| `addons.fluxcd.enabled`                       | Enables Flux CD                                                                                                                                                   | `false` |
-| `addons.fluxcd.valuesOverride`                | Custom values to override                                                                                                                                         | `{}`    |
-| `addons.monitoringAgents.enabled`             | Enables MonitoringAgents (fluentbit, vmagents for sending logs and metrics to storage) if tenant monitoring enabled, send to tenant storage, else to root storage | `false` |
-| `addons.monitoringAgents.valuesOverride`      | Custom values to override                                                                                                                                         | `{}`    |
-| `addons.verticalPodAutoscaler.valuesOverride` | Custom values to override                                                                                                                                         | `{}`    |
-
-### Kamaji control plane
-
-| Name                                                            | Description                                                                                                                                                                                                       | Value   |
-| --------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
-| `kamajiControlPlane.apiServer.resources`                        | Resources                                                                                                                                                                                                         | `{}`    |
-| `kamajiControlPlane.apiServer.resourcesPreset`                  | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production). | `small` |
-| `kamajiControlPlane.controllerManager.resources`                | Resources                                                                                                                                                                                                         | `{}`    |
-| `kamajiControlPlane.controllerManager.resourcesPreset`          | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production). | `micro` |
-| `kamajiControlPlane.scheduler.resources`                        | Resources                                                                                                                                                                                                         | `{}`    |
-| `kamajiControlPlane.scheduler.resourcesPreset`                  | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production). | `micro` |
-| `kamajiControlPlane.addons.konnectivity.server.resources`       | Resources                                                                                                                                                                                                         | `{}`    |
-| `kamajiControlPlane.addons.konnectivity.server.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production). | `micro` |
+.                           |  U  |  O  |  CX  |  M  |  RT
+----------------------------|-----|-----|------|-----|------
+*Has GPUs*                  |     |     |      |     |
+*Hugepages*                 |     |     |  ✓   |  ✓  |  ✓
+*Overcommitted Memory*      |     |  ✓  |      |     |
+*Dedicated CPU*             |     |     |  ✓   |     |  ✓
+*Burstable CPU performance* |  ✓  |  ✓  |      |  ✓  |
+*Isolated emulator threads* |     |     |  ✓   |     |  ✓
+*vNUMA*                     |     |     |  ✓   |     |  ✓
+*vCPU-To-Memory Ratio*      | 1:4 | 1:4 |  1:2 | 1:8 | 1:4


