core/installer: multi-arch talos support

Signed-off-by: nbykov0 <166552198+nbykov0@users.noreply.github.com>

.github/workflows/pull-requests.yaml

@@ -33,21 +33,29 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
           registry: ghcr.io
+        env:
+          DOCKER_CONFIG: ${{ runner.temp }}/.docker
 
       - name: Build
         run: make build
+        env:
+          DOCKER_CONFIG: ${{ runner.temp }}/.docker
 
       - name: Build Talos image
         run: make -C packages/core/installer talos-nocloud
-
-      - name: Upload artifacts
+     
+      - name: Upload installer
         uses: actions/upload-artifact@v4
         with:
-          name: cozystack-artefacts
-          path: |
-            _out/assets/nocloud-amd64.raw.xz
-            _out/assets/cozystack-installer.yaml
+          name: cozystack-installer
+          path: _out/assets/cozystack-installer.yaml
 
+      - name: Upload Talos image
+        uses: actions/upload-artifact@v4
+        with:
+          name: talos-image
+          path: _out/assets/nocloud-amd64.raw.xz
+ 
   test:
     name: Test
     runs-on: [self-hosted]
@@ -58,16 +66,16 @@ jobs:
       !contains(github.event.pull_request.labels.*.name, 'release')
 
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          fetch-tags: true
-
-      - name: Download artifacts
+      - name: Download installer
         uses: actions/download-artifact@v4
         with:
-          name: cozystack-artefacts
+          name: cozystack-installer
+          path: _out/assets/
+
+      - name: Download Talos image
+        uses: actions/download-artifact@v4
+        with:
+          name: talos-image
           path: _out/assets/
 
       - name: Test

.github/workflows/tags.yaml

@@ -99,11 +99,15 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
           registry: ghcr.io
+        env:
+          DOCKER_CONFIG: ${{ runner.temp }}/.docker
 
       # Build project artifacts
       - name: Build
         if: steps.check_release.outputs.skip == 'false'
         run: make build
+        env:
+          DOCKER_CONFIG: ${{ runner.temp }}/.docker
 
       # Commit built artifacts
       - name: Commit release artifacts

hack/e2e-cluster.bats

@@ -86,7 +86,7 @@ EOF
 @test "Prepare VM disks" {
   for i in 1 2 3; do
     cp nocloud-amd64.raw srv${i}/system.img
-    qemu-img resize srv${i}/system.img 20G
+    qemu-img resize srv${i}/system.img 50G
     qemu-img create srv${i}/data.img 100G
   done
 }

hack/upload-assets.sh

@@ -4,8 +4,18 @@ set -xe
 version=${VERSION:-$(git describe --tags)}
 
 gh release upload --clobber $version _out/assets/cozystack-installer.yaml
+
 gh release upload --clobber $version _out/assets/metal-amd64.iso
+gh release upload --clobber $version _out/assets/metal-arm64.iso
+
 gh release upload --clobber $version _out/assets/metal-amd64.raw.xz
+gh release upload --clobber $version _out/assets/metal-arm64.raw.xz
+
 gh release upload --clobber $version _out/assets/nocloud-amd64.raw.xz
+gh release upload --clobber $version _out/assets/nocloud-arm64.raw.xz
+
 gh release upload --clobber $version _out/assets/kernel-amd64
+gh release upload --clobber $version _out/assets/kernel-arm64
+
 gh release upload --clobber $version _out/assets/initramfs-metal-amd64.xz
+gh release upload --clobber $version _out/assets/initramfs-metal-arm64.xz

packages/apps/clickhouse/Chart.yaml

@@ -23,3 +23,8 @@ version: 0.9.0
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
 appVersion: "24.9.2"
+
+dependencies:
+  - name: cozy-lib
+    version: 0.1.0
+    repository: "http://cozystack.cozy-system.svc/repos/library"

packages/apps/clickhouse/templates/clickhouse.yaml

@@ -122,9 +122,9 @@ spec:
             - name: clickhouse
               image: clickhouse/clickhouse-server:24.9.2.42
               {{- if .Values.resources }}
-              resources: {{- include "cozy-lib.resources.sanitize" .Values.resources | nindent 16 }}
+              resources: {{- include "cozy-lib.resources.sanitize" (list .Values.resources $) | nindent 16 }}
               {{- else if ne .Values.resourcesPreset "none" }}
-              resources: {{- include "cozy-lib.resources.preset" .Values.resourcesPreset | nindent 16 }}
+              resources: {{- include "cozy-lib.resources.preset" (list .Values.resourcesPreset $) | nindent 16 }}
               {{- end }}
               volumeMounts:
                 - name: data-volume-template

