Merge remote-tracking branch 'upstream/main' into refactor-engine

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

.github/workflows/auto-release.yaml

@@ -1,185 +0,0 @@
-name: Auto Patch Release
-
-on:
-  schedule:
-    # Run daily at 2:00 AM CET (1:00 UTC in winter, 0:00 UTC in summer)
-    # Using 1:00 UTC to approximate 2:00 AM CET
-    - cron: '0 1 * * *'
-  workflow_dispatch: # Allow manual trigger
-
-concurrency:
-  group: auto-release-${{ github.workflow }}
-  cancel-in-progress: false
-
-jobs:
-  auto-release:
-    name: Auto Patch Release
-    runs-on: [self-hosted]
-    permissions:
-      contents: write
-      pull-requests: read
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          fetch-tags: true
-
-      - name: Configure git
-        env:
-          GH_PAT: ${{ secrets.GH_PAT }}
-        run: |
-          git config user.name  "cozystack-bot"
-          git config user.email "217169706+cozystack-bot@users.noreply.github.com"
-          git remote set-url origin https://cozystack-bot:${GH_PAT}@github.com/${GITHUB_REPOSITORY}
-
-      - name: Process release branches
-        uses: actions/github-script@v7
-        env:
-          GH_PAT: ${{ secrets.GH_PAT }}
-        with:
-          github-token: ${{ secrets.GH_PAT }}
-          script: |
-            const { execSync } = require('child_process');
-
-            // Configure git to use PAT for authentication
-            execSync('git config user.name "cozystack-bot"', { encoding: 'utf8' });
-            execSync('git config user.email "217169706+cozystack-bot@users.noreply.github.com"', { encoding: 'utf8' });
-            execSync(`git remote set-url origin https://cozystack-bot:${process.env.GH_PAT}@github.com/${process.env.GITHUB_REPOSITORY}`, { encoding: 'utf8' });
-
-            // Get all release-X.Y branches
-            const branches = execSync('git branch -r | grep -E "origin/release-[0-9]+\\.[0-9]+$" | sed "s|origin/||" | tr -d " "', { encoding: 'utf8' })
-              .split('\n')
-              .filter(b => b.trim())
-              .filter(b => /^release-\d+\.\d+$/.test(b));
-            
-            console.log(`Found ${branches.length} release branches: ${branches.join(', ')}`);
-            
-            // Get all published releases (not draft)
-            const allReleases = await github.rest.repos.listReleases({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              per_page: 100
-            });
-            
-            // Filter to only published releases (not draft) with tags matching vX.Y.Z (no suffixes)
-            const publishedReleases = allReleases.data
-              .filter(r => !r.draft)
-              .filter(r => /^v\d+\.\d+\.\d+$/.test(r.tag_name));
-            
-            console.log(`Found ${publishedReleases.length} published releases without suffixes`);
-            
-            for (const branch of branches) {
-              console.log(`\n=== Processing branch: ${branch} ===`);
-              
-              // Extract X.Y from branch name (release-X.Y)
-              const match = branch.match(/^release-(\d+\.\d+)$/);
-              if (!match) {
-                console.log(`  ⚠️  Branch ${branch} doesn't match pattern, skipping`);
-                continue;
-              }
-              
-              const [major, minor] = match[1].split('.');
-              const versionPrefix = `v${major}.${minor}.`;
-              
-              console.log(`  Looking for releases with prefix: ${versionPrefix}`);
-              
-              // Find the latest published release for this branch (vX.Y.Z without suffixes)
-              const branchReleases = publishedReleases
-                .filter(r => r.tag_name.startsWith(versionPrefix))
-                .filter(r => /^v\d+\.\d+\.\d+$/.test(r.tag_name)); // Ensure no suffixes
-              
-              if (branchReleases.length === 0) {
-                console.log(`  ⚠️  No published releases found for ${branch}, skipping`);
-                continue;
-              }
-              
-              // Sort by version (descending) to get the latest
-              branchReleases.sort((a, b) => {
-                const aVersion = a.tag_name.match(/^v(\d+)\.(\d+)\.(\d+)$/);
-                const bVersion = b.tag_name.match(/^v(\d+)\.(\d+)\.(\d+)$/);
-                if (!aVersion || !bVersion) return 0;
-                
-                const aNum = parseInt(aVersion[1]) * 10000 + parseInt(aVersion[2]) * 100 + parseInt(aVersion[3]);
-                const bNum = parseInt(bVersion[1]) * 10000 + parseInt(bVersion[2]) * 100 + parseInt(bVersion[3]);
-                return bNum - aNum;
-              });
-              
-              const latestRelease = branchReleases[0];
-              console.log(`  ✅ Latest published release: ${latestRelease.tag_name}`);
-              
-              // Get the commit SHA for this release tag
-              let releaseCommitSha;
-              try {
-                releaseCommitSha = execSync(`git rev-list -n 1 ${latestRelease.tag_name}`, { encoding: 'utf8' }).trim();
-                console.log(`  Release commit SHA: ${releaseCommitSha}`);
-              } catch (error) {
-                console.log(`  ⚠️  Could not find commit for tag ${latestRelease.tag_name}, skipping`);
-                continue;
-              }
-              
-              // Checkout the branch
-              execSync(`git fetch origin ${branch}:${branch}`, { encoding: 'utf8' });
-              execSync(`git checkout ${branch}`, { encoding: 'utf8' });
-              
-              // Get the latest commit on the branch
-              const latestBranchCommit = execSync('git rev-parse HEAD', { encoding: 'utf8' }).trim();
-              console.log(`  Latest branch commit: ${latestBranchCommit}`);
-              
-              // Check if there are new commits after the release
-              const commitsAfterRelease = execSync(
-                `git rev-list ${releaseCommitSha}..HEAD --oneline`,
-                { encoding: 'utf8' }
-              ).trim();
-              
-              if (!commitsAfterRelease) {
-                console.log(`  ℹ️  No new commits after ${latestRelease.tag_name}, skipping`);
-                continue;
-              }
-              
-              console.log(`  ✅ Found new commits after release:`);
-              console.log(commitsAfterRelease);
-              
-              // Calculate next version (Z+1)
-              const versionMatch = latestRelease.tag_name.match(/^v(\d+)\.(\d+)\.(\d+)$/);
-              if (!versionMatch) {
-                console.log(`  ❌ Could not parse version from ${latestRelease.tag_name}, skipping`);
-                continue;
-              }
-              
-              const nextPatch = parseInt(versionMatch[3]) + 1;
-              const nextTag = `v${versionMatch[1]}.${versionMatch[2]}.${nextPatch}`;
-              
-              console.log(`  🏷️  Creating new tag: ${nextTag} on commit ${latestBranchCommit}`);
-              
-              // Create and push the tag with base_ref for workflow triggering
-              try {
-                // Delete local tag if exists to force update
-                try {
-                  execSync(`git tag -d ${nextTag}`, { encoding: 'utf8' });
-                } catch (e) {
-                  // Tag doesn't exist locally, that's fine
-                }
-
-                // Delete remote tag if exists
-                try {
-                  execSync(`git push origin :refs/tags/${nextTag}`, { encoding: 'utf8' });
-                } catch (e) {
-                  // Tag doesn't exist remotely, that's fine
-                }
-
-                // Create tag locally
-                execSync(`git tag ${nextTag} ${latestBranchCommit}`, { encoding: 'utf8' });
-
-                // Push tag with HEAD reference to preserve base_ref
-                execSync(`git push origin HEAD:refs/tags/${nextTag}`, { encoding: 'utf8' });
-                console.log(`  ✅ Successfully created and pushed tag ${nextTag}`);
-              } catch (error) {
-                console.log(`  ❌ Error creating/pushing tag ${nextTag}: ${error.message}`);
-                core.setFailed(`Failed to create tag ${nextTag} for branch ${branch}`);
-              }
-            }
-            
-            console.log(`\n✅ Finished processing all release branches`);
-

.github/workflows/backport.yaml

@@ -2,7 +2,7 @@ name: Automatic Backport
 
 on:
   pull_request_target:
-    types: [closed, labeled]   # fires when PR is closed (merged) or labeled
+    types: [closed]   # fires when PR is closed (merged)
 
 concurrency:
   group: backport-${{ github.workflow }}-${{ github.event.pull_request.number }}
@@ -13,46 +13,22 @@ permissions:
   pull-requests: write
 
 jobs:
-  # Determine which backports are needed
-  prepare:
+  backport:
     if: |
       github.event.pull_request.merged == true &&
-      (
-        contains(github.event.pull_request.labels.*.name, 'backport') ||
-        contains(github.event.pull_request.labels.*.name, 'backport-previous') ||
-        (github.event.action == 'labeled' && (github.event.label.name == 'backport' || github.event.label.name == 'backport-previous'))
-      )
+      contains(github.event.pull_request.labels.*.name, 'backport')
     runs-on: [self-hosted]
-    outputs:
-      backport_current: ${{ steps.labels.outputs.backport }}
-      backport_previous: ${{ steps.labels.outputs.backport_previous }}
-      current_branch: ${{ steps.branches.outputs.current_branch }}
-      previous_branch: ${{ steps.branches.outputs.previous_branch }}
+
     steps:
-      - name: Check which labels are present
-        id: labels
+      # 1. Decide which maintenance branch should receive the back‑port
+      - name: Determine target maintenance branch
+        id: target
         uses: actions/github-script@v7
         with:
           script: |
-            const pr = context.payload.pull_request;
-            const labels = pr.labels.map(l => l.name);
-            const isBackport = labels.includes('backport');
-            const isBackportPrevious = labels.includes('backport-previous');
-            
-            core.setOutput('backport', isBackport ? 'true' : 'false');
-            core.setOutput('backport_previous', isBackportPrevious ? 'true' : 'false');
-            
-            console.log(`backport label: ${isBackport}, backport-previous label: ${isBackportPrevious}`);
-      
-      - name: Determine target branches
-        id: branches
-        uses: actions/github-script@v7
-        with:
-          script: |
-            // Get latest release
-            let latestRelease;
+            let rel;
             try {
-              latestRelease = await github.rest.repos.getLatestRelease({
+              rel = await github.rest.repos.getLatestRelease({
                 owner: context.repo.owner,
                 repo: context.repo.repo
               });
@@ -60,70 +36,18 @@ jobs:
               core.setFailed('No existing releases found; cannot determine backport target.');
               return;
             }
-            
-            const [maj, min] = latestRelease.data.tag_name.replace(/^v/, '').split('.');
-            const currentBranch = `release-${maj}.${min}`;
-            const prevMin = parseInt(min) - 1;
-            const previousBranch = prevMin >= 0 ? `release-${maj}.${prevMin}` : '';
-            
-            core.setOutput('current_branch', currentBranch);
-            core.setOutput('previous_branch', previousBranch);
-            
-            console.log(`Current branch: ${currentBranch}, Previous branch: ${previousBranch || 'N/A'}`);
-            
-            // Verify previous branch exists if we need it
-            if (previousBranch && '${{ steps.labels.outputs.backport_previous }}' === 'true') {
-              try {
-                await github.rest.repos.getBranch({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  branch: previousBranch
-                });
-                console.log(`Previous branch ${previousBranch} exists`);
-              } catch (e) {
-                core.setFailed(`Previous branch ${previousBranch} does not exist.`);
-                return;
-              }
-            }
-
-  backport:
-    needs: prepare
-    if: |
-      github.event.pull_request.merged == true &&
-      (needs.prepare.outputs.backport_current == 'true' || needs.prepare.outputs.backport_previous == 'true')
-    runs-on: [self-hosted]
-    strategy:
-      matrix:
-        backport_type: [current, previous]
-    steps:
-      # 1. Determine target branch based on matrix
-      - name: Set target branch
-        id: target
-        if: |
-          (matrix.backport_type == 'current' && needs.prepare.outputs.backport_current == 'true') ||
-          (matrix.backport_type == 'previous' && needs.prepare.outputs.backport_previous == 'true')
-        run: |
-          if [ "${{ matrix.backport_type }}" == "current" ]; then
-            echo "branch=${{ needs.prepare.outputs.current_branch }}" >> $GITHUB_OUTPUT
-            echo "Target branch: ${{ needs.prepare.outputs.current_branch }}"
-          else
-            echo "branch=${{ needs.prepare.outputs.previous_branch }}" >> $GITHUB_OUTPUT
-            echo "Target branch: ${{ needs.prepare.outputs.previous_branch }}"
-          fi
-      
+            const [maj, min] = rel.data.tag_name.replace(/^v/, '').split('.');
+            const branch = `release-${maj}.${min}`;
+            core.setOutput('branch', branch);
+            console.log(`Latest release ${rel.data.tag_name}; backporting to ${branch}`);
       # 2. Checkout (required by backport‑action)
       - name: Checkout repository
-        if: steps.target.outcome == 'success'
         uses: actions/checkout@v4
 
       # 3. Create the back‑port pull request
       - name: Create back‑port PR
-        id: backport
-        if: steps.target.outcome == 'success'
-        uses: korthout/backport-action@v3.2.1
+        uses: korthout/backport-action@v3
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           label_pattern: '' # don't read labels for targets
           target_branches: ${{ steps.target.outputs.branch }}
-          merge_commits: skip
-          conflict_resolution: draft_commit_conflicts

.github/workflows/pre-commit.yml

@@ -28,7 +28,7 @@ jobs:
 
       - name: Install generate
         run: |
-          curl -sSL https://github.com/cozystack/cozyvalues-gen/releases/download/v1.0.6/cozyvalues-gen-linux-amd64.tar.gz | tar -xzvf- -C /usr/local/bin/ cozyvalues-gen
+          curl -sSL https://github.com/cozystack/cozyvalues-gen/releases/download/v1.0.5/cozyvalues-gen-linux-amd64.tar.gz | tar -xzvf- -C /usr/local/bin/ cozyvalues-gen
 
       - name: Run pre-commit hooks
         run: |

.github/workflows/pull-requests-release.yaml

@@ -46,12 +46,7 @@ jobs:
           fetch-depth: 0
 
       - name: Create tag on merge commit
-        env:
-          GH_PAT: ${{ secrets.GH_PAT }}
         run: |
-          git config user.name  "cozystack-bot"
-          git config user.email "217169706+cozystack-bot@users.noreply.github.com"
-          git remote set-url origin https://cozystack-bot:${GH_PAT}@github.com/${GITHUB_REPOSITORY}
           git tag -f ${{ steps.get_tag.outputs.tag }} ${{ github.sha }}
           git push -f origin ${{ steps.get_tag.outputs.tag }}
 

.github/workflows/update-releasenotes.yaml

@@ -1,92 +0,0 @@
-name: Update Release Notes
-
-on:
-  push:
-    branches:
-      - main
-
-concurrency:
-  group: update-releasenotes-${{ github.workflow }}
-  cancel-in-progress: false
-
-jobs:
-  update-releasenotes:
-    name: Update Release Notes
-    runs-on: [self-hosted]
-    permissions:
-      contents: write
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Update release notes from changelogs
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const fs = require('fs');
-            const path = require('path');
-            
-            const changelogDir = 'docs/changelogs';
-            
-            // Get releases from first page
-            const releases = await github.rest.repos.listReleases({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              per_page: 30
-            });
-            
-            console.log(`Found ${releases.data.length} releases (first page only)`);
-            
-            // Process each release
-            for (const release of releases.data) {
-              const tag = release.tag_name;
-              const changelogFile = `${tag}.md`;
-              const changelogPath = path.join(changelogDir, changelogFile);
-              
-              console.log(`\nProcessing release: ${tag}`);
-              
-              // Check if changelog file exists
-              if (!fs.existsSync(changelogPath)) {
-                console.log(`  ⚠️  Changelog file ${changelogFile} does not exist, skipping...`);
-                continue;
-              }
-              
-              // Read changelog file content
-              let changelogContent;
-              try {
-                changelogContent = fs.readFileSync(changelogPath, 'utf8');
-              } catch (error) {
-                console.log(`  ❌ Error reading file ${changelogPath}: ${error.message}`);
-                continue;
-              }
-              
-              if (!changelogContent.trim()) {
-                console.log(`  ⚠️  Changelog file ${changelogFile} is empty, skipping...`);
-                continue;
-              }
-              
-              // Check if content is already up to date
-              const currentBody = release.body || '';
-              if (currentBody.trim() === changelogContent.trim()) {
-                console.log(`  ✓ Content is already up to date, skipping...`);
-                continue;
-              }
-              
-              // Update release notes
-              try {
-                await github.rest.repos.updateRelease({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  release_id: release.id,
-                  body: changelogContent
-                });
-                console.log(`  ✅ Successfully updated release notes for ${tag}`);
-              } catch (error) {
-                console.log(`  ❌ Error updating release ${tag}: ${error.message}`);
-                core.setFailed(`Failed to update release notes for ${tag}`);
-              }
-            }
-

ADOPTERS.md

@@ -32,4 +32,4 @@ This list is sorted in chronological order, based on the submission date.
 | [Urmanac](https://urmanac.com) | @kingdonb | 2024-12-04 | Urmanac is the future home of a hosting platform for the knowledge base of a community of personal server enthusiasts. We use Cozystack to provide support services for web sites hosted using both conventional deployments and on SpinKube, with WASM. |
 | [Hidora](https://hikube.cloud) | @matthieu-robin | 2025-09-17 | Hidora is a Swiss cloud provider delivering managed services and infrastructure solutions through datacenters located in Switzerland, ensuring data sovereignty and reliability. Its sovereign cloud platform, Hikube, is designed to run workloads with high availability across multiple datacenters, providing enterprises with a secure and scalable foundation for their applications based on Cozystack. |
 | [QOSI](https://qosi.kz) | @tabu-a | 2025-10-04 | QOSI is a non-profit organization driving open-source adoption and digital sovereignty across Kazakhstan and Central Asia. We use Cozystack as a platform for deploying sovereign, GPU-enabled clouds and educational environments under the National AI Program. Our goal is to accelerate the region’s transition toward open, self-hosted cloud-native technologies |
-| [Cloupard](https://cloupard.kz/) | @serjiott | 2025-12-18 | Cloupard is a public cloud provider offering IaaS and PaaS services via datacenters in Kazakhstan and Uzbekistan. Uses CozyStack on bare metal to extend its managed PaaS offerings. |
+|

AGENTS.md

@@ -3,38 +3,14 @@
 This file provides structured guidance for AI coding assistants and agents
 working with the **Cozystack** project.
 
-## Activation
+## Agent Documentation
 
-**CRITICAL**: When the user asks you to do something that matches the scope of a documented process, you MUST read the corresponding documentation file and follow the instructions exactly as written.
-
-- **Commits, PRs, git operations** (e.g., "create a commit", "make a PR", "fix review comments", "rebase", "cherry-pick")
-  - Read: [`contributing.md`](./docs/agents/contributing.md)
-  - Action: Read the entire file and follow ALL instructions step-by-step
-
-- **Changelog generation** (e.g., "generate changelog", "create changelog", "prepare changelog for version X")
-  - Read: [`changelog.md`](./docs/agents/changelog.md)
-  - Action: Read the entire file and follow ALL steps in the checklist. Do NOT skip any mandatory steps
-
-- **Release creation** (e.g., "create release", "prepare release", "tag release", "make a release")
-  - Read: [`releasing.md`](./docs/agents/releasing.md)
-  - Action: Read the file and follow the referenced release process in `docs/release.md`
-
-- **Project structure, conventions, code layout** (e.g., "where should I put X", "what's the convention for Y", "how is the project organized")
-  - Read: [`overview.md`](./docs/agents/overview.md)
-  - Action: Read relevant sections to understand project structure and conventions
-
-- **General questions about contributing**
-  - Read: [`contributing.md`](./docs/agents/contributing.md)
-  - Action: Read the file to understand git workflow, commit format, PR process
-
-**Important rules:**
-- ✅ **ONLY read the file if the task matches the documented process scope** - do not read files for tasks that don't match their purpose
-- ✅ **ALWAYS read the file FIRST** before starting the task (when applicable)
-- ✅ **Follow instructions EXACTLY** as written in the documentation
-- ✅ **Do NOT skip mandatory steps** (especially in changelog.md)
-- ✅ **Do NOT assume** you know the process - always check the documentation when the task matches
-- ❌ **Do NOT read files** for tasks that are outside their documented scope
-- 📖 **Note**: [`overview.md`](./docs/agents/overview.md) can be useful as a reference to understand project structure and conventions, even when not explicitly required by the task
+| Agent | Purpose |
+|-------|---------|
+| [overview.md](./docs/agents/overview.md) | Project structure and conventions |
+| [contributing.md](./docs/agents/contributing.md) | Commits, pull requests, and git workflow |
+| [changelog.md](./docs/agents/changelog.md) | Changelog generation instructions |
+| [releasing.md](./docs/agents/releasing.md) | Release process and workflow |
 
 ## Project Overview
 

Makefile

@@ -15,9 +15,9 @@ build: build-deps
 	make -C packages/extra/monitoring image
 	make -C packages/system/cozystack-api image
 	make -C packages/system/cozystack-controller image
-	make -C packages/system/backup-controller image
 	make -C packages/system/lineage-controller-webhook image
 	make -C packages/system/cilium image
+	make -C packages/system/kubeovn image
 	make -C packages/system/kubeovn-webhook image
 	make -C packages/system/kubeovn-plunger image
 	make -C packages/system/dashboard image
@@ -26,20 +26,15 @@ build: build-deps
 	make -C packages/system/bucket image
 	make -C packages/system/objectstorage-controller image
 	make -C packages/core/testing image
+	make -C packages/core/installer image-operator
 	make -C packages/core/talos image
 	make -C packages/core/platform image
-	make -C packages/core/installer image
+	make -C packages/core/installer image-packages
 	make manifests
 
-repos:
-	rm -rf _out
-	make -C packages/system repo
-	make -C packages/apps repo
-	make -C packages/extra repo
-
 manifests:
 	mkdir -p _out/assets
-	(cd packages/core/installer/; helm template -n cozy-installer installer .) > _out/assets/cozystack-installer.yaml
+	(cd packages/core/installer/; helm template -n cozy-system cozystack-operator . | sed '/^WARNING/d') > _out/assets/cozystack-installer.yaml
 
 assets:
 	make -C packages/core/talos assets

api/.gitattributes

@@ -1 +0,0 @@
-zz_generated_deepcopy.go linguist-generated

api/backups/strategy/v1alpha1/groupversion_info.go

@@ -1,37 +0,0 @@
-/*
-Copyright 2025.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Package v1alpha1 contains API Schema definitions for the  v1alpha1 API group.
-// +kubebuilder:object:generate=true
-// +groupName=strategy.backups.cozystack.io
-package v1alpha1
-
-import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-)
-
-var (
-	GroupVersion  = schema.GroupVersion{Group: "strategy.backups.cozystack.io", Version: "v1alpha1"}
-	SchemeBuilder = runtime.NewSchemeBuilder(addGroupVersion)
-	AddToScheme   = SchemeBuilder.AddToScheme
-)
-
-func addGroupVersion(scheme *runtime.Scheme) error {
-	metav1.AddToGroupVersion(scheme, GroupVersion)
-	return nil
-}

api/backups/strategy/v1alpha1/job_types.go

@@ -1,63 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Package v1alpha1 defines strategy.backups.cozystack.io API types.
-//
-// Group: strategy.backups.cozystack.io
-// Version: v1alpha1
-package v1alpha1
-
-import (
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-func init() {
-	SchemeBuilder.Register(func(s *runtime.Scheme) error {
-		s.AddKnownTypes(GroupVersion,
-			&Job{},
-			&JobList{},
-		)
-		return nil
-	})
-}
-
-const (
-	JobStrategyKind = "Job"
-)
-
-// +kubebuilder:object:root=true
-// +kubebuilder:subresource:status
-// +kubebuilder:resource:scope=Cluster
-
-// Job defines a backup strategy using a one-shot Job
-type Job struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   JobSpec   `json:"spec,omitempty"`
-	Status JobStatus `json:"status,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// JobList contains a list of backup Jobs.
-type JobList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []Job `json:"items"`
-}
-
-// JobSpec specifies the desired behavior of a backup job.
-type JobSpec struct {
-	// Template holds a PodTemplateSpec with the right shape to
-	// run a single pod to completion and create a tarball with
-	// a given apps data. Helm-like Go templates are supported.
-	// The values of the source application are available under
-	// `.Values`. `.Release.Name` and `.Release.Namespace` are
-	// also exported.
-	Template corev1.PodTemplateSpec `json:"template"`
-}
-
-type JobStatus struct {
-	Conditions []metav1.Condition `json:"conditions,omitempty"`
-}

api/backups/strategy/v1alpha1/velero_types.go

@@ -1,54 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Package v1alpha1 defines strategy.backups.cozystack.io API types.
-//
-// Group: strategy.backups.cozystack.io
-// Version: v1alpha1
-package v1alpha1
-
-import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-func init() {
-	SchemeBuilder.Register(func(s *runtime.Scheme) error {
-		s.AddKnownTypes(GroupVersion,
-			&Velero{},
-			&VeleroList{},
-		)
-		return nil
-	})
-}
-
-const (
-	VeleroStrategyKind = "Velero"
-)
-
-// +kubebuilder:object:root=true
-// +kubebuilder:subresource:status
-// +kubebuilder:resource:scope=Cluster
-
-// Velero defines a backup strategy using Velero as the driver.
-type Velero struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   VeleroSpec   `json:"spec,omitempty"`
-	Status VeleroStatus `json:"status,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// VeleroList contains a list of Velero backup strategies.
-type VeleroList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []Velero `json:"items"`
-}
-
-// VeleroSpec specifies the desired strategy for backing up with Velero.
-type VeleroSpec struct{}
-
-type VeleroStatus struct {
-	Conditions []metav1.Condition `json:"conditions,omitempty"`
-}

api/backups/strategy/v1alpha1/zz_generated.deepcopy.go

@@ -1,219 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Job) DeepCopyInto(out *Job) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Job.
-func (in *Job) DeepCopy() *Job {
-	if in == nil {
-		return nil
-	}
-	out := new(Job)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Job) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *JobList) DeepCopyInto(out *JobList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]Job, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JobList.
-func (in *JobList) DeepCopy() *JobList {
-	if in == nil {
-		return nil
-	}
-	out := new(JobList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *JobList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *JobSpec) DeepCopyInto(out *JobSpec) {
-	*out = *in
-	in.Template.DeepCopyInto(&out.Template)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JobSpec.
-func (in *JobSpec) DeepCopy() *JobSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(JobSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *JobStatus) DeepCopyInto(out *JobStatus) {
-	*out = *in
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]v1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JobStatus.
-func (in *JobStatus) DeepCopy() *JobStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(JobStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Velero) DeepCopyInto(out *Velero) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	out.Spec = in.Spec
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Velero.
-func (in *Velero) DeepCopy() *Velero {
-	if in == nil {
-		return nil
-	}
-	out := new(Velero)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Velero) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *VeleroList) DeepCopyInto(out *VeleroList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]Velero, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VeleroList.
-func (in *VeleroList) DeepCopy() *VeleroList {
-	if in == nil {
-		return nil
-	}
-	out := new(VeleroList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *VeleroList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *VeleroSpec) DeepCopyInto(out *VeleroSpec) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VeleroSpec.
-func (in *VeleroSpec) DeepCopy() *VeleroSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(VeleroSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *VeleroStatus) DeepCopyInto(out *VeleroStatus) {
-	*out = *in
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]v1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VeleroStatus.
-func (in *VeleroStatus) DeepCopy() *VeleroStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(VeleroStatus)
-	in.DeepCopyInto(out)
-	return out
-}

