api

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

.github/workflows/backport.yaml

@@ -2,7 +2,7 @@ name: Automatic Backport
 
 on:
   pull_request_target:
-    types: [closed]   # fires when PR is closed (merged)
+    types: [closed, labeled]   # fires when PR is closed (merged) or labeled
 
 concurrency:
   group: backport-${{ github.workflow }}-${{ github.event.pull_request.number }}
@@ -13,22 +13,46 @@ permissions:
   pull-requests: write
 
 jobs:
-  backport:
+  # Determine which backports are needed
+  prepare:
     if: |
       github.event.pull_request.merged == true &&
-      contains(github.event.pull_request.labels.*.name, 'backport')
+      (
+        contains(github.event.pull_request.labels.*.name, 'backport') ||
+        contains(github.event.pull_request.labels.*.name, 'backport-previous') ||
+        (github.event.action == 'labeled' && (github.event.label.name == 'backport' || github.event.label.name == 'backport-previous'))
+      )
     runs-on: [self-hosted]
-
+    outputs:
+      backport_current: ${{ steps.labels.outputs.backport }}
+      backport_previous: ${{ steps.labels.outputs.backport_previous }}
+      current_branch: ${{ steps.branches.outputs.current_branch }}
+      previous_branch: ${{ steps.branches.outputs.previous_branch }}
     steps:
-      # 1. Decide which maintenance branch should receive the back‑port
-      - name: Determine target maintenance branch
-        id: target
+      - name: Check which labels are present
+        id: labels
         uses: actions/github-script@v7
         with:
           script: |
-            let rel;
+            const pr = context.payload.pull_request;
+            const labels = pr.labels.map(l => l.name);
+            const isBackport = labels.includes('backport');
+            const isBackportPrevious = labels.includes('backport-previous');
+            
+            core.setOutput('backport', isBackport ? 'true' : 'false');
+            core.setOutput('backport_previous', isBackportPrevious ? 'true' : 'false');
+            
+            console.log(`backport label: ${isBackport}, backport-previous label: ${isBackportPrevious}`);
+      
+      - name: Determine target branches
+        id: branches
+        uses: actions/github-script@v7
+        with:
+          script: |
+            // Get latest release
+            let latestRelease;
             try {
-              rel = await github.rest.repos.getLatestRelease({
+              latestRelease = await github.rest.repos.getLatestRelease({
                 owner: context.repo.owner,
                 repo: context.repo.repo
               });
@@ -36,18 +60,70 @@ jobs:
               core.setFailed('No existing releases found; cannot determine backport target.');
               return;
             }
-            const [maj, min] = rel.data.tag_name.replace(/^v/, '').split('.');
-            const branch = `release-${maj}.${min}`;
-            core.setOutput('branch', branch);
-            console.log(`Latest release ${rel.data.tag_name}; backporting to ${branch}`);
+            
+            const [maj, min] = latestRelease.data.tag_name.replace(/^v/, '').split('.');
+            const currentBranch = `release-${maj}.${min}`;
+            const prevMin = parseInt(min) - 1;
+            const previousBranch = prevMin >= 0 ? `release-${maj}.${prevMin}` : '';
+            
+            core.setOutput('current_branch', currentBranch);
+            core.setOutput('previous_branch', previousBranch);
+            
+            console.log(`Current branch: ${currentBranch}, Previous branch: ${previousBranch || 'N/A'}`);
+            
+            // Verify previous branch exists if we need it
+            if (previousBranch && '${{ steps.labels.outputs.backport_previous }}' === 'true') {
+              try {
+                await github.rest.repos.getBranch({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  branch: previousBranch
+                });
+                console.log(`Previous branch ${previousBranch} exists`);
+              } catch (e) {
+                core.setFailed(`Previous branch ${previousBranch} does not exist.`);
+                return;
+              }
+            }
+
+  backport:
+    needs: prepare
+    if: |
+      github.event.pull_request.merged == true &&
+      (needs.prepare.outputs.backport_current == 'true' || needs.prepare.outputs.backport_previous == 'true')
+    runs-on: [self-hosted]
+    strategy:
+      matrix:
+        backport_type: [current, previous]
+    steps:
+      # 1. Determine target branch based on matrix
+      - name: Set target branch
+        id: target
+        if: |
+          (matrix.backport_type == 'current' && needs.prepare.outputs.backport_current == 'true') ||
+          (matrix.backport_type == 'previous' && needs.prepare.outputs.backport_previous == 'true')
+        run: |
+          if [ "${{ matrix.backport_type }}" == "current" ]; then
+            echo "branch=${{ needs.prepare.outputs.current_branch }}" >> $GITHUB_OUTPUT
+            echo "Target branch: ${{ needs.prepare.outputs.current_branch }}"
+          else
+            echo "branch=${{ needs.prepare.outputs.previous_branch }}" >> $GITHUB_OUTPUT
+            echo "Target branch: ${{ needs.prepare.outputs.previous_branch }}"
+          fi
+      
       # 2. Checkout (required by backport‑action)
       - name: Checkout repository
+        if: steps.target.outcome == 'success'
         uses: actions/checkout@v4
 
       # 3. Create the back‑port pull request
       - name: Create back‑port PR
-        uses: korthout/backport-action@v3
+        id: backport
+        if: steps.target.outcome == 'success'
+        uses: korthout/backport-action@v3.2.1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           label_pattern: '' # don't read labels for targets
           target_branches: ${{ steps.target.outputs.branch }}
+          merge_commits: skip
+          conflict_resolution: draft_commit_conflicts

.github/workflows/pre-commit.yml

@@ -28,7 +28,7 @@ jobs:
 
       - name: Install generate
         run: |
-          curl -sSL https://github.com/cozystack/cozyvalues-gen/releases/download/v1.0.5/cozyvalues-gen-linux-amd64.tar.gz | tar -xzvf- -C /usr/local/bin/ cozyvalues-gen
+          curl -sSL https://github.com/cozystack/cozyvalues-gen/releases/download/v1.0.6/cozyvalues-gen-linux-amd64.tar.gz | tar -xzvf- -C /usr/local/bin/ cozyvalues-gen
 
       - name: Run pre-commit hooks
         run: |

ADOPTERS.md

@@ -32,4 +32,4 @@ This list is sorted in chronological order, based on the submission date.
 | [Urmanac](https://urmanac.com) | @kingdonb | 2024-12-04 | Urmanac is the future home of a hosting platform for the knowledge base of a community of personal server enthusiasts. We use Cozystack to provide support services for web sites hosted using both conventional deployments and on SpinKube, with WASM. |
 | [Hidora](https://hikube.cloud) | @matthieu-robin | 2025-09-17 | Hidora is a Swiss cloud provider delivering managed services and infrastructure solutions through datacenters located in Switzerland, ensuring data sovereignty and reliability. Its sovereign cloud platform, Hikube, is designed to run workloads with high availability across multiple datacenters, providing enterprises with a secure and scalable foundation for their applications based on Cozystack. |
 | [QOSI](https://qosi.kz) | @tabu-a | 2025-10-04 | QOSI is a non-profit organization driving open-source adoption and digital sovereignty across Kazakhstan and Central Asia. We use Cozystack as a platform for deploying sovereign, GPU-enabled clouds and educational environments under the National AI Program. Our goal is to accelerate the region’s transition toward open, self-hosted cloud-native technologies |
-|
+| [Cloupard](https://cloupard.kz/) | @serjiott | 2025-12-18 | Cloupard is a public cloud provider offering IaaS and PaaS services via datacenters in Kazakhstan and Uzbekistan. Uses CozyStack on bare metal to extend its managed PaaS offerings. |

Makefile

@@ -18,7 +18,6 @@ build: build-deps
 	make -C packages/system/backup-controller image
 	make -C packages/system/lineage-controller-webhook image
 	make -C packages/system/cilium image
-	make -C packages/system/linstor image
 	make -C packages/system/kubeovn-webhook image
 	make -C packages/system/kubeovn-plunger image
 	make -C packages/system/dashboard image
@@ -27,6 +26,7 @@ build: build-deps
 	make -C packages/system/bucket image
 	make -C packages/system/objectstorage-controller image
 	make -C packages/core/testing image
+	make -C packages/core/platform image
 	make -C packages/core/installer image
 	make manifests
 

api/backups/strategy/v1alpha1/velero_types.go

@@ -1,64 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Package v1alpha1 defines strategy.backups.cozystack.io API types.
-//
-// Group: strategy.backups.cozystack.io
-// Version: v1alpha1
-package v1alpha1
-
-import (
-	velerov1 "github.com/vmware-tanzu/velero/pkg/apis/velero/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-func init() {
-	SchemeBuilder.Register(func(s *runtime.Scheme) error {
-		s.AddKnownTypes(GroupVersion,
-			&Velero{},
-			&VeleroList{},
-		)
-		return nil
-	})
-}
-
-const (
-	VeleroStrategyKind = "Velero"
-)
-
-// +kubebuilder:object:root=true
-// +kubebuilder:subresource:status
-// +kubebuilder:resource:scope=Cluster
-
-// Velero defines a backup strategy using Velero as the driver.
-type Velero struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   VeleroSpec   `json:"spec,omitempty"`
-	Status VeleroStatus `json:"status,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// VeleroList contains a list of Velero backup strategies.
-type VeleroList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []Velero `json:"items"`
-}
-
-// VeleroSpec specifies the desired strategy for backing up with Velero.
-type VeleroSpec struct {
-	Template VeleroTemplate `json:"template"`
-}
-
-// VeleroTemplate describes the data a backup.velero.io should have when
-// templated from a Velero backup strategy.
-type VeleroTemplate struct {
-	Spec        velerov1.BackupSpec  `json:"spec"`
-	RestoreSpec velerov1.RestoreSpec `json:"restoreSpec"`
-}
-
-type VeleroStatus struct {
-	Conditions []metav1.Condition `json:"conditions,omitempty"`
-}

api/backups/strategy/v1alpha1/zz_generated.deepcopy.go

@@ -121,117 +121,3 @@ func (in *JobStatus) DeepCopy() *JobStatus {
 	in.DeepCopyInto(out)
 	return out
 }
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Velero) DeepCopyInto(out *Velero) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Velero.
-func (in *Velero) DeepCopy() *Velero {
-	if in == nil {
-		return nil
-	}
-	out := new(Velero)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Velero) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *VeleroList) DeepCopyInto(out *VeleroList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]Velero, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VeleroList.
-func (in *VeleroList) DeepCopy() *VeleroList {
-	if in == nil {
-		return nil
-	}
-	out := new(VeleroList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *VeleroList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *VeleroSpec) DeepCopyInto(out *VeleroSpec) {
-	*out = *in
-	in.Template.DeepCopyInto(&out.Template)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VeleroSpec.
-func (in *VeleroSpec) DeepCopy() *VeleroSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(VeleroSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *VeleroStatus) DeepCopyInto(out *VeleroStatus) {
-	*out = *in
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]v1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VeleroStatus.
-func (in *VeleroStatus) DeepCopy() *VeleroStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(VeleroStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *VeleroTemplate) DeepCopyInto(out *VeleroTemplate) {
-	*out = *in
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.RestoreSpec.DeepCopyInto(&out.RestoreSpec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VeleroTemplate.
-func (in *VeleroTemplate) DeepCopy() *VeleroTemplate {
-	if in == nil {
-		return nil
-	}
-	out := new(VeleroTemplate)
-	in.DeepCopyInto(out)
-	return out
-}

api/backups/v1alpha1/backupjob_types.go

@@ -21,11 +21,6 @@ func init() {
 	})
 }
 
-const (
-	OwningJobNameLabel      = thisGroup + "/owned-by.BackupJobName"
-	OwningJobNamespaceLabel = thisGroup + "/owned-by.BackupJobNamespace"
-)
-
 // BackupJobPhase represents the lifecycle phase of a BackupJob.
 type BackupJobPhase string
 
@@ -90,8 +85,6 @@ type BackupJobStatus struct {
 // The field indexing on applicationRef will be needed later to display per-app backup resources.
 
 // +kubebuilder:object:root=true
-// +kubebuilder:subresource:status
-// +kubebuilder:printcolumn:name="Phase",type="string",JSONPath=".status.phase",priority=0
 // +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.apiGroup`
 // +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.kind`
 // +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.name`

api/backups/v1alpha1/groupversion_info.go

@@ -25,13 +25,8 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 )
 
-const (
-	thisGroup   = "backups.cozystack.io"
-	thisVersion = "v1alpha1"
-)
-
 var (
-	GroupVersion  = schema.GroupVersion{Group: thisGroup, Version: thisVersion}
+	GroupVersion  = schema.GroupVersion{Group: "backups.cozystack.io", Version: "v1alpha1"}
 	SchemeBuilder = runtime.NewSchemeBuilder(addGroupVersion)
 	AddToScheme   = SchemeBuilder.AddToScheme
 )

api/backups/v1alpha1/restorejob_types.go

@@ -71,8 +71,6 @@ type RestoreJobStatus struct {
 }
 
 // +kubebuilder:object:root=true
-// +kubebuilder:subresource:status
-// +kubebuilder:printcolumn:name="Phase",type="string",JSONPath=".status.phase",priority=0
 
 // RestoreJob represents a single execution of a restore from a Backup.
 type RestoreJob struct {

api/v1alpha1/cozystackresourcedefinitions_types.go

@@ -92,7 +92,8 @@ type CozystackResourceDefinitionApplication struct {
 
 type CozystackResourceDefinitionRelease struct {
 	// Helm chart configuration
-	Chart CozystackResourceDefinitionChart `json:"chart"`
+	// +optional
+	Chart CozystackResourceDefinitionChart `json:"chart,omitempty"`
 	// Labels for the release
 	Labels map[string]string `json:"labels,omitempty"`
 	// Prefix for the release name
@@ -110,17 +111,18 @@ type CozystackResourceDefinitionRelease struct {
 // - {{ .namespace }}: The namespace of the resource being processed
 //
 // Example YAML:
-//   secrets:
-//     include:
-//     - matchExpressions:
-//       - key: badlabel
-//         operator: DoesNotExist
-//       matchLabels:
-//         goodlabel: goodvalue
-//       resourceNames:
-//       - "{{ .name }}-secret"
-//       - "{{ .kind }}-{{ .name }}-tls"
-//       - "specificname"
+//
+//	secrets:
+//	  include:
+//	  - matchExpressions:
+//	    - key: badlabel
+//	      operator: DoesNotExist
+//	    matchLabels:
+//	      goodlabel: goodvalue
+//	    resourceNames:
+//	    - "{{ .name }}-secret"
+//	    - "{{ .kind }}-{{ .name }}-tls"
+//	    - "specificname"
 type CozystackResourceDefinitionResourceSelector struct {
 	metav1.LabelSelector `json:",inline"`
 	// ResourceNames is a list of resource names to match

api/v1alpha1/package_types.go

@@ -0,0 +1,89 @@
+/*
+Copyright 2025.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +kubebuilder:object:root=true
+// +kubebuilder:resource:scope=Cluster,shortName={pkg,pkgs}
+// +kubebuilder:subresource:status
+// +kubebuilder:printcolumn:name="Variant",type="string",JSONPath=".spec.variant",description="Selected variant"
+// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status",description="Ready status"
+// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].message",description="Ready message"
+
+// Package is the Schema for the packages API
+type Package struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   PackageSpec   `json:"spec,omitempty"`
+	Status PackageStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// PackageList contains a list of Packages
+type PackageList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []Package `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&Package{}, &PackageList{})
+}
+
+// PackageSpec defines the desired state of Package
+type PackageSpec struct {
+	// Variant is the name of the variant to use from the PackageSource
+	// If not specified, defaults to "default"
+	// +optional
+	Variant string `json:"variant,omitempty"`
+
+	// IgnoreDependencies is a list of package source dependencies to ignore
+	// Dependencies listed here will not be installed even if they are specified in the PackageSource
+	// +optional
+	IgnoreDependencies []string `json:"ignoreDependencies,omitempty"`
+
+	// Components is a map of release name to component overrides
+	// Allows overriding values and enabling/disabling specific components from the PackageSource
+	// +optional
+	Components map[string]PackageComponent `json:"components,omitempty"`
+}
+
+// PackageRelease defines overrides for a specific component
+type PackageComponent struct {
+	// Enabled indicates whether this component should be installed
+	// If false, the component will be disabled even if it's defined in the PackageSource
+	// +optional
+	Enabled *bool `json:"enabled,omitempty"`
+
+	// Values contains Helm chart values as a JSON object
+	// These values will be merged with the default values from the PackageSource
+	// +optional
+	Values *apiextensionsv1.JSON `json:"values,omitempty"`
+}
+
+// PackageStatus defines the observed state of Package
+type PackageStatus struct {
+	// Conditions represents the latest available observations of a Package's state
+	// +optional
+	Conditions []metav1.Condition `json:"conditions,omitempty"`
+}

api/v1alpha1/packagesource_types.go

@@ -0,0 +1,184 @@
+/*
+Copyright 2025.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +kubebuilder:object:root=true
+// +kubebuilder:resource:scope=Cluster,shortName={pkgsrc,pkgsrcs}
+// +kubebuilder:subresource:status
+// +kubebuilder:printcolumn:name="Variants",type="string",JSONPath=".status.variants",description="Package variants (comma-separated)"
+// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status",description="Ready status"
+// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].message",description="Ready message"
+
+// PackageSource is the Schema for the packagesources API
+type PackageSource struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   PackageSourceSpec   `json:"spec,omitempty"`
+	Status PackageSourceStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// PackageSourceList contains a list of PackageSources
+type PackageSourceList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []PackageSource `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&PackageSource{}, &PackageSourceList{})
+}
+
+// PackageSourceSpec defines the desired state of PackageSource
+type PackageSourceSpec struct {
+	// SourceRef is the source reference for the package source charts
+	// +optional
+	SourceRef *PackageSourceRef `json:"sourceRef,omitempty"`
+
+	// Variants is a list of package source variants
+	// Each variant defines components, applications, dependencies, and libraries for a specific configuration
+	// +optional
+	Variants []Variant `json:"variants,omitempty"`
+}
+
+// Variant defines a single variant configuration
+type Variant struct {
+	// Name is the unique identifier for this variant
+	// +required
+	Name string `json:"name"`
+
+	// DependsOn is a list of package source dependencies
+	// For example: "cozystack.networking"
+	// +optional
+	DependsOn []string `json:"dependsOn,omitempty"`
+
+	// Libraries is a list of Helm library charts used by components in this variant
+	// +optional
+	Libraries []Library `json:"libraries,omitempty"`
+
+	// Components is a list of Helm releases to be installed as part of this variant
+	// +optional
+	Components []Component `json:"components,omitempty"`
+}
+
+// DependencyTarget defines a named group of packages that can be referenced
+// by other package sources via dependsOn
+type DependencyTarget struct {
+	// Name is the unique identifier for this dependency target
+	// +required
+	Name string `json:"name"`
+
+	// Packages is a list of package names that belong to this target
+	// These packages will be added as dependencies when this target is referenced
+	// +required
+	Packages []string `json:"packages"`
+}
+
+// Library defines a Helm library chart
+type Library struct {
+	// Name is the optional name for library placed in charts
+	// +optional
+	Name string `json:"name,omitempty"`
+
+	// Path is the path to the library chart directory
+	// +required
+	Path string `json:"path"`
+}
+
+// PackageSourceRef defines the source reference for package source charts
+type PackageSourceRef struct {
+	// Kind of the source reference
+	// +kubebuilder:validation:Enum=GitRepository;OCIRepository
+	// +required
+	Kind string `json:"kind"`
+
+	// Name of the source reference
+	// +required
+	Name string `json:"name"`
+
+	// Namespace of the source reference
+	// +required
+	Namespace string `json:"namespace"`
+
+	// Path is the base path where packages are located in the source.
+	// For GitRepository, defaults to "packages" if not specified.
+	// For OCIRepository, defaults to empty string (root) if not specified.
+	// +optional
+	Path string `json:"path,omitempty"`
+}
+
+// ComponentInstall defines installation parameters for a component
+type ComponentInstall struct {
+	// ReleaseName is the name of the HelmRelease resource that will be created
+	// If not specified, defaults to the component Name field
+	// +optional
+	ReleaseName string `json:"releaseName,omitempty"`
+
+	// Namespace is the Kubernetes namespace where the release will be installed
+	// +optional
+	Namespace string `json:"namespace,omitempty"`
+
+	// Privileged indicates whether this release requires privileged access
+	// +optional
+	Privileged bool `json:"privileged,omitempty"`
+
+	// DependsOn is a list of component names that must be installed before this component
+	// +optional
+	DependsOn []string `json:"dependsOn,omitempty"`
+}
+
+// Component defines a single Helm release component within a package source
+type Component struct {
+	// Name is the unique identifier for this component within the package source
+	// +required
+	Name string `json:"name"`
+
+	// Path is the path to the Helm chart directory
+	// +required
+	Path string `json:"path"`
+
+	// Install defines installation parameters for this component
+	// +optional
+	Install *ComponentInstall `json:"install,omitempty"`
+
+	// Libraries is a list of library names that this component depends on
+	// These libraries must be defined at the variant level
+	// +optional
+	Libraries []string `json:"libraries,omitempty"`
+
+	// ValuesFiles is a list of values file names to use
+	// +optional
+	ValuesFiles []string `json:"valuesFiles,omitempty"`
+}
+
+// PackageSourceStatus defines the observed state of PackageSource
+type PackageSourceStatus struct {
+	// Variants is a comma-separated list of package variant names
+	// This field is populated by the controller based on spec.variants keys
+	// +optional
+	Variants string `json:"variants,omitempty"`
+
+	// Conditions represents the latest available observations of a PackageSource's state
+	// +optional
+	Conditions []metav1.Condition `json:"conditions,omitempty"`
+}

api/v1alpha1/zz_generated.deepcopy.go

@@ -21,10 +21,62 @@ limitations under the License.
 package v1alpha1
 
 import (
+	"k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Component) DeepCopyInto(out *Component) {
+	*out = *in
+	if in.Install != nil {
+		in, out := &in.Install, &out.Install
+		*out = new(ComponentInstall)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Libraries != nil {
+		in, out := &in.Libraries, &out.Libraries
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.ValuesFiles != nil {
+		in, out := &in.ValuesFiles, &out.ValuesFiles
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Component.
+func (in *Component) DeepCopy() *Component {
+	if in == nil {
+		return nil
+	}
+	out := new(Component)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ComponentInstall) DeepCopyInto(out *ComponentInstall) {
+	*out = *in
+	if in.DependsOn != nil {
+		in, out := &in.DependsOn, &out.DependsOn
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ComponentInstall.
+func (in *ComponentInstall) DeepCopy() *ComponentInstall {
+	if in == nil {
+		return nil
+	}
+	out := new(ComponentInstall)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CozystackResourceDefinition) DeepCopyInto(out *CozystackResourceDefinition) {
 	*out = *in
@@ -256,6 +308,297 @@ func (in *CozystackResourceDefinitionSpec) DeepCopy() *CozystackResourceDefiniti
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DependencyTarget) DeepCopyInto(out *DependencyTarget) {
+	*out = *in
+	if in.Packages != nil {
+		in, out := &in.Packages, &out.Packages
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DependencyTarget.
+func (in *DependencyTarget) DeepCopy() *DependencyTarget {
+	if in == nil {
+		return nil
+	}
+	out := new(DependencyTarget)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Library) DeepCopyInto(out *Library) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Library.
+func (in *Library) DeepCopy() *Library {
+	if in == nil {
+		return nil
+	}
+	out := new(Library)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Package) DeepCopyInto(out *Package) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Package.
+func (in *Package) DeepCopy() *Package {
+	if in == nil {
+		return nil
+	}
+	out := new(Package)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Package) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PackageComponent) DeepCopyInto(out *PackageComponent) {
+	*out = *in
+	if in.Enabled != nil {
+		in, out := &in.Enabled, &out.Enabled
+		*out = new(bool)
+		**out = **in
+	}
+	if in.Values != nil {
+		in, out := &in.Values, &out.Values
+		*out = new(v1.JSON)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageComponent.
+func (in *PackageComponent) DeepCopy() *PackageComponent {
+	if in == nil {
+		return nil
+	}
+	out := new(PackageComponent)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PackageList) DeepCopyInto(out *PackageList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Package, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageList.
+func (in *PackageList) DeepCopy() *PackageList {
+	if in == nil {
+		return nil
+	}
+	out := new(PackageList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PackageList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PackageSource) DeepCopyInto(out *PackageSource) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageSource.
+func (in *PackageSource) DeepCopy() *PackageSource {
+	if in == nil {
+		return nil
+	}
+	out := new(PackageSource)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PackageSource) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PackageSourceList) DeepCopyInto(out *PackageSourceList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]PackageSource, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageSourceList.
+func (in *PackageSourceList) DeepCopy() *PackageSourceList {
+	if in == nil {
+		return nil
+	}
+	out := new(PackageSourceList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PackageSourceList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PackageSourceRef) DeepCopyInto(out *PackageSourceRef) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageSourceRef.
+func (in *PackageSourceRef) DeepCopy() *PackageSourceRef {
+	if in == nil {
+		return nil
+	}
+	out := new(PackageSourceRef)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PackageSourceSpec) DeepCopyInto(out *PackageSourceSpec) {
+	*out = *in
+	if in.SourceRef != nil {
+		in, out := &in.SourceRef, &out.SourceRef
+		*out = new(PackageSourceRef)
+		**out = **in
+	}
+	if in.Variants != nil {
+		in, out := &in.Variants, &out.Variants
+		*out = make([]Variant, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageSourceSpec.
+func (in *PackageSourceSpec) DeepCopy() *PackageSourceSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(PackageSourceSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PackageSourceStatus) DeepCopyInto(out *PackageSourceStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]metav1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageSourceStatus.
+func (in *PackageSourceStatus) DeepCopy() *PackageSourceStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(PackageSourceStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PackageSpec) DeepCopyInto(out *PackageSpec) {
+	*out = *in
+	if in.IgnoreDependencies != nil {
+		in, out := &in.IgnoreDependencies, &out.IgnoreDependencies
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Components != nil {
+		in, out := &in.Components, &out.Components
+		*out = make(map[string]PackageComponent, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageSpec.
+func (in *PackageSpec) DeepCopy() *PackageSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(PackageSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PackageStatus) DeepCopyInto(out *PackageStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]metav1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageStatus.
+func (in *PackageStatus) DeepCopy() *PackageStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(PackageStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in Selector) DeepCopyInto(out *Selector) {
 	{
@@ -292,6 +635,38 @@ func (in *SourceRef) DeepCopy() *SourceRef {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Variant) DeepCopyInto(out *Variant) {
+	*out = *in
+	if in.DependsOn != nil {
+		in, out := &in.DependsOn, &out.DependsOn
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Libraries != nil {
+		in, out := &in.Libraries, &out.Libraries
+		*out = make([]Library, len(*in))
+		copy(*out, *in)
+	}
+	if in.Components != nil {
+		in, out := &in.Components, &out.Components
+		*out = make([]Component, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Variant.
+func (in *Variant) DeepCopy() *Variant {
+	if in == nil {
+		return nil
+	}
+	out := new(Variant)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Workload) DeepCopyInto(out *Workload) {
 	*out = *in

cmd/backupstrategy-controller/main.go

@@ -35,10 +35,8 @@ import (
 	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
 
-	strategyv1alpha1 "github.com/cozystack/cozystack/api/backups/strategy/v1alpha1"
 	backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1"
 	"github.com/cozystack/cozystack/internal/backupcontroller"
-	velerov1 "github.com/vmware-tanzu/velero/pkg/apis/velero/v1"
 	// +kubebuilder:scaffold:imports
 )
 
@@ -51,8 +49,6 @@ func init() {
 	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
 
 	utilruntime.Must(backupsv1alpha1.AddToScheme(scheme))
-	utilruntime.Must(strategyv1alpha1.AddToScheme(scheme))
-	utilruntime.Must(velerov1.AddToScheme(scheme))
 	// +kubebuilder:scaffold:scheme
 }
 
@@ -151,21 +147,11 @@ func main() {
 		os.Exit(1)
 	}
 
-	if err = (&backupcontroller.BackupJobReconciler{
-		Client:   mgr.GetClient(),
-		Scheme:   mgr.GetScheme(),
-		Recorder: mgr.GetEventRecorderFor("backup-controller"),
+	if err = (&backupcontroller.BackupJobStrategyReconciler{
+		Client: mgr.GetClient(),
+		Scheme: mgr.GetScheme(),
 	}).SetupWithManager(mgr); err != nil {
-		setupLog.Error(err, "unable to create controller", "controller", "BackupJob")
-		os.Exit(1)
-	}
-
-	if err = (&backupcontroller.RestoreJobReconciler{
-		Client:   mgr.GetClient(),
-		Scheme:   mgr.GetScheme(),
-		Recorder: mgr.GetEventRecorderFor("restore-controller"),
-	}).SetupWithManager(mgr); err != nil {
-		setupLog.Error(err, "unable to create controller", "controller", "RestoreJob")
+		setupLog.Error(err, "unable to create controller", "controller", "Job")
 		os.Exit(1)
 	}
 

cmd/cozypkg/cmd/add.go

@@ -0,0 +1,565 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cmd
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"github.com/spf13/cobra"
+	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/serializer/yaml"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	_ "k8s.io/client-go/plugin/pkg/client/auth"
+)
+
+var addCmdFlags struct {
+	files      []string
+	kubeconfig string
+}
+
+var addCmd = &cobra.Command{
+	Use:   "add [package]...",
+	Short: "Install PackageSource and its dependencies interactively",
+	Long: `Install PackageSource and its dependencies interactively.
+
+You can specify packages as arguments or use -f flag to read from files.
+Multiple -f flags can be specified, and they can point to files or directories.`,
+	Args: cobra.ArbitraryArgs,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		ctx := context.Background()
+
+		// Collect package names from arguments and files
+		packageNames := make(map[string]bool)
+		packagesFromFiles := make(map[string]string) // packageName -> filePath
+		
+		for _, arg := range args {
+			packageNames[arg] = true
+		}
+
+		// Read packages from files
+		for _, filePath := range addCmdFlags.files {
+			packages, err := readPackagesFromFile(filePath)
+			if err != nil {
+				return fmt.Errorf("failed to read packages from %s: %w", filePath, err)
+			}
+			for _, pkg := range packages {
+				packageNames[pkg] = true
+				packagesFromFiles[pkg] = filePath
+			}
+		}
+
+		if len(packageNames) == 0 {
+			return fmt.Errorf("no packages specified")
+		}
+
+		// Create Kubernetes client config
+		var config *rest.Config
+		var err error
+
+		if addCmdFlags.kubeconfig != "" {
+			config, err = clientcmd.BuildConfigFromFlags("", addCmdFlags.kubeconfig)
+			if err != nil {
+				return fmt.Errorf("failed to load kubeconfig from %s: %w", addCmdFlags.kubeconfig, err)
+			}
+		} else {
+			config, err = ctrl.GetConfig()
+			if err != nil {
+				return fmt.Errorf("failed to get kubeconfig: %w", err)
+			}
+		}
+
+		scheme := runtime.NewScheme()
+		utilruntime.Must(clientgoscheme.AddToScheme(scheme))
+		utilruntime.Must(cozyv1alpha1.AddToScheme(scheme))
+
+		k8sClient, err := client.New(config, client.Options{Scheme: scheme})
+		if err != nil {
+			return fmt.Errorf("failed to create k8s client: %w", err)
+		}
+
+		// Process each package
+		for packageName := range packageNames {
+			// Check if package comes from a file
+			if filePath, fromFile := packagesFromFiles[packageName]; fromFile {
+				// Try to create Package directly from file
+				if err := createPackageFromFile(ctx, k8sClient, filePath, packageName); err == nil {
+					fmt.Fprintf(os.Stderr, "✓ Added Package %s\n", packageName)
+					continue
+				}
+				// If failed, fall back to interactive installation
+			}
+			
+			// Interactive installation from PackageSource
+			if err := installPackage(ctx, k8sClient, packageName); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	},
+}
+
+func readPackagesFromFile(filePath string) ([]string, error) {
+	info, err := os.Stat(filePath)
+	if err != nil {
+		return nil, err
+	}
+
+	var packages []string
+
+	if info.IsDir() {
+		// Read all YAML files from directory
+		err := filepath.Walk(filePath, func(path string, info os.FileInfo, err error) error {
+			if err != nil {
+				return err
+			}
+			if info.IsDir() || !strings.HasSuffix(path, ".yaml") && !strings.HasSuffix(path, ".yml") {
+				return nil
+			}
+
+			pkgs, err := readPackagesFromYAMLFile(path)
+			if err != nil {
+				return fmt.Errorf("failed to read %s: %w", path, err)
+			}
+			packages = append(packages, pkgs...)
+			return nil
+		})
+		if err != nil {
+			return nil, err
+		}
+	} else {
+		packages, err = readPackagesFromYAMLFile(filePath)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return packages, nil
+}
+
+func readPackagesFromYAMLFile(filePath string) ([]string, error) {
+	data, err := os.ReadFile(filePath)
+	if err != nil {
+		return nil, err
+	}
+
+	var packages []string
+
+	// Split YAML documents (in case of multiple resources)
+	documents := strings.Split(string(data), "---")
+	
+	for _, doc := range documents {
+		doc = strings.TrimSpace(doc)
+		if doc == "" {
+			continue
+		}
+
+		// Parse using Kubernetes decoder
+		decoder := yaml.NewDecodingSerializer(unstructured.UnstructuredJSONScheme)
+		obj := &unstructured.Unstructured{}
+		_, _, err := decoder.Decode([]byte(doc), nil, obj)
+		if err != nil {
+			continue
+		}
+
+		// Check if it's a Package
+		if obj.GetKind() == "Package" {
+			name := obj.GetName()
+			if name != "" {
+				packages = append(packages, name)
+			}
+			continue
+		}
+
+		// Check if it's a PackageSource
+		if obj.GetKind() == "PackageSource" {
+			name := obj.GetName()
+			if name != "" {
+				packages = append(packages, name)
+			}
+			continue
+		}
+
+		// Try to parse as PackageList
+		if obj.GetKind() == "PackageList" {
+			items, found, err := unstructured.NestedSlice(obj.Object, "items")
+			if err == nil && found {
+				for _, item := range items {
+					if itemMap, ok := item.(map[string]interface{}); ok {
+						if metadata, ok := itemMap["metadata"].(map[string]interface{}); ok {
+							if name, ok := metadata["name"].(string); ok && name != "" {
+								packages = append(packages, name)
+							}
+						}
+					}
+				}
+			}
+			continue
+		}
+
+		// Try to parse as PackageSourceList
+		if obj.GetKind() == "PackageSourceList" {
+			items, found, err := unstructured.NestedSlice(obj.Object, "items")
+			if err == nil && found {
+				for _, item := range items {
+					if itemMap, ok := item.(map[string]interface{}); ok {
+						if metadata, ok := itemMap["metadata"].(map[string]interface{}); ok {
+							if name, ok := metadata["name"].(string); ok && name != "" {
+								packages = append(packages, name)
+							}
+						}
+					}
+				}
+			}
+			continue
+		}
+	}
+
+	if len(packages) == 0 {
+		return nil, fmt.Errorf("no valid packages found in file")
+	}
+
+	return packages, nil
+}
+
+// buildDependencyTree builds a dependency tree starting from the root PackageSource
+// Returns both the dependency tree and a map of dependencies to their requesters
+func buildDependencyTree(ctx context.Context, k8sClient client.Client, rootName string) (map[string][]string, map[string]string, error) {
+	tree := make(map[string][]string)
+	dependencyRequesters := make(map[string]string) // dep -> requester
+	visited := make(map[string]bool)
+	
+	// Ensure root is in tree even if it has no dependencies
+	tree[rootName] = []string{}
+
+	var buildTree func(string) error
+	buildTree = func(pkgName string) error {
+		if visited[pkgName] {
+			return nil
+		}
+		visited[pkgName] = true
+
+		// Get PackageSource
+		ps := &cozyv1alpha1.PackageSource{}
+		if err := k8sClient.Get(ctx, client.ObjectKey{Name: pkgName}, ps); err != nil {
+			// If PackageSource doesn't exist, just skip it
+			return nil
+		}
+
+		// Collect all dependencies from all variants
+		deps := make(map[string]bool)
+		for _, variant := range ps.Spec.Variants {
+			for _, dep := range variant.DependsOn {
+				deps[dep] = true
+			}
+		}
+
+		// Add dependencies to tree
+		for dep := range deps {
+			if _, exists := tree[pkgName]; !exists {
+				tree[pkgName] = []string{}
+			}
+			tree[pkgName] = append(tree[pkgName], dep)
+			// Track who requested this dependency
+			dependencyRequesters[dep] = pkgName
+			// Recursively build tree for dependencies
+			if err := buildTree(dep); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	}
+
+	if err := buildTree(rootName); err != nil {
+		return nil, nil, err
+	}
+
+	return tree, dependencyRequesters, nil
+}
+
+// topologicalSort performs topological sort on the dependency tree
+// Returns order from root to leaves (dependencies first)
+func topologicalSort(tree map[string][]string) ([]string, error) {
+	// Build reverse graph (dependencies -> dependents)
+	reverseGraph := make(map[string][]string)
+	allNodes := make(map[string]bool)
+
+	for node, deps := range tree {
+		allNodes[node] = true
+		for _, dep := range deps {
+			allNodes[dep] = true
+			reverseGraph[dep] = append(reverseGraph[dep], node)
+		}
+	}
+
+	// Calculate in-degrees (how many dependencies a node has)
+	inDegree := make(map[string]int)
+	for node := range allNodes {
+		inDegree[node] = 0
+	}
+	for node, deps := range tree {
+		inDegree[node] = len(deps)
+	}
+
+	// Kahn's algorithm - start with nodes that have no dependencies
+	var queue []string
+	for node, degree := range inDegree {
+		if degree == 0 {
+			queue = append(queue, node)
+		}
+	}
+
+	var result []string
+	for len(queue) > 0 {
+		node := queue[0]
+		queue = queue[1:]
+		result = append(result, node)
+
+		// Process dependents (nodes that depend on this node)
+		for _, dependent := range reverseGraph[node] {
+			inDegree[dependent]--
+			if inDegree[dependent] == 0 {
+				queue = append(queue, dependent)
+			}
+		}
+	}
+
+	// Check for cycles
+	if len(result) != len(allNodes) {
+		return nil, fmt.Errorf("dependency cycle detected")
+	}
+
+	return result, nil
+}
+
+// createPackageFromFile creates a Package resource directly from a YAML file
+func createPackageFromFile(ctx context.Context, k8sClient client.Client, filePath string, packageName string) error {
+	data, err := os.ReadFile(filePath)
+	if err != nil {
+		return err
+	}
+
+	// Split YAML documents
+	documents := strings.Split(string(data), "---")
+	
+	for _, doc := range documents {
+		doc = strings.TrimSpace(doc)
+		if doc == "" {
+			continue
+		}
+
+		// Parse using Kubernetes decoder
+		decoder := yaml.NewDecodingSerializer(unstructured.UnstructuredJSONScheme)
+		obj := &unstructured.Unstructured{}
+		_, _, err := decoder.Decode([]byte(doc), nil, obj)
+		if err != nil {
+			continue
+		}
+
+		// Check if it's a Package with matching name
+		if obj.GetKind() == "Package" && obj.GetName() == packageName {
+			// Convert to Package
+			var pkg cozyv1alpha1.Package
+			if err := runtime.DefaultUnstructuredConverter.FromUnstructured(obj.Object, &pkg); err != nil {
+				return fmt.Errorf("failed to convert Package: %w", err)
+			}
+
+			// Create Package
+			if err := k8sClient.Create(ctx, &pkg); err != nil {
+				return fmt.Errorf("failed to create Package: %w", err)
+			}
+
+			return nil
+		}
+	}
+
+	return fmt.Errorf("Package %s not found in file", packageName)
+}
+
+func installPackage(ctx context.Context, k8sClient client.Client, packageSourceName string) error {
+	// Get PackageSource
+	packageSource := &cozyv1alpha1.PackageSource{}
+	if err := k8sClient.Get(ctx, client.ObjectKey{Name: packageSourceName}, packageSource); err != nil {
+		return fmt.Errorf("failed to get PackageSource %s: %w", packageSourceName, err)
+	}
+
+	// Build dependency tree
+	dependencyTree, dependencyRequesters, err := buildDependencyTree(ctx, k8sClient, packageSourceName)
+	if err != nil {
+		return fmt.Errorf("failed to build dependency tree: %w", err)
+	}
+
+	// Topological sort (install from root to leaves)
+	installOrder, err := topologicalSort(dependencyTree)
+	if err != nil {
+		return fmt.Errorf("failed to sort dependencies: %w", err)
+	}
+
+	// Get all PackageSources for variant selection
+	var allPackageSources cozyv1alpha1.PackageSourceList
+	if err := k8sClient.List(ctx, &allPackageSources); err != nil {
+		return fmt.Errorf("failed to list PackageSources: %w", err)
+	}
+
+	packageSourceMap := make(map[string]*cozyv1alpha1.PackageSource)
+	for i := range allPackageSources.Items {
+		packageSourceMap[allPackageSources.Items[i].Name] = &allPackageSources.Items[i]
+	}
+
+	// Get all installed Packages
+	var installedPackages cozyv1alpha1.PackageList
+	if err := k8sClient.List(ctx, &installedPackages); err != nil {
+		return fmt.Errorf("failed to list Packages: %w", err)
+	}
+
+	installedMap := make(map[string]*cozyv1alpha1.Package)
+	for i := range installedPackages.Items {
+		installedMap[installedPackages.Items[i].Name] = &installedPackages.Items[i]
+	}
+
+	// First, collect all variant selections
+	fmt.Fprintf(os.Stderr, "Installing %s and its dependencies...\n\n", packageSourceName)
+	packageVariants := make(map[string]string) // packageName -> variant
+
+	for _, pkgName := range installOrder {
+		// Check if already installed
+		if installed, exists := installedMap[pkgName]; exists {
+			variant := installed.Spec.Variant
+			if variant == "" {
+				variant = "default"
+			}
+			fmt.Fprintf(os.Stderr, "✓ %s (already installed, variant: %s)\n", pkgName, variant)
+			packageVariants[pkgName] = variant
+			continue
+		}
+
+		// Get PackageSource for this dependency
+		ps, exists := packageSourceMap[pkgName]
+		if !exists {
+			requester := dependencyRequesters[pkgName]
+			if requester != "" {
+				return fmt.Errorf("PackageSource %s not found (required by %s)", pkgName, requester)
+			}
+			return fmt.Errorf("PackageSource %s not found", pkgName)
+		}
+
+		// Select variant interactively
+		variant, err := selectVariantInteractive(ps)
+		if err != nil {
+			return fmt.Errorf("failed to select variant for %s: %w", pkgName, err)
+		}
+
+		packageVariants[pkgName] = variant
+	}
+
+		// Now create all Package resources
+		for _, pkgName := range installOrder {
+			// Skip if already installed
+			if _, exists := installedMap[pkgName]; exists {
+				continue
+			}
+
+			variant := packageVariants[pkgName]
+
+			// Create Package
+			pkg := &cozyv1alpha1.Package{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: pkgName,
+				},
+				Spec: cozyv1alpha1.PackageSpec{
+					Variant: variant,
+				},
+			}
+
+			if err := k8sClient.Create(ctx, pkg); err != nil {
+				return fmt.Errorf("failed to create Package %s: %w", pkgName, err)
+			}
+
+			fmt.Fprintf(os.Stderr, "✓ Added Package %s\n", pkgName)
+		}
+
+		return nil
+}
+
+// selectVariantInteractive prompts user to select a variant
+func selectVariantInteractive(ps *cozyv1alpha1.PackageSource) (string, error) {
+	if len(ps.Spec.Variants) == 0 {
+		return "", fmt.Errorf("no variants available for PackageSource %s", ps.Name)
+	}
+
+	reader := bufio.NewReader(os.Stdin)
+
+	fmt.Fprintf(os.Stderr, "\nPackageSource: %s\n", ps.Name)
+	fmt.Fprintf(os.Stderr, "Available variants:\n")
+	for i, variant := range ps.Spec.Variants {
+		fmt.Fprintf(os.Stderr, "  %d. %s\n", i+1, variant.Name)
+	}
+
+	// If only one variant, use it as default
+	defaultVariant := ps.Spec.Variants[0].Name
+	var prompt string
+	if len(ps.Spec.Variants) == 1 {
+		prompt = "Select variant [1]: "
+	} else {
+		prompt = fmt.Sprintf("Select variant (1-%d): ", len(ps.Spec.Variants))
+	}
+
+	for {
+		fmt.Fprintf(os.Stderr, prompt)
+		input, err := reader.ReadString('\n')
+		if err != nil {
+			return "", fmt.Errorf("failed to read input: %w", err)
+		}
+
+		input = strings.TrimSpace(input)
+
+		// If input is empty and there's a default variant, use it
+		if input == "" && len(ps.Spec.Variants) == 1 {
+			return defaultVariant, nil
+		}
+
+		choice, err := strconv.Atoi(input)
+		if err != nil || choice < 1 || choice > len(ps.Spec.Variants) {
+			fmt.Fprintf(os.Stderr, "Invalid choice. Please enter a number between 1 and %d.\n", len(ps.Spec.Variants))
+			continue
+		}
+
+		return ps.Spec.Variants[choice-1].Name, nil
+	}
+}
+
+func init() {
+	rootCmd.AddCommand(addCmd)
+	addCmd.Flags().StringArrayVarP(&addCmdFlags.files, "file", "f", []string{}, "Read packages from file or directory (can be specified multiple times)")
+	addCmd.Flags().StringVar(&addCmdFlags.kubeconfig, "kubeconfig", "", "Path to kubeconfig file (defaults to ~/.kube/config or KUBECONFIG env var)")
+}
+