 ## U Series
--- a/packages/apps/kubernetes/images/kubevirt-cloud-provider.tag
+++ b/packages/apps/kubernetes/images/kubevirt-cloud-provider.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-cloud-provider:0.18.1@sha256:af456f75b9bda2ca23e114dcf7f3ba6d4da6a4cf83105c92c9ab2b1ac3615f63
+ghcr.io/cozystack/cozystack/kubevirt-cloud-provider:0.18.1@sha256:20d1ed52aadfeb71732cdd5060c76f322d147a5102b11d69ff0e7adf42698d79
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.18.1@sha256:5f59b1987bdbd1b7271c4d46552bb0780d60cabfef02c29abb962b06f1386f35
+ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.18.1@sha256:14e887aab7cb40fb500135db7121e621a6086e578fbbc2b389ea672d3651caf5
--- a/packages/apps/kubernetes/images/ubuntu-container-disk.tag
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.30.1@sha256:fb5e09edf7b3fa5849b0c0f3f4ff5657a41fcbd97444704254deafd6b36f0992
+ghcr.io/cozystack/cozystack/ubuntu-container-disk:v1.30.1@sha256:6359b7877f04c6ac6641c0ebcc2a1d03cabfe1718464cd43f82e97724ad6aad8
--- a/packages/apps/kubernetes/values.schema.json
+++ b/packages/apps/kubernetes/values.schema.json
@@ -90,93 +90,8 @@
                            "default": {}
                        }
                    }
-                },
-                "verticalPodAutoscaler": {
-                    "type": "object",
-                    "properties": {
-                        "valuesOverride": {
-                            "type": "object",
-                            "description": "Custom values to override",
-                            "default": {}
-                        }
-                    }
-                }
-            }
-        },
-        "kamajiControlPlane": {
-            "type": "object",
-            "properties": {
-                "apiServer": {
-                    "type": "object",
-                    "properties": {
-                        "resources": {
-                            "type": "object",
-                            "description": "Resources",
-                            "default": {}
-                        },
-                        "resourcesPreset": {
-                            "type": "string",
-                            "description": "Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production).",
-                            "default": "small"
-                        }
-                    }
-                },
-                "controllerManager": {
-                    "type": "object",
-                    "properties": {
-                        "resources": {
-                            "type": "object",
-                            "description": "Resources",
-                            "default": {}
-                        },
-                        "resourcesPreset": {
-                            "type": "string",
-                            "description": "Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production).",
-                            "default": "micro"
-                        }
-                    }
-                },
-                "scheduler": {
-                    "type": "object",
-                    "properties": {
-                        "resources": {
-                            "type": "object",
-                            "description": "Resources",
-                            "default": {}
-                        },
-                        "resourcesPreset": {
-                            "type": "string",
-                            "description": "Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production).",
-                            "default": "micro"
-                        }
-                    }
-                },
-                "addons": {
-                    "type": "object",
-                    "properties": {
-                        "konnectivity": {
-                            "type": "object",
-                            "properties": {
-                                "server": {
-                                    "type": "object",
-                                    "properties": {
-                                        "resources": {
-                                            "type": "object",
-                                            "description": "Resources",
-                                            "default": {}
-                                        },
-                                        "resourcesPreset": {
-                                            "type": "string",
-                                            "description": "Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production).",
-                                            "default": "micro"
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    }
                }
            }
        }
    }
-}
+}
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -1,2 +1,2 @@
 cozystack:
-  image: ghcr.io/cozystack/cozystack/installer:v0.30.6@sha256:d16944b050f044b4bd95d396b9a2c07933d40a8285dc286a6b989b57a58a3999
+  image: ghcr.io/cozystack/cozystack/installer:v0.30.5@sha256:e13c08b9e1adb90dc9e607a36018daef45942c4f9186710a6e37d1214bb9adfb
--- a/packages/core/testing/values.yaml
+++ b/packages/core/testing/values.yaml
@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v0.30.6@sha256:3e6fe802702a59f495f75415863a8a3b075971e4e6a62dbb0bfd41300e357485
+  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v0.30.5@sha256:c887410f9004805522594680fd05d5454953613fd568c527589952294d9793e9
--- a/packages/extra/bootbox/images/matchbox.tag
+++ b/packages/extra/bootbox/images/matchbox.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/matchbox:v0.30.6@sha256:5cfcc7501be3088657a77796e3871e896953d0a8b825c301fb56dfa93e93586c
+ghcr.io/cozystack/cozystack/matchbox:v0.30.5@sha256:167b592b12273150ae3182004fcd40fbdf5471119ac8ce0b18e6934af5b3e08e
--- a/packages/extra/monitoring/images/grafana.tag
+++ b/packages/extra/monitoring/images/grafana.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/grafana:1.9.2@sha256:fb48d37f1a9386e0023df9ac067ec2e03953b7b8c9d6abf2d12716e084f846a4
+ghcr.io/cozystack/cozystack/grafana:1.9.2@sha256:24382d445bf7a39ed988ef4dc7a0d9f084db891fcb5f42fd2e64622710b9457e
--- a/packages/system/bucket/images/s3manager.tag
+++ b/packages/system/bucket/images/s3manager.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/s3manager:v0.5.0@sha256:30fd3277ef61566688a87b34d2d3f401abb205a6fb2547bdd99a7dcf1a3a2e7e
+ghcr.io/cozystack/cozystack/s3manager:v0.5.0@sha256:31da347157adc2e05e280b958eae8b027eda75be4c2db0bf608197c0b3b30d2e
--- a/packages/system/cozystack-api/values.yaml
+++ b/packages/system/cozystack-api/values.yaml
@@ -1,2 +1,2 @@
 cozystackAPI:
-  image: ghcr.io/cozystack/cozystack/cozystack-api:v0.30.6@sha256:fc321690bb822498dc7c62818a9cd40d344b3646bbc007a46bbfb06d1c6d0bd7
+  image: ghcr.io/cozystack/cozystack/cozystack-api:v0.30.5@sha256:1c7985bb9d3dbb3b058581f218f82f22252a7bcd028e592ec371089362bf6757
--- a/packages/system/cozystack-controller/values.yaml
+++ b/packages/system/cozystack-controller/values.yaml
@@ -1,5 +1,5 @@
 cozystackController:
-  image: ghcr.io/cozystack/cozystack/cozystack-controller:v0.30.6@sha256:5128ef094e55e082ab514f4026876a78b8903612aa1722acf3fe3c132481d4bb
+  image: ghcr.io/cozystack/cozystack/cozystack-controller:v0.30.5@sha256:3140019eb7ffa521da226400558b421cb2395fc00fd5a65f3a60ab7ee868f240
  debug: false
  disableTelemetry: false
-  cozystackVersion: "v0.30.6"
+  cozystackVersion: "v0.30.5"
--- a/packages/system/dashboard/charts/kubeapps/templates/dashboard/configmap.yaml
+++ b/packages/system/dashboard/charts/kubeapps/templates/dashboard/configmap.yaml
@@ -76,7 +76,7 @@ data:
      "kubeappsNamespace": {{ .Release.Namespace | quote }},
      "helmGlobalNamespace": {{ include "kubeapps.helmGlobalPackagingNamespace" . | quote }},
      "carvelGlobalNamespace": {{ .Values.kubeappsapis.pluginConfig.kappController.packages.v1alpha1.globalPackagingNamespace | quote }},
-      "appVersion": "v0.30.6",
+      "appVersion": "v0.30.5",
      "authProxyEnabled": {{ .Values.authProxy.enabled }},
      "oauthLoginURI": {{ .Values.authProxy.oauthLoginURI | quote }},
      "oauthLogoutURI": {{ .Values.authProxy.oauthLogoutURI | quote }},
--- a/packages/system/dashboard/values.yaml
+++ b/packages/system/dashboard/values.yaml
@@ -18,14 +18,14 @@ kubeapps:
    image:
      registry: ghcr.io/cozystack/cozystack
      repository: dashboard
-      tag: v0.30.6
+      tag: v0.30.5
      digest: "sha256:a83fe4654f547469cfa469a02bda1273c54bca103a41eb007fdb2e18a7a91e93"
  kubeappsapis:
    image:
      registry: ghcr.io/cozystack/cozystack
      repository: kubeapps-apis
-      tag: v0.30.6
-      digest: "sha256:cbb14a3becd0ca847a87fa17211a3348d4f0ff499738a47e1f86c85ce1b72f71"
+      tag: v0.30.5
+      digest: "sha256:09bb7073ac3dd89c2cfe972e24a7898b208c0dfec3db09d6994523ef96e445ab"
    pluginConfig:
      flux:
        packages:
--- a/packages/system/kamaji/values.yaml
+++ b/packages/system/kamaji/values.yaml
@@ -3,7 +3,7 @@ kamaji:
    deploy: false
  image:
    pullPolicy: IfNotPresent
-    tag: v0.30.6@sha256:3bc9ae6d996fa041b4c5cd951ac99d3bb45884bff87462144ccf3db1c0425a36
+    tag: v0.30.5@sha256:094ad5f4938867d7cea63709b375c3ba781853c10ce78d52fab44a1917bb4d34
    repository: ghcr.io/cozystack/cozystack/kamaji
  resources:
    limits:
--- a/packages/system/kubeovn-webhook/values.yaml
+++ b/packages/system/kubeovn-webhook/values.yaml
@@ -1,3 +1,3 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v0.30.6@sha256:b183c02ca2236f15eadcb0b728696022269de7c9bbf9e594f0b4e38d4f3b163f
+image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v0.30.5@sha256:1b924921013052a013fc1867d950798a27c587247b8ba3be154ce82f62fb88e7
--- a/packages/system/kubeovn/Makefile
+++ b/packages/system/kubeovn/Makefile
@@ -1,4 +1,4 @@
-KUBEOVN_TAG=$(shell awk '$$1 == "version:" {print $$2}' charts/kube-ovn/Chart.yaml)
+KUBEOVN_TAG = v1.13.8

 export NAME=kubeovn
 export NAMESPACE=cozy-$(NAME)
--- a/packages/system/kubeovn/charts/kube-ovn/Chart.yaml
+++ b/packages/system/kubeovn/charts/kube-ovn/Chart.yaml
@@ -15,12 +15,12 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v1.13.11
+version: v1.13.8