api/backups/v1alpha1/DESIGN.md

@@ -1,421 +0,0 @@
-# Cozystack Backups – Core API & Contracts (Draft)
-
-## 1. Overview
-
-Cozystack’s backup subsystem provides a generic, composable way to back up and restore managed applications:
-
-* Every **application instance** can have one or more **backup plans**.
-* Backups are stored in configurable **storage locations**.
-* The mechanics of *how* a backup/restore is performed are delegated to **strategy drivers**, each implementing driver-specific **BackupStrategy** CRDs.
-
-The core API:
-
-* Orchestrates **when** backups happen and **where** they’re stored.
-* Tracks **what** backups exist and their status.
-* Defines contracts with drivers via shared resources (`BackupJob`, `Backup`, `RestoreJob`).
-
-It does **not** implement the backup logic itself.
-
-This document covers only the **core** API and its contracts with drivers, not driver implementations.
-
----
-
-## 2. Goals and non-goals
-
-### Goals
-
-* Provide a **stable core API** for:
-
-  * Declaring **backup plans** per application.
-  * Configuring **storage targets** (S3, in-cluster bucket, etc.).
-  * Tracking **backup artifacts**.
-  * Initiating and tracking **restores**.
-* Allow multiple **strategy drivers** to plug in, each supporting specific kinds of applications and strategies.
-* Let application/product authors implement backup for their kinds by:
-
-  * Creating **Plan** objects referencing a **driver-specific strategy**.
-  * Not having to write a backup engine themselves.
-
-### Non-goals
-
-* Implement backup logic for any specific application or storage backend.
-* Define the internal structure of driver-specific strategy CRDs.
-* Handle tenant-facing UI/UX (that’s built on top of these APIs).
-
----
-
-## 3. Architecture
-
-High-level components:
-
-* **Core backups controller(s)** (Cozystack-owned):
-
-  * Group: `backups.cozystack.io`
-  * Own:
-
-    * `Plan`
-    * `BackupJob`
-    * `Backup`
-    * `RestoreJob`
-  * Responsibilities:
-
-    * Schedule backups based on `Plan`.
-    * Create `BackupJob` objects when due.
-    * Provide stable contracts for drivers to:
-
-      * Perform backups and create `Backup`s.
-      * Perform restores based on `Backup`s.
-
-* **Strategy drivers** (pluggable, possibly third-party):
-
-  * Their own API groups, e.g. `jobdriver.backups.cozystack.io`.
-  * Own **strategy CRDs** (e.g. `JobBackupStrategy`).
-  * Implement controllers that:
-
-    * Watch `BackupJob` / `RestoreJob`.
-    * Match runs whose `strategyRef` GVK they support.
-    * Execute backup/restore logic.
-    * Create and update `Backup` and run statuses.
-
-Strategy drivers and core communicate entirely via Kubernetes objects; there are no webhook/HTTP calls between them.
-
-* **Storage drivers** (pluggable, possibly third-party):
-
-  * **TBD**
-
----
-
-## 4. Core API resources
-
-### 4.1 Plan
-
-**Group/Kind**
-`backups.cozystack.io/v1alpha1, Kind=Plan`
-
-**Purpose**
-Describe **when**, **how**, and **where** to back up a specific managed application.
-
-**Key fields (spec)**
-
-```go
-type PlanSpec struct {
-    // Application to back up.
-    ApplicationRef corev1.TypedLocalObjectReference `json:"applicationRef"`
-
-    // Where backups should be stored.
-    StorageRef corev1.TypedLocalObjectReference `json:"storageRef"`
-
-    // Driver-specific BackupStrategy to use.
-    StrategyRef corev1.TypedLocalObjectReference `json:"strategyRef"`
-
-    // When backups should run.
-    Schedule PlanSchedule `json:"schedule"`
-}
-```
-
-`PlanSchedule` (initially) supports only cron:
-
-```go
-type PlanScheduleType string
-
-const (
-    PlanScheduleTypeEmpty PlanScheduleType = ""
-    PlanScheduleTypeCron  PlanScheduleType = "cron"
-)
-```
-
-```go
-type PlanSchedule struct {
-    // Type is the schedule type. Currently only "cron" is supported.
-    // Defaults to "cron".
-    Type PlanScheduleType `json:"type,omitempty"`
-
-    // Cron expression (required for cron type).
-    Cron string `json:"cron,omitempty"`
-}
-```
-
-**Plan reconciliation contract**
-
-Core Plan controller:
-
-1. **Read schedule** from `spec.schedule` and compute the next fire time.
-2. When due:
-
-   * Create a `BackupJob` in the same namespace:
-
-     * `spec.planRef.name = plan.Name`
-     * `spec.applicationRef = plan.spec.applicationRef`
-     * `spec.storageRef = plan.spec.storageRef`
-     * `spec.strategyRef = plan.spec.strategyRef`
-     * `spec.triggeredBy = "Plan"`
-   * Set `ownerReferences` so the `BackupJob` is owned by the `Plan`.
-
-The Plan controller does **not**:
-
-* Execute backups itself.
-* Modify driver resources or `Backup` objects.
-* Touch `BackupJob.spec` after creation.
-
----
-
-### 4.2 Storage
-
-**API Shape**
-
-TBD
-
-**Storage usage**
-
-* `Plan` and `BackupJob` reference `Storage` via `TypedLocalObjectReference`.
-* Drivers read `Storage` to know how/where to store or read artifacts.
-* Core treats `Storage` spec as opaque; it does not directly talk to S3 or buckets.
-
----
-
-### 4.3 BackupJob
-
-**Group/Kind**
-`backups.cozystack.io/v1alpha1, Kind=BackupJob`
-
-**Purpose**
-Represent a single **execution** of a backup operation, typically created when a `Plan` fires or when a user triggers an ad-hoc backup.
-
-**Key fields (spec)**
-
-```go
-type BackupJobSpec struct {
-    // Plan that triggered this run, if any.
-    PlanRef *corev1.LocalObjectReference `json:"planRef,omitempty"`
-
-    // Application to back up.
-    ApplicationRef corev1.TypedLocalObjectReference `json:"applicationRef"`
-
-    // Storage to use.
-    StorageRef corev1.TypedLocalObjectReference `json:"storageRef"`
-
-    // Driver-specific BackupStrategy to use.
-    StrategyRef corev1.TypedLocalObjectReference `json:"strategyRef"`
-
-    // Informational: what triggered this run ("Plan", "Manual", etc.).
-    TriggeredBy string `json:"triggeredBy,omitempty"`
-}
-```
-
-**Key fields (status)**
-
-```go
-type BackupJobStatus struct {
-    Phase       BackupJobPhase         `json:"phase,omitempty"`
-    BackupRef   *corev1.LocalObjectReference `json:"backupRef,omitempty"`
-    StartedAt   *metav1.Time           `json:"startedAt,omitempty"`
-    CompletedAt *metav1.Time           `json:"completedAt,omitempty"`
-    Message     string                 `json:"message,omitempty"`
-    Conditions  []metav1.Condition     `json:"conditions,omitempty"`
-}
-```
-
-`BackupJobPhase` is one of: `Pending`, `Running`, `Succeeded`, `Failed`.
-
-**BackupJob contract with drivers**
-
-* Core **creates** `BackupJob` and must treat `spec` as immutable afterwards.
-* Each driver controller:
-
-  * Watches `BackupJob`.
-  * Reconciles runs where `spec.strategyRef.apiGroup/kind` matches its **strategy type(s)**.
-* Driver responsibilities:
-
-  1. On first reconcile:
-
-     * Set `status.startedAt` if unset.
-     * Set `status.phase = Running`.
-  2. Resolve inputs:
-
-     * Read `Strategy` (driver-owned CRD), `Storage`, `Application`, optionally `Plan`.
-  3. Execute backup logic (implementation-specific).
-  4. On success:
-
-     * Create a `Backup` resource (see below).
-     * Set `status.backupRef` to the created `Backup`.
-     * Set `status.completedAt`.
-     * Set `status.phase = Succeeded`.
-  5. On failure:
-
-     * Set `status.completedAt`.
-     * Set `status.phase = Failed`.
-     * Set `status.message` and conditions.
-
-Drivers must **not** modify `BackupJob.spec` or delete `BackupJob` themselves.
-
----
-
-### 4.4 Backup
-
-**Group/Kind**
-`backups.cozystack.io/v1alpha1, Kind=Backup`
-
-**Purpose**
-Represent a single **backup artifact** for a given application, decoupled from a particular run. usable as a stable, listable “thing you can restore from”.
-
-**Key fields (spec)**
-
-```go
-type BackupSpec struct {
-    ApplicationRef corev1.TypedLocalObjectReference `json:"applicationRef"`
-    PlanRef        *corev1.LocalObjectReference     `json:"planRef,omitempty"`
-    StorageRef     corev1.TypedLocalObjectReference `json:"storageRef"`
-    StrategyRef    corev1.TypedLocalObjectReference `json:"strategyRef"`
-    TakenAt        metav1.Time                      `json:"takenAt"`
-    DriverMetadata map[string]string                `json:"driverMetadata,omitempty"`
-}
-```
-
-**Key fields (status)**
-
-```go
-type BackupStatus struct {
-    Phase      BackupPhase       `json:"phase,omitempty"` // Pending, Ready, Failed, etc.
-    Artifact   *BackupArtifact   `json:"artifact,omitempty"`
-    Conditions []metav1.Condition `json:"conditions,omitempty"`
-}
-```
-
-`BackupArtifact` describes the artifact (URI, size, checksum).
-
-**Backup contract with drivers**
-
-* On successful completion of a `BackupJob`, the **driver**:
-
-  * Creates a `Backup` in the same namespace (typically owned by the `BackupJob`).
-  * Populates `spec` fields with:
-
-    * The application, storage, strategy references.
-    * `takenAt`.
-    * Optional `driverMetadata`.
-  * Sets `status` with:
-
-    * `phase = Ready` (or equivalent when fully usable).
-    * `artifact` describing the stored object.
-* Core:
-
-  * Treats `Backup` spec as mostly immutable and opaque.
-  * Uses it to:
-
-    * List backups for a given application/plan.
-    * Anchor `RestoreJob` operations.
-    * Implement higher-level policies (retention) if needed.
-
----
-
-### 4.5 RestoreJob
-
-**Group/Kind**
-`backups.cozystack.io/v1alpha1, Kind=RestoreJob`
-
-**Purpose**
-Represent a single **restore operation** from a `Backup`, either back into the same application or into a new target application.
-
-**Key fields (spec)**
-
-```go
-type RestoreJobSpec struct {
-    // Backup to restore from.
-    BackupRef corev1.LocalObjectReference `json:"backupRef"`
-
-    // Target application; if omitted, drivers SHOULD restore into
-    // backup.spec.applicationRef.
-    TargetApplicationRef *corev1.TypedLocalObjectReference `json:"targetApplicationRef,omitempty"`
-}
-```
-
-**Key fields (status)**
-
-```go
-type RestoreJobStatus struct {
-    Phase       RestoreJobPhase   `json:"phase,omitempty"` // Pending, Running, Succeeded, Failed
-    StartedAt   *metav1.Time      `json:"startedAt,omitempty"`
-    CompletedAt *metav1.Time      `json:"completedAt,omitempty"`
-    Message     string            `json:"message,omitempty"`
-    Conditions  []metav1.Condition `json:"conditions,omitempty"`
-}
-```
-
-**RestoreJob contract with drivers**
-
-* RestoreJob is created either manually or by core.
-* Driver controller:
-
-  1. Watches `RestoreJob`.
-  2. On reconcile:
-
-     * Fetches the referenced `Backup`.
-     * Determines effective:
-
-       * **Strategy**: `backup.spec.strategyRef`.
-       * **Storage**: `backup.spec.storageRef`.
-       * **Target application**: `spec.targetApplicationRef` or `backup.spec.applicationRef`.
-     * If effective strategy’s GVK is one of its supported strategy types → driver is responsible.
-  3. Behaviour:
-
-     * On first reconcile, set `status.startedAt` and `phase = Running`.
-     * Resolve `Backup`, `Storage`, `Strategy`, target application.
-     * Execute restore logic (implementation-specific).
-     * On success:
-
-       * Set `status.completedAt`.
-       * Set `status.phase = Succeeded`.
-     * On failure:
-
-       * Set `status.completedAt`.
-       * Set `status.phase = Failed`.
-       * Set `status.message` and conditions.
-
-Drivers must not modify `RestoreJob.spec` or delete `RestoreJob`.
-
----
-
-## 5. Strategy drivers (high-level)
-
-Strategy drivers are separate controllers that:
-
-* Define their own **strategy CRDs** (e.g. `JobBackupStrategy`) in their own API groups:
-
-  * e.g. `jobdriver.backups.cozystack.io/v1alpha1, Kind=JobBackupStrategy`
-* Implement the **BackupJob contract**:
-
-  * Watch `BackupJob`.
-  * Filter by `spec.strategyRef.apiGroup/kind`.
-  * Execute backup logic.
-  * Create/update `Backup`.
-* Implement the **RestoreJob contract**:
-
-  * Watch `RestoreJob`.
-  * Resolve `Backup`, then effective `strategyRef`.
-  * Filter by effective strategy GVK.
-  * Execute restore logic.
-
-The core backups API **does not** dictate:
-
-* The fields and structure of driver strategy specs.
-* How drivers implement backup/restore internally (Jobs, snapshots, native operator CRDs, etc.).
-
-Drivers are interchangeable as long as they respect:
-
-* The `BackupJob` and `RestoreJob` contracts.
-* The shapes and semantics of `Backup` objects.
-
----
-
-## 6. Summary
-
-The Cozystack backups core API:
-
-* Uses a single group, `backups.cozystack.io`, for all core CRDs.
-* Cleanly separates:
-
-  * **When & where** (Plan + Storage) – core-owned.
-  * **What backup artifacts exist** (Backup) – driver-created but cluster-visible.
-  * **Execution lifecycle** (BackupJob, RestoreJob) – shared contract boundary.
-* Allows multiple strategy drivers to implement backup/restore logic without entangling their implementation with the core API.
-

api/backups/v1alpha1/backup_types.go

@@ -1,118 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Package v1alpha1 defines backups.cozystack.io API types.
-//
-// Group: backups.cozystack.io
-// Version: v1alpha1
-package v1alpha1
-
-import (
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-func init() {
-	SchemeBuilder.Register(func(s *runtime.Scheme) error {
-		s.AddKnownTypes(GroupVersion,
-			&Backup{},
-			&BackupList{},
-		)
-		return nil
-	})
-}
-
-// BackupPhase represents the lifecycle phase of a Backup.
-type BackupPhase string
-
-const (
-	BackupPhaseEmpty   BackupPhase = ""
-	BackupPhasePending BackupPhase = "Pending"
-	BackupPhaseReady   BackupPhase = "Ready"
-	BackupPhaseFailed  BackupPhase = "Failed"
-)
-
-// BackupArtifact describes the stored backup object (tarball, snapshot, etc.).
-type BackupArtifact struct {
-	// URI is a driver-/storage-specific URI pointing to the backup artifact.
-	// For example: s3://bucket/prefix/file.tar.gz
-	URI string `json:"uri"`
-
-	// SizeBytes is the size of the artifact in bytes, if known.
-	// +optional
-	SizeBytes int64 `json:"sizeBytes,omitempty"`
-
-	// Checksum is the checksum of the artifact, if computed.
-	// For example: "sha256:<hex>".
-	// +optional
-	Checksum string `json:"checksum,omitempty"`
-}
-
-// BackupSpec describes an immutable backup artifact produced by a BackupJob.
-type BackupSpec struct {
-	// ApplicationRef refers to the application that was backed up.
-	ApplicationRef corev1.TypedLocalObjectReference `json:"applicationRef"`
-
-	// PlanRef refers to the Plan that produced this backup, if any.
-	// For manually triggered backups, this can be omitted.
-	// +optional
-	PlanRef *corev1.LocalObjectReference `json:"planRef,omitempty"`
-
-	// StorageRef refers to the Storage object that describes where the backup
-	// artifact is stored.
-	StorageRef corev1.TypedLocalObjectReference `json:"storageRef"`
-
-	// StrategyRef refers to the driver-specific BackupStrategy that was used
-	// to create this backup. This allows the driver to later perform restores.
-	StrategyRef corev1.TypedLocalObjectReference `json:"strategyRef"`
-
-	// TakenAt is the time at which the backup was taken (as reported by the
-	// driver). It may differ slightly from metadata.creationTimestamp.
-	TakenAt metav1.Time `json:"takenAt"`
-
-	// DriverMetadata holds driver-specific, opaque metadata associated with
-	// this backup (for example snapshot IDs, schema versions, etc.).
-	// This data is not interpreted by the core backup controllers.
-	// +optional
-	DriverMetadata map[string]string `json:"driverMetadata,omitempty"`
-}
-
-// BackupStatus represents the observed state of a Backup.
-type BackupStatus struct {
-	// Phase is a simple, high-level summary of the backup's state.
-	// Typical values are: Pending, Ready, Failed.
-	// +optional
-	Phase BackupPhase `json:"phase,omitempty"`
-
-	// Artifact describes the stored backup object, if available.
-	// +optional
-	Artifact *BackupArtifact `json:"artifact,omitempty"`
-
-	// Conditions represents the latest available observations of a Backup's state.
-	// +optional
-	Conditions []metav1.Condition `json:"conditions,omitempty"`
-}
-
-// The field indexing on applicationRef will be needed later to display per-app backup resources.
-
-// +kubebuilder:object:root=true
-// +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.apiGroup`
-// +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.kind`
-// +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.name`
-
-// Backup represents a single backup artifact for a given application.
-type Backup struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   BackupSpec   `json:"spec,omitempty"`
-	Status BackupStatus `json:"status,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// BackupList contains a list of Backups.
-type BackupList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []Backup `json:"items"`
-}

api/backups/v1alpha1/backupjob_types.go

@@ -1,109 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Package v1alpha1 defines backups.cozystack.io API types.
-//
-// Group: backups.cozystack.io
-// Version: v1alpha1
-package v1alpha1
-
-import (
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-func init() {
-	SchemeBuilder.Register(func(s *runtime.Scheme) error {
-		s.AddKnownTypes(GroupVersion,
-			&BackupJob{},
-			&BackupJobList{},
-		)
-		return nil
-	})
-}
-
-// BackupJobPhase represents the lifecycle phase of a BackupJob.
-type BackupJobPhase string
-
-const (
-	BackupJobPhaseEmpty     BackupJobPhase = ""
-	BackupJobPhasePending   BackupJobPhase = "Pending"
-	BackupJobPhaseRunning   BackupJobPhase = "Running"
-	BackupJobPhaseSucceeded BackupJobPhase = "Succeeded"
-	BackupJobPhaseFailed    BackupJobPhase = "Failed"
-)
-
-// BackupJobSpec describes the execution of a single backup operation.
-type BackupJobSpec struct {
-	// PlanRef refers to the Plan that requested this backup run.
-	// For ad-hoc/manual backups, this can be omitted.
-	// +optional
-	PlanRef *corev1.LocalObjectReference `json:"planRef,omitempty"`
-
-	// ApplicationRef holds a reference to the managed application whose state
-	// is being backed up.
-	ApplicationRef corev1.TypedLocalObjectReference `json:"applicationRef"`
-
-	// StorageRef holds a reference to the Storage object that describes where
-	// the backup will be stored.
-	StorageRef corev1.TypedLocalObjectReference `json:"storageRef"`
-
-	// StrategyRef holds a reference to the driver-specific BackupStrategy object
-	// that describes how the backup should be created.
-	StrategyRef corev1.TypedLocalObjectReference `json:"strategyRef"`
-}
-
-// BackupJobStatus represents the observed state of a BackupJob.
-type BackupJobStatus struct {
-	// Phase is a high-level summary of the run's state.
-	// Typical values: Pending, Running, Succeeded, Failed.
-	// +optional
-	Phase BackupJobPhase `json:"phase,omitempty"`
-
-	// BackupRef refers to the Backup object created by this run, if any.
-	// +optional
-	BackupRef *corev1.LocalObjectReference `json:"backupRef,omitempty"`
-
-	// StartedAt is the time at which the backup run started.
-	// +optional
-	StartedAt *metav1.Time `json:"startedAt,omitempty"`
-
-	// CompletedAt is the time at which the backup run completed (successfully
-	// or otherwise).
-	// +optional
-	CompletedAt *metav1.Time `json:"completedAt,omitempty"`
-
-	// Message is a human-readable message indicating details about why the
-	// backup run is in its current phase, if any.
-	// +optional
-	Message string `json:"message,omitempty"`
-
-	// Conditions represents the latest available observations of a BackupJob's state.
-	// +optional
-	Conditions []metav1.Condition `json:"conditions,omitempty"`
-}
-
-// The field indexing on applicationRef will be needed later to display per-app backup resources.
-
-// +kubebuilder:object:root=true
-// +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.apiGroup`
-// +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.kind`
-// +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.name`
-
-// BackupJob represents a single execution of a backup.
-// It is typically created by a Plan controller when a schedule fires.
-type BackupJob struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   BackupJobSpec   `json:"spec,omitempty"`
-	Status BackupJobStatus `json:"status,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// BackupJobList contains a list of BackupJobs.
-type BackupJobList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []BackupJob `json:"items"`
-}

api/backups/v1alpha1/groupversion_info.go

@@ -1,37 +0,0 @@
-/*
-Copyright 2025.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Package v1alpha1 contains API Schema definitions for the  v1alpha1 API group.
-// +kubebuilder:object:generate=true
-// +groupName=backups.cozystack.io
-package v1alpha1
-
-import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-)
-
-var (
-	GroupVersion  = schema.GroupVersion{Group: "backups.cozystack.io", Version: "v1alpha1"}
-	SchemeBuilder = runtime.NewSchemeBuilder(addGroupVersion)
-	AddToScheme   = SchemeBuilder.AddToScheme
-)
-
-func addGroupVersion(scheme *runtime.Scheme) error {
-	metav1.AddToGroupVersion(scheme, GroupVersion)
-	return nil
-}

api/backups/v1alpha1/plan_types.go

@@ -1,98 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Package v1alpha1 defines backups.cozystack.io API types.
-//
-// Group: backups.cozystack.io
-// Version: v1alpha1
-package v1alpha1
-
-import (
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-func init() {
-	SchemeBuilder.Register(func(s *runtime.Scheme) error {
-		s.AddKnownTypes(GroupVersion,
-			&Plan{},
-			&PlanList{},
-		)
-		return nil
-	})
-}
-
-type PlanScheduleType string
-
-const (
-	PlanScheduleTypeEmpty PlanScheduleType = ""
-	PlanScheduleTypeCron  PlanScheduleType = "cron"
-)
-
-// Condtions
-const (
-	PlanConditionError = "Error"
-)
-
-// The field indexing on applicationRef will be needed later to display per-app backup resources.
-
-// +kubebuilder:object:root=true
-// +kubebuilder:subresource:status
-// +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.apiGroup`
-// +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.kind`
-// +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.name`
-
-// Plan describes the schedule, method and storage location for the
-// backup of a given target application.
-type Plan struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   PlanSpec   `json:"spec,omitempty"`
-	Status PlanStatus `json:"status,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// PlanList contains a list of backup Plans.
-type PlanList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []Plan `json:"items"`
-}
-
-// PlanSpec references the storage, the strategy, the application to be
-// backed up and specifies the timetable on which the backups will run.
-type PlanSpec struct {
-	// ApplicationRef holds a reference to the managed application,
-	// whose state and configuration must be backed up.
-	ApplicationRef corev1.TypedLocalObjectReference `json:"applicationRef"`
-
-	// StorageRef holds a reference to the Storage object that
-	// describes the location where the backup will be stored.
-	StorageRef corev1.TypedLocalObjectReference `json:"storageRef"`
-
-	// StrategyRef holds a reference to the Strategy object that
-	// describes, how a backup copy is to be created.
-	StrategyRef corev1.TypedLocalObjectReference `json:"strategyRef"`
-
-	// Schedule specifies when backup copies are created.
-	Schedule PlanSchedule `json:"schedule"`
-}
-
-// PlanSchedule specifies when backup copies are created.
-type PlanSchedule struct {
-	// Type is the type of schedule specification. Supported values are
-	// [`cron`]. If omitted, defaults to `cron`.
-	// +optional
-	Type PlanScheduleType `json:"type,omitempty"`
-
-	// Cron contains the cron spec for scheduling backups. Must be
-	// specified if the schedule type is `cron`. Since only `cron` is
-	// supported, omitting this field is not allowed.
-	// +optional
-	Cron string `json:"cron,omitempty"`
-}
-
-type PlanStatus struct {
-	Conditions []metav1.Condition `json:"conditions,omitempty"`
-}

api/backups/v1alpha1/restorejob_types.go

@@ -1,91 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Package v1alpha1 defines backups.cozystack.io API types.
-//
-// Group: backups.cozystack.io
-// Version: v1alpha1
-package v1alpha1
-
-import (
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-func init() {
-	SchemeBuilder.Register(func(s *runtime.Scheme) error {
-		s.AddKnownTypes(GroupVersion,
-			&RestoreJob{},
-			&RestoreJobList{},
-		)
-		return nil
-	})
-}
-
-// RestoreJobPhase represents the lifecycle phase of a RestoreJob.
-type RestoreJobPhase string
-
-const (
-	RestoreJobPhaseEmpty     RestoreJobPhase = ""
-	RestoreJobPhasePending   RestoreJobPhase = "Pending"
-	RestoreJobPhaseRunning   RestoreJobPhase = "Running"
-	RestoreJobPhaseSucceeded RestoreJobPhase = "Succeeded"
-	RestoreJobPhaseFailed    RestoreJobPhase = "Failed"
-)
-
-// RestoreJobSpec describes the execution of a single restore operation.
-type RestoreJobSpec struct {
-	// BackupRef refers to the Backup that should be restored.
-	BackupRef corev1.LocalObjectReference `json:"backupRef"`
-
-	// TargetApplicationRef refers to the application into which the backup
-	// should be restored. If omitted, the driver SHOULD restore into the same
-	// application as referenced by backup.spec.applicationRef.
-	// +optional
-	TargetApplicationRef *corev1.TypedLocalObjectReference `json:"targetApplicationRef,omitempty"`
-}
-
-// RestoreJobStatus represents the observed state of a RestoreJob.
-type RestoreJobStatus struct {
-	// Phase is a high-level summary of the run's state.
-	// Typical values: Pending, Running, Succeeded, Failed.
-	// +optional
-	Phase RestoreJobPhase `json:"phase,omitempty"`
-
-	// StartedAt is the time at which the restore run started.
-	// +optional
-	StartedAt *metav1.Time `json:"startedAt,omitempty"`
-
-	// CompletedAt is the time at which the restore run completed (successfully
-	// or otherwise).
-	// +optional
-	CompletedAt *metav1.Time `json:"completedAt,omitempty"`
-
-	// Message is a human-readable message indicating details about why the
-	// restore run is in its current phase, if any.
-	// +optional
-	Message string `json:"message,omitempty"`
-
-	// Conditions represents the latest available observations of a RestoreJob's state.
-	// +optional
-	Conditions []metav1.Condition `json:"conditions,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// RestoreJob represents a single execution of a restore from a Backup.
-type RestoreJob struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   RestoreJobSpec   `json:"spec,omitempty"`
-	Status RestoreJobStatus `json:"status,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// RestoreJobList contains a list of RestoreJobs.
-type RestoreJobList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []RestoreJob `json:"items"`
-}