packages/core/installer/Makefile

@@ -1,10 +1,12 @@
 NAME=installer
 NAMESPACE=cozy-system
 
-TALOS_VERSION=$(shell awk '/^version:/ {print $$2}' images/talos/profiles/installer.yaml)
+TALOS_VERSION=$(shell awk '/^version:/ {print $$2}' images/talos/profiles/installer-amd64.yaml)
 
 include ../../../scripts/common-envs.mk
 
+ARCH := $(shell echo "$(PLATFORM)" | sed 's:linux/::g;s:,: :g')
+
 pre-checks:
 	../../../hack/pre-checks.sh
 
@@ -17,8 +19,10 @@ apply:
 diff:
 	helm template -n $(NAMESPACE) $(NAME) . | kubectl diff -f -
 
-update:
-	hack/gen-profiles.sh
+update: update-amd64 update-arm64
+
+update-%:
+	hack/gen-profiles.sh $*
 
 image: pre-checks image-matchbox image-cozystack image-talos
 
@@ -26,9 +30,10 @@ image-cozystack:
 	make -C ../../.. repos
 	docker buildx build -f images/cozystack/Dockerfile ../../.. \
 		--provenance false \
+		--builder=$(BUILDER) \
+		--platform=$(PLATFORM) \
 		--tag $(REGISTRY)/installer:$(call settag,$(TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/installer:latest \
-		--platform linux/amd64 \
 		--cache-to type=inline \
 		--metadata-file images/installer.json \
 		--push=$(PUSH) \
@@ -39,14 +44,28 @@ image-cozystack:
 	rm -f images/installer.json
 
 image-talos:
-	test -f ../../../_out/assets/installer-amd64.tar || make talos-installer
-	skopeo copy docker-archive:../../../_out/assets/installer-amd64.tar docker://$(REGISTRY)/talos:$(call settag,$(TALOS_VERSION))
+	# assets for different architectures may be built on a single host
+	for arch in amd64 arm64; do \
+		test -f ../../../_out/assets/installer-$${arch}.tar || make talos-installer-$${arch}; \
+		skopeo copy --override-os=linux --override-arch=$${arch} docker-archive:../../../_out/assets/installer-$${arch}.tar \
+			docker://$(REGISTRY)/talos-$${arch}:$(call settag,$(TALOS_VERSION)); \
+	done
+	# assemble multiarch image from two parts
+	docker buildx imagetools create \
+		--builder=$(BUILDER) \
+		--tag $(REGISTRY)/talos:$(call settag,$(TALOS_VERSION)) \
+		$(REGISTRY)/talos-amd64:$(call settag,$(TALOS_VERSION)) \
+		$(REGISTRY)/talos-arm64:$(call settag,$(TALOS_VERSION))
 
 image-matchbox:
-	test -f ../../../_out/assets/kernel-amd64 || make talos-kernel
-	test -f ../../../_out/assets/initramfs-metal-amd64.xz || make talos-initramfs
+	for arch in $(ARCH); do \
+		test -f ../../../_out/assets/kernel-$${arch} || make talos-kernel-$${arch}; \
+		test -f ../../../_out/assets/initramfs-metal-$${arch}.xz || make talos-initramfs-$${arch}; \
+	done
 	docker buildx build -f images/matchbox/Dockerfile ../../.. \
 		--provenance false \
+		--builder=$(BUILDER) \
+		--platform=$(PLATFORM) \
 		--tag $(REGISTRY)/matchbox:$(call settag,$(TAG)) \
 		--tag $(REGISTRY)/matchbox:$(call settag,$(TALOS_VERSION)-$(TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/matchbox:latest \
@@ -59,10 +78,13 @@ image-matchbox:
 		> ../../extra/bootbox/images/matchbox.tag
 	rm -f images/matchbox.json
 
-assets: talos-iso talos-nocloud talos-metal talos-kernel talos-initramfs
+assets: assets-amd64 assets-arm64
 