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "1.13.11"
+appVersion: "1.13.8"

 kubeVersion: ">= 1.23.0-0"
--- a/packages/system/kubeovn/charts/kube-ovn/templates/controller-deploy.yaml
+++ b/packages/system/kubeovn/charts/kube-ovn/templates/controller-deploy.yaml
@@ -83,9 +83,6 @@ spec:
          - --node-switch={{ .Values.networking.NODE_SUBNET }}
          - --node-switch-cidr={{ index $cozyConfig.data "ipv4-join-cidr" }}
          - --service-cluster-ip-range={{ index $cozyConfig.data "ipv4-svc-cidr" }}
-          {{- if .Values.global.logVerbosity }}
-          - --v={{ .Values.global.logVerbosity }}
-          {{- end }}
          - --network-type={{- .Values.networking.NETWORK_TYPE }}
          - --default-provider-name={{ .Values.networking.vlan.PROVIDER_NAME }}
          - --default-interface-name={{- .Values.networking.vlan.VLAN_INTERFACE_NAME }}
--- a/packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml
+++ b/packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml
@@ -35,7 +35,11 @@ spec:
        command:
          - sh
          - -xec
-          - iptables -V
+          - {{ if not .Values.DISABLE_MODULES_MANAGEMENT -}}
+            iptables -V
+            {{- else -}}
+            echo "nothing to do"
+            {{- end }}
        securityContext:
          allowPrivilegeEscalation: true
          capabilities:
@@ -89,9 +93,6 @@ spec:
          - --node-switch={{ .Values.networking.NODE_SUBNET }}
          - --encap-checksum=true
          - --service-cluster-ip-range={{ index $cozyConfig.data "ipv4-svc-cidr" }}
-          {{- if .Values.global.logVerbosity }}
-          - --v={{ .Values.global.logVerbosity }}
-          {{- end }}
          {{- if eq .Values.networking.NETWORK_TYPE "vlan" }}
          - --iface=
          {{- else}}
@@ -124,6 +125,9 @@ spec:
              - NET_RAW
              - SYS_ADMIN
              - SYS_PTRACE
+              {{- if not .Values.DISABLE_MODULES_MANAGEMENT }}
+              - SYS_MODULE
+              {{- end }}
              - SYS_NICE
        env:
          - name: ENABLE_SSL
--- a/packages/system/kubeovn/charts/kube-ovn/templates/ovsovn-ds.yaml
+++ b/packages/system/kubeovn/charts/kube-ovn/templates/ovsovn-ds.yaml
@@ -49,9 +49,8 @@ spec:
            - -xec
            - |
              chown -R nobody: /var/run/ovn /var/log/ovn /etc/openvswitch /var/run/openvswitch /var/log/openvswitch
-              iptables -V
              {{- if not .Values.DISABLE_MODULES_MANAGEMENT }}
-              /usr/share/openvswitch/scripts/ovs-ctl load-kmod
+              iptables -V
              {{- else }}
              ln -sf /bin/true /usr/local/sbin/modprobe
              ln -sf /bin/true /usr/local/sbin/modinfo
@@ -65,9 +64,6 @@ spec:
            privileged: true
            runAsUser: 0
          volumeMounts:
-            - mountPath: /lib/modules
-              name: host-modules
-              readOnly: true
            - mountPath: /usr/local/sbin
              name: usr-local-sbin
            - mountPath: /var/log/ovn
@@ -100,7 +96,9 @@ spec:
              add:
                - NET_ADMIN
                - NET_BIND_SERVICE
-                - NET_RAW
+                {{- if not .Values.DISABLE_MODULES_MANAGEMENT }}
+                - SYS_MODULE
+                {{- end }}
                - SYS_NICE
                - SYS_ADMIN
          env:
--- a/packages/system/kubeovn/charts/kube-ovn/values.yaml
+++ b/packages/system/kubeovn/charts/kube-ovn/values.yaml
@@ -10,7 +10,7 @@ global:
      repository: kube-ovn
      dpdkRepository: kube-ovn-dpdk
      vpcRepository: vpc-nat-gateway
-      tag: v1.13.11
+      tag: v1.13.8
      support_arm: true
      thirdparty: true