api/backups/v1alpha1/zz_generated.deepcopy.go

@@ -1,501 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Backup) DeepCopyInto(out *Backup) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backup.
-func (in *Backup) DeepCopy() *Backup {
-	if in == nil {
-		return nil
-	}
-	out := new(Backup)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Backup) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BackupArtifact) DeepCopyInto(out *BackupArtifact) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupArtifact.
-func (in *BackupArtifact) DeepCopy() *BackupArtifact {
-	if in == nil {
-		return nil
-	}
-	out := new(BackupArtifact)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BackupJob) DeepCopyInto(out *BackupJob) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupJob.
-func (in *BackupJob) DeepCopy() *BackupJob {
-	if in == nil {
-		return nil
-	}
-	out := new(BackupJob)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *BackupJob) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BackupJobList) DeepCopyInto(out *BackupJobList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]BackupJob, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupJobList.
-func (in *BackupJobList) DeepCopy() *BackupJobList {
-	if in == nil {
-		return nil
-	}
-	out := new(BackupJobList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *BackupJobList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BackupJobSpec) DeepCopyInto(out *BackupJobSpec) {
-	*out = *in
-	if in.PlanRef != nil {
-		in, out := &in.PlanRef, &out.PlanRef
-		*out = new(v1.LocalObjectReference)
-		**out = **in
-	}
-	in.ApplicationRef.DeepCopyInto(&out.ApplicationRef)
-	in.StorageRef.DeepCopyInto(&out.StorageRef)
-	in.StrategyRef.DeepCopyInto(&out.StrategyRef)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupJobSpec.
-func (in *BackupJobSpec) DeepCopy() *BackupJobSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(BackupJobSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BackupJobStatus) DeepCopyInto(out *BackupJobStatus) {
-	*out = *in
-	if in.BackupRef != nil {
-		in, out := &in.BackupRef, &out.BackupRef
-		*out = new(v1.LocalObjectReference)
-		**out = **in
-	}
-	if in.StartedAt != nil {
-		in, out := &in.StartedAt, &out.StartedAt
-		*out = (*in).DeepCopy()
-	}
-	if in.CompletedAt != nil {
-		in, out := &in.CompletedAt, &out.CompletedAt
-		*out = (*in).DeepCopy()
-	}
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]metav1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupJobStatus.
-func (in *BackupJobStatus) DeepCopy() *BackupJobStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(BackupJobStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BackupList) DeepCopyInto(out *BackupList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]Backup, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupList.
-func (in *BackupList) DeepCopy() *BackupList {
-	if in == nil {
-		return nil
-	}
-	out := new(BackupList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *BackupList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BackupSpec) DeepCopyInto(out *BackupSpec) {
-	*out = *in
-	in.ApplicationRef.DeepCopyInto(&out.ApplicationRef)
-	if in.PlanRef != nil {
-		in, out := &in.PlanRef, &out.PlanRef
-		*out = new(v1.LocalObjectReference)
-		**out = **in
-	}
-	in.StorageRef.DeepCopyInto(&out.StorageRef)
-	in.StrategyRef.DeepCopyInto(&out.StrategyRef)
-	in.TakenAt.DeepCopyInto(&out.TakenAt)
-	if in.DriverMetadata != nil {
-		in, out := &in.DriverMetadata, &out.DriverMetadata
-		*out = make(map[string]string, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupSpec.
-func (in *BackupSpec) DeepCopy() *BackupSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(BackupSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BackupStatus) DeepCopyInto(out *BackupStatus) {
-	*out = *in
-	if in.Artifact != nil {
-		in, out := &in.Artifact, &out.Artifact
-		*out = new(BackupArtifact)
-		**out = **in
-	}
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]metav1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupStatus.
-func (in *BackupStatus) DeepCopy() *BackupStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(BackupStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Plan) DeepCopyInto(out *Plan) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Plan.
-func (in *Plan) DeepCopy() *Plan {
-	if in == nil {
-		return nil
-	}
-	out := new(Plan)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Plan) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PlanList) DeepCopyInto(out *PlanList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]Plan, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PlanList.
-func (in *PlanList) DeepCopy() *PlanList {
-	if in == nil {
-		return nil
-	}
-	out := new(PlanList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *PlanList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PlanSchedule) DeepCopyInto(out *PlanSchedule) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PlanSchedule.
-func (in *PlanSchedule) DeepCopy() *PlanSchedule {
-	if in == nil {
-		return nil
-	}
-	out := new(PlanSchedule)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PlanSpec) DeepCopyInto(out *PlanSpec) {
-	*out = *in
-	in.ApplicationRef.DeepCopyInto(&out.ApplicationRef)
-	in.StorageRef.DeepCopyInto(&out.StorageRef)
-	in.StrategyRef.DeepCopyInto(&out.StrategyRef)
-	out.Schedule = in.Schedule
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PlanSpec.
-func (in *PlanSpec) DeepCopy() *PlanSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(PlanSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PlanStatus) DeepCopyInto(out *PlanStatus) {
-	*out = *in
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]metav1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PlanStatus.
-func (in *PlanStatus) DeepCopy() *PlanStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(PlanStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RestoreJob) DeepCopyInto(out *RestoreJob) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RestoreJob.
-func (in *RestoreJob) DeepCopy() *RestoreJob {
-	if in == nil {
-		return nil
-	}
-	out := new(RestoreJob)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *RestoreJob) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RestoreJobList) DeepCopyInto(out *RestoreJobList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]RestoreJob, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RestoreJobList.
-func (in *RestoreJobList) DeepCopy() *RestoreJobList {
-	if in == nil {
-		return nil
-	}
-	out := new(RestoreJobList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *RestoreJobList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RestoreJobSpec) DeepCopyInto(out *RestoreJobSpec) {
-	*out = *in
-	out.BackupRef = in.BackupRef
-	if in.TargetApplicationRef != nil {
-		in, out := &in.TargetApplicationRef, &out.TargetApplicationRef
-		*out = new(v1.TypedLocalObjectReference)
-		(*in).DeepCopyInto(*out)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RestoreJobSpec.
-func (in *RestoreJobSpec) DeepCopy() *RestoreJobSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(RestoreJobSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RestoreJobStatus) DeepCopyInto(out *RestoreJobStatus) {
-	*out = *in
-	if in.StartedAt != nil {
-		in, out := &in.StartedAt, &out.StartedAt
-		*out = (*in).DeepCopy()
-	}
-	if in.CompletedAt != nil {
-		in, out := &in.CompletedAt, &out.CompletedAt
-		*out = (*in).DeepCopy()
-	}
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]metav1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RestoreJobStatus.
-func (in *RestoreJobStatus) DeepCopy() *RestoreJobStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(RestoreJobStatus)
-	in.DeepCopyInto(out)
-	return out
-}

api/v1alpha1/applicationdefinitions_types.go

@@ -18,50 +18,51 @@ package v1alpha1
 
 import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 )
 
 // +kubebuilder:object:root=true
-// +kubebuilder:resource:scope=Cluster
+// +kubebuilder:resource:scope=Cluster,shortName=appdef
 
-// CozystackResourceDefinition is the Schema for the cozystackresourcedefinitions API
-type CozystackResourceDefinition struct {
+// ApplicationDefinition is the Schema for the applicationdefinitions API
+type ApplicationDefinition struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
 
-	Spec CozystackResourceDefinitionSpec `json:"spec,omitempty"`
+	Spec ApplicationDefinitionSpec `json:"spec,omitempty"`
 }
 
 // +kubebuilder:object:root=true
 
-// CozystackResourceDefinitionList contains a list of CozystackResourceDefinitions
-type CozystackResourceDefinitionList struct {
+// ApplicationDefinitionList contains a list of ApplicationDefinitions
+type ApplicationDefinitionList struct {
 	metav1.TypeMeta `json:",inline"`
 	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []CozystackResourceDefinition `json:"items"`
+	Items           []ApplicationDefinition `json:"items"`
 }
 
 func init() {
-	SchemeBuilder.Register(&CozystackResourceDefinition{}, &CozystackResourceDefinitionList{})
+	SchemeBuilder.Register(&ApplicationDefinition{}, &ApplicationDefinitionList{})
 }
 
-type CozystackResourceDefinitionSpec struct {
+type ApplicationDefinitionSpec struct {
 	// Application configuration
-	Application CozystackResourceDefinitionApplication `json:"application"`
+	Application ApplicationDefinitionApplication `json:"application"`
 	// Release configuration
-	Release CozystackResourceDefinitionRelease `json:"release"`
+	Release ApplicationDefinitionRelease `json:"release"`
 
 	// Secret selectors
-	Secrets CozystackResourceDefinitionResources `json:"secrets,omitempty"`
+	Secrets ApplicationDefinitionResources `json:"secrets,omitempty"`
 	// Service selectors
-	Services CozystackResourceDefinitionResources `json:"services,omitempty"`
+	Services ApplicationDefinitionResources `json:"services,omitempty"`
 	// Ingress selectors
-	Ingresses CozystackResourceDefinitionResources `json:"ingresses,omitempty"`
+	Ingresses ApplicationDefinitionResources `json:"ingresses,omitempty"`
 
 	// Dashboard configuration for this resource
-	Dashboard *CozystackResourceDefinitionDashboard `json:"dashboard,omitempty"`
+	Dashboard *ApplicationDefinitionDashboard `json:"dashboard,omitempty"`
 }
 
-type CozystackResourceDefinitionChart struct {
+type ApplicationDefinitionChart struct {
 	// Name of the Helm chart
 	Name string `json:"name"`
 	// Source reference for the Helm chart
@@ -79,7 +80,7 @@ type SourceRef struct {
 	Namespace string `json:"namespace"`
 }
 
-type CozystackResourceDefinitionApplication struct {
+type ApplicationDefinitionApplication struct {
 	// Kind of the application, used for UI and API
 	Kind string `json:"kind"`
 	// OpenAPI schema for the application, used for API validation
@@ -90,17 +91,30 @@ type CozystackResourceDefinitionApplication struct {
 	Singular string `json:"singular"`
 }
 
-type CozystackResourceDefinitionRelease struct {
-	// Helm chart configuration
+// +kubebuilder:validation:XValidation:rule="(has(self.chart) && !has(self.chartRef)) || (!has(self.chart) && has(self.chartRef))",message="either chart or chartRef must be set, but not both"
+type ApplicationDefinitionRelease struct {
+	// Helm chart configuration (for HelmRepository source)
 	// +optional
-	Chart CozystackResourceDefinitionChart `json:"chart,omitempty"`
+	Chart *ApplicationDefinitionChart `json:"chart,omitempty"`
+	// Chart reference configuration (for ExternalArtifact source)
+	// +optional
+	ChartRef *ApplicationDefinitionChartRef `json:"chartRef,omitempty"`
 	// Labels for the release
 	Labels map[string]string `json:"labels,omitempty"`
 	// Prefix for the release name
 	Prefix string `json:"prefix"`
+	// Default values to be merged into every HelmRelease created from this resource definition
+	// User-specified values in Application spec will override these default values
+	// +optional
+	Values *apiextensionsv1.JSON `json:"values,omitempty"`
 }
 
-// CozystackResourceDefinitionResourceSelector extends metav1.LabelSelector with resourceNames support.
+type ApplicationDefinitionChartRef struct {
+	// Source reference for the chart (ExternalArtifact)
+	SourceRef SourceRef `json:"sourceRef"`
+}
+
+// ApplicationDefinitionResourceSelector extends metav1.LabelSelector with resourceNames support.
 // A resource matches this selector only if it satisfies ALL criteria:
 // - Label selector conditions (matchExpressions and matchLabels)
 // - AND has a name that matches one of the names in resourceNames (if specified)
@@ -111,19 +125,18 @@ type CozystackResourceDefinitionRelease struct {
 // - {{ .namespace }}: The namespace of the resource being processed
 //
 // Example YAML:
-//
-//	secrets:
-//	  include:
-//	  - matchExpressions:
-//	    - key: badlabel
-//	      operator: DoesNotExist
-//	    matchLabels:
-//	      goodlabel: goodvalue
-//	    resourceNames:
-//	    - "{{ .name }}-secret"
-//	    - "{{ .kind }}-{{ .name }}-tls"
-//	    - "specificname"
-type CozystackResourceDefinitionResourceSelector struct {
+//   secrets:
+//     include:
+//     - matchExpressions:
+//       - key: badlabel
+//         operator: DoesNotExist
+//       matchLabels:
+//         goodlabel: goodvalue
+//       resourceNames:
+//       - "{{ .name }}-secret"
+//       - "{{ .kind }}-{{ .name }}-tls"
+//       - "specificname"
+type ApplicationDefinitionResourceSelector struct {
 	metav1.LabelSelector `json:",inline"`
 	// ResourceNames is a list of resource names to match
 	// If specified, the resource must have one of these exact names to match the selector
@@ -131,16 +144,16 @@ type CozystackResourceDefinitionResourceSelector struct {
 	ResourceNames []string `json:"resourceNames,omitempty"`
 }
 
-type CozystackResourceDefinitionResources struct {
+type ApplicationDefinitionResources struct {
 	// Exclude contains an array of resource selectors that target resources.
 	// If a resource matches the selector in any of the elements in the array, it is
 	// hidden from the user, regardless of the matches in the include array.
-	Exclude []*CozystackResourceDefinitionResourceSelector `json:"exclude,omitempty"`
+	Exclude []*ApplicationDefinitionResourceSelector `json:"exclude,omitempty"`
 	// Include contains an array of resource selectors that target resources.
 	// If a resource matches the selector in any of the elements in the array, and
 	// matches none of the selectors in the exclude array that resource is marked
 	// as a tenant resource and is visible to users.
-	Include []*CozystackResourceDefinitionResourceSelector `json:"include,omitempty"`
+	Include []*ApplicationDefinitionResourceSelector `json:"include,omitempty"`
 }
 
 // ---- Dashboard types ----
@@ -157,8 +170,8 @@ const (
 	DashboardTabYAML      DashboardTab = "yaml"
 )
 
-// CozystackResourceDefinitionDashboard describes how this resource appears in the UI.
-type CozystackResourceDefinitionDashboard struct {
+// ApplicationDefinitionDashboard describes how this resource appears in the UI.
+type ApplicationDefinitionDashboard struct {
 	// Human-readable name shown in the UI (e.g., "Bucket")
 	Singular string `json:"singular"`
 	// Plural human-readable name (e.g., "Buckets")

api/v1alpha1/bundles_types.go

@@ -0,0 +1,230 @@
+/*
+Copyright 2025.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +kubebuilder:object:root=true
+// +kubebuilder:resource:scope=Cluster,shortName=bundle
+
+// Bundle is the Schema for the bundles API
+type Bundle struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec BundleSpec `json:"spec,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// BundleList contains a list of Bundles
+type BundleList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []Bundle `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&Bundle{}, &BundleList{})
+}
+
+// BundleSpec defines the desired state of Bundle
+type BundleSpec struct {
+	// SourceRef is the source reference for the bundle charts
+	// +required
+	SourceRef BundleSourceRef `json:"sourceRef"`
+
+	// DependsOn is a list of bundle dependencies in the format "bundleName/target"
+	// For example: "cozystack-system/network"
+	// If specified, the dependencies listed in the target's packages will be taken
+	// from the specified bundle and added to all packages in this bundle
+	// +optional
+	DependsOn []string `json:"dependsOn,omitempty"`
+
+	// DependencyTargets defines named groups of packages that can be referenced
+	// by other bundles via dependsOn. Each target has a name and a list of packages.
+	// +optional
+	DependencyTargets []BundleDependencyTarget `json:"dependencyTargets,omitempty"`
+
+	// Libraries is a list of Helm library charts used by packages
+	// +optional
+	Libraries []BundleLibrary `json:"libraries,omitempty"`
+
+	// Artifacts is a list of Helm charts that will be built as ExternalArtifacts
+	// These artifacts can be referenced by ApplicationDefinitions
+	// +optional
+	Artifacts []BundleArtifact `json:"artifacts,omitempty"`
+
+	// Packages is a list of Helm releases to be installed as part of this bundle
+	// +required
+	Packages []BundleRelease `json:"packages"`
+
+	// DeletionPolicy defines how child resources should be handled when the bundle is deleted.
+	// - "Delete" (default): Child resources will be deleted when the bundle is deleted (via ownerReference).
+	// - "Orphan": Child resources will be orphaned (ownerReferences will be removed).
+	// +kubebuilder:validation:Enum=Delete;Orphan
+	// +kubebuilder:default=Delete
+	// +optional
+	DeletionPolicy DeletionPolicy `json:"deletionPolicy,omitempty"`
+
+	// Labels are labels that will be applied to all resources created by this bundle
+	// (ArtifactGenerators and HelmReleases). These labels are merged with the default
+	// cozystack.io/bundle label.
+	// +optional
+	Labels map[string]string `json:"labels,omitempty"`
+
+	// BasePath is the base path where packages are located in the source.
+	// For GitRepository, defaults to "packages" if not specified.
+	// For OCIRepository, defaults to empty string (root) if not specified.
+	// +optional
+	BasePath string `json:"basePath,omitempty"`
+}
+
+// DeletionPolicy defines how child resources should be handled when the parent is deleted.
+// +kubebuilder:validation:Enum=Delete;Orphan
+type DeletionPolicy string
+
+const (
+	// DeletionPolicyDelete means child resources will be deleted when the parent is deleted.
+	DeletionPolicyDelete DeletionPolicy = "Delete"
+	// DeletionPolicyOrphan means child resources will be orphaned (ownerReferences removed).
+	DeletionPolicyOrphan DeletionPolicy = "Orphan"
+)
+
+// BundleDependencyTarget defines a named group of packages that can be referenced
+// by other bundles via dependsOn
+type BundleDependencyTarget struct {
+	// Name is the unique identifier for this dependency target
+	// +required
+	Name string `json:"name"`
+
+	// Packages is a list of package names that belong to this target
+	// These packages will be added as dependencies when this target is referenced
+	// +required
+	Packages []string `json:"packages"`
+}
+
+// BundleLibrary defines a Helm library chart
+type BundleLibrary struct {
+	// Name is the unique identifier for this library
+	// +required
+	Name string `json:"name"`
+
+	// Path is the path to the library chart directory
+	// +required
+	Path string `json:"path"`
+}
+
+// BundleArtifact defines a Helm chart artifact that will be built as ExternalArtifact
+type BundleArtifact struct {
+	// Name is the unique identifier for this artifact (used as ExternalArtifact name)
+	// +required
+	Name string `json:"name"`
+
+	// Path is the path to the Helm chart directory
+	// +required
+	Path string `json:"path"`
+
+	// Libraries is a list of library names that this artifact depends on
+	// +optional
+	Libraries []string `json:"libraries,omitempty"`
+}
+
+// BundleSourceRef defines the source reference for bundle charts
+type BundleSourceRef struct {
+	// Kind of the source reference
+	// +kubebuilder:validation:Enum=GitRepository;OCIRepository
+	// +required
+	Kind string `json:"kind"`
+
+	// Name of the source reference
+	// +required
+	Name string `json:"name"`
+
+	// Namespace of the source reference
+	// +required
+	Namespace string `json:"namespace"`
+}
+
+// +kubebuilder:validation:XValidation:rule="(has(self.path) && !has(self.artifact)) || (!has(self.path) && has(self.artifact))",message="either path or artifact must be set, but not both"
+// BundleRelease defines a single Helm release within a bundle
+type BundleRelease struct {
+	// Name is the unique identifier for this release within the bundle
+	// +required
+	Name string `json:"name"`
+
+	// ReleaseName is the name of the HelmRelease resource that will be created
+	// +required
+	ReleaseName string `json:"releaseName"`
+
+	// Path is the path to the Helm chart directory
+	// Either Path or Artifact must be specified, but not both
+	// +optional
+	Path string `json:"path,omitempty"`
+
+	// Artifact is the name of an artifact from the bundle's artifacts list
+	// The artifact must exist in the bundle's artifacts section
+	// Either Path or Artifact must be specified, but not both
+	// +optional
+	Artifact string `json:"artifact,omitempty"`
+
+	// Namespace is the Kubernetes namespace where the release will be installed
+	// +required
+	Namespace string `json:"namespace"`
+
+	// Privileged indicates whether this release requires privileged access
+	// +optional
+	Privileged bool `json:"privileged,omitempty"`
+
+	// Disabled indicates whether this release is disabled (should not be installed)
+	// +optional
+	Disabled bool `json:"disabled,omitempty"`
+
+	// DependsOn is a list of release names that must be installed before this release
+	// +optional
+	DependsOn []string `json:"dependsOn,omitempty"`
+
+	// Libraries is a list of library names that this package depends on
+	// +optional
+	Libraries []string `json:"libraries,omitempty"`
+
+	// Values contains Helm chart values as a JSON object
+	// +optional
+	Values *apiextensionsv1.JSON `json:"values,omitempty"`
+
+	// ValuesFiles is a list of values file names to use
+	// +optional
+	ValuesFiles []string `json:"valuesFiles,omitempty"`
+
+	// Labels are labels that will be applied to the HelmRelease created for this package
+	// These labels are merged with bundle-level labels and the default cozystack.io/bundle label
+	// +optional
+	Labels map[string]string `json:"labels,omitempty"`
+
+	// NamespaceLabels are labels that will be applied to the namespace for this package
+	// These labels are merged with labels from other packages in the same namespace
+	// +optional
+	NamespaceLabels map[string]string `json:"namespaceLabels,omitempty"`
+
+	// NamespaceAnnotations are annotations that will be applied to the namespace for this package
+	// These annotations are merged with annotations from other packages in the same namespace
+	// +optional
+	NamespaceAnnotations map[string]string `json:"namespaceAnnotations,omitempty"`
+}

api/v1alpha1/package_types.go

@@ -1,100 +0,0 @@
-/*
-Copyright 2025.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1alpha1
-
-import (
-	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-// +kubebuilder:resource:scope=Cluster,shortName={pkg,pkgs}
-// +kubebuilder:subresource:status
-// +kubebuilder:printcolumn:name="Variant",type="string",JSONPath=".spec.variant",description="Selected variant"
-// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status",description="Ready status"
-// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].message",description="Ready message"
-
-// Package is the Schema for the packages API
-type Package struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   PackageSpec   `json:"spec,omitempty"`
-	Status PackageStatus `json:"status,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// PackageList contains a list of Packages
-type PackageList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []Package `json:"items"`
-}
-
-func init() {
-	SchemeBuilder.Register(&Package{}, &PackageList{})
-}
-
-// PackageSpec defines the desired state of Package
-type PackageSpec struct {
-	// Variant is the name of the variant to use from the PackageSource
-	// If not specified, defaults to "default"
-	// +optional
-	Variant string `json:"variant,omitempty"`
-
-	// IgnoreDependencies is a list of package source dependencies to ignore
-	// Dependencies listed here will not be installed even if they are specified in the PackageSource
-	// +optional
-	IgnoreDependencies []string `json:"ignoreDependencies,omitempty"`
-
-	// Components is a map of release name to component overrides
-	// Allows overriding values and enabling/disabling specific components from the PackageSource
-	// +optional
-	Components map[string]PackageComponent `json:"components,omitempty"`
-}
-
-// PackageComponent defines overrides for a specific component
-type PackageComponent struct {
-	// Enabled indicates whether this component should be installed
-	// If false, the component will be disabled even if it's defined in the PackageSource
-	// +optional
-	Enabled *bool `json:"enabled,omitempty"`
-
-	// Values contains Helm chart values as a JSON object
-	// These values will be merged with the default values from the PackageSource
-	// +optional
-	Values *apiextensionsv1.JSON `json:"values,omitempty"`
-}
-
-// PackageStatus defines the observed state of Package
-type PackageStatus struct {
-	// Conditions represents the latest available observations of a Package's state
-	// +optional
-	Conditions []metav1.Condition `json:"conditions,omitempty"`
-
-	// Dependencies tracks the readiness status of each dependency
-	// Key is the dependency package name, value indicates if the dependency is ready
-	// +optional
-	Dependencies map[string]DependencyStatus `json:"dependencies,omitempty"`
-}
-
-// DependencyStatus represents the readiness status of a dependency
-type DependencyStatus struct {
-	// Ready indicates whether the dependency is ready
-	Ready bool `json:"ready"`
-}

api/v1alpha1/packagesource_types.go

@@ -1,171 +0,0 @@
-/*
-Copyright 2025.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1alpha1
-
-import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-// +kubebuilder:resource:scope=Cluster,shortName={pks}
-// +kubebuilder:subresource:status
-// +kubebuilder:printcolumn:name="Variants",type="string",JSONPath=".status.variants",description="Package variants (comma-separated)"
-// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status",description="Ready status"
-// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].message",description="Ready message"
-
-// PackageSource is the Schema for the packagesources API
-type PackageSource struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   PackageSourceSpec   `json:"spec,omitempty"`
-	Status PackageSourceStatus `json:"status,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// PackageSourceList contains a list of PackageSources
-type PackageSourceList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []PackageSource `json:"items"`
-}
-
-func init() {
-	SchemeBuilder.Register(&PackageSource{}, &PackageSourceList{})
-}
-
-// PackageSourceSpec defines the desired state of PackageSource
-type PackageSourceSpec struct {
-	// SourceRef is the source reference for the package source charts
-	// +optional
-	SourceRef *PackageSourceRef `json:"sourceRef,omitempty"`
-
-	// Variants is a list of package source variants
-	// Each variant defines components, applications, dependencies, and libraries for a specific configuration
-	// +optional
-	Variants []Variant `json:"variants,omitempty"`
-}
-
-// Variant defines a single variant configuration
-type Variant struct {
-	// Name is the unique identifier for this variant
-	// +required
-	Name string `json:"name"`
-
-	// DependsOn is a list of package source dependencies
-	// For example: "cozystack.networking"
-	// +optional
-	DependsOn []string `json:"dependsOn,omitempty"`
-
-	// Libraries is a list of Helm library charts used by components in this variant
-	// +optional
-	Libraries []Library `json:"libraries,omitempty"`
-
-	// Components is a list of Helm releases to be installed as part of this variant
-	// +optional
-	Components []Component `json:"components,omitempty"`
-}
-
-// Library defines a Helm library chart
-type Library struct {
-	// Name is the optional name for library placed in charts
-	// +optional
-	Name string `json:"name,omitempty"`
-
-	// Path is the path to the library chart directory
-	// +required
-	Path string `json:"path"`
-}
-
-// PackageSourceRef defines the source reference for package source charts
-type PackageSourceRef struct {
-	// Kind of the source reference
-	// +kubebuilder:validation:Enum=GitRepository;OCIRepository
-	// +required
-	Kind string `json:"kind"`
-
-	// Name of the source reference
-	// +required
-	Name string `json:"name"`
-
-	// Namespace of the source reference
-	// +required
-	Namespace string `json:"namespace"`
-
-	// Path is the base path where packages are located in the source.
-	// For GitRepository, defaults to "packages" if not specified.
-	// For OCIRepository, defaults to empty string (root) if not specified.
-	// +optional
-	Path string `json:"path,omitempty"`
-}
-
-// ComponentInstall defines installation parameters for a component
-type ComponentInstall struct {
-	// ReleaseName is the name of the HelmRelease resource that will be created
-	// If not specified, defaults to the component Name field
-	// +optional
-	ReleaseName string `json:"releaseName,omitempty"`
-
-	// Namespace is the Kubernetes namespace where the release will be installed
-	// +optional
-	Namespace string `json:"namespace,omitempty"`
-
-	// Privileged indicates whether this release requires privileged access
-	// +optional
-	Privileged bool `json:"privileged,omitempty"`
-
-	// DependsOn is a list of component names that must be installed before this component
-	// +optional
-	DependsOn []string `json:"dependsOn,omitempty"`
-}
-
-// Component defines a single Helm release component within a package source
-type Component struct {
-	// Name is the unique identifier for this component within the package source
-	// +required
-	Name string `json:"name"`
-
-	// Path is the path to the Helm chart directory
-	// +required
-	Path string `json:"path"`
-
-	// Install defines installation parameters for this component
-	// +optional
-	Install *ComponentInstall `json:"install,omitempty"`
-
-	// Libraries is a list of library names that this component depends on
-	// These libraries must be defined at the variant level
-	// +optional
-	Libraries []string `json:"libraries,omitempty"`
-
-	// ValuesFiles is a list of values file names to use
-	// +optional
-	ValuesFiles []string `json:"valuesFiles,omitempty"`
-}
-
-// PackageSourceStatus defines the observed state of PackageSource
-type PackageSourceStatus struct {
-	// Variants is a comma-separated list of package variant names
-	// This field is populated by the controller based on spec.variants keys
-	// +optional
-	Variants string `json:"variants,omitempty"`
-
-	// Conditions represents the latest available observations of a PackageSource's state
-	// +optional
-	Conditions []metav1.Condition `json:"conditions,omitempty"`
-}