cmd/cozypkg/cmd/del.go

@@ -0,0 +1,121 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
+	"k8s.io/apimachinery/pkg/runtime"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	_ "k8s.io/client-go/plugin/pkg/client/auth"
+)
+
+var delCmdFlags struct {
+	files      []string
+	kubeconfig string
+}
+
+var delCmd = &cobra.Command{
+	Use:   "del [package]...",
+	Short: "Delete Package resources",
+	Long: `Delete Package resources.
+
+You can specify packages as arguments or use -f flag to read from files.
+Multiple -f flags can be specified, and they can point to files or directories.`,
+	Args: cobra.ArbitraryArgs,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		ctx := context.Background()
+
+		// Collect package names from arguments and files
+		packageNames := make(map[string]bool)
+		for _, arg := range args {
+			packageNames[arg] = true
+		}
+
+		// Read packages from files (reuse function from add.go)
+		for _, filePath := range delCmdFlags.files {
+			packages, err := readPackagesFromFile(filePath)
+			if err != nil {
+				return fmt.Errorf("failed to read packages from %s: %w", filePath, err)
+			}
+			for _, pkg := range packages {
+				packageNames[pkg] = true
+			}
+		}
+
+		if len(packageNames) == 0 {
+			return fmt.Errorf("no packages specified")
+		}
+
+		// Create Kubernetes client config
+		var config *rest.Config
+		var err error
+
+		if delCmdFlags.kubeconfig != "" {
+			config, err = clientcmd.BuildConfigFromFlags("", delCmdFlags.kubeconfig)
+			if err != nil {
+				return fmt.Errorf("failed to load kubeconfig from %s: %w", delCmdFlags.kubeconfig, err)
+			}
+		} else {
+			config, err = ctrl.GetConfig()
+			if err != nil {
+				return fmt.Errorf("failed to get kubeconfig: %w", err)
+			}
+		}
+
+		scheme := runtime.NewScheme()
+		utilruntime.Must(clientgoscheme.AddToScheme(scheme))
+		utilruntime.Must(cozyv1alpha1.AddToScheme(scheme))
+
+		k8sClient, err := client.New(config, client.Options{Scheme: scheme})
+		if err != nil {
+			return fmt.Errorf("failed to create k8s client: %w", err)
+		}
+
+		// Delete each package
+		for packageName := range packageNames {
+			pkg := &cozyv1alpha1.Package{}
+			pkg.Name = packageName
+			if err := k8sClient.Delete(ctx, pkg); err != nil {
+				if client.IgnoreNotFound(err) == nil {
+					fmt.Fprintf(os.Stderr, "⚠ Package %s not found, skipping\n", packageName)
+					continue
+				}
+				return fmt.Errorf("failed to delete Package %s: %w", packageName, err)
+			}
+			fmt.Fprintf(os.Stderr, "✓ Deleted Package %s\n", packageName)
+		}
+
+		return nil
+	},
+}
+
+func init() {
+	rootCmd.AddCommand(delCmd)
+	delCmd.Flags().StringArrayVarP(&delCmdFlags.files, "file", "f", []string{}, "Read packages from file or directory (can be specified multiple times)")
+	delCmd.Flags().StringVar(&delCmdFlags.kubeconfig, "kubeconfig", "", "Path to kubeconfig file (defaults to ~/.kube/config or KUBECONFIG env var)")
+}
+

cmd/cozypkg/cmd/dependencies.go

@@ -0,0 +1,300 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/emicklei/dot"
+	"github.com/spf13/cobra"
+	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
+	"k8s.io/apimachinery/pkg/runtime"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	_ "k8s.io/client-go/plugin/pkg/client/auth"
+)
+
+var dotCmdFlags struct {
+	installed  bool
+	components bool
+	files      []string
+	kubeconfig string
+}
+
+var dotCmd = &cobra.Command{
+	Use:   "dot [package]...",
+	Short: "Generate dependency graph as graphviz DOT format",
+	Long: `Generate dependency graph as graphviz DOT format.
+
+Pipe the output through the "dot" program (part of graphviz package) to render the graph:
+
+    cozypkg dot | dot -Tpng > graph.png
+
+By default, shows dependencies for all PackageSource resources.
+Use --installed to show only installed Package resources.
+Specify packages as arguments or use -f flag to read from files.`,
+	Args: cobra.ArbitraryArgs,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		ctx := context.Background()
+
+		// Collect package names from arguments and files
+		packageNames := make(map[string]bool)
+		for _, arg := range args {
+			packageNames[arg] = true
+		}
+
+		// Read packages from files (reuse function from add.go)
+		for _, filePath := range dotCmdFlags.files {
+			packages, err := readPackagesFromFile(filePath)
+			if err != nil {
+				return fmt.Errorf("failed to read packages from %s: %w", filePath, err)
+			}
+			for _, pkg := range packages {
+				packageNames[pkg] = true
+			}
+		}
+
+		// Convert to slice, empty means all packages
+		var selectedPackages []string
+		if len(packageNames) > 0 {
+			for pkg := range packageNames {
+				selectedPackages = append(selectedPackages, pkg)
+			}
+		}
+
+		// If multiple packages specified, show graph for all of them
+		// If single package, use packageName for backward compatibility
+		var packageName string
+		if len(selectedPackages) == 1 {
+			packageName = selectedPackages[0]
+		} else if len(selectedPackages) > 1 {
+			// Multiple packages - pass empty string to packageName, use selectedPackages
+			packageName = ""
+		}
+
+		// packagesOnly is inverse of components flag (if components=false, then packagesOnly=true)
+		packagesOnly := !dotCmdFlags.components
+		graph, allNodes, err := buildGraphFromCluster(ctx, dotCmdFlags.kubeconfig, packagesOnly, dotCmdFlags.installed, packageName, selectedPackages)
+		if err != nil {
+			return fmt.Errorf("error getting PackageSource dependencies: %w", err)
+		}
+
+		dotGraph := generateDOTGraph(graph, allNodes, packagesOnly)
+		dotGraph.Write(os.Stdout)
+
+		return nil
+	},
+}
+
+func init() {
+	rootCmd.AddCommand(dotCmd)
+	dotCmd.Flags().BoolVarP(&dotCmdFlags.installed, "installed", "i", false, "show dependencies only for installed Package resources")
+	dotCmd.Flags().BoolVar(&dotCmdFlags.components, "components", true, "show component-level dependencies (default: true)")
+	dotCmd.Flags().StringArrayVarP(&dotCmdFlags.files, "file", "f", []string{}, "Read packages from file or directory (can be specified multiple times)")
+	dotCmd.Flags().StringVar(&dotCmdFlags.kubeconfig, "kubeconfig", "", "Path to kubeconfig file (defaults to ~/.kube/config or KUBECONFIG env var)")
+}
+
+var (
+	dependenciesScheme = runtime.NewScheme()
+)
+
+func init() {
+	utilruntime.Must(clientgoscheme.AddToScheme(dependenciesScheme))
+	utilruntime.Must(cozyv1alpha1.AddToScheme(dependenciesScheme))
+}
+
+// buildGraphFromCluster builds a dependency graph from PackageSource resources in the cluster.
+func buildGraphFromCluster(ctx context.Context, kubeconfig string, packagesOnly bool, installedOnly bool, packageName string, selectedPackages []string) (map[string][]string, map[string]bool, error) {
+	// Create Kubernetes client config
+	var config *rest.Config
+	var err error
+
+	if kubeconfig != "" {
+		// Load kubeconfig from explicit path
+		config, err = clientcmd.BuildConfigFromFlags("", kubeconfig)
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to load kubeconfig from %s: %w", kubeconfig, err)
+		}
+	} else {
+		// Use default kubeconfig loading (from env var or ~/.kube/config)
+		config, err = ctrl.GetConfig()
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to get kubeconfig: %w", err)
+		}
+	}
+
+	k8sClient, err := client.New(config, client.Options{Scheme: dependenciesScheme})
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to create k8s client: %w", err)
+	}
+
+	// Get installed Packages if needed
+	installedPackages := make(map[string]bool)
+	if installedOnly || packageName != "" {
+		var packageList cozyv1alpha1.PackageList
+		if err := k8sClient.List(ctx, &packageList); err != nil {
+			return nil, nil, fmt.Errorf("failed to list Packages: %w", err)
+		}
+		for _, pkg := range packageList.Items {
+			installedPackages[pkg.Name] = true
+		}
+	}
+
+	// List all PackageSource resources
+	var packageSourceList cozyv1alpha1.PackageSourceList
+	if err := k8sClient.List(ctx, &packageSourceList); err != nil {
+		return nil, nil, fmt.Errorf("failed to list PackageSources: %w", err)
+	}
+
+	graph := make(map[string][]string)
+	allNodes := make(map[string]bool)
+
+	// Process each PackageSource
+	for _, ps := range packageSourceList.Items {
+		psName := ps.Name
+		if psName == "" {
+			continue
+		}
+
+		// Filter by package name if specified
+		if packageName != "" && psName != packageName {
+			continue
+		}
+
+		// Filter by selected packages if specified
+		if len(selectedPackages) > 0 {
+			found := false
+			for _, selected := range selectedPackages {
+				if psName == selected {
+					found = true
+					break
+				}
+			}
+			if !found {
+				continue
+			}
+		}
+
+		// Filter by installed packages if flag is set
+		if installedOnly && !installedPackages[psName] {
+			continue
+		}
+
+		allNodes[psName] = true
+
+		// Extract dependencies from variants
+		for _, variant := range ps.Spec.Variants {
+			// Variant-level dependencies
+			for _, dep := range variant.DependsOn {
+				// If installedOnly is set, only include dependencies that are installed
+				if installedOnly && !installedPackages[dep] {
+					continue
+				}
+				graph[psName] = append(graph[psName], dep)
+				allNodes[dep] = true
+			}
+
+			// Component-level dependencies
+			if !packagesOnly {
+				for _, component := range variant.Components {
+					componentName := fmt.Sprintf("%s.%s", psName, component.Name)
+					allNodes[componentName] = true
+
+					if component.Install != nil {
+						for _, dep := range component.Install.DependsOn {
+							// Check if it's a local component dependency or external
+							if strings.Contains(dep, ".") {
+								graph[componentName] = append(graph[componentName], dep)
+								allNodes[dep] = true
+							} else {
+								// Local component dependency
+								localDep := fmt.Sprintf("%s.%s", psName, dep)
+								graph[componentName] = append(graph[componentName], localDep)
+								allNodes[localDep] = true
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+
+	return graph, allNodes, nil
+}
+
+// generateDOTGraph generates a DOT graph from the dependency graph.
+func generateDOTGraph(graph map[string][]string, allNodes map[string]bool, packagesOnly bool) *dot.Graph {
+	g := dot.NewGraph(dot.Directed)
+	g.Attr("rankdir", "LR")
+	g.Attr("nodesep", "0.5")
+	g.Attr("ranksep", "1.0")
+
+	// Add nodes
+	for node := range allNodes {
+		if packagesOnly && strings.Contains(node, ".") && !strings.HasPrefix(node, "cozystack.") {
+			// Skip component nodes when packages-only is enabled
+			continue
+		}
+
+		n := g.Node(node)
+
+		// Style nodes based on type
+		if strings.Contains(node, ".") && !strings.HasPrefix(node, "cozystack.") {
+			// Component node
+			n.Attr("shape", "box")
+			n.Attr("style", "rounded,filled")
+			n.Attr("fillcolor", "lightyellow")
+			n.Attr("label", strings.Split(node, ".")[len(strings.Split(node, "."))-1])
+		} else {
+			// Package node
+			n.Attr("shape", "box")
+			n.Attr("style", "rounded,filled")
+			n.Attr("fillcolor", "lightblue")
+			n.Attr("label", node)
+		}
+	}
+
+	// Add edges
+	for source, targets := range graph {
+		if packagesOnly && strings.Contains(source, ".") && !strings.HasPrefix(source, "cozystack.") {
+			// Skip component edges when packages-only is enabled
+			continue
+		}
+
+		for _, target := range targets {
+			if packagesOnly && strings.Contains(target, ".") && !strings.HasPrefix(target, "cozystack.") {
+				// Skip component edges when packages-only is enabled
+				continue
+			}
+
+			// Only add edge if both nodes exist
+			if allNodes[source] && allNodes[target] {
+				g.Edge(g.Node(source), g.Node(target))
+			}
+		}
+	}
+
+	return g
+}
+

cmd/cozypkg/cmd/list.go

@@ -0,0 +1,201 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/spf13/cobra"
+	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
+	"k8s.io/apimachinery/pkg/runtime"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	_ "k8s.io/client-go/plugin/pkg/client/auth"
+)
+
+var listCmdFlags struct {
+	installed   bool
+	components  bool
+	kubeconfig  string
+}
+
+var listCmd = &cobra.Command{
+	Use:   "list",
+	Short: "List PackageSource or Package resources",
+	Long: `List PackageSource or Package resources in table format.
+
+By default, lists PackageSource resources. Use --installed flag to list installed Package resources.
+Use --components flag to show components on separate lines.`,
+	Args: cobra.NoArgs,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		ctx := context.Background()
+
+		// Create Kubernetes client config
+		var config *rest.Config
+		var err error
+
+		if listCmdFlags.kubeconfig != "" {
+			config, err = clientcmd.BuildConfigFromFlags("", listCmdFlags.kubeconfig)
+			if err != nil {
+				return fmt.Errorf("failed to load kubeconfig from %s: %w", listCmdFlags.kubeconfig, err)
+			}
+		} else {
+			config, err = ctrl.GetConfig()
+			if err != nil {
+				return fmt.Errorf("failed to get kubeconfig: %w", err)
+			}
+		}
+
+		scheme := runtime.NewScheme()
+		utilruntime.Must(clientgoscheme.AddToScheme(scheme))
+		utilruntime.Must(cozyv1alpha1.AddToScheme(scheme))
+
+		k8sClient, err := client.New(config, client.Options{Scheme: scheme})
+		if err != nil {
+			return fmt.Errorf("failed to create k8s client: %w", err)
+		}
+
+		if listCmdFlags.installed {
+			return listPackages(ctx, k8sClient, listCmdFlags.components)
+		}
+		return listPackageSources(ctx, k8sClient, listCmdFlags.components)
+	},
+}
+
+func listPackageSources(ctx context.Context, k8sClient client.Client, showComponents bool) error {
+	var psList cozyv1alpha1.PackageSourceList
+	if err := k8sClient.List(ctx, &psList); err != nil {
+		return fmt.Errorf("failed to list PackageSources: %w", err)
+	}
+
+	// Print header
+	fmt.Fprintf(os.Stdout, "%-50s %-30s %-10s %s\n", "NAME", "VARIANTS", "READY", "STATUS")
+	fmt.Fprintf(os.Stdout, "%-50s %-30s %-10s %s\n", strings.Repeat("-", 50), strings.Repeat("-", 30), strings.Repeat("-", 10), strings.Repeat("-", 50))
+
+		// Print rows
+		for _, ps := range psList.Items {
+			// Get variants
+			var variants []string
+			for _, variant := range ps.Spec.Variants {
+				variants = append(variants, variant.Name)
+			}
+			variantsStr := strings.Join(variants, ",")
+			if len(variantsStr) > 28 {
+				variantsStr = variantsStr[:25] + "..."
+			}
+
+			// Get Ready condition
+			ready := "Unknown"
+			status := ""
+			for _, condition := range ps.Status.Conditions {
+				if condition.Type == "Ready" {
+					ready = string(condition.Status)
+					status = condition.Message
+					if len(status) > 48 {
+						status = status[:45] + "..."
+					}
+					break
+				}
+			}
+
+			fmt.Fprintf(os.Stdout, "%-50s %-30s %-10s %s\n", ps.Name, variantsStr, ready, status)
+
+			// Show components if requested
+			if showComponents {
+				for _, variant := range ps.Spec.Variants {
+					for _, component := range variant.Components {
+						fmt.Fprintf(os.Stdout, "  %-48s %-30s %-10s %s\n", 
+							fmt.Sprintf("%s.%s", ps.Name, component.Name), 
+							variant.Name, "", "")
+					}
+				}
+			}
+		}
+
+	return nil
+}
+
+func listPackages(ctx context.Context, k8sClient client.Client, showComponents bool) error {
+	var pkgList cozyv1alpha1.PackageList
+	if err := k8sClient.List(ctx, &pkgList); err != nil {
+		return fmt.Errorf("failed to list Packages: %w", err)
+	}
+
+	// Print header
+	fmt.Fprintf(os.Stdout, "%-50s %-20s %-10s %s\n", "NAME", "VARIANT", "READY", "STATUS")
+	fmt.Fprintf(os.Stdout, "%-50s %-20s %-10s %s\n", strings.Repeat("-", 50), strings.Repeat("-", 20), strings.Repeat("-", 10), strings.Repeat("-", 50))
+
+	// Print rows
+	for _, pkg := range pkgList.Items {
+		variant := pkg.Spec.Variant
+		if variant == "" {
+			variant = "default"
+		}
+
+		// Get Ready condition
+		ready := "Unknown"
+		status := ""
+		for _, condition := range pkg.Status.Conditions {
+			if condition.Type == "Ready" {
+				ready = string(condition.Status)
+				status = condition.Message
+				if len(status) > 48 {
+					status = status[:45] + "..."
+				}
+				break
+			}
+		}
+
+		fmt.Fprintf(os.Stdout, "%-50s %-20s %-10s %s\n", pkg.Name, variant, ready, status)
+
+		// Show components if requested
+		if showComponents {
+			// Get PackageSource to show components
+			ps := &cozyv1alpha1.PackageSource{}
+			if err := k8sClient.Get(ctx, client.ObjectKey{Name: pkg.Name}, ps); err == nil {
+				// Find the variant
+				for _, v := range ps.Spec.Variants {
+					if v.Name == variant {
+						for _, component := range v.Components {
+							fmt.Fprintf(os.Stdout, "  %-48s %-20s %-10s %s\n", 
+								fmt.Sprintf("%s.%s", pkg.Name, component.Name), 
+								variant, "", "")
+						}
+						break
+					}
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
+func init() {
+	rootCmd.AddCommand(listCmd)
+	listCmd.Flags().BoolVarP(&listCmdFlags.installed, "installed", "i", false, "list installed Package resources instead of PackageSource resources")
+	listCmd.Flags().BoolVar(&listCmdFlags.components, "components", false, "show components on separate lines")
+	listCmd.Flags().StringVar(&listCmdFlags.kubeconfig, "kubeconfig", "", "Path to kubeconfig file (defaults to ~/.kube/config or KUBECONFIG env var)")
+}
+

cmd/cozypkg/cmd/root.go

@@ -0,0 +1,49 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cmd
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+// rootCmd represents the base command when called without any subcommands.
+var rootCmd = &cobra.Command{
+	Use:               "cozypkg",
+	Short:             "A CLI for managing Cozystack packages",
+	Long:              ``,
+	SilenceErrors:     true,
+	SilenceUsage:      true,
+	DisableAutoGenTag: true,
+}
+
+// Execute adds all child commands to the root command and sets flags appropriately.
+// This is called by main.main(). It only needs to happen once to the rootCmd.
+func Execute() error {
+	if err := rootCmd.Execute(); err != nil {
+		fmt.Fprintln(os.Stderr, err.Error())
+		return err
+	}
+	return nil
+}
+
+func init() {
+	// Commands are registered in their respective init() functions
+}
+

cmd/cozypkg/main.go

@@ -0,0 +1,30 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"os"
+
+	"github.com/cozystack/cozystack/cmd/cozypkg/cmd"
+)
+
+func main() {
+	if err := cmd.Execute(); err != nil {
+		os.Exit(1)
+	}
+}
+

cmd/cozystack-operator/main.go

@@ -0,0 +1,481 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
+	// to ensure that exec-entrypoint and run can make use of them.
+	_ "k8s.io/client-go/plugin/pkg/client/auth"
+
+	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
+	helmv2 "github.com/fluxcd/helm-controller/api/v2"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1"
+	sourcewatcherv1beta1 "github.com/fluxcd/source-watcher/api/v2/v1beta1"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/healthz"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/log/zap"
+	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+
+	"github.com/cozystack/cozystack/internal/fluxinstall"
+	"github.com/cozystack/cozystack/internal/operator"
+	// +kubebuilder:scaffold:imports
+)
+
+var (
+	scheme   = runtime.NewScheme()
+	setupLog = ctrl.Log.WithName("setup")
+)
+
+// stringSliceFlag is a custom flag type that allows multiple values
+type stringSliceFlag []string
+
+func (f *stringSliceFlag) String() string {
+	return strings.Join(*f, ",")
+}
+
+func (f *stringSliceFlag) Set(value string) error {
+	*f = append(*f, value)
+	return nil
+}
+
+func init() {
+	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
+	utilruntime.Must(apiextensionsv1.AddToScheme(scheme))
+	utilruntime.Must(cozyv1alpha1.AddToScheme(scheme))
+	utilruntime.Must(helmv2.AddToScheme(scheme))
+	utilruntime.Must(sourcev1.AddToScheme(scheme))
+	utilruntime.Must(sourcewatcherv1beta1.AddToScheme(scheme))
+	// +kubebuilder:scaffold:scheme
+}
+
+func main() {
+	var metricsAddr string
+	var enableLeaderElection bool
+	var probeAddr string
+	var secureMetrics bool
+	var enableHTTP2 bool
+	var installFlux bool
+	var cozystackVersion string
+	var installFluxResources stringSliceFlag
+	var platformSource string
+	var platformSourceName string
+
+	flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
+	flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
+	flag.BoolVar(&enableLeaderElection, "leader-elect", false,
+		"Enable leader election for controller manager. "+
+			"Enabling this will ensure there is only one active controller manager.")
+	flag.BoolVar(&secureMetrics, "metrics-secure", false,
+		"If set the metrics endpoint is served securely")
+	flag.BoolVar(&enableHTTP2, "enable-http2", false,
+		"If set, HTTP/2 will be enabled for the metrics and webhook servers")
+	flag.BoolVar(&installFlux, "install-flux", false, "Install Flux components before starting reconcile loop")
+	flag.Var(&installFluxResources, "install-flux-resource", "Install Flux resource (JSON format). Can be specified multiple times. Applied after Flux installation.")
+	flag.StringVar(&cozystackVersion, "cozystack-version", "unknown",
+		"Version of Cozystack")
+	flag.StringVar(&platformSource, "platform-source", "", "Platform source URL (oci:// or git://). If specified, generates OCIRepository or GitRepository resource.")
+	flag.StringVar(&platformSourceName, "platform-source-name", "cozystack-packages", "Name for the generated platform source resource (default: cozystack-packages)")
+
+	opts := zap.Options{
+		Development: true,
+	}
+	opts.BindFlags(flag.CommandLine)
+	flag.Parse()
+
+	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
+
+	config := ctrl.GetConfigOrDie()
+
+	// Start the controller manager
+	setupLog.Info("Starting controller manager")
+	mgr, err := ctrl.NewManager(config, ctrl.Options{
+		Scheme: scheme,
+		Metrics: metricsserver.Options{
+			BindAddress:   metricsAddr,
+			SecureServing: secureMetrics,
+		},
+		WebhookServer: webhook.NewServer(webhook.Options{
+			Port: 9443,
+		}),
+		HealthProbeBindAddress: probeAddr,
+		LeaderElection:         enableLeaderElection,
+		LeaderElectionID:       "cozystack-operator.cozystack.io",
+		// LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily
+		// when the Manager ends. This requires the binary to immediately end when the
+		// Manager is stopped, otherwise, setting this significantly speeds up voluntary
+		// leader transitions as the new leader don't have to wait LeaseDuration time first.
+		//
+		// In the default scaffold provided, the program ends immediately after
+		// the manager stops, so would be fine to enable this option. However,
+		// if you are doing or is intended to do any operation such as perform cleanups
+		// after the manager stops then its usage might be unsafe.
+		// LeaderElectionReleaseOnCancel: true,
+	})
+	if err != nil {
+		setupLog.Error(err, "unable to start manager")
+		os.Exit(1)
+	}
+
+	// Install Flux before starting reconcile loop
+	if installFlux {
+		setupLog.Info("Installing Flux components before starting reconcile loop")
+		installCtx, installCancel := context.WithTimeout(context.Background(), 5*time.Minute)
+		defer installCancel()
+
+		// The namespace will be automatically extracted from the embedded manifests
+		if err := fluxinstall.Install(installCtx, mgr.GetClient(), fluxinstall.WriteEmbeddedManifests); err != nil {
+			setupLog.Error(err, "failed to install Flux, continuing anyway")
+			// Don't exit - allow operator to start even if Flux install fails
+			// This allows the operator to work in environments where Flux is already installed
+		} else {
+			setupLog.Info("Flux installation completed successfully")
+		}
+	}
+
+	// Install Flux resources after Flux installation
+	if len(installFluxResources) > 0 {
+		setupLog.Info("Installing Flux resources", "count", len(installFluxResources))
+		installCtx, installCancel := context.WithTimeout(context.Background(), 2*time.Minute)
+		defer installCancel()
+
+		if err := installFluxResourcesFunc(installCtx, mgr.GetClient(), installFluxResources); err != nil {
+			setupLog.Error(err, "failed to install Flux resources, continuing anyway")
+			// Don't exit - allow operator to start even if resource installation fails
+		} else {
+			setupLog.Info("Flux resources installation completed successfully")
+		}
+	}
+
+	// Generate and install platform source resource if specified
+	if platformSource != "" {
+		setupLog.Info("Generating platform source resource", "source", platformSource, "name", platformSourceName)
+		installCtx, installCancel := context.WithTimeout(context.Background(), 2*time.Minute)
+		defer installCancel()
+
+		if err := installPlatformSourceResource(installCtx, mgr.GetClient(), platformSource, platformSourceName); err != nil {
+			setupLog.Error(err, "failed to install platform source resource")
+			os.Exit(1)
+		} else {
+			setupLog.Info("Platform source resource installation completed successfully")
+		}
+	}
+
+	// Setup PackageSource reconciler
+	if err := (&operator.PackageSourceReconciler{
+		Client: mgr.GetClient(),
+		Scheme: mgr.GetScheme(),
+	}).SetupWithManager(mgr); err != nil {
+		setupLog.Error(err, "unable to create controller", "controller", "PackageSource")
+		os.Exit(1)
+	}
+
+	// Setup Package reconciler
+	if err := (&operator.PackageReconciler{
+		Client: mgr.GetClient(),
+		Scheme: mgr.GetScheme(),
+	}).SetupWithManager(mgr); err != nil {
+		setupLog.Error(err, "unable to create controller", "controller", "Package")
+		os.Exit(1)
+	}
+
+	// +kubebuilder:scaffold:builder
+
+	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
+		setupLog.Error(err, "unable to set up health check")
+		os.Exit(1)
+	}
+	if err := mgr.AddReadyzCheck("readyz", healthz.Ping); err != nil {
+		setupLog.Error(err, "unable to set up ready check")
+		os.Exit(1)
+	}
+
+	setupLog.Info("Starting controller manager")
+	mgrCtx := ctrl.SetupSignalHandler()
+	if err := mgr.Start(mgrCtx); err != nil {
+		setupLog.Error(err, "problem running manager")
+		os.Exit(1)
+	}
+}
+
+// installFluxResourcesFunc installs Flux resources from JSON strings
+func installFluxResourcesFunc(ctx context.Context, k8sClient client.Client, resources []string) error {
+	logger := log.FromContext(ctx)
+
+	for i, resourceJSON := range resources {
+		logger.Info("Installing Flux resource", "index", i+1, "total", len(resources))
+
+		// Parse JSON into unstructured object
+		var obj unstructured.Unstructured
+		if err := json.Unmarshal([]byte(resourceJSON), &obj.Object); err != nil {
+			return fmt.Errorf("failed to parse resource JSON at index %d: %w", i, err)
+		}
+
+		// Validate that it has required fields
+		if obj.GetAPIVersion() == "" {
+			return fmt.Errorf("resource at index %d missing apiVersion", i)
+		}
+		if obj.GetKind() == "" {
+			return fmt.Errorf("resource at index %d missing kind", i)
+		}
+		if obj.GetName() == "" {
+			return fmt.Errorf("resource at index %d missing metadata.name", i)
+		}
+
+		// Apply the resource (create or update)
+		logger.Info("Applying Flux resource",
+			"apiVersion", obj.GetAPIVersion(),
+			"kind", obj.GetKind(),
+			"name", obj.GetName(),
+			"namespace", obj.GetNamespace(),
+		)
+
+		// Use server-side apply or create/update
+		existing := &unstructured.Unstructured{}
+		existing.SetGroupVersionKind(obj.GroupVersionKind())
+		key := client.ObjectKey{
+			Name:      obj.GetName(),
+			Namespace: obj.GetNamespace(),
+		}
+
+		err := k8sClient.Get(ctx, key, existing)
+		if err != nil {
+			if client.IgnoreNotFound(err) == nil {
+				// Resource doesn't exist, create it
+				if err := k8sClient.Create(ctx, &obj); err != nil {
+					return fmt.Errorf("failed to create resource %s/%s: %w", obj.GetKind(), obj.GetName(), err)
+				}
+				logger.Info("Created Flux resource", "kind", obj.GetKind(), "name", obj.GetName())
+			} else {
+				return fmt.Errorf("failed to check if resource exists: %w", err)
+			}
+		} else {
+			// Resource exists, update it
+			obj.SetResourceVersion(existing.GetResourceVersion())
+			if err := k8sClient.Update(ctx, &obj); err != nil {
+				return fmt.Errorf("failed to update resource %s/%s: %w", obj.GetKind(), obj.GetName(), err)
+			}
+			logger.Info("Updated Flux resource", "kind", obj.GetKind(), "name", obj.GetName())
+		}
+	}
+
+	return nil
+}
+
+// installPlatformSourceResource generates and installs a Flux source resource (OCIRepository or GitRepository)
+// based on the platform source URL
+func installPlatformSourceResource(ctx context.Context, k8sClient client.Client, sourceURL, resourceName string) error {
+	logger := log.FromContext(ctx)
+
+	// Parse the source URL to determine type
+	sourceType, repoURL, ref, err := parsePlatformSource(sourceURL)
+	if err != nil {
+		return fmt.Errorf("failed to parse platform source URL: %w", err)
+	}
+
+	var obj *unstructured.Unstructured
+	switch sourceType {
+	case "oci":
+		obj, err = generateOCIRepository(resourceName, repoURL, ref)
+		if err != nil {
+			return fmt.Errorf("failed to generate OCIRepository: %w", err)
+		}
+	case "git":
+		obj, err = generateGitRepository(resourceName, repoURL, ref)
+		if err != nil {
+			return fmt.Errorf("failed to generate GitRepository: %w", err)
+		}
+	default:
+		return fmt.Errorf("unsupported source type: %s (expected oci:// or git://)", sourceType)
+	}
+
+	// Apply the resource (create or update)
+	logger.Info("Applying platform source resource",
+		"apiVersion", obj.GetAPIVersion(),
+		"kind", obj.GetKind(),
+		"name", obj.GetName(),
+		"namespace", obj.GetNamespace(),
+	)
+
+	existing := &unstructured.Unstructured{}
+	existing.SetGroupVersionKind(obj.GroupVersionKind())
+	key := client.ObjectKey{
+		Name:      obj.GetName(),
+		Namespace: obj.GetNamespace(),
+	}
+
+	err = k8sClient.Get(ctx, key, existing)
+	if err != nil {
+		if client.IgnoreNotFound(err) == nil {
+			// Resource doesn't exist, create it
+			if err := k8sClient.Create(ctx, obj); err != nil {
+				return fmt.Errorf("failed to create resource %s/%s: %w", obj.GetKind(), obj.GetName(), err)
+			}
+			logger.Info("Created platform source resource", "kind", obj.GetKind(), "name", obj.GetName())
+		} else {
+			return fmt.Errorf("failed to check if resource exists: %w", err)
+		}
+	} else {
+		// Resource exists, update it
+		obj.SetResourceVersion(existing.GetResourceVersion())
+		if err := k8sClient.Update(ctx, obj); err != nil {
+			return fmt.Errorf("failed to update resource %s/%s: %w", obj.GetKind(), obj.GetName(), err)
+		}
+		logger.Info("Updated platform source resource", "kind", obj.GetKind(), "name", obj.GetName())
+	}
+
+	return nil
+}
+
+// parsePlatformSource parses the source URL and returns the type, repository URL, and reference
+// Supports formats:
+//   - oci://registry.example.com/repo@sha256:digest
+//   - oci://registry.example.com/repo (ref will be empty)
+//   - git://github.com/user/repo@branch
+//   - git://github.com/user/repo (ref will default to "main")
+//   - https://github.com/user/repo@branch (treated as git)
+func parsePlatformSource(sourceURL string) (sourceType, repoURL, ref string, err error) {
+	// Normalize the URL by trimming whitespace
+	sourceURL = strings.TrimSpace(sourceURL)
+
+	// Check for oci:// prefix
+	if strings.HasPrefix(sourceURL, "oci://") {
+		// Remove oci:// prefix
+		rest := strings.TrimPrefix(sourceURL, "oci://")
+
+		// Check for @sha256: digest (look for @ followed by sha256:)
+		// We need to find the last @ before sha256: to handle paths with @ symbols
+		sha256Idx := strings.Index(rest, "@sha256:")
+		if sha256Idx != -1 {
+			repoURL = "oci://" + rest[:sha256Idx]
+			ref = rest[sha256Idx+1:] // sha256:digest
+		} else {
+			// Check for @ without sha256: (might be a tag)
+			if atIdx := strings.LastIndex(rest, "@"); atIdx != -1 {
+				// Could be a tag, but for OCI we expect sha256: digest
+				// For now, treat everything after @ as the ref
+				repoURL = "oci://" + rest[:atIdx]
+				ref = rest[atIdx+1:]
+			} else {
+				repoURL = "oci://" + rest
+				ref = "" // No digest specified
+			}
+		}
+		return "oci", repoURL, ref, nil
+	}
+
+	// Check for git:// prefix or treat as git for http/https
+	if strings.HasPrefix(sourceURL, "git://") || strings.HasPrefix(sourceURL, "http://") || strings.HasPrefix(sourceURL, "https://") || strings.HasPrefix(sourceURL, "ssh://") {
+		// Parse URL to extract ref if present
+		parsedURL, err := url.Parse(sourceURL)
+		if err != nil {
+			return "", "", "", fmt.Errorf("invalid URL: %w", err)
+		}
+
+		// Check for @ref in the path (e.g., git://host/path@branch)
+		path := parsedURL.Path
+		if idx := strings.LastIndex(path, "@"); idx != -1 {
+			repoURL = fmt.Sprintf("%s://%s%s", parsedURL.Scheme, parsedURL.Host, path[:idx])
+			if parsedURL.RawQuery != "" {
+				repoURL += "?" + parsedURL.RawQuery
+			}
+			ref = path[idx+1:]
+		} else {
+			// Default to main branch if no ref specified
+			repoURL = sourceURL
+			ref = "main"
+		}
+
+		// Normalize git:// to https:// for GitRepository
+		if strings.HasPrefix(repoURL, "git://") {
+			repoURL = strings.Replace(repoURL, "git://", "https://", 1)
+		}
+
+		return "git", repoURL, ref, nil
+	}
+
+	return "", "", "", fmt.Errorf("unsupported source URL scheme (expected oci:// or git://): %s", sourceURL)
+}
+
+// generateOCIRepository creates an OCIRepository resource
+func generateOCIRepository(name, repoURL, digest string) (*unstructured.Unstructured, error) {
+	obj := &unstructured.Unstructured{}
+	obj.SetAPIVersion("source.toolkit.fluxcd.io/v1")
+	obj.SetKind("OCIRepository")
+	obj.SetName(name)
+	obj.SetNamespace("cozy-system")
+
+	spec := map[string]interface{}{
+		"interval": "5m0s",
+		"url":      repoURL,
+	}
+
+	if digest != "" {
+		// Ensure digest starts with sha256:
+		if !strings.HasPrefix(digest, "sha256:") {
+			digest = "sha256:" + digest
+		}
+		spec["ref"] = map[string]interface{}{
+			"digest": digest,
+		}
+	}
+
+	if err := unstructured.SetNestedField(obj.Object, spec, "spec"); err != nil {
+		return nil, fmt.Errorf("failed to set spec: %w", err)
+	}
+
+	return obj, nil
+}
+
+// generateGitRepository creates a GitRepository resource
+func generateGitRepository(name, repoURL, ref string) (*unstructured.Unstructured, error) {
+	obj := &unstructured.Unstructured{}
+	obj.SetAPIVersion("source.toolkit.fluxcd.io/v1")
+	obj.SetKind("GitRepository")
+	obj.SetName(name)
+	obj.SetNamespace("cozy-system")
+
+	spec := map[string]interface{}{
+		"interval": "5m0s",
+		"url":      repoURL,
+		"ref": map[string]interface{}{
+			"branch": ref,
+		},
+	}
+
+	if err := unstructured.SetNestedField(obj.Object, spec, "spec"); err != nil {
+		return nil, fmt.Errorf("failed to set spec: %w", err)
+	}
+
+	return obj, nil
+}

docs/changelogs/v0.38.2.md

@@ -0,0 +1,13 @@
+
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v0.38.2
+-->
+
+## Fixes
+
+* **[api] Revert dynamic list kinds representation fix (fixes namespace deletion regression)**: Reverted changes from #1630 that caused a regression affecting namespace deletion and upgrades from previous versions. The regression caused namespace deletion failures with errors like "content is not a list: []unstructured.Unstructured" during namespace finalization. This revert restores compatibility with namespace deletion controller and fixes upgrade issues from previous versions, particularly when running migration 20 ([**@kvaps**](https://github.com/kvaps) in #1677).
+
+---
+
+**Full Changelog**: [v0.38.1...v0.38.2](https://github.com/cozystack/cozystack/compare/v0.38.1...v0.38.2)
+

examples/desired-backup.yaml

@@ -1,20 +0,0 @@
-apiVersion: backups.cozystack.io/v1alpha1
-kind: BackupJob
-metadata:
-  name: desired-backup
-  namespace: tenant-root
-  labels:
-    backups.cozystack.io/triggered-by: manual
-spec:
-  applicationRef:
-    apiGroup: apps.cozystack.io
-    kind: VirtualMachine
-    name: vm1
-  storageRef:
-    apiGroup: apps.cozystack.io
-    kind: Bucket
-    name: test-bucket
-  strategyRef:
-    apiGroup: strategy.backups.cozystack.io
-    kind: Velero
-    name: velero-strategy-default

go.mod

@@ -2,24 +2,24 @@
 
 module github.com/cozystack/cozystack
 
-go 1.24.0
-
-toolchain go1.24.5
+go 1.25.0
 
 require (
-	github.com/fluxcd/helm-controller/api v1.1.0
+	github.com/emicklei/dot v1.10.0
+	github.com/fluxcd/helm-controller/api v1.4.3
+	github.com/fluxcd/source-controller/api v1.6.2
+	github.com/fluxcd/source-watcher/api/v2 v2.0.2
 	github.com/go-logr/logr v1.4.3
 	github.com/go-logr/zapr v1.3.0
 	github.com/google/gofuzz v1.2.0
-	github.com/onsi/ginkgo/v2 v2.22.0
-	github.com/onsi/gomega v1.36.1
+	github.com/onsi/ginkgo/v2 v2.23.3
+	github.com/onsi/gomega v1.37.0
 	github.com/prometheus/client_golang v1.22.0
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/spf13/cobra v1.9.1
-	github.com/stretchr/testify v1.10.0
-	github.com/vmware-tanzu/velero v1.17.1
 	go.uber.org/zap v1.27.0
 	gopkg.in/yaml.v2 v2.4.0
+	gopkg.in/yaml.v3 v3.0.1
 	k8s.io/api v0.34.1
 	k8s.io/apiextensions-apiserver v0.34.1
 	k8s.io/apimachinery v0.34.1
@@ -28,9 +28,9 @@ require (
 	k8s.io/component-base v0.34.1
 	k8s.io/klog/v2 v2.130.1
 	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b
-	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397
-	sigs.k8s.io/controller-runtime v0.22.4
-	sigs.k8s.io/structured-merge-diff/v4 v4.6.0
+	k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d
+	sigs.k8s.io/controller-runtime v0.22.2
+	sigs.k8s.io/structured-merge-diff/v4 v4.7.0
 )
 
 require (
@@ -45,15 +45,17 @@ require (
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
+	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fluxcd/pkg/apis/kustomize v1.6.1 // indirect
-	github.com/fluxcd/pkg/apis/meta v1.6.1 // indirect
+	github.com/fluxcd/pkg/apis/acl v0.9.0 // indirect
+	github.com/fluxcd/pkg/apis/kustomize v1.13.0 // indirect
+	github.com/fluxcd/pkg/apis/meta v1.22.0 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
-	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
@@ -62,7 +64,7 @@ require (
 	github.com/google/cel-go v0.26.0 // indirect
 	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db // indirect
+	github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
@@ -71,7 +73,7 @@ require (
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/moby/spdystream v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
@@ -79,54 +81,53 @@ require (
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.65.0 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/common v0.62.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/spf13/pflag v1.0.7 // indirect
 	github.com/stoewer/go-strcase v1.3.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.etcd.io/etcd/api/v3 v3.6.4 // indirect
 	go.etcd.io/etcd/client/pkg/v3 v3.6.4 // indirect
 	go.etcd.io/etcd/client/v3 v3.6.4 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
-	go.opentelemetry.io/otel v1.37.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
+	go.opentelemetry.io/otel v1.35.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 // indirect
-	go.opentelemetry.io/otel/metric v1.37.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
-	go.opentelemetry.io/otel/trace v1.37.0 // indirect
+	go.opentelemetry.io/otel/metric v1.35.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.34.0 // indirect
+	go.opentelemetry.io/otel/trace v1.35.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.40.0 // indirect
+	golang.org/x/crypto v0.42.0 // indirect
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
-	golang.org/x/net v0.42.0 // indirect
-	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/sync v0.16.0 // indirect
-	golang.org/x/sys v0.34.0 // indirect
-	golang.org/x/term v0.33.0 // indirect
-	golang.org/x/text v0.27.0 // indirect
-	golang.org/x/time v0.12.0 // indirect
-	golang.org/x/tools v0.34.0 // indirect
+	golang.org/x/net v0.45.0 // indirect
+	golang.org/x/oauth2 v0.29.0 // indirect
+	golang.org/x/sync v0.17.0 // indirect
+	golang.org/x/sys v0.36.0 // indirect
+	golang.org/x/term v0.35.0 // indirect
+	golang.org/x/text v0.29.0 // indirect
+	golang.org/x/time v0.11.0 // indirect
+	golang.org/x/tools v0.37.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
-	google.golang.org/grpc v1.73.0 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb // indirect
+	google.golang.org/grpc v1.72.1 // indirect
+	google.golang.org/protobuf v1.36.5 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/kms v0.34.1 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
-	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
 