--- a/packages/system/kubeovn/images/kubeovn/Dockerfile
+++ b/packages/system/kubeovn/images/kubeovn/Dockerfile
@@ -1,2 +1,54 @@
-ARG VERSION=v1.13.11
-FROM kubeovn/kube-ovn:${VERSION}
+# syntax = docker/dockerfile:experimental
+ARG VERSION=v1.13.8
+ARG BASE_TAG=$VERSION
+
+FROM golang:1.23-bookworm as builder
+
+ARG TAG=v1.13.8
+RUN git clone --branch ${TAG} --depth 1 https://github.com/kubeovn/kube-ovn /source
+
+WORKDIR /source
+
+COPY patches /patches
+RUN git apply /patches/*.diff
+RUN make build-go
+
+WORKDIR /source/dist/images
+
+# imported from https://github.com/kubeovn/kube-ovn/blob/master/dist/images/Dockerfile
+FROM kubeovn/kube-ovn-base:$BASE_TAG AS setcap
+
+COPY --from=builder /source/dist/images/*.sh /kube-ovn/
+COPY --from=builder /source/dist/images/kubectl-ko /kube-ovn/kubectl-ko
+COPY --from=builder /source/dist/images/01-kube-ovn.conflist /kube-ovn/01-kube-ovn.conflist
+
+COPY --from=builder /source/dist/images/kube-ovn /kube-ovn/kube-ovn
+COPY --from=builder /source/dist/images/kube-ovn-cmd /kube-ovn/kube-ovn-cmd
+COPY --from=builder /source/dist/images/kube-ovn-daemon /kube-ovn/kube-ovn-daemon
+COPY --from=builder /source/dist/images/kube-ovn-controller /kube-ovn/kube-ovn-controller
+RUN ln -s /kube-ovn/kube-ovn-cmd /kube-ovn/kube-ovn-monitor && \
+    ln -s /kube-ovn/kube-ovn-cmd /kube-ovn/kube-ovn-speaker && \
+    ln -s /kube-ovn/kube-ovn-cmd /kube-ovn/kube-ovn-webhook && \
+    ln -s /kube-ovn/kube-ovn-cmd /kube-ovn/kube-ovn-leader-checker && \
+    ln -s /kube-ovn/kube-ovn-cmd /kube-ovn/kube-ovn-ic-controller && \
+    ln -s /kube-ovn/kube-ovn-controller /kube-ovn/kube-ovn-pinger && \
+    setcap CAP_NET_BIND_SERVICE+eip /kube-ovn/kube-ovn-cmd && \
+    setcap CAP_NET_RAW,CAP_NET_BIND_SERVICE+eip /kube-ovn/kube-ovn-controller && \
+    setcap CAP_NET_ADMIN,CAP_NET_RAW,CAP_NET_BIND_SERVICE,CAP_SYS_ADMIN+eip /kube-ovn/kube-ovn-daemon
+
+FROM kubeovn/kube-ovn-base:$BASE_TAG
+
+COPY --chmod=0644 --from=builder /source/dist/images/logrotate/* /etc/logrotate.d/
+COPY --from=builder /source/dist/images/grace_stop_ovn_controller /usr/share/ovn/scripts/grace_stop_ovn_controller
+
+COPY --from=setcap /kube-ovn /kube-ovn
+RUN /kube-ovn/iptables-wrapper-installer.sh --no-sanity-check
+
+WORKDIR /kube-ovn
+
+# Fix https://github.com/kubeovn/kube-ovn/issues/4526
+RUN setcap CAP_NET_ADMIN,CAP_NET_BIND_SERVICE,CAP_SYS_ADMIN+eip /usr/lib/openvswitch-switch/ovs-vswitchd \
+ && setcap CAP_NET_ADMIN,CAP_NET_BIND_SERVICE,CAP_SYS_ADMIN+eip /usr/sbin/xtables-legacy-multi \
+ && setcap CAP_NET_ADMIN,CAP_NET_BIND_SERVICE,CAP_SYS_ADMIN+eip /usr/sbin/xtables-nft-multi \
+ && setcap CAP_NET_ADMIN,CAP_NET_RAW,CAP_NET_BIND_SERVICE,CAP_SYS_ADMIN+eip /usr/sbin/ipset \
+ && setcap CAP_NET_ADMIN,CAP_NET_RAW,CAP_SYS_ADMIN+eip /usr/bin/ip
--- a/packages/system/kubeovn/patches/cozyconfig.diff
+++ b/packages/system/kubeovn/patches/cozyconfig.diff
@@ -3,7 +3,7 @@ diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml b/
 index d9a9a67..b2e12dd 100644
 --- a/packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml
 +++ b/packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml
-@@ -51,18 +51,15 @@ spec:
+@@ -51,18 +51,12 @@ spec:
           - bash
           - /kube-ovn/start-cniserver.sh
         args:
@@ -21,9 +21,6 @@ index d9a9a67..b2e12dd 100644
 -          {{ .Values.ipv6.SVC_CIDR }}
 -          {{- end }}
 +          - --service-cluster-ip-range={{ index $cozyConfig.data "ipv4-svc-cidr" }}
-+          {{- if .Values.global.logVerbosity }}
-+          - --v={{ .Values.global.logVerbosity }}
-+          {{- end }}
           {{- if eq .Values.networking.NETWORK_TYPE "vlan" }}
           - --iface=
           {{- else}}
@@ -31,7 +28,7 @@ diff --git a/packages/system/kubeovn/charts/kube-ovn/templates/controller-deploy
 index 0e69494..756eb7c 100644
 --- a/packages/system/kubeovn/charts/kube-ovn/templates/controller-deploy.yaml
 +++ b/packages/system/kubeovn/charts/kube-ovn/templates/controller-deploy.yaml
-@@ -52,46 +52,22 @@ spec:
+@@ -52,46 +52,19 @@ spec:
           image: {{ .Values.global.registry.address }}/{{ .Values.global.images.kubeovn.repository }}:{{ .Values.global.images.kubeovn.tag }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args:
@@ -80,9 +77,6 @@ index 0e69494..756eb7c 100644
 -          {{- end }}
 +          - --node-switch-cidr={{ index $cozyConfig.data "ipv4-join-cidr" }}
 +          - --service-cluster-ip-range={{ index $cozyConfig.data "ipv4-svc-cidr" }}
-+          {{- if .Values.global.logVerbosity }}
-+          - --v={{ .Values.global.logVerbosity }}
-+          {{- end }}
           - --network-type={{- .Values.networking.NETWORK_TYPE }}
           - --default-provider-name={{ .Values.networking.vlan.PROVIDER_NAME }}
           - --default-interface-name={{- .Values.networking.vlan.VLAN_INTERFACE_NAME }}
--- a/packages/system/kubeovn/values.yaml
+++ b/packages/system/kubeovn/values.yaml
@@ -22,4 +22,4 @@ global:
  images:
    kubeovn:
      repository: kubeovn
-      tag: v1.13.11@sha256:bbae091631c3ac6dbdd346c19187322211a9afe397566f601393a2cb338b5aeb
+      tag: v1.13.8@sha256:59f7e55e9b5557cb033c2731734170952f15b0c813d5579667c64d4a83f49a24
--- a/packages/system/metallb/Makefile
+++ b/packages/system/metallb/Makefile
@@ -1,7 +1,6 @@
 export NAME=metallb
 export NAMESPACE=cozy-$(NAME)