api/v1alpha1/platform_types.go

@@ -0,0 +1,71 @@
+/*
+Copyright 2025.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +kubebuilder:object:root=true
+// +kubebuilder:resource:scope=Cluster,shortName=platform
+
+// Platform is the Schema for the platforms API
+type Platform struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec PlatformSpec `json:"spec,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// PlatformList contains a list of Platform
+type PlatformList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []Platform `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&Platform{}, &PlatformList{})
+}
+
+// PlatformSpec defines the desired state of Platform
+type PlatformSpec struct {
+	// SourceRef is the source reference for the platform chart
+	// This is used to generate the ArtifactGenerator
+	// +required
+	SourceRef SourceRef `json:"sourceRef"`
+
+	// Values contains Helm chart values as a JSON object
+	// These values are passed directly to HelmRelease.values
+	// +optional
+	Values *apiextensionsv1.JSON `json:"values,omitempty"`
+
+	// Interval is the interval at which to reconcile the HelmRelease
+	// +kubebuilder:default="5m"
+	// +optional
+	Interval *metav1.Duration `json:"interval,omitempty"`
+
+	// BasePath is the base path where the platform chart is located in the source.
+	// For GitRepository, defaults to "packages/core/platform" if not specified.
+	// For OCIRepository, defaults to "core/platform" if not specified.
+	// +optional
+	BasePath string `json:"basePath,omitempty"`
+}
+

api/v1alpha1/zz_generated.deepcopy.go

@@ -28,75 +28,25 @@ import (
 )
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Component) DeepCopyInto(out *Component) {
-	*out = *in
-	if in.Install != nil {
-		in, out := &in.Install, &out.Install
-		*out = new(ComponentInstall)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.Libraries != nil {
-		in, out := &in.Libraries, &out.Libraries
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.ValuesFiles != nil {
-		in, out := &in.ValuesFiles, &out.ValuesFiles
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Component.
-func (in *Component) DeepCopy() *Component {
-	if in == nil {
-		return nil
-	}
-	out := new(Component)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ComponentInstall) DeepCopyInto(out *ComponentInstall) {
-	*out = *in
-	if in.DependsOn != nil {
-		in, out := &in.DependsOn, &out.DependsOn
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ComponentInstall.
-func (in *ComponentInstall) DeepCopy() *ComponentInstall {
-	if in == nil {
-		return nil
-	}
-	out := new(ComponentInstall)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CozystackResourceDefinition) DeepCopyInto(out *CozystackResourceDefinition) {
+func (in *ApplicationDefinition) DeepCopyInto(out *ApplicationDefinition) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
 	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
 	in.Spec.DeepCopyInto(&out.Spec)
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CozystackResourceDefinition.
-func (in *CozystackResourceDefinition) DeepCopy() *CozystackResourceDefinition {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationDefinition.
+func (in *ApplicationDefinition) DeepCopy() *ApplicationDefinition {
 	if in == nil {
 		return nil
 	}
-	out := new(CozystackResourceDefinition)
+	out := new(ApplicationDefinition)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *CozystackResourceDefinition) DeepCopyObject() runtime.Object {
+func (in *ApplicationDefinition) DeepCopyObject() runtime.Object {
 	if c := in.DeepCopy(); c != nil {
 		return c
 	}
@@ -104,38 +54,54 @@ func (in *CozystackResourceDefinition) DeepCopyObject() runtime.Object {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CozystackResourceDefinitionApplication) DeepCopyInto(out *CozystackResourceDefinitionApplication) {
+func (in *ApplicationDefinitionApplication) DeepCopyInto(out *ApplicationDefinitionApplication) {
 	*out = *in
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CozystackResourceDefinitionApplication.
-func (in *CozystackResourceDefinitionApplication) DeepCopy() *CozystackResourceDefinitionApplication {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationDefinitionApplication.
+func (in *ApplicationDefinitionApplication) DeepCopy() *ApplicationDefinitionApplication {
 	if in == nil {
 		return nil
 	}
-	out := new(CozystackResourceDefinitionApplication)
+	out := new(ApplicationDefinitionApplication)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CozystackResourceDefinitionChart) DeepCopyInto(out *CozystackResourceDefinitionChart) {
+func (in *ApplicationDefinitionChart) DeepCopyInto(out *ApplicationDefinitionChart) {
 	*out = *in
 	out.SourceRef = in.SourceRef
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CozystackResourceDefinitionChart.
-func (in *CozystackResourceDefinitionChart) DeepCopy() *CozystackResourceDefinitionChart {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationDefinitionChart.
+func (in *ApplicationDefinitionChart) DeepCopy() *ApplicationDefinitionChart {
 	if in == nil {
 		return nil
 	}
-	out := new(CozystackResourceDefinitionChart)
+	out := new(ApplicationDefinitionChart)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CozystackResourceDefinitionDashboard) DeepCopyInto(out *CozystackResourceDefinitionDashboard) {
+func (in *ApplicationDefinitionChartRef) DeepCopyInto(out *ApplicationDefinitionChartRef) {
+	*out = *in
+	out.SourceRef = in.SourceRef
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationDefinitionChartRef.
+func (in *ApplicationDefinitionChartRef) DeepCopy() *ApplicationDefinitionChartRef {
+	if in == nil {
+		return nil
+	}
+	out := new(ApplicationDefinitionChartRef)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ApplicationDefinitionDashboard) DeepCopyInto(out *ApplicationDefinitionDashboard) {
 	*out = *in
 	if in.Tags != nil {
 		in, out := &in.Tags, &out.Tags
@@ -160,42 +126,42 @@ func (in *CozystackResourceDefinitionDashboard) DeepCopyInto(out *CozystackResou
 	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CozystackResourceDefinitionDashboard.
-func (in *CozystackResourceDefinitionDashboard) DeepCopy() *CozystackResourceDefinitionDashboard {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationDefinitionDashboard.
+func (in *ApplicationDefinitionDashboard) DeepCopy() *ApplicationDefinitionDashboard {
 	if in == nil {
 		return nil
 	}
-	out := new(CozystackResourceDefinitionDashboard)
+	out := new(ApplicationDefinitionDashboard)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CozystackResourceDefinitionList) DeepCopyInto(out *CozystackResourceDefinitionList) {
+func (in *ApplicationDefinitionList) DeepCopyInto(out *ApplicationDefinitionList) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
 	in.ListMeta.DeepCopyInto(&out.ListMeta)
 	if in.Items != nil {
 		in, out := &in.Items, &out.Items
-		*out = make([]CozystackResourceDefinition, len(*in))
+		*out = make([]ApplicationDefinition, len(*in))
 		for i := range *in {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CozystackResourceDefinitionList.
-func (in *CozystackResourceDefinitionList) DeepCopy() *CozystackResourceDefinitionList {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationDefinitionList.
+func (in *ApplicationDefinitionList) DeepCopy() *ApplicationDefinitionList {
 	if in == nil {
 		return nil
 	}
-	out := new(CozystackResourceDefinitionList)
+	out := new(ApplicationDefinitionList)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *CozystackResourceDefinitionList) DeepCopyObject() runtime.Object {
+func (in *ApplicationDefinitionList) DeepCopyObject() runtime.Object {
 	if c := in.DeepCopy(); c != nil {
 		return c
 	}
@@ -203,9 +169,18 @@ func (in *CozystackResourceDefinitionList) DeepCopyObject() runtime.Object {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CozystackResourceDefinitionRelease) DeepCopyInto(out *CozystackResourceDefinitionRelease) {
+func (in *ApplicationDefinitionRelease) DeepCopyInto(out *ApplicationDefinitionRelease) {
 	*out = *in
-	out.Chart = in.Chart
+	if in.Chart != nil {
+		in, out := &in.Chart, &out.Chart
+		*out = new(ApplicationDefinitionChart)
+		**out = **in
+	}
+	if in.ChartRef != nil {
+		in, out := &in.ChartRef, &out.ChartRef
+		*out = new(ApplicationDefinitionChartRef)
+		**out = **in
+	}
 	if in.Labels != nil {
 		in, out := &in.Labels, &out.Labels
 		*out = make(map[string]string, len(*in))
@@ -213,20 +188,25 @@ func (in *CozystackResourceDefinitionRelease) DeepCopyInto(out *CozystackResourc
 			(*out)[key] = val
 		}
 	}
+	if in.Values != nil {
+		in, out := &in.Values, &out.Values
+		*out = new(v1.JSON)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CozystackResourceDefinitionRelease.
-func (in *CozystackResourceDefinitionRelease) DeepCopy() *CozystackResourceDefinitionRelease {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationDefinitionRelease.
+func (in *ApplicationDefinitionRelease) DeepCopy() *ApplicationDefinitionRelease {
 	if in == nil {
 		return nil
 	}
-	out := new(CozystackResourceDefinitionRelease)
+	out := new(ApplicationDefinitionRelease)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CozystackResourceDefinitionResourceSelector) DeepCopyInto(out *CozystackResourceDefinitionResourceSelector) {
+func (in *ApplicationDefinitionResourceSelector) DeepCopyInto(out *ApplicationDefinitionResourceSelector) {
 	*out = *in
 	in.LabelSelector.DeepCopyInto(&out.LabelSelector)
 	if in.ResourceNames != nil {
@@ -236,55 +216,55 @@ func (in *CozystackResourceDefinitionResourceSelector) DeepCopyInto(out *Cozysta
 	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CozystackResourceDefinitionResourceSelector.
-func (in *CozystackResourceDefinitionResourceSelector) DeepCopy() *CozystackResourceDefinitionResourceSelector {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationDefinitionResourceSelector.
+func (in *ApplicationDefinitionResourceSelector) DeepCopy() *ApplicationDefinitionResourceSelector {
 	if in == nil {
 		return nil
 	}
-	out := new(CozystackResourceDefinitionResourceSelector)
+	out := new(ApplicationDefinitionResourceSelector)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CozystackResourceDefinitionResources) DeepCopyInto(out *CozystackResourceDefinitionResources) {
+func (in *ApplicationDefinitionResources) DeepCopyInto(out *ApplicationDefinitionResources) {
 	*out = *in
 	if in.Exclude != nil {
 		in, out := &in.Exclude, &out.Exclude
-		*out = make([]*CozystackResourceDefinitionResourceSelector, len(*in))
+		*out = make([]*ApplicationDefinitionResourceSelector, len(*in))
 		for i := range *in {
 			if (*in)[i] != nil {
 				in, out := &(*in)[i], &(*out)[i]
-				*out = new(CozystackResourceDefinitionResourceSelector)
+				*out = new(ApplicationDefinitionResourceSelector)
 				(*in).DeepCopyInto(*out)
 			}
 		}
 	}
 	if in.Include != nil {
 		in, out := &in.Include, &out.Include
-		*out = make([]*CozystackResourceDefinitionResourceSelector, len(*in))
+		*out = make([]*ApplicationDefinitionResourceSelector, len(*in))
 		for i := range *in {
 			if (*in)[i] != nil {
 				in, out := &(*in)[i], &(*out)[i]
-				*out = new(CozystackResourceDefinitionResourceSelector)
+				*out = new(ApplicationDefinitionResourceSelector)
 				(*in).DeepCopyInto(*out)
 			}
 		}
 	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CozystackResourceDefinitionResources.
-func (in *CozystackResourceDefinitionResources) DeepCopy() *CozystackResourceDefinitionResources {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationDefinitionResources.
+func (in *ApplicationDefinitionResources) DeepCopy() *ApplicationDefinitionResources {
 	if in == nil {
 		return nil
 	}
-	out := new(CozystackResourceDefinitionResources)
+	out := new(ApplicationDefinitionResources)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CozystackResourceDefinitionSpec) DeepCopyInto(out *CozystackResourceDefinitionSpec) {
+func (in *ApplicationDefinitionSpec) DeepCopyInto(out *ApplicationDefinitionSpec) {
 	*out = *in
 	out.Application = in.Application
 	in.Release.DeepCopyInto(&out.Release)
@@ -293,72 +273,41 @@ func (in *CozystackResourceDefinitionSpec) DeepCopyInto(out *CozystackResourceDe
 	in.Ingresses.DeepCopyInto(&out.Ingresses)
 	if in.Dashboard != nil {
 		in, out := &in.Dashboard, &out.Dashboard
-		*out = new(CozystackResourceDefinitionDashboard)
+		*out = new(ApplicationDefinitionDashboard)
 		(*in).DeepCopyInto(*out)
 	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CozystackResourceDefinitionSpec.
-func (in *CozystackResourceDefinitionSpec) DeepCopy() *CozystackResourceDefinitionSpec {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationDefinitionSpec.
+func (in *ApplicationDefinitionSpec) DeepCopy() *ApplicationDefinitionSpec {
 	if in == nil {
 		return nil
 	}
-	out := new(CozystackResourceDefinitionSpec)
+	out := new(ApplicationDefinitionSpec)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DependencyStatus) DeepCopyInto(out *DependencyStatus) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DependencyStatus.
-func (in *DependencyStatus) DeepCopy() *DependencyStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(DependencyStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Library) DeepCopyInto(out *Library) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Library.
-func (in *Library) DeepCopy() *Library {
-	if in == nil {
-		return nil
-	}
-	out := new(Library)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Package) DeepCopyInto(out *Package) {
+func (in *Bundle) DeepCopyInto(out *Bundle) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
 	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
 	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Package.
-func (in *Package) DeepCopy() *Package {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Bundle.
+func (in *Bundle) DeepCopy() *Bundle {
 	if in == nil {
 		return nil
 	}
-	out := new(Package)
+	out := new(Bundle)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Package) DeepCopyObject() runtime.Object {
+func (in *Bundle) DeepCopyObject() runtime.Object {
 	if c := in.DeepCopy(); c != nil {
 		return c
 	}
@@ -366,237 +315,297 @@ func (in *Package) DeepCopyObject() runtime.Object {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PackageComponent) DeepCopyInto(out *PackageComponent) {
+func (in *BundleArtifact) DeepCopyInto(out *BundleArtifact) {
 	*out = *in
-	if in.Enabled != nil {
-		in, out := &in.Enabled, &out.Enabled
-		*out = new(bool)
-		**out = **in
+	if in.Libraries != nil {
+		in, out := &in.Libraries, &out.Libraries
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BundleArtifact.
+func (in *BundleArtifact) DeepCopy() *BundleArtifact {
+	if in == nil {
+		return nil
+	}
+	out := new(BundleArtifact)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BundleDependencyTarget) DeepCopyInto(out *BundleDependencyTarget) {
+	*out = *in
+	if in.Packages != nil {
+		in, out := &in.Packages, &out.Packages
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BundleDependencyTarget.
+func (in *BundleDependencyTarget) DeepCopy() *BundleDependencyTarget {
+	if in == nil {
+		return nil
+	}
+	out := new(BundleDependencyTarget)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BundleLibrary) DeepCopyInto(out *BundleLibrary) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BundleLibrary.
+func (in *BundleLibrary) DeepCopy() *BundleLibrary {
+	if in == nil {
+		return nil
+	}
+	out := new(BundleLibrary)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BundleList) DeepCopyInto(out *BundleList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Bundle, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BundleList.
+func (in *BundleList) DeepCopy() *BundleList {
+	if in == nil {
+		return nil
+	}
+	out := new(BundleList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *BundleList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BundleRelease) DeepCopyInto(out *BundleRelease) {
+	*out = *in
+	if in.DependsOn != nil {
+		in, out := &in.DependsOn, &out.DependsOn
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Libraries != nil {
+		in, out := &in.Libraries, &out.Libraries
+		*out = make([]string, len(*in))
+		copy(*out, *in)
 	}
 	if in.Values != nil {
 		in, out := &in.Values, &out.Values
 		*out = new(v1.JSON)
 		(*in).DeepCopyInto(*out)
 	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageComponent.
-func (in *PackageComponent) DeepCopy() *PackageComponent {
-	if in == nil {
-		return nil
-	}
-	out := new(PackageComponent)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PackageList) DeepCopyInto(out *PackageList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]Package, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageList.
-func (in *PackageList) DeepCopy() *PackageList {
-	if in == nil {
-		return nil
-	}
-	out := new(PackageList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *PackageList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PackageSource) DeepCopyInto(out *PackageSource) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageSource.
-func (in *PackageSource) DeepCopy() *PackageSource {
-	if in == nil {
-		return nil
-	}
-	out := new(PackageSource)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *PackageSource) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PackageSourceList) DeepCopyInto(out *PackageSourceList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]PackageSource, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageSourceList.
-func (in *PackageSourceList) DeepCopy() *PackageSourceList {
-	if in == nil {
-		return nil
-	}
-	out := new(PackageSourceList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *PackageSourceList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PackageSourceRef) DeepCopyInto(out *PackageSourceRef) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageSourceRef.
-func (in *PackageSourceRef) DeepCopy() *PackageSourceRef {
-	if in == nil {
-		return nil
-	}
-	out := new(PackageSourceRef)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PackageSourceSpec) DeepCopyInto(out *PackageSourceSpec) {
-	*out = *in
-	if in.SourceRef != nil {
-		in, out := &in.SourceRef, &out.SourceRef
-		*out = new(PackageSourceRef)
-		**out = **in
-	}
-	if in.Variants != nil {
-		in, out := &in.Variants, &out.Variants
-		*out = make([]Variant, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageSourceSpec.
-func (in *PackageSourceSpec) DeepCopy() *PackageSourceSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(PackageSourceSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PackageSourceStatus) DeepCopyInto(out *PackageSourceStatus) {
-	*out = *in
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]metav1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageSourceStatus.
-func (in *PackageSourceStatus) DeepCopy() *PackageSourceStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(PackageSourceStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PackageSpec) DeepCopyInto(out *PackageSpec) {
-	*out = *in
-	if in.IgnoreDependencies != nil {
-		in, out := &in.IgnoreDependencies, &out.IgnoreDependencies
+	if in.ValuesFiles != nil {
+		in, out := &in.ValuesFiles, &out.ValuesFiles
 		*out = make([]string, len(*in))
 		copy(*out, *in)
 	}
-	if in.Components != nil {
-		in, out := &in.Components, &out.Components
-		*out = make(map[string]PackageComponent, len(*in))
+	if in.Labels != nil {
+		in, out := &in.Labels, &out.Labels
+		*out = make(map[string]string, len(*in))
 		for key, val := range *in {
-			(*out)[key] = *val.DeepCopy()
+			(*out)[key] = val
 		}
 	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageSpec.
-func (in *PackageSpec) DeepCopy() *PackageSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(PackageSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PackageStatus) DeepCopyInto(out *PackageStatus) {
-	*out = *in
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]metav1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
+	if in.NamespaceLabels != nil {
+		in, out := &in.NamespaceLabels, &out.NamespaceLabels
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
 		}
 	}
-	if in.Dependencies != nil {
-		in, out := &in.Dependencies, &out.Dependencies
-		*out = make(map[string]DependencyStatus, len(*in))
+	if in.NamespaceAnnotations != nil {
+		in, out := &in.NamespaceAnnotations, &out.NamespaceAnnotations
+		*out = make(map[string]string, len(*in))
 		for key, val := range *in {
 			(*out)[key] = val
 		}
 	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageStatus.
-func (in *PackageStatus) DeepCopy() *PackageStatus {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BundleRelease.
+func (in *BundleRelease) DeepCopy() *BundleRelease {
 	if in == nil {
 		return nil
 	}
-	out := new(PackageStatus)
+	out := new(BundleRelease)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BundleSourceRef) DeepCopyInto(out *BundleSourceRef) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BundleSourceRef.
+func (in *BundleSourceRef) DeepCopy() *BundleSourceRef {
+	if in == nil {
+		return nil
+	}
+	out := new(BundleSourceRef)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BundleSpec) DeepCopyInto(out *BundleSpec) {
+	*out = *in
+	out.SourceRef = in.SourceRef
+	if in.DependsOn != nil {
+		in, out := &in.DependsOn, &out.DependsOn
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.DependencyTargets != nil {
+		in, out := &in.DependencyTargets, &out.DependencyTargets
+		*out = make([]BundleDependencyTarget, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Libraries != nil {
+		in, out := &in.Libraries, &out.Libraries
+		*out = make([]BundleLibrary, len(*in))
+		copy(*out, *in)
+	}
+	if in.Artifacts != nil {
+		in, out := &in.Artifacts, &out.Artifacts
+		*out = make([]BundleArtifact, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Packages != nil {
+		in, out := &in.Packages, &out.Packages
+		*out = make([]BundleRelease, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Labels != nil {
+		in, out := &in.Labels, &out.Labels
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BundleSpec.
+func (in *BundleSpec) DeepCopy() *BundleSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(BundleSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Platform) DeepCopyInto(out *Platform) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Platform.
+func (in *Platform) DeepCopy() *Platform {
+	if in == nil {
+		return nil
+	}
+	out := new(Platform)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Platform) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PlatformList) DeepCopyInto(out *PlatformList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Platform, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PlatformList.
+func (in *PlatformList) DeepCopy() *PlatformList {
+	if in == nil {
+		return nil
+	}
+	out := new(PlatformList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PlatformList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PlatformSpec) DeepCopyInto(out *PlatformSpec) {
+	*out = *in
+	out.SourceRef = in.SourceRef
+	if in.Values != nil {
+		in, out := &in.Values, &out.Values
+		*out = new(v1.JSON)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Interval != nil {
+		in, out := &in.Interval, &out.Interval
+		*out = new(metav1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PlatformSpec.
+func (in *PlatformSpec) DeepCopy() *PlatformSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(PlatformSpec)
 	in.DeepCopyInto(out)
 	return out
 }
@@ -637,38 +646,6 @@ func (in *SourceRef) DeepCopy() *SourceRef {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Variant) DeepCopyInto(out *Variant) {
-	*out = *in
-	if in.DependsOn != nil {
-		in, out := &in.DependsOn, &out.DependsOn
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.Libraries != nil {
-		in, out := &in.Libraries, &out.Libraries
-		*out = make([]Library, len(*in))
-		copy(*out, *in)
-	}
-	if in.Components != nil {
-		in, out := &in.Components, &out.Components
-		*out = make([]Component, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Variant.
-func (in *Variant) DeepCopy() *Variant {
-	if in == nil {
-		return nil
-	}
-	out := new(Variant)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Workload) DeepCopyInto(out *Workload) {
 	*out = *in

cmd/backup-controller/main.go

@@ -1,174 +0,0 @@
-/*
-Copyright 2025.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"crypto/tls"
-	"flag"
-	"os"
-
-	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
-	// to ensure that exec-entrypoint and run can make use of them.
-	_ "k8s.io/client-go/plugin/pkg/client/auth"
-
-	"k8s.io/apimachinery/pkg/runtime"
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/healthz"
-	"sigs.k8s.io/controller-runtime/pkg/log/zap"
-	"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
-	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-
-	backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1"
-	"github.com/cozystack/cozystack/internal/backupcontroller"
-	// +kubebuilder:scaffold:imports
-)
-
-var (
-	scheme   = runtime.NewScheme()
-	setupLog = ctrl.Log.WithName("setup")
-)
-
-func init() {
-	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
-
-	utilruntime.Must(backupsv1alpha1.AddToScheme(scheme))
-	// +kubebuilder:scaffold:scheme
-}
-
-func main() {
-	var metricsAddr string
-	var enableLeaderElection bool
-	var probeAddr string
-	var secureMetrics bool
-	var enableHTTP2 bool
-	var tlsOpts []func(*tls.Config)
-	flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+
-		"Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.")
-	flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
-	flag.BoolVar(&enableLeaderElection, "leader-elect", false,
-		"Enable leader election for controller manager. "+
-			"Enabling this will ensure there is only one active controller manager.")
-	flag.BoolVar(&secureMetrics, "metrics-secure", true,
-		"If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.")
-	flag.BoolVar(&enableHTTP2, "enable-http2", false,
-		"If set, HTTP/2 will be enabled for the metrics and webhook servers")
-	opts := zap.Options{
-		Development: false,
-	}
-	opts.BindFlags(flag.CommandLine)
-	flag.Parse()
-
-	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
-
-	// if the enable-http2 flag is false (the default), http/2 should be disabled
-	// due to its vulnerabilities. More specifically, disabling http/2 will
-	// prevent from being vulnerable to the HTTP/2 Stream Cancellation and
-	// Rapid Reset CVEs. For more information see:
-	// - https://github.com/advisories/GHSA-qppj-fm5r-hxr3
-	// - https://github.com/advisories/GHSA-4374-p667-p6c8
-	disableHTTP2 := func(c *tls.Config) {
-		setupLog.Info("disabling http/2")
-		c.NextProtos = []string{"http/1.1"}
-	}
-
-	if !enableHTTP2 {
-		tlsOpts = append(tlsOpts, disableHTTP2)
-	}
-
-	webhookServer := webhook.NewServer(webhook.Options{
-		TLSOpts: tlsOpts,
-	})
-
-	// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
-	// More info:
-	// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.19.1/pkg/metrics/server
-	// - https://book.kubebuilder.io/reference/metrics.html
-	metricsServerOptions := metricsserver.Options{
-		BindAddress:   metricsAddr,
-		SecureServing: secureMetrics,
-		TLSOpts:       tlsOpts,
-	}
-
-	if secureMetrics {
-		// FilterProvider is used to protect the metrics endpoint with authn/authz.
-		// These configurations ensure that only authorized users and service accounts
-		// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
-		// https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.19.1/pkg/metrics/filters#WithAuthenticationAndAuthorization
-		metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
-
-		// TODO(user): If CertDir, CertName, and KeyName are not specified, controller-runtime will automatically
-		// generate self-signed certificates for the metrics server. While convenient for development and testing,
-		// this setup is not recommended for production.
-	}
-
-	// Configure rate limiting for the Kubernetes client
-	config := ctrl.GetConfigOrDie()
-	config.QPS = 50.0  // Increased from default 5.0
-	config.Burst = 100 // Increased from default 10
-
-	mgr, err := ctrl.NewManager(config, ctrl.Options{
-		Scheme:                 scheme,
-		Metrics:                metricsServerOptions,
-		WebhookServer:          webhookServer,
-		HealthProbeBindAddress: probeAddr,
-		LeaderElection:         enableLeaderElection,
-		LeaderElectionID:       "core.backups.cozystack.io",
-		// LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily
-		// when the Manager ends. This requires the binary to immediately end when the
-		// Manager is stopped, otherwise, this setting is unsafe. Setting this significantly
-		// speeds up voluntary leader transitions as the new leader don't have to wait
-		// LeaseDuration time first.
-		//
-		// In the default scaffold provided, the program ends immediately after
-		// the manager stops, so would be fine to enable this option. However,
-		// if you are doing or is intended to do any operation such as perform cleanups
-		// after the manager stops then its usage might be unsafe.
-		// LeaderElectionReleaseOnCancel: true,
-	})
-	if err != nil {
-		setupLog.Error(err, "unable to start manager")
-		os.Exit(1)
-	}
-
-	if err = (&backupcontroller.PlanReconciler{
-		Client: mgr.GetClient(),
-		Scheme: mgr.GetScheme(),
-	}).SetupWithManager(mgr); err != nil {
-		setupLog.Error(err, "unable to create controller", "controller", "Plan")
-		os.Exit(1)
-	}
-
-	// +kubebuilder:scaffold:builder
-
-	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
-		setupLog.Error(err, "unable to set up health check")
-		os.Exit(1)
-	}
-	if err := mgr.AddReadyzCheck("readyz", healthz.Ping); err != nil {
-		setupLog.Error(err, "unable to set up ready check")
-		os.Exit(1)
-	}
-
-	setupLog.Info("starting manager")
-	if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {
-		setupLog.Error(err, "problem running manager")
-		os.Exit(1)
-	}
-}