 // See: issues.k8s.io/135537
-//replace k8s.io/apimachinery => github.com/cozystack/apimachinery v0.0.0-20251201201312-18e522a87614
+replace k8s.io/apimachinery => github.com/cozystack/apimachinery v0.0.0-20251219010959-1f91eabae46c

go.sum

@@ -18,28 +18,37 @@ github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
 github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/cozystack/apimachinery v0.0.0-20251219010959-1f91eabae46c h1:C2wIfH/OzhU9XOK/e6Ik9cg7nZ1z6fN4lf6a3yFdik8=
+github.com/cozystack/apimachinery v0.0.0-20251219010959-1f91eabae46c/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/emicklei/dot v1.10.0 h1:z17n0ce/FBMz3QbShSzVGhiW447Qhu7fljzvp3Gs6ig=
+github.com/emicklei/dot v1.10.0/go.mod h1:DeV7GvQtIw4h2u73RKBkkFdvVAz0D9fzeJrgPW6gy/s=
 github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
 github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/evanphx/json-patch v0.5.2 h1:xVCHIVMUu1wtM/VkR9jVZ45N3FhZfYMMYGorLCR8P3k=
-github.com/evanphx/json-patch v0.5.2/go.mod h1:ZWS5hhDbVDyob71nXKNL0+PWn6ToqBHMikGIFbs31qQ=
+github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH5pOlLGNtQ5lPWQu84=
+github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
 github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/fluxcd/helm-controller/api v1.1.0 h1:NS5Wm3U6Kv4w7Cw2sDOV++vf2ecGfFV00x1+2Y3QcOY=
-github.com/fluxcd/helm-controller/api v1.1.0/go.mod h1:BgHMgMY6CWynzl4KIbHpd6Wpn3FN9BqgkwmvoKCp6iE=
-github.com/fluxcd/pkg/apis/kustomize v1.6.1 h1:22FJc69Mq4i8aCxnKPlddHhSMyI4UPkQkqiAdWFcqe0=
-github.com/fluxcd/pkg/apis/kustomize v1.6.1/go.mod h1:5dvQ4IZwz0hMGmuj8tTWGtarsuxW0rWsxJOwC6i+0V8=
-github.com/fluxcd/pkg/apis/meta v1.6.1 h1:maLhcRJ3P/70ArLCY/LF/YovkxXbX+6sTWZwZQBeNq0=
-github.com/fluxcd/pkg/apis/meta v1.6.1/go.mod h1:YndB/gxgGZmKfqpAfFxyCDNFJFP0ikpeJzs66jwq280=
+github.com/fluxcd/helm-controller/api v1.4.3 h1:CdZwjL1liXmYCWyk2jscmFEB59tICIlnWB9PfDDW5q4=
+github.com/fluxcd/helm-controller/api v1.4.3/go.mod h1:0XrBhKEaqvxyDj/FziG1Q8Fmx2UATdaqLgYqmZh6wW4=
+github.com/fluxcd/pkg/apis/acl v0.9.0 h1:wBpgsKT+jcyZEcM//OmZr9RiF8klL3ebrDp2u2ThsnA=
+github.com/fluxcd/pkg/apis/acl v0.9.0/go.mod h1:TttNS+gocsGLwnvmgVi3/Yscwqrjc17+vhgYfqkfrV4=
+github.com/fluxcd/pkg/apis/kustomize v1.13.0 h1:GGf0UBVRIku+gebY944icVeEIhyg1P/KE3IrhOyJJnE=
+github.com/fluxcd/pkg/apis/kustomize v1.13.0/go.mod h1:TLKVqbtnzkhDuhWnAsN35977HvRfIjs+lgMuNro/LEc=
+github.com/fluxcd/pkg/apis/meta v1.22.0 h1:EHWQH5ZWml7i8eZ/AMjm1jxid3j/PQ31p+hIwCt6crM=
+github.com/fluxcd/pkg/apis/meta v1.22.0/go.mod h1:Kc1+bWe5p0doROzuV9XiTfV/oL3ddsemYXt8ZYWdVVg=
+github.com/fluxcd/source-controller/api v1.6.2 h1:UmodAeqLIeF29HdTqf2GiacZyO+hJydJlepDaYsMvhc=
+github.com/fluxcd/source-controller/api v1.6.2/go.mod h1:ZJcAi0nemsnBxjVgmJl0WQzNvB0rMETxQMTdoFosmMw=
+github.com/fluxcd/source-watcher/api/v2 v2.0.2 h1:fWSxsDqYN7My2AEpQwbP7O6Qjix8nGBX+UE/qWHtZfM=
+github.com/fluxcd/source-watcher/api/v2 v2.0.2/go.mod h1:Hs6ueayPt23jlkIr/d1pGPZ+OHiibQwWjxvU6xqljzg=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
@@ -51,12 +60,10 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
 github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
-github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
 github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
 github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
-github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
-github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
-github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
+github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
 github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
 github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
@@ -80,8 +87,8 @@ github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
+github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad h1:a6HEuzUHeKH6hwfN/ZoQgRgVIWFJljSWa/zetS2WTvg=
+github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
@@ -106,17 +113,14 @@ github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
-github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
+github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
 github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
 github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -129,10 +133,10 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
-github.com/onsi/ginkgo/v2 v2.22.0 h1:Yed107/8DjTr0lKCNt7Dn8yQ6ybuDRQoMGrNFKzMfHg=
-github.com/onsi/ginkgo/v2 v2.22.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
-github.com/onsi/gomega v1.36.1 h1:bJDPBO7ibjxcbHMgSCoo4Yj18UWbKDlLwX1x9sybDcw=
-github.com/onsi/gomega v1.36.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
+github.com/onsi/ginkgo/v2 v2.23.3 h1:edHxnszytJ4lD9D5Jjc4tiDkPBZ3siDeJJkUZJJVkp0=
+github.com/onsi/ginkgo/v2 v2.23.3/go.mod h1:zXTP6xIp3U8aVuXN8ENK9IXRaTjFnpVB9mGmaSRvxnM=
+github.com/onsi/gomega v1.37.0 h1:CdEG8g0S133B4OswTDC/5XPSzE1OeP29QOioj2PID2Y=
+github.com/onsi/gomega v1.37.0/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -140,10 +144,10 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
 github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
-github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
-github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
-github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
+github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
+github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
+github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
+github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
 github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
@@ -157,8 +161,9 @@ github.com/soheilhy/cmux v0.1.5 h1:jjzc5WVemNEDTLwv9tlmemhC73tI08BNOIGwBOo10Js=
 github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
 github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
 github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
+github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stoewer/go-strcase v1.3.0 h1:g0eASXYtp+yvN9fK8sH94oCIk0fau9uV1/ZdJ0AVEzs=
 github.com/stoewer/go-strcase v1.3.0/go.mod h1:fAH5hQ5pehh+j3nZfvwdk2RgEgQjAoM8wodgtPmh1xo=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -170,12 +175,10 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75 h1:6fotK7otjonDflCTK0BCfls4SPy3NcCVb5dqqmbRknE=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75/go.mod h1:KO6IkyS8Y3j8OdNO85qEYBsRPuteD+YciPomcXdrMnk=
-github.com/vmware-tanzu/velero v1.17.1 h1:ldKeiTuUwkThOw7zrUucNA1NwnLG66zl13YetWAoE0I=
-github.com/vmware-tanzu/velero v1.17.1/go.mod h1:3KTxuUN6Un38JzmYAX+8U6j2k6EexGoNNxa8jrJML8U=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xiang90/probing v0.0.0-20221125231312-a49e3df8f510 h1:S2dVYn90KE98chqDkyE9Z4N61UnQd+KOfgp5Iu53llk=
@@ -198,24 +201,24 @@ go.etcd.io/raft/v3 v3.6.0 h1:5NtvbDVYpnfZWcIHgGRk9DyzkBIXOi8j+DDp1IcnUWQ=
 go.etcd.io/raft/v3 v3.6.0/go.mod h1:nLvLevg6+xrVtHUmVaTcTz603gQPHfh7kUAwV6YpfGo=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
-go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
-go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 h1:x7wzEgXfnzJcHDwStJT+mxOz4etr2EcexjqhBvmoakw=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0/go.mod h1:rg+RlpR5dKwaS95IyyZqj5Wd4E13lk/msnTS0Xl9lJM=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 h1:yd02MEjBdJkG3uabWP9apV+OuWRIXGDuJEUJbOHmCFU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0/go.mod h1:umTcuxiv1n/s/S6/c2AT/g2CQ7u5C59sHDNmfSwgz7Q=
+go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
+go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 h1:OeNbIYk/2C15ckl7glBlOBp5+WlYsOElzTNmiPW/x60=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0/go.mod h1:7Bept48yIeqxP2OZ9/AqIpYS94h2or0aB4FypJTc8ZM=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 h1:tgJ0uaNS4c98WRNUEx5U3aDlrDOI5Rs+1Vifcw4DJ8U=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0/go.mod h1:U7HYyW0zt/a9x5J1Kjs+r1f/d4ZHnYFclhYY2+YbeoE=
-go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
-go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
-go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
-go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
-go.opentelemetry.io/otel/sdk/metric v1.36.0 h1:r0ntwwGosWGaa0CrSt8cuNuTcccMXERFwHX4dThiPis=
-go.opentelemetry.io/otel/sdk/metric v1.36.0/go.mod h1:qTNOhFDfKRwX0yXOqJYegL5WRaW376QbB7P4Pb0qva4=
-go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
-go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
+go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
+go.opentelemetry.io/otel/sdk v1.34.0 h1:95zS4k/2GOy069d321O8jWgYsW3MzVV+KuSPKp7Wr1A=
+go.opentelemetry.io/otel/sdk v1.34.0/go.mod h1:0e/pNiaMAqaykJGKbi+tSjWfNNHMTxoC9qANsCzbyxU=
+go.opentelemetry.io/otel/sdk/metric v1.34.0 h1:5CeK9ujjbFVL5c1PhLuStg1wxA7vQv7ce1EK0Gyvahk=
+go.opentelemetry.io/otel/sdk/metric v1.34.0/go.mod h1:jQ/r8Ze28zRKoNRdkjCZxfs6YvBTG1+YIqyFVFYec5w=
+go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
+go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
 go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
 go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
@@ -231,8 +234,8 @@ go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
-golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
+golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -241,48 +244,48 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
-golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
-golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
-golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
+golang.org/x/net v0.45.0 h1:RLBg5JKixCy82FtLJpeNlVM0nrSqpCRYzVU1n8kj0tM=
+golang.org/x/net v0.45.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
+golang.org/x/oauth2 v0.29.0 h1:WdYw2tdTK1S8olAzWHdgeqfy+Mtm9XNhv/xJsY65d98=
+golang.org/x/oauth2 v0.29.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
-golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
-golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.33.0 h1:NuFncQrRcaRvVmgRkvM3j/F00gWIAlcmlB8ACEKmGIg=
-golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0=
+golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
+golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ=
+golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
-golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
-golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
-golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
+golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
+golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
+golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
-golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
+golang.org/x/tools v0.37.0 h1:DVSRzp7FwePZW356yEAChSdNcQo6Nsp+fex1SUW09lE=
+golang.org/x/tools v0.37.0/go.mod h1:MBN5QPQtLMHVdvsbtarmTNukZDdgwdwlO5qGacAzF0w=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
 gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
-google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 h1:oWVWY3NzT7KJppx2UKhKmzPq4SRe0LdCijVRwvGeikY=
-google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822/go.mod h1:h3c4v36UTKzUiuaOKQ6gr3S+0hovBtUrXzTG/i3+XEc=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 h1:fc6jSaCT0vBduLYZHYrBBNY4dsWuvgyff9noRNDdBeE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
-google.golang.org/grpc v1.73.0 h1:VIWSmpI2MegBtTuFt5/JWy2oXxtjJ/e89Z70ImfD2ok=
-google.golang.org/grpc v1.73.0/go.mod h1:50sbHOUqWoCQGI8V2HQLJM0B+LMlIUjNSZmow7EVBQc=
-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb h1:p31xT4yrYrSM/G4Sn2+TNUkVhFCbG9y8itM2S6Th950=
+google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:jbe3Bkdp+Dh2IrslsFCklNhweNTBgSYanP1UXhJDhKg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb h1:TLPQVbx1GJ8VKZxz52VAxl1EBgKXXbTiU9Fc5fZeLn4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:LuRYeWDFV6WOn90g357N17oMCaxpgCnbi/44qJvDn2I=
+google.golang.org/grpc v1.72.1 h1:HR03wO6eyZ7lknl75XlxABNVLLFc2PAb6mHlYh756mA=
+google.golang.org/grpc v1.72.1/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
+google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
+google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -301,8 +304,6 @@ k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
 k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
 k8s.io/apiextensions-apiserver v0.34.1 h1:NNPBva8FNAPt1iSVwIE0FsdrVriRXMsaWFMqJbII2CI=
 k8s.io/apiextensions-apiserver v0.34.1/go.mod h1:hP9Rld3zF5Ay2Of3BeEpLAToP+l4s5UlxiHfqRaRcMc=
-k8s.io/apimachinery v0.34.1 h1:dTlxFls/eikpJxmAC7MVE8oOeP1zryV7iRyIjB0gky4=
-k8s.io/apimachinery v0.34.1/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
 k8s.io/apiserver v0.34.1 h1:U3JBGdgANK3dfFcyknWde1G6X1F4bg7PXuvlqt8lITA=
 k8s.io/apiserver v0.34.1/go.mod h1:eOOc9nrVqlBI1AFCvVzsob0OxtPZUCPiUJL45JOTBG0=
 k8s.io/client-go v0.34.1 h1:ZUPJKgXsnKwVwmKKdPfw4tB58+7/Ik3CrjOEhsiZ7mY=
@@ -315,19 +316,19 @@ k8s.io/kms v0.34.1 h1:iCFOvewDPzWM9fMTfyIPO+4MeuZ0tcZbugxLNSHFG4w=
 k8s.io/kms v0.34.1/go.mod h1:s1CFkLG7w9eaTYvctOxosx88fl4spqmixnNpys0JAtM=
 k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b h1:MloQ9/bdJyIu9lb1PzujOPolHyvO06MXG5TUIj2mNAA=
 k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b/go.mod h1:UZ2yyWbFTpuhSbFhv24aGNOdoRdJZgsIObGBUaYVsts=
-k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
-k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d h1:wAhiDyZ4Tdtt7e46e9M5ZSAJ/MnPGPs+Ki1gHw4w1R0=
+k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 h1:jpcvIRr3GLoUoEKRkHKSmGjxb6lWwrBlJsXc+eUYQHM=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
-sigs.k8s.io/controller-runtime v0.22.4 h1:GEjV7KV3TY8e+tJ2LCTxUTanW4z/FmNB7l327UfMq9A=
-sigs.k8s.io/controller-runtime v0.22.4/go.mod h1:+QX1XUpTXN4mLoblf4tqr5CQcyHPAki2HLXqQMY6vh8=
-sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
-sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/controller-runtime v0.22.2 h1:cK2l8BGWsSWkXz09tcS4rJh95iOLney5eawcK5A33r4=
+sigs.k8s.io/controller-runtime v0.22.2/go.mod h1:+QX1XUpTXN4mLoblf4tqr5CQcyHPAki2HLXqQMY6vh8=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v4 v4.6.0 h1:IUA9nvMmnKWcj5jl84xn+T5MnlZKThmUW1TdblaLVAc=
-sigs.k8s.io/structured-merge-diff/v4 v4.6.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
+sigs.k8s.io/structured-merge-diff/v4 v4.7.0 h1:qPeWmscJcXP0snki5IYF79Z8xrl8ETFxgMd7wez1XkI=
+sigs.k8s.io/structured-merge-diff/v4 v4.7.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
 sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
 sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=

hack/e2e-apps/backup.bats.disabled

@@ -1,226 +0,0 @@
-#!/usr/bin/env bats
-
-# Test variables - stored for teardown
-TEST_NAMESPACE='tenant-test'
-TEST_BUCKET_NAME='test-backup-bucket'
-TEST_VM_NAME='test-backup-vm'
-TEST_BACKUPJOB_NAME='test-backup-job'
-
-teardown() {
-  # Clean up resources (runs even if test fails)
-  namespace="${TEST_NAMESPACE}"
-  bucket_name="${TEST_BUCKET_NAME}"
-  vm_name="${TEST_VM_NAME}"
-  backupjob_name="${TEST_BACKUPJOB_NAME}"
-  
-  # Clean up port-forward if still running
-  pkill -f "kubectl.*port-forward.*seaweedfs-s3" 2>/dev/null || true
-  
-  # Clean up Velero resources in cozy-velero namespace
-  # Find Velero backup by pattern matching namespace-backupjob
-  for backup in $(kubectl -n cozy-velero get backups.velero.io -o jsonpath='{.items[*].metadata.name}' 2>/dev/null || true); do
-    if echo "$backup" | grep -q "^${namespace}-${backupjob_name}-"; then
-      kubectl -n cozy-velero delete backups.velero.io ${backup} --wait=false 2>/dev/null || true
-    fi
-  done
-  
-  # Clean up BackupStorageLocation and VolumeSnapshotLocation (named: namespace-backupjob)
-  BSL_NAME="${namespace}-${backupjob_name}"
-  kubectl -n cozy-velero delete backupstoragelocations.velero.io ${BSL_NAME} --wait=false 2>/dev/null || true
-  kubectl -n cozy-velero delete volumesnapshotlocations.velero.io ${BSL_NAME} --wait=false 2>/dev/null || true
-  
-  # Clean up Velero credentials secret
-  SECRET_NAME="backup-${namespace}-${backupjob_name}-s3-credentials"
-  kubectl -n cozy-velero delete secret ${SECRET_NAME} --wait=false 2>/dev/null || true
-  
-  # Clean up BackupJob
-  kubectl -n ${namespace} delete backupjob ${backupjob_name} --wait=false 2>/dev/null || true
-  
-  # Clean up Virtual Machine
-  kubectl -n ${namespace} delete virtualmachines.apps.cozystack.io ${vm_name} --wait=false 2>/dev/null || true
-  
-  # Clean up Bucket
-  kubectl -n ${namespace} delete bucket.apps.cozystack.io ${bucket_name} --wait=false 2>/dev/null || true
-
-  # Clean up temporary files
-  rm -f /tmp/bucket-backup-credentials.json
-}
-
-print_log() {
-  echo "# $1" >&3
-}
-
-@test "Create Backup for Virtual Machine" {
-  # Test variables
-  bucket_name="${TEST_BUCKET_NAME}"
-  vm_name="${TEST_VM_NAME}"
-  backupjob_name="${TEST_BACKUPJOB_NAME}"
-  namespace="${TEST_NAMESPACE}"
-
-  print_log "Step 0:Ensure BackupJob and Velero strategy CRDs are installed"
-  kubectl apply -f packages/system/backup-controller/definitions/backups.cozystack.io_backupjobs.yaml
-  kubectl apply -f packages/system/backupstrategy-controller/definitions/strategy.backups.cozystack.io_veleroes.yaml
-  # Wait for CRDs to be ready
-  kubectl wait --for condition=established --timeout=30s crd backupjobs.backups.cozystack.io
-  kubectl wait --for condition=established --timeout=30s crd veleroes.strategy.backups.cozystack.io
-  
-  # Ensure velero-strategy-default resource exists
-  kubectl apply -f packages/system/backup-controller/templates/strategy.yaml
-
-  print_log "Step 1: Create the bucket resource"
-  kubectl apply -f - <<EOF
-apiVersion: apps.cozystack.io/v1alpha1
-kind: Bucket
-metadata:
-  name: ${bucket_name}
-  namespace: ${namespace}
-spec: {}
-EOF
-
-  print_log "Wait for the bucket to be ready"
-  kubectl -n ${namespace} wait hr bucket-${bucket_name} --timeout=100s --for=condition=ready
-  kubectl -n ${namespace} wait bucketclaims.objectstorage.k8s.io bucket-${bucket_name} --timeout=300s --for=jsonpath='{.status.bucketReady}'=true
-  kubectl -n ${namespace} wait bucketaccesses.objectstorage.k8s.io bucket-${bucket_name} --timeout=300s --for=jsonpath='{.status.accessGranted}'=true
-
-  # Get bucket credentials for later S3 verification
-  kubectl -n ${namespace} get secret bucket-${bucket_name} -ojsonpath='{.data.BucketInfo}' | base64 -d > /tmp/bucket-backup-credentials.json
-  ACCESS_KEY=$(jq -r '.spec.secretS3.accessKeyID' /tmp/bucket-backup-credentials.json)
-  SECRET_KEY=$(jq -r '.spec.secretS3.accessSecretKey' /tmp/bucket-backup-credentials.json)
-  BUCKET_NAME=$(jq -r '.spec.bucketName' /tmp/bucket-backup-credentials.json)
-
-  print_log "Step 2: Create the Virtual Machine"
-  kubectl apply -f - <<EOF
-apiVersion: apps.cozystack.io/v1alpha1
-kind: VirtualMachine
-metadata:
-  name: ${vm_name}
-  namespace: ${namespace}
-spec:
-  external: false
-  externalMethod: PortList
-  externalPorts:
-  - 22
-  instanceType: "u1.medium"
-  instanceProfile: ubuntu
-  systemDisk:
-    image: ubuntu
-    storage: 5Gi
-    storageClass: replicated
-  gpus: []
-  resources: {}
-  sshKeys:
-  - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPht0dPk5qQ+54g1hSX7A6AUxXJW5T6n/3d7Ga2F8gTF
-    test@test
-  cloudInit: |
-    #cloud-config
-    users:
-      - name: test
-        shell: /bin/bash
-        sudo: ['ALL=(ALL) NOPASSWD: ALL']
-        groups: sudo
-        ssh_authorized_keys:
-          - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPht0dPk5qQ+54g1hSX7A6AUxXJW5T6n/3d7Ga2F8gTF test@test
-  cloudInitSeed: ""
-EOF
-
-  print_log "Wait for VM to be ready"
-  sleep 5
-  kubectl -n ${namespace} wait hr virtual-machine-${vm_name} --timeout=10s --for=condition=ready
-  kubectl -n ${namespace} wait dv virtual-machine-${vm_name} --timeout=150s --for=condition=ready
-  kubectl -n ${namespace} wait pvc virtual-machine-${vm_name} --timeout=100s --for=jsonpath='{.status.phase}'=Bound
-  kubectl -n ${namespace} wait vm virtual-machine-${vm_name} --timeout=100s --for=condition=ready
-
-  print_log "Step 3: Create BackupJob"
-  kubectl apply -f - <<EOF
-apiVersion: backups.cozystack.io/v1alpha1
-kind: BackupJob
-metadata:
-  name: ${backupjob_name}
-  namespace: ${namespace}
-  labels:
-    backups.cozystack.io/triggered-by: e2e-test
-spec:
-  applicationRef:
-    apiGroup: apps.cozystack.io
-    kind: VirtualMachine
-    name: ${vm_name}
-  storageRef:
-    apiGroup: apps.cozystack.io
-    kind: Bucket
-    name: ${bucket_name}
-  strategyRef:
-    apiGroup: strategy.backups.cozystack.io
-    kind: Velero
-    name: velero-strategy-default
-EOF
-
-  print_log "Wait for BackupJob to start"
-  kubectl -n ${namespace} wait backupjob ${backupjob_name} --timeout=60s --for=jsonpath='{.status.phase}'=Running
-
-  print_log "Wait for BackupJob to complete"
-  kubectl -n ${namespace} wait backupjob ${backupjob_name} --timeout=300s --for=jsonpath='{.status.phase}'=Succeeded
-
-  print_log "Verify BackupJob status"
-  PHASE=$(kubectl -n ${namespace} get backupjob ${backupjob_name} -o jsonpath='{.status.phase}')
-  [ "$PHASE" = "Succeeded" ]
-
-  # Verify BackupJob has a backupRef
-  BACKUP_REF=$(kubectl -n ${namespace} get backupjob ${backupjob_name} -o jsonpath='{.status.backupRef.name}')
-  [ -n "$BACKUP_REF" ]
-
-  # Find the Velero backup by searching for backups matching the namespace-backupjob pattern
-  # Format: namespace-backupjob-timestamp
-  VELERO_BACKUP_NAME=""
-  VELERO_BACKUP_PHASE=""
-  
-  print_log "Wait a bit for the backup to be created and appear in the API"
-  sleep 30
-  
-  # Find backup by pattern matching namespace-backupjob
-  for backup in $(kubectl -n cozy-velero get backups.velero.io -o jsonpath='{.items[*].metadata.name}' 2>/dev/null); do
-    if echo "$backup" | grep -q "^${namespace}-${backupjob_name}-"; then
-      VELERO_BACKUP_NAME=$backup
-      VELERO_BACKUP_PHASE=$(kubectl -n cozy-velero get backups.velero.io $backup -o jsonpath='{.status.phase}' 2>/dev/null || echo "")
-      break
-    fi
-  done
-
-  print_log "Verify Velero Backup was found"
-  [ -n "$VELERO_BACKUP_NAME" ]
-  
-  echo '# Wait for Velero Backup to complete' >&3
-  until kubectl -n cozy-velero get backups.velero.io ${VELERO_BACKUP_NAME} -o jsonpath='{.status.phase}' | grep -q 'Completed\|Failed'; do
-    sleep 5
-  done
-
-  print_log "Verify Velero Backup is Completed"
-  timeout 90 sh -ec "until [ \"\$(kubectl -n cozy-velero get backups.velero.io ${VELERO_BACKUP_NAME} -o jsonpath='{.status.phase}' 2>/dev/null)\" = \"Completed\" ]; do sleep 30; done"
-  
-  # Final verification
-  VELERO_BACKUP_PHASE=$(kubectl -n cozy-velero get backups.velero.io ${VELERO_BACKUP_NAME} -o jsonpath='{.status.phase}' 2>/dev/null || echo "")
-  [ "$VELERO_BACKUP_PHASE" = "Completed" ]
-
-  print_log "Step 4: Verify S3 has backup data"
-  # Start port-forwarding to S3 service (with timeout to keep it alive)
-  bash -c 'timeout 100s kubectl port-forward service/seaweedfs-s3 -n tenant-root 8333:8333 > /dev/null 2>&1 &'
-
-  # Wait for port-forward to be ready
-  timeout 30 sh -ec "until nc -z localhost 8333; do sleep 1; done"
-
-  # Wait a bit for backup data to be written to S3
-  sleep 30
-  
-  # Set up MinIO client with insecure flag (use environment variable for all commands)
-  export MC_INSECURE=1
-  mc alias set local https://localhost:8333 $ACCESS_KEY $SECRET_KEY
-
-  # Verify backup directory exists in S3
-  BACKUP_PATH="${BUCKET_NAME}/backups/${VELERO_BACKUP_NAME}"
-  mc ls local/${BACKUP_PATH}/ 2>/dev/null
-  [ $? -eq 0 ]
-  
-  # Verify backup files exist (at least metadata files)
-  BACKUP_FILES=$(mc ls local/${BACKUP_PATH}/ 2>/dev/null | wc -l || echo "0")
-  [ "$BACKUP_FILES" -gt "0" ]
-}
-

hack/update-codegen.sh

@@ -24,6 +24,8 @@ API_KNOWN_VIOLATIONS_DIR="${API_KNOWN_VIOLATIONS_DIR:-"${SCRIPT_ROOT}/api/api-ru
 UPDATE_API_KNOWN_VIOLATIONS="${UPDATE_API_KNOWN_VIOLATIONS:-true}"
 CONTROLLER_GEN="go run sigs.k8s.io/controller-tools/cmd/controller-gen@v0.16.4"
 TMPDIR=$(mktemp -d)
+OPERATOR_CRDDIR=packages/core/installer/crds
+BACKUPSTRATEGY_CRDDIR=packages/system/backupstrategy-controller/definitions
 COZY_CONTROLLER_CRDDIR=packages/system/cozystack-controller/crds
 COZY_RD_CRDDIR=packages/system/cozystack-resource-definition-crd/definition
 BACKUPS_CORE_CRDDIR=packages/system/backup-controller/definitions
@@ -62,6 +64,9 @@ kube::codegen::gen_openapi \
 $CONTROLLER_GEN object:headerFile="hack/boilerplate.go.txt" paths="./api/..."
 $CONTROLLER_GEN rbac:roleName=manager-role crd paths="./api/..." output:crd:artifacts:config=${TMPDIR} 
 
+mv ${TMPDIR}/cozystack.io_packages.yaml ${OPERATOR_CRDDIR}/cozystack.io_packages.yaml
+mv ${TMPDIR}/cozystack.io_packagesources.yaml ${OPERATOR_CRDDIR}/cozystack.io_packagesources.yaml
+
 mv ${TMPDIR}/cozystack.io_cozystackresourcedefinitions.yaml \
         ${COZY_RD_CRDDIR}/cozystack.io_cozystackresourcedefinitions.yaml
 

internal/backupcontroller/backupjob_controller.go

@@ -1,111 +0,0 @@
-package backupcontroller
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/api/meta"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/client-go/dynamic"
-	"k8s.io/client-go/rest"
-	"k8s.io/client-go/tools/record"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/client/apiutil"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-
-	strategyv1alpha1 "github.com/cozystack/cozystack/api/backups/strategy/v1alpha1"
-	backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1"
-)
-
-// BackupVeleroStrategyReconciler reconciles BackupJob with a strategy referencing
-// Velero.strategy.backups.cozystack.io objects.
-type BackupJobReconciler struct {
-	client.Client
-	dynamic.Interface
-	meta.RESTMapper
-	Scheme   *runtime.Scheme
-	Recorder record.EventRecorder
-}
-
-func (r *BackupJobReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
-	logger := log.FromContext(ctx)
-	logger.Info("reconciling BackupJob", "namespace", req.Namespace, "name", req.Name)
-
-	j := &backupsv1alpha1.BackupJob{}
-	err := r.Get(ctx, types.NamespacedName{Namespace: req.Namespace, Name: req.Name}, j)
-	if err != nil {
-		if apierrors.IsNotFound(err) {
-			logger.V(1).Info("BackupJob not found, skipping")
-			return ctrl.Result{}, nil
-		}
-		logger.Error(err, "failed to get BackupJob")
-		return ctrl.Result{}, err
-	}
-
-	if j.Spec.StrategyRef.APIGroup == nil {
-		return r.markBackupJobFailed(ctx, j, "StrategyRef.APIGroup is nil")
-	}
-
-	if *j.Spec.StrategyRef.APIGroup != strategyv1alpha1.GroupVersion.Group {
-		// skip if the strategy group foreign to this controller
-		return ctrl.Result{}, nil
-	}
-
-	logger.Info("processing BackupJob", "backupjob", j.Name, "strategyKind", j.Spec.StrategyRef.Kind)
-	switch j.Spec.StrategyRef.Kind {
-	case strategyv1alpha1.JobStrategyKind:
-		return r.reconcileJob(ctx, j)
-	case strategyv1alpha1.VeleroStrategyKind:
-		return r.reconcileVelero(ctx, j)
-	default:
-		return r.markBackupJobFailed(ctx, j, fmt.Sprintf("StrategyRef.Kind not supported: %s", j.Spec.StrategyRef.Kind))
-	}
-}
-
-// SetupWithManager registers our controller with the Manager and sets up watches.
-func (r *BackupJobReconciler) SetupWithManager(mgr ctrl.Manager) error {
-	cfg := mgr.GetConfig()
-	var err error
-	if r.Interface, err = dynamic.NewForConfig(cfg); err != nil {
-		return err
-	}
-	var h *http.Client
-	if h, err = rest.HTTPClientFor(cfg); err != nil {
-		return err
-	}
-	if r.RESTMapper, err = apiutil.NewDynamicRESTMapper(cfg, h); err != nil {
-		return err
-	}
-	return ctrl.NewControllerManagedBy(mgr).
-		For(&backupsv1alpha1.BackupJob{}).
-		Complete(r)
-}
-
-func (r *BackupJobReconciler) markBackupJobFailed(ctx context.Context, backupJob *backupsv1alpha1.BackupJob, message string) (ctrl.Result, error) {
-	logger := getLogger(ctx)
-	now := metav1.Now()
-	backupJob.Status.CompletedAt = &now
-	backupJob.Status.Phase = backupsv1alpha1.BackupJobPhaseFailed
-	backupJob.Status.Message = message
-
-	// Add condition
-	backupJob.Status.Conditions = append(backupJob.Status.Conditions, metav1.Condition{
-		Type:               "Ready",
-		Status:             metav1.ConditionFalse,
-		Reason:             "BackupFailed",
-		Message:            message,
-		LastTransitionTime: now,
-	})
-
-	if err := r.Status().Update(ctx, backupJob); err != nil {
-		logger.Error(err, "failed to update BackupJob status to Failed")
-		return ctrl.Result{}, err
-	}
-	logger.Debug("BackupJob failed", "message", message)
-	return ctrl.Result{}, nil
-}

internal/backupcontroller/jobstrategy_controller.go

@@ -3,18 +3,29 @@ package backupcontroller
 import (
 	"context"
 
+	"k8s.io/apimachinery/pkg/runtime"
 	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1"
 )
 
-func (r *BackupJobReconciler) reconcileJob(ctx context.Context, j *backupsv1alpha1.BackupJob) (ctrl.Result, error) {
+// BackupJobStrategyReconciler reconciles BackupJob with a strategy referencing
+// Job.strategy.backups.cozystack.io objects.
+type BackupJobStrategyReconciler struct {
+	client.Client
+	Scheme *runtime.Scheme
+}
+
+func (r *BackupJobStrategyReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	_ = log.FromContext(ctx)
 	return ctrl.Result{}, nil
 }
 