-include ../../../scripts/common-envs.mk
 include ../../../scripts/package.mk

 update:
@@ -10,25 +9,3 @@ update:
 	helm repo update metallb
 	helm pull metallb/metallb --untar --untardir charts
 	rm -rf charts/metallb/charts/frr-k8s
-
-image-controller image-speaker:
-	$(eval TARGET := $(subst image-,,$@))
-	$(eval VERSION := $(shell yq '.appVersion' charts/metallb/Chart.yaml))
-	docker buildx build images/metallb \
-		--provenance false \
-		--target $(TARGET) \
-		--build-arg VERSION=$(VERSION) \
-		--tag $(REGISTRY)/metallb-$(TARGET):$(VERSION) \
-		--cache-from type=registry,ref=$(REGISTRY)/metallb-$(TARGET):latest \
-		--cache-to type=inline \
-		--metadata-file images/$(TARGET).json \
-		--push=$(PUSH) \
-		--label "org.opencontainers.image.source=https://github.com/cozystack/cozystack"
-		--load=1
-	REPOSITORY="$(REGISTRY)/metallb-$(TARGET)" \
-		yq -i '.metallb.$(TARGET).image.repository = strenv(REPOSITORY)' values.yaml
-	TAG=$(VERSION)@$$(yq e '."containerimage.digest"' images/$(TARGET).json -o json -r) \
-		yq -i '.metallb.$(TARGET).image.tag = strenv(TAG)' values.yaml
-	rm -f images/$(TARGET).json
-
-image: image-controller image-speaker
--- a/packages/system/metallb/charts/metallb/Chart.lock
+++ b/packages/system/metallb/charts/metallb/Chart.lock
@@ -1,9 +1,9 @@
 dependencies:
 - name: crds
  repository: ""
-  version: 0.14.9
+  version: 0.14.8
 - name: frr-k8s
  repository: https://metallb.github.io/frr-k8s
-  version: 0.0.16
-digest: sha256:20d9a53af12c82d35168e7524ae337341b2c7cb43e2169545185f750a718466e
-generated: "2024-12-17T15:39:32.082324414+01:00"
+  version: 0.0.14
+digest: sha256:8dff488902a5b504a491bbd1a9ab0983a877ff214e163ed74106c73c939a9aa3
+generated: "2024-07-23T15:22:40.589621+03:00"
--- a/packages/system/metallb/charts/metallb/Chart.yaml
+++ b/packages/system/metallb/charts/metallb/Chart.yaml
@@ -1,14 +1,14 @@
 apiVersion: v2
-appVersion: v0.14.9
+appVersion: v0.14.8
 dependencies:
 - condition: crds.enabled
  name: crds
  repository: ""
-  version: 0.14.9
+  version: 0.14.8
 - condition: frrk8s.enabled
  name: frr-k8s
  repository: https://metallb.github.io/frr-k8s
-  version: 0.0.16
+  version: 0.0.14
 description: A network load-balancer implementation for Kubernetes using standard
  routing protocols
 home: https://metallb.universe.tf
@@ -18,4 +18,4 @@ name: metallb
 sources:
 - https://github.com/metallb/metallb
 type: application
-version: 0.14.9
+version: 0.14.8
--- a/packages/system/metallb/charts/metallb/README.md
+++ b/packages/system/metallb/charts/metallb/README.md
@@ -17,7 +17,7 @@ Kubernetes: `>= 1.19.0-0`
 | Repository | Name | Version |
 |------------|------|---------|
 |  | crds | 0.0.0 |
-| https://metallb.github.io/frr-k8s | frr-k8s | 0.0.16 |
+| https://metallb.github.io/frr-k8s | frr-k8s | 0.0.14 |