cmd/backupstrategy-controller/main.go

@@ -1,174 +0,0 @@
-/*
-Copyright 2025.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"crypto/tls"
-	"flag"
-	"os"
-
-	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
-	// to ensure that exec-entrypoint and run can make use of them.
-	_ "k8s.io/client-go/plugin/pkg/client/auth"
-
-	"k8s.io/apimachinery/pkg/runtime"
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/healthz"
-	"sigs.k8s.io/controller-runtime/pkg/log/zap"
-	"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
-	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-
-	backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1"
-	"github.com/cozystack/cozystack/internal/backupcontroller"
-	// +kubebuilder:scaffold:imports
-)
-
-var (
-	scheme   = runtime.NewScheme()
-	setupLog = ctrl.Log.WithName("setup")
-)
-
-func init() {
-	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
-
-	utilruntime.Must(backupsv1alpha1.AddToScheme(scheme))
-	// +kubebuilder:scaffold:scheme
-}
-
-func main() {
-	var metricsAddr string
-	var enableLeaderElection bool
-	var probeAddr string
-	var secureMetrics bool
-	var enableHTTP2 bool
-	var tlsOpts []func(*tls.Config)
-	flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+
-		"Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.")
-	flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
-	flag.BoolVar(&enableLeaderElection, "leader-elect", false,
-		"Enable leader election for controller manager. "+
-			"Enabling this will ensure there is only one active controller manager.")
-	flag.BoolVar(&secureMetrics, "metrics-secure", true,
-		"If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.")
-	flag.BoolVar(&enableHTTP2, "enable-http2", false,
-		"If set, HTTP/2 will be enabled for the metrics and webhook servers")
-	opts := zap.Options{
-		Development: false,
-	}
-	opts.BindFlags(flag.CommandLine)
-	flag.Parse()
-
-	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
-
-	// if the enable-http2 flag is false (the default), http/2 should be disabled
-	// due to its vulnerabilities. More specifically, disabling http/2 will
-	// prevent from being vulnerable to the HTTP/2 Stream Cancellation and
-	// Rapid Reset CVEs. For more information see:
-	// - https://github.com/advisories/GHSA-qppj-fm5r-hxr3
-	// - https://github.com/advisories/GHSA-4374-p667-p6c8
-	disableHTTP2 := func(c *tls.Config) {
-		setupLog.Info("disabling http/2")
-		c.NextProtos = []string{"http/1.1"}
-	}
-
-	if !enableHTTP2 {
-		tlsOpts = append(tlsOpts, disableHTTP2)
-	}
-
-	webhookServer := webhook.NewServer(webhook.Options{
-		TLSOpts: tlsOpts,
-	})
-
-	// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
-	// More info:
-	// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.19.1/pkg/metrics/server
-	// - https://book.kubebuilder.io/reference/metrics.html
-	metricsServerOptions := metricsserver.Options{
-		BindAddress:   metricsAddr,
-		SecureServing: secureMetrics,
-		TLSOpts:       tlsOpts,
-	}
-
-	if secureMetrics {
-		// FilterProvider is used to protect the metrics endpoint with authn/authz.
-		// These configurations ensure that only authorized users and service accounts
-		// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
-		// https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.19.1/pkg/metrics/filters#WithAuthenticationAndAuthorization
-		metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
-
-		// TODO(user): If CertDir, CertName, and KeyName are not specified, controller-runtime will automatically
-		// generate self-signed certificates for the metrics server. While convenient for development and testing,
-		// this setup is not recommended for production.
-	}
-
-	// Configure rate limiting for the Kubernetes client
-	config := ctrl.GetConfigOrDie()
-	config.QPS = 50.0  // Increased from default 5.0
-	config.Burst = 100 // Increased from default 10
-
-	mgr, err := ctrl.NewManager(config, ctrl.Options{
-		Scheme:                 scheme,
-		Metrics:                metricsServerOptions,
-		WebhookServer:          webhookServer,
-		HealthProbeBindAddress: probeAddr,
-		LeaderElection:         enableLeaderElection,
-		LeaderElectionID:       "strategy.backups.cozystack.io",
-		// LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily
-		// when the Manager ends. This requires the binary to immediately end when the
-		// Manager is stopped, otherwise, this setting is unsafe. Setting this significantly
-		// speeds up voluntary leader transitions as the new leader don't have to wait
-		// LeaseDuration time first.
-		//
-		// In the default scaffold provided, the program ends immediately after
-		// the manager stops, so would be fine to enable this option. However,
-		// if you are doing or is intended to do any operation such as perform cleanups
-		// after the manager stops then its usage might be unsafe.
-		// LeaderElectionReleaseOnCancel: true,
-	})
-	if err != nil {
-		setupLog.Error(err, "unable to start manager")
-		os.Exit(1)
-	}
-
-	if err = (&backupcontroller.BackupJobReconciler{
-		Client: mgr.GetClient(),
-		Scheme: mgr.GetScheme(),
-	}).SetupWithManager(mgr); err != nil {
-		setupLog.Error(err, "unable to create controller", "controller", "Job")
-		os.Exit(1)
-	}
-
-	// +kubebuilder:scaffold:builder
-
-	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
-		setupLog.Error(err, "unable to set up health check")
-		os.Exit(1)
-	}
-	if err := mgr.AddReadyzCheck("readyz", healthz.Ping); err != nil {
-		setupLog.Error(err, "unable to set up ready check")
-		os.Exit(1)
-	}
-
-	setupLog.Info("starting manager")
-	if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {
-		setupLog.Error(err, "problem running manager")
-		os.Exit(1)
-	}
-}

cmd/cozypkg/cmd/add.go

@@ -1,549 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package cmd
-
-import (
-	"bufio"
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-
-	"github.com/spf13/cobra"
-	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/serializer/yaml"
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
-	"k8s.io/client-go/rest"
-	"k8s.io/client-go/tools/clientcmd"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	_ "k8s.io/client-go/plugin/pkg/client/auth"
-)
-
-var addCmdFlags struct {
-	files      []string
-	kubeconfig string
-}
-
-var addCmd = &cobra.Command{
-	Use:   "add [package]...",
-	Short: "Install PackageSource and its dependencies interactively",
-	Long: `Install PackageSource and its dependencies interactively.
-
-You can specify packages as arguments or use -f flag to read from files.
-Multiple -f flags can be specified, and they can point to files or directories.`,
-	Args: cobra.ArbitraryArgs,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		ctx := context.Background()
-
-		// Collect package names from arguments and files
-		packageNames := make(map[string]bool)
-		packagesFromFiles := make(map[string]string) // packageName -> filePath
-		
-		for _, arg := range args {
-			packageNames[arg] = true
-		}
-
-		// Read packages from files
-		for _, filePath := range addCmdFlags.files {
-			packages, err := readPackagesFromFile(filePath)
-			if err != nil {
-				return fmt.Errorf("failed to read packages from %s: %w", filePath, err)
-			}
-			for _, pkg := range packages {
-				packageNames[pkg] = true
-				if oldPath, ok := packagesFromFiles[pkg]; ok {
-					fmt.Fprintf(os.Stderr, "warning: package %q is defined in both %s and %s, using the latter\n", pkg, oldPath, filePath)
-				}
-				packagesFromFiles[pkg] = filePath
-			}
-		}
-
-		if len(packageNames) == 0 {
-			return fmt.Errorf("no packages specified")
-		}
-
-		// Create Kubernetes client config
-		var config *rest.Config
-		var err error
-
-		if addCmdFlags.kubeconfig != "" {
-			config, err = clientcmd.BuildConfigFromFlags("", addCmdFlags.kubeconfig)
-			if err != nil {
-				return fmt.Errorf("failed to load kubeconfig from %s: %w", addCmdFlags.kubeconfig, err)
-			}
-		} else {
-			config, err = ctrl.GetConfig()
-			if err != nil {
-				return fmt.Errorf("failed to get kubeconfig: %w", err)
-			}
-		}
-
-		scheme := runtime.NewScheme()
-		utilruntime.Must(clientgoscheme.AddToScheme(scheme))
-		utilruntime.Must(cozyv1alpha1.AddToScheme(scheme))
-
-		k8sClient, err := client.New(config, client.Options{Scheme: scheme})
-		if err != nil {
-			return fmt.Errorf("failed to create k8s client: %w", err)
-		}
-
-		// Process each package
-		for packageName := range packageNames {
-			// Check if package comes from a file
-			if filePath, fromFile := packagesFromFiles[packageName]; fromFile {
-				// Try to create Package directly from file
-				if err := createPackageFromFile(ctx, k8sClient, filePath, packageName); err == nil {
-					fmt.Fprintf(os.Stderr, "✓ Added Package %s\n", packageName)
-					continue
-				}
-				// If failed, fall back to interactive installation
-			}
-			
-			// Interactive installation from PackageSource
-			if err := installPackage(ctx, k8sClient, packageName); err != nil {
-				return err
-			}
-		}
-
-		return nil
-	},
-}
-
-func readPackagesFromFile(filePath string) ([]string, error) {
-	info, err := os.Stat(filePath)
-	if err != nil {
-		return nil, err
-	}
-
-	var packages []string
-
-	if info.IsDir() {
-		// Read all YAML files from directory
-		err := filepath.Walk(filePath, func(path string, info os.FileInfo, err error) error {
-			if err != nil {
-				return err
-			}
-			if info.IsDir() || !strings.HasSuffix(path, ".yaml") && !strings.HasSuffix(path, ".yml") {
-				return nil
-			}
-
-			pkgs, err := readPackagesFromYAMLFile(path)
-			if err != nil {
-				return fmt.Errorf("failed to read %s: %w", path, err)
-			}
-			packages = append(packages, pkgs...)
-			return nil
-		})
-		if err != nil {
-			return nil, err
-		}
-	} else {
-		packages, err = readPackagesFromYAMLFile(filePath)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	return packages, nil
-}
-
-func readPackagesFromYAMLFile(filePath string) ([]string, error) {
-	data, err := os.ReadFile(filePath)
-	if err != nil {
-		return nil, err
-	}
-
-	var packages []string
-
-	// Split YAML documents (in case of multiple resources)
-	documents := strings.Split(string(data), "---")
-	
-	for _, doc := range documents {
-		doc = strings.TrimSpace(doc)
-		if doc == "" {
-			continue
-		}
-
-		// Parse using Kubernetes decoder
-		decoder := yaml.NewDecodingSerializer(unstructured.UnstructuredJSONScheme)
-		obj := &unstructured.Unstructured{}
-		_, _, err := decoder.Decode([]byte(doc), nil, obj)
-		if err != nil {
-			continue
-		}
-
-		// Check if it's a Package
-		if obj.GetKind() == "Package" {
-			name := obj.GetName()
-			if name != "" {
-				packages = append(packages, name)
-			}
-			continue
-		}
-
-		// Check if it's a PackageSource
-		if obj.GetKind() == "PackageSource" {
-			name := obj.GetName()
-			if name != "" {
-				packages = append(packages, name)
-			}
-			continue
-		}
-
-		// Try to parse as PackageList or PackageSourceList
-		if obj.GetKind() == "PackageList" || obj.GetKind() == "PackageSourceList" {
-			items, found, err := unstructured.NestedSlice(obj.Object, "items")
-			if err == nil && found {
-				for _, item := range items {
-					if itemMap, ok := item.(map[string]interface{}); ok {
-						if metadata, ok := itemMap["metadata"].(map[string]interface{}); ok {
-							if name, ok := metadata["name"].(string); ok && name != "" {
-								packages = append(packages, name)
-							}
-						}
-					}
-				}
-			}
-			continue
-		}
-	}
-
-	// Return empty list if no packages found - don't error out
-	// The check for whether any packages were specified at all is handled later in RunE
-	return packages, nil
-}
-
-// buildDependencyTree builds a dependency tree starting from the root PackageSource
-// Returns both the dependency tree and a map of dependencies to their requesters
-func buildDependencyTree(ctx context.Context, k8sClient client.Client, rootName string) (map[string][]string, map[string]string, error) {
-	tree := make(map[string][]string)
-	dependencyRequesters := make(map[string]string) // dep -> requester
-	visited := make(map[string]bool)
-	
-	// Ensure root is in tree even if it has no dependencies
-	tree[rootName] = []string{}
-
-	var buildTree func(string) error
-	buildTree = func(pkgName string) error {
-		if visited[pkgName] {
-			return nil
-		}
-		visited[pkgName] = true
-
-		// Get PackageSource
-		ps := &cozyv1alpha1.PackageSource{}
-		if err := k8sClient.Get(ctx, client.ObjectKey{Name: pkgName}, ps); err != nil {
-			// If PackageSource doesn't exist, just skip it
-			return nil
-		}
-
-		// Collect all dependencies from all variants
-		deps := make(map[string]bool)
-		for _, variant := range ps.Spec.Variants {
-			for _, dep := range variant.DependsOn {
-				deps[dep] = true
-			}
-		}
-
-		// Add dependencies to tree
-		for dep := range deps {
-			if _, exists := tree[pkgName]; !exists {
-				tree[pkgName] = []string{}
-			}
-			tree[pkgName] = append(tree[pkgName], dep)
-			// Track who requested this dependency
-			dependencyRequesters[dep] = pkgName
-			// Recursively build tree for dependencies
-			if err := buildTree(dep); err != nil {
-				return err
-			}
-		}
-
-		return nil
-	}
-
-	if err := buildTree(rootName); err != nil {
-		return nil, nil, err
-	}
-
-	return tree, dependencyRequesters, nil
-}
-
-// topologicalSort performs topological sort on the dependency tree
-// Returns order from root to leaves (dependencies first)
-func topologicalSort(tree map[string][]string) ([]string, error) {
-	// Build reverse graph (dependencies -> dependents)
-	reverseGraph := make(map[string][]string)
-	allNodes := make(map[string]bool)
-
-	for node, deps := range tree {
-		allNodes[node] = true
-		for _, dep := range deps {
-			allNodes[dep] = true
-			reverseGraph[dep] = append(reverseGraph[dep], node)
-		}
-	}
-
-	// Calculate in-degrees (how many dependencies a node has)
-	inDegree := make(map[string]int)
-	for node := range allNodes {
-		inDegree[node] = 0
-	}
-	for node, deps := range tree {
-		inDegree[node] = len(deps)
-	}
-
-	// Kahn's algorithm - start with nodes that have no dependencies
-	var queue []string
-	for node, degree := range inDegree {
-		if degree == 0 {
-			queue = append(queue, node)
-		}
-	}
-
-	var result []string
-	for len(queue) > 0 {
-		node := queue[0]
-		queue = queue[1:]
-		result = append(result, node)
-
-		// Process dependents (nodes that depend on this node)
-		for _, dependent := range reverseGraph[node] {
-			inDegree[dependent]--
-			if inDegree[dependent] == 0 {
-				queue = append(queue, dependent)
-			}
-		}
-	}
-
-	// Check for cycles
-	if len(result) != len(allNodes) {
-		return nil, fmt.Errorf("dependency cycle detected")
-	}
-
-	return result, nil
-}
-
-// createPackageFromFile creates a Package resource directly from a YAML file
-func createPackageFromFile(ctx context.Context, k8sClient client.Client, filePath string, packageName string) error {
-	data, err := os.ReadFile(filePath)
-	if err != nil {
-		return err
-	}
-
-	// Split YAML documents
-	documents := strings.Split(string(data), "---")
-	
-	for _, doc := range documents {
-		doc = strings.TrimSpace(doc)
-		if doc == "" {
-			continue
-		}
-
-		// Parse using Kubernetes decoder
-		decoder := yaml.NewDecodingSerializer(unstructured.UnstructuredJSONScheme)
-		obj := &unstructured.Unstructured{}
-		_, _, err := decoder.Decode([]byte(doc), nil, obj)
-		if err != nil {
-			continue
-		}
-
-		// Check if it's a Package with matching name
-		if obj.GetKind() == "Package" && obj.GetName() == packageName {
-			// Convert to Package
-			var pkg cozyv1alpha1.Package
-			if err := runtime.DefaultUnstructuredConverter.FromUnstructured(obj.Object, &pkg); err != nil {
-				return fmt.Errorf("failed to convert Package: %w", err)
-			}
-
-			// Create Package
-			if err := k8sClient.Create(ctx, &pkg); err != nil {
-				return fmt.Errorf("failed to create Package: %w", err)
-			}
-
-			return nil
-		}
-	}
-
-	return fmt.Errorf("Package %s not found in file", packageName)
-}
-
-func installPackage(ctx context.Context, k8sClient client.Client, packageSourceName string) error {
-	// Get PackageSource
-	packageSource := &cozyv1alpha1.PackageSource{}
-	if err := k8sClient.Get(ctx, client.ObjectKey{Name: packageSourceName}, packageSource); err != nil {
-		return fmt.Errorf("failed to get PackageSource %s: %w", packageSourceName, err)
-	}
-
-	// Build dependency tree
-	dependencyTree, dependencyRequesters, err := buildDependencyTree(ctx, k8sClient, packageSourceName)
-	if err != nil {
-		return fmt.Errorf("failed to build dependency tree: %w", err)
-	}
-
-	// Topological sort (install from root to leaves)
-	installOrder, err := topologicalSort(dependencyTree)
-	if err != nil {
-		return fmt.Errorf("failed to sort dependencies: %w", err)
-	}
-
-	// Get all PackageSources for variant selection
-	var allPackageSources cozyv1alpha1.PackageSourceList
-	if err := k8sClient.List(ctx, &allPackageSources); err != nil {
-		return fmt.Errorf("failed to list PackageSources: %w", err)
-	}
-
-	packageSourceMap := make(map[string]*cozyv1alpha1.PackageSource)
-	for i := range allPackageSources.Items {
-		packageSourceMap[allPackageSources.Items[i].Name] = &allPackageSources.Items[i]
-	}
-
-	// Get all installed Packages
-	var installedPackages cozyv1alpha1.PackageList
-	if err := k8sClient.List(ctx, &installedPackages); err != nil {
-		return fmt.Errorf("failed to list Packages: %w", err)
-	}
-
-	installedMap := make(map[string]*cozyv1alpha1.Package)
-	for i := range installedPackages.Items {
-		installedMap[installedPackages.Items[i].Name] = &installedPackages.Items[i]
-	}
-
-	// First, collect all variant selections
-	fmt.Fprintf(os.Stderr, "Installing %s and its dependencies...\n\n", packageSourceName)
-	packageVariants := make(map[string]string) // packageName -> variant
-
-	for _, pkgName := range installOrder {
-		// Check if already installed
-		if installed, exists := installedMap[pkgName]; exists {
-			variant := installed.Spec.Variant
-			if variant == "" {
-				variant = "default"
-			}
-			fmt.Fprintf(os.Stderr, "✓ %s (already installed, variant: %s)\n", pkgName, variant)
-			packageVariants[pkgName] = variant
-			continue
-		}
-
-		// Get PackageSource for this dependency
-		ps, exists := packageSourceMap[pkgName]
-		if !exists {
-			requester := dependencyRequesters[pkgName]
-			if requester != "" {
-				return fmt.Errorf("PackageSource %s not found (required by %s)", pkgName, requester)
-			}
-			return fmt.Errorf("PackageSource %s not found", pkgName)
-		}
-
-		// Select variant interactively
-		variant, err := selectVariantInteractive(ps)
-		if err != nil {
-			return fmt.Errorf("failed to select variant for %s: %w", pkgName, err)
-		}
-
-		packageVariants[pkgName] = variant
-	}
-
-	// Now create all Package resources
-	for _, pkgName := range installOrder {
-		// Skip if already installed
-		if _, exists := installedMap[pkgName]; exists {
-			continue
-		}
-
-		variant := packageVariants[pkgName]
-
-		// Create Package
-		pkg := &cozyv1alpha1.Package{
-			ObjectMeta: metav1.ObjectMeta{
-				Name: pkgName,
-			},
-			Spec: cozyv1alpha1.PackageSpec{
-				Variant: variant,
-			},
-		}
-
-		if err := k8sClient.Create(ctx, pkg); err != nil {
-			return fmt.Errorf("failed to create Package %s: %w", pkgName, err)
-		}
-
-		fmt.Fprintf(os.Stderr, "✓ Added Package %s\n", pkgName)
-	}
-
-	return nil
-}
-
-// selectVariantInteractive prompts user to select a variant
-func selectVariantInteractive(ps *cozyv1alpha1.PackageSource) (string, error) {
-	if len(ps.Spec.Variants) == 0 {
-		return "", fmt.Errorf("no variants available for PackageSource %s", ps.Name)
-	}
-
-	reader := bufio.NewReader(os.Stdin)
-
-	fmt.Fprintf(os.Stderr, "\nPackageSource: %s\n", ps.Name)
-	fmt.Fprintf(os.Stderr, "Available variants:\n")
-	for i, variant := range ps.Spec.Variants {
-		fmt.Fprintf(os.Stderr, "  %d. %s\n", i+1, variant.Name)
-	}
-
-	// If only one variant, use it as default
-	defaultVariant := ps.Spec.Variants[0].Name
-	var prompt string
-	if len(ps.Spec.Variants) == 1 {
-		prompt = "Select variant [1]: "
-	} else {
-		prompt = fmt.Sprintf("Select variant (1-%d): ", len(ps.Spec.Variants))
-	}
-
-	for {
-		fmt.Fprintf(os.Stderr, prompt)
-		input, err := reader.ReadString('\n')
-		if err != nil {
-			return "", fmt.Errorf("failed to read input: %w", err)
-		}
-
-		input = strings.TrimSpace(input)
-
-		// If input is empty and there's a default variant, use it
-		if input == "" && len(ps.Spec.Variants) == 1 {
-			return defaultVariant, nil
-		}
-
-		choice, err := strconv.Atoi(input)
-		if err != nil || choice < 1 || choice > len(ps.Spec.Variants) {
-			fmt.Fprintf(os.Stderr, "Invalid choice. Please enter a number between 1 and %d.\n", len(ps.Spec.Variants))
-			continue
-		}
-
-		return ps.Spec.Variants[choice-1].Name, nil
-	}
-}
-
-func init() {
-	rootCmd.AddCommand(addCmd)
-	addCmd.Flags().StringArrayVarP(&addCmdFlags.files, "file", "f", []string{}, "Read packages from file or directory (can be specified multiple times)")
-	addCmd.Flags().StringVar(&addCmdFlags.kubeconfig, "kubeconfig", "", "Path to kubeconfig file (defaults to ~/.kube/config or KUBECONFIG env var)")
-}
-