-talos-initramfs talos-kernel talos-installer talos-iso talos-nocloud talos-metal:
+assets-amd64 assets-arm64: assets-%: talos-iso-% talos-nocloud-% talos-metal-% talos-kernel-% talos-initramfs-%
+
+talos-%:
 	mkdir -p ../../../_out/assets
+	@echo Building $@...
 	cat images/talos/profiles/$(subst talos-,,$@).yaml | \
 		docker run --rm -i -v /dev:/dev --privileged "ghcr.io/siderolabs/imager:$(TALOS_VERSION)" --tar-to-stdout - | \
 		tar -C ../../../_out/assets -xzf-

packages/core/installer/hack/gen-profiles.sh

@@ -2,6 +2,12 @@
 set -e
 set -u
 
+case ${1:-} in
+  amd64|arm64) ARCH=$1; talos_version="";;
+  *) ARCH=${2:-"amd64"}; talos_version=${1:-""};; #this supports previously available script call syntax
+esac
+echo "ARCH=$ARCH"
+
 PROFILES="initramfs kernel iso installer nocloud metal"
 FIRMWARES="amd-ucode amdgpu-firmware bnx2-bnx2x i915-ucode intel-ice-firmware intel-ucode qlogic-firmware"
 EXTENSIONS="drbd zfs"
@@ -9,7 +15,7 @@ EXTENSIONS="drbd zfs"
 mkdir -p images/talos/profiles
 
 printf "fetching talos version: "
-talos_version=${1:-$(skopeo --override-os linux --override-arch amd64 list-tags docker://ghcr.io/siderolabs/imager | jq -r '.Tags[]' | grep '^v[0-9]\+.[0-9]\+.[0-9]\+$' | sort -V | tail -n 1)}
+talos_version=${talos_version:-$(skopeo --override-os=linux --override-arch=$ARCH list-tags docker://ghcr.io/siderolabs/imager | jq -r '.Tags[]' | grep '^v[0-9]\+.[0-9]\+.[0-9]\+$' | sort -V | tail -n 1)}
 echo "$talos_version"
 
 export "TALOS_VERSION=$talos_version"
@@ -17,7 +23,7 @@ export "TALOS_VERSION=$talos_version"
 for firmware in $FIRMWARES; do
   printf "fetching %s version: " "$firmware"
   firmware_var=$(echo "$firmware" | tr '[:lower:]' '[:upper:]' | tr - _)_VERSION
-  version=$(skopeo list-tags docker://ghcr.io/siderolabs/$firmware | jq -r '.Tags[]|select(length == 8)|select(startswith("20"))' | sort -V | tail -n 1)
+  version=$(skopeo --override-os=linux --override-arch=$ARCH list-tags docker://ghcr.io/siderolabs/$firmware | jq -r '.Tags[]|select(length == 8)|select(startswith("20"))' | sort -V | tail -n 1)
   echo "$version"
   export "$firmware_var=$version"
 done
@@ -25,13 +31,13 @@ done
 for extension in $EXTENSIONS; do
   printf "fetching %s version: " "$extension"
   extension_var=$(echo "$extension" | tr '[:lower:]' '[:upper:]' | tr - _)_VERSION
-  version=$(skopeo --override-os linux --override-arch amd64 list-tags docker://ghcr.io/siderolabs/$extension | jq -r '.Tags[]' | grep "\-${talos_version}$" | sort -V | tail -n1)
+  version=$(skopeo --override-os=linux --override-arch=$ARCH list-tags docker://ghcr.io/siderolabs/$extension | jq -r '.Tags[]' | grep "\-${talos_version}$" | sort -V | tail -n1)
   echo "$version"
   export "$extension_var=$version"
 done
 
 for profile in $PROFILES; do
-  echo "writing profile images/talos/profiles/$profile.yaml"
+  echo "writing profile images/talos/profiles/${profile}-${ARCH}.yaml"
   case "$profile" in
     initramfs|kernel|iso)
       image_options="{}"
@@ -63,18 +69,18 @@ for profile in $PROFILES; do
       ;;
   esac
 
-  cat > images/talos/profiles/$profile.yaml <<EOT
+  cat > images/talos/profiles/${profile}-${ARCH}.yaml <<EOT
 # this file generated by hack/gen-profiles.sh
 # do not edit it
-arch: amd64
+arch: ${ARCH}
 platform: ${platform}
 secureboot: false
 version: ${TALOS_VERSION}
 input:
   kernel:
-    path: /usr/install/amd64/vmlinuz
+    path: /usr/install/${ARCH}/vmlinuz
   initramfs:
-    path: /usr/install/amd64/initramfs.xz
+    path: /usr/install/${ARCH}/initramfs.xz
   baseInstaller:
     imageRef: "ghcr.io/siderolabs/installer:v1.10.3"
   systemExtensions:

packages/core/installer/hack/gen-versions.sh

@@ -1,20 +1,28 @@
 #!/bin/sh
+set -e
+set -u
+
+case ${1:-} in
+  amd64|arm64) ARCH=$1; talos_version="";;
+  *) ARCH=${2:-"amd64"}; talos_version=${1:-""};; #this supports previously available script call syntax
+esac
+echo "ARCH=$ARCH"
 