 ## Values

@@ -79,17 +79,17 @@ Kubernetes: `>= 1.19.0-0`
 | prometheus.podMonitor.relabelings | list | `[]` |  |
 | prometheus.prometheusRule.additionalLabels | object | `{}` |  |
 | prometheus.prometheusRule.addressPoolExhausted.enabled | bool | `true` |  |
-| prometheus.prometheusRule.addressPoolExhausted.labels.severity | string | `"critical"` |  |
+| prometheus.prometheusRule.addressPoolExhausted.labels.severity | string | `"alert"` |  |
 | prometheus.prometheusRule.addressPoolUsage.enabled | bool | `true` |  |
 | prometheus.prometheusRule.addressPoolUsage.thresholds[0].labels.severity | string | `"warning"` |  |
 | prometheus.prometheusRule.addressPoolUsage.thresholds[0].percent | int | `75` |  |
 | prometheus.prometheusRule.addressPoolUsage.thresholds[1].labels.severity | string | `"warning"` |  |
 | prometheus.prometheusRule.addressPoolUsage.thresholds[1].percent | int | `85` |  |
-| prometheus.prometheusRule.addressPoolUsage.thresholds[2].labels.severity | string | `"critical"` |  |
+| prometheus.prometheusRule.addressPoolUsage.thresholds[2].labels.severity | string | `"alert"` |  |
 | prometheus.prometheusRule.addressPoolUsage.thresholds[2].percent | int | `95` |  |
 | prometheus.prometheusRule.annotations | object | `{}` |  |
 | prometheus.prometheusRule.bgpSessionDown.enabled | bool | `true` |  |
-| prometheus.prometheusRule.bgpSessionDown.labels.severity | string | `"critical"` |  |
+| prometheus.prometheusRule.bgpSessionDown.labels.severity | string | `"alert"` |  |
 | prometheus.prometheusRule.configNotLoaded.enabled | bool | `true` |  |
 | prometheus.prometheusRule.configNotLoaded.labels.severity | string | `"warning"` |  |
 | prometheus.prometheusRule.enabled | bool | `false` |  |
--- a/packages/system/metallb/charts/metallb/charts/crds/Chart.yaml
+++ b/packages/system/metallb/charts/metallb/charts/crds/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: v0.14.9
+appVersion: v0.14.8
 description: MetalLB CRDs
 home: https://metallb.universe.tf
 icon: https://metallb.universe.tf/images/logo/metallb-white.png
@@ -7,4 +7,4 @@ name: crds
 sources:
 - https://github.com/metallb/metallb
 type: application
-version: 0.14.9
+version: 0.14.8
--- a/packages/system/metallb/charts/metallb/charts/crds/templates/crds.yaml
+++ b/packages/system/metallb/charts/metallb/charts/crds/templates/crds.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.3
+    controller-gen.kubebuilder.io/version: v0.14.0
  name: bfdprofiles.metallb.io
 spec:
  group: metallb.io
@@ -123,7 +123,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.3
+    controller-gen.kubebuilder.io/version: v0.14.0
  name: bgpadvertisements.metallb.io
 spec:
  group: metallb.io
@@ -329,7 +329,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.3
+    controller-gen.kubebuilder.io/version: v0.14.0
  name: bgppeers.metallb.io
 spec:
  conversion:
@@ -365,8 +365,6 @@ spec:
        - jsonPath: .spec.ebgpMultiHop
          name: Multi Hops
          type: string
-      deprecated: true
-      deprecationWarning: v1beta1 is deprecated, please use v1beta2
      name: v1beta1
      schema:
        openAPIV3Schema:
@@ -528,26 +526,15 @@ spec:
                  default: false
                  description: To set if we want to disable MP BGP that will separate IPv4 and IPv6 route exchanges into distinct BGP sessions.
                  type: boolean
-                dynamicASN:
-                  description: |-
-                    DynamicASN detects the AS number to use for the remote end of the session
-                    without explicitly setting it via the ASN field. Limited to:
-                    internal - if the neighbor's ASN is different than MyASN connection is denied.
-                    external - if the neighbor's ASN is the same as MyASN the connection is denied.
-                    ASN and DynamicASN are mutually exclusive and one of them must be specified.
-                  enum:
-                    - internal
-                    - external
-                  type: string
                ebgpMultiHop:
                  description: To set if the BGPPeer is multi-hops away. Needed for FRR mode only.
                  type: boolean
                enableGracefulRestart:
                  description: |-
-                    EnableGracefulRestart allows BGP peer to continue to forward data packets
-                    along known routes while the routing protocol information is being
-                    restored. This field is immutable because it requires restart of the BGP
-                    session. Supported for FRR mode only.
+                    EnableGracefulRestart allows BGP peer to continue to forward data packets along
+                    known routes while the routing protocol information is being restored.
+                    This field is immutable because it requires restart of the BGP session
+                    Supported for FRR mode only.
                  type: boolean
                  x-kubernetes-validations:
                    - message: EnableGracefulRestart cannot be changed after creation
@@ -635,9 +622,7 @@ spec:
                  type: object
                  x-kubernetes-map-type: atomic
                peerASN:
-                  description: |-
-                    AS number to expect from the remote end of the session.
-                    ASN and DynamicASN are mutually exclusive and one of them must be specified.
+                  description: AS number to expect from the remote end of the session.
                  format: int32
                  maximum: 4294967295
                  minimum: 0
@@ -664,6 +649,7 @@ spec:
                  type: string
              required:
                - myASN
+                - peerASN
                - peerAddress
              type: object
            status:
@@ -679,7 +665,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.3
+    controller-gen.kubebuilder.io/version: v0.14.0
  name: communities.metallb.io
 spec:
  group: metallb.io
@@ -744,7 +730,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.3
+    controller-gen.kubebuilder.io/version: v0.14.0
  name: ipaddresspools.metallb.io
 spec:
  group: metallb.io
@@ -954,7 +940,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.3
+    controller-gen.kubebuilder.io/version: v0.14.0
  name: l2advertisements.metallb.io
 spec:
  group: metallb.io
@@ -1134,7 +1120,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.3
+    controller-gen.kubebuilder.io/version: v0.14.0
  name: servicel2statuses.metallb.io
 spec:
  group: metallb.io
--- a/packages/system/metallb/charts/metallb/templates/controller.yaml
+++ b/packages/system/metallb/charts/metallb/templates/controller.yaml
@@ -84,7 +84,7 @@ spec:
        - name: METALLB_DEPLOYMENT
          value: {{ template "metallb.fullname" . }}-controller
        {{- end }}
-        {{- if and .Values.speaker.enabled .Values.speaker.frr.enabled }}
+        {{- if .Values.speaker.frr.enabled }}
        - name: METALLB_BGP_TYPE
          value: frr
        {{- end }}
--- a/packages/system/metallb/charts/metallb/templates/podmonitor.yaml
+++ b/packages/system/metallb/charts/metallb/templates/podmonitor.yaml
@@ -36,7 +36,6 @@ spec:
    relabelings:
 {{- toYaml .Values.prometheus.podMonitor.relabelings | nindent 4 }}
 {{- end }}
-{{- if .Values.speaker.enabled }}
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: PodMonitor
@@ -75,7 +74,6 @@ spec:
    relabelings:
 {{- toYaml .Values.prometheus.podMonitor.relabelings | nindent 4 }}
 {{- end }}
-{{- end }}
 ---
 {{- if .Values.prometheus.rbacPrometheus }}