cmd/cozypkg/cmd/del.go

@@ -1,396 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package cmd
-
-import (
-	"bufio"
-	"context"
-	"fmt"
-	"os"
-	"strings"
-
-	"github.com/spf13/cobra"
-	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/runtime"
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
-	"k8s.io/client-go/rest"
-	"k8s.io/client-go/tools/clientcmd"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	_ "k8s.io/client-go/plugin/pkg/client/auth"
-)
-
-var delCmdFlags struct {
-	files      []string
-	kubeconfig string
-}
-
-var delCmd = &cobra.Command{
-	Use:   "del [package]...",
-	Short: "Delete Package resources",
-	Long: `Delete Package resources.
-
-You can specify packages as arguments or use -f flag to read from files.
-Multiple -f flags can be specified, and they can point to files or directories.`,
-	Args: cobra.ArbitraryArgs,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		ctx := context.Background()
-
-		// Collect package names from arguments and files
-		packageNames := make(map[string]bool)
-		packagesFromFiles := make(map[string]string) // packageName -> filePath
-		
-		for _, arg := range args {
-			packageNames[arg] = true
-		}
-
-		// Read packages from files (reuse function from add.go)
-		for _, filePath := range delCmdFlags.files {
-			packages, err := readPackagesFromFile(filePath)
-			if err != nil {
-				return fmt.Errorf("failed to read packages from %s: %w", filePath, err)
-			}
-			for _, pkg := range packages {
-				packageNames[pkg] = true
-				if oldPath, ok := packagesFromFiles[pkg]; ok {
-					fmt.Fprintf(os.Stderr, "warning: package %q is defined in both %s and %s, using the latter\n", pkg, oldPath, filePath)
-				}
-				packagesFromFiles[pkg] = filePath
-			}
-		}
-
-		if len(packageNames) == 0 {
-			return fmt.Errorf("no packages specified")
-		}
-
-		// Create Kubernetes client config
-		var config *rest.Config
-		var err error
-
-		if delCmdFlags.kubeconfig != "" {
-			config, err = clientcmd.BuildConfigFromFlags("", delCmdFlags.kubeconfig)
-			if err != nil {
-				return fmt.Errorf("failed to load kubeconfig from %s: %w", delCmdFlags.kubeconfig, err)
-			}
-		} else {
-			config, err = ctrl.GetConfig()
-			if err != nil {
-				return fmt.Errorf("failed to get kubeconfig: %w", err)
-			}
-		}
-
-		scheme := runtime.NewScheme()
-		utilruntime.Must(clientgoscheme.AddToScheme(scheme))
-		utilruntime.Must(cozyv1alpha1.AddToScheme(scheme))
-
-		k8sClient, err := client.New(config, client.Options{Scheme: scheme})
-		if err != nil {
-			return fmt.Errorf("failed to create k8s client: %w", err)
-		}
-
-		// Check which requested packages are installed
-		var installedPackages cozyv1alpha1.PackageList
-		if err := k8sClient.List(ctx, &installedPackages); err != nil {
-			return fmt.Errorf("failed to list Packages: %w", err)
-		}
-		installedMap := make(map[string]bool)
-		for _, pkg := range installedPackages.Items {
-			installedMap[pkg.Name] = true
-		}
-
-		// Warn about requested packages that are not installed
-		for pkgName := range packageNames {
-			if !installedMap[pkgName] {
-				fmt.Fprintf(os.Stderr, "⚠ Package %s is not installed, skipping\n", pkgName)
-			}
-		}
-
-		// Find all packages to delete (including dependents)
-		packagesToDelete, err := findPackagesToDelete(ctx, k8sClient, packageNames)
-		if err != nil {
-			return fmt.Errorf("failed to analyze dependencies: %w", err)
-		}
-
-		if len(packagesToDelete) == 0 {
-			fmt.Fprintf(os.Stderr, "No packages found to delete\n")
-			return nil
-		}
-
-		// Show packages to be deleted and ask for confirmation
-		if err := confirmDeletion(packagesToDelete, packageNames); err != nil {
-			return err
-		}
-
-		// Delete packages in reverse topological order (dependents first, then dependencies)
-		deleteOrder, err := getDeleteOrder(ctx, k8sClient, packagesToDelete)
-		if err != nil {
-			return fmt.Errorf("failed to determine delete order: %w", err)
-		}
-
-		// Delete each package
-		for _, packageName := range deleteOrder {
-			pkg := &cozyv1alpha1.Package{}
-			pkg.Name = packageName
-			if err := k8sClient.Delete(ctx, pkg); err != nil {
-				if apierrors.IsNotFound(err) {
-					fmt.Fprintf(os.Stderr, "⚠ Package %s not found, skipping\n", packageName)
-					continue
-				}
-				return fmt.Errorf("failed to delete Package %s: %w", packageName, err)
-			}
-			fmt.Fprintf(os.Stderr, "✓ Deleted Package %s\n", packageName)
-		}
-
-		return nil
-	},
-}
-
-// findPackagesToDelete finds all packages that need to be deleted, including dependents
-func findPackagesToDelete(ctx context.Context, k8sClient client.Client, requestedPackages map[string]bool) (map[string]bool, error) {
-	// Get all installed Packages
-	var installedPackages cozyv1alpha1.PackageList
-	if err := k8sClient.List(ctx, &installedPackages); err != nil {
-		return nil, fmt.Errorf("failed to list Packages: %w", err)
-	}
-
-	installedMap := make(map[string]bool)
-	for _, pkg := range installedPackages.Items {
-		installedMap[pkg.Name] = true
-	}
-
-	// Get all PackageSources to build dependency graph
-	var packageSources cozyv1alpha1.PackageSourceList
-	if err := k8sClient.List(ctx, &packageSources); err != nil {
-		return nil, fmt.Errorf("failed to list PackageSources: %w", err)
-	}
-
-	// Build reverse dependency graph (dependents -> dependencies)
-	// This tells us: for each package, which packages depend on it
-	reverseDeps := make(map[string][]string)
-	for _, ps := range packageSources.Items {
-		// Only consider installed packages
-		if !installedMap[ps.Name] {
-			continue
-		}
-		for _, variant := range ps.Spec.Variants {
-			for _, dep := range variant.DependsOn {
-				// Only consider installed dependencies
-				if installedMap[dep] {
-					reverseDeps[dep] = append(reverseDeps[dep], ps.Name)
-				}
-			}
-		}
-	}
-
-	// Find all packages to delete (requested + their dependents)
-	packagesToDelete := make(map[string]bool)
-	visited := make(map[string]bool)
-
-	var findDependents func(string)
-	findDependents = func(pkgName string) {
-		if visited[pkgName] {
-			return
-		}
-		visited[pkgName] = true
-
-		// Only add if it's installed
-		if installedMap[pkgName] {
-			packagesToDelete[pkgName] = true
-		}
-
-		// Recursively find all dependents
-		for _, dependent := range reverseDeps[pkgName] {
-			if installedMap[dependent] {
-				findDependents(dependent)
-			}
-		}
-	}
-
-	// Start from requested packages
-	for pkgName := range requestedPackages {
-		if !installedMap[pkgName] {
-			continue
-		}
-		findDependents(pkgName)
-	}
-
-	return packagesToDelete, nil
-}
-
-// confirmDeletion shows the list of packages to be deleted and asks for user confirmation
-func confirmDeletion(packagesToDelete map[string]bool, requestedPackages map[string]bool) error {
-	// Separate requested packages from dependents
-	var requested []string
-	var dependents []string
-
-	for pkg := range packagesToDelete {
-		if requestedPackages[pkg] {
-			requested = append(requested, pkg)
-		} else {
-			dependents = append(dependents, pkg)
-		}
-	}
-
-	fmt.Fprintf(os.Stderr, "\nThe following packages will be deleted:\n\n")
-
-	if len(requested) > 0 {
-		fmt.Fprintf(os.Stderr, "Requested packages:\n")
-		for _, pkg := range requested {
-			fmt.Fprintf(os.Stderr, "  - %s\n", pkg)
-		}
-		fmt.Fprintf(os.Stderr, "\n")
-	}
-
-	if len(dependents) > 0 {
-		fmt.Fprintf(os.Stderr, "Dependent packages (will also be deleted):\n")
-		for _, pkg := range dependents {
-			fmt.Fprintf(os.Stderr, "  - %s\n", pkg)
-		}
-		fmt.Fprintf(os.Stderr, "\n")
-	}
-
-	fmt.Fprintf(os.Stderr, "Total: %d package(s)\n\n", len(packagesToDelete))
-	fmt.Fprintf(os.Stderr, "Do you want to continue? [y/N]: ")
-
-	reader := bufio.NewReader(os.Stdin)
-	input, err := reader.ReadString('\n')
-	if err != nil {
-		return fmt.Errorf("failed to read input: %w", err)
-	}
-
-	input = strings.TrimSpace(strings.ToLower(input))
-	if input != "y" && input != "yes" {
-		return fmt.Errorf("deletion cancelled")
-	}
-
-	return nil
-}
-
-// getDeleteOrder returns packages in reverse topological order (dependents first, then dependencies)
-// This ensures we delete dependents before their dependencies
-func getDeleteOrder(ctx context.Context, k8sClient client.Client, packagesToDelete map[string]bool) ([]string, error) {
-	// Get all PackageSources to build dependency graph
-	var packageSources cozyv1alpha1.PackageSourceList
-	if err := k8sClient.List(ctx, &packageSources); err != nil {
-		return nil, fmt.Errorf("failed to list PackageSources: %w", err)
-	}
-
-	// Build forward dependency graph (package -> dependencies)
-	dependencyGraph := make(map[string][]string)
-	for _, ps := range packageSources.Items {
-		if !packagesToDelete[ps.Name] {
-			continue
-		}
-		deps := make(map[string]bool)
-		for _, variant := range ps.Spec.Variants {
-			for _, dep := range variant.DependsOn {
-				if packagesToDelete[dep] {
-					deps[dep] = true
-				}
-			}
-		}
-		var depList []string
-		for dep := range deps {
-			depList = append(depList, dep)
-		}
-		dependencyGraph[ps.Name] = depList
-	}
-
-	// Build reverse graph for topological sort
-	reverseGraph := make(map[string][]string)
-	allNodes := make(map[string]bool)
-
-	for node, deps := range dependencyGraph {
-		allNodes[node] = true
-		for _, dep := range deps {
-			allNodes[dep] = true
-			reverseGraph[dep] = append(reverseGraph[dep], node)
-		}
-	}
-
-	// Add nodes that have no dependencies
-	for pkg := range packagesToDelete {
-		if !allNodes[pkg] {
-			allNodes[pkg] = true
-			dependencyGraph[pkg] = []string{}
-		}
-	}
-
-	// Calculate in-degrees
-	inDegree := make(map[string]int)
-	for node := range allNodes {
-		inDegree[node] = 0
-	}
-	for node, deps := range dependencyGraph {
-		inDegree[node] = len(deps)
-	}
-
-	// Kahn's algorithm - start with nodes that have no dependencies
-	var queue []string
-	for node, degree := range inDegree {
-		if degree == 0 {
-			queue = append(queue, node)
-		}
-	}
-
-	var result []string
-	for len(queue) > 0 {
-		node := queue[0]
-		queue = queue[1:]
-		result = append(result, node)
-
-		// Process dependents
-		for _, dependent := range reverseGraph[node] {
-			inDegree[dependent]--
-			if inDegree[dependent] == 0 {
-				queue = append(queue, dependent)
-			}
-		}
-	}
-
-	// Check for cycles: if not all nodes were processed, there's a cycle
-	if len(result) != len(allNodes) {
-		// Find unprocessed nodes
-		processed := make(map[string]bool)
-		for _, node := range result {
-			processed[node] = true
-		}
-		var unprocessed []string
-		for node := range allNodes {
-			if !processed[node] {
-				unprocessed = append(unprocessed, node)
-			}
-		}
-		return nil, fmt.Errorf("dependency cycle detected: the following packages form a cycle and cannot be deleted: %v", unprocessed)
-	}
-
-	// Reverse the result to get dependents first, then dependencies
-	for i, j := 0, len(result)-1; i < j; i, j = i+1, j-1 {
-		result[i], result[j] = result[j], result[i]
-	}
-
-	return result, nil
-}
-
-func init() {
-	rootCmd.AddCommand(delCmd)
-	delCmd.Flags().StringArrayVarP(&delCmdFlags.files, "file", "f", []string{}, "Read packages from file or directory (can be specified multiple times)")
-	delCmd.Flags().StringVar(&delCmdFlags.kubeconfig, "kubeconfig", "", "Path to kubeconfig file (defaults to ~/.kube/config or KUBECONFIG env var)")
-}
-

cmd/cozypkg/cmd/dependencies.go

@@ -1,564 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"strings"
-
-	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
-	"github.com/emicklei/dot"
-	"github.com/spf13/cobra"
-	"k8s.io/apimachinery/pkg/runtime"
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
-	_ "k8s.io/client-go/plugin/pkg/client/auth"
-	"k8s.io/client-go/rest"
-	"k8s.io/client-go/tools/clientcmd"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-)
-
-var dotCmdFlags struct {
-	installed  bool
-	components bool
-	files      []string
-	kubeconfig string
-}
-
-var dotCmd = &cobra.Command{
-	Use:   "dot [package]...",
-	Short: "Generate dependency graph as graphviz DOT format",
-	Long: `Generate dependency graph as graphviz DOT format.
-
-Pipe the output through the "dot" program (part of graphviz package) to render the graph:
-
-    cozypkg dot | dot -Tpng > graph.png
-
-By default, shows dependencies for all PackageSource resources.
-Use --installed to show only installed Package resources.
-Specify packages as arguments or use -f flag to read from files.`,
-	Args: cobra.ArbitraryArgs,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		ctx := context.Background()
-
-		// Collect package names from arguments and files
-		packageNames := make(map[string]bool)
-		for _, arg := range args {
-			packageNames[arg] = true
-		}
-
-		// Read packages from files (reuse function from add.go)
-		for _, filePath := range dotCmdFlags.files {
-			packages, err := readPackagesFromFile(filePath)
-			if err != nil {
-				return fmt.Errorf("failed to read packages from %s: %w", filePath, err)
-			}
-			for _, pkg := range packages {
-				packageNames[pkg] = true
-			}
-		}
-
-		// Convert to slice, empty means all packages
-		var selectedPackages []string
-		if len(packageNames) > 0 {
-			for pkg := range packageNames {
-				selectedPackages = append(selectedPackages, pkg)
-			}
-		}
-
-		// If multiple packages specified, show graph for all of them
-		// If single package, use packageName for backward compatibility
-		var packageName string
-		if len(selectedPackages) == 1 {
-			packageName = selectedPackages[0]
-		} else if len(selectedPackages) > 1 {
-			// Multiple packages - pass empty string to packageName, use selectedPackages
-			packageName = ""
-		}
-
-		// packagesOnly is inverse of components flag (if components=false, then packagesOnly=true)
-		packagesOnly := !dotCmdFlags.components
-		graph, allNodes, edgeVariants, packageNames, err := buildGraphFromCluster(ctx, dotCmdFlags.kubeconfig, packagesOnly, dotCmdFlags.installed, packageName, selectedPackages)
-		if err != nil {
-			return fmt.Errorf("error getting PackageSource dependencies: %w", err)
-		}
-
-		dotGraph := generateDOTGraph(graph, allNodes, packagesOnly, edgeVariants, packageNames)
-		dotGraph.Write(os.Stdout)
-
-		return nil
-	},
-}
-
-func init() {
-	rootCmd.AddCommand(dotCmd)
-	dotCmd.Flags().BoolVarP(&dotCmdFlags.installed, "installed", "i", false, "show dependencies only for installed Package resources")
-	dotCmd.Flags().BoolVar(&dotCmdFlags.components, "components", false, "show component-level dependencies")
-	dotCmd.Flags().StringArrayVarP(&dotCmdFlags.files, "file", "f", []string{}, "Read packages from file or directory (can be specified multiple times)")
-	dotCmd.Flags().StringVar(&dotCmdFlags.kubeconfig, "kubeconfig", "", "Path to kubeconfig file (defaults to ~/.kube/config or KUBECONFIG env var)")
-}
-
-var (
-	dependenciesScheme = runtime.NewScheme()
-)
-
-func init() {
-	utilruntime.Must(clientgoscheme.AddToScheme(dependenciesScheme))
-	utilruntime.Must(cozyv1alpha1.AddToScheme(dependenciesScheme))
-}
-
-// buildGraphFromCluster builds a dependency graph from PackageSource resources in the cluster.
-// Returns: graph, allNodes, edgeVariants (map[edgeKey]variants), packageNames, error
-func buildGraphFromCluster(ctx context.Context, kubeconfig string, packagesOnly bool, installedOnly bool, packageName string, selectedPackages []string) (map[string][]string, map[string]bool, map[string][]string, map[string]bool, error) {
-	// Create Kubernetes client config
-	var config *rest.Config
-	var err error
-
-	if kubeconfig != "" {
-		// Load kubeconfig from explicit path
-		config, err = clientcmd.BuildConfigFromFlags("", kubeconfig)
-		if err != nil {
-			return nil, nil, nil, nil, fmt.Errorf("failed to load kubeconfig from %s: %w", kubeconfig, err)
-		}
-	} else {
-		// Use default kubeconfig loading (from env var or ~/.kube/config)
-		config, err = ctrl.GetConfig()
-		if err != nil {
-			return nil, nil, nil, nil, fmt.Errorf("failed to get kubeconfig: %w", err)
-		}
-	}
-
-	k8sClient, err := client.New(config, client.Options{Scheme: dependenciesScheme})
-	if err != nil {
-		return nil, nil, nil, nil, fmt.Errorf("failed to create k8s client: %w", err)
-	}
-
-	// Get installed Packages if needed
-	installedPackages := make(map[string]bool)
-	if installedOnly {
-		var packageList cozyv1alpha1.PackageList
-		if err := k8sClient.List(ctx, &packageList); err != nil {
-			return nil, nil, nil, nil, fmt.Errorf("failed to list Packages: %w", err)
-		}
-		for _, pkg := range packageList.Items {
-			installedPackages[pkg.Name] = true
-		}
-	}
-
-	// List all PackageSource resources
-	var packageSourceList cozyv1alpha1.PackageSourceList
-	if err := k8sClient.List(ctx, &packageSourceList); err != nil {
-		return nil, nil, nil, nil, fmt.Errorf("failed to list PackageSources: %w", err)
-	}
-
-	// Build map of existing packages and components
-	packageNames := make(map[string]bool)
-	allExistingComponents := make(map[string]bool) // "package.component" -> true
-	for _, ps := range packageSourceList.Items {
-		if ps.Name != "" {
-			packageNames[ps.Name] = true
-			for _, variant := range ps.Spec.Variants {
-				for _, component := range variant.Components {
-					if component.Install != nil {
-						componentFullName := fmt.Sprintf("%s.%s", ps.Name, component.Name)
-						allExistingComponents[componentFullName] = true
-					}
-				}
-			}
-		}
-	}
-
-	graph := make(map[string][]string)
-	allNodes := make(map[string]bool)
-	edgeVariants := make(map[string][]string)      // key: "source->target", value: list of variant names
-	existingEdges := make(map[string]bool)         // key: "source->target" to avoid duplicates
-	componentHasLocalDeps := make(map[string]bool) // componentName -> has local component dependencies
-
-	// Process each PackageSource
-	for _, ps := range packageSourceList.Items {
-		psName := ps.Name
-		if psName == "" {
-			continue
-		}
-
-		// Filter by package name if specified
-		if packageName != "" && psName != packageName {
-			continue
-		}
-
-		// Filter by selected packages if specified
-		if len(selectedPackages) > 0 {
-			found := false
-			for _, selected := range selectedPackages {
-				if psName == selected {
-					found = true
-					break
-				}
-			}
-			if !found {
-				continue
-			}
-		}
-
-		// Filter by installed packages if flag is set
-		if installedOnly && !installedPackages[psName] {
-			continue
-		}
-
-		allNodes[psName] = true
-
-		// Track package dependencies per variant
-		packageDepVariants := make(map[string]map[string]bool) // dep -> variant -> true
-		allVariantNames := make(map[string]bool)
-		for _, v := range ps.Spec.Variants {
-			allVariantNames[v.Name] = true
-		}
-
-		// Track component dependencies per variant
-		componentDepVariants := make(map[string]map[string]map[string]bool) // componentName -> dep -> variant -> true
-		componentVariants := make(map[string]map[string]bool)               // componentName -> variant -> true
-
-		// Extract dependencies from variants
-		for _, variant := range ps.Spec.Variants {
-			// Variant-level dependencies (package-level)
-			for _, dep := range variant.DependsOn {
-				// If installedOnly is set, only include dependencies that are installed
-				if installedOnly && !installedPackages[dep] {
-					continue
-				}
-
-				// Track which variant this dependency comes from
-				if packageDepVariants[dep] == nil {
-					packageDepVariants[dep] = make(map[string]bool)
-				}
-				packageDepVariants[dep][variant.Name] = true
-
-				edgeKey := fmt.Sprintf("%s->%s", psName, dep)
-				if !existingEdges[edgeKey] {
-					graph[psName] = append(graph[psName], dep)
-					existingEdges[edgeKey] = true
-				}
-
-				// Add to allNodes only if package exists
-				if packageNames[dep] {
-					allNodes[dep] = true
-				}
-				// If package doesn't exist, don't add to allNodes - it will be shown as missing (red)
-			}
-
-			// Component-level dependencies
-			if !packagesOnly {
-				for _, component := range variant.Components {
-					// Skip components without install section
-					if component.Install == nil {
-						continue
-					}
-
-					componentName := fmt.Sprintf("%s.%s", psName, component.Name)
-					allNodes[componentName] = true
-
-					// Track which variants this component appears in
-					if componentVariants[componentName] == nil {
-						componentVariants[componentName] = make(map[string]bool)
-					}
-					componentVariants[componentName][variant.Name] = true
-
-					if component.Install != nil {
-						if componentDepVariants[componentName] == nil {
-							componentDepVariants[componentName] = make(map[string]map[string]bool)
-						}
-
-						for _, dep := range component.Install.DependsOn {
-							// Track which variant this dependency comes from
-							if componentDepVariants[componentName][dep] == nil {
-								componentDepVariants[componentName][dep] = make(map[string]bool)
-							}
-							componentDepVariants[componentName][dep][variant.Name] = true
-
-							// Check if it's a local component dependency or external
-							if strings.Contains(dep, ".") {
-								// External component dependency (package.component format)
-								// Mark that this component has local dependencies (for edge to package logic)
-								componentHasLocalDeps[componentName] = true
-
-								// Check if target component exists
-								if allExistingComponents[dep] {
-									// Component exists
-									edgeKey := fmt.Sprintf("%s->%s", componentName, dep)
-									if !existingEdges[edgeKey] {
-										graph[componentName] = append(graph[componentName], dep)
-										existingEdges[edgeKey] = true
-									}
-									allNodes[dep] = true
-								} else {
-									// Component doesn't exist - create missing component node
-									edgeKey := fmt.Sprintf("%s->%s", componentName, dep)
-									if !existingEdges[edgeKey] {
-										graph[componentName] = append(graph[componentName], dep)
-										existingEdges[edgeKey] = true
-									}
-									// Don't add to allNodes - will be shown as missing (red)
-
-									// Add edge from missing component to its package
-									parts := strings.SplitN(dep, ".", 2)
-									if len(parts) == 2 {
-										depPackageName := parts[0]
-										missingEdgeKey := fmt.Sprintf("%s->%s", dep, depPackageName)
-										if !existingEdges[missingEdgeKey] {
-											graph[dep] = append(graph[dep], depPackageName)
-											existingEdges[missingEdgeKey] = true
-										}
-										// Add package to allNodes only if it exists
-										if packageNames[depPackageName] {
-											allNodes[depPackageName] = true
-										}
-										// If package doesn't exist, it will be shown as missing (red)
-									}
-								}
-							} else {
-								// Local component dependency (same package)
-								// Mark that this component has local dependencies
-								componentHasLocalDeps[componentName] = true
-
-								localDep := fmt.Sprintf("%s.%s", psName, dep)
-
-								// Check if target component exists
-								if allExistingComponents[localDep] {
-									// Component exists
-									edgeKey := fmt.Sprintf("%s->%s", componentName, localDep)
-									if !existingEdges[edgeKey] {
-										graph[componentName] = append(graph[componentName], localDep)
-										existingEdges[edgeKey] = true
-									}
-									allNodes[localDep] = true
-								} else {
-									// Component doesn't exist - create missing component node
-									edgeKey := fmt.Sprintf("%s->%s", componentName, localDep)
-									if !existingEdges[edgeKey] {
-										graph[componentName] = append(graph[componentName], localDep)
-										existingEdges[edgeKey] = true
-									}
-									// Don't add to allNodes - will be shown as missing (red)
-
-									// Add edge from missing component to its package
-									missingEdgeKey := fmt.Sprintf("%s->%s", localDep, psName)
-									if !existingEdges[missingEdgeKey] {
-										graph[localDep] = append(graph[localDep], psName)
-										existingEdges[missingEdgeKey] = true
-									}
-								}
-							}
-						}
-					}
-				}
-			}
-		}
-
-		// Store variant information for package dependencies that are not in all variants
-		for dep, variants := range packageDepVariants {
-			if len(variants) < len(allVariantNames) {
-				var variantList []string
-				for v := range variants {
-					variantList = append(variantList, v)
-				}
-				edgeKey := fmt.Sprintf("%s->%s", psName, dep)
-				edgeVariants[edgeKey] = variantList
-			}
-		}
-
-		// Add component->package edges for components without local dependencies
-		if !packagesOnly {
-			for componentName := range componentVariants {
-				// Only add edge to package if component has no local component dependencies
-				if !componentHasLocalDeps[componentName] {
-					edgeKey := fmt.Sprintf("%s->%s", componentName, psName)
-					if !existingEdges[edgeKey] {
-						graph[componentName] = append(graph[componentName], psName)
-						existingEdges[edgeKey] = true
-					}
-					
-					// If component is not in all variants, store variant info for component->package edge
-					componentAllVariants := componentVariants[componentName]
-					if len(componentAllVariants) < len(allVariantNames) {
-						var variantList []string
-						for v := range componentAllVariants {
-							variantList = append(variantList, v)
-						}
-						edgeVariants[edgeKey] = variantList
-					}
-				}
-			}
-		}
-
-		// Store variant information for component dependencies that are not in all variants
-		for componentName, deps := range componentDepVariants {
-			componentAllVariants := componentVariants[componentName]
-			for dep, variants := range deps {
-				if len(variants) < len(componentAllVariants) {
-					var variantList []string
-					for v := range variants {
-						variantList = append(variantList, v)
-					}
-					// Determine the actual target name
-					var targetName string
-					if strings.Contains(dep, ".") {
-						targetName = dep
-					} else {
-						targetName = fmt.Sprintf("%s.%s", psName, dep)
-					}
-					edgeKey := fmt.Sprintf("%s->%s", componentName, targetName)
-					edgeVariants[edgeKey] = variantList
-				}
-			}
-		}
-	}
-
-	return graph, allNodes, edgeVariants, packageNames, nil
-}
-
-// generateDOTGraph generates a DOT graph from the dependency graph.
-func generateDOTGraph(graph map[string][]string, allNodes map[string]bool, packagesOnly bool, edgeVariants map[string][]string, packageNames map[string]bool) *dot.Graph {
-	g := dot.NewGraph(dot.Directed)
-	g.Attr("rankdir", "RL")
-	g.Attr("nodesep", "0.5")
-	g.Attr("ranksep", "1.0")
-
-	// Helper function to check if a node is a package
-	// A node is a package if:
-	// 1. It's directly in packageNames
-	// 2. It doesn't contain a dot (simple package name)
-	// 3. It contains a dot but the part before the first dot is a package name
-	isPackage := func(nodeName string) bool {
-		if packageNames[nodeName] {
-			return true
-		}
-		if !strings.Contains(nodeName, ".") {
-			return true
-		}
-		// If it contains a dot, check if the part before the first dot is a package
-		parts := strings.SplitN(nodeName, ".", 2)
-		if len(parts) > 0 {
-			return packageNames[parts[0]]
-		}
-		return false
-	}
-
-	// Add nodes
-	for node := range allNodes {
-		if packagesOnly && !isPackage(node) {
-			// Skip component nodes when packages-only is enabled
-			continue
-		}
-
-		n := g.Node(node)
-
-		// Style nodes based on type
-		if isPackage(node) {
-			// Package node
-			n.Attr("shape", "box")
-			n.Attr("style", "rounded,filled")
-			n.Attr("fillcolor", "lightblue")
-			n.Attr("label", node)
-		} else {
-			// Component node
-			n.Attr("shape", "box")
-			n.Attr("style", "rounded,filled")
-			n.Attr("fillcolor", "lightyellow")
-			// Extract component name (part after last dot)
-			parts := strings.Split(node, ".")
-			if len(parts) > 0 {
-				n.Attr("label", parts[len(parts)-1])
-			} else {
-				n.Attr("label", node)
-			}
-		}
-	}
-
-	// Add edges
-	for source, targets := range graph {
-		if packagesOnly && !isPackage(source) {
-			// Skip component edges when packages-only is enabled
-			continue
-		}
-
-		for _, target := range targets {
-			if packagesOnly && !isPackage(target) {
-				// Skip component edges when packages-only is enabled
-				continue
-			}
-
-			// Check if target exists
-			targetExists := allNodes[target]
-
-			// Determine edge type for coloring
-			sourceIsPackage := isPackage(source)
-			targetIsPackage := isPackage(target)
-
-			// Add edge
-			edge := g.Edge(g.Node(source), g.Node(target))
-
-			// Set edge color based on type (if target exists)
-			if targetExists {
-				if sourceIsPackage && targetIsPackage {
-					// Package -> Package: black (default)
-					edge.Attr("color", "black")
-				} else {
-					// Component -> Package or Component -> Component: green
-					edge.Attr("color", "green")
-				}
-			}
-
-			// If target doesn't exist, mark it as missing (red color)
-			if !targetExists {
-				edge.Attr("color", "red")
-				edge.Attr("style", "dashed")
-
-				// Also add the missing node with red color
-				missingNode := g.Node(target)
-				missingNode.Attr("shape", "box")
-				missingNode.Attr("style", "rounded,filled,dashed")
-				missingNode.Attr("fillcolor", "lightcoral")
-
-				// Determine label based on node type
-				if isPackage(target) {
-					// Package node
-					missingNode.Attr("label", target)
-				} else {
-					// Component node - extract component name
-					parts := strings.Split(target, ".")
-					if len(parts) > 0 {
-						missingNode.Attr("label", parts[len(parts)-1])
-					} else {
-						missingNode.Attr("label", target)
-					}
-				}
-			} else {
-				// Check if this edge has variant information (dependency not in all variants)
-				edgeKey := fmt.Sprintf("%s->%s", source, target)
-				if variants, hasVariants := edgeVariants[edgeKey]; hasVariants {
-					// Add label with variant names
-					edge.Attr("label", strings.Join(variants, ","))
-				}
-			}
-		}
-	}
-
-	return g
-}