 FIRMWARES="amd-ucode amdgpu-firmware bnx2-bnx2x i915-ucode intel-ice-firmware intel-ucode qlogic-firmware"
 EXTENSIONS="drbd zfs"
 
-talos_version=${1:-$(skopeo --override-os linux --override-arch amd64 list-tags docker://ghcr.io/siderolabs/imager | jq -r '.Tags[]' | grep '^v[0-9]\+.[0-9]\+.[0-9]\+$' | sort -V | tail -n 1)}
+talos_version=${1:-$(skopeo --override-os linux --override-arch=$ARCH list-tags docker://ghcr.io/siderolabs/imager | jq -r '.Tags[]' | grep '^v[0-9]\+.[0-9]\+.[0-9]\+$' | sort -V | tail -n 1)}
 
 echo "TALOS_VERSION=$talos_version"
 
 for firmware in $FIRMWARES; do
   firmware_var=$(echo "$firmware" | tr '[:lower:]' '[:upper:]' | tr - _)_VERSION
-  version=$(skopeo list-tags docker://ghcr.io/siderolabs/$firmware | jq -r '.Tags[]|select(length == 8)|select(startswith("20"))' | sort -V | tail -n 1)
+  version=$(skopeo --override-os=linux --override-arch=$ARCH list-tags docker://ghcr.io/siderolabs/$firmware | jq -r '.Tags[]|select(length == 8)|select(startswith("20"))' | sort -V | tail -n 1)
   echo "$firmware_var=$version"
 done
 
 for extension in $EXTENSIONS; do
   extension_var=$(echo "$extension" | tr '[:lower:]' '[:upper:]' | tr - _)_VERSION
-  version=$(skopeo --override-os linux --override-arch amd64 list-tags docker://ghcr.io/siderolabs/$extension | jq -r '.Tags[]' | grep "\-${talos_version}$" | sort -V | tail -n1)
+  version=$(skopeo --override-os=linux --override-arch=$ARCH list-tags docker://ghcr.io/siderolabs/$extension | jq -r '.Tags[]' | grep "\-${talos_version}$" | sort -V | tail -n1)
   echo "$extension_var=$version"
 done

packages/core/installer/images/cozystack/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:alpine3.21 as k8s-await-election-builder
+FROM golang:alpine3.21 AS k8s-await-election-builder
 
 ARG K8S_AWAIT_ELECTION_GITREPO=https://github.com/LINBIT/k8s-await-election
 ARG K8S_AWAIT_ELECTION_VERSION=0.4.1
@@ -13,7 +13,10 @@ RUN git clone ${K8S_AWAIT_ELECTION_GITREPO} /usr/local/go/k8s-await-election/ \
  && make \
  && mv ./out/k8s-await-election-${TARGETARCH} /k8s-await-election
 
-FROM golang:alpine3.21 as builder
+FROM golang:alpine3.21 AS builder
+
+ARG TARGETOS
+ARG TARGETARCH
 
 RUN apk add --no-cache make git
 RUN apk add helm --repository=https://dl-cdn.alpinelinux.org/alpine/edge/community
@@ -21,7 +24,7 @@ RUN apk add helm --repository=https://dl-cdn.alpinelinux.org/alpine/edge/communi
 COPY . /src/
 WORKDIR /src
 
-RUN go build -o /cozystack-assets-server -ldflags '-extldflags "-static" -w -s' ./cmd/cozystack-assets-server
+RUN GOOS=$TARGETOS GOARCH=$TARGETARCH go build -o /cozystack-assets-server -ldflags '-extldflags "-static" -w -s' ./cmd/cozystack-assets-server
 
 # Check that versions_map is not changed
 RUN make repos
@@ -29,9 +32,9 @@ RUN make repos
 FROM alpine:3.21
 
 RUN apk add --no-cache make
-RUN apk add helm kubectl --repository=https://dl-cdn.alpinelinux.org/alpine/edge/community
-RUN apk add yq
-RUN apk add coreutils
+RUN apk add --no-cache helm kubectl --repository=https://dl-cdn.alpinelinux.org/alpine/edge/community
+RUN apk add --no-cache yq
+RUN apk add --no-cache coreutils
 