-func (r *RestoreJobReconciler) reconcileJobRestore(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup) (ctrl.Result, error) {
-	_ = log.FromContext(ctx)
-	return ctrl.Result{}, nil
+// SetupWithManager registers our controller with the Manager and sets up watches.
+func (r *BackupJobStrategyReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewControllerManagedBy(mgr).
+		For(&backupsv1alpha1.BackupJob{}).
+		Complete(r)
 }

internal/backupcontroller/restorejob_controller.go

@@ -1,139 +0,0 @@
-package backupcontroller
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-
-	corev1 "k8s.io/api/core/v1"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/api/meta"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/client-go/dynamic"
-	"k8s.io/client-go/rest"
-	"k8s.io/client-go/tools/record"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/client/apiutil"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-
-	strategyv1alpha1 "github.com/cozystack/cozystack/api/backups/strategy/v1alpha1"
-	backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1"
-)
-
-// RestoreJobReconciler reconciles RestoreJob objects.
-// It routes RestoreJobs to strategy-specific handlers based on the strategy
-// referenced in the Backup that the RestoreJob is restoring from.
-type RestoreJobReconciler struct {
-	client.Client
-	dynamic.Interface
-	meta.RESTMapper
-	Scheme   *runtime.Scheme
-	Recorder record.EventRecorder
-}
-
-func (r *RestoreJobReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
-	logger := log.FromContext(ctx)
-	logger.Info("reconciling RestoreJob", "namespace", req.Namespace, "name", req.Name)
-
-	restoreJob := &backupsv1alpha1.RestoreJob{}
-	err := r.Get(ctx, types.NamespacedName{Namespace: req.Namespace, Name: req.Name}, restoreJob)
-	if err != nil {
-		if apierrors.IsNotFound(err) {
-			logger.V(1).Info("RestoreJob not found, skipping")
-			return ctrl.Result{}, nil
-		}
-		logger.Error(err, "failed to get RestoreJob")
-		return ctrl.Result{}, err
-	}
-
-	// If already completed, no need to reconcile
-	if restoreJob.Status.Phase == backupsv1alpha1.RestoreJobPhaseSucceeded ||
-		restoreJob.Status.Phase == backupsv1alpha1.RestoreJobPhaseFailed {
-		logger.V(1).Info("RestoreJob already completed, skipping", "phase", restoreJob.Status.Phase)
-		return ctrl.Result{}, nil
-	}
-
-	// Step 1: Fetch the referenced Backup
-	backup := &backupsv1alpha1.Backup{}
-	backupKey := types.NamespacedName{Namespace: req.Namespace, Name: restoreJob.Spec.BackupRef.Name}
-	if err := r.Get(ctx, backupKey, backup); err != nil {
-		return r.markRestoreJobFailed(ctx, restoreJob, fmt.Sprintf("failed to get Backup: %v", err))
-	}
-
-	// Step 2: Determine effective strategy from backup.spec.strategyRef
-	if backup.Spec.StrategyRef.APIGroup == nil {
-		return r.markRestoreJobFailed(ctx, restoreJob, "Backup has nil StrategyRef.APIGroup")
-	}
-
-	if *backup.Spec.StrategyRef.APIGroup != strategyv1alpha1.GroupVersion.Group {
-		return r.markRestoreJobFailed(ctx, restoreJob,
-			fmt.Sprintf("StrategyRef.APIGroup doesn't match: %s", *backup.Spec.StrategyRef.APIGroup))
-	}
-
-	logger.Info("processing RestoreJob", "restorejob", restoreJob.Name, "backup", backup.Name, "strategyKind", backup.Spec.StrategyRef.Kind)
-	switch backup.Spec.StrategyRef.Kind {
-	case strategyv1alpha1.JobStrategyKind:
-		return r.reconcileJobRestore(ctx, restoreJob, backup)
-	case strategyv1alpha1.VeleroStrategyKind:
-		return r.reconcileVeleroRestore(ctx, restoreJob, backup)
-	default:
-		return r.markRestoreJobFailed(ctx, restoreJob, fmt.Sprintf("StrategyRef.Kind not supported: %s", backup.Spec.StrategyRef.Kind))
-	}
-}
-
-// SetupWithManager registers our controller with the Manager and sets up watches.
-func (r *RestoreJobReconciler) SetupWithManager(mgr ctrl.Manager) error {
-	cfg := mgr.GetConfig()
-	var err error
-	if r.Interface, err = dynamic.NewForConfig(cfg); err != nil {
-		return err
-	}
-	var h *http.Client
-	if h, err = rest.HTTPClientFor(cfg); err != nil {
-		return err
-	}
-	if r.RESTMapper, err = apiutil.NewDynamicRESTMapper(cfg, h); err != nil {
-		return err
-	}
-	return ctrl.NewControllerManagedBy(mgr).
-		For(&backupsv1alpha1.RestoreJob{}).
-		Complete(r)
-}
-
-// getTargetApplicationRef determines the effective target application reference.
-// According to DESIGN.md, if spec.targetApplicationRef is omitted, drivers SHOULD
-// restore into backup.spec.applicationRef.
-func (r *RestoreJobReconciler) getTargetApplicationRef(restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup) corev1.TypedLocalObjectReference {
-	if restoreJob.Spec.TargetApplicationRef != nil {
-		return *restoreJob.Spec.TargetApplicationRef
-	}
-	return backup.Spec.ApplicationRef
-}
-
-// markRestoreJobFailed updates the RestoreJob status to Failed with the given message.
-func (r *RestoreJobReconciler) markRestoreJobFailed(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, message string) (ctrl.Result, error) {
-	logger := getLogger(ctx)
-	now := metav1.Now()
-	restoreJob.Status.CompletedAt = &now
-	restoreJob.Status.Phase = backupsv1alpha1.RestoreJobPhaseFailed
-	restoreJob.Status.Message = message
-
-	// Add condition
-	restoreJob.Status.Conditions = append(restoreJob.Status.Conditions, metav1.Condition{
-		Type:               "Ready",
-		Status:             metav1.ConditionFalse,
-		Reason:             "RestoreFailed",
-		Message:            message,
-		LastTransitionTime: now,
-	})
-
-	if err := r.Status().Update(ctx, restoreJob); err != nil {
-		logger.Error(err, "failed to update RestoreJob status to Failed")
-		return ctrl.Result{}, err
-	}
-	logger.Debug("RestoreJob failed", "message", message)
-	return ctrl.Result{}, nil
-}

internal/backupcontroller/velerostrategy_controller.go

@@ -1,771 +0,0 @@
-package backupcontroller
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"reflect"
-	"time"
-
-	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/api/meta"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-
-	strategyv1alpha1 "github.com/cozystack/cozystack/api/backups/strategy/v1alpha1"
-	backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1"
-	"github.com/cozystack/cozystack/internal/template"
-
-	"github.com/go-logr/logr"
-	velerov1 "github.com/vmware-tanzu/velero/pkg/apis/velero/v1"
-)
-
-func getLogger(ctx context.Context) loggerWithDebug {
-	return loggerWithDebug{Logger: log.FromContext(ctx)}
-}
-
-// loggerWithDebug wraps a logr.Logger and provides a Debug() method
-// that maps to V(1).Info() for convenience.
-type loggerWithDebug struct {
-	logr.Logger
-}
-
-// Debug logs at debug level (equivalent to V(1).Info())
-func (l loggerWithDebug) Debug(msg string, keysAndValues ...interface{}) {
-	l.Logger.V(1).Info(msg, keysAndValues...)
-}
-
-// S3Credentials holds the discovered S3 credentials from a Bucket storageRef
-type S3Credentials struct {
-	BucketName      string
-	Endpoint        string
-	Region          string
-	AccessKeyID     string
-	AccessSecretKey string
-}
-
-// bucketInfo represents the structure of BucketInfo stored in the secret
-type bucketInfo struct {
-	Spec struct {
-		BucketName string `json:"bucketName"`
-		SecretS3   struct {
-			Endpoint        string `json:"endpoint"`
-			Region          string `json:"region"`
-			AccessKeyID     string `json:"accessKeyID"`
-			AccessSecretKey string `json:"accessSecretKey"`
-		} `json:"secretS3"`
-	} `json:"spec"`
-}
-
-const (
-	defaultRequeueAfter                 = 5 * time.Second
-	defaultActiveJobPollingInterval     = defaultRequeueAfter
-	defaultRestoreRequeueAfter          = 5 * time.Second
-	defaultActiveRestorePollingInterval = defaultRestoreRequeueAfter
-	// Velero requires API objects and secrets to be in the cozy-velero namespace
-	veleroNamespace                  = "cozy-velero"
-	veleroBackupNameMetadataKey      = "velero.io/backup-name"
-	veleroBackupNamespaceMetadataKey = "velero.io/backup-namespace"
-)
-
-func storageS3SecretName(namespace, backupJobName string) string {
-	return fmt.Sprintf("backup-%s-%s-s3-credentials", namespace, backupJobName)
-}
-
-func boolPtr(b bool) *bool {
-	return &b
-}
-
-func (r *BackupJobReconciler) reconcileVelero(ctx context.Context, j *backupsv1alpha1.BackupJob) (ctrl.Result, error) {
-	logger := getLogger(ctx)
-	logger.Debug("reconciling Velero strategy", "backupjob", j.Name, "phase", j.Status.Phase)
-
-	// If already completed, no need to reconcile
-	if j.Status.Phase == backupsv1alpha1.BackupJobPhaseSucceeded ||
-		j.Status.Phase == backupsv1alpha1.BackupJobPhaseFailed {
-		logger.Debug("BackupJob already completed, skipping", "phase", j.Status.Phase)
-		return ctrl.Result{}, nil
-	}
-
-	// Step 1: On first reconcile, set startedAt (but not phase yet - phase will be set after backup creation)
-	logger.Debug("checking BackupJob status", "startedAt", j.Status.StartedAt, "phase", j.Status.Phase)
-	if j.Status.StartedAt == nil {
-		logger.Debug("setting BackupJob StartedAt")
-		now := metav1.Now()
-		j.Status.StartedAt = &now
-		// Don't set phase to Running yet - will be set after Velero backup is successfully created
-		if err := r.Status().Update(ctx, j); err != nil {
-			logger.Error(err, "failed to update BackupJob status")
-			return ctrl.Result{}, err
-		}
-		logger.Debug("set BackupJob StartedAt", "startedAt", j.Status.StartedAt)
-	} else {
-		logger.Debug("BackupJob already started", "startedAt", j.Status.StartedAt, "phase", j.Status.Phase)
-	}
-
-	// Step 2: Resolve inputs - Read Strategy, Storage, Application, optionally Plan
-	logger.Debug("fetching Velero strategy", "strategyName", j.Spec.StrategyRef.Name)
-	veleroStrategy := &strategyv1alpha1.Velero{}
-	if err := r.Get(ctx, client.ObjectKey{Name: j.Spec.StrategyRef.Name}, veleroStrategy); err != nil {
-		if errors.IsNotFound(err) {
-			logger.Error(err, "Velero strategy not found", "strategyName", j.Spec.StrategyRef.Name)
-			return r.markBackupJobFailed(ctx, j, fmt.Sprintf("Velero strategy not found: %s", j.Spec.StrategyRef.Name))
-		}
-		logger.Error(err, "failed to get Velero strategy")
-		return ctrl.Result{}, err
-	}
-	logger.Debug("fetched Velero strategy", "strategyName", veleroStrategy.Name)
-
-	// Step 3: Execute backup logic
-	// Check if we already created a Velero Backup
-	if j.Status.StartedAt == nil {
-		logger.Error(nil, "StartedAt is nil after status update, this should not happen")
-		return ctrl.Result{RequeueAfter: defaultRequeueAfter}, nil
-	}
-	logger.Debug("checking for existing Velero Backup", "namespace", veleroNamespace)
-	veleroBackupList := &velerov1.BackupList{}
-	opts := []client.ListOption{
-		client.InNamespace(veleroNamespace),
-		client.MatchingLabels{
-			backupsv1alpha1.OwningJobNamespaceLabel: j.Namespace,
-			backupsv1alpha1.OwningJobNameLabel:      j.Name,
-		},
-	}
-
-	if err := r.List(ctx, veleroBackupList, opts...); err != nil {
-		logger.Error(err, "failed to get Velero Backup")
-		return ctrl.Result{}, err
-	}
-
-	if len(veleroBackupList.Items) == 0 {
-		// Create Velero Backup
-		logger.Debug("Velero Backup not found, creating new one")
-		if err := r.createVeleroBackup(ctx, j, veleroStrategy); err != nil {
-			logger.Error(err, "failed to create Velero Backup")
-			return r.markBackupJobFailed(ctx, j, fmt.Sprintf("failed to create Velero Backup: %v", err))
-		}
-		// After successful Velero backup creation, set phase to Running
-		if j.Status.Phase != backupsv1alpha1.BackupJobPhaseRunning {
-			logger.Debug("setting BackupJob phase to Running after successful Velero backup creation")
-			j.Status.Phase = backupsv1alpha1.BackupJobPhaseRunning
-			if err := r.Status().Update(ctx, j); err != nil {
-				logger.Error(err, "failed to update BackupJob phase to Running")
-				return ctrl.Result{}, err
-			}
-		}
-		logger.Debug("created Velero Backup, requeuing")
-		// Requeue to check status
-		return ctrl.Result{RequeueAfter: defaultRequeueAfter}, nil
-	}
-
-	if len(veleroBackupList.Items) > 1 {
-		logger.Error(fmt.Errorf("too many Velero backups for BackupJob"), "found more than one Velero Backup referencing a single BackupJob as owner")
-		j.Status.Phase = backupsv1alpha1.BackupJobPhaseFailed
-		if err := r.Status().Update(ctx, j); err != nil {
-			logger.Error(err, "failed to update BackupJob status")
-		}
-		return ctrl.Result{}, nil
-	}
-
-	veleroBackup := veleroBackupList.Items[0].DeepCopy()
-	logger.Debug("found existing Velero Backup", "phase", veleroBackup.Status.Phase)
-
-	// If Velero backup exists but phase is not Running, set it to Running
-	// This handles the case where the backup was created but phase wasn't set yet
-	if j.Status.Phase != backupsv1alpha1.BackupJobPhaseRunning {
-		logger.Debug("setting BackupJob phase to Running (Velero backup already exists)")
-		j.Status.Phase = backupsv1alpha1.BackupJobPhaseRunning
-		if err := r.Status().Update(ctx, j); err != nil {
-			logger.Error(err, "failed to update BackupJob phase to Running")
-			return ctrl.Result{}, err
-		}
-	}
-
-	// Check Velero Backup status
-	phase := string(veleroBackup.Status.Phase)
-	if phase == "" {
-		// Still in progress, requeue
-		return ctrl.Result{RequeueAfter: defaultActiveJobPollingInterval}, nil
-	}
-
-	// Step 4: On success - Create Backup resource and update status
-	if phase == "Completed" {
-		// Check if we already created the Backup resource
-		if j.Status.BackupRef == nil {
-			backup, err := r.createBackupResource(ctx, j, veleroBackup)
-			if err != nil {
-				return r.markBackupJobFailed(ctx, j, fmt.Sprintf("failed to create Backup resource: %v", err))
-			}
-
-			now := metav1.Now()
-			j.Status.BackupRef = &corev1.LocalObjectReference{Name: backup.Name}
-			j.Status.CompletedAt = &now
-			j.Status.Phase = backupsv1alpha1.BackupJobPhaseSucceeded
-			if err := r.Status().Update(ctx, j); err != nil {
-				logger.Error(err, "failed to update BackupJob status")
-				return ctrl.Result{}, err
-			}
-			logger.Debug("BackupJob succeeded", "backup", backup.Name)
-		}
-		return ctrl.Result{}, nil
-	}
-
-	// Step 5: On failure
-	if phase == "Failed" || phase == "PartiallyFailed" {
-		message := fmt.Sprintf("Velero Backup failed with phase: %s", phase)
-		if len(veleroBackup.Status.ValidationErrors) > 0 {
-			message = fmt.Sprintf("%s: %v", message, veleroBackup.Status.ValidationErrors)
-		}
-		return r.markBackupJobFailed(ctx, j, message)
-	}
-
-	// Still in progress (InProgress, New, etc.)
-	return ctrl.Result{RequeueAfter: 5 * time.Second}, nil
-}
-
-// resolveBucketStorageRef discovers S3 credentials from a Bucket storageRef
-// It follows this flow:
-// 1. Get the Bucket resource (apps.cozystack.io/v1alpha1)
-// 2. Find the BucketAccess that references this bucket
-// 3. Get the secret from BucketAccess.spec.credentialsSecretName
-// 4. Decode BucketInfo from secret.data.BucketInfo and extract S3 credentials
-func (r *BackupJobReconciler) resolveBucketStorageRef(ctx context.Context, storageRef corev1.TypedLocalObjectReference, namespace string) (*S3Credentials, error) {
-	logger := getLogger(ctx)
-
-	// Step 1: Get the Bucket resource
-	bucket := &unstructured.Unstructured{}
-	bucket.SetGroupVersionKind(schema.GroupVersionKind{
-		Group:   *storageRef.APIGroup,
-		Version: "v1alpha1",
-		Kind:    storageRef.Kind,
-	})
-
-	if *storageRef.APIGroup != "apps.cozystack.io" {
-		return nil, fmt.Errorf("Unsupported storage APIGroup: %v, expected apps.cozystack.io", storageRef.APIGroup)
-	}
-	bucketKey := client.ObjectKey{Namespace: namespace, Name: storageRef.Name}
-
-	if err := r.Get(ctx, bucketKey, bucket); err != nil {
-		return nil, fmt.Errorf("failed to get Bucket %s: %w", storageRef.Name, err)
-	}
-
-	// Step 2: Determine the bucket claim name
-	// For apps.cozystack.io Bucket, the BucketClaim name is typically the same as the Bucket name
-	// or follows a pattern. Based on the templates, it's usually the Release.Name which equals the Bucket name
-	bucketName := storageRef.Name
-
-	// Step 3: Get BucketAccess by name (assuming BucketAccess name matches bucketName)
-	bucketAccess := &unstructured.Unstructured{}
-	bucketAccess.SetGroupVersionKind(schema.GroupVersionKind{
-		Group:   "objectstorage.k8s.io",
-		Version: "v1alpha1",
-		Kind:    "BucketAccess",
-	})
-
-	bucketAccessKey := client.ObjectKey{Name: "bucket-" + bucketName, Namespace: namespace}
-	if err := r.Get(ctx, bucketAccessKey, bucketAccess); err != nil {
-		return nil, fmt.Errorf("failed to get BucketAccess %s in namespace %s: %w", bucketName, namespace, err)
-	}
-
-	// Step 4: Get the secret name from BucketAccess
-	secretName, found, err := unstructured.NestedString(bucketAccess.Object, "spec", "credentialsSecretName")
-	if err != nil {
-		return nil, fmt.Errorf("failed to get credentialsSecretName from BucketAccess: %w", err)
-	}
-	if !found || secretName == "" {
-		return nil, fmt.Errorf("credentialsSecretName not found in BucketAccess %s", bucketAccessKey.Name)
-	}
-
-	// Step 5: Get the secret
-	secret := &corev1.Secret{}
-	secretKey := client.ObjectKey{Namespace: namespace, Name: secretName}
-	if err := r.Get(ctx, secretKey, secret); err != nil {
-		return nil, fmt.Errorf("failed to get secret %s: %w", secretName, err)
-	}
-
-	// Step 6: Decode BucketInfo from secret.data.BucketInfo
-	bucketInfoData, found := secret.Data["BucketInfo"]
-	if !found {
-		return nil, fmt.Errorf("BucketInfo key not found in secret %s", secretName)
-	}
-
-	// Parse JSON value
-	var info bucketInfo
-	if err := json.Unmarshal(bucketInfoData, &info); err != nil {
-		return nil, fmt.Errorf("failed to unmarshal BucketInfo from secret %s: %w", secretName, err)
-	}
-
-	// Step 7: Extract and return S3 credentials
-	creds := &S3Credentials{
-		BucketName:      info.Spec.BucketName,
-		Endpoint:        info.Spec.SecretS3.Endpoint,
-		Region:          info.Spec.SecretS3.Region,
-		AccessKeyID:     info.Spec.SecretS3.AccessKeyID,
-		AccessSecretKey: info.Spec.SecretS3.AccessSecretKey,
-	}
-
-	logger.Debug("resolved S3 credentials from Bucket storageRef",
-		"bucket", storageRef.Name,
-		"bucketName", creds.BucketName,
-		"endpoint", creds.Endpoint)
-
-	return creds, nil
-}
-
-// createS3CredsForVelero creates or updates a Kubernetes Secret containing
-// Velero S3 credentials in the format expected by Velero's cloud-credentials plugin.
-func (r *BackupJobReconciler) createS3CredsForVelero(ctx context.Context, backupJob *backupsv1alpha1.BackupJob, creds *S3Credentials) error {
-	logger := getLogger(ctx)
-	secretName := storageS3SecretName(backupJob.Namespace, backupJob.Name)
-	secretNamespace := veleroNamespace
-
-	secret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      secretName,
-			Namespace: secretNamespace,
-		},
-		Type: corev1.SecretTypeOpaque,
-		StringData: map[string]string{
-			"cloud": fmt.Sprintf(`[default]
-aws_access_key_id=%s
-aws_secret_access_key=%s
-
-services = seaweed-s3
-[services seaweed-s3]
-s3 =
-    endpoint_url = %s
-`, creds.AccessKeyID, creds.AccessSecretKey, creds.Endpoint),
-		},
-	}
-
-	foundSecret := &corev1.Secret{}
-	secretKey := client.ObjectKey{Name: secretName, Namespace: secretNamespace}
-	err := r.Get(ctx, secretKey, foundSecret)
-	if err != nil && errors.IsNotFound(err) {
-		// Create the Secret
-		if err := r.Create(ctx, secret); err != nil {
-			r.Recorder.Event(backupJob, corev1.EventTypeWarning, "SecretCreationFailed",
-				fmt.Sprintf("Failed to create Velero credentials secret %s/%s: %v", secretNamespace, secretName, err))
-			return fmt.Errorf("failed to create Velero credentials secret: %w", err)
-		}
-		logger.Debug("created Velero credentials secret", "secret", secretName)
-		r.Recorder.Event(backupJob, corev1.EventTypeNormal, "SecretCreated",
-			fmt.Sprintf("Created Velero credentials secret %s/%s", secretNamespace, secretName))
-	} else if err == nil {
-		// Update if necessary - only update if the secret data has actually changed
-		// Compare the new secret data with existing secret data
-		existingData := foundSecret.Data
-		if existingData == nil {
-			existingData = make(map[string][]byte)
-		}
-		newData := make(map[string][]byte)
-		for k, v := range secret.StringData {
-			newData[k] = []byte(v)
-		}
-
-		// Check if data has changed
-		dataChanged := false
-		if len(existingData) != len(newData) {
-			dataChanged = true
-		} else {
-			for k, newVal := range newData {
-				existingVal, exists := existingData[k]
-				if !exists || !reflect.DeepEqual(existingVal, newVal) {
-					dataChanged = true
-					break
-				}
-			}
-		}
-
-		if dataChanged {
-			foundSecret.StringData = secret.StringData
-			foundSecret.Data = nil // Clear .Data so .StringData will be used
-			if err := r.Update(ctx, foundSecret); err != nil {
-				r.Recorder.Event(backupJob, corev1.EventTypeWarning, "SecretUpdateFailed",
-					fmt.Sprintf("Failed to update Velero credentials secret %s/%s: %v", secretNamespace, secretName, err))
-				return fmt.Errorf("failed to update Velero credentials secret: %w", err)
-			}
-			logger.Debug("updated Velero credentials secret", "secret", secretName)
-			r.Recorder.Event(backupJob, corev1.EventTypeNormal, "SecretUpdated",
-				fmt.Sprintf("Updated Velero credentials secret %s/%s", secretNamespace, secretName))
-		} else {
-			logger.Debug("Velero credentials secret data unchanged, skipping update", "secret", secretName)
-		}
-	} else if err != nil {
-		return fmt.Errorf("error checking for existing Velero credentials secret: %w", err)
-	}
-
-	return nil
-}
-
-// createBackupStorageLocation creates or updates a Velero BackupStorageLocation resource.
-func (r *BackupJobReconciler) createBackupStorageLocation(ctx context.Context, bsl *velerov1.BackupStorageLocation) error {
-	logger := getLogger(ctx)
-	foundBSL := &velerov1.BackupStorageLocation{}
-	bslKey := client.ObjectKey{Name: bsl.Name, Namespace: bsl.Namespace}
-
-	err := r.Get(ctx, bslKey, foundBSL)
-	if err != nil && errors.IsNotFound(err) {
-		// Create the BackupStorageLocation
-		if err := r.Create(ctx, bsl); err != nil {
-			return fmt.Errorf("failed to create BackupStorageLocation: %w", err)
-		}
-		logger.Debug("created BackupStorageLocation", "name", bsl.Name, "namespace", bsl.Namespace)
-	} else if err == nil {
-		// Update if necessary - use patch to avoid conflicts with Velero's status updates
-		// Only update if the spec has actually changed
-		if !reflect.DeepEqual(foundBSL.Spec, bsl.Spec) {
-			// Retry on conflict since Velero may be updating status concurrently
-			for i := 0; i < 3; i++ {
-				if err := r.Get(ctx, bslKey, foundBSL); err != nil {
-					return fmt.Errorf("failed to get BackupStorageLocation for update: %w", err)
-				}
-				foundBSL.Spec = bsl.Spec
-				if err := r.Update(ctx, foundBSL); err != nil {
-					if errors.IsConflict(err) && i < 2 {
-						logger.Debug("conflict updating BackupStorageLocation, retrying", "attempt", i+1)
-						time.Sleep(100 * time.Millisecond)
-						continue
-					}
-					return fmt.Errorf("failed to update BackupStorageLocation: %w", err)
-				}
-				logger.Debug("updated BackupStorageLocation", "name", bsl.Name, "namespace", bsl.Namespace)
-				return nil
-			}
-		} else {
-			logger.Debug("BackupStorageLocation spec unchanged, skipping update", "name", bsl.Name, "namespace", bsl.Namespace)
-		}
-	} else if err != nil {
-		return fmt.Errorf("error checking for existing BackupStorageLocation: %w", err)
-	}
-
-	return nil
-}
-
-// createVolumeSnapshotLocation creates or updates a Velero VolumeSnapshotLocation resource.
-func (r *BackupJobReconciler) createVolumeSnapshotLocation(ctx context.Context, vsl *velerov1.VolumeSnapshotLocation) error {
-	logger := getLogger(ctx)
-	foundVSL := &velerov1.VolumeSnapshotLocation{}
-	vslKey := client.ObjectKey{Name: vsl.Name, Namespace: vsl.Namespace}
-
-	err := r.Get(ctx, vslKey, foundVSL)
-	if err != nil && errors.IsNotFound(err) {
-		// Create the VolumeSnapshotLocation
-		if err := r.Create(ctx, vsl); err != nil {
-			return fmt.Errorf("failed to create VolumeSnapshotLocation: %w", err)
-		}
-		logger.Debug("created VolumeSnapshotLocation", "name", vsl.Name, "namespace", vsl.Namespace)
-	} else if err == nil {
-		// Update if necessary - only update if the spec has actually changed
-		if !reflect.DeepEqual(foundVSL.Spec, vsl.Spec) {
-			// Retry on conflict since Velero may be updating status concurrently
-			for i := 0; i < 3; i++ {
-				if err := r.Get(ctx, vslKey, foundVSL); err != nil {
-					return fmt.Errorf("failed to get VolumeSnapshotLocation for update: %w", err)
-				}
-				foundVSL.Spec = vsl.Spec
-				if err := r.Update(ctx, foundVSL); err != nil {
-					if errors.IsConflict(err) && i < 2 {
-						logger.Debug("conflict updating VolumeSnapshotLocation, retrying", "attempt", i+1)
-						time.Sleep(100 * time.Millisecond)
-						continue
-					}
-					return fmt.Errorf("failed to update VolumeSnapshotLocation: %w", err)
-				}
-				logger.Debug("updated VolumeSnapshotLocation", "name", vsl.Name, "namespace", vsl.Namespace)
-				return nil
-			}
-		} else {
-			logger.Debug("VolumeSnapshotLocation spec unchanged, skipping update", "name", vsl.Name, "namespace", vsl.Namespace)
-		}
-	} else if err != nil {
-		return fmt.Errorf("error checking for existing VolumeSnapshotLocation: %w", err)
-	}
-
-	return nil
-}
-
-func (r *BackupJobReconciler) createVeleroBackup(ctx context.Context, backupJob *backupsv1alpha1.BackupJob, strategy *strategyv1alpha1.Velero) error {
-	logger := getLogger(ctx)
-	logger.Debug("createVeleroBackup called", "strategy", strategy.Name)
-
-	mapping, err := r.RESTMapping(schema.GroupKind{Group: *backupJob.Spec.ApplicationRef.APIGroup, Kind: backupJob.Spec.ApplicationRef.Kind})
-	if err != nil {
-		return err
-	}
-	ns := backupJob.Namespace
-	if mapping.Scope.Name() != meta.RESTScopeNameNamespace {
-		ns = ""
-	}
-	app, err := r.Resource(mapping.Resource).Namespace(ns).Get(ctx, backupJob.Spec.ApplicationRef.Name, metav1.GetOptions{})
-	if err != nil {
-		return err
-	}
-
-	veleroBackupSpec, err := template.Template(&strategy.Spec.Template.Spec, app.Object)
-	if err != nil {
-		return err
-	}
-	veleroBackup := &velerov1.Backup{
-		ObjectMeta: metav1.ObjectMeta{
-			GenerateName: fmt.Sprintf("%s.%s-", backupJob.Namespace, backupJob.Name),
-			Namespace:    veleroNamespace,
-			Labels: map[string]string{
-				backupsv1alpha1.OwningJobNameLabel:      backupJob.Name,
-				backupsv1alpha1.OwningJobNamespaceLabel: backupJob.Namespace,
-			},
-		},
-		Spec: *veleroBackupSpec,
-	}
-	name := veleroBackup.GenerateName
-	if err := r.Create(ctx, veleroBackup); err != nil {
-		if veleroBackup.Name != "" {
-			name = veleroBackup.Name
-		}
-		logger.Error(err, "failed to create Velero Backup", "name", veleroBackup.Name)
-		r.Recorder.Event(backupJob, corev1.EventTypeWarning, "VeleroBackupCreationFailed",
-			fmt.Sprintf("Failed to create Velero Backup %s/%s: %v", veleroNamespace, name, err))
-		return err
-	}
-
-	logger.Debug("created Velero Backup", "name", veleroBackup.Name, "namespace", veleroBackup.Namespace)
-	r.Recorder.Event(backupJob, corev1.EventTypeNormal, "VeleroBackupCreated",
-		fmt.Sprintf("Created Velero Backup %s/%s", veleroNamespace, name))
-	return nil
-}
-
-func (r *BackupJobReconciler) createBackupResource(ctx context.Context, backupJob *backupsv1alpha1.BackupJob, veleroBackup *velerov1.Backup) (*backupsv1alpha1.Backup, error) {
-	logger := getLogger(ctx)
-	// Extract artifact information from Velero Backup
-	// Create a basic artifact referencing the Velero backup
-	artifact := &backupsv1alpha1.BackupArtifact{
-		URI: fmt.Sprintf("velero://%s/%s", backupJob.Namespace, veleroBackup.Name),
-	}
-
-	// Get takenAt from Velero Backup creation timestamp or status
-	takenAt := metav1.Now()
-	if veleroBackup.Status.StartTimestamp != nil {
-		takenAt = *veleroBackup.Status.StartTimestamp
-	} else if !veleroBackup.CreationTimestamp.IsZero() {
-		takenAt = veleroBackup.CreationTimestamp
-	}
-
-	// Extract driver metadata (e.g., Velero backup name)
-	driverMetadata := map[string]string{
-		veleroBackupNameMetadataKey:      veleroBackup.Name,
-		veleroBackupNamespaceMetadataKey: veleroBackup.Namespace,
-	}
-
-	backup := &backupsv1alpha1.Backup{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      fmt.Sprintf("%s", backupJob.Name),
-			Namespace: backupJob.Namespace,
-			OwnerReferences: []metav1.OwnerReference{
-				{
-					APIVersion: backupJob.APIVersion,
-					Kind:       backupJob.Kind,
-					Name:       backupJob.Name,
-					UID:        backupJob.UID,
-					Controller: boolPtr(true),
-				},
-			},
-		},
-		Spec: backupsv1alpha1.BackupSpec{
-			ApplicationRef: backupJob.Spec.ApplicationRef,
-			StorageRef:     backupJob.Spec.StorageRef,
-			StrategyRef:    backupJob.Spec.StrategyRef,
-			TakenAt:        takenAt,
-			DriverMetadata: driverMetadata,
-		},
-		Status: backupsv1alpha1.BackupStatus{
-			Phase: backupsv1alpha1.BackupPhaseReady,
-		},
-	}
-
-	if backupJob.Spec.PlanRef != nil {
-		backup.Spec.PlanRef = backupJob.Spec.PlanRef
-	}
-
-	if artifact != nil {
-		backup.Status.Artifact = artifact
-	}
-
-	if err := r.Create(ctx, backup); err != nil {
-		logger.Error(err, "failed to create Backup resource")
-		return nil, err
-	}
-
-	logger.Debug("created Backup resource", "name", backup.Name)
-	return backup, nil
-}
-
-// reconcileVeleroRestore handles restore operations for Velero strategy.
-func (r *RestoreJobReconciler) reconcileVeleroRestore(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup) (ctrl.Result, error) {
-	logger := getLogger(ctx)
-	logger.Debug("reconciling Velero strategy restore", "restorejob", restoreJob.Name, "backup", backup.Name)
-
-	// Step 1: On first reconcile, set startedAt and phase = Running
-	if restoreJob.Status.StartedAt == nil {
-		logger.Debug("setting RestoreJob StartedAt and phase to Running")
-		now := metav1.Now()
-		restoreJob.Status.StartedAt = &now
-		restoreJob.Status.Phase = backupsv1alpha1.RestoreJobPhaseRunning
-		if err := r.Status().Update(ctx, restoreJob); err != nil {
-			logger.Error(err, "failed to update RestoreJob status")
-			return ctrl.Result{}, err
-		}
-		return ctrl.Result{RequeueAfter: defaultRestoreRequeueAfter}, nil
-	}
-
-	// Step 2: Resolve inputs - Read Strategy, Storage, target Application
-	logger.Debug("fetching Velero strategy", "strategyName", backup.Spec.StrategyRef.Name)
-	veleroStrategy := &strategyv1alpha1.Velero{}
-	if err := r.Get(ctx, client.ObjectKey{Name: backup.Spec.StrategyRef.Name}, veleroStrategy); err != nil {
-		if errors.IsNotFound(err) {
-			logger.Error(err, "Velero strategy not found", "strategyName", backup.Spec.StrategyRef.Name)
-			return r.markRestoreJobFailed(ctx, restoreJob, fmt.Sprintf("Velero strategy not found: %s", backup.Spec.StrategyRef.Name))
-		}
-		logger.Error(err, "failed to get Velero strategy")
-		return ctrl.Result{}, err
-	}
-	logger.Debug("fetched Velero strategy", "strategyName", veleroStrategy.Name)
-
-	// Get Velero backup name from Backup's driverMetadata
-	veleroBackupName, ok := backup.Spec.DriverMetadata[veleroBackupNameMetadataKey]
-	if !ok {
-		return r.markRestoreJobFailed(ctx, restoreJob, fmt.Sprintf("Backup missing Velero backup name in driverMetadata (key: %s)", veleroBackupNameMetadataKey))
-	}
-
-	// Step 3: Execute restore logic
-	// Check if we already created a Velero Restore
-	logger.Debug("checking for existing Velero Restore", "namespace", veleroNamespace)
-	veleroRestoreList := &velerov1.RestoreList{}
-	opts := []client.ListOption{
-		client.InNamespace(veleroNamespace),
-		client.MatchingLabels{
-			backupsv1alpha1.OwningJobNameLabel:      restoreJob.Name,
-			backupsv1alpha1.OwningJobNamespaceLabel: restoreJob.Namespace,
-		},
-	}
-
-	if err := r.List(ctx, veleroRestoreList, opts...); err != nil {
-		logger.Error(err, "failed to get Velero Restore")
-		return ctrl.Result{}, err
-	}
-
-	if len(veleroRestoreList.Items) == 0 {
-		// Create Velero Restore
-		logger.Debug("Velero Restore not found, creating new one")
-		if err := r.createVeleroRestore(ctx, restoreJob, backup, veleroStrategy, veleroBackupName); err != nil {
-			logger.Error(err, "failed to create Velero Restore")
-			return r.markRestoreJobFailed(ctx, restoreJob, fmt.Sprintf("failed to create Velero Restore: %v", err))
-		}
-		logger.Debug("created Velero Restore, requeuing")
-		// Requeue to check status
-		return ctrl.Result{RequeueAfter: defaultRestoreRequeueAfter}, nil
-	}
-
-	if len(veleroRestoreList.Items) > 1 {
-		logger.Error(fmt.Errorf("too many Velero restores for RestoreJob"), "found more than one Velero Restore referencing a single RestoreJob as owner")
-		return r.markRestoreJobFailed(ctx, restoreJob, "found multiple Velero Restores for this RestoreJob")
-	}
-
-	veleroRestore := veleroRestoreList.Items[0].DeepCopy()
-	logger.Debug("found existing Velero Restore", "phase", veleroRestore.Status.Phase)
-
-	// Check Velero Restore status
-	phase := string(veleroRestore.Status.Phase)
-	if phase == "" {
-		// Still in progress, requeue
-		return ctrl.Result{RequeueAfter: defaultActiveRestorePollingInterval}, nil
-	}
-
-	// Step 4: On success
-	if phase == "Completed" {
-		now := metav1.Now()
-		restoreJob.Status.CompletedAt = &now
-		restoreJob.Status.Phase = backupsv1alpha1.RestoreJobPhaseSucceeded
-		if err := r.Status().Update(ctx, restoreJob); err != nil {
-			logger.Error(err, "failed to update RestoreJob status")
-			return ctrl.Result{}, err
-		}
-		logger.Debug("RestoreJob succeeded")
-		return ctrl.Result{}, nil
-	}
-
-	// Step 5: On failure
-	if phase == "Failed" || phase == "PartiallyFailed" {
-		message := fmt.Sprintf("Velero Restore failed with phase: %s", phase)
-		if veleroRestore.Status.FailureReason != "" {
-			message = fmt.Sprintf("%s: %s", message, veleroRestore.Status.FailureReason)
-		}
-		return r.markRestoreJobFailed(ctx, restoreJob, message)
-	}
-
-	// Still in progress (InProgress, New, etc.)
-	return ctrl.Result{RequeueAfter: defaultRestoreRequeueAfter}, nil
-}
-
-// createVeleroRestore creates a Velero Restore resource.
-func (r *RestoreJobReconciler) createVeleroRestore(ctx context.Context, restoreJob *backupsv1alpha1.RestoreJob, backup *backupsv1alpha1.Backup, strategy *strategyv1alpha1.Velero, veleroBackupName string) error {
-	logger := getLogger(ctx)
-	logger.Debug("createVeleroRestore called", "strategy", strategy.Name, "veleroBackupName", veleroBackupName)
-
-	// Determine target application reference
-	targetAppRef := r.getTargetApplicationRef(restoreJob, backup)
-
-	// Get the target application object for templating
-	mapping, err := r.RESTMapping(schema.GroupKind{Group: *targetAppRef.APIGroup, Kind: targetAppRef.Kind})
-	if err != nil {
-		return fmt.Errorf("failed to get REST mapping for target application: %w", err)
-	}
-	ns := restoreJob.Namespace
-	if mapping.Scope.Name() != meta.RESTScopeNameNamespace {
-		ns = ""
-	}
-	app, err := r.Resource(mapping.Resource).Namespace(ns).Get(ctx, targetAppRef.Name, metav1.GetOptions{})
-	if err != nil {
-		return fmt.Errorf("failed to get target application: %w", err)
-	}
-
-	// Template the restore spec from the strategy
-	veleroRestoreSpec, err := template.Template(&strategy.Spec.Template.RestoreSpec, app.Object)
-	if err != nil {
-		return fmt.Errorf("failed to template Velero Restore spec: %w", err)
-	}
-
-	// Set the backupName in the spec (required by Velero)
-	veleroRestoreSpec.BackupName = veleroBackupName
-
-	veleroRestore := &velerov1.Restore{
-		ObjectMeta: metav1.ObjectMeta{
-			GenerateName: fmt.Sprintf("%s.%s-", restoreJob.Namespace, restoreJob.Name),
-			Namespace:    veleroNamespace,
-			Labels: map[string]string{
-				backupsv1alpha1.OwningJobNameLabel:      restoreJob.Name,
-				backupsv1alpha1.OwningJobNamespaceLabel: restoreJob.Namespace,
-			},
-		},
-		Spec: *veleroRestoreSpec,
-	}
-	name := veleroRestore.GenerateName
-	if err := r.Create(ctx, veleroRestore); err != nil {
-		if veleroRestore.Name != "" {
-			name = veleroRestore.Name
-		}
-		logger.Error(err, "failed to create Velero Restore", "name", veleroRestore.Name)
-		r.Recorder.Event(restoreJob, corev1.EventTypeWarning, "VeleroRestoreCreationFailed",
-			fmt.Sprintf("Failed to create Velero Restore %s/%s: %v", veleroNamespace, name, err))
-		return err
-	}
-
-	logger.Debug("created Velero Restore", "name", veleroRestore.Name, "namespace", veleroRestore.Namespace)
-	r.Recorder.Event(restoreJob, corev1.EventTypeNormal, "VeleroRestoreCreated",
-		fmt.Sprintf("Created Velero Restore %s/%s", veleroNamespace, name))
-	return nil
-}

internal/controller/cozystackresource_controller.go

@@ -5,11 +5,13 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
+	"fmt"
 	"slices"
 	"sync"
 	"time"
 
 	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
+	helmv2 "github.com/fluxcd/helm-controller/api/v2"
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -37,6 +39,11 @@ type CozystackResourceDefinitionReconciler struct {
 }
 
 func (r *CozystackResourceDefinitionReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	if err := r.reconcileCozyRDAndUpdateHelmReleases(ctx); err != nil {
+		return ctrl.Result{}, err
+	}
+
+	// Continue with debounced restart logic
 	return r.debouncedRestart(ctx)
 }
 