 apiVersion: rbac.authorization.k8s.io/v1
--- a/packages/system/metallb/charts/metallb/templates/prometheusrules.yaml
+++ b/packages/system/metallb/charts/metallb/templates/prometheusrules.yaml
@@ -19,8 +19,8 @@ spec:
    {{- if .Values.prometheus.prometheusRule.staleConfig.enabled }}
    - alert: MetalLBStaleConfig
      annotations:
-        summary: {{`'Stale config on {{ $labels.pod }}'`}}
-        description: {{`'{{ $labels.job }} - MetalLB {{ $labels.container }} on {{ $labels.pod }} has a stale config for > 1 minute'`}}
+        message: {{`'{{ $labels.job }} - MetalLB {{ $labels.container }} on {{ $labels.pod
+          }} has a stale config for > 1 minute'`}}
      expr: metallb_k8s_client_config_stale_bool{job=~"{{ template "metallb.fullname" . }}.*"} == 1
      for: 1m
      {{- with .Values.prometheus.prometheusRule.staleConfig.labels }}
@@ -31,8 +31,8 @@ spec:
    {{- if .Values.prometheus.prometheusRule.configNotLoaded.enabled }}
    - alert: MetalLBConfigNotLoaded
      annotations:
-        summary: {{`'Config on {{ $labels.pod }} has not been loaded'`}}
-        description: {{`'{{ $labels.job }} - MetalLB {{ $labels.container }} on {{ $labels.pod }} has not loaded for > 1 minute'`}}
+        message: {{`'{{ $labels.job }} - MetalLB {{ $labels.container }} on {{ $labels.pod
+          }} has not loaded for > 1 minute'`}}
      expr: metallb_k8s_client_config_loaded_bool{job=~"{{ template "metallb.fullname" . }}.*"} == 0
      for: 1m
      {{- with .Values.prometheus.prometheusRule.configNotLoaded.labels }}
@@ -43,8 +43,8 @@ spec:
    {{- if .Values.prometheus.prometheusRule.addressPoolExhausted.enabled }}
    - alert: MetalLBAddressPoolExhausted
      annotations:
-        summary: {{`'Exhausted address pool on {{ $labels.pod }}'`}}
-        description: {{`'{{ $labels.job }} - MetalLB {{ $labels.container }} on {{ $labels.pod }} has exhausted address pool {{ $labels.pool }} for > 1 minute'`}}
+        message: {{`'{{ $labels.job }} - MetalLB {{ $labels.container }} on {{ $labels.pod
+          }} has exhausted address pool {{ $labels.pool }} for > 1 minute'`}}
      expr: metallb_allocator_addresses_in_use_total >= on(pool) metallb_allocator_addresses_total
      for: 1m
      {{- with .Values.prometheus.prometheusRule.addressPoolExhausted.labels }}
@@ -57,8 +57,8 @@ spec:
    {{- range .Values.prometheus.prometheusRule.addressPoolUsage.thresholds }}
    - alert: MetalLBAddressPoolUsage{{ .percent }}Percent
      annotations:
-        summary: {{`'Exhausted address pool on {{ $labels.pod }}'`}}
-        message: {{`'{{ $labels.job }} - MetalLB {{ $labels.container }} on {{ $labels.pod }} has address pool {{ $labels.pool }} past `}}{{ .percent }}{{`% usage for > 1 minute'`}}
+        message: {{`'{{ $labels.job }} - MetalLB {{ $labels.container }} on {{ $labels.pod
+          }} has address pool {{ $labels.pool }} past `}}{{ .percent }}{{`% usage for > 1 minute'`}}
      expr: ( metallb_allocator_addresses_in_use_total / on(pool) metallb_allocator_addresses_total ) * 100 > {{ .percent }}
      {{- with .labels }}
      labels:
@@ -69,8 +69,8 @@ spec:
    {{- if .Values.prometheus.prometheusRule.bgpSessionDown.enabled }}
    - alert: MetalLBBGPSessionDown
      annotations:
-        summary:  {{`'BGP session down on {{ $labels.pod }}'`}}
-        message: {{`'{{ $labels.job }} - MetalLB {{ $labels.container }} on {{ $labels.pod }} has BGP session {{ $labels.peer }} down for > 1 minute'`}}
+        message: {{`'{{ $labels.job }} - MetalLB {{ $labels.container }} on {{ $labels.pod
+          }} has BGP session {{ $labels.peer }} down for > 1 minute'`}}
      expr: metallb_bgp_session_up{job=~"{{ template "metallb.fullname" . }}.*"} == 0
      for: 1m
      {{- with .Values.prometheus.prometheusRule.bgpSessionDown.labels }}
--- a/packages/system/metallb/charts/metallb/templates/rbac.yaml
+++ b/packages/system/metallb/charts/metallb/templates/rbac.yaml
@@ -19,11 +19,11 @@ rules:
  resources: ["events"]
  verbs: ["create", "patch"]
 - apiGroups: ["admissionregistration.k8s.io"]
-  resources: ["validatingwebhookconfigurations"]
+  resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
  resourceNames: ["metallb-webhook-configuration"]
  verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
 - apiGroups: ["admissionregistration.k8s.io"]
-  resources: ["validatingwebhookconfigurations"]
+  resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
  verbs: ["list", "watch"]
 - apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
@@ -41,7 +41,6 @@ rules:
  resources: ["subjectaccessreviews"]
  verbs: ["create"]
 {{- end }}
-{{- if .Values.speaker.enabled }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -73,7 +72,7 @@ rules:
 {{- if or .Values.frrk8s.enabled .Values.frrk8s.external }}
 - apiGroups: ["frrk8s.metallb.io"]
  resources: ["frrconfigurations"]
-  verbs: ["get", "list", "watch","create","update","delete"]
+  verbs: ["get", "list", "watch","create","update"]
 {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -110,7 +109,6 @@ rules:
 - apiGroups: ["metallb.io"]
  resources: ["communities"]
  verbs: ["get", "list", "watch"]
-{{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -119,7 +117,7 @@ metadata:
  namespace: {{ .Release.Namespace | quote }}
  labels: {{- include "metallb.labels" . | nindent 4 }}
 rules:
-{{- if and .Values.speaker.enabled .Values.speaker.memberlist.enabled }}
+{{- if .Values.speaker.memberlist.enabled }}
 - apiGroups: [""]
  resources: ["secrets"]
  verbs: ["create", "get", "list", "watch"]
@@ -168,7 +166,6 @@ roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ template "metallb.fullname" . }}:controller
-{{- if .Values.speaker.enabled }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -198,7 +195,6 @@ roleRef:
 subjects:
 - kind: ServiceAccount
  name: {{ include "metallb.speaker.serviceAccountName" . }}
-{{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
--- a/packages/system/metallb/charts/metallb/templates/service-accounts.yaml
+++ b/packages/system/metallb/charts/metallb/templates/service-accounts.yaml
@@ -13,7 +13,7 @@ metadata:
    {{- toYaml . | nindent 4 }}
  {{- end }}
 {{- end }}
-{{- if and .Values.speaker.enabled .Values.speaker.serviceAccount.create }}
+{{- if .Values.speaker.serviceAccount.create }}
 ---
 apiVersion: v1
 kind: ServiceAccount
--- a/packages/system/metallb/charts/metallb/templates/servicemonitor.yaml
+++ b/packages/system/metallb/charts/metallb/templates/servicemonitor.yaml
@@ -1,9 +1,4 @@
-{{- if and .Values.prometheus.serviceMonitor.enabled .Values.prometheus.podMonitor.enabled }}
-{{- fail "prometheus.serviceMonitor.enabled and prometheus.podMonitor.enabled cannot both be set" }}
-{{- end }}
-
 {{- if .Values.prometheus.serviceMonitor.enabled }}
-{{- if .Values.speaker.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
@@ -94,7 +89,6 @@ spec:
 {{- end }}
  sessionAffinity: None
  type: ClusterIP
-{{- end }}
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
@@ -103,6 +97,7 @@ metadata:
  namespace: {{ .Release.Namespace | quote }}
  labels:
    {{- include "metallb.labels" . | nindent 4 }}
+    app.kubernetes.io/component: speaker
    {{- if .Values.prometheus.serviceMonitor.controller.additionalLabels }}
 {{ toYaml .Values.prometheus.serviceMonitor.controller.additionalLabels | indent 4 }}
    {{- end }}
--- a/packages/system/metallb/charts/metallb/values.yaml
+++ b/packages/system/metallb/charts/metallb/values.yaml
@@ -42,7 +42,7 @@ prometheus:
  # certificate to be used.
  controllerMetricsTLSSecret: ""