 COPY scripts /cozystack/scripts
 COPY --from=builder /src/packages/core /cozystack/packages/core

packages/core/installer/images/matchbox/Dockerfile

@@ -1,6 +1,8 @@
 FROM quay.io/poseidon/matchbox:v0.10.0
 
-COPY _out/assets/initramfs-metal-amd64.xz /var/lib/matchbox/assets/initramfs.xz
-COPY _out/assets/kernel-amd64 /var/lib/matchbox/assets/vmlinuz
+ARG TARGETARCH
+
+COPY _out/assets/initramfs-metal-$TARGETARCH.xz /var/lib/matchbox/assets/initramfs.xz
+COPY _out/assets/kernel-$TARGETARCH /var/lib/matchbox/assets/vmlinuz
 COPY packages/core/installer/images/matchbox/groups /var/lib/matchbox/groups
 COPY packages/core/installer/images/matchbox/profiles /var/lib/matchbox/profiles

packages/core/installer/images/talos/profiles/initramfs-arm64.yaml

@@ -0,0 +1,27 @@
+# this file generated by hack/gen-profiles.sh
+# do not edit it
+arch: arm64
+platform: metal
+secureboot: false
+version: v1.10.1
+input:
+  kernel:
+    path: /usr/install/arm64/vmlinuz
+  initramfs:
+    path: /usr/install/arm64/initramfs.xz
+  baseInstaller:
+    imageRef: ghcr.io/siderolabs/installer:v1.10.1
+  systemExtensions:
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20250410
+    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20241110
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20250410
+    - imageRef: ghcr.io/siderolabs/i915-ucode:20241110
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250410
+    - imageRef: ghcr.io/siderolabs/intel-ucode:20250211
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250410
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.13-v1.10.1
+    - imageRef: ghcr.io/siderolabs/zfs:2.3.1-v1.10.1
+output:
+  kind: initramfs
+  imageOptions: {}
+  outFormat: raw

packages/core/installer/images/talos/profiles/installer-arm64.yaml

@@ -0,0 +1,27 @@
+# this file generated by hack/gen-profiles.sh
+# do not edit it
+arch: arm64
+platform: metal
+secureboot: false
+version: v1.10.1
+input:
+  kernel:
+    path: /usr/install/arm64/vmlinuz
+  initramfs:
+    path: /usr/install/arm64/initramfs.xz
+  baseInstaller:
+    imageRef: ghcr.io/siderolabs/installer:v1.10.1
+  systemExtensions:
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20250410
+    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20241110
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20250410
+    - imageRef: ghcr.io/siderolabs/i915-ucode:20241110
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250410
+    - imageRef: ghcr.io/siderolabs/intel-ucode:20250211
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250410
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.13-v1.10.1
+    - imageRef: ghcr.io/siderolabs/zfs:2.3.1-v1.10.1
+output:
+  kind: installer
+  imageOptions: {}
+  outFormat: raw

packages/core/installer/images/talos/profiles/iso-arm64.yaml

@@ -0,0 +1,27 @@
+# this file generated by hack/gen-profiles.sh
+# do not edit it
+arch: arm64
+platform: metal
+secureboot: false
+version: v1.10.1
+input:
+  kernel:
+    path: /usr/install/arm64/vmlinuz
+  initramfs:
+    path: /usr/install/arm64/initramfs.xz
+  baseInstaller:
+    imageRef: ghcr.io/siderolabs/installer:v1.10.1
+  systemExtensions:
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20250410
+    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20241110
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20250410
+    - imageRef: ghcr.io/siderolabs/i915-ucode:20241110
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250410
+    - imageRef: ghcr.io/siderolabs/intel-ucode:20250211
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250410
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.13-v1.10.1
+    - imageRef: ghcr.io/siderolabs/zfs:2.3.1-v1.10.1
+output:
+  kind: iso
+  imageOptions: {}
+  outFormat: raw

packages/core/installer/images/talos/profiles/kernel-arm64.yaml

@@ -0,0 +1,27 @@
+# this file generated by hack/gen-profiles.sh
+# do not edit it
+arch: arm64
+platform: metal
+secureboot: false
+version: v1.10.1
+input:
+  kernel:
+    path: /usr/install/arm64/vmlinuz
+  initramfs:
+    path: /usr/install/arm64/initramfs.xz
+  baseInstaller:
+    imageRef: ghcr.io/siderolabs/installer:v1.10.1
+  systemExtensions:
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20250410
+    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20241110
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20250410
+    - imageRef: ghcr.io/siderolabs/i915-ucode:20241110
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250410
+    - imageRef: ghcr.io/siderolabs/intel-ucode:20250211
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250410
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.13-v1.10.1
+    - imageRef: ghcr.io/siderolabs/zfs:2.3.1-v1.10.1
+output:
+  kind: kernel
+  imageOptions: {}
+  outFormat: raw