@@ -185,3 +192,138 @@ func sortCozyRDs(a, b cozyv1alpha1.CozystackResourceDefinition) int {
 	}
 	return 1
 }
+
+// reconcileCozyRDAndUpdateHelmReleases reconciles all CozystackResourceDefinitions and updates HelmReleases from them
+func (r *CozystackResourceDefinitionReconciler) reconcileCozyRDAndUpdateHelmReleases(ctx context.Context) error {
+	logger := log.FromContext(ctx)
+
+	// List all CozystackResourceDefinitions
+	crdList := &cozyv1alpha1.CozystackResourceDefinitionList{}
+	if err := r.List(ctx, crdList); err != nil {
+		logger.Error(err, "failed to list CozystackResourceDefinitions")
+		return err
+	}
+
+	// Update HelmReleases for each CRD
+	for i := range crdList.Items {
+		crd := &crdList.Items[i]
+		if err := r.updateHelmReleasesForCRD(ctx, crd); err != nil {
+			logger.Error(err, "failed to update HelmReleases for CRD", "crd", crd.Name)
+			// Continue with other CRDs even if one fails
+		}
+	}
+
+	return nil
+}
+
+// updateHelmReleasesForCRD updates all HelmReleases that match the application labels from CozystackResourceDefinition
+func (r *CozystackResourceDefinitionReconciler) updateHelmReleasesForCRD(ctx context.Context, crd *cozyv1alpha1.CozystackResourceDefinition) error {
+	logger := log.FromContext(ctx)
+
+	// Use application labels to find HelmReleases
+	// Labels: apps.cozystack.io/application.kind and apps.cozystack.io/application.group
+	applicationKind := crd.Spec.Application.Kind
+	
+	// Validate that applicationKind is non-empty
+	if applicationKind == "" {
+		logger.Error(fmt.Errorf("Application.Kind is empty"), "Skipping HelmRelease update: invalid CozystackResourceDefinition", "crd", crd.Name)
+		return nil
+	}
+	
+	applicationGroup := "apps.cozystack.io" // All applications use this group
+
+	// Build label selector for HelmReleases
+	// Only reconcile HelmReleases with cozystack.io/ui=true label
+	labelSelector := client.MatchingLabels{
+		"apps.cozystack.io/application.kind":  applicationKind,
+		"apps.cozystack.io/application.group": applicationGroup,
+		"cozystack.io/ui":                      "true",
+	}
+
+	// List all HelmReleases with matching labels
+	hrList := &helmv2.HelmReleaseList{}
+	if err := r.List(ctx, hrList, labelSelector); err != nil {
+		logger.Error(err, "failed to list HelmReleases", "kind", applicationKind, "group", applicationGroup)
+		return err
+	}
+
+	logger.V(4).Info("Found HelmReleases to update", "crd", crd.Name, "kind", applicationKind, "count", len(hrList.Items))
+
+	// Update each HelmRelease
+	for i := range hrList.Items {
+		hr := &hrList.Items[i]
+		if err := r.updateHelmReleaseChart(ctx, hr, crd); err != nil {
+			logger.Error(err, "failed to update HelmRelease", "name", hr.Name, "namespace", hr.Namespace)
+			continue
+		}
+	}
+
+	return nil
+}
+
+// updateHelmReleaseChart updates the chart in HelmRelease based on CozystackResourceDefinition
+func (r *CozystackResourceDefinitionReconciler) updateHelmReleaseChart(ctx context.Context, hr *helmv2.HelmRelease, crd *cozyv1alpha1.CozystackResourceDefinition) error {
+	logger := log.FromContext(ctx)
+	hrCopy := hr.DeepCopy()
+	updated := false
+
+	// Validate Chart configuration exists
+	if crd.Spec.Release.Chart.Name == "" {
+		logger.V(4).Info("Skipping HelmRelease chart update: Chart.Name is empty", "crd", crd.Name)
+		return nil
+	}
+
+	// Validate SourceRef fields
+	if crd.Spec.Release.Chart.SourceRef.Kind == "" ||
+		crd.Spec.Release.Chart.SourceRef.Name == "" ||
+		crd.Spec.Release.Chart.SourceRef.Namespace == "" {
+		logger.Error(fmt.Errorf("invalid SourceRef in CRD"), "Skipping HelmRelease chart update: SourceRef fields are incomplete",
+			"crd", crd.Name,
+			"kind", crd.Spec.Release.Chart.SourceRef.Kind,
+			"name", crd.Spec.Release.Chart.SourceRef.Name,
+			"namespace", crd.Spec.Release.Chart.SourceRef.Namespace)
+		return nil
+	}
+
+	// Get version and reconcileStrategy from CRD or use defaults
+	version := ">= 0.0.0-0"
+	reconcileStrategy := "Revision"
+	// TODO: Add Version and ReconcileStrategy fields to CozystackResourceDefinitionChart if needed
+
+	// Build expected SourceRef
+	expectedSourceRef := helmv2.CrossNamespaceObjectReference{
+		Kind:      crd.Spec.Release.Chart.SourceRef.Kind,
+		Name:      crd.Spec.Release.Chart.SourceRef.Name,
+		Namespace: crd.Spec.Release.Chart.SourceRef.Namespace,
+	}
+
+	if hrCopy.Spec.Chart == nil {
+		// Need to create Chart spec
+		hrCopy.Spec.Chart = &helmv2.HelmChartTemplate{
+			Spec: helmv2.HelmChartTemplateSpec{
+				Chart:             crd.Spec.Release.Chart.Name,
+				Version:           version,
+				ReconcileStrategy: reconcileStrategy,
+				SourceRef:         expectedSourceRef,
+			},
+		}
+		updated = true
+	} else {
+		// Update existing Chart spec
+		if hrCopy.Spec.Chart.Spec.Chart != crd.Spec.Release.Chart.Name ||
+			hrCopy.Spec.Chart.Spec.SourceRef != expectedSourceRef {
+			hrCopy.Spec.Chart.Spec.Chart = crd.Spec.Release.Chart.Name
+			hrCopy.Spec.Chart.Spec.SourceRef = expectedSourceRef
+			updated = true
+		}
+	}
+
+	if updated {
+		logger.V(4).Info("Updating HelmRelease chart", "name", hr.Name, "namespace", hr.Namespace)
+		if err := r.Update(ctx, hrCopy); err != nil {
+			return fmt.Errorf("failed to update HelmRelease: %w", err)
+		}
+	}
+
+	return nil
+}

internal/controller/dashboard/README.md

@@ -1,355 +0,0 @@
-# Dashboard Resource Integration Guide
-
-This guide explains how to add a new Kubernetes resource to the Cozystack dashboard. The dashboard provides a unified interface for viewing and managing Kubernetes resources through custom table views, detail pages, and sidebar navigation.
-
-## Overview
-
-Adding a new resource to the dashboard requires three main components:
-
-1. **CustomColumnsOverride**: Defines how the resource appears in list/table views
-2. **Factory**: Defines the detail page layout for individual resource instances
-3. **Sidebar Entry**: Adds navigation to the resource in the sidebar menu
-
-## Prerequisites
-
-- The resource must have a Kubernetes CustomResourceDefinition (CRD) or be a built-in Kubernetes resource
-- Know the resource's API group, version, kind, and plural name
-- Understand the resource's spec structure to display relevant fields
-
-## Step-by-Step Guide
-
-### Step 1: Add CustomColumnsOverride
-
-The CustomColumnsOverride defines the columns shown in the resource list table and how clicking on a row navigates to the detail page.
-
-**Location**: `internal/controller/dashboard/static_refactored.go` in `CreateAllCustomColumnsOverrides()`
-
-**Example**:
-```go
-// Stock namespace backups cozystack io v1alpha1 plans
-createCustomColumnsOverride("stock-namespace-/backups.cozystack.io/v1alpha1/plans", []any{
-    createCustomColumnWithJsonPath("Name", ".metadata.name", "Plan", "", "/openapi-ui/{2}/{reqsJsonPath[0]['.metadata.namespace']['-']}/factory/plan-details/{reqsJsonPath[0]['.metadata.name']['-']}"),
-    createApplicationRefColumn("Application"),
-    createTimestampColumn("Created", ".metadata.creationTimestamp"),
-}),
-```
-
-**Key Components**:
-- **ID Format**: `stock-namespace-/{group}/{version}/{plural}`
-- **Name Column**: Use `createCustomColumnWithJsonPath()` with:
-  - Badge value: Resource kind in PascalCase (e.g., "Plan", "Service")
-  - Link href: `/openapi-ui/{2}/{namespace}/factory/{resource-details}/{name}`
-- **Additional Columns**: Use helper functions like:
-  - `createStringColumn()`: Simple string values
-  - `createTimestampColumn()`: Timestamp fields
-  - `createReadyColumn()`: Ready status from conditions
-  - Custom helpers for complex fields
-
-**Helper Functions Available**:
-- `createCustomColumnWithJsonPath(name, jsonPath, badgeValue, badgeColor, linkHref)`: Column with badge and link
-- `createStringColumn(name, jsonPath)`: Simple string column
-- `createTimestampColumn(name, jsonPath)`: Timestamp with formatting
-- `createReadyColumn()`: Ready status column
-- `createBoolColumn(name, jsonPath)`: Boolean column
-- `createArrayColumn(name, jsonPath)`: Array column
-
-### Step 2: Add Factory (Detail Page)
-
-The Factory defines the detail page layout when viewing an individual resource instance.
-
-**Location**: `internal/controller/dashboard/static_refactored.go` in `CreateAllFactories()`
-
-**Using Unified Factory Approach** (Recommended):
-```go
-// Resource details factory using unified approach
-resourceConfig := UnifiedResourceConfig{
-    Name:         "resource-details",  // Must match the href in CustomColumnsOverride
-    ResourceType: "factory",
-    Kind:         "ResourceKind",      // PascalCase
-    Plural:       "resources",         // lowercase plural
-    Title:        "resource",          // lowercase singular
-}
-resourceTabs := []any{
-    map[string]any{
-        "key":   "details",
-        "label": "Details",
-        "children": []any{
-            contentCard("details-card", map[string]any{
-                "marginBottom": "24px",
-            }, []any{
-                antdText("details-title", true, "Resource details", map[string]any{
-                    "fontSize":     20,
-                    "marginBottom": "12px",
-                }),
-                spacer("details-spacer", 16),
-                antdRow("details-grid", []any{48, 12}, []any{
-                    antdCol("col-left", 12, []any{
-                        antdFlexVertical("col-left-stack", 24, []any{
-                            // Metadata fields: Name, Namespace, Created, etc.
-                        }),
-                    }),
-                    antdCol("col-right", 12, []any{
-                        antdFlexVertical("col-right-stack", 24, []any{
-                            // Spec fields
-                        }),
-                    }),
-                }),
-            }),
-        },
-    },
-}
-resourceSpec := createUnifiedFactory(resourceConfig, resourceTabs, []any{"/api/clusters/{2}/k8s/apis/{group}/{version}/namespaces/{3}/{plural}/{6}"})
-
-// Add to return list
-return []*dashboardv1alpha1.Factory{
-    // ... other factories
-    createFactory("resource-details", resourceSpec),
-}
-```
-
-**Key Components**:
-- **Factory Key**: Must match the href path segment (e.g., `plan-details` matches `/factory/plan-details/...`)
-- **API Endpoint**: `/api/clusters/{2}/k8s/apis/{group}/{version}/namespaces/{3}/{plural}/{6}`
-  - `{2}`: Cluster name
-  - `{3}`: Namespace
-  - `{6}`: Resource name
-- **Sidebar Tags**: Automatically set to `["{lowercase-kind}-sidebar"]` by `createUnifiedFactory()`
-- **Tabs**: Define the detail page content (Details, YAML, etc.)
-
-**UI Helper Functions**:
-- `contentCard(id, style, children)`: Container card
-- `antdText(id, strong, text, style)`: Text element
-- `antdFlexVertical(id, gap, children)`: Vertical flex container
-- `antdRow(id, gutter, children)`: Row layout
-- `antdCol(id, span, children)`: Column layout
-- `parsedText(id, text, style)`: Text with JSON path parsing
-- `parsedTextWithFormatter(id, text, formatter)`: Formatted text (e.g., timestamp)
-- `spacer(id, space)`: Spacing element
-
-**Displaying Fields**:
-```go
-antdFlexVertical("field-block", 4, []any{
-    antdText("field-label", true, "Field Label", nil),
-    parsedText("field-value", "{reqsJsonPath[0]['.spec.fieldName']['-']}", nil),
-}),
-```
-
-### Step 3: Add Sidebar Entry
-
-The sidebar entry adds navigation to the resource in the sidebar menu.
-
-**Location**: `internal/controller/dashboard/sidebar.go` in `ensureSidebar()`
-
-**3a. Add to keysAndTags** (around line 110-116):
-```go
-// Add sidebar for {group} {kind} resource
-keysAndTags["{plural}"] = []any{"{lowercase-kind}-sidebar"}
-```
-
-**3b. Add Sidebar Section** (if creating a new section, around line 169):
-```go
-// Add hardcoded {SectionName} section
-menuItems = append(menuItems, map[string]any{
-    "key":   "{section-key}",
-    "label": "{SectionName}",
-    "children": []any{
-        map[string]any{
-            "key":   "{plural}",
-            "label": "{ResourceLabel}",
-            "link":  "/openapi-ui/{clusterName}/{namespace}/api-table/{group}/{version}/{plural}",
-        },
-    },
-}),
-```
-
-**3c. Add Sidebar ID to targetIDs** (around line 220):
-```go
-"stock-project-factory-{lowercase-kind}-details",
-```
-
-**3d. Update Category Ordering** (if adding a new section):
-- Update the comment around line 29 to include the new section
-- Update `orderCategoryLabels()` function if needed
-- Add skip condition in the category loop (around line 149)
-
-**Important Notes**:
-- The sidebar tag (`{lowercase-kind}-sidebar`) must match what the Factory uses
-- The link format: `/openapi-ui/{clusterName}/{namespace}/api-table/{group}/{version}/{plural}`
-- All sidebars share the same `keysAndTags` and `menuItems`, so changes affect all sidebar instances
-
-### Step 4: Verify Integration
-
-1. **Check Factory-Sidebar Connection**:
-   - Factory uses `sidebarTags: ["{lowercase-kind}-sidebar"]`
-   - Sidebar has `keysAndTags["{plural}"] = []any{"{lowercase-kind}-sidebar"}`
-   - Sidebar ID `stock-project-factory-{lowercase-kind}-details` exists in `targetIDs`
-
-2. **Check Navigation Flow**:
-   - Sidebar link → List table (CustomColumnsOverride)
-   - List table Name column → Detail page (Factory)
-   - All paths use consistent naming
-
-3. **Test**:
-   - Verify the resource appears in the sidebar
-   - Verify the list table displays correctly
-   - Verify clicking a resource navigates to the detail page
-   - Verify the detail page displays all relevant fields
-
-## Common Patterns
-
-### Displaying Object References
-
-For fields that reference other resources (e.g., `applicationRef`, `storageRef`):
-
-```go
-// In CustomColumnsOverride
-createApplicationRefColumn("Application"),  // Uses helper function
-
-// In Factory details tab
-parsedText("application-ref-value", 
-    "{reqsJsonPath[0]['.spec.applicationRef.kind']['-']}.{reqsJsonPath[0]['.spec.applicationRef.apiGroup']['-']}/{reqsJsonPath[0]['.spec.applicationRef.name']['-']}", 
-    nil),
-```
-
-### Displaying Timestamps
-
-```go
-antdFlexVertical("created-block", 4, []any{
-    antdText("time-label", true, "Created", nil),
-    antdFlex("time-block", 6, []any{
-        map[string]any{
-            "type": "antdText",
-            "data": map[string]any{
-                "id":   "time-icon",
-                "text": "🌐",
-            },
-        },
-        map[string]any{
-            "type": "parsedText",
-            "data": map[string]any{
-                "formatter": "timestamp",
-                "id":        "time-value",
-                "text":      "{reqsJsonPath[0]['.metadata.creationTimestamp']['-']}",
-            },
-        },
-    }),
-}),
-```
-
-### Displaying Namespace with Link
-
-```go
-antdFlexVertical("meta-namespace-block", 8, []any{
-    antdText("meta-namespace-label", true, "Namespace", nil),
-    antdFlex("header-row", 6, []any{
-        // Badge component
-        map[string]any{
-            "type": "antdText",
-            "data": map[string]any{
-                "id":    "header-badge",
-                "text":  "NS",
-                "title": "namespace",
-                "style": map[string]any{
-                    "backgroundColor": "#a25792ff",
-                    // ... badge styles
-                },
-            },
-        },
-        // Link component
-        map[string]any{
-            "type": "antdLink",
-            "data": map[string]any{
-                "id":   "namespace-link",
-                "text": "{reqsJsonPath[0]['.metadata.namespace']['-']}",
-                "href": "/openapi-ui/{2}/{reqsJsonPath[0]['.metadata.namespace']['-']}/factory/marketplace",
-            },
-        },
-    }),
-}),
-```
-
-## File Reference
-
-- **CustomColumnsOverride**: `internal/controller/dashboard/static_refactored.go` → `CreateAllCustomColumnsOverrides()`
-- **Factory**: `internal/controller/dashboard/static_refactored.go` → `CreateAllFactories()`
-- **Sidebar**: `internal/controller/dashboard/sidebar.go` → `ensureSidebar()`
-- **Helper Functions**: `internal/controller/dashboard/static_helpers.go`
-- **UI Helpers**: `internal/controller/dashboard/ui_helpers.go`
-- **Unified Helpers**: `internal/controller/dashboard/unified_helpers.go`
-
-## AI Agent Prompt Template
-
-Use this template when asking an AI agent to add a new resource to the dashboard:
-
-```
-Please add support for the {ResourceKind} resource ({group}/{version}/{plural}) to the Cozystack dashboard.
-
-Resource Details:
-- API Group: {group}
-- Version: {version}
-- Kind: {ResourceKind}
-- Plural: {plural}
-- Namespaced: {true/false}
-
-Requirements:
-1. Add a CustomColumnsOverride in CreateAllCustomColumnsOverrides() with:
-   - ID: stock-namespace-/{group}/{version}/{plural}
-   - Name column with {ResourceKind} badge linking to /factory/{lowercase-kind}-details/{name}
-   - Additional columns: {list relevant columns}
-   
-2. Add a Factory in CreateAllFactories() with:
-   - Key: {lowercase-kind}-details
-   - API endpoint: /api/clusters/{2}/k8s/apis/{group}/{version}/namespaces/{3}/{plural}/{6}
-   - Details tab showing all spec fields:
-     {list spec fields to display}
-   - Use createUnifiedFactory() approach
-   
-3. Add sidebar entry in ensureSidebar():
-   - Add keysAndTags entry: keysAndTags["{plural}"] = []any{"{lowercase-kind}-sidebar"}
-   - Add sidebar section: {specify section name or "add to existing section"}
-   - Add to targetIDs: "stock-project-factory-{lowercase-kind}-details"
-   
-4. Ensure Factory sidebarTags matches the keysAndTags entry
-
-Please follow the existing patterns in the codebase, particularly the Plan resource implementation as a reference.
-```
-
-## Example: Plan Resource
-
-The Plan resource (`backups.cozystack.io/v1alpha1/plans`) serves as a complete reference implementation:
-
-- **CustomColumnsOverride**: [Diff](https://github.com/cozystack/cozystack/compare/1f0b5ff9ac0d9d8896af46f8a19501c8b728671d..88da2d1f642b6cf03873d368dfdc675de23f1513#diff-8309b1db3362715b3d94a8b0beae7e95d3ccaf248d4f8702aaa12fba398da895R374-R380) in `static_refactored.go`
-- **Factory**: [Diff](https://github.com/cozystack/cozystack/compare/1f0b5ff9ac0d9d8896af46f8a19501c8b728671d..88da2d1f642b6cf03873d368dfdc675de23f1513#diff-8309b1db3362715b3d94a8b0beae7e95d3ccaf248d4f8702aaa12fba398da895R1443-R1558) in `static_refactored.go`
-- **Sidebar**: [Diff](https://github.com/cozystack/cozystack/compare/1f0b5ff9ac0d9d8896af46f8a19501c8b728671d..88da2d1f642b6cf03873d368dfdc675de23f1513#diff-be79027f7179e457a8f10e225bb921a197ffa390eb8f916d8d21379fadd54a56) in `sidebar.go`
-- **Helper Function**: `createApplicationRefColumn()` in `static_helpers.go` ([diff](https://github.com/cozystack/cozystack/compare/1f0b5ff9ac0d9d8896af46f8a19501c8b728671d..88da2d1f642b6cf03873d368dfdc675de23f1513#diff-f17bcccc089cac3a8e965b13b9ab26e678d45bfc9a58d842399f218703e06a08R1026-R1046))
-
-Review [this implementation](https://github.com/cozystack/cozystack/compare/1f0b5ff9ac0d9d8896af46f8a19501c8b728671d..88da2d1f642b6cf03873d368dfdc675de23f1513) for a complete working example.
-
-## Troubleshooting
-
-### Resource doesn't appear in sidebar
-- Check that `keysAndTags["{plural}"]` is set correctly
-- Verify the sidebar section is added to `menuItems`
-- Ensure the sidebar ID is in `targetIDs`
-
-### Clicking resource doesn't navigate to detail page
-- Verify the CustomColumnsOverride href matches the Factory key
-- Check that the Factory key is exactly `{lowercase-kind}-details`
-- Ensure the Factory is added to the return list in `CreateAllFactories()`
-
-### Detail page shows wrong sidebar
-- Verify Factory `sidebarTags` matches `keysAndTags["{plural}"]`
-- Check that the sidebar ID `stock-project-factory-{lowercase-kind}-details` exists
-- Ensure all sidebars are updated (they share the same `keysAndTags`)
-
-### Fields not displaying correctly
-- Verify JSON paths are correct (use `.spec.fieldName` format)
-- Check that `reqsJsonPath[0]` index is used for single resource views
-- Ensure field names match the actual resource spec structure
-
-## Additional Resources
-
-- Kubernetes API Conventions: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md
-- Dashboard API Types: `api/dashboard/v1alpha1/`
-- Resource Types: `api/backups/v1alpha1/` (example)
-

internal/controller/dashboard/sidebar.go

@@ -26,7 +26,7 @@ import (
 //   - Tenant Info  (/openapi-ui/{clusterName}/{namespace}/factory/info-details/info)
 //   - All other sections are built from CRDs where spec.dashboard != nil.
 //   - Categories are ordered strictly as:
-//     Marketplace, IaaS, PaaS, NaaS, <others A→Z>, Resources, Backups, Administration
+//     Marketplace, IaaS, PaaS, NaaS, <others A→Z>, Resources, Administration
 //   - Items within each category: sort by Weight (desc), then Label (A→Z).
 func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.CozystackResourceDefinition) error {
 	// Build the full menu once.
@@ -112,15 +112,6 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Cozystack
 	keysAndTags["secrets"] = []any{"secret-sidebar"}
 	keysAndTags["ingresses"] = []any{"ingress-sidebar"}
 
-	// Add sidebar for backups.cozystack.io Plan resource
-	keysAndTags["plans"] = []any{"plan-sidebar"}
-
-	// Add sidebar for backups.cozystack.io BackupJob resource
-	keysAndTags["backupjobs"] = []any{"backupjob-sidebar"}
-
-	// Add sidebar for backups.cozystack.io Backup resource
-	keysAndTags["backups"] = []any{"backup-sidebar"}
-
 	// 3) Sort items within each category by Weight (desc), then Label (A→Z)
 	for cat := range categories {
 		sort.Slice(categories[cat], func(i, j int) bool {
@@ -132,10 +123,10 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Cozystack
 	}
 
 	// 4) Order categories strictly:
-	//    Marketplace (hardcoded), IaaS, PaaS, NaaS, <others A→Z>, Resources, Backups (hardcoded), Administration (hardcoded)
+	//    Marketplace (hardcoded), IaaS, PaaS, NaaS, <others A→Z>, Resources, Administration
 	orderedCats := orderCategoryLabels(categories)
 
-	// 5) Build menuItems (hardcode "Marketplace"; then dynamic categories; then hardcode "Backups" and "Administration")
+	// 5) Build menuItems (hardcode "Marketplace"; then dynamic categories; then hardcode "Administration")
 	menuItems := []any{
 		map[string]any{
 			"key":   "marketplace",
@@ -151,8 +142,8 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Cozystack
 	}
 
 	for _, cat := range orderedCats {
-		// Skip "Marketplace", "Backups", and "Administration" here since they're hardcoded
-		if strings.EqualFold(cat, "Marketplace") || strings.EqualFold(cat, "Backups") || strings.EqualFold(cat, "Administration") {
+		// Skip "Marketplace" and "Administration" here since they're hardcoded
+		if strings.EqualFold(cat, "Marketplace") || strings.EqualFold(cat, "Administration") {
 			continue
 		}
 		children := []any{}
@@ -172,29 +163,6 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Cozystack
 		}
 	}
 
-	// Add hardcoded Backups section
-	menuItems = append(menuItems, map[string]any{
-		"key":   "backups",
-		"label": "Backups",
-		"children": []any{
-			map[string]any{
-				"key":   "plans",
-				"label": "Plans",
-				"link":  "/openapi-ui/{clusterName}/{namespace}/api-table/backups.cozystack.io/v1alpha1/plans",
-			},
-			map[string]any{
-				"key":   "backupjobs",
-				"label": "BackupJobs",
-				"link":  "/openapi-ui/{clusterName}/{namespace}/api-table/backups.cozystack.io/v1alpha1/backupjobs",
-			},
-			map[string]any{
-				"key":   "backups",
-				"label": "Backups",
-				"link":  "/openapi-ui/{clusterName}/{namespace}/api-table/backups.cozystack.io/v1alpha1/backups",
-			},
-		},
-	})
-
 	// Add hardcoded Administration section
 	menuItems = append(menuItems, map[string]any{
 		"key":   "administration",
@@ -233,9 +201,6 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Cozystack
 		"stock-project-factory-kube-service-details",
 		"stock-project-factory-kube-secret-details",
 		"stock-project-factory-kube-ingress-details",
-		"stock-project-factory-plan-details",
-		"stock-project-factory-backupjob-details",
-		"stock-project-factory-backup-details",
 		"stock-project-api-form",
 		"stock-project-api-table",
 		"stock-project-builtin-form",

internal/controller/dashboard/static_helpers.go

@@ -1023,27 +1023,6 @@ func createReadyColumn() map[string]any {
 	}
 }
 
-// createApplicationRefColumn creates a column that displays
-// applicationRef in the format "Kind.apiGroup/name"
-func createApplicationRefColumn(name string) map[string]any {
-	return map[string]any{
-		"name": name,
-		"type": "factory",
-		"customProps": map[string]any{
-			"disableEventBubbling": true,
-			"items": []any{
-				map[string]any{
-					"type": "parsedText",
-					"data": map[string]any{
-						"id":   "application-ref-text",
-						"text": "{reqsJsonPath[0]['.spec.applicationRef.kind']['-']}.{reqsJsonPath[0]['.spec.applicationRef.apiGroup']['-']}/{reqsJsonPath[0]['.spec.applicationRef.name']['-']}",
-					},
-				},
-			},
-		},
-	}
-}
-
 // createConverterBytesColumn creates a column with ConverterBytes component
 func createConverterBytesColumn(name, jsonPath string) map[string]any {
 	return map[string]any{

internal/controller/dashboard/static_refactored.go

@@ -371,30 +371,6 @@ func CreateAllCustomColumnsOverrides() []*dashboardv1alpha1.CustomColumnsOverrid
 			createCustomColumnWithJsonPath("Name", ".metadata.name", "TenantNamespace", "", "/openapi-ui/{2}/{reqsJsonPath[0]['.metadata.name']['-']}/factory/marketplace"),
 			createTimestampColumn("Created", ".metadata.creationTimestamp"),
 		}),
-
-		// Stock namespace backups cozystack io v1alpha1 plans
-		createCustomColumnsOverride("stock-namespace-/backups.cozystack.io/v1alpha1/plans", []any{
-			createCustomColumnWithJsonPath("Name", ".metadata.name", "Plan", "", "/openapi-ui/{2}/{reqsJsonPath[0]['.metadata.namespace']['-']}/factory/plan-details/{reqsJsonPath[0]['.metadata.name']['-']}"),
-			createApplicationRefColumn("Application"),
-			createTimestampColumn("Created", ".metadata.creationTimestamp"),
-		}),
-
-		// Stock namespace backups cozystack io v1alpha1 backupjobs
-		createCustomColumnsOverride("stock-namespace-/backups.cozystack.io/v1alpha1/backupjobs", []any{
-			createCustomColumnWithJsonPath("Name", ".metadata.name", "BackupJob", "", "/openapi-ui/{2}/{reqsJsonPath[0]['.metadata.namespace']['-']}/factory/backupjob-details/{reqsJsonPath[0]['.metadata.name']['-']}"),
-			createStringColumn("Phase", ".status.phase"),
-			createApplicationRefColumn("Application"),
-			createTimestampColumn("Created", ".metadata.creationTimestamp"),
-		}),
-
-		// Stock namespace backups cozystack io v1alpha1 backups
-		createCustomColumnsOverride("stock-namespace-/backups.cozystack.io/v1alpha1/backups", []any{
-			createCustomColumnWithJsonPath("Name", ".metadata.name", "Backup", "", "/openapi-ui/{2}/{reqsJsonPath[0]['.metadata.namespace']['-']}/factory/backup-details/{reqsJsonPath[0]['.metadata.name']['-']}"),
-			createStringColumn("Phase", ".status.phase"),
-			createApplicationRefColumn("Application"),
-			createTimestampColumn("Taken At", ".spec.takenAt"),
-			createTimestampColumn("Created", ".metadata.creationTimestamp"),
-		}),
 	}
 }
 
@@ -1457,434 +1433,6 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 	}
 	workloadmonitorSpec := createFactorySpec("workloadmonitor-details", []any{"workloadmonitor-sidebar"}, []any{"/api/clusters/{2}/k8s/apis/cozystack.io/v1alpha1/namespaces/{3}/workloadmonitors/{6}"}, workloadmonitorHeader, workloadmonitorTabs)
 
-	// Plan details factory using unified approach
-	planConfig := UnifiedResourceConfig{
-		Name:         "plan-details",
-		ResourceType: "factory",
-		Kind:         "Plan",
-		Plural:       "plans",
-		Title:        "plan",
-	}
-	planTabs := []any{
-		map[string]any{
-			"key":   "details",
-			"label": "Details",
-			"children": []any{
-				contentCard("details-card", map[string]any{
-					"marginBottom": "24px",
-				}, []any{
-					antdText("details-title", true, "Plan details", map[string]any{
-						"fontSize":     20,
-						"marginBottom": "12px",
-					}),
-					spacer("details-spacer", 16),
-					antdRow("details-grid", []any{48, 12}, []any{
-						antdCol("col-left", 12, []any{
-							antdFlexVertical("col-left-stack", 24, []any{
-								antdFlexVertical("meta-name-block", 4, []any{
-									antdText("meta-name-label", true, "Name", nil),
-									parsedText("meta-name-value", "{reqsJsonPath[0]['.metadata.name']['-']}", nil),
-								}),
-								antdFlexVertical("meta-namespace-block", 8, []any{
-									antdText("meta-namespace-label", true, "Namespace", nil),
-									antdFlex("header-row", 6, []any{
-										map[string]any{
-											"type": "antdText",
-											"data": map[string]any{
-												"id":    "header-badge",
-												"text":  "NS",
-												"title": "namespace",
-												"style": map[string]any{
-													"backgroundColor": "#a25792ff",
-													"borderRadius":    "20px",
-													"color":           "#fff",
-													"display":         "inline-block",
-													"fontFamily":      "RedHatDisplay, Overpass, overpass, helvetica, arial, sans-serif",
-													"fontSize":        "15px",
-													"fontWeight":      400,
-													"lineHeight":      "24px",
-													"minWidth":        24,
-													"padding":         "0 9px",
-													"textAlign":       "center",
-													"whiteSpace":      "nowrap",
-												},
-											},
-										},
-										map[string]any{
-											"type": "antdLink",
-											"data": map[string]any{
-												"id":   "namespace-link",
-												"text": "{reqsJsonPath[0]['.metadata.namespace']['-']}",
-												"href": "/openapi-ui/{2}/{reqsJsonPath[0]['.metadata.namespace']['-']}/factory/marketplace",
-											},
-										},
-									}),
-								}),
-								antdFlexVertical("meta-created-block", 4, []any{
-									antdText("time-label", true, "Created", nil),
-									antdFlex("time-block", 6, []any{
-										map[string]any{
-											"type": "antdText",
-											"data": map[string]any{
-												"id":   "time-icon",
-												"text": "🌐",
-											},
-										},
-										map[string]any{
-											"type": "parsedText",
-											"data": map[string]any{
-												"formatter": "timestamp",
-												"id":        "time-value",
-												"text":      "{reqsJsonPath[0]['.metadata.creationTimestamp']['-']}",
-											},
-										},
-									}),
-								}),
-							}),
-						}),
-						antdCol("col-right", 12, []any{
-							antdFlexVertical("col-right-stack", 24, []any{
-								antdFlexVertical("spec-application-ref-block", 4, []any{
-									antdText("application-ref-label", true, "Application", nil),
-									parsedText("application-ref-value", "{reqsJsonPath[0]['.spec.applicationRef.kind']['-']}.{reqsJsonPath[0]['.spec.applicationRef.apiGroup']['-']}/{reqsJsonPath[0]['.spec.applicationRef.name']['-']}", nil),
-								}),
-								antdFlexVertical("spec-storage-ref-block", 4, []any{
-									antdText("storage-ref-label", true, "Storage", nil),
-									parsedText("storage-ref-value", "{reqsJsonPath[0]['.spec.storageRef.kind']['-']}.{reqsJsonPath[0]['.spec.storageRef.apiGroup']['-']}/{reqsJsonPath[0]['.spec.storageRef.name']['-']}", nil),
-								}),
-								antdFlexVertical("spec-strategy-ref-block", 4, []any{
-									antdText("strategy-ref-label", true, "Strategy", nil),
-									parsedText("strategy-ref-value", "{reqsJsonPath[0]['.spec.strategyRef.kind']['-']}.{reqsJsonPath[0]['.spec.strategyRef.apiGroup']['-']}/{reqsJsonPath[0]['.spec.strategyRef.name']['-']}", nil),
-								}),
-								antdFlexVertical("spec-schedule-type-block", 4, []any{
-									antdText("schedule-type-label", true, "Schedule Type", nil),
-									parsedText("schedule-type-value", "{reqsJsonPath[0]['.spec.schedule.type']['-']}", nil),
-								}),
-								antdFlexVertical("spec-schedule-cron-block", 4, []any{
-									antdText("schedule-cron-label", true, "Schedule Cron", nil),
-									parsedText("schedule-cron-value", "{reqsJsonPath[0]['.spec.schedule.cron']['-']}", nil),
-								}),
-							}),
-						}),
-					}),
-				}),
-			},
-		},
-	}
-	planSpec := createUnifiedFactory(planConfig, planTabs, []any{"/api/clusters/{2}/k8s/apis/backups.cozystack.io/v1alpha1/namespaces/{3}/plans/{6}"})
-
-	// BackupJob details factory using unified approach
-	backupJobConfig := UnifiedResourceConfig{
-		Name:         "backupjob-details",
-		ResourceType: "factory",
-		Kind:         "BackupJob",
-		Plural:       "backupjobs",
-		Title:        "backupjob",
-	}
-	backupJobTabs := []any{
-		map[string]any{
-			"key":   "details",
-			"label": "Details",
-			"children": []any{
-				contentCard("details-card", map[string]any{
-					"marginBottom": "24px",
-				}, []any{
-					antdText("details-title", true, "BackupJob details", map[string]any{
-						"fontSize":     20,
-						"marginBottom": "12px",
-					}),
-					spacer("details-spacer", 16),
-					antdRow("details-grid", []any{48, 12}, []any{
-						antdCol("col-left", 12, []any{
-							antdFlexVertical("col-left-stack", 24, []any{
-								antdFlexVertical("meta-name-block", 4, []any{
-									antdText("meta-name-label", true, "Name", nil),
-									parsedText("meta-name-value", "{reqsJsonPath[0]['.metadata.name']['-']}", nil),
-								}),
-								antdFlexVertical("meta-namespace-block", 8, []any{
-									antdText("meta-namespace-label", true, "Namespace", nil),
-									antdFlex("header-row", 6, []any{
-										map[string]any{
-											"type": "antdText",
-											"data": map[string]any{
-												"id":    "header-badge",
-												"text":  "NS",
-												"title": "namespace",
-												"style": map[string]any{
-													"backgroundColor": "#a25792ff",
-													"borderRadius":    "20px",
-													"color":           "#fff",
-													"display":         "inline-block",
-													"fontFamily":      "RedHatDisplay, Overpass, overpass, helvetica, arial, sans-serif",
-													"fontSize":        "15px",
-													"fontWeight":      400,
-													"lineHeight":      "24px",
-													"minWidth":        24,
-													"padding":         "0 9px",
-													"textAlign":       "center",
-													"whiteSpace":      "nowrap",
-												},
-											},
-										},
-										map[string]any{
-											"type": "antdLink",
-											"data": map[string]any{
-												"id":   "namespace-link",
-												"text": "{reqsJsonPath[0]['.metadata.namespace']['-']}",
-												"href": "/openapi-ui/{2}/{reqsJsonPath[0]['.metadata.namespace']['-']}/factory/marketplace",
-											},
-										},
-									}),
-								}),
-								antdFlexVertical("meta-created-block", 4, []any{
-									antdText("time-label", true, "Created", nil),
-									antdFlex("time-block", 6, []any{
-										map[string]any{
-											"type": "antdText",
-											"data": map[string]any{
-												"id":   "time-icon",
-												"text": "🌐",
-											},
-										},
-										map[string]any{
-											"type": "parsedText",
-											"data": map[string]any{
-												"formatter": "timestamp",
-												"id":        "time-value",
-												"text":      "{reqsJsonPath[0]['.metadata.creationTimestamp']['-']}",
-											},
-										},
-									}),
-								}),
-							}),
-						}),
-						antdCol("col-right", 12, []any{
-							antdFlexVertical("col-right-stack", 24, []any{
-								antdFlexVertical("status-phase-block", 4, []any{
-									antdText("phase-label", true, "Phase", nil),
-									parsedText("phase-value", "{reqsJsonPath[0]['.status.phase']['-']}", nil),
-								}),
-								antdFlexVertical("spec-plan-ref-block", 4, []any{
-									antdText("plan-ref-label", true, "Plan Ref", nil),
-									parsedText("plan-ref-value", "{reqsJsonPath[0]['.spec.planRef.name']['-']}", nil),
-								}),
-								antdFlexVertical("spec-application-ref-block", 4, []any{
-									antdText("application-ref-label", true, "Application", nil),
-									parsedText("application-ref-value", "{reqsJsonPath[0]['.spec.applicationRef.kind']['-']}.{reqsJsonPath[0]['.spec.applicationRef.apiGroup']['-']}/{reqsJsonPath[0]['.spec.applicationRef.name']['-']}", nil),
-								}),
-								antdFlexVertical("spec-storage-ref-block", 4, []any{
-									antdText("storage-ref-label", true, "Storage", nil),
-									parsedText("storage-ref-value", "{reqsJsonPath[0]['.spec.storageRef.kind']['-']}.{reqsJsonPath[0]['.spec.storageRef.apiGroup']['-']}/{reqsJsonPath[0]['.spec.storageRef.name']['-']}", nil),
-								}),
-								antdFlexVertical("spec-strategy-ref-block", 4, []any{
-									antdText("strategy-ref-label", true, "Strategy", nil),
-									parsedText("strategy-ref-value", "{reqsJsonPath[0]['.spec.strategyRef.name']['-']}", nil),
-								}),
-								antdFlexVertical("status-backup-ref-block", 4, []any{
-									antdText("backup-ref-label", true, "Backup Ref", nil),
-									parsedText("backup-ref-value", "{reqsJsonPath[0]['.status.backupRef.name']['-']}", nil),
-								}),
-								antdFlexVertical("status-started-at-block", 4, []any{
-									antdText("started-at-label", true, "Started At", nil),
-									antdFlex("time-block", 6, []any{
-										map[string]any{
-											"type": "antdText",
-											"data": map[string]any{
-												"id":   "time-icon",
-												"text": "🌐",
-											},
-										},
-										map[string]any{
-											"type": "parsedText",
-											"data": map[string]any{
-												"formatter": "timestamp",
-												"id":        "time-value",
-												"text":      "{reqsJsonPath[0]['.status.startedAt']['-']}",
-											},
-										},
-									}),
-								}),
-								antdFlexVertical("status-completed-at-block", 4, []any{
-									antdText("completed-at-label", true, "Completed At", nil),
-									antdFlex("time-block", 6, []any{
-										map[string]any{
-											"type": "antdText",
-											"data": map[string]any{
-												"id":   "time-icon",
-												"text": "🌐",
-											},
-										},
-										map[string]any{
-											"type": "parsedText",
-											"data": map[string]any{
-												"formatter": "timestamp",
-												"id":        "time-value",
-												"text":      "{reqsJsonPath[0]['.status.completedAt']['-']}",
-											},
-										},
-									}),
-								}),
-								antdFlexVertical("status-message-block", 4, []any{
-									antdText("message-label", true, "Message", nil),
-									parsedText("message-value", "{reqsJsonPath[0]['.status.message']['-']}", nil),
-								}),
-							}),
-						}),
-					}),
-				}),
-			},
-		},
-	}
-	backupJobSpec := createUnifiedFactory(backupJobConfig, backupJobTabs, []any{"/api/clusters/{2}/k8s/apis/backups.cozystack.io/v1alpha1/namespaces/{3}/backupjobs/{6}"})
-
-	// Backup details factory using unified approach
-	backupConfig := UnifiedResourceConfig{
-		Name:         "backup-details",
-		ResourceType: "factory",
-		Kind:         "Backup",
-		Plural:       "backups",
-		Title:        "backup",
-	}
-	backupTabs := []any{
-		map[string]any{
-			"key":   "details",
-			"label": "Details",
-			"children": []any{
-				contentCard("details-card", map[string]any{
-					"marginBottom": "24px",
-				}, []any{
-					antdText("details-title", true, "Backup details", map[string]any{
-						"fontSize":     20,
-						"marginBottom": "12px",
-					}),
-					spacer("details-spacer", 16),
-					antdRow("details-grid", []any{48, 12}, []any{
-						antdCol("col-left", 12, []any{
-							antdFlexVertical("col-left-stack", 24, []any{
-								antdFlexVertical("meta-name-block", 4, []any{
-									antdText("meta-name-label", true, "Name", nil),
-									parsedText("meta-name-value", "{reqsJsonPath[0]['.metadata.name']['-']}", nil),
-								}),
-								antdFlexVertical("meta-namespace-block", 8, []any{
-									antdText("meta-namespace-label", true, "Namespace", nil),
-									antdFlex("header-row", 6, []any{
-										map[string]any{
-											"type": "antdText",
-											"data": map[string]any{
-												"id":    "header-badge",
-												"text":  "NS",
-												"title": "namespace",
-												"style": map[string]any{
-													"backgroundColor": "#a25792ff",
-													"borderRadius":    "20px",
-													"color":           "#fff",
-													"display":         "inline-block",
-													"fontFamily":      "RedHatDisplay, Overpass, overpass, helvetica, arial, sans-serif",
-													"fontSize":        "15px",
-													"fontWeight":      400,
-													"lineHeight":      "24px",
-													"minWidth":        24,
-													"padding":         "0 9px",
-													"textAlign":       "center",
-													"whiteSpace":      "nowrap",
-												},
-											},
-										},
-										map[string]any{
-											"type": "antdLink",
-											"data": map[string]any{
-												"id":   "namespace-link",
-												"text": "{reqsJsonPath[0]['.metadata.namespace']['-']}",
-												"href": "/openapi-ui/{2}/{reqsJsonPath[0]['.metadata.namespace']['-']}/factory/marketplace",
-											},
-										},
-									}),
-								}),
-								antdFlexVertical("meta-created-block", 4, []any{
-									antdText("time-label", true, "Created", nil),
-									antdFlex("time-block", 6, []any{
-										map[string]any{
-											"type": "antdText",
-											"data": map[string]any{
-												"id":   "time-icon",
-												"text": "🌐",
-											},
-										},
-										map[string]any{
-											"type": "parsedText",
-											"data": map[string]any{
-												"formatter": "timestamp",
-												"id":        "time-value",
-												"text":      "{reqsJsonPath[0]['.metadata.creationTimestamp']['-']}",
-											},
-										},
-									}),
-								}),
-							}),
-						}),
-						antdCol("col-right", 12, []any{
-							antdFlexVertical("col-right-stack", 24, []any{
-								antdFlexVertical("status-phase-block", 4, []any{
-									antdText("phase-label", true, "Phase", nil),
-									parsedText("phase-value", "{reqsJsonPath[0]['.status.phase']['-']}", nil),
-								}),
-								antdFlexVertical("spec-taken-at-block", 4, []any{
-									antdText("taken-at-label", true, "Taken At", nil),
-									antdFlex("time-block", 6, []any{
-										map[string]any{
-											"type": "antdText",
-											"data": map[string]any{
-												"id":   "time-icon",
-												"text": "🌐",
-											},
-										},
-										map[string]any{
-											"type": "parsedText",
-											"data": map[string]any{
-												"formatter": "timestamp",
-												"id":        "time-value",
-												"text":      "{reqsJsonPath[0]['.spec.takenAt']['-']}",
-											},
-										},
-									}),
-								}),
-								antdFlexVertical("spec-plan-ref-block", 4, []any{
-									antdText("plan-ref-label", true, "Plan Ref", nil),
-									parsedText("plan-ref-value", "{reqsJsonPath[0]['.spec.planRef.name']['-']}", nil),
-								}),
-								antdFlexVertical("spec-application-ref-block", 4, []any{
-									antdText("application-ref-label", true, "Application", nil),
-									parsedText("application-ref-value", "{reqsJsonPath[0]['.spec.applicationRef.kind']['-']}.{reqsJsonPath[0]['.spec.applicationRef.apiGroup']['-']}/{reqsJsonPath[0]['.spec.applicationRef.name']['-']}", nil),
-								}),
-								antdFlexVertical("spec-storage-ref-block", 4, []any{
-									antdText("storage-ref-label", true, "Storage", nil),
-									parsedText("storage-ref-value", "{reqsJsonPath[0]['.spec.storageRef.kind']['-']}.{reqsJsonPath[0]['.spec.storageRef.apiGroup']['-']}/{reqsJsonPath[0]['.spec.storageRef.name']['-']}", nil),
-								}),
-								antdFlexVertical("spec-strategy-ref-block", 4, []any{
-									antdText("strategy-ref-label", true, "Strategy", nil),
-									parsedText("strategy-ref-value", "{reqsJsonPath[0]['.spec.strategyRef.kind']['-']}.{reqsJsonPath[0]['.spec.strategyRef.apiGroup']['-']}/{reqsJsonPath[0]['.spec.strategyRef.name']['-']}", nil),
-								}),
-								antdFlexVertical("status-artifact-uri-block", 4, []any{
-									antdText("artifact-uri-label", true, "Artifact URI", nil),
-									parsedText("artifact-uri-value", "{reqsJsonPath[0]['.status.artifact.uri']['-']}", nil),
-								}),
-								antdFlexVertical("status-artifact-size-block", 4, []any{
-									antdText("artifact-size-label", true, "Artifact Size", nil),
-									parsedText("artifact-size-value", "{reqsJsonPath[0]['.status.artifact.sizeBytes']['-']}", nil),
-								}),
-								antdFlexVertical("status-artifact-checksum-block", 4, []any{
-									antdText("artifact-checksum-label", true, "Artifact Checksum", nil),
-									parsedText("artifact-checksum-value", "{reqsJsonPath[0]['.status.artifact.checksum']['-']}", nil),
-								}),
-							}),
-						}),
-					}),
-				}),
-			},
-		},
-	}
-	backupSpec := createUnifiedFactory(backupConfig, backupTabs, []any{"/api/clusters/{2}/k8s/apis/backups.cozystack.io/v1alpha1/namespaces/{3}/backups/{6}"})
-
 	return []*dashboardv1alpha1.Factory{
 		createFactory("marketplace", marketplaceSpec),
 		createFactory("namespace-details", namespaceSpec),
@@ -1894,9 +1442,6 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 		createFactory("kube-service-details", serviceSpec),
 		createFactory("kube-ingress-details", ingressSpec),
 		createFactory("workloadmonitor-details", workloadmonitorSpec),
-		createFactory("plan-details", planSpec),
-		createFactory("backupjob-details", backupJobSpec),
-		createFactory("backup-details", backupSpec),
 	}
 }
 