cmd/cozypkg/cmd/list.go

@@ -1,220 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"strings"
-	"text/tabwriter"
-
-	"github.com/spf13/cobra"
-	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
-	"k8s.io/apimachinery/pkg/runtime"
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
-	"k8s.io/client-go/rest"
-	"k8s.io/client-go/tools/clientcmd"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	_ "k8s.io/client-go/plugin/pkg/client/auth"
-)
-
-var listCmdFlags struct {
-	installed   bool
-	components  bool
-	kubeconfig  string
-}
-
-var listCmd = &cobra.Command{
-	Use:   "list",
-	Short: "List PackageSource or Package resources",
-	Long: `List PackageSource or Package resources in table format.
-
-By default, lists PackageSource resources. Use --installed flag to list installed Package resources.
-Use --components flag to show components on separate lines.`,
-	Args: cobra.NoArgs,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		ctx := context.Background()
-
-		// Create Kubernetes client config
-		var config *rest.Config
-		var err error
-
-		if listCmdFlags.kubeconfig != "" {
-			config, err = clientcmd.BuildConfigFromFlags("", listCmdFlags.kubeconfig)
-			if err != nil {
-				return fmt.Errorf("failed to load kubeconfig from %s: %w", listCmdFlags.kubeconfig, err)
-			}
-		} else {
-			config, err = ctrl.GetConfig()
-			if err != nil {
-				return fmt.Errorf("failed to get kubeconfig: %w", err)
-			}
-		}
-
-		scheme := runtime.NewScheme()
-		utilruntime.Must(clientgoscheme.AddToScheme(scheme))
-		utilruntime.Must(cozyv1alpha1.AddToScheme(scheme))
-
-		k8sClient, err := client.New(config, client.Options{Scheme: scheme})
-		if err != nil {
-			return fmt.Errorf("failed to create k8s client: %w", err)
-		}
-
-		if listCmdFlags.installed {
-			return listPackages(ctx, k8sClient, listCmdFlags.components)
-		}
-		return listPackageSources(ctx, k8sClient, listCmdFlags.components)
-	},
-}
-
-func listPackageSources(ctx context.Context, k8sClient client.Client, showComponents bool) error {
-	var psList cozyv1alpha1.PackageSourceList
-	if err := k8sClient.List(ctx, &psList); err != nil {
-		return fmt.Errorf("failed to list PackageSources: %w", err)
-	}
-
-	// Use tabwriter for better column alignment
-	w := tabwriter.NewWriter(os.Stdout, 0, 0, 3, ' ', 0)
-	defer w.Flush()
-
-	// Print header
-	fmt.Fprintln(w, "NAME\tVARIANTS\tREADY\tSTATUS")
-
-	// Print rows
-	for _, ps := range psList.Items {
-		// Get variants
-		var variants []string
-		for _, variant := range ps.Spec.Variants {
-			variants = append(variants, variant.Name)
-		}
-		variantsStr := strings.Join(variants, ",")
-		if len(variantsStr) > 28 {
-			variantsStr = variantsStr[:25] + "..."
-		}
-
-		// Get Ready condition
-		ready := "Unknown"
-		status := ""
-		for _, condition := range ps.Status.Conditions {
-			if condition.Type == "Ready" {
-				ready = string(condition.Status)
-				status = condition.Message
-				if len(status) > 48 {
-					status = status[:45] + "..."
-				}
-				break
-			}
-		}
-
-		fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", ps.Name, variantsStr, ready, status)
-
-		// Show components if requested
-		if showComponents {
-			for _, variant := range ps.Spec.Variants {
-				for _, component := range variant.Components {
-					fmt.Fprintf(w, "  %s\t%s\t\t\n", 
-						fmt.Sprintf("%s.%s", ps.Name, component.Name), 
-						variant.Name)
-				}
-			}
-		}
-	}
-
-	return nil
-}
-
-func listPackages(ctx context.Context, k8sClient client.Client, showComponents bool) error {
-	var pkgList cozyv1alpha1.PackageList
-	if err := k8sClient.List(ctx, &pkgList); err != nil {
-		return fmt.Errorf("failed to list Packages: %w", err)
-	}
-
-	// Fetch all PackageSource resources once if components are requested
-	var psMap map[string]*cozyv1alpha1.PackageSource
-	if showComponents {
-		var psList cozyv1alpha1.PackageSourceList
-		if err := k8sClient.List(ctx, &psList); err != nil {
-			return fmt.Errorf("failed to list PackageSources: %w", err)
-		}
-		psMap = make(map[string]*cozyv1alpha1.PackageSource)
-		for i := range psList.Items {
-			psMap[psList.Items[i].Name] = &psList.Items[i]
-		}
-	}
-
-	// Use tabwriter for better column alignment
-	w := tabwriter.NewWriter(os.Stdout, 0, 0, 3, ' ', 0)
-	defer w.Flush()
-
-	// Print header
-	fmt.Fprintln(w, "NAME\tVARIANT\tREADY\tSTATUS")
-
-	// Print rows
-	for _, pkg := range pkgList.Items {
-		variant := pkg.Spec.Variant
-		if variant == "" {
-			variant = "default"
-		}
-
-		// Get Ready condition
-		ready := "Unknown"
-		status := ""
-		for _, condition := range pkg.Status.Conditions {
-			if condition.Type == "Ready" {
-				ready = string(condition.Status)
-				status = condition.Message
-				if len(status) > 48 {
-					status = status[:45] + "..."
-				}
-				break
-			}
-		}
-
-		fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", pkg.Name, variant, ready, status)
-
-		// Show components if requested
-		if showComponents {
-			// Look up PackageSource from map instead of making API call
-			if ps, exists := psMap[pkg.Name]; exists {
-				// Find the variant
-				for _, v := range ps.Spec.Variants {
-					if v.Name == variant {
-						for _, component := range v.Components {
-							fmt.Fprintf(w, "  %s\t%s\t\t\n", 
-								fmt.Sprintf("%s.%s", pkg.Name, component.Name), 
-								variant)
-						}
-						break
-					}
-				}
-			}
-		}
-	}
-
-	return nil
-}
-
-func init() {
-	rootCmd.AddCommand(listCmd)
-	listCmd.Flags().BoolVarP(&listCmdFlags.installed, "installed", "i", false, "list installed Package resources instead of PackageSource resources")
-	listCmd.Flags().BoolVar(&listCmdFlags.components, "components", false, "show components on separate lines")
-	listCmd.Flags().StringVar(&listCmdFlags.kubeconfig, "kubeconfig", "", "Path to kubeconfig file (defaults to ~/.kube/config or KUBECONFIG env var)")
-}
-

cmd/cozypkg/cmd/root.go

@@ -1,49 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package cmd
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/spf13/cobra"
-)
-
-// rootCmd represents the base command when called without any subcommands.
-var rootCmd = &cobra.Command{
-	Use:               "cozypkg",
-	Short:             "A CLI for managing Cozystack packages",
-	Long:              ``,
-	SilenceErrors:     true,
-	SilenceUsage:      true,
-	DisableAutoGenTag: true,
-}
-
-// Execute adds all child commands to the root command and sets flags appropriately.
-// This is called by main.main(). It only needs to happen once to the rootCmd.
-func Execute() error {
-	if err := rootCmd.Execute(); err != nil {
-		fmt.Fprintln(os.Stderr, err.Error())
-		return err
-	}
-	return nil
-}
-
-func init() {
-	// Commands are registered in their respective init() functions
-}
-

cmd/cozypkg/main.go

@@ -1,30 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"os"
-
-	"github.com/cozystack/cozystack/cmd/cozypkg/cmd"
-)
-
-func main() {
-	if err := cmd.Execute(); err != nil {
-		os.Exit(1)
-	}
-}
-

cmd/cozystack-assets-server/main.go

@@ -1,29 +0,0 @@
-package main
-
-import (
-	"flag"
-	"log"
-	"net/http"
-	"path/filepath"
-)
-
-func main() {
-	addr := flag.String("address", ":8123", "Address to listen on")
-	dir := flag.String("dir", "/cozystack/assets", "Directory to serve files from")
-	flag.Parse()
-
-	absDir, err := filepath.Abs(*dir)
-	if err != nil {
-		log.Fatalf("Error getting absolute path for %s: %v", *dir, err)
-	}
-
-	fs := http.FileServer(http.Dir(absDir))
-	http.Handle("/", fs)
-
-	log.Printf("Server starting on %s, serving directory %s", *addr, absDir)
-
-	err = http.ListenAndServe(*addr, nil)
-	if err != nil {
-		log.Fatalf("Server failed to start: %v", err)
-	}
-}

cmd/cozystack-controller/main.go

@@ -20,7 +20,6 @@ import (
 	"crypto/tls"
 	"flag"
 	"os"
-	"time"
 
 	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
 	// to ensure that exec-entrypoint and run can make use of them.
@@ -39,7 +38,6 @@ import (
 	cozystackiov1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
 	"github.com/cozystack/cozystack/internal/controller"
 	"github.com/cozystack/cozystack/internal/controller/dashboard"
-	"github.com/cozystack/cozystack/internal/telemetry"
 
 	helmv2 "github.com/fluxcd/helm-controller/api/v2"
 	// +kubebuilder:scaffold:imports
@@ -65,10 +63,6 @@ func main() {
 	var probeAddr string
 	var secureMetrics bool
 	var enableHTTP2 bool
-	var disableTelemetry bool
-	var telemetryEndpoint string
-	var telemetryInterval string
-	var cozystackVersion string
 	var reconcileDeployment bool
 	var tlsOpts []func(*tls.Config)
 	flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+
@@ -81,14 +75,6 @@ func main() {
 		"If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.")
 	flag.BoolVar(&enableHTTP2, "enable-http2", false,
 		"If set, HTTP/2 will be enabled for the metrics and webhook servers")
-	flag.BoolVar(&disableTelemetry, "disable-telemetry", false,
-		"Disable telemetry collection")
-	flag.StringVar(&telemetryEndpoint, "telemetry-endpoint", "https://telemetry.cozystack.io",
-		"Endpoint for sending telemetry data")
-	flag.StringVar(&telemetryInterval, "telemetry-interval", "15m",
-		"Interval between telemetry data collection (e.g. 15m, 1h)")
-	flag.StringVar(&cozystackVersion, "cozystack-version", "unknown",
-		"Version of Cozystack")
 	flag.BoolVar(&reconcileDeployment, "reconcile-deployment", false,
 		"If set, the Cozystack API server is assumed to run as a Deployment, else as a DaemonSet.")
 	opts := zap.Options{
@@ -97,21 +83,6 @@ func main() {
 	opts.BindFlags(flag.CommandLine)
 	flag.Parse()
 
-	// Parse telemetry interval
-	interval, err := time.ParseDuration(telemetryInterval)
-	if err != nil {
-		setupLog.Error(err, "invalid telemetry interval")
-		os.Exit(1)
-	}
-
-	// Configure telemetry
-	telemetryConfig := telemetry.Config{
-		Disabled:         disableTelemetry,
-		Endpoint:         telemetryEndpoint,
-		Interval:         interval,
-		CozystackVersion: cozystackVersion,
-	}
-
 	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
 
 	// if the enable-http2 flag is false (the default), http/2 should be disabled
@@ -200,40 +171,20 @@ func main() {
 		os.Exit(1)
 	}
 
-	if err = (&controller.TenantHelmReconciler{
+	if err = (&controller.NamespaceHelmReconciler{
 		Client: mgr.GetClient(),
 		Scheme: mgr.GetScheme(),
 	}).SetupWithManager(mgr); err != nil {
-		setupLog.Error(err, "unable to create controller", "controller", "TenantHelmReconciler")
+		setupLog.Error(err, "unable to create controller", "controller", "NamespaceHelmReconciler")
 		os.Exit(1)
 	}
 
-	if err = (&controller.CozystackConfigReconciler{
+	if err = (&controller.ApplicationDefinitionReconciler{
 		Client: mgr.GetClient(),
 		Scheme: mgr.GetScheme(),
+		CozystackAPIKind: "Deployment",
 	}).SetupWithManager(mgr); err != nil {
-		setupLog.Error(err, "unable to create controller", "controller", "CozystackConfigReconciler")
-		os.Exit(1)
-	}
-
-	cozyAPIKind := "DaemonSet"
-	if reconcileDeployment {
-		cozyAPIKind = "Deployment"
-	}
-	if err = (&controller.CozystackResourceDefinitionReconciler{
-		Client:           mgr.GetClient(),
-		Scheme:           mgr.GetScheme(),
-		CozystackAPIKind: cozyAPIKind,
-	}).SetupWithManager(mgr); err != nil {
-		setupLog.Error(err, "unable to create controller", "controller", "CozystackResourceDefinitionReconciler")
-		os.Exit(1)
-	}
-
-	if err = (&controller.CozystackResourceDefinitionHelmReconciler{
-		Client: mgr.GetClient(),
-		Scheme: mgr.GetScheme(),
-	}).SetupWithManager(mgr); err != nil {
-		setupLog.Error(err, "unable to create controller", "controller", "CozystackResourceDefinitionHelmReconciler")
+		setupLog.Error(err, "unable to create controller", "controller", "ApplicationDefinitionReconciler")
 		os.Exit(1)
 	}
 
@@ -257,19 +208,6 @@ func main() {
 		os.Exit(1)
 	}
 
-	// Initialize telemetry collector
-	collector, err := telemetry.NewCollector(mgr.GetClient(), &telemetryConfig, mgr.GetConfig())
-	if err != nil {
-		setupLog.V(1).Error(err, "unable to create telemetry collector, telemetry will be disabled")
-	}
-
-	if collector != nil {
-		if err := mgr.Add(collector); err != nil {
-			setupLog.Error(err, "unable to set up telemetry collector")
-			setupLog.V(1).Error(err, "unable to set up telemetry collector, continuing without telemetry")
-		}
-	}
-
 	setupLog.Info("starting manager")
 	ctx := ctrl.SetupSignalHandler()
 	dashboardManager.InitializeStaticResources(ctx)

cmd/cozystack-operator/main.go

@@ -18,6 +18,7 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"flag"
 	"fmt"
 	"os"
@@ -33,7 +34,7 @@ import (
 	sourcev1 "github.com/fluxcd/source-controller/api/v1"
 	sourcewatcherv1beta1 "github.com/fluxcd/source-watcher/api/v2/v1beta1"
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
@@ -47,6 +48,7 @@ import (
 
 	"github.com/cozystack/cozystack/internal/fluxinstall"
 	"github.com/cozystack/cozystack/internal/operator"
+	"github.com/cozystack/cozystack/internal/telemetry"
 	// +kubebuilder:scaffold:imports
 )
 
@@ -55,6 +57,18 @@ var (
 	setupLog = ctrl.Log.WithName("setup")
 )
 
+// stringSliceFlag is a custom flag type that allows multiple values
+type stringSliceFlag []string
+
+func (f *stringSliceFlag) String() string {
+	return strings.Join(*f, ",")
+}
+
+func (f *stringSliceFlag) Set(value string) error {
+	*f = append(*f, value)
+	return nil
+}
+
 func init() {
 	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
 	utilruntime.Must(apiextensionsv1.AddToScheme(scheme))
@@ -72,10 +86,11 @@ func main() {
 	var secureMetrics bool
 	var enableHTTP2 bool
 	var installFlux bool
+	var disableTelemetry bool
+	var telemetryEndpoint string
+	var telemetryInterval string
 	var cozystackVersion string
-	var platformSourceURL string
-	var platformSourceName string
-	var platformSourceRef string
+	var installFluxResources stringSliceFlag
 
 	flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
 	flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
@@ -87,11 +102,15 @@ func main() {
 	flag.BoolVar(&enableHTTP2, "enable-http2", false,
 		"If set, HTTP/2 will be enabled for the metrics and webhook servers")
 	flag.BoolVar(&installFlux, "install-flux", false, "Install Flux components before starting reconcile loop")
+	flag.Var(&installFluxResources, "install-flux-resource", "Install Flux resource (JSON format). Can be specified multiple times. Applied after Flux installation.")
+	flag.BoolVar(&disableTelemetry, "disable-telemetry", false,
+		"Disable telemetry collection")
+	flag.StringVar(&telemetryEndpoint, "telemetry-endpoint", "https://telemetry.cozystack.io",
+		"Endpoint for sending telemetry data")
+	flag.StringVar(&telemetryInterval, "telemetry-interval", "15m",
+		"Interval between telemetry data collection (e.g. 15m, 1h)")
 	flag.StringVar(&cozystackVersion, "cozystack-version", "unknown",
 		"Version of Cozystack")
-	flag.StringVar(&platformSourceURL, "platform-source-url", "", "Platform source URL (oci:// or https://). If specified, generates OCIRepository or GitRepository resource.")
-	flag.StringVar(&platformSourceName, "platform-source-name", "cozystack-packages", "Name for the generated platform source resource (default: cozystack-packages)")
-	flag.StringVar(&platformSourceRef, "platform-source-ref", "", "Reference specification as key=value pairs (e.g., 'branch=main' or 'digest=sha256:...,tag=v1.0'). For OCI: digest, semver, semverFilter, tag. For Git: branch, tag, semver, name, commit.")
 
 	opts := zap.Options{
 		Development: true,
@@ -99,17 +118,25 @@ func main() {
 	opts.BindFlags(flag.CommandLine)
 	flag.Parse()
 
+	// Parse telemetry interval
+	interval, err := time.ParseDuration(telemetryInterval)
+	if err != nil {
+		setupLog.Error(err, "invalid telemetry interval")
+		os.Exit(1)
+	}
+
+	// Configure telemetry
+	telemetryConfig := telemetry.Config{
+		Disabled:         disableTelemetry,
+		Endpoint:         telemetryEndpoint,
+		Interval:         interval,
+		CozystackVersion: cozystackVersion,
+	}
+
 	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
 
 	config := ctrl.GetConfigOrDie()
 
-	// Create a direct client (without cache) for pre-start operations
-	directClient, err := client.New(config, client.Options{Scheme: scheme})
-	if err != nil {
-		setupLog.Error(err, "unable to create direct client")
-		os.Exit(1)
-	}
-
 	// Start the controller manager
 	setupLog.Info("Starting controller manager")
 	mgr, err := ctrl.NewManager(config, ctrl.Options{
@@ -123,7 +150,7 @@ func main() {
 		}),
 		HealthProbeBindAddress: probeAddr,
 		LeaderElection:         enableLeaderElection,
-		LeaderElectionID:       "cozystack-operator.cozystack.io",
+		LeaderElectionID:       "platform-operator.cozystack.io",
 		// LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily
 		// when the Manager ends. This requires the binary to immediately end when the
 		// Manager is stopped, otherwise, setting this significantly speeds up voluntary
@@ -146,44 +173,45 @@ func main() {
 		installCtx, installCancel := context.WithTimeout(context.Background(), 5*time.Minute)
 		defer installCancel()
 
-		// Use direct client for pre-start operations (cache is not ready yet)
-		if err := fluxinstall.Install(installCtx, directClient, fluxinstall.WriteEmbeddedManifests); err != nil {
-			setupLog.Error(err, "failed to install Flux")
-			os.Exit(1)
+		// The namespace will be automatically extracted from the embedded manifests
+		if err := fluxinstall.Install(installCtx, mgr.GetClient(), fluxinstall.WriteEmbeddedManifests); err != nil {
+			setupLog.Error(err, "failed to install Flux, continuing anyway")
+			// Don't exit - allow operator to start even if Flux install fails
+			// This allows the operator to work in environments where Flux is already installed
+		} else {
+			setupLog.Info("Flux installation completed successfully")
 		}
-		setupLog.Info("Flux installation completed successfully")
 	}
 
-	// Generate and install platform source resource if specified
-	if platformSourceURL != "" {
-		setupLog.Info("Generating platform source resource", "url", platformSourceURL, "name", platformSourceName, "ref", platformSourceRef)
+	// Install Flux resources after Flux installation
+	if len(installFluxResources) > 0 {
+		setupLog.Info("Installing Flux resources", "count", len(installFluxResources))
 		installCtx, installCancel := context.WithTimeout(context.Background(), 2*time.Minute)
 		defer installCancel()
 
-		// Use direct client for pre-start operations (cache is not ready yet)
-		if err := installPlatformSourceResource(installCtx, directClient, platformSourceURL, platformSourceName, platformSourceRef); err != nil {
-			setupLog.Error(err, "failed to install platform source resource")
-			os.Exit(1)
+		if err := installFluxResourcesFunc(installCtx, mgr.GetClient(), installFluxResources); err != nil {
+			setupLog.Error(err, "failed to install Flux resources, continuing anyway")
+			// Don't exit - allow operator to start even if resource installation fails
 		} else {
-			setupLog.Info("Platform source resource installation completed successfully")
+			setupLog.Info("Flux resources installation completed successfully")
 		}
 	}
 
-	// Setup PackageSource reconciler
-	if err := (&operator.PackageSourceReconciler{
+	bundleReconciler := &operator.BundleReconciler{
 		Client: mgr.GetClient(),
 		Scheme: mgr.GetScheme(),
-	}).SetupWithManager(mgr); err != nil {
-		setupLog.Error(err, "unable to create controller", "controller", "PackageSource")
+	}
+	if err = bundleReconciler.SetupWithManager(mgr); err != nil {
+		setupLog.Error(err, "unable to create controller", "controller", "Bundle")
 		os.Exit(1)
 	}
 
-	// Setup Package reconciler
-	if err := (&operator.PackageReconciler{
+	platformReconciler := &operator.PlatformReconciler{
 		Client: mgr.GetClient(),
 		Scheme: mgr.GetScheme(),
-	}).SetupWithManager(mgr); err != nil {
-		setupLog.Error(err, "unable to create controller", "controller", "Package")
+	}
+	if err = platformReconciler.SetupWithManager(mgr); err != nil {
+		setupLog.Error(err, "unable to create controller", "controller", "Platform")
 		os.Exit(1)
 	}
 
@@ -198,6 +226,19 @@ func main() {
 		os.Exit(1)
 	}
 
+	// Initialize telemetry collector
+	collector, err := telemetry.NewCollector(mgr.GetClient(), &telemetryConfig, mgr.GetConfig())
+	if err != nil {
+		setupLog.V(1).Error(err, "unable to create telemetry collector, telemetry will be disabled")
+	}
+
+	if collector != nil {
+		if err := mgr.Add(collector); err != nil {
+			setupLog.Error(err, "unable to set up telemetry collector")
+			setupLog.V(1).Error(err, "unable to set up telemetry collector, continuing without telemetry")
+		}
+	}
+
 	setupLog.Info("Starting controller manager")
 	mgrCtx := ctrl.SetupSignalHandler()
 	if err := mgr.Start(mgrCtx); err != nil {
@@ -206,255 +247,66 @@ func main() {
 	}
 }
 
-// installPlatformSourceResource generates and installs a Flux source resource (OCIRepository or GitRepository)
-// based on the platform source URL
-func installPlatformSourceResource(ctx context.Context, k8sClient client.Client, sourceURL, resourceName, refSpec string) error {
+// installFluxResourcesFunc installs Flux resources from JSON strings
+func installFluxResourcesFunc(ctx context.Context, k8sClient client.Client, resources []string) error {
 	logger := log.FromContext(ctx)
 
-	// Parse the source URL to determine type
-	sourceType, repoURL, err := parsePlatformSourceURL(sourceURL)
-	if err != nil {
-		return fmt.Errorf("failed to parse platform source URL: %w", err)
-	}
+	for i, resourceJSON := range resources {
+		logger.Info("Installing Flux resource", "index", i+1, "total", len(resources))
 
-	// Parse reference specification
-	refMap, err := parseRefSpec(refSpec)
-	if err != nil {
-		return fmt.Errorf("failed to parse reference specification: %w", err)
-	}
-
-	var obj client.Object
-	switch sourceType {
-	case "oci":
-		obj, err = generateOCIRepository(resourceName, repoURL, refMap)
-		if err != nil {
-			return fmt.Errorf("failed to generate OCIRepository: %w", err)
+		// Parse JSON into unstructured object
+		var obj unstructured.Unstructured
+		if err := json.Unmarshal([]byte(resourceJSON), &obj.Object); err != nil {
+			return fmt.Errorf("failed to parse resource JSON at index %d: %w", i, err)
 		}
-	case "git":
-		obj, err = generateGitRepository(resourceName, repoURL, refMap)
-		if err != nil {
-			return fmt.Errorf("failed to generate GitRepository: %w", err)
+
+		// Validate that it has required fields
+		if obj.GetAPIVersion() == "" {
+			return fmt.Errorf("resource at index %d missing apiVersion", i)
+		}
+		if obj.GetKind() == "" {
+			return fmt.Errorf("resource at index %d missing kind", i)
+		}
+		if obj.GetName() == "" {
+			return fmt.Errorf("resource at index %d missing metadata.name", i)
 		}
-	default:
-		return fmt.Errorf("unsupported source type: %s (expected oci:// or https://)", sourceType)
-	}
 
-	// Apply the resource (create or update)
-	logger.Info("Applying platform source resource",
-		"apiVersion", obj.GetObjectKind().GroupVersionKind().GroupVersion().String(),
-		"kind", obj.GetObjectKind().GroupVersionKind().Kind,
-		"name", obj.GetName(),
-		"namespace", obj.GetNamespace(),
-	)
+		// Apply the resource (create or update)
+		logger.Info("Applying Flux resource",
+			"apiVersion", obj.GetAPIVersion(),
+			"kind", obj.GetKind(),
+			"name", obj.GetName(),
+			"namespace", obj.GetNamespace(),
+		)
 
-	existing := obj.DeepCopyObject().(client.Object)
-	key := client.ObjectKeyFromObject(obj)
+		// Use server-side apply or create/update
+		existing := &unstructured.Unstructured{}
+		existing.SetGroupVersionKind(obj.GroupVersionKind())
+		key := client.ObjectKey{
+			Name:      obj.GetName(),
+			Namespace: obj.GetNamespace(),
+		}
 