packages/core/installer/images/talos/profiles/metal-arm64.yaml

@@ -0,0 +1,27 @@
+# this file generated by hack/gen-profiles.sh
+# do not edit it
+arch: arm64
+platform: metal
+secureboot: false
+version: v1.10.1
+input:
+  kernel:
+    path: /usr/install/arm64/vmlinuz
+  initramfs:
+    path: /usr/install/arm64/initramfs.xz
+  baseInstaller:
+    imageRef: ghcr.io/siderolabs/installer:v1.10.1
+  systemExtensions:
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20250410
+    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20241110
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20250410
+    - imageRef: ghcr.io/siderolabs/i915-ucode:20241110
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250410
+    - imageRef: ghcr.io/siderolabs/intel-ucode:20250211
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250410
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.13-v1.10.1
+    - imageRef: ghcr.io/siderolabs/zfs:2.3.1-v1.10.1
+output:
+  kind: image
+  imageOptions: { diskSize: 1306525696, diskFormat: raw }
+  outFormat: .xz

packages/core/installer/images/talos/profiles/nocloud-arm64.yaml

@@ -0,0 +1,27 @@
+# this file generated by hack/gen-profiles.sh
+# do not edit it
+arch: arm64
+platform: nocloud
+secureboot: false
+version: v1.10.1
+input:
+  kernel:
+    path: /usr/install/arm64/vmlinuz
+  initramfs:
+    path: /usr/install/arm64/initramfs.xz
+  baseInstaller:
+    imageRef: ghcr.io/siderolabs/installer:v1.10.1
+  systemExtensions:
+    - imageRef: ghcr.io/siderolabs/amd-ucode:20250410
+    - imageRef: ghcr.io/siderolabs/amdgpu-firmware:20241110
+    - imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20250410
+    - imageRef: ghcr.io/siderolabs/i915-ucode:20241110
+    - imageRef: ghcr.io/siderolabs/intel-ice-firmware:20250410
+    - imageRef: ghcr.io/siderolabs/intel-ucode:20250211
+    - imageRef: ghcr.io/siderolabs/qlogic-firmware:20250410
+    - imageRef: ghcr.io/siderolabs/drbd:9.2.13-v1.10.1
+    - imageRef: ghcr.io/siderolabs/zfs:2.3.1-v1.10.1
+output:
+  kind: image
+  imageOptions: { diskSize: 1306525696, diskFormat: raw }
+  outFormat: .xz

packages/library/cozy-lib/Chart.yaml

@@ -15,4 +15,4 @@ type: library
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.0
+version: 0.2.0

packages/library/cozy-lib/templates/_checkinput.tpl

@@ -0,0 +1,5 @@
+{{- define "cozy-lib.checkInput" }}
+{{-   if not (kindIs "slice" .) }}
+{{-     fail (printf "called cozy-lib function without global scope, expected [<arg>, $], got %s" (kindOf .)) }}
+{{-   end }}
+{{- end }}

packages/library/cozy-lib/templates/_cozyconfig.tpl

@@ -0,0 +1,7 @@
+{{- define "cozy-lib.loadCozyConfig" }}
+{{-   include "cozy-lib.checkInput" . }}
+{{-   if not (hasKey (index . 1) "cozyConfig") }}
+{{-     $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
+{{-     $_ := set (index . 1) "cozyConfig" $cozyConfig }}
+{{-   end }}
+{{- end }}