-  # prometheus doesn't have the permission to scrape all namespaces so we give it permission to scrape metallb's one
+  # prometheus doens't have the permission to scrape all namespaces so we give it permission to scrape metallb's one
  rbacPrometheus: true

  # the service account used by prometheus
@@ -64,7 +64,7 @@ prometheus:
    # enable support for Prometheus Operator
    enabled: false

-    # optional additional labels for podMonitors
+    # optional additionnal labels for podMonitors
    additionalLabels: {}

    # optional annotations for podMonitors
@@ -143,7 +143,7 @@ prometheus:
    # enable alertmanager alerts
    enabled: false

-    # optional additional labels for prometheusRules
+    # optional additionnal labels for prometheusRules
    additionalLabels: {}

    # optional annotations for prometheusRules
@@ -165,7 +165,7 @@ prometheus:
    addressPoolExhausted:
      enabled: true
      labels:
-        severity: critical
+        severity: alert

    addressPoolUsage:
      enabled: true
@@ -178,13 +178,13 @@ prometheus:
            severity: warning
        - percent: 95
          labels:
-            severity: critical
+            severity: alert

    # MetalLBBGPSessionDown
    bgpSessionDown:
      enabled: true
      labels:
-        severity: critical
+        severity: alert

    extraAlerts: []

--- a/packages/system/metallb/images/metallb/Dockerfile
+++ b/packages/system/metallb/images/metallb/Dockerfile
@@ -1,87 +0,0 @@
-# syntax=docker/dockerfile:1.2
-
-FROM --platform=$BUILDPLATFORM docker.io/golang:1.22.7 AS builder
-
-ARG VERSION
-ARG GIT_COMMIT=dev
-ARG GIT_BRANCH=dev
-ARG TARGETARCH
-ARG TARGETOS
-ARG TARGETPLATFORM
-
-WORKDIR /go/go.universe.tf/metallb
-
-RUN --mount=type=cache,target=/go/pkg/mod \
-    curl -sSL https://github.com/metallb/metallb/archive/refs/tags/${VERSION}.tar.gz \
-    | tar -xzvf- --strip=1 
-
-RUN curl -sSLO https://github.com/metallb/metallb/pull/2726.diff && \
-    git apply 2726.diff
-
-RUN --mount=type=cache,target=/go/pkg/mod \
-    --mount=type=cache,target=/root/.cache/go-build \
-    go mod download -x
-
-RUN case ${TARGETPLATFORM} in \
-    "linux/arm/v6") export VARIANT="6" ;; \
-    "linux/arm/v7") export VARIANT="7" ;; \
-    *) export VARIANT="" ;; \
-    esac && \
-    CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH GOARM=$VARIANT \
-    go build -v -o /build/controller \
-    -ldflags "-X 'go.universe.tf/metallb/internal/version.gitCommit=${GIT_COMMIT}' \
-      -X 'go.universe.tf/metallb/internal/version.gitBranch=${GIT_BRANCH}'" \
-    ./controller \
-    && \
-    CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH GOARM=$VARIANT \
-    go build -v -o /build/frr-metrics \
-    -ldflags "-X 'go.universe.tf/metallb/internal/version.gitCommit=${GIT_COMMIT}' \
-      -X 'go.universe.tf/metallb/internal/version.gitBranch=${GIT_BRANCH}'" \
-    frr-tools/metrics/exporter.go \
-    && \
-    CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH GOARM=$VARIANT \
-    go build -v -o /build/cp-tool \
-    -ldflags "-X 'go.universe.tf/metallb/internal/version.gitCommit=${GIT_COMMIT}' \
-      -X 'go.universe.tf/metallb/internal/version.gitBranch=${GIT_BRANCH}'" \
-    frr-tools/cp-tool/cp-tool.go \
-    && \
-    CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH GOARM=$VARIANT \
-    go build -v -o /build/speaker \
-    -ldflags "-X 'go.universe.tf/metallb/internal/version.gitCommit=${GIT_COMMIT}' \
-      -X 'go.universe.tf/metallb/internal/version.gitBranch=${GIT_BRANCH}'" \
-    ./speaker
-
-FROM gcr.io/distroless/static:latest as controller
-
-COPY --from=builder /build/controller /controller
-
-LABEL org.opencontainers.image.authors="metallb" \
-    org.opencontainers.image.url="https://github.com/metallb/metallb" \
-    org.opencontainers.image.documentation="https://metallb.universe.tf" \
-    org.opencontainers.image.source="https://github.com/cozystack/cozystack" \
-    org.opencontainers.image.vendor="metallb" \
-    org.opencontainers.image.licenses="Apache-2.0" \
-    org.opencontainers.image.description="Metallb Controller" \
-    org.opencontainers.image.title="controller" \
-    org.opencontainers.image.base.name="gcr.io/distroless/static:latest"
-
-ENTRYPOINT ["/controller"]
-
-FROM gcr.io/distroless/static:latest as speaker
-
-COPY --from=builder /build/cp-tool /cp-tool
-COPY --from=builder /build/speaker /speaker
-COPY --from=builder /build/frr-metrics /frr-metrics
-COPY --from=builder /go/go.universe.tf/metallb/frr-tools/reloader/frr-reloader.sh /frr-reloader.sh
-
-LABEL org.opencontainers.image.authors="metallb" \
-  org.opencontainers.image.url="https://github.com/metallb/metallb" \
-  org.opencontainers.image.documentation="https://metallb.universe.tf" \
-  org.opencontainers.image.source="https://github.com/cozystack/cozystack" \
-  org.opencontainers.image.vendor="metallb" \
-  org.opencontainers.image.licenses="Apache-2.0" \
-  org.opencontainers.image.description="Metallb speaker" \
-  org.opencontainers.image.title="speaker" \
-  org.opencontainers.image.base.name="gcr.io/distroless/static:latest"
-
-ENTRYPOINT ["/speaker"]
--- a/packages/system/metallb/values.yaml
+++ b/packages/system/metallb/values.yaml
@@ -1,11 +1,6 @@
 metallb:
  crds:
    enabled: true
-  controller:
-    image:
-      repository: ghcr.io/cozystack/cozystack/metallb-controller
-      tag: v0.14.9@sha256:9ae0502f353360bdfe1785871789fc4124f528ab2f94a6ead20479d9d322a423
-  speaker:
-    image:
-      repository: ghcr.io/cozystack/cozystack/metallb-speaker
-      tag: v0.14.9@sha256:64ce9f2c8d351df5054a4a92cce1728589e6570dc0749043311cddd0356871c2
+
+  #speaker:
+  #  tolerateMaster: false