internal/fluxinstall/install.go

@@ -0,0 +1,352 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fluxinstall
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/serializer/yaml"
+	k8syaml "k8s.io/apimachinery/pkg/util/yaml"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+)
+
+// Install installs Flux components using embedded manifests.
+// It extracts the manifests and applies them to the cluster.
+// The namespace is automatically determined from the Namespace object in the manifests.
+func Install(ctx context.Context, k8sClient client.Client, writeEmbeddedManifests func(string) error) error {
+	logger := log.FromContext(ctx)
+
+	// Create temporary directory for manifests
+	tmpDir, err := os.MkdirTemp("", "flux-install-*")
+	if err != nil {
+		return fmt.Errorf("failed to create temp directory: %w", err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	// Extract embedded manifests (generated by cozypkg)
+	manifestsDir := filepath.Join(tmpDir, "manifests")
+	if err := os.MkdirAll(manifestsDir, 0755); err != nil {
+		return fmt.Errorf("failed to create manifests directory: %w", err)
+	}
+
+	if err := writeEmbeddedManifests(manifestsDir); err != nil {
+		return fmt.Errorf("failed to extract embedded manifests: %w", err)
+	}
+
+	// Find the manifest file (should be fluxcd.yaml from cozypkg)
+	manifestPath := filepath.Join(manifestsDir, "fluxcd.yaml")
+	if _, err := os.Stat(manifestPath); err != nil {
+		// Try to find any YAML file if fluxcd.yaml doesn't exist
+		entries, err := os.ReadDir(manifestsDir)
+		if err != nil {
+			return fmt.Errorf("failed to read manifests directory: %w", err)
+		}
+		for _, entry := range entries {
+			if strings.HasSuffix(entry.Name(), ".yaml") {
+				manifestPath = filepath.Join(manifestsDir, entry.Name())
+				break
+			}
+		}
+	}
+
+	// Parse and apply manifests
+	objects, err := parseManifests(manifestPath)
+	if err != nil {
+		return fmt.Errorf("failed to parse manifests: %w", err)
+	}
+
+	if len(objects) == 0 {
+		return fmt.Errorf("no objects found in manifests")
+	}
+
+	// Inject KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT if set in operator environment
+	if err := injectKubernetesServiceEnv(objects); err != nil {
+		logger.Info("Failed to inject KUBERNETES_SERVICE_* env vars, continuing anyway", "error", err)
+	}
+
+	// Extract namespace from Namespace object in manifests
+	namespace, err := extractNamespace(objects)
+	if err != nil {
+		return fmt.Errorf("failed to extract namespace from manifests: %w", err)
+	}
+
+	logger.Info("Installing Flux components", "namespace", namespace)
+
+	// Apply manifests using server-side apply
+	logger.Info("Applying Flux manifests", "count", len(objects), "manifest", manifestPath, "namespace", namespace)
+	if err := applyManifests(ctx, k8sClient, objects); err != nil {
+		return fmt.Errorf("failed to apply manifests: %w", err)
+	}
+
+	logger.Info("Flux installation completed successfully")
+	return nil
+}
+
+// parseManifests parses YAML manifests into unstructured objects.
+func parseManifests(manifestPath string) ([]*unstructured.Unstructured, error) {
+	data, err := os.ReadFile(manifestPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read manifest file: %w", err)
+	}
+
+	return readYAMLObjects(bytes.NewReader(data))
+}
+
+// readYAMLObjects parses multi-document YAML into unstructured objects.
+func readYAMLObjects(reader io.Reader) ([]*unstructured.Unstructured, error) {
+	var objects []*unstructured.Unstructured
+	yamlReader := k8syaml.NewYAMLReader(bufio.NewReader(reader))
+
+	for {
+		doc, err := yamlReader.Read()
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+			return nil, fmt.Errorf("failed to read YAML document: %w", err)
+		}
+
+		// Skip empty documents
+		if len(bytes.TrimSpace(doc)) == 0 {
+			continue
+		}
+
+		obj := &unstructured.Unstructured{}
+		decoder := k8syaml.NewYAMLOrJSONDecoder(bytes.NewReader(doc), len(doc))
+		if err := decoder.Decode(obj); err != nil {
+			// Skip documents that can't be decoded (might be comments or empty)
+			if err == io.EOF {
+				continue
+			}
+			return nil, fmt.Errorf("failed to decode YAML document: %w", err)
+		}
+
+		// Skip empty objects (no kind)
+		if obj.GetKind() == "" {
+			continue
+		}
+
+		objects = append(objects, obj)
+	}
+
+	return objects, nil
+}
+
+// applyManifests applies Kubernetes objects using server-side apply.
+func applyManifests(ctx context.Context, k8sClient client.Client, objects []*unstructured.Unstructured) error {
+	logger := log.FromContext(ctx)
+	decoder := yaml.NewDecodingSerializer(unstructured.UnstructuredJSONScheme)
+
+	// Separate CRDs and namespaces from other resources
+	var stageOne []*unstructured.Unstructured // CRDs and Namespaces
+	var stageTwo []*unstructured.Unstructured // Everything else
+
+	for _, obj := range objects {
+		if isClusterDefinition(obj) {
+			stageOne = append(stageOne, obj)
+		} else {
+			stageTwo = append(stageTwo, obj)
+		}
+	}
+
+	// Apply stage one (CRDs and Namespaces) first
+	if len(stageOne) > 0 {
+		logger.Info("Applying cluster definitions", "count", len(stageOne))
+		if err := applyObjects(ctx, k8sClient, decoder, stageOne); err != nil {
+			return fmt.Errorf("failed to apply cluster definitions: %w", err)
+		}
+
+		// Wait a bit for CRDs to be registered
+		time.Sleep(2 * time.Second)
+	}
+
+	// Apply stage two (everything else)
+	if len(stageTwo) > 0 {
+		logger.Info("Applying resources", "count", len(stageTwo))
+		if err := applyObjects(ctx, k8sClient, decoder, stageTwo); err != nil {
+			return fmt.Errorf("failed to apply resources: %w", err)
+		}
+	}
+
+	return nil
+}
+
+// applyObjects applies a list of objects using server-side apply.
+func applyObjects(ctx context.Context, k8sClient client.Client, decoder runtime.Decoder, objects []*unstructured.Unstructured) error {
+	for _, obj := range objects {
+		// Use server-side apply with force ownership and field manager
+		// FieldManager is required for apply patch operations
+		patchOptions := &client.PatchOptions{
+			FieldManager: "cozystack-operator",
+			Force:        func() *bool { b := true; return &b }(),
+		}
+
+		if err := k8sClient.Patch(ctx, obj, client.Apply, patchOptions); err != nil {
+			return fmt.Errorf("failed to apply object %s/%s: %w", obj.GetKind(), obj.GetName(), err)
+		}
+	}
+	return nil
+}
+
+
+// extractNamespace extracts the namespace name from the Namespace object in the manifests.
+func extractNamespace(objects []*unstructured.Unstructured) (string, error) {
+	for _, obj := range objects {
+		if obj.GetKind() == "Namespace" {
+			namespace := obj.GetName()
+			if namespace == "" {
+				return "", fmt.Errorf("Namespace object has no name")
+			}
+			return namespace, nil
+		}
+	}
+	return "", fmt.Errorf("no Namespace object found in manifests")
+}
+
+// isClusterDefinition checks if an object is a CRD or Namespace.
+func isClusterDefinition(obj *unstructured.Unstructured) bool {
+	kind := obj.GetKind()
+	return kind == "CustomResourceDefinition" || kind == "Namespace"
+}
+
+// injectKubernetesServiceEnv injects KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT
+// environment variables into all containers of Deployment, StatefulSet, and DaemonSet objects
+// if these variables are set in the operator's environment.
+func injectKubernetesServiceEnv(objects []*unstructured.Unstructured) error {
+	kubernetesHost := os.Getenv("KUBERNETES_SERVICE_HOST")
+	kubernetesPort := os.Getenv("KUBERNETES_SERVICE_PORT")
+
+	// If neither variable is set, nothing to do
+	if kubernetesHost == "" && kubernetesPort == "" {
+		return nil
+	}
+
+	for _, obj := range objects {
+		kind := obj.GetKind()
+		if kind != "Deployment" && kind != "StatefulSet" && kind != "DaemonSet" {
+			continue
+		}
+
+		// Navigate to spec.template.spec.containers
+		spec, found, err := unstructured.NestedMap(obj.Object, "spec", "template", "spec")
+		if !found || err != nil {
+			continue
+		}
+
+		// Update containers
+		containers, found, err := unstructured.NestedSlice(spec, "containers")
+		if found && err == nil {
+			containers = updateContainersEnv(containers, kubernetesHost, kubernetesPort)
+			if err := unstructured.SetNestedSlice(spec, containers, "containers"); err != nil {
+				continue
+			}
+		}
+
+		// Update initContainers
+		initContainers, found, err := unstructured.NestedSlice(spec, "initContainers")
+		if found && err == nil {
+			initContainers = updateContainersEnv(initContainers, kubernetesHost, kubernetesPort)
+			if err := unstructured.SetNestedSlice(spec, initContainers, "initContainers"); err != nil {
+				continue
+			}
+		}
+
+		// Update spec in the object
+		if err := unstructured.SetNestedMap(obj.Object, spec, "spec", "template", "spec"); err != nil {
+			continue
+		}
+	}
+
+	return nil
+}
+
+// updateContainersEnv updates environment variables for a slice of containers.
+func updateContainersEnv(containers []interface{}, kubernetesHost, kubernetesPort string) []interface{} {
+	for i, container := range containers {
+		containerMap, ok := container.(map[string]interface{})
+		if !ok {
+			continue
+		}
+
+		env, found, err := unstructured.NestedSlice(containerMap, "env")
+		if err != nil {
+			continue
+		}
+
+		if !found {
+			env = []interface{}{}
+		}
+
+		// Update or add KUBERNETES_SERVICE_HOST
+		if kubernetesHost != "" {
+			env = setEnvVar(env, "KUBERNETES_SERVICE_HOST", kubernetesHost)
+		}
+
+		// Update or add KUBERNETES_SERVICE_PORT
+		if kubernetesPort != "" {
+			env = setEnvVar(env, "KUBERNETES_SERVICE_PORT", kubernetesPort)
+		}
+
+		// Update the container's env
+		if err := unstructured.SetNestedSlice(containerMap, env, "env"); err != nil {
+			continue
+		}
+
+		// Update the container in the slice
+		containers[i] = containerMap
+	}
+
+	return containers
+}
+
+// setEnvVar updates or adds an environment variable in the env slice.
+func setEnvVar(env []interface{}, name, value string) []interface{} {
+	// Check if variable already exists
+	for i, envVar := range env {
+		envVarMap, ok := envVar.(map[string]interface{})
+		if !ok {
+			continue
+		}
+
+		if envVarMap["name"] == name {
+			// Update existing variable
+			envVarMap["value"] = value
+			env[i] = envVarMap
+			return env
+		}
+	}
+
+	// Add new variable
+	env = append(env, map[string]interface{}{
+		"name":  name,
+		"value": value,
+	})
+
+	return env
+}
+

internal/fluxinstall/manifests.embed.go

@@ -0,0 +1,51 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fluxinstall
+
+import (
+	"embed"
+	"fmt"
+	"io/fs"
+	"os"
+	"path"
+)
+
+//go:embed manifests/*.yaml
+var embeddedFluxManifests embed.FS
+
+// WriteEmbeddedManifests extracts embedded Flux manifests to a temporary directory.
+func WriteEmbeddedManifests(dir string) error {
+	manifests, err := fs.ReadDir(embeddedFluxManifests, "manifests")
+	if err != nil {
+		return fmt.Errorf("failed to read embedded manifests: %w", err)
+	}
+
+	for _, manifest := range manifests {
+		data, err := fs.ReadFile(embeddedFluxManifests, path.Join("manifests", manifest.Name()))
+		if err != nil {
+			return fmt.Errorf("failed to read file %s: %w", manifest.Name(), err)
+		}
+
+		outputPath := path.Join(dir, manifest.Name())
+		if err := os.WriteFile(outputPath, data, 0666); err != nil {
+			return fmt.Errorf("failed to write file %s: %w", outputPath, err)
+		}
+	}
+
+	return nil
+}
+

internal/lineagecontrollerwebhook/config.go

@@ -2,49 +2,72 @@ package lineagecontrollerwebhook
 
 import (
 	"fmt"
+	"strings"
 
 	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
 	helmv2 "github.com/fluxcd/helm-controller/api/v2"
 )
 
-type chartRef struct {
-	repo  string
-	chart string
-}
-
 type appRef struct {
 	group string
 	kind  string
 }
 
 type runtimeConfig struct {
-	chartAppMap map[chartRef]*cozyv1alpha1.CozystackResourceDefinition
-	appCRDMap   map[appRef]*cozyv1alpha1.CozystackResourceDefinition
+	appCRDMap map[appRef]*cozyv1alpha1.CozystackResourceDefinition
 }
 
 func (l *LineageControllerWebhook) initConfig() {
 	l.initOnce.Do(func() {
 		if l.config.Load() == nil {
 			l.config.Store(&runtimeConfig{
-				chartAppMap: make(map[chartRef]*cozyv1alpha1.CozystackResourceDefinition),
-				appCRDMap:   make(map[appRef]*cozyv1alpha1.CozystackResourceDefinition),
+				appCRDMap: make(map[appRef]*cozyv1alpha1.CozystackResourceDefinition),
 			})
 		}
 	})
 }
 
-func (l *LineageControllerWebhook) Map(hr *helmv2.HelmRelease) (string, string, string, error) {
-	cfg, ok := l.config.Load().(*runtimeConfig)
+// getApplicationLabel safely extracts an application label from HelmRelease
+func getApplicationLabel(hr *helmv2.HelmRelease, key string) (string, error) {
+	if hr.Labels == nil {
+		return "", fmt.Errorf("cannot map helm release %s/%s to dynamic app: labels are nil", hr.Namespace, hr.Name)
+	}
+	val, ok := hr.Labels[key]
 	if !ok {
-		return "", "", "", fmt.Errorf("failed to load chart-app mapping from config")
+		return "", fmt.Errorf("cannot map helm release %s/%s to dynamic app: missing %s label", hr.Namespace, hr.Name, key)
 	}
-	if hr.Spec.Chart == nil {
-		return "", "", "", fmt.Errorf("cannot map helm release %s/%s to dynamic app", hr.Namespace, hr.Name)
-	}
-	s := hr.Spec.Chart.Spec
-	val, ok := cfg.chartAppMap[chartRef{s.SourceRef.Name, s.Chart}]
-	if !ok {
-		return "", "", "", fmt.Errorf("cannot map helm release %s/%s to dynamic app", hr.Namespace, hr.Name)
-	}
-	return "apps.cozystack.io/v1alpha1", val.Spec.Application.Kind, val.Spec.Release.Prefix, nil
+	return val, nil
+}
+
+func (l *LineageControllerWebhook) Map(hr *helmv2.HelmRelease) (string, string, string, error) {
+	// Extract application metadata from labels
+	appKind, err := getApplicationLabel(hr, "apps.cozystack.io/application.kind")
+	if err != nil {
+		return "", "", "", err
+	}
+	
+	appGroup, err := getApplicationLabel(hr, "apps.cozystack.io/application.group")
+	if err != nil {
+		return "", "", "", err
+	}
+	
+	appName, err := getApplicationLabel(hr, "apps.cozystack.io/application.name")
+	if err != nil {
+		return "", "", "", err
+	}
+	
+	// Construct API version from group
+	apiVersion := fmt.Sprintf("%s/v1alpha1", appGroup)
+	
+	// Extract prefix from HelmRelease name by removing the application name
+	// HelmRelease name format: <prefix><application-name>
+	prefix := strings.TrimSuffix(hr.Name, appName)
+	
+	// Validate the derived prefix
+	// This ensures correctness when appName appears multiple times in hr.Name
+	if prefix+appName != hr.Name {
+		return "", "", "", fmt.Errorf("cannot derive prefix from helm release %s/%s: name does not end with application name %s", hr.Namespace, hr.Name, appName)
+	}
+	
+	return apiVersion, appKind, prefix, nil
 }

internal/lineagecontrollerwebhook/controller.go

@@ -24,25 +24,15 @@ func (c *LineageControllerWebhook) Reconcile(ctx context.Context, req ctrl.Reque
 		return ctrl.Result{}, err
 	}
 	cfg := &runtimeConfig{
-		chartAppMap: make(map[chartRef]*cozyv1alpha1.CozystackResourceDefinition),
-		appCRDMap:   make(map[appRef]*cozyv1alpha1.CozystackResourceDefinition),
+		appCRDMap: make(map[appRef]*cozyv1alpha1.CozystackResourceDefinition),
 	}
 	for _, crd := range crds.Items {
-		chRef := chartRef{
-			crd.Spec.Release.Chart.SourceRef.Name,
-			crd.Spec.Release.Chart.Name,
-		}
 		appRef := appRef{
 			"apps.cozystack.io",
 			crd.Spec.Application.Kind,
 		}
 
 		newRef := crd
-		if _, exists := cfg.chartAppMap[chRef]; exists {
-			l.Info("duplicate chart mapping detected; ignoring subsequent entry", "key", chRef)
-		} else {
-			cfg.chartAppMap[chRef] = &newRef
-		}
 		if _, exists := cfg.appCRDMap[appRef]; exists {
 			l.Info("duplicate app mapping detected; ignoring subsequent entry", "key", appRef)
 		} else {

internal/operator/package_reconciler.go

@@ -0,0 +1,889 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package operator
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
+	helmv2 "github.com/fluxcd/helm-controller/api/v2"
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+)
+
+// PackageReconciler reconciles Package resources
+type PackageReconciler struct {
+	client.Client
+	Scheme *runtime.Scheme
+}
+
+// +kubebuilder:rbac:groups=cozystack.io,resources=packages,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=cozystack.io,resources=packages/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=cozystack.io,resources=packagesources,verbs=get;list;watch
+// +kubebuilder:rbac:groups=helm.toolkit.fluxcd.io,resources=helmreleases,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=core,resources=namespaces,verbs=get;list;watch;create;update;patch
+
+// Reconcile is part of the main kubernetes reconciliation loop
+func (r *PackageReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	logger := log.FromContext(ctx)
+
+	pkg := &cozyv1alpha1.Package{}
+	if err := r.Get(ctx, req.NamespacedName, pkg); err != nil {
+		if apierrors.IsNotFound(err) {
+			// Resource not found, return (ownerReference will handle cleanup)
+			return ctrl.Result{}, nil
+		}
+		return ctrl.Result{}, err
+	}
+
+	// Get PackageSource with the same name
+	packageSource := &cozyv1alpha1.PackageSource{}
+	if err := r.Get(ctx, types.NamespacedName{Name: pkg.Name}, packageSource); err != nil {
+		if apierrors.IsNotFound(err) {
+			meta.SetStatusCondition(&pkg.Status.Conditions, metav1.Condition{
+				Type:    "Ready",
+				Status:  metav1.ConditionFalse,
+				Reason:  "PackageSourceNotFound",
+				Message: fmt.Sprintf("PackageSource %s not found", pkg.Name),
+			})
+			if err := r.Status().Update(ctx, pkg); err != nil {
+				return ctrl.Result{}, err
+			}
+			return ctrl.Result{}, nil
+		}
+		return ctrl.Result{}, err
+	}
+
+	// Determine variant (default to "default" if not specified)
+	variantName := pkg.Spec.Variant
+	if variantName == "" {
+		variantName = "default"
+	}
+
+	// Find the variant in PackageSource
+	var variant *cozyv1alpha1.Variant
+	for i := range packageSource.Spec.Variants {
+		if packageSource.Spec.Variants[i].Name == variantName {
+			variant = &packageSource.Spec.Variants[i]
+			break
+		}
+	}
+
+	if variant == nil {
+		meta.SetStatusCondition(&pkg.Status.Conditions, metav1.Condition{
+			Type:    "Ready",
+			Status:  metav1.ConditionFalse,
+			Reason:  "VariantNotFound",
+			Message: fmt.Sprintf("Variant %s not found in PackageSource %s", variantName, pkg.Name),
+		})
+		if err := r.Status().Update(ctx, pkg); err != nil {
+			return ctrl.Result{}, err
+		}
+		return ctrl.Result{}, nil
+	}
+
+	// Reconcile namespaces from components
+	if err := r.reconcileNamespaces(ctx, pkg, variant); err != nil {
+		logger.Error(err, "failed to reconcile namespaces")
+		return ctrl.Result{}, err
+	}
+
+	// Validate variant dependencies before creating HelmReleases
+	// If dependencies are missing, we don't create new HelmReleases but don't delete existing ones
+	if err := r.validateVariantDependencies(ctx, pkg, variant); err != nil {
+		logger.Info("variant dependencies not ready, skipping HelmRelease creation", "package", pkg.Name, "error", err)
+		meta.SetStatusCondition(&pkg.Status.Conditions, metav1.Condition{
+			Type:    "Ready",
+			Status:  metav1.ConditionFalse,
+			Reason:  "DependenciesNotReady",
+			Message: fmt.Sprintf("Variant dependencies not ready: %v", err),
+		})
+		if err := r.Status().Update(ctx, pkg); err != nil {
+			return ctrl.Result{}, err
+		}
+		// Return success to avoid requeue, but don't create HelmReleases
+		return ctrl.Result{}, nil
+	}
+
+	// Create HelmReleases for components with Install section
+	helmReleaseCount := 0
+	for _, component := range variant.Components {
+		// Skip components without Install section
+		if component.Install == nil {
+			continue
+		}
+
+		// Check if component is disabled via Package spec
+		if pkgComponent, ok := pkg.Spec.Components[component.Name]; ok {
+			if pkgComponent.Enabled != nil && !*pkgComponent.Enabled {
+				logger.V(1).Info("skipping disabled component", "package", pkg.Name, "component", component.Name)
+				continue
+			}
+		}
+
+		// Build artifact name: <packagesource>-<variant>-<componentname> (with dots replaced by dashes)
+		artifactName := fmt.Sprintf("%s-%s-%s",
+			strings.ReplaceAll(packageSource.Name, ".", "-"),
+			strings.ReplaceAll(variantName, ".", "-"),
+			strings.ReplaceAll(component.Name, ".", "-"))
+
+		// Determine namespace (from Install or default to cozy-system)
+		namespace := component.Install.Namespace
+		if namespace == "" {
+			namespace = "cozy-system"
+		}
+
+		// Determine release name (from Install or use component name)
+		releaseName := component.Install.ReleaseName
+		if releaseName == "" {
+			releaseName = component.Name
+		}
+
+		// Build labels
+		labels := make(map[string]string)
+		labels["cozystack.io/package"] = pkg.Name
+		if component.Install.Privileged {
+			labels["cozystack.io/privileged"] = "true"
+		}
+
+		// Create HelmRelease
+		hr := &helmv2.HelmRelease{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      releaseName,
+				Namespace: namespace,
+				Labels:    labels,
+			},
+			Spec: helmv2.HelmReleaseSpec{
+				Interval: metav1.Duration{Duration: 5 * 60 * 1000000000}, // 5m
+				ChartRef: &helmv2.CrossNamespaceSourceReference{
+					Kind:      "ExternalArtifact",
+					Name:      artifactName,
+					Namespace: "cozy-system",
+				},
+				Install: &helmv2.Install{
+					Remediation: &helmv2.InstallRemediation{
+						Retries: -1,
+					},
+				},
+				Upgrade: &helmv2.Upgrade{
+					Remediation: &helmv2.UpgradeRemediation{
+						Retries: -1,
+					},
+				},
+			},
+		}
+
+		// Set ownerReference
+		hr.OwnerReferences = []metav1.OwnerReference{
+			{
+				APIVersion: pkg.APIVersion,
+				Kind:       pkg.Kind,
+				Name:       pkg.Name,
+				UID:        pkg.UID,
+				Controller: func() *bool { b := true; return &b }(),
+			},
+		}
+
+		// Merge values from Package spec if provided
+		if pkgComponent, ok := pkg.Spec.Components[component.Name]; ok && pkgComponent.Values != nil {
+			hr.Spec.Values = pkgComponent.Values
+		}
+
+		// Build DependsOn from component Install and variant DependsOn
+		dependsOn, err := r.buildDependsOn(ctx, pkg, packageSource, variant, &component)
+		if err != nil {
+			logger.Error(err, "failed to build DependsOn", "component", component.Name)
+			meta.SetStatusCondition(&pkg.Status.Conditions, metav1.Condition{
+				Type:    "Ready",
+				Status:  metav1.ConditionFalse,
+				Reason:  "DependsOnFailed",
+				Message: fmt.Sprintf("Failed to build DependsOn for component %s: %v", component.Name, err),
+			})
+			if err := r.Status().Update(ctx, pkg); err != nil {
+				return ctrl.Result{}, err
+			}
+			return ctrl.Result{}, err
+		}
+		if len(dependsOn) > 0 {
+			hr.Spec.DependsOn = dependsOn
+		}
+
+		if err := r.createOrUpdateHelmRelease(ctx, hr); err != nil {
+			logger.Error(err, "failed to reconcile HelmRelease", "name", releaseName, "namespace", namespace)
+			meta.SetStatusCondition(&pkg.Status.Conditions, metav1.Condition{
+				Type:    "Ready",
+				Status:  metav1.ConditionFalse,
+				Reason:  "HelmReleaseFailed",
+				Message: fmt.Sprintf("Failed to create HelmRelease %s: %v", releaseName, err),
+			})
+			if err := r.Status().Update(ctx, pkg); err != nil {
+				return ctrl.Result{}, err
+			}
+			return ctrl.Result{}, err
+		}
+
+		helmReleaseCount++
+		logger.Info("reconciled HelmRelease", "package", pkg.Name, "component", component.Name, "releaseName", releaseName, "namespace", namespace)
+	}
+
+	// Cleanup orphaned HelmReleases
+	if err := r.cleanupOrphanedHelmReleases(ctx, pkg, variant); err != nil {
+		logger.Error(err, "failed to cleanup orphaned HelmReleases")
+		// Don't return error, continue with status update
+	}
+
+	// Update status with success message
+	message := fmt.Sprintf("reconciliation succeeded, generated %d helmrelease(s)", helmReleaseCount)
+	meta.SetStatusCondition(&pkg.Status.Conditions, metav1.Condition{
+		Type:    "Ready",
+		Status:  metav1.ConditionTrue,
+		Reason:  "ReconciliationSucceeded",
+		Message: message,
+	})
+
+	if err := r.Status().Update(ctx, pkg); err != nil {
+		return ctrl.Result{}, err
+	}
+
+	logger.Info("reconciled Package", "name", pkg.Name, "helmReleaseCount", helmReleaseCount)
+
+	// Trigger reconcile for Packages that depend on this Package
+	if err := r.triggerDependentPackages(ctx, pkg.Name); err != nil {
+		logger.Error(err, "failed to trigger dependent Packages", "package", pkg.Name)
+		// Don't return error, this is best-effort
+	}
+
+	return ctrl.Result{}, nil
+}
+
+// createOrUpdateHelmRelease creates or updates a HelmRelease
+func (r *PackageReconciler) createOrUpdateHelmRelease(ctx context.Context, hr *helmv2.HelmRelease) error {
+	existing := &helmv2.HelmRelease{}
+	key := types.NamespacedName{
+		Name:      hr.Name,
+		Namespace: hr.Namespace,
+	}
+
+	err := r.Get(ctx, key, existing)
+	if apierrors.IsNotFound(err) {
+		return r.Create(ctx, hr)
+	} else if err != nil {
+		return err
+	}
+
+	// Preserve resource version
+	hr.SetResourceVersion(existing.GetResourceVersion())
+
+	// Merge labels
+	labels := hr.GetLabels()
+	if labels == nil {
+		labels = make(map[string]string)
+	}
+	for k, v := range existing.GetLabels() {
+		if _, ok := labels[k]; !ok {
+			labels[k] = v
+		}
+	}
+	hr.SetLabels(labels)
+
+	// Merge annotations
+	annotations := hr.GetAnnotations()
+	if annotations == nil {
+		annotations = make(map[string]string)
+	}
+	for k, v := range existing.GetAnnotations() {
+		if _, ok := annotations[k]; !ok {
+			annotations[k] = v
+		}
+	}
+	hr.SetAnnotations(annotations)
+
+	// Update Spec
+	existing.Spec = hr.Spec
+	existing.SetLabels(hr.GetLabels())
+	existing.SetAnnotations(hr.GetAnnotations())
+	existing.SetOwnerReferences(hr.GetOwnerReferences())
+
+	return r.Update(ctx, existing)
+}
+
+// buildDependsOn builds DependsOn list for a component
+// Includes:
+// 1. Dependencies from component.Install.DependsOn (with namespace from referenced component)
+// 2. Dependencies from variant.DependsOn (all components with Install from referenced Package)
+func (r *PackageReconciler) buildDependsOn(ctx context.Context, pkg *cozyv1alpha1.Package, packageSource *cozyv1alpha1.PackageSource, variant *cozyv1alpha1.Variant, component *cozyv1alpha1.Component) ([]helmv2.DependencyReference, error) {
+	logger := log.FromContext(ctx)
+	dependsOn := []helmv2.DependencyReference{}
+
+	// Build map of component names to their release names and namespaces in current variant
+	componentMap := make(map[string]struct {
+		releaseName string
+		namespace   string
+	})
+	for _, comp := range variant.Components {
+		if comp.Install == nil {
+			continue
+		}
+		compNamespace := comp.Install.Namespace
+		if compNamespace == "" {
+			compNamespace = "cozy-system"
+		}
+		compReleaseName := comp.Install.ReleaseName
+		if compReleaseName == "" {
+			compReleaseName = comp.Name
+		}
+		componentMap[comp.Name] = struct {
+			releaseName string
+			namespace   string
+		}{
+			releaseName: compReleaseName,
+			namespace:   compNamespace,
+		}
+	}
+
+	// Add dependencies from component.Install.DependsOn
+	if len(component.Install.DependsOn) > 0 {
+		for _, depName := range component.Install.DependsOn {
+			depComp, ok := componentMap[depName]
+			if !ok {
+				return nil, fmt.Errorf("component %s not found in variant for dependency %s", depName, component.Name)
+			}
+			dependsOn = append(dependsOn, helmv2.DependencyReference{
+				Name:      depComp.releaseName,
+				Namespace: depComp.namespace,
+			})
+			logger.V(1).Info("added component dependency", "component", component.Name, "dependsOn", depName, "releaseName", depComp.releaseName, "namespace", depComp.namespace)
+		}
+	}
+
+	// Add dependencies from variant.DependsOn
+	if len(variant.DependsOn) > 0 {
+		for _, depPackageName := range variant.DependsOn {
+			// Check if dependency is in IgnoreDependencies
+			ignore := false
+			for _, ignoreDep := range pkg.Spec.IgnoreDependencies {
+				if ignoreDep == depPackageName {
+					ignore = true
+					break
+				}
+			}
+			if ignore {
+				logger.V(1).Info("ignoring dependency", "package", pkg.Name, "dependency", depPackageName)
+				continue
+			}
+
+			// Get the Package
+			depPackage := &cozyv1alpha1.Package{}
+			if err := r.Get(ctx, types.NamespacedName{Name: depPackageName}, depPackage); err != nil {
+				if apierrors.IsNotFound(err) {
+					return nil, fmt.Errorf("dependent Package %s not found", depPackageName)
+				}
+				return nil, fmt.Errorf("failed to get dependent Package %s: %w", depPackageName, err)
+			}
+
+			// Get the variant from dependent Package
+			depVariantName := depPackage.Spec.Variant
+			if depVariantName == "" {
+				depVariantName = "default"
+			}
+
+			// Get the PackageSource
+			depPackageSource := &cozyv1alpha1.PackageSource{}
+			if err := r.Get(ctx, types.NamespacedName{Name: depPackageName}, depPackageSource); err != nil {
+				if apierrors.IsNotFound(err) {
+					return nil, fmt.Errorf("dependent PackageSource %s not found", depPackageName)
+				}
+				return nil, fmt.Errorf("failed to get dependent PackageSource %s: %w", depPackageName, err)
+			}
+
+			// Find the variant in PackageSource
+			var depVariant *cozyv1alpha1.Variant
+			for i := range depPackageSource.Spec.Variants {
+				if depPackageSource.Spec.Variants[i].Name == depVariantName {
+					depVariant = &depPackageSource.Spec.Variants[i]
+					break
+				}
+			}
+
+			if depVariant == nil {
+				return nil, fmt.Errorf("dependent variant %s not found in PackageSource %s", depVariantName, depPackageName)
+			}
+
+			// Add all components with Install from dependent variant
+			for _, depComp := range depVariant.Components {
+				if depComp.Install == nil {
+					continue
+				}
+
+				// Check if component is disabled in dependent Package
+				if depPkgComponent, ok := depPackage.Spec.Components[depComp.Name]; ok {
+					if depPkgComponent.Enabled != nil && !*depPkgComponent.Enabled {
+						continue
+					}
+				}
+
+				depCompNamespace := depComp.Install.Namespace
+				if depCompNamespace == "" {
+					depCompNamespace = "cozy-system"
+				}
+				depCompReleaseName := depComp.Install.ReleaseName
+				if depCompReleaseName == "" {
+					depCompReleaseName = depComp.Name
+				}
+
+				dependsOn = append(dependsOn, helmv2.DependencyReference{
+					Name:      depCompReleaseName,
+					Namespace: depCompNamespace,
+				})
+				logger.V(1).Info("added variant dependency", "package", pkg.Name, "dependency", depPackageName, "component", depComp.Name, "releaseName", depCompReleaseName, "namespace", depCompNamespace)
+			}
+		}
+	}
+
+	return dependsOn, nil
+}
+
+// validateVariantDependencies validates that all variant dependencies exist
+// Returns error if any dependency is missing
+func (r *PackageReconciler) validateVariantDependencies(ctx context.Context, pkg *cozyv1alpha1.Package, variant *cozyv1alpha1.Variant) error {
+	logger := log.FromContext(ctx)
+
+	if len(variant.DependsOn) == 0 {
+		return nil
+	}
+
+	for _, depPackageName := range variant.DependsOn {
+		// Check if dependency is in IgnoreDependencies
+		ignore := false
+		for _, ignoreDep := range pkg.Spec.IgnoreDependencies {
+			if ignoreDep == depPackageName {
+				ignore = true
+				break
+			}
+		}
+		if ignore {
+			logger.V(1).Info("ignoring dependency", "package", pkg.Name, "dependency", depPackageName)
+			continue
+		}
+
+		// Get the Package
+		depPackage := &cozyv1alpha1.Package{}
+		if err := r.Get(ctx, types.NamespacedName{Name: depPackageName}, depPackage); err != nil {
+			if apierrors.IsNotFound(err) {
+				return fmt.Errorf("dependent Package %s not found", depPackageName)
+			}
+			return fmt.Errorf("failed to get dependent Package %s: %w", depPackageName, err)
+		}
+
+		// Get the PackageSource
+		depPackageSource := &cozyv1alpha1.PackageSource{}
+		if err := r.Get(ctx, types.NamespacedName{Name: depPackageName}, depPackageSource); err != nil {
+			if apierrors.IsNotFound(err) {
+				return fmt.Errorf("dependent PackageSource %s not found", depPackageName)
+			}
+			return fmt.Errorf("failed to get dependent PackageSource %s: %w", depPackageName, err)
+		}
+
+		// Get the variant from dependent Package
+		depVariantName := depPackage.Spec.Variant
+		if depVariantName == "" {
+			depVariantName = "default"
+		}
+
+		// Find the variant in PackageSource
+		var depVariant *cozyv1alpha1.Variant
+		for i := range depPackageSource.Spec.Variants {
+			if depPackageSource.Spec.Variants[i].Name == depVariantName {
+				depVariant = &depPackageSource.Spec.Variants[i]
+				break
+			}
+		}
+
+		if depVariant == nil {
+			return fmt.Errorf("dependent variant %s not found in PackageSource %s", depVariantName, depPackageName)
+		}
+	}
+
+	return nil
+}
+
+// reconcileNamespaces creates or updates namespaces based on components in the variant
+func (r *PackageReconciler) reconcileNamespaces(ctx context.Context, pkg *cozyv1alpha1.Package, variant *cozyv1alpha1.Variant) error {
+	logger := log.FromContext(ctx)
+
+	// Collect namespaces from components
+	// Map: namespace -> {isPrivileged}
+	type namespaceInfo struct {
+		privileged bool
+	}
+	namespacesMap := make(map[string]namespaceInfo)
+
+	for _, component := range variant.Components {
+		// Skip components without Install section
+		if component.Install == nil {
+			continue
+		}
+
+		// Check if component is disabled via Package spec
+		if pkgComponent, ok := pkg.Spec.Components[component.Name]; ok {
+			if pkgComponent.Enabled != nil && !*pkgComponent.Enabled {
+				continue
+			}
+		}
+
+		// Namespace must be set
+		namespace := component.Install.Namespace
+		if namespace == "" {
+			return fmt.Errorf("component %s has empty namespace in Install section", component.Name)
+		}
+
+		info, exists := namespacesMap[namespace]
+		if !exists {
+			info = namespaceInfo{
+				privileged: false,
+			}
+		}
+
+		// If component is privileged, mark namespace as privileged
+		if component.Install.Privileged {
+			info.privileged = true
+		}
+
+		namespacesMap[namespace] = info
+	}
+
+	// Create or update all namespaces
+	for nsName, info := range namespacesMap {
+		namespace := &corev1.Namespace{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:   nsName,
+				Labels: make(map[string]string),
+				Annotations: map[string]string{
+					"helm.sh/resource-policy": "keep",
+				},
+			},
+		}
+
+		// Add system label only for non-tenant namespaces
+		if !strings.HasPrefix(nsName, "tenant-") {
+			namespace.Labels["cozystack.io/system"] = "true"
+		}
+
+		// Add privileged label if needed
+		if info.privileged {
+			namespace.Labels["pod-security.kubernetes.io/enforce"] = "privileged"
+		}
+
+		if err := r.createOrUpdateNamespace(ctx, namespace); err != nil {
+			logger.Error(err, "failed to reconcile namespace", "name", nsName, "privileged", info.privileged)
+			return fmt.Errorf("failed to reconcile namespace %s: %w", nsName, err)
+		}
+		logger.Info("reconciled namespace", "name", nsName, "privileged", info.privileged)
+	}
+
+	return nil
+}
+
+// createOrUpdateNamespace creates or updates a namespace
+func (r *PackageReconciler) createOrUpdateNamespace(ctx context.Context, namespace *corev1.Namespace) error {
+	existing := &corev1.Namespace{}
+	key := types.NamespacedName{Name: namespace.Name}
+
+	err := r.Get(ctx, key, existing)
+	if apierrors.IsNotFound(err) {
+		return r.Create(ctx, namespace)
+	} else if err != nil {
+		return err
+	}
+
+	// Preserve resource version
+	namespace.SetResourceVersion(existing.GetResourceVersion())
+
+	// Merge labels
+	labels := namespace.GetLabels()
+	if labels == nil {
+		labels = make(map[string]string)
+	}
+	for k, v := range existing.GetLabels() {
+		if _, ok := labels[k]; !ok {
+			labels[k] = v
+		}
+	}
+	namespace.SetLabels(labels)
+
+	// Merge annotations
+	annotations := namespace.GetAnnotations()
+	if annotations == nil {
+		annotations = make(map[string]string)
+	}
+	for k, v := range existing.GetAnnotations() {
+		if _, ok := annotations[k]; !ok {
+			annotations[k] = v
+		}
+	}
+	namespace.SetAnnotations(annotations)
+
+	return r.Update(ctx, namespace)
+}
+
+// cleanupOrphanedHelmReleases removes HelmReleases that are no longer needed
+func (r *PackageReconciler) cleanupOrphanedHelmReleases(ctx context.Context, pkg *cozyv1alpha1.Package, variant *cozyv1alpha1.Variant) error {
+	logger := log.FromContext(ctx)
+
+	// Build map of desired HelmRelease names (from components with Install)
+	desiredReleases := make(map[types.NamespacedName]bool)
+	for _, component := range variant.Components {
+		if component.Install == nil {
+			continue
+		}
+
+		// Check if component is disabled via Package spec
+		if pkgComponent, ok := pkg.Spec.Components[component.Name]; ok {
+			if pkgComponent.Enabled != nil && !*pkgComponent.Enabled {
+				continue
+			}
+		}
+
+		namespace := component.Install.Namespace
+		if namespace == "" {
+			namespace = "cozy-system"
+		}
+
+		releaseName := component.Install.ReleaseName
+		if releaseName == "" {
+			releaseName = component.Name
+		}
+
+		desiredReleases[types.NamespacedName{
+			Name:      releaseName,
+			Namespace: namespace,
+		}] = true
+	}
+
+	// Find all HelmReleases owned by this Package
+	hrList := &helmv2.HelmReleaseList{}
+	if err := r.List(ctx, hrList, client.MatchingLabels{
+		"cozystack.io/package": pkg.Name,
+	}); err != nil {
+		return err
+	}
+
+	// Delete HelmReleases that are not in desired list
+	for _, hr := range hrList.Items {
+		key := types.NamespacedName{
+			Name:      hr.Name,
+			Namespace: hr.Namespace,
+		}
+		if !desiredReleases[key] {
+			logger.Info("deleting orphaned HelmRelease", "name", hr.Name, "namespace", hr.Namespace, "package", pkg.Name)
+			if err := r.Delete(ctx, &hr); err != nil && !apierrors.IsNotFound(err) {
+				logger.Error(err, "failed to delete orphaned HelmRelease", "name", hr.Name, "namespace", hr.Namespace)
+			}
+		}
+	}
+
+	return nil
+}
+
+// triggerDependentPackages triggers reconcile for all Packages that depend on the given Package
+func (r *PackageReconciler) triggerDependentPackages(ctx context.Context, packageName string) error {
+	logger := log.FromContext(ctx)
+
+	// Get all Packages
+	packageList := &cozyv1alpha1.PackageList{}
+	if err := r.List(ctx, packageList); err != nil {
+		return fmt.Errorf("failed to list Packages: %w", err)
+	}
+
+	// For each Package, check if it depends on the given Package
+	for _, pkg := range packageList.Items {
+		// Skip the Package itself
+		if pkg.Name == packageName {
+			continue
+		}
+
+		// Get PackageSource
+		packageSource := &cozyv1alpha1.PackageSource{}
+		if err := r.Get(ctx, types.NamespacedName{Name: pkg.Name}, packageSource); err != nil {
+			if apierrors.IsNotFound(err) {
+				continue
+			}
+			logger.V(1).Error(err, "failed to get PackageSource", "package", pkg.Name)
+			continue
+		}
+
+		// Determine variant
+		variantName := pkg.Spec.Variant
+		if variantName == "" {
+			variantName = "default"
+		}
+
+		// Find variant
+		var variant *cozyv1alpha1.Variant
+		for i := range packageSource.Spec.Variants {
+			if packageSource.Spec.Variants[i].Name == variantName {
+				variant = &packageSource.Spec.Variants[i]
+				break
+			}
+		}
+
+		if variant == nil {
+			continue
+		}
+
+		// Check if this Package depends on the given Package
+		dependsOn := false
+		for _, dep := range variant.DependsOn {
+			// Check if dependency is in IgnoreDependencies
+			ignore := false
+			for _, ignoreDep := range pkg.Spec.IgnoreDependencies {
+				if ignoreDep == dep {
+					ignore = true
+					break
+				}
+			}
+			if ignore {
+				continue
+			}
+
+			if dep == packageName {
+				dependsOn = true
+				break
+			}
+		}
+
+		if dependsOn {
+			logger.V(1).Info("triggering reconcile for dependent Package", "package", pkg.Name, "dependency", packageName)
+			// Trigger reconcile by updating the Package (add annotation or just requeue)
+			// We can't directly requeue from here, but we can update the Package to trigger reconcile
+			// Actually, we can use the client to trigger an update, but that might cause infinite loop
+			// Better approach: use event handler or just log and let the watch handle it
+			// For now, we'll just log - the watch on PackageSource should handle it
+			// But we need a way to trigger reconcile...
+			// Let's add an annotation to trigger reconcile
+			if pkg.Annotations == nil {
+				pkg.Annotations = make(map[string]string)
+			}
+			pkg.Annotations["cozystack.io/trigger-reconcile"] = fmt.Sprintf("%d", metav1.Now().Unix())
+			if err := r.Update(ctx, &pkg); err != nil {
+				logger.V(1).Error(err, "failed to trigger reconcile for dependent Package", "package", pkg.Name)
+			}
+		}
+	}
+
+	return nil
+}
+
+// SetupWithManager sets up the controller with the Manager.
+func (r *PackageReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewControllerManagedBy(mgr).
+		Named("cozystack-package").
+		For(&cozyv1alpha1.Package{}).
+		Watches(
+			&cozyv1alpha1.PackageSource{},
+			handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, obj client.Object) []reconcile.Request {
+				ps, ok := obj.(*cozyv1alpha1.PackageSource)
+				if !ok {
+					return nil
+				}
+				// Find Package with the same name as PackageSource
+				// PackageSource and Package share the same name
+				pkg := &cozyv1alpha1.Package{}
+				if err := mgr.GetClient().Get(ctx, types.NamespacedName{Name: ps.Name}, pkg); err != nil {
+					// Package not found, that's ok - it might not exist yet
+					return nil
+				}
+				// Trigger reconcile for the corresponding Package
+				return []reconcile.Request{{
+					NamespacedName: types.NamespacedName{
+						Name: pkg.Name,
+					},
+				}}
+			}),
+		).
+		Watches(
+			&cozyv1alpha1.Package{},
+			handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, obj client.Object) []reconcile.Request {
+				updatedPkg, ok := obj.(*cozyv1alpha1.Package)
+				if !ok {
+					return nil
+				}
+				// Find all Packages that depend on this Package
+				packageList := &cozyv1alpha1.PackageList{}
+				if err := mgr.GetClient().List(ctx, packageList); err != nil {
+					return nil
+				}
+				var requests []reconcile.Request
+				for _, pkg := range packageList.Items {
+					if pkg.Name == updatedPkg.Name {
+						continue // Skip the Package itself
+					}
+					// Get PackageSource to check dependencies
+					packageSource := &cozyv1alpha1.PackageSource{}
+					if err := mgr.GetClient().Get(ctx, types.NamespacedName{Name: pkg.Name}, packageSource); err != nil {
+						continue
+					}
+					// Determine variant
+					variantName := pkg.Spec.Variant
+					if variantName == "" {
+						variantName = "default"
+					}
+					// Find variant
+					for _, variant := range packageSource.Spec.Variants {
+						if variant.Name == variantName {
+							// Check if this variant depends on updatedPkg
+							for _, dep := range variant.DependsOn {
+								// Check if dependency is in IgnoreDependencies
+								ignore := false
+								for _, ignoreDep := range pkg.Spec.IgnoreDependencies {
+									if ignoreDep == dep {
+										ignore = true
+										break
+									}
+								}
+								if ignore {
+									continue
+								}
+								if dep == updatedPkg.Name {
+									requests = append(requests, reconcile.Request{
+										NamespacedName: types.NamespacedName{
+											Name: pkg.Name,
+										},
+									})
+									break
+								}
+							}
+							break
+						}
+					}
+				}
+				return requests
+			}),
+		).
+		Complete(r)
+}