packages/library/cozy-lib/templates/_resourcepresets.tpl

@@ -11,38 +11,68 @@ These presets are for basic testing and not meant to be used in production
 {{ include "cozy-lib.resources.preset" "nano" -}}
 */}}
 {{- define "cozy-lib.resources.preset" -}}
+{{-   $cpuAllocationRatio := include "cozy-lib.resources.cpuAllocationRatio" . | float64 }}
+{{-   $args := index . 0 }}
+
+{{-   $baseCPU := dict
+        "nano"    (dict "requests" (dict "cpu" "100m" ))
+        "micro"   (dict "requests" (dict "cpu" "250m" ))
+        "small"   (dict "requests" (dict "cpu" "500m" ))
+        "medium"  (dict "requests" (dict "cpu" "500m" ))
+        "large"   (dict "requests" (dict "cpu" "1"    ))
+        "xlarge"  (dict "requests" (dict "cpu" "2"    ))
+        "2xlarge" (dict "requests" (dict "cpu" "4"    ))
+}}
+{{-   $baseMemory := dict
+        "nano"    (dict "requests" (dict "memory" "128Mi" ))
+        "micro"   (dict "requests" (dict "memory" "256Mi" ))
+        "small"   (dict "requests" (dict "memory" "512Mi" ))
+        "medium"  (dict "requests" (dict "memory" "1Gi"   ))
+        "large"   (dict "requests" (dict "memory" "2Gi"   ))
+        "xlarge"  (dict "requests" (dict "memory" "4Gi"   ))
+        "2xlarge" (dict "requests" (dict "memory" "8Gi"   ))
+}}
+
+{{-   range $baseCPU }}
+{{-     $_ := set . "limits" (dict "cpu" (include "cozy-lib.resources.toFloat" .requests.cpu | float64 | mulf $cpuAllocationRatio | toString)) }}
+{{-   end }}
+{{-   range $baseMemory }}
+{{-     $_ := set . "limits" (dict "memory" .requests.memory) }}
+{{-   end }}
+
 {{- $presets := dict 
   "nano" (dict 
-      "requests" (dict "cpu" "100m" "memory" "128Mi" "ephemeral-storage" "50Mi")
-      "limits" (dict "memory" "128Mi" "ephemeral-storage" "2Gi")
+      "requests" (dict "ephemeral-storage" "50Mi")
+      "limits" (dict "ephemeral-storage" "2Gi")
    )
   "micro" (dict 
-      "requests" (dict "cpu" "250m" "memory" "256Mi" "ephemeral-storage" "50Mi")
-      "limits" (dict "memory" "256Mi" "ephemeral-storage" "2Gi")
+      "requests" (dict "ephemeral-storage" "50Mi")
+      "limits" (dict "ephemeral-storage" "2Gi")
    )
   "small" (dict 
-      "requests" (dict "cpu" "500m" "memory" "512Mi" "ephemeral-storage" "50Mi")
-      "limits" (dict "memory" "512Mi" "ephemeral-storage" "2Gi")
+      "requests" (dict "ephemeral-storage" "50Mi")
+      "limits" (dict "ephemeral-storage" "2Gi")
    )
   "medium" (dict 
-      "requests" (dict "cpu" "500m" "memory" "1Gi" "ephemeral-storage" "50Mi")
-      "limits" (dict "memory" "1Gi" "ephemeral-storage" "2Gi")
+      "requests" (dict "ephemeral-storage" "50Mi")
+      "limits" (dict "ephemeral-storage" "2Gi")
    )
   "large" (dict 
-      "requests" (dict "cpu" "1" "memory" "2Gi" "ephemeral-storage" "50Mi")
-      "limits" (dict "memory" "2Gi" "ephemeral-storage" "2Gi")
+      "requests" (dict "ephemeral-storage" "50Mi")
+      "limits" (dict "ephemeral-storage" "2Gi")
    )
   "xlarge" (dict 
-      "requests" (dict "cpu" "2" "memory" "4Gi" "ephemeral-storage" "50Mi")
-      "limits" (dict "memory" "4Gi" "ephemeral-storage" "2Gi")
+      "requests" (dict "ephemeral-storage" "50Mi")
+      "limits" (dict "ephemeral-storage" "2Gi")
    )
   "2xlarge" (dict 
-      "requests" (dict "cpu" "4" "memory" "8Gi" "ephemeral-storage" "50Mi")
-      "limits" (dict "memory" "8Gi" "ephemeral-storage" "2Gi")
+      "requests" (dict "ephemeral-storage" "50Mi")
+      "limits" (dict "ephemeral-storage" "2Gi")
    )
  }}
-{{- if hasKey $presets . -}}
-{{- index $presets . | toYaml -}}
+{{- $_ := merge $presets $baseCPU $baseMemory }}
+{{- if hasKey $presets $args -}}
+{{- index $presets $args | toYaml -}}
 {{- else -}}
 {{- printf "ERROR: Preset key '%s' invalid. Allowed values are %s" . (join "," (keys $presets)) | fail -}}
 {{- end -}}

packages/library/cozy-lib/templates/_resources.tpl

@@ -1,16 +1,47 @@
+{{- define "cozy-lib.resources.defaultCpuAllocationRatio" }}
+{{-   `10` }}
+{{- end }}
+
+{{- define "cozy-lib.resources.cpuAllocationRatio" }}
+{{-   include "cozy-lib.loadCozyConfig" . }}
+{{-   $cozyConfig := index . 1 "cozyConfig" }}
+{{-   if not $cozyConfig }}
+{{-     include "cozy-lib.resources.defaultCpuAllocationRatio" . }}
+{{-   else }}
+{{-     dig "data" "cpu-allocation-ratio" (include "cozy-lib.resources.defaultCpuAllocationRatio" dict) $cozyConfig }}
+{{-   end }}
+{{- end }}
+
+{{- define "cozy-lib.resources.toFloat" -}}
+    {{- $value := . -}}
+    {{- $unit := 1.0 -}}
+    {{- if typeIs "string" . -}}
+        {{- $base2 := dict "Ki" 0x1p10 "Mi" 0x1p20 "Gi" 0x1p30 "Ti" 0x1p40 "Pi" 0x1p50 "Ei" 0x1p60 -}}
+        {{- $base10 := dict "m" 1e-3 "k" 1e3 "M" 1e6 "G" 1e9 "T" 1e12 "P" 1e15 "E" 1e18 -}}
+        {{- range $k, $v := merge $base2 $base10 -}}
+            {{- if hasSuffix $k $ -}}
+                {{- $value = trimSuffix $k $ -}}
+                {{- $unit = $v -}}
+            {{- end -}}
+        {{- end -}}
+    {{- end -}}
+    {{- mulf (float64 $value) $unit | toString -}}
+{{- end -}}
+
 {{- /*
   A sanitized resource map is a dict with resource-name => resource-quantity.
   If not in such a form, requests are used, then limits. All resources are set
-  to have equal requests and limits, except CPU, that has only requests. The
-  template expects to receive a dict {"requests":{...}, "limits":{...}} as
-  input, e.g. {{ include "cozy-lib.resources.sanitize" .Values.resources }}.
+  to have equal requests and limits, except CPU, where the limit is increased
+  by a factor of the CPU allocation ratio. The template expects to receive a
+  dict {"requests":{...}, "limits":{...}} as input, e.g.
+  {{ include "cozy-lib.resources.sanitize" .Values.resources }}.
   Example input:
   ==============
   limits:
-    cpu: 100m
+    cpu: "1"
     memory: 1024Mi
   requests:
-    cpu: 200m
+    cpu: "2"
     memory: 512Mi
   memory: 256Mi
   devices.com/nvidia: "1"
@@ -18,34 +49,42 @@
   Example output:
   ===============
   limits:
-    devices.com/nvidia: "1"
-    memory: 256Mi
+    devices.com/nvidia: "1" # only present in top level key
+    memory: 256Mi # value from top level key has priority over all others
+    cpu: "2" # value from .requests.cpu has priority over .limits.cpu
   requests:
-    cpu: 200m
-    devices.com/nvidia: "1"
-    memory: 256Mi
+    cpu: 200m # .limits.cpu divided by CPU allocation ratio
+    devices.com/nvidia: "1" # .requests == .limits
+    memory: 256Mi # .requests == .limits
 */}}
 {{- define "cozy-lib.resources.sanitize" }}
+{{-   $cpuAllocationRatio := include "cozy-lib.resources.cpuAllocationRatio" . | float64 }}
 {{-   $sanitizedMap := dict }}
-{{-   if hasKey . "limits" }}
-{{-     range $k, $v := .limits }}
+{{-   $args := index . 0 }}
+{{-   if hasKey $args "limits" }}
+{{-     range $k, $v := $args.limits }}
 {{-       $_ := set $sanitizedMap $k $v }}
 {{-     end }}
 {{-   end }}
-{{-   if hasKey . "requests" }}
-{{-     range $k, $v := .requests }}
+{{-   if hasKey $args "requests" }}
+{{-     range $k, $v := $args.requests }}
 {{-       $_ := set $sanitizedMap $k $v }}
 {{-     end }}
 {{-   end }}
-{{-   range $k, $v := . }}
+{{-   range $k, $v := $args }}
 {{-     if not (or (eq $k "requests") (eq $k "limits")) }}
 {{-       $_ := set $sanitizedMap $k $v }}
 {{-     end }}
 {{-   end }}
 {{-   $output := dict "requests" dict "limits" dict }}
 {{-   range $k, $v := $sanitizedMap }}
-{{-     $_ := set $output.requests $k $v }}
 {{-     if not (eq $k "cpu") }}
+{{-       $_ := set $output.requests $k $v }}
+{{-       $_ := set $output.limits $k $v }}
+{{-     else }}
+{{-       $vcpuRequestF64 := (include "cozy-lib.resources.toFloat" $v) | float64 }}
+{{-       $cpuRequestF64 := divf $vcpuRequestF64 $cpuAllocationRatio }}
+{{-       $_ := set $output.requests $k ($cpuRequestF64 | toString) }}
 {{-       $_ := set $output.limits $k $v }}
 {{-     end }}
 {{-   end }}