internal/operator/packagesource_reconciler.go

@@ -0,0 +1,468 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package operator
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
+	sourcewatcherv1beta1 "github.com/fluxcd/source-watcher/api/v2/v1beta1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+)
+
+// PackageSourceReconciler reconciles PackageSource resources
+type PackageSourceReconciler struct {
+	client.Client
+	Scheme *runtime.Scheme
+}
+
+// +kubebuilder:rbac:groups=cozystack.io,resources=packagesources,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=cozystack.io,resources=packagesources/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=source.extensions.fluxcd.io,resources=artifactgenerators,verbs=get;list;watch;create;update;patch;delete
+
+// Reconcile is part of the main kubernetes reconciliation loop
+func (r *PackageSourceReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	logger := log.FromContext(ctx)
+
+	packageSource := &cozyv1alpha1.PackageSource{}
+	if err := r.Get(ctx, req.NamespacedName, packageSource); err != nil {
+		if apierrors.IsNotFound(err) {
+			// Resource not found, return (ownerReference will handle cleanup)
+			return ctrl.Result{}, nil
+		}
+		return ctrl.Result{}, err
+	}
+
+	// Generate ArtifactGenerator for package source
+	if err := r.reconcileArtifactGenerators(ctx, packageSource); err != nil {
+		logger.Error(err, "failed to reconcile ArtifactGenerator")
+		return ctrl.Result{}, err
+	}
+
+	// Update PackageSource status (variants and conditions from ArtifactGenerator)
+	if err := r.updateStatus(ctx, packageSource); err != nil {
+		logger.Error(err, "failed to update status")
+		// Don't return error, status update is not critical
+	}
+
+	return ctrl.Result{}, nil
+}
+
+// reconcileArtifactGenerators generates a single ArtifactGenerator for the package source
+// Creates one ArtifactGenerator per package source with all OutputArtifacts from components
+func (r *PackageSourceReconciler) reconcileArtifactGenerators(ctx context.Context, packageSource *cozyv1alpha1.PackageSource) error {
+	logger := log.FromContext(ctx)
+
+	// Check if SourceRef is set
+	if packageSource.Spec.SourceRef == nil {
+		logger.Info("skipping ArtifactGenerator creation, SourceRef not set", "packageSource", packageSource.Name)
+		return nil
+	}
+
+	// Build library map from all variants
+	// Map key is the library name (from lib.Name or extracted from path)
+	// This allows components to reference libraries by name
+	libraryMap := make(map[string]cozyv1alpha1.Library)
+	for _, variant := range packageSource.Spec.Variants {
+		for _, lib := range variant.Libraries {
+			libName := lib.Name
+			if libName == "" {
+				// If library name is not set, extract from path
+				libName = r.getPackageNameFromPath(lib.Path)
+			}
+			if libName != "" {
+				// Store library with the resolved name
+				libraryMap[libName] = lib
+			}
+		}
+	}
+
+	// Namespace is always cozy-system
+	namespace := "cozy-system"
+	// ArtifactGenerator name is the package source name
+	agName := packageSource.Name
+
+	// Collect all OutputArtifacts
+	outputArtifacts := []sourcewatcherv1beta1.OutputArtifact{}
+
+	// Process all variants and their components
+	for _, variant := range packageSource.Spec.Variants {
+		for _, component := range variant.Components {
+			// Skip components without path
+			if component.Path == "" {
+				logger.V(1).Info("skipping component without path", "packageSource", packageSource.Name, "variant", variant.Name, "component", component.Name)
+				continue
+			}
+
+			logger.V(1).Info("processing component", "packageSource", packageSource.Name, "variant", variant.Name, "component", component.Name, "path", component.Path)
+
+			// Extract component name from path (last component)
+			componentPathName := r.getPackageNameFromPath(component.Path)
+			if componentPathName == "" {
+				logger.Info("skipping component with invalid path", "packageSource", packageSource.Name, "variant", variant.Name, "component", component.Name, "path", component.Path)
+				continue
+			}
+
+			// Get basePath with default values
+			basePath := r.getBasePath(packageSource)
+
+			// Build copy operations
+			copyOps := []sourcewatcherv1beta1.CopyOperation{
+				{
+					From: r.buildSourcePath(packageSource.Spec.SourceRef.Name, basePath, component.Path),
+					To:   fmt.Sprintf("@artifact/%s/", componentPathName),
+				},
+			}
+
+			// Add libraries if specified
+			for _, libName := range component.Libraries {
+				if lib, ok := libraryMap[libName]; ok {
+					copyOps = append(copyOps, sourcewatcherv1beta1.CopyOperation{
+						From: r.buildSourcePath(packageSource.Spec.SourceRef.Name, basePath, lib.Path),
+						To:   fmt.Sprintf("@artifact/%s/charts/%s/", componentPathName, libName),
+					})
+				}
+			}
+
+			// Add valuesFiles if specified
+			for i, valuesFile := range component.ValuesFiles {
+				strategy := "Merge"
+				if i == 0 {
+					strategy = "Overwrite"
+				}
+				copyOps = append(copyOps, sourcewatcherv1beta1.CopyOperation{
+					From:     r.buildSourceFilePath(packageSource.Spec.SourceRef.Name, basePath, fmt.Sprintf("%s/%s", component.Path, valuesFile)),
+					To:       fmt.Sprintf("@artifact/%s/values.yaml", componentPathName),
+					Strategy: strategy,
+				})
+			}
+
+			// Artifact name: <packagesource>-<variant>-<componentname>
+			// Replace dots with dashes to comply with Kubernetes naming requirements
+			artifactName := fmt.Sprintf("%s-%s-%s",
+				strings.ReplaceAll(packageSource.Name, ".", "-"),
+				strings.ReplaceAll(variant.Name, ".", "-"),
+				strings.ReplaceAll(component.Name, ".", "-"))
+
+			outputArtifacts = append(outputArtifacts, sourcewatcherv1beta1.OutputArtifact{
+				Name: artifactName,
+				Copy: copyOps,
+			})
+
+			logger.Info("added OutputArtifact for component", "packageSource", packageSource.Name, "variant", variant.Name, "component", component.Name, "artifactName", artifactName)
+		}
+	}
+
+	// If there are no OutputArtifacts, return (ownerReference will handle cleanup if needed)
+	if len(outputArtifacts) == 0 {
+		logger.Info("no OutputArtifacts to generate, skipping ArtifactGenerator creation", "packageSource", packageSource.Name)
+		return nil
+	}
+
+	// Build labels
+	labels := make(map[string]string)
+	labels["cozystack.io/packagesource"] = packageSource.Name
+
+	// Create single ArtifactGenerator for the package source
+	ag := &sourcewatcherv1beta1.ArtifactGenerator{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      agName,
+			Namespace: namespace,
+			Labels:    labels,
+		},
+		Spec: sourcewatcherv1beta1.ArtifactGeneratorSpec{
+			Sources: []sourcewatcherv1beta1.SourceReference{
+				{
+					Alias:     packageSource.Spec.SourceRef.Name,
+					Kind:      packageSource.Spec.SourceRef.Kind,
+					Name:      packageSource.Spec.SourceRef.Name,
+					Namespace: packageSource.Spec.SourceRef.Namespace,
+				},
+			},
+			OutputArtifacts: outputArtifacts,
+		},
+	}
+
+	// Set ownerReference
+	ag.OwnerReferences = []metav1.OwnerReference{
+		{
+			APIVersion: packageSource.APIVersion,
+			Kind:       packageSource.Kind,
+			Name:       packageSource.Name,
+			UID:        packageSource.UID,
+			Controller: func() *bool { b := true; return &b }(),
+		},
+	}
+
+	logger.Info("creating ArtifactGenerator for package source", "packageSource", packageSource.Name, "agName", agName, "namespace", namespace, "outputArtifactCount", len(outputArtifacts))
+
+	if err := r.createOrUpdate(ctx, ag); err != nil {
+		return fmt.Errorf("failed to reconcile ArtifactGenerator %s: %w", agName, err)
+	}
+
+	logger.Info("reconciled ArtifactGenerator for package source", "name", agName, "namespace", namespace, "outputArtifactCount", len(outputArtifacts))
+
+	return nil
+}
+
+// Helper functions
+func (r *PackageSourceReconciler) getPackageNameFromPath(path string) string {
+	parts := strings.Split(path, "/")
+	if len(parts) > 0 {
+		return parts[len(parts)-1]
+	}
+	return ""
+}
+
+// getBasePath returns the basePath with default values based on source kind
+func (r *PackageSourceReconciler) getBasePath(packageSource *cozyv1alpha1.PackageSource) string {
+	// If path is explicitly set in SourceRef, use it (but normalize "/" to empty)
+	if packageSource.Spec.SourceRef.Path != "" {
+		path := strings.Trim(packageSource.Spec.SourceRef.Path, "/")
+		// If path is "/" or empty after trim, return empty string
+		if path == "" {
+			return ""
+		}
+		return path
+	}
+	// Default values based on kind
+	if packageSource.Spec.SourceRef.Kind == "OCIRepository" {
+		return "" // Root for OCI
+	}
+	// Default for GitRepository
+	return "packages"
+}
+
+// buildSourcePath builds the full source path using basePath with glob pattern
+func (r *PackageSourceReconciler) buildSourcePath(sourceName, basePath, path string) string {
+	// Remove leading/trailing slashes and combine
+	parts := []string{}
+	if basePath != "" {
+		trimmed := strings.Trim(basePath, "/")
+		if trimmed != "" {
+			parts = append(parts, trimmed)
+		}
+	}
+	if path != "" {
+		trimmed := strings.Trim(path, "/")
+		if trimmed != "" {
+			parts = append(parts, trimmed)
+		}
+	}
+
+	fullPath := strings.Join(parts, "/")
+	if fullPath == "" {
+		return fmt.Sprintf("@%s/**", sourceName)
+	}
+	return fmt.Sprintf("@%s/%s/**", sourceName, fullPath)
+}
+
+// buildSourceFilePath builds the full source path for a specific file (without glob pattern)
+func (r *PackageSourceReconciler) buildSourceFilePath(sourceName, basePath, path string) string {
+	// Remove leading/trailing slashes and combine
+	parts := []string{}
+	if basePath != "" {
+		trimmed := strings.Trim(basePath, "/")
+		if trimmed != "" {
+			parts = append(parts, trimmed)
+		}
+	}
+	if path != "" {
+		trimmed := strings.Trim(path, "/")
+		if trimmed != "" {
+			parts = append(parts, trimmed)
+		}
+	}
+
+	fullPath := strings.Join(parts, "/")
+	if fullPath == "" {
+		return fmt.Sprintf("@%s", sourceName)
+	}
+	return fmt.Sprintf("@%s/%s", sourceName, fullPath)
+}
+
+// createOrUpdate creates or updates a resource
+func (r *PackageSourceReconciler) createOrUpdate(ctx context.Context, obj client.Object) error {
+	existing := obj.DeepCopyObject().(client.Object)
+	key := client.ObjectKeyFromObject(obj)
+
+	err := r.Get(ctx, key, existing)
+	if apierrors.IsNotFound(err) {
+		return r.Create(ctx, obj)
+	} else if err != nil {
+		return err
+	}
+
+	// Preserve resource version
+	obj.SetResourceVersion(existing.GetResourceVersion())
+	// Merge labels and annotations
+	labels := obj.GetLabels()
+	if labels == nil {
+		labels = make(map[string]string)
+	}
+	for k, v := range existing.GetLabels() {
+		if _, ok := labels[k]; !ok {
+			labels[k] = v
+		}
+	}
+	obj.SetLabels(labels)
+
+	annotations := obj.GetAnnotations()
+	if annotations == nil {
+		annotations = make(map[string]string)
+	}
+	for k, v := range existing.GetAnnotations() {
+		if _, ok := annotations[k]; !ok {
+			annotations[k] = v
+		}
+	}
+	obj.SetAnnotations(annotations)
+
+	// For ArtifactGenerator, explicitly update Spec (OutputArtifacts and Sources)
+	if ag, ok := obj.(*sourcewatcherv1beta1.ArtifactGenerator); ok {
+		if existingAG, ok := existing.(*sourcewatcherv1beta1.ArtifactGenerator); ok {
+			logger := log.FromContext(ctx)
+			logger.V(1).Info("updating ArtifactGenerator Spec", "name", ag.Name, "namespace", ag.Namespace,
+				"outputArtifactCount", len(ag.Spec.OutputArtifacts))
+			// Update Spec from obj (which contains the desired state with all OutputArtifacts)
+			existingAG.Spec = ag.Spec
+			// Preserve metadata updates we made above
+			existingAG.SetLabels(ag.GetLabels())
+			existingAG.SetAnnotations(ag.GetAnnotations())
+			existingAG.SetOwnerReferences(ag.GetOwnerReferences())
+			// Use existingAG for Update
+			obj = existingAG
+		}
+	}
+
+	return r.Update(ctx, obj)
+}
+
+// updateStatus updates PackageSource status (variants and conditions from ArtifactGenerator)
+func (r *PackageSourceReconciler) updateStatus(ctx context.Context, packageSource *cozyv1alpha1.PackageSource) error {
+	logger := log.FromContext(ctx)
+
+	// Update variants in status from spec
+	variantNames := make([]string, 0, len(packageSource.Spec.Variants))
+	for _, variant := range packageSource.Spec.Variants {
+		variantNames = append(variantNames, variant.Name)
+	}
+	packageSource.Status.Variants = strings.Join(variantNames, ",")
+
+	// Check if SourceRef is set
+	if packageSource.Spec.SourceRef == nil {
+		// Set status to unknown if SourceRef is not set
+		meta.SetStatusCondition(&packageSource.Status.Conditions, metav1.Condition{
+			Type:    "Ready",
+			Status:  metav1.ConditionUnknown,
+			Reason:  "SourceRefNotSet",
+			Message: "SourceRef is not configured",
+		})
+		return r.Status().Update(ctx, packageSource)
+	}
+
+	// Get ArtifactGenerator
+	ag := &sourcewatcherv1beta1.ArtifactGenerator{}
+	agKey := types.NamespacedName{
+		Name:      packageSource.Name,
+		Namespace: "cozy-system",
+	}
+
+	if err := r.Get(ctx, agKey, ag); err != nil {
+		if apierrors.IsNotFound(err) {
+			// ArtifactGenerator not found, set status to unknown
+			meta.SetStatusCondition(&packageSource.Status.Conditions, metav1.Condition{
+				Type:    "Ready",
+				Status:  metav1.ConditionUnknown,
+				Reason:  "ArtifactGeneratorNotFound",
+				Message: "ArtifactGenerator not found",
+			})
+			return r.Status().Update(ctx, packageSource)
+		}
+		return fmt.Errorf("failed to get ArtifactGenerator: %w", err)
+	}
+
+	// Find Ready condition in ArtifactGenerator
+	readyCondition := meta.FindStatusCondition(ag.Status.Conditions, "Ready")
+	if readyCondition == nil {
+		// No Ready condition in ArtifactGenerator, set status to unknown
+		meta.SetStatusCondition(&packageSource.Status.Conditions, metav1.Condition{
+			Type:    "Ready",
+			Status:  metav1.ConditionUnknown,
+			Reason:  "ArtifactGeneratorNotReady",
+			Message: "ArtifactGenerator Ready condition not found",
+		})
+		return r.Status().Update(ctx, packageSource)
+	}
+
+	// Copy Ready condition from ArtifactGenerator to PackageSource
+	meta.SetStatusCondition(&packageSource.Status.Conditions, metav1.Condition{
+		Type:               "Ready",
+		Status:             readyCondition.Status,
+		Reason:             readyCondition.Reason,
+		Message:            readyCondition.Message,
+		ObservedGeneration: packageSource.Generation,
+		LastTransitionTime: readyCondition.LastTransitionTime,
+	})
+
+	logger.V(1).Info("updated PackageSource status from ArtifactGenerator",
+		"packageSource", packageSource.Name,
+		"status", readyCondition.Status,
+		"reason", readyCondition.Reason)
+
+	return r.Status().Update(ctx, packageSource)
+}
+
+// SetupWithManager sets up the controller with the Manager.
+func (r *PackageSourceReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewControllerManagedBy(mgr).
+		Named("cozystack-packagesource").
+		For(&cozyv1alpha1.PackageSource{}).
+		Watches(
+			&sourcewatcherv1beta1.ArtifactGenerator{},
+			handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, obj client.Object) []reconcile.Request {
+				ag, ok := obj.(*sourcewatcherv1beta1.ArtifactGenerator)
+				if !ok {
+					return nil
+				}
+				// Find the PackageSource that owns this ArtifactGenerator by ownerReference
+				for _, ownerRef := range ag.OwnerReferences {
+					if ownerRef.Kind == "PackageSource" {
+						return []reconcile.Request{{
+							NamespacedName: types.NamespacedName{
+								Name: ownerRef.Name,
+							},
+						}}
+					}
+				}
+				return nil
+			}),
+		).
+		Complete(r)
+}
+

internal/template/template.go

@@ -1,68 +0,0 @@
-package template
-
-import (
-	"bytes"
-	"encoding/json"
-	tmpl "text/template"
-)
-
-func Template[T any](obj *T, templateContext map[string]any) (*T, error) {
-	b, err := json.Marshal(obj)
-	if err != nil {
-		return nil, err
-	}
-	var unstructured any
-	err = json.Unmarshal(b, &unstructured)
-	if err != nil {
-		return nil, err
-	}
-	templateFunc := func(in string) string {
-		out, err := template(in, templateContext)
-		if err != nil {
-			return in
-		}
-		return out
-	}
-	unstructured = mapAtStrings(unstructured, templateFunc)
-	b, err = json.Marshal(unstructured)
-	if err != nil {
-		return nil, err
-	}
-	var out T
-	err = json.Unmarshal(b, &out)
-	if err != nil {
-		return nil, err
-	}
-	return &out, nil
-}
-
-func mapAtStrings(v any, f func(string) string) any {
-	switch x := v.(type) {
-	case map[string]any:
-		for k, val := range x {
-			x[k] = mapAtStrings(val, f)
-		}
-		return x
-	case []any:
-		for i, val := range x {
-			x[i] = mapAtStrings(val, f)
-		}
-		return x
-	case string:
-		return f(x)
-	default:
-		return v
-	}
-}
-
-func template(in string, templateContext map[string]any) (string, error) {
-	tpl, err := tmpl.New("this").Parse(in)
-	if err != nil {
-		return "", err
-	}
-	var buf bytes.Buffer
-	if err := tpl.Execute(&buf, templateContext); err != nil {
-		return "", err
-	}
-	return buf.String(), nil
-}

internal/template/template_test.go

@@ -1,68 +0,0 @@
-package template
-
-import (
-	"encoding/json"
-	"testing"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-func TestTemplate_PodTemplateSpec(t *testing.T) {
-	original := corev1.PodTemplateSpec{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: "my-pod",
-			Labels: map[string]string{
-				"app": "demo",
-			},
-			Annotations: map[string]string{
-				"note": "hello",
-			},
-		},
-		Spec: corev1.PodSpec{
-			Containers: []corev1.Container{
-				{
-					Name:  "{{ .Release.Name }}",
-					Image: "nginx:1.21",
-					Args:  []string{"--flag={{ .Values.value }}"},
-					Env: []corev1.EnvVar{
-						{
-							Name:  "FOO",
-							Value: "{{ .Release.Namespace }}",
-						},
-					},
-				},
-			},
-		},
-	}
-	templateContext := map[string]any{
-		"Release": map[string]any{
-			"Name":      "foo",
-			"Namespace": "notdefault",
-		},
-		"Values": map[string]any{
-			"value": 3,
-		},
-	}
-	reference := *original.DeepCopy()
-	reference.Spec.Containers[0].Name = "foo"
-	reference.Spec.Containers[0].Args[0] = "--flag=3"
-	reference.Spec.Containers[0].Env[0].Value = "notdefault"
-	got, err := Template(&original, templateContext)
-	if err != nil {
-		t.Fatalf("Template returned error: %v", err)
-	}
-	b1, err := json.Marshal(reference)
-	t.Logf("reference:\n%s", string(b1))
-	if err != nil {
-		t.Fatalf("failed to marshal reference value: %v", err)
-	}
-	b2, err := json.Marshal(got)
-	t.Logf("got:\n%s", string(b2))
-	if err != nil {
-		t.Fatalf("failed to marshal transformed value: %v", err)
-	}
-	if string(b1) != string(b2) {
-		t.Fatalf("transformed value not equal to reference value, expected: %s, got: %s", string(b1), string(b2))
-	}
-}

packages/apps/bucket/templates/helmrelease.yaml

@@ -3,15 +3,10 @@ kind: HelmRelease
 metadata:
   name: {{ .Release.Name }}-system
 spec:
-  chart:
-    spec:
-      chart: cozy-bucket
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-bucket-application-default-bucket-system
+    namespace: cozy-system
   interval: 5m
   timeout: 10m
   install:

packages/apps/http-cache/images/nginx-cache.tag

@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/nginx-cache:0.0.0@sha256:b7633717cd7449c0042ae92d8ca9b36e4d69566561f5c7d44e21058e7d05c6d5
+ghcr.io/cozystack/cozystack/nginx-cache:0.0.0@sha256:e0a07082bb6fc6aeaae2315f335386f1705a646c72f9e0af512aebbca5cb2b15

packages/apps/kubernetes/.helmignore

@@ -1,3 +1,4 @@
 .helmignore
 /logos
 /Makefile
+/hack

packages/apps/kubernetes/Makefile

@@ -6,9 +6,12 @@ include ../../../scripts/package.mk
 
 generate:
 	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
-	yq -o=json -i '.properties.version.enum = (load("files/versions.yaml") | keys)' values.schema.json
 	../../../hack/update-crd.sh
 
+update:
+	hack/update-versions.sh
+	make generate
+
 image: image-ubuntu-container-disk image-kubevirt-cloud-provider image-kubevirt-csi-driver image-cluster-autoscaler
 
 image-ubuntu-container-disk:

packages/apps/kubernetes/README.md

@@ -104,7 +104,7 @@ See the reference for components utilized in this service:
 | `nodeGroups[name].resources.memory` | Memory (RAM) available.                                                                        | `quantity`          | `""`        |
 | `nodeGroups[name].gpus`             | List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).                            | `[]object`          | `[]`        |
 | `nodeGroups[name].gpus[i].name`     | Name of GPU, such as "nvidia.com/AD102GL_L40S".                                                | `string`            | `""`        |
-| `version`                           | Kubernetes version (vMAJOR.MINOR). Supported: 1.28–1.33.                                     | `string`            | `v1.33`     |
+| `version`                           | Kubernetes major.minor version to deploy                                                       | `string`            | `v1.33`     |
 | `host`                              | External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty. | `string`            | `""`        |
 
 

packages/apps/kubernetes/files/versions.yaml

@@ -1,6 +1,6 @@
-"v1.28": "v1.28.15"
-"v1.29": "v1.29.15"
-"v1.30": "v1.30.14"
-"v1.31": "v1.31.10"
-"v1.32": "v1.32.6"
 "v1.33": "v1.33.0"
+"v1.32": "v1.32.10"
+"v1.31": "v1.31.14"
+"v1.30": "v1.30.14"
+"v1.29": "v1.29.15"
+"v1.28": "v1.28.15"

packages/apps/kubernetes/hack/update-versions.sh

@@ -0,0 +1,260 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+KUBERNETES_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+VALUES_FILE="${KUBERNETES_DIR}/values.yaml"
+VERSIONS_FILE="${KUBERNETES_DIR}/files/versions.yaml"
+MAKEFILE="${KUBERNETES_DIR}/Makefile"
+KAMAJI_DOCKERFILE="${KUBERNETES_DIR}/../../system/kamaji/images/kamaji/Dockerfile"
+
+# Check if skopeo is installed
+if ! command -v skopeo &> /dev/null; then
+    echo "Error: skopeo is not installed. Please install skopeo and try again." >&2
+    exit 1
+fi
+
+# Check if jq is installed
+if ! command -v jq &> /dev/null; then
+    echo "Error: jq is not installed. Please install jq and try again." >&2
+    exit 1
+fi
+
+# Get kamaji version from Dockerfile
+echo "Reading kamaji version from Dockerfile..."
+if [ ! -f "$KAMAJI_DOCKERFILE" ]; then
+    echo "Error: Kamaji Dockerfile not found at $KAMAJI_DOCKERFILE" >&2
+    exit 1
+fi
+
+KAMAJI_VERSION=$(grep "^ARG VERSION=" "$KAMAJI_DOCKERFILE" | cut -d= -f2 | tr -d '"')
+if [ -z "$KAMAJI_VERSION" ]; then
+    echo "Error: Could not extract kamaji version from Dockerfile" >&2
+    exit 1
+fi
+
+echo "Kamaji version: $KAMAJI_VERSION"
+
+# Get Kubernetes version from kamaji repository
+echo "Fetching Kubernetes version from kamaji repository..."
+KUBERNETES_VERSION_FROM_KAMAJI=$(curl -sSL "https://raw.githubusercontent.com/clastix/kamaji/${KAMAJI_VERSION}/internal/upgrade/kubeadm_version.go" | grep "KubeadmVersion" | sed -E 's/.*KubeadmVersion = "([^"]+)".*/\1/')
+
+if [ -z "$KUBERNETES_VERSION_FROM_KAMAJI" ]; then
+    echo "Error: Could not fetch Kubernetes version from kamaji repository" >&2
+    exit 1
+fi
+
+echo "Kubernetes version from kamaji: $KUBERNETES_VERSION_FROM_KAMAJI"
+
+# Extract major.minor version (e.g., "1.33" from "v1.33.0")
+KUBERNETES_MAJOR_MINOR=$(echo "$KUBERNETES_VERSION_FROM_KAMAJI" | sed -E 's/v([0-9]+)\.([0-9]+)\.[0-9]+/\1.\2/')
+KUBERNETES_MAJOR=$(echo "$KUBERNETES_MAJOR_MINOR" | cut -d. -f1)
+KUBERNETES_MINOR=$(echo "$KUBERNETES_MAJOR_MINOR" | cut -d. -f2)
+
+echo "Kubernetes major.minor: $KUBERNETES_MAJOR_MINOR"
+
+# Get available image tags
+echo "Fetching available image tags from registry..."
+AVAILABLE_TAGS=$(skopeo list-tags docker://registry.k8s.io/kube-apiserver | jq -r '.Tags[] | select(test("^v[0-9]+\\.[0-9]+\\.[0-9]+$"))' | sort -V)
+
+if [ -z "$AVAILABLE_TAGS" ]; then
+    echo "Error: Could not fetch available image tags" >&2
+    exit 1
+fi
+
+# Filter out versions higher than KUBERNETES_VERSION_FROM_KAMAJI
+echo "Filtering versions above ${KUBERNETES_VERSION_FROM_KAMAJI}..."
+FILTERED_TAGS=$(echo "$AVAILABLE_TAGS" | while read tag; do
+    if [ -n "$tag" ]; then
+        # Compare tag with KUBERNETES_VERSION_FROM_KAMAJI using version sort
+        # Include tag if it's less than or equal to KUBERNETES_VERSION_FROM_KAMAJI
+        if [ "$(printf '%s\n%s\n' "$tag" "$KUBERNETES_VERSION_FROM_KAMAJI" | sort -V | head -1)" = "$tag" ] || [ "$tag" = "$KUBERNETES_VERSION_FROM_KAMAJI" ]; then
+            echo "$tag"
+        fi
+    fi
+done)
+
+if [ -z "$FILTERED_TAGS" ]; then
+    echo "Error: No versions found after filtering" >&2
+    exit 1
+fi
+
+AVAILABLE_TAGS="$FILTERED_TAGS"
+echo "Filtered to $(echo "$AVAILABLE_TAGS" | wc -l | tr -d ' ') versions"
+
+# Find the latest patch version for the supported major.minor version
+echo "Finding latest patch version for ${KUBERNETES_MAJOR_MINOR}..."
+SUPPORTED_PATCH_TAGS=$(echo "$AVAILABLE_TAGS" | grep "^v${KUBERNETES_MAJOR}\\.${KUBERNETES_MINOR}\\.")
+if [ -z "$SUPPORTED_PATCH_TAGS" ]; then
+    echo "Error: Could not find any patch versions for ${KUBERNETES_MAJOR_MINOR}" >&2
+    exit 1
+fi
+KUBERNETES_VERSION=$(echo "$SUPPORTED_PATCH_TAGS" | tail -n1)
+echo "Using latest patch version: $KUBERNETES_VERSION"
+
+# Build versions map: major.minor -> latest patch version
+# First, collect all unique major.minor versions from available tags
+echo "Collecting all available major.minor versions..."
+ALL_MAJOR_MINOR_VERSIONS=$(echo "$AVAILABLE_TAGS" | sed -E 's/v([0-9]+)\.([0-9]+)\.[0-9]+/v\1.\2/' | sort -V -u)
+
+# Find the position of the supported version in the sorted list
+SUPPORTED_MAJOR_MINOR="v${KUBERNETES_MAJOR}.${KUBERNETES_MINOR}"
+echo "Looking for supported version: $SUPPORTED_MAJOR_MINOR"
+
+# Get all versions that are <= supported version
+# Create a temporary file for filtering
+TEMP_VERSIONS=$(mktemp)
+
+echo "$ALL_MAJOR_MINOR_VERSIONS" | while read version; do
+    # Compare versions using sort -V (version sort)
+    # If version <= supported, include it
+    if [ "$(printf '%s\n%s\n' "$version" "$SUPPORTED_MAJOR_MINOR" | sort -V | head -1)" = "$version" ] || [ "$version" = "$SUPPORTED_MAJOR_MINOR" ]; then
+        echo "$version"
+    fi
+done > "$TEMP_VERSIONS"
+
+# Get the supported version and 5 previous versions (total 6 versions)
+# First, find the position of supported version
+SUPPORTED_POS=$(grep -n "^${SUPPORTED_MAJOR_MINOR}$" "$TEMP_VERSIONS" | cut -d: -f1)
+
+if [ -z "$SUPPORTED_POS" ]; then
+    echo "Error: Supported version $SUPPORTED_MAJOR_MINOR not found in available versions" >&2
+    exit 1
+fi
+
+# Calculate start position (5 versions before supported, or from beginning if less than 5 available)
+TOTAL_LINES=$(wc -l < "$TEMP_VERSIONS" | tr -d ' ')
+START_POS=$((SUPPORTED_POS - 5))
+if [ $START_POS -lt 1 ]; then
+    START_POS=1
+fi
+
+# Extract versions from START_POS to SUPPORTED_POS (inclusive)
+CANDIDATE_VERSIONS=$(sed -n "${START_POS},${SUPPORTED_POS}p" "$TEMP_VERSIONS")
+
+if [ -z "$CANDIDATE_VERSIONS" ]; then
+    echo "Error: Could not find supported version $SUPPORTED_MAJOR_MINOR in available versions" >&2
+    exit 1
+fi
+
+declare -A VERSION_MAP
+VERSIONS=()
+
+# Process each candidate version
+for major_minor_key in $CANDIDATE_VERSIONS; do
+    # Extract major and minor for matching
+    major=$(echo "$major_minor_key" | sed -E 's/v([0-9]+)\.([0-9]+)/\1/')
+    minor=$(echo "$major_minor_key" | sed -E 's/v([0-9]+)\.([0-9]+)/\2/')
+    
+    # Find all tags that match this major.minor version
+    matching_tags=$(echo "$AVAILABLE_TAGS" | grep "^v${major}\\.${minor}\\.")
+    
+    if [ -n "$matching_tags" ]; then
+        # Get the latest patch version for this major.minor version
+        latest_tag=$(echo "$matching_tags" | tail -n1)
+        
+        VERSION_MAP["${major_minor_key}"]="${latest_tag}"
+        VERSIONS+=("${major_minor_key}")
+        echo "Found version: ${major_minor_key} -> ${latest_tag}"
+    fi
+done
+
+if [ ${#VERSIONS[@]} -eq 0 ]; then
+    echo "Error: No matching versions found" >&2
+    exit 1
+fi
+
+# Sort versions in descending order (newest first)
+IFS=$'\n' VERSIONS=($(printf '%s\n' "${VERSIONS[@]}" | sort -V -r))
+unset IFS
+
+echo "Versions to add: ${VERSIONS[*]}"
+
+# Create/update versions.yaml file
+echo "Updating $VERSIONS_FILE..."
+{
+    for ver in "${VERSIONS[@]}"; do
+        echo "\"${ver}\": \"${VERSION_MAP[$ver]}\""
+    done
+} > "$VERSIONS_FILE"
+
+echo "Successfully updated $VERSIONS_FILE"
+
+# Update values.yaml - enum with major.minor versions only
+TEMP_FILE=$(mktemp)
+trap "rm -f $TEMP_FILE $TEMP_VERSIONS" EXIT
+
+# Build new version section
+NEW_VERSION_SECTION="## @enum {string} Version"
+for ver in "${VERSIONS[@]}"; do
+    NEW_VERSION_SECTION="${NEW_VERSION_SECTION}
+## @value $ver"
+done
+NEW_VERSION_SECTION="${NEW_VERSION_SECTION}
+
+## @param {Version} version - Kubernetes major.minor version to deploy
+version: \"${VERSIONS[0]}\""
+
+# Check if version section already exists
+if grep -q "^## @enum {string} Version" "$VALUES_FILE"; then
+    # Version section exists, update it using awk
+    echo "Updating existing version section in $VALUES_FILE..."
+    
+    # Use awk to replace the section from "## @enum {string} Version" to "version: " (inclusive)
+    # Delete the old section and insert the new one
+    awk -v new_section="$NEW_VERSION_SECTION" '
+        /^## @enum {string} Version/ {
+            in_section = 1
+            print new_section
+            next
+        }
+        in_section && /^version: / {
+            in_section = 0
+            next
+        }
+        in_section {
+            next
+        }
+        { print }
+    ' "$VALUES_FILE" > "$TEMP_FILE.tmp"
+    mv "$TEMP_FILE.tmp" "$VALUES_FILE"
+else
+    # Version section doesn't exist, insert it before Application-specific parameters section
+    echo "Inserting new version section in $VALUES_FILE..."
+    
+    # Use awk to insert before "## @section Application-specific parameters"
+    awk -v new_section="$NEW_VERSION_SECTION" '
+        /^## @section Application-specific parameters/ {
+            print new_section
+            print ""
+        }
+        { print }
+    ' "$VALUES_FILE" > "$TEMP_FILE.tmp"
+    mv "$TEMP_FILE.tmp" "$VALUES_FILE"
+fi
+
+echo "Successfully updated $VALUES_FILE with versions: ${VERSIONS[*]}"
+
+# Update KUBERNETES_VERSION in Makefile
+# Extract major.minor from KUBERNETES_VERSION (e.g., "v1.33" from "v1.33.4")
+KUBERNETES_MAJOR_MINOR_FOR_MAKEFILE=$(echo "$KUBERNETES_VERSION" | sed -E 's/v([0-9]+)\.([0-9]+)\.[0-9]+/v\1.\2/')
+
+if grep -q "^KUBERNETES_VERSION" "$MAKEFILE"; then
+    # Update existing KUBERNETES_VERSION line using awk
+    echo "Updating KUBERNETES_VERSION in $MAKEFILE..."
+    awk -v new_version="${KUBERNETES_MAJOR_MINOR_FOR_MAKEFILE}" '
+        /^KUBERNETES_VERSION = / {
+            print "KUBERNETES_VERSION = " new_version
+            next
+        }
+        { print }
+    ' "$MAKEFILE" > "$TEMP_FILE.tmp"
+    mv "$TEMP_FILE.tmp" "$MAKEFILE"
+    echo "Successfully updated KUBERNETES_VERSION in $MAKEFILE to ${KUBERNETES_MAJOR_MINOR_FOR_MAKEFILE}"
+else
+    echo "Warning: KUBERNETES_VERSION not found in $MAKEFILE" >&2
+fi
+

packages/apps/kubernetes/images/cluster-autoscaler.tag

@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/cluster-autoscaler:0.0.0@sha256:e1c0eb54d0ddadc8c7d72cee4f4282d56c957bf4ff0f62ef37db6b38dd0e8a01
+ghcr.io/cozystack/cozystack/cluster-autoscaler:0.0.0@sha256:2d39989846c3579dd020b9f6c77e6e314cc81aa344eaac0f6d633e723c17196d

packages/apps/kubernetes/images/kubevirt-cloud-provider/patches/354.diff

@@ -1,5 +1,5 @@
 diff --git a/pkg/controller/kubevirteps/kubevirteps_controller.go b/pkg/controller/kubevirteps/kubevirteps_controller.go
-index 53388eb8e..873060251 100644
+index 53388eb8e..28644236f 100644
 --- a/pkg/controller/kubevirteps/kubevirteps_controller.go
 +++ b/pkg/controller/kubevirteps/kubevirteps_controller.go
 @@ -12,7 +12,6 @@ import (
@@ -10,17 +10,12 @@ index 53388eb8e..873060251 100644
  	"k8s.io/apimachinery/pkg/runtime"
  	"k8s.io/apimachinery/pkg/runtime/schema"
  	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-@@ -666,38 +665,62 @@ func (c *Controller) getDesiredEndpoints(service *v1.Service, tenantSlices []*di
- 		// for extracting the nodes it does not matter what type of address we are dealing with
- 		// all nodes with an endpoint for a corresponding slice will be selected.
- 		nodeSet := sets.Set[string]{}
-+		hasEndpointsWithoutNodeName := false
+@@ -669,35 +668,50 @@ func (c *Controller) getDesiredEndpoints(service *v1.Service, tenantSlices []*di
  		for _, slice := range tenantSlices {
  			for _, endpoint := range slice.Endpoints {
  				// find all unique nodes that correspond to an endpoint in a tenant slice
 +				if endpoint.NodeName == nil {
 +					klog.Warningf("Skipping endpoint without NodeName in slice %s/%s", slice.Namespace, slice.Name)
-+					hasEndpointsWithoutNodeName = true
 +					continue
 +				}
  				nodeSet.Insert(*endpoint.NodeName)
@@ -28,13 +23,6 @@ index 53388eb8e..873060251 100644
  		}
  
 -		klog.Infof("Desired nodes for service %s in namespace %s: %v", service.Name, service.Namespace, sets.List(nodeSet))
-+		// Fallback: if no endpoints with NodeName were found, but there are endpoints without NodeName,
-+		// distribute traffic to all VMIs (similar to ExternalTrafficPolicy=Cluster behavior)
-+		if nodeSet.Len() == 0 && hasEndpointsWithoutNodeName {
-+			klog.Infof("No endpoints with NodeName found for service %s/%s, falling back to all VMIs", service.Namespace, service.Name)
-+			return c.getAllVMIEndpoints()
-+		}
-+
 +		klog.Infof("Desired nodes for service %s/%s: %v", service.Namespace, service.Name, sets.List(nodeSet))
  
  		for _, node := range sets.List(nodeSet) {
@@ -80,7 +68,7 @@ index 53388eb8e..873060251 100644
  					desiredEndpoints = append(desiredEndpoints, &discovery.Endpoint{
  						Addresses: []string{i.IP},
  						Conditions: discovery.EndpointConditions{
-@@ -705,9 +728,9 @@ func (c *Controller) getDesiredEndpoints(service *v1.Service, tenantSlices []*di
+@@ -705,9 +719,9 @@ func (c *Controller) getDesiredEndpoints(service *v1.Service, tenantSlices []*di
  							Serving:     &serving,
  							Terminating: &terminating,
  						},
@@ -92,71 +80,6 @@ index 53388eb8e..873060251 100644
  				}
  			}
  		}
-@@ -716,6 +739,64 @@ func (c *Controller) getDesiredEndpoints(service *v1.Service, tenantSlices []*di
- 	return desiredEndpoints
- }
- 
-+// getAllVMIEndpoints returns endpoints for all VMIs in the infra namespace.
-+// This is used as a fallback when tenant endpoints don't have NodeName specified,
-+// similar to ExternalTrafficPolicy=Cluster behavior where traffic is distributed to all nodes.
-+func (c *Controller) getAllVMIEndpoints() []*discovery.Endpoint {
-+	var endpoints []*discovery.Endpoint
-+
-+	// List all VMIs in the infra namespace
-+	vmiList, err := c.infraDynamic.
-+		Resource(kubevirtv1.VirtualMachineInstanceGroupVersionKind.GroupVersion().WithResource("virtualmachineinstances")).
-+		Namespace(c.infraNamespace).
-+		List(context.TODO(), metav1.ListOptions{})
-+	if err != nil {
-+		klog.Errorf("Failed to list VMIs in namespace %q: %v", c.infraNamespace, err)
-+		return endpoints
-+	}
-+
-+	for _, obj := range vmiList.Items {
-+		vmi := &kubevirtv1.VirtualMachineInstance{}
-+		err = runtime.DefaultUnstructuredConverter.FromUnstructured(obj.Object, vmi)
-+		if err != nil {
-+			klog.Errorf("Failed to convert Unstructured to VirtualMachineInstance: %v", err)
-+			continue
-+		}
-+
-+		if vmi.Status.NodeName == "" {
-+			klog.Warningf("Skipping VMI %s/%s: NodeName is empty", vmi.Namespace, vmi.Name)
-+			continue
-+		}
-+		nodeNamePtr := &vmi.Status.NodeName
-+
-+		ready := vmi.Status.Phase == kubevirtv1.Running
-+		serving := vmi.Status.Phase == kubevirtv1.Running
-+		terminating := vmi.Status.Phase == kubevirtv1.Failed || vmi.Status.Phase == kubevirtv1.Succeeded
-+
-+		for _, i := range vmi.Status.Interfaces {
-+			if i.Name == "default" {
-+				if i.IP == "" {
-+					klog.Warningf("VMI %s/%s interface %q has no IP, skipping", vmi.Namespace, vmi.Name, i.Name)
-+					continue
-+				}
-+				endpoints = append(endpoints, &discovery.Endpoint{
-+					Addresses: []string{i.IP},
-+					Conditions: discovery.EndpointConditions{
-+						Ready:       &ready,
-+						Serving:     &serving,
-+						Terminating: &terminating,
-+					},
-+					NodeName: nodeNamePtr,
-+				})
-+				break
-+			}
-+		}
-+	}
-+
-+	klog.Infof("Fallback: created %d endpoints from all VMIs in namespace %s", len(endpoints), c.infraNamespace)
-+	return endpoints
-+}
-+
- func (c *Controller) ensureEndpointSliceLabels(slice *discovery.EndpointSlice, svc *v1.Service) (map[string]string, bool) {
- 	labels := make(map[string]string)
- 	labelsChanged := false
 diff --git a/pkg/controller/kubevirteps/kubevirteps_controller_test.go b/pkg/controller/kubevirteps/kubevirteps_controller_test.go
 index 1c97035b4..d205d0bed 100644
 --- a/pkg/controller/kubevirteps/kubevirteps_controller_test.go

packages/apps/kubernetes/images/kubevirt-csi-driver.tag

@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:ae0c5e3e005388d865617097a9fe4b4e8a2be6b62cec893e08f2143d0acde241
+ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:d5c836ba33cf5dbed7e6f866784f668f80ffe69179e7c75847b680111984eefb

packages/apps/kubernetes/templates/delete.yaml

@@ -5,8 +5,8 @@ metadata:
   annotations:
     "helm.sh/hook": pre-delete
     "helm.sh/hook-weight": "10"
-    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation,hook-failed
-  name: {{ .Release.Name }}-cleanup
+    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
+  name: {{ .Release.Name }}-pre-cleanup
 spec:
   template:
     metadata:
@@ -65,7 +65,6 @@ spec:
 
               echo "Cleanup completed successfully"
 
-
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -73,7 +72,7 @@ metadata:
   name: {{ .Release.Name }}-cleanup
   annotations:
     helm.sh/hook: pre-delete
-    helm.sh/hook-delete-policy: before-hook-creation,hook-failed,hook-succeeded
+    helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation,hook-failed
     helm.sh/hook-weight: "0"
 ---
 apiVersion: rbac.authorization.k8s.io/v1

packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml

@@ -8,15 +8,10 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: cert-manager-crds
-  chart:
-    spec:
-      chart: cozy-cert-manager-crds
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-cert-manager-crds
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig
@@ -45,8 +40,6 @@ spec:
   - name: {{ .Release.Name }}
     namespace: {{ .Release.Namespace }}
   {{- end }}
-  - name: {{ .Release.Name }}-cilium
-    namespace: {{ .Release.Namespace }}
 {{- if .Values.addons.certManager.valuesOverride }}
 ---
 apiVersion: v1

packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml

@@ -8,15 +8,10 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: cert-manager
-  chart:
-    spec:
-      chart: cozy-cert-manager
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-cert-manager
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/cilium.yaml

@@ -22,15 +22,10 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: cilium
-  chart:
-    spec:
-      chart: cozy-cilium
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-cilium
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/coredns.yaml

@@ -13,15 +13,10 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: coredns
-  chart:
-    spec:
-      chart: cozy-coredns
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-coredns
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/csi.yaml

@@ -8,15 +8,10 @@ metadata:
 spec:
   interval: 5m
   releaseName: csi
-  chart:
-    spec:
-      chart: cozy-kubevirt-csi-node
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-kubevirt-csi-node
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig
@@ -37,6 +32,8 @@ spec:
   dependsOn:
   - name: {{ .Release.Name }}-vsnap-crd
     namespace: {{ .Release.Namespace }}
+  - name: {{ .Release.Name }}-cilium
+    namespace: {{ .Release.Namespace }}
   {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
   - name: {{ .Release.Name }}
     namespace: {{ .Release.Namespace }}

packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml

@@ -8,15 +8,10 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: fluxcd-operator
-  chart:
-    spec:
-      chart: cozy-fluxcd-operator
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-fluxcd-operator
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig
@@ -56,15 +51,10 @@ metadata:
 spec:
   interval: 5m
   releaseName: fluxcd
-  chart:
-    spec:
-      chart: cozy-fluxcd
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-fluxcd
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-kubeconfig

packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml

@@ -8,15 +8,10 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: gateway-api-crds
-  chart:
-    spec:
-      chart: cozy-gateway-api-crds
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-gateway-api-crds
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml

@@ -8,15 +8,10 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: gpu-operator
-  chart:
-    spec:
-      chart: cozy-gpu-operator
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-gpu-operator
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml

@@ -27,15 +27,10 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: ingress-nginx
-  chart:
-    spec:
-      chart: cozy-ingress-nginx
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-ingress-nginx
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/metrics-server.yaml

@@ -0,0 +1,37 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: {{ .Release.Name }}-metrics-server
+  labels:
+    cozystack.io/repository: system
+    cozystack.io/target-cluster-name: {{ .Release.Name }}
+spec:
+  releaseName: metrics-server
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-metrics-server
+    namespace: cozy-system
+  kubeConfig:
+    secretRef:
+      name: {{ .Release.Name }}-admin-kubeconfig
+      key: super-admin.svc
+  targetNamespace: cozy-monitoring
+  storageNamespace: cozy-monitoring
+  interval: 5m
+  timeout: 10m
+  install:
+    createNamespace: true
+    remediation:
+      retries: -1
+  upgrade:
+    remediation:
+      retries: -1
+  dependsOn:
+  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
+  - name: {{ .Release.Name }}
+    namespace: {{ .Release.Namespace }}
+  {{- end }}
+  - name: {{ .Release.Name }}-cilium
+    namespace: {{ .Release.Namespace }}
+  - name: {{ .Release.Name }}-prometheus-operator-crds
+    namespace: {{ .Release.Namespace }}

packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml

@@ -10,15 +10,10 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: cozy-monitoring-agents
-  chart:
-    spec:
-      chart: cozy-monitoring-agents
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-monitoring-agents
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig
@@ -44,6 +39,10 @@ spec:
     namespace: {{ .Release.Namespace }}
   - name: {{ .Release.Name }}-vertical-pod-autoscaler-crds
     namespace: {{ .Release.Namespace }}
+  - name: {{ .Release.Name }}-prometheus-operator-crds
+    namespace: {{ .Release.Namespace }}
+  - name: {{ .Release.Name }}-metrics-server
+    namespace: {{ .Release.Namespace }}
   values:
     vmagent:
       externalLabels:

packages/apps/kubernetes/templates/helmreleases/prometheus-operator-crds.yaml

@@ -0,0 +1,32 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: {{ .Release.Name }}-prometheus-operator-crds
+  labels:
+    cozystack.io/repository: system
+    cozystack.io/target-cluster-name: {{ .Release.Name }}
+spec:
+  releaseName: prometheus-operator-crds
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-prometheus-operator-crds
+    namespace: cozy-system
+  kubeConfig:
+    secretRef:
+      name: {{ .Release.Name }}-admin-kubeconfig
+      key: super-admin.svc
+  targetNamespace: cozy-victoria-metrics-operator
+  storageNamespace: cozy-victoria-metrics-operator
+  interval: 5m
+  install:
+    createNamespace: true
+    remediation:
+      retries: -1
+  upgrade:
+    remediation:
+      retries: -1
+  dependsOn:
+  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
+  - name: {{ .Release.Name }}
+    namespace: {{ .Release.Namespace }}
+  {{- end }}

packages/apps/kubernetes/templates/helmreleases/velero.yaml

@@ -8,15 +8,10 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: velero
-  chart:
-    spec:
-      chart: cozy-velero
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-velero
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler-crds.yaml

@@ -9,15 +9,10 @@ metadata:
 spec:
   interval: 5m
   releaseName: vertical-pod-autoscaler-crds
-  chart:
-    spec:
-      chart: cozy-vertical-pod-autoscaler-crds
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-vertical-pod-autoscaler-crds
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig
@@ -37,6 +32,4 @@ spec:
   - name: {{ .Release.Name }}
     namespace: {{ .Release.Namespace }}
   {{- end }}
-  - name: {{ .Release.Name }}-cilium
-    namespace: {{ .Release.Namespace }}
 {{- end }}

packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml

@@ -36,15 +36,10 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: vertical-pod-autoscaler
-  chart:
-    spec:
-      chart: cozy-vertical-pod-autoscaler
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-vertical-pod-autoscaler
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml

@@ -8,15 +8,10 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: cozy-victoria-metrics-operator
-  chart:
-    spec:
-      chart: cozy-victoria-metrics-operator
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-victoria-metrics-operator
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml

@@ -7,15 +7,10 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: vsnap-crd
-  chart:
-    spec:
-      chart: cozy-vsnap-crd
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-volumesnapshot-crd
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig
@@ -37,5 +32,3 @@ spec:
   - name: {{ .Release.Name }}
     namespace: {{ .Release.Namespace }}
   {{- end }}
-  - name: {{ .Release.Name }}-cilium
-    namespace: {{ .Release.Namespace }}

packages/apps/kubernetes/values.schema.json

@@ -492,7 +492,7 @@
       }
     },
     "host": {
-      "description": "External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.",
+      "description": "External hostname for Kubernetes cluster. Defaults to `\u003ccluster-name\u003e.\u003ctenant-host\u003e` if empty.",
       "type": "string",
       "default": ""
     },
@@ -615,17 +615,17 @@
       "default": "replicated"
     },
     "version": {
-      "description": "Kubernetes version (vMAJOR.MINOR). Supported: 1.28–1.33.",
+      "description": "Kubernetes major.minor version to deploy",
       "type": "string",
       "default": "v1.33",
       "enum": [
-        "v1.28",
-        "v1.29",
-        "v1.30",
-        "v1.31",
+        "v1.33",
         "v1.32",
-        "v1.33"
+        "v1.31",
+        "v1.30",
+        "v1.29",
+        "v1.28"
       ]
     }
   }
-}
+}

packages/apps/kubernetes/values.yaml

@@ -46,9 +46,19 @@ nodeGroups:
     resources: {}
     gpus: []
 
-## @param {string} version - Kubernetes version (vMAJOR.MINOR). Supported: 1.28–1.33.
+##
+## @enum {string} Version
+## @value v1.33
+## @value v1.32
+## @value v1.31
+## @value v1.30
+## @value v1.29
+## @value v1.28
+
+## @param {Version} version - Kubernetes major.minor version to deploy
 version: "v1.33"
 
+
 ## @param {string} host - External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.
 host: ""
 

packages/apps/mysql/.helmignore

@@ -1,3 +1,4 @@
 .helmignore
 /logos
 /Makefile
+/hack

packages/apps/mysql/Makefile

@@ -7,6 +7,10 @@ generate:
 	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
 	../../../hack/update-crd.sh
 
+update:
+	hack/update-versions.sh
+	make generate
+
 image:
 	docker buildx build images/mariadb-backup \
 		--tag $(REGISTRY)/mariadb-backup:$(call settag,$(MARIADB_BACKUP_TAG)) \

packages/apps/mysql/README.md

@@ -79,6 +79,7 @@ more details:
 | `size`             | Persistent Volume Claim size available for application data.                                                                      | `quantity` | `10Gi`  |
 | `storageClass`     | StorageClass used to store the data.                                                                                              | `string`   | `""`    |
 | `external`         | Enable external access from outside the cluster.                                                                                  | `bool`     | `false` |
+| `version`          | MariaDB major.minor version to deploy                                                                                             | `string`   | `v11.8` |
 
 
 ### Application-specific parameters

packages/apps/mysql/files/versions.yaml

@@ -0,0 +1,4 @@
+"v11.8": "11.8.5"
+"v11.4": "11.4.9"
+"v10.11": "10.11.15"
+"v10.6": "10.6.24"

packages/apps/mysql/hack/update-versions.sh

@@ -0,0 +1,151 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+MYSQL_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+VALUES_FILE="${MYSQL_DIR}/values.yaml"
+VERSIONS_FILE="${MYSQL_DIR}/files/versions.yaml"
+MARIADB_API_URL="https://downloads.mariadb.org/rest-api/mariadb/"
+
+# Check if jq is installed
+if ! command -v jq &> /dev/null; then
+    echo "Error: jq is not installed. Please install jq and try again." >&2
+    exit 1
+fi
+
+# Get LTS versions from MariaDB REST API
+echo "Fetching LTS versions from MariaDB REST API..."
+LTS_VERSIONS_JSON=$(curl -sSL "${MARIADB_API_URL}")
+
+if [ -z "$LTS_VERSIONS_JSON" ]; then
+    echo "Error: Could not fetch versions from MariaDB REST API" >&2
+    exit 1
+fi
+
+# Extract LTS stable major versions
+LTS_MAJOR_VERSIONS=$(echo "$LTS_VERSIONS_JSON" | jq -r '.major_releases[] | select(.release_support_type == "Long Term Support") | select(.release_status == "Stable") | .release_id' | sort -V -r)
+
+if [ -z "$LTS_MAJOR_VERSIONS" ]; then
+    echo "Error: Could not find any LTS stable versions" >&2
+    exit 1
+fi
+
+echo "Found LTS major versions: $(echo "$LTS_MAJOR_VERSIONS" | tr '\n' ' ')"
+
+# Build versions map: major version -> latest patch version
+declare -A VERSION_MAP
+MAJOR_VERSIONS=()
+
+for major_version in $LTS_MAJOR_VERSIONS; do
+    echo "Fetching patch versions for ${major_version}..."
+    
+    # Get patch versions for this major version
+    PATCH_VERSIONS_JSON=$(curl -sSL "${MARIADB_API_URL}${major_version}")
+    
+    if [ -z "$PATCH_VERSIONS_JSON" ]; then
+        echo "Warning: Could not fetch patch versions for ${major_version}, skipping..." >&2
+        continue
+    fi
+    
+    # Extract all stable patch version IDs (format: MAJOR.MINOR.PATCH)
+    # Filter only Stable releases
+    PATCH_VERSIONS=$(echo "$PATCH_VERSIONS_JSON" | jq -r --arg major "$major_version" '.releases | to_entries[] | select(.key | startswith($major + ".")) | select(.value.release_status == "Stable") | .key' | sort -V)
+    
+    # If no stable releases found, try to get any releases (for backwards compatibility)
+    if [ -z "$PATCH_VERSIONS" ]; then
+        PATCH_VERSIONS=$(echo "$PATCH_VERSIONS_JSON" | jq -r '.releases | keys[]' | grep -E "^${major_version}\." | sort -V)
+    fi
+    
+    if [ -z "$PATCH_VERSIONS" ]; then
+        echo "Warning: Could not find any patch versions for ${major_version}, skipping..." >&2
+        continue
+    fi
+    
+    # Get the latest patch version
+    LATEST_PATCH=$(echo "$PATCH_VERSIONS" | tail -n1)
+    
+    # major_version already has format MAJOR.MINOR (e.g., "11.8")
+    VERSION_MAP["v${major_version}"]="${LATEST_PATCH}"
+    MAJOR_VERSIONS+=("v${major_version}")
+    echo "Found version: v${major_version} -> ${LATEST_PATCH}"
+done
+
+if [ ${#MAJOR_VERSIONS[@]} -eq 0 ]; then
+    echo "Error: No matching versions found" >&2
+    exit 1
+fi
+
+# Sort major versions in descending order (newest first)
+IFS=$'\n' MAJOR_VERSIONS=($(printf '%s\n' "${MAJOR_VERSIONS[@]}" | sort -V -r))
+unset IFS
+
+echo "Major versions to add: ${MAJOR_VERSIONS[*]}"
+
+# Create/update versions.yaml file
+echo "Updating $VERSIONS_FILE..."
+{
+    for major_ver in "${MAJOR_VERSIONS[@]}"; do
+        echo "\"${major_ver}\": \"${VERSION_MAP[$major_ver]}\""
+    done
+} > "$VERSIONS_FILE"
+
+echo "Successfully updated $VERSIONS_FILE"
+
+# Update values.yaml - enum with major.minor versions only
+TEMP_FILE=$(mktemp)
+trap "rm -f $TEMP_FILE" EXIT
+
+# Build new version section
+NEW_VERSION_SECTION="## @enum {string} Version"
+for major_ver in "${MAJOR_VERSIONS[@]}"; do
+    NEW_VERSION_SECTION="${NEW_VERSION_SECTION}
+## @value $major_ver"
+done
+NEW_VERSION_SECTION="${NEW_VERSION_SECTION}
+
+## @param {Version} version - MariaDB major.minor version to deploy
+version: ${MAJOR_VERSIONS[0]}"
+
+# Check if version section already exists
+if grep -q "^## @enum {string} Version" "$VALUES_FILE"; then
+    # Version section exists, update it using awk
+    echo "Updating existing version section in $VALUES_FILE..."
+    
+    # Use awk to replace the section from "## @enum {string} Version" to "version: " (inclusive)
+    # Delete the old section and insert the new one
+    awk -v new_section="$NEW_VERSION_SECTION" '
+        /^## @enum {string} Version/ {
+            in_section = 1
+            print new_section
+            next
+        }
+        in_section && /^version: / {
+            in_section = 0
+            next
+        }
+        in_section {
+            next
+        }
+        { print }
+    ' "$VALUES_FILE" > "$TEMP_FILE.tmp"
+    mv "$TEMP_FILE.tmp" "$VALUES_FILE"
+else
+    # Version section doesn't exist, insert it before Application-specific parameters section
+    echo "Inserting new version section in $VALUES_FILE..."
+    
+    # Use awk to insert before "## @section Application-specific parameters"
+    awk -v new_section="$NEW_VERSION_SECTION" '
+        /^## @section Application-specific parameters/ {
+            print new_section
+            print ""
+        }
+        { print }
+    ' "$VALUES_FILE" > "$TEMP_FILE.tmp"
+    mv "$TEMP_FILE.tmp" "$VALUES_FILE"
+fi
+
+echo "Successfully updated $VALUES_FILE with major.minor versions: ${MAJOR_VERSIONS[*]}"
+

packages/apps/mysql/templates/_versions.tpl

@@ -0,0 +1,8 @@
+{{- define "mysql.versionMap" }}
+{{- $versionMap := .Files.Get "files/versions.yaml" | fromYaml }}
+{{- if not (hasKey $versionMap .Values.version) }}
+    {{- printf `MariaDB version %s is not supported, allowed versions are %s` $.Values.version (keys $versionMap) | fail }}
+{{- end }}
+{{- index $versionMap .Values.version }}
+{{- end }}
+

packages/apps/mysql/templates/mariadb.yaml

@@ -8,7 +8,7 @@ spec:
     name: {{ .Release.Name }}-credentials
     key: root
 
-  image: "mariadb:11.0.2"
+  image: "mariadb:{{ include "mysql.versionMap" $ }}"
 
   port: 3306
 

packages/apps/mysql/values.schema.json

@@ -186,6 +186,17 @@
           }
         }
       }
+    },
+    "version": {
+      "description": "MariaDB major.minor version to deploy",
+      "type": "string",
+      "default": "v11.8",
+      "enum": [
+        "v11.8",
+        "v11.4",
+        "v10.11",
+        "v10.6"
+      ]
     }
   }
 }

packages/apps/mysql/values.yaml

@@ -33,6 +33,16 @@ storageClass: ""
 ## @param {bool} external - Enable external access from outside the cluster.
 external: false
 
+##
+## @enum {string} Version
+## @value v11.8
+## @value v11.4
+## @value v10.11
+## @value v10.6
+
+## @param {Version} version - MariaDB major.minor version to deploy
+version: v11.8
+
 ##
 ## @section Application-specific parameters
 ##

packages/apps/nats/templates/nats.yaml

@@ -35,15 +35,10 @@ kind: HelmRelease
 metadata:
   name: {{ .Release.Name }}-system
 spec:
-  chart:
-    spec:
-      chart: cozy-nats
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-nats-application-default-nats-system
+    namespace: cozy-system
   interval: 5m
   timeout: 10m
   install:

packages/apps/postgres/.helmignore

@@ -1,3 +1,4 @@
 .helmignore
 /logos
 /Makefile
+/hack

packages/apps/postgres/Makefile

@@ -3,3 +3,7 @@ include ../../../scripts/package.mk
 generate:
 	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
 	../../../hack/update-crd.sh
+
+update:
+	hack/update-versions.sh
+	make generate

packages/apps/postgres/README.md

@@ -76,6 +76,7 @@ See:
 | `size`             | Persistent Volume Claim size available for application data.                                                                         | `quantity` | `10Gi`  |
 | `storageClass`     | StorageClass used to store the data.                                                                                                 | `string`   | `""`    |
 | `external`         | Enable external access from outside the cluster.                                                                                     | `bool`     | `false` |
+| `version`          | PostgreSQL major version to deploy                                                                                                   | `string`   | `v18`   |
 
 
 ### Application-specific parameters

packages/apps/postgres/files/versions.yaml

@@ -0,0 +1,6 @@
+"v18": "v18.1"
+"v17": "v17.7"
+"v16": "v16.11"
+"v15": "v15.15"
+"v14": "v14.20"
+"v13": "v13.22"

packages/apps/postgres/hack/update-versions.sh

@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+POSTGRES_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+VALUES_FILE="${POSTGRES_DIR}/values.yaml"
+VERSIONS_FILE="${POSTGRES_DIR}/files/versions.yaml"
+
+# Get supported major versions from GitHub README
+echo "Fetching supported major versions from GitHub..."
+SUPPORTED_MAJOR_VERSIONS=$(curl -sSL 'https://raw.githubusercontent.com/cloudnative-pg/postgres-containers/refs/heads/main/README.md' | sed -n '/# CNPG PostgreSQL Container Images/,/#/p' | awk -F' +| +' '$4 ~ /[0-9]+\-[0-9]+\-[0-9]+/ && $6 ~ /[0-9]+\-[0-9]+\-[0-9]+/ {print $2}' | sort -u | xargs)
+
+if [ -z "$SUPPORTED_MAJOR_VERSIONS" ]; then
+    echo "Error: Could not fetch supported major versions" >&2
+    exit 1
+fi
+
+echo "Supported major versions: $SUPPORTED_MAJOR_VERSIONS"
+
+# Check if skopeo is installed
+if ! command -v skopeo &> /dev/null; then
+    echo "Error: skopeo is not installed. Please install skopeo and try again." >&2
+    exit 1
+fi
+
+# Check if jq is installed
+if ! command -v jq &> /dev/null; then
+    echo "Error: jq is not installed. Please install jq and try again." >&2
+    exit 1
+fi
+
+# Get available image tags
+echo "Fetching available image tags from registry..."
+AVAILABLE_TAGS=$(skopeo list-tags docker://ghcr.io/cloudnative-pg/postgresql | jq -r '.Tags[] | select(test("^[0-9]+\\.[0-9]+$"))' | sort -V)
+
+if [ -z "$AVAILABLE_TAGS" ]; then
+    echo "Error: Could not fetch available image tags" >&2
+    exit 1
+fi
+
+# Build versions map: major version -> latest minor version
+declare -A VERSION_MAP
+MAJOR_VERSIONS=()
+
+for major_version in $SUPPORTED_MAJOR_VERSIONS; do
+    # Extract major version number (e.g., "18" from "18.1")
+    major_num=$(echo "$major_version" | cut -d. -f1)
+    
+    # Find all tags that match this major version
+    matching_tags=$(echo "$AVAILABLE_TAGS" | grep "^${major_num}\\.")
+    
+    if [ -n "$matching_tags" ]; then
+        # Get the latest minor version for this major version
+        latest_tag=$(echo "$matching_tags" | tail -n1)
+        VERSION_MAP["v${major_num}"]="v${latest_tag}"
+        MAJOR_VERSIONS+=("v${major_num}")
+        echo "Found version: v${major_num} -> v${latest_tag}"
+    fi
+done
+
+if [ ${#MAJOR_VERSIONS[@]} -eq 0 ]; then
+    echo "Error: No matching versions found" >&2
+    exit 1
+fi
+
+# Sort major versions in descending order (newest first)
+IFS=$'\n' MAJOR_VERSIONS=($(printf '%s\n' "${MAJOR_VERSIONS[@]}" | sort -V -r))
+unset IFS
+
+echo "Major versions to add: ${MAJOR_VERSIONS[*]}"
+
+# Create/update versions.yaml file
+echo "Updating $VERSIONS_FILE..."
+{
+    for major_ver in "${MAJOR_VERSIONS[@]}"; do
+        echo "\"${major_ver}\": \"${VERSION_MAP[$major_ver]}\""
+    done
+} > "$VERSIONS_FILE"
+
+echo "Successfully updated $VERSIONS_FILE"
+
+# Update values.yaml - enum with major versions only
+TEMP_FILE=$(mktemp)
+trap "rm -f $TEMP_FILE" EXIT
+
+# Build new version section
+NEW_VERSION_SECTION="## @enum {string} Version"
+for major_ver in "${MAJOR_VERSIONS[@]}"; do
+    NEW_VERSION_SECTION="${NEW_VERSION_SECTION}
+## @value $major_ver"
+done
+NEW_VERSION_SECTION="${NEW_VERSION_SECTION}
+
+## @param {Version} version - PostgreSQL major version to deploy
+version: ${MAJOR_VERSIONS[0]}"
+
+# Check if version section already exists
+if grep -q "^## @enum {string} Version" "$VALUES_FILE"; then
+    # Version section exists, update it using awk
+    echo "Updating existing version section in $VALUES_FILE..."
+    
+    # Use awk to replace the section from "## @enum {string} Version" to "version: " (inclusive)
+    # Delete the old section and insert the new one
+    awk -v new_section="$NEW_VERSION_SECTION" '
+        /^## @enum {string} Version/ {
+            in_section = 1
+            print new_section
+            next
+        }
+        in_section && /^version: / {
+            in_section = 0
+            next
+        }
+        in_section {
+            next
+        }
+        { print }
+    ' "$VALUES_FILE" > "$TEMP_FILE.tmp"
+    mv "$TEMP_FILE.tmp" "$VALUES_FILE"
+else
+    # Version section doesn't exist, insert it before Application-specific parameters section
+    echo "Inserting new version section in $VALUES_FILE..."
+    
+    # Use awk to insert before "## @section Application-specific parameters"
+    awk -v new_section="$NEW_VERSION_SECTION" '
+        /^## @section Application-specific parameters/ {
+            print new_section
+            print ""
+        }
+        { print }
+    ' "$VALUES_FILE" > "$TEMP_FILE.tmp"
+    mv "$TEMP_FILE.tmp" "$VALUES_FILE"
+fi
+
+echo "Successfully updated $VALUES_FILE with major versions: ${MAJOR_VERSIONS[*]}"

packages/apps/postgres/templates/_versions.tpl

@@ -0,0 +1,8 @@
+{{- define "postgres.versionMap" }}
+{{- $versionMap := .Files.Get "files/versions.yaml" | fromYaml }}
+{{- if not (hasKey $versionMap .Values.version) }}
+    {{- printf `PostgreSQL version %s is not supported, allowed versions are %s` $.Values.version (keys $versionMap) | fail }}
+{{- end }}
+{{- index $versionMap .Values.version }}
+{{- end }}
+

packages/apps/postgres/templates/db.yaml

@@ -44,6 +44,7 @@ spec:
 
   resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.resourcesPreset .Values.resources $) | nindent 4 }}
 
+  imageName: ghcr.io/cloudnative-pg/postgresql:{{ include "postgres.versionMap" $ | trimPrefix "v" }}
   enableSuperuserAccess: true
   {{- $configMap := lookup "v1" "ConfigMap" "cozy-system" "cozystack-scheduling" }}
   {{- if $configMap }}

packages/apps/postgres/templates/init-job.yaml

@@ -16,7 +16,7 @@ spec:
       restartPolicy: Never
       containers:
       - name: postgres
-        image: ghcr.io/cloudnative-pg/postgresql:15.3
+        image: ghcr.io/cloudnative-pg/postgresql:{{ include "postgres.versionMap" $ | trimPrefix "v" }}
         command:
         - bash
         - /scripts/init.sh

packages/apps/postgres/values.schema.json

@@ -243,6 +243,19 @@
           }
         }
       }
+    },
+    "version": {
+      "description": "PostgreSQL major version to deploy",
+      "type": "string",
+      "default": "v18",
+      "enum": [
+        "v18",
+        "v17",
+        "v16",
+        "v15",
+        "v14",
+        "v13"
+      ]
     }
   }
 }

packages/apps/postgres/values.yaml

@@ -34,6 +34,17 @@ storageClass: ""
 external: false
 
 ##
+## @enum {string} Version
+## @value v18
+## @value v17
+## @value v16
+## @value v15
+## @value v14
+## @value v13
+
+## @param {Version} version - PostgreSQL major version to deploy
+version: v18
+
 ## @section Application-specific parameters
 ##
 

packages/apps/redis/.helmignore

@@ -1,3 +1,4 @@
 .helmignore
 /logos
 /Makefile
+/hack

packages/apps/redis/Makefile

@@ -3,3 +3,7 @@ include ../../../scripts/package.mk
 generate:
 	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
 	../../../hack/update-crd.sh
+
+update:
+	hack/update-versions.sh
+	make generate

packages/apps/redis/README.md

@@ -23,6 +23,7 @@ Service utilizes the Spotahome Redis Operator for efficient management and orche
 | `size`             | Persistent Volume Claim size available for application data.                                                                    | `quantity` | `1Gi`   |
 | `storageClass`     | StorageClass used to store the data.                                                                                            | `string`   | `""`    |
 | `external`         | Enable external access from outside the cluster.                                                                                | `bool`     | `false` |
+| `version`          | Redis major version to deploy                                                                                                   | `string`   | `v8`    |
 
 
 ### Application-specific parameters

packages/apps/redis/files/versions.yaml

@@ -0,0 +1,2 @@
+"v8": "8.4.0"
+"v7": "7.4.7"