-	err = k8sClient.Get(ctx, key, existing)
-	if err != nil {
-		if client.IgnoreNotFound(err) == nil {
-			// Resource doesn't exist, create it
-			if err := k8sClient.Create(ctx, obj); err != nil {
-				return fmt.Errorf("failed to create resource %s/%s: %w", obj.GetObjectKind().GroupVersionKind().Kind, obj.GetName(), err)
+		err := k8sClient.Get(ctx, key, existing)
+		if err != nil {
+			if client.IgnoreNotFound(err) == nil {
+				// Resource doesn't exist, create it
+				if err := k8sClient.Create(ctx, &obj); err != nil {
+					return fmt.Errorf("failed to create resource %s/%s: %w", obj.GetKind(), obj.GetName(), err)
+				}
+				logger.Info("Created Flux resource", "kind", obj.GetKind(), "name", obj.GetName())
+			} else {
+				return fmt.Errorf("failed to check if resource exists: %w", err)
 			}
-			logger.Info("Created platform source resource", "kind", obj.GetObjectKind().GroupVersionKind().Kind, "name", obj.GetName())
 		} else {
-			return fmt.Errorf("failed to check if resource exists: %w", err)
-		}
-	} else {
-		// Resource exists, update it
-		obj.SetResourceVersion(existing.GetResourceVersion())
-		if err := k8sClient.Update(ctx, obj); err != nil {
-			return fmt.Errorf("failed to update resource %s/%s: %w", obj.GetObjectKind().GroupVersionKind().Kind, obj.GetName(), err)
-		}
-		logger.Info("Updated platform source resource", "kind", obj.GetObjectKind().GroupVersionKind().Kind, "name", obj.GetName())
-	}
-
-	return nil
-}
-
-// parsePlatformSourceURL parses the source URL and returns the source type and repository URL.
-// Supports formats:
-//   - oci://registry.example.com/repo
-//   - https://github.com/user/repo
-//   - http://github.com/user/repo
-//   - ssh://git@github.com/user/repo
-func parsePlatformSourceURL(sourceURL string) (sourceType, repoURL string, err error) {
-	sourceURL = strings.TrimSpace(sourceURL)
-
-	if strings.HasPrefix(sourceURL, "oci://") {
-		return "oci", sourceURL, nil
-	}
-
-	if strings.HasPrefix(sourceURL, "https://") || strings.HasPrefix(sourceURL, "http://") || strings.HasPrefix(sourceURL, "ssh://") {
-		return "git", sourceURL, nil
-	}
-
-	return "", "", fmt.Errorf("unsupported source URL scheme (expected oci://, https://, http://, or ssh://): %s", sourceURL)
-}
-
-// parseRefSpec parses a reference specification string in the format "key1=value1,key2=value2".
-// Returns a map of key-value pairs.
-func parseRefSpec(refSpec string) (map[string]string, error) {
-	result := make(map[string]string)
-
-	refSpec = strings.TrimSpace(refSpec)
-	if refSpec == "" {
-		return result, nil
-	}
-
-	pairs := strings.Split(refSpec, ",")
-	for _, pair := range pairs {
-		pair = strings.TrimSpace(pair)
-		if pair == "" {
-			continue
-		}
-
-		// Split on first '=' only to allow '=' in values (e.g., digest=sha256:...)
-		idx := strings.Index(pair, "=")
-		if idx == -1 {
-			return nil, fmt.Errorf("invalid reference specification format: %q (expected key=value)", pair)
-		}
-
-		key := strings.TrimSpace(pair[:idx])
-		value := strings.TrimSpace(pair[idx+1:])
-
-		if key == "" {
-			return nil, fmt.Errorf("empty key in reference specification: %q", pair)
-		}
-		if value == "" {
-			return nil, fmt.Errorf("empty value for key %q in reference specification", key)
-		}
-
-		result[key] = value
-	}
-
-	return result, nil
-}
-
-// Valid reference keys for OCI repositories
-var validOCIRefKeys = map[string]bool{
-	"digest":       true,
-	"semver":       true,
-	"semverFilter": true,
-	"tag":          true,
-}
-
-// Valid reference keys for Git repositories
-var validGitRefKeys = map[string]bool{
-	"branch": true,
-	"tag":    true,
-	"semver": true,
-	"name":   true,
-	"commit": true,
-}
-
-// validateOCIRef validates reference keys for OCI repositories
-func validateOCIRef(refMap map[string]string) error {
-	for key := range refMap {
-		if !validOCIRefKeys[key] {
-			return fmt.Errorf("invalid OCI reference key %q (valid keys: digest, semver, semverFilter, tag)", key)
-		}
-	}
-
-	// Validate digest format if provided
-	if digest, ok := refMap["digest"]; ok {
-		if !strings.HasPrefix(digest, "sha256:") {
-			return fmt.Errorf("digest must be in format 'sha256:<hash>', got: %s", digest)
-		}
-	}
-
-	return nil
-}
-
-// validateGitRef validates reference keys for Git repositories
-func validateGitRef(refMap map[string]string) error {
-	for key := range refMap {
-		if !validGitRefKeys[key] {
-			return fmt.Errorf("invalid Git reference key %q (valid keys: branch, tag, semver, name, commit)", key)
-		}
-	}
-
-	// Validate commit format if provided (should be a hex string)
-	if commit, ok := refMap["commit"]; ok {
-		if len(commit) < 7 {
-			return fmt.Errorf("commit SHA should be at least 7 characters, got: %s", commit)
-		}
-		for _, c := range commit {
-			if !((c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F')) {
-				return fmt.Errorf("commit SHA should be a hexadecimal string, got: %s", commit)
+			// Resource exists, update it
+			obj.SetResourceVersion(existing.GetResourceVersion())
+			if err := k8sClient.Update(ctx, &obj); err != nil {
+				return fmt.Errorf("failed to update resource %s/%s: %w", obj.GetKind(), obj.GetName(), err)
 			}
+			logger.Info("Updated Flux resource", "kind", obj.GetKind(), "name", obj.GetName())
 		}
 	}
 
 	return nil
 }
-
-// generateOCIRepository creates an OCIRepository resource
-func generateOCIRepository(name, repoURL string, refMap map[string]string) (*sourcev1.OCIRepository, error) {
-	if err := validateOCIRef(refMap); err != nil {
-		return nil, err
-	}
-
-	obj := &sourcev1.OCIRepository{
-		TypeMeta: metav1.TypeMeta{
-			APIVersion: sourcev1.GroupVersion.String(),
-			Kind:       sourcev1.OCIRepositoryKind,
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      name,
-			Namespace: "cozy-system",
-		},
-		Spec: sourcev1.OCIRepositorySpec{
-			URL:      repoURL,
-			Interval: metav1.Duration{Duration: 5 * time.Minute},
-		},
-	}
-
-	// Set reference if any ref options are provided
-	if len(refMap) > 0 {
-		obj.Spec.Reference = &sourcev1.OCIRepositoryRef{
-			Digest:       refMap["digest"],
-			SemVer:       refMap["semver"],
-			SemverFilter: refMap["semverFilter"],
-			Tag:          refMap["tag"],
-		}
-	}
-
-	return obj, nil
-}
-
-// generateGitRepository creates a GitRepository resource
-func generateGitRepository(name, repoURL string, refMap map[string]string) (*sourcev1.GitRepository, error) {
-	if err := validateGitRef(refMap); err != nil {
-		return nil, err
-	}
-
-	obj := &sourcev1.GitRepository{
-		TypeMeta: metav1.TypeMeta{
-			APIVersion: sourcev1.GroupVersion.String(),
-			Kind:       sourcev1.GitRepositoryKind,
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      name,
-			Namespace: "cozy-system",
-		},
-		Spec: sourcev1.GitRepositorySpec{
-			URL:      repoURL,
-			Interval: metav1.Duration{Duration: 5 * time.Minute},
-		},
-	}
-
-	// Set reference if any ref options are provided
-	if len(refMap) > 0 {
-		obj.Spec.Reference = &sourcev1.GitRepositoryRef{
-			Branch: refMap["branch"],
-			Tag:    refMap["tag"],
-			SemVer: refMap["semver"],
-			Name:   refMap["name"],
-			Commit: refMap["commit"],
-		}
-	}
-
-	return obj, nil
-}

docs/agents/changelog.md

@@ -22,7 +22,7 @@ When the user asks to generate a changelog, follow these steps in the specified
 - [ ] Step 5: Get the list of commits for the release period
 - [ ] Step 6: Check additional repositories (website is REQUIRED, optional repos if tags exist)
   - [ ] **MANDATORY**: Check website repository for documentation changes WITH authors and PR links via GitHub CLI
-  - [ ] **MANDATORY**: Check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy) for tags during release period
+  - [ ] **MANDATORY**: Check ALL optional repositories (talm, boot-to-talos, cozypkg, cozy-proxy) for tags during release period
   - [ ] **MANDATORY**: For ALL commits from additional repos, get GitHub username via CLI, prioritizing PR author over commit author.
 - [ ] Step 7: Analyze commits (extract PR numbers, authors, user impact)
   - [ ] **MANDATORY**: For EVERY PR in main repo, get PR author via `gh pr view <PR_NUMBER> --json author --jq .author.login` (do NOT skip this step)
@@ -146,7 +146,7 @@ Cozystack release may include changes from related repositories. Check and inclu
 **Optional repositories (MUST check ALL of them for tags during release period):**
 - [https://github.com/cozystack/talm](https://github.com/cozystack/talm)
 - [https://github.com/cozystack/boot-to-talos](https://github.com/cozystack/boot-to-talos)
-- [https://github.com/cozystack/cozyhr](https://github.com/cozystack/cozyhr)
+- [https://github.com/cozystack/cozypkg](https://github.com/cozystack/cozypkg)
 - [https://github.com/cozystack/cozy-proxy](https://github.com/cozystack/cozy-proxy)
 
 **⚠️ IMPORTANT**: You MUST check ALL optional repositories for tags created during the release period. Do NOT skip this step even if you think there might not be any tags. Use the process below to verify.
@@ -195,7 +195,7 @@ Cozystack release may include changes from related repositories. Check and inclu
 
 3. **For optional repositories, check if tags exist during release period:**
 
-   **⚠️ MANDATORY: You MUST check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy). Do NOT skip any repository!**
+   **⚠️ MANDATORY: You MUST check ALL optional repositories (talm, boot-to-talos, cozypkg, cozy-proxy). Do NOT skip any repository!**
 
    **Use the helper script:**
    ```bash
@@ -208,7 +208,7 @@ Cozystack release may include changes from related repositories. Check and inclu
    ```
    
    The script will:
-   - Check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy)
+   - Check ALL optional repositories (talm, boot-to-talos, cozypkg, cozy-proxy)
    - Look for tags created during the release period
    - Get commits between tags (if tags exist) or by date range (if no tags)
    - Extract PR numbers from commit messages
@@ -569,7 +569,7 @@ Create a new changelog file in the format matching previous versions:
 - [ ] Step 5 completed: **ALL commits included** (including merge commits and backports) - do not skip any commits
 - [ ] Step 5 completed: **Backports identified and handled correctly** - original PR author used, both original and backport PR numbers included
 - [ ] Step 6 completed: Website repository checked for documentation changes WITH authors and PR links via GitHub CLI
-- [ ] Step 6 completed: **ALL** optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy) checked for tags during release period
+- [ ] Step 6 completed: **ALL** optional repositories (talm, boot-to-talos, cozypkg, cozy-proxy) checked for tags during release period
 - [ ] Step 6 completed: For ALL commits from additional repos, GitHub username obtained via GitHub CLI (not skipped). For commits with PR numbers, PR author used via `gh pr view` (not commit author)
 - [ ] Step 7 completed: For EVERY PR in main repo (including backports), PR author obtained via `gh pr view <PR_NUMBER> --json author --jq .author.login` (not skipped or assumed). Commit author NOT used - always use PR author
 - [ ] Step 7 completed: **Backports verified** - for each backport PR, original PR found and original PR author used in changelog
@@ -628,7 +628,7 @@ Save the changelog to file `docs/changelogs/v<version>.md` according to the vers
 
 - **Additional repositories (Step 6) - MANDATORY**: 
   - **⚠️ CRITICAL**: Always check the **website** repository for documentation changes during the release period. This is a required step and MUST NOT be skipped.
-  - **⚠️ CRITICAL**: You MUST check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy) for tags during the release period. Do NOT skip any repository even if you think there might not be tags.
+  - **⚠️ CRITICAL**: You MUST check ALL optional repositories (talm, boot-to-talos, cozypkg, cozy-proxy) for tags during the release period. Do NOT skip any repository even if you think there might not be tags.
   - **CRITICAL**: For ALL entries from additional repositories (website and optional), you MUST:
     - **MANDATORY**: Extract PR number from commit message first
     - **MANDATORY**: For commits with PR numbers, ALWAYS use `gh pr view <PR_NUMBER> --repo cozystack/<repo> --json author --jq .author.login` to get PR author (not commit author)
@@ -637,7 +637,7 @@ Save the changelog to file `docs/changelogs/v<version>.md` according to the vers
     - **MANDATORY**: Do NOT use commit author for PRs - always use PR author
     - Include PR link or commit hash reference
     - Format: `* **[repo] Description**: details ([**@username**](https://github.com/username) in cozystack/repo#123)`
-  - For **optional repositories** (talm, boot-to-talos, cozyhr, cozy-proxy), you MUST check ALL of them for tags during the release period. Use the loop provided in Step 6 to check each repository systematically.
+  - For **optional repositories** (talm, boot-to-talos, cozypkg, cozy-proxy), you MUST check ALL of them for tags during the release period. Use the loop provided in Step 6 to check each repository systematically.
   - When including changes from additional repositories, use the format: `[repo-name] Description` and link to the repository's PR/issue if available
   - **Prefer PR numbers over commit hashes**: For commits from additional repositories, extract PR number from commit message using GitHub API. Use PR format (`cozystack/website#123`) instead of commit hash (`cozystack/website@abc1234`) when available
   - **Never add entries without author and PR/commit reference**: Every entry from additional repositories must have both author and link

docs/agents/contributing.md

@@ -155,91 +155,6 @@ git diff
 
 The user will commit and push when ready.
 
-## Code Review Comments
-
-When asked to fix code review comments, **always work only with unresolved (open) comments**. Resolved comments should be ignored as they have already been addressed.
-
-### Getting Unresolved Review Comments
-
-Use GitHub GraphQL API to fetch only unresolved review comments from a pull request:
-
-```bash
-gh api graphql -F owner=cozystack -F repo=cozystack -F pr=<PR_NUMBER> -f query='
-query($owner: String!, $repo: String!, $pr: Int!) {
-  repository(owner: $owner, name: $repo) {
-    pullRequest(number: $pr) {
-      reviewThreads(first: 100) {
-        nodes {
-          isResolved
-          comments(first: 100) {
-            nodes {
-              id
-              path
-              line
-              author { login }
-              bodyText
-              url
-              createdAt
-            }
-          }
-        }
-      }
-    }
-  }
-}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | .comments.nodes[]'
-```
-
-### Filtering for Unresolved Comments
-
-The key filter is `select(.isResolved == false)` which ensures only unresolved review threads are processed. Each thread can contain multiple comments, but if the thread is resolved, all its comments should be ignored.
-
-### Working with Review Comments
-
-1. **Fetch unresolved comments** using the GraphQL query above
-2. **Parse the results** to identify:
-   - File path (`path`)
-   - Line number (`line` or `originalLine`)
-   - Comment text (`bodyText`)
-   - Author (`author.login`)
-3. **Address each unresolved comment** by:
-   - Locating the relevant code section
-   - Making the requested changes
-   - Ensuring the fix addresses the concern raised
-4. **Do NOT process resolved comments** - they have already been handled
-
-### Example: Compact List of Unresolved Comments
-
-For a quick overview of unresolved comments:
-
-```bash
-gh api graphql -F owner=cozystack -F repo=cozystack -F pr=<PR_NUMBER> -f query='
-query($owner: String!, $repo: String!, $pr: Int!) {
-  repository(owner: $owner, name: $repo) {
-    pullRequest(number: $pr) {
-      reviewThreads(first: 100) {
-        nodes {
-          isResolved
-          comments(first: 100) {
-            nodes {
-              path
-              line
-              author { login }
-              bodyText
-            }
-          }
-        }
-      }
-    }
-  }
-}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | .comments.nodes[] | "\(.path):\(.line // "N/A") - \(.author.login): \(.bodyText[:150])"'
-```
-
-### Important Notes
-
-- **REST API limitation**: The REST endpoint `/pulls/{pr}/reviews` returns review summaries, not individual review comments. Use GraphQL API for accessing `reviewThreads` with `isResolved` status.
-- **Thread-based resolution**: Comments are organized in threads. If a thread is resolved (`isResolved: true`), ignore all comments in that thread.
-- **Always filter**: Never process comments from resolved threads, even if they appear in the results.
-
 ### Example Workflow
 
 ```bash

docs/agents/overview.md

@@ -10,7 +10,7 @@ Cozystack is an open-source Kubernetes-based platform and framework for building
 - **Multi-tenancy**: Full isolation and self-service for tenants
 - **GitOps-driven**: FluxCD-based continuous delivery
 - **Modular Architecture**: Extensible with custom packages and services
-- **Developer Experience**: Simplified local development with cozyhr tool
+- **Developer Experience**: Simplified local development with cozypkg tool
 
 The platform exposes infrastructure services via the Kubernetes API with ready-made configs, built-in monitoring, and alerts.
 

docs/changelogs/v0.36.2.md

@@ -5,13 +5,10 @@ https://github.com/cozystack/cozystack/releases/tag/v0.36.2
 
 ## Features and Improvements
 
-* [vm-disk] New SVG icon for VM disk application. (@kvaps and @kvapsova in https://github.com/cozystack/cozystack/pull/1435)
+## Security
 
 ## Fixes
 
-* [kubernetes] Pin CoreDNS image tag to v1.12.4 for consistent, reproducible deployments. (@kvaps in https://github.com/cozystack/cozystack/pull/1469)
-* [dashboard] Fix FerretDB spec typo that prevented deploy/display in the web UI. (@lllamnyp in https://github.com/cozystack/cozystack/pull/1440)
-
 ## Dependencies
 
 ## Development, Testing, and CI/CD

docs/changelogs/v0.38.3.md

@@ -1,14 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.38.3
--->
-
-## Improvements
-
-* **[core:installer] Address buildx warnings for installer image builds**: Aligns Dockerfile syntax casing to remove buildx warnings, keeping installer builds clean ([**@nbykov0**](https://github.com/nbykov0) in #1682).
-* **[system:coredns] Align CoreDNS app labels with Talos defaults**: Matches CoreDNS labels to Talos conventions so services select pods consistently across platform and tenant clusters ([**@nbykov0**](https://github.com/nbykov0) in #1675).
-* **[system:monitoring-agents] Rename CoreDNS metrics service to avoid conflicts**: Renames the metrics service so it no longer clashes with the CoreDNS service used for name resolution in tenant clusters ([**@nbykov0**](https://github.com/nbykov0) in #1676).
-
----
-
-**Full Changelog**: [v0.38.2...v0.38.3](https://github.com/cozystack/cozystack/compare/v0.38.2...v0.38.3)
-

docs/changelogs/v0.38.4.md

@@ -1,18 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.38.4
--->
-
-## Fixes
-
-* **[linstor] Update piraeus-operator v2.10.2 to handle fsck checks reliably**: Upgrades LINSTOR CSI to avoid failed mounts when fsck sees mounted volumes, improving volume publish reliability ([**@kvaps**](https://github.com/kvaps) in #1689, #1697).
-* **[dashboard] Nest CustomFormsOverride properties under spec.properties**: Fixes schema generation so custom form properties are placed under `spec.properties`, preventing mis-rendered or missing form fields ([**@kvaps**](https://github.com/kvaps) in #1692, #1700).
-* **[virtual-machine] Guard PVC resize to only expand storage**: Ensures resize jobs run only when storage size increases, avoiding unintended shrink attempts during VM updates ([**@kvaps**](https://github.com/kvaps) in #1688, #1701).
-
-## Documentation
-
-* **[website] Clarify GPU check command**: Makes the kubectl command for validating GPU binding more explicit, including namespace context ([**@nbykov0**](https://github.com/nbykov0) in cozystack/website#379).
-
----
-
-**Full Changelog**: [v0.38.3...v0.38.4](https://github.com/cozystack/cozystack/compare/v0.38.3...v0.38.4)
-

docs/changelogs/v0.39.0.md

@@ -1,95 +0,0 @@
-# Cozystack v0.39 — "Enhanced Networking & Monitoring"
-
-This release introduces topology-aware routing for Cilium services, automatic pod rollouts on configuration changes, improved monitoring capabilities, and numerous bug fixes and improvements across the platform.
-
-## Highlights
-
-* **Topology-Aware Routing**: Enabled topology-aware routing for Cilium services, improving traffic distribution and reducing latency by routing traffic to endpoints in the same zone when possible ([**@nbykov0**](https://github.com/nbykov0) in #1734).
-* **Automatic Pod Rollouts**: Cilium and Cilium operator pods now automatically restart when configuration changes, ensuring configuration updates are applied immediately ([**@kvaps**](https://github.com/kvaps) in #1728).
-* **Windows VM Scheduling**: Added nodeAffinity configuration for Windows VMs based on scheduling config, enabling dedicated nodes for Windows workloads ([**@kvaps**](https://github.com/kvaps) in #1693).
-* **SeaweedFS Updates**: Updated to SeaweedFS v4.02 with improved S3 daemon performance and fixes ([**@kvaps**](https://github.com/kvaps) in #1725).
-
----
-
-## Major Features and Improvements
-
-### Networking
-
-* **[system/cilium] Enable topology-aware routing for services**: Enabled topology-aware routing for services, improving traffic distribution and reducing latency by routing traffic to endpoints in the same zone when possible. This feature helps optimize network performance in multi-zone deployments ([**@nbykov0**](https://github.com/nbykov0) in #1734).
-* **[cilium] Enable automatic pod rollout on configmap updates**: Cilium and Cilium operator pods now automatically restart when the cilium-config ConfigMap is updated, ensuring configuration changes are applied immediately without manual intervention ([**@kvaps**](https://github.com/kvaps) in #1728).
-
-### Virtual Machines
-
-* **[virtual-machine,vm-instance] Add nodeAffinity for Windows VMs based on scheduling config**: Added nodeAffinity configuration to virtual-machine and vm-instance charts to support dedicated nodes for Windows VMs. When `dedicatedNodesForWindowsVMs` is enabled in the `cozystack-scheduling` ConfigMap, Windows VMs are scheduled on nodes with label `scheduling.cozystack.io/vm-windows=true`, while non-Windows VMs prefer nodes without this label ([**@kvaps**](https://github.com/kvaps) in #1693).
-
-### Storage
-
-* **Update SeaweedFS v4.02**: Updated SeaweedFS to version 4.02 with improved performance for S3 daemon and fixes for known issues. This update includes better S3 compatibility and performance improvements ([**@kvaps**](https://github.com/kvaps) in #1725).
-
-### Tools
-
-* **[talm] feat(init)!: require --name flag for cluster name**: Breaking change: The `talm init` command now requires the `--name` flag to specify the cluster name. This ensures consistent cluster naming and prevents accidental initialization without a name ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm#86).
-* **[talm] feat(template): preserve extra YAML documents in output**: Templates now preserve extra YAML documents in the output, allowing for more flexible template processing ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm#87).
-* **[talm] feat: add directory expansion for -f flag**: Added directory expansion support for the `-f` flag, allowing users to specify directories instead of individual files ([**@kvaps**](https://github.com/kvaps) in cozystack/talm@ca5713e).
-* **[talm] Introduce automatic root detection**: Added automatic root detection logic to simplify talm usage and reduce manual configuration ([**@kvaps**](https://github.com/kvaps) in cozystack/talm@d165162).
-* **[talm] Introduce talm kubeconfig --login command**: Added new `talm kubeconfig --login` command for easier kubeconfig management ([**@kvaps**](https://github.com/kvaps) in cozystack/talm@5f7e05b).
-* **[talm] Introduce encryption**: Added encryption support to talm for secure configuration management ([**@kvaps**](https://github.com/kvaps) in cozystack/talm#81).
-* **[talm] Replace code-generation with wrapper on talosctl**: Refactored talm to use a wrapper on talosctl instead of code generation, simplifying the codebase and improving maintainability ([**@kvaps**](https://github.com/kvaps) in cozystack/talm#80).
-* **[talm] Use go embed instead of code generation**: Migrated from code generation to go embed for better build performance and simpler dependency management ([**@kvaps**](https://github.com/kvaps) in cozystack/talm#79).
-* **[boot-to-talos] Cozystack: Update Talos Linux v1.11.3**: Updated boot-to-talos to use Talos Linux v1.11.3 ([**@kvaps**](https://github.com/kvaps) in cozystack/boot-to-talos#7).
-
-## Improvements
-
-* **[seaweedfs] Extended CA certificate duration to reduce disruptive CA rotations**: Extended CA certificate duration to reduce disruptive CA rotations, improving long-term certificate management and reducing operational overhead ([**@IvanHunters**](https://github.com/IvanHunters) in #1657).
-* **[dashboard] Add config hash annotations to restart pods on config changes**: Added config hash annotations to dashboard deployment templates to ensure pods are automatically restarted when their configuration changes, ensuring configuration updates are applied immediately ([**@kvaps**](https://github.com/kvaps) in #1662).
-* **[tenant][kubernetes] Introduce better cleanup logic**: Improved cleanup logic for tenant Kubernetes resources, ensuring proper resource cleanup when tenants are deleted or updated. Added automated pre-delete cleanup job for tenant namespaces to remove tenant-related releases during uninstall ([**@kvaps**](https://github.com/kvaps) in #1661).
-* **[system:coredns] update coredns app labels to match Talos coredns labels**: Updated coredns app labels to match Talos coredns labels, ensuring consistency across the platform ([**@nbykov0**](https://github.com/nbykov0) in #1675).
-* **[system:monitoring-agents] rename coredns metrics service**: Renamed coredns metrics service to avoid interference with coredns service used for name resolution in tenant k8s clusters ([**@nbykov0**](https://github.com/nbykov0) in #1676).
-* **[core:installer] Address buildx warnings**: Fixed Dockerfile syntax warnings from buildx, ensuring clean builds without warnings ([**@nbykov0**](https://github.com/nbykov0) in #1682).
-* **[talm] Refactor root detection logic into single file**: Improved code organization by consolidating root detection logic into a single file ([**@kvaps**](https://github.com/kvaps) in cozystack/talm@487b479).
-* **[talm] Refactor init logic, better upgrade**: Improved initialization logic and upgrade process for better reliability ([**@kvaps**](https://github.com/kvaps) in cozystack/talm@c512777).
-* **[talm] Sugar for kubeconfig command**: Added convenience features to the kubeconfig command for improved usability ([**@kvaps**](https://github.com/kvaps) in cozystack/talm@a4010b3).
-* **[talm] wrap upgrade command**: Wrapped upgrade command for better integration and error handling ([**@kvaps**](https://github.com/kvaps) in cozystack/talm@2e1afbf).
-* **[talm] docs(readme): add Homebrew installation option**: Added Homebrew installation option to the README for easier installation on macOS ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm@12bd4f2).
-* **[talm] cozystack: disable nodeCIDRs allocation**: Disabled nodeCIDRs allocation in talm for better network configuration control ([**@kvaps**](https://github.com/kvaps) in cozystack/talm#82).
-* **[talm] Update license to Apache2.0**: Updated license to Apache 2.0 for better compatibility and clarity ([**@kvaps**](https://github.com/kvaps) in cozystack/talm@eda1032).
-
-## Fixes
-
-* **[apps] Refactor apiserver to use typed objects and fix UnstructuredList GVK**: Refactored the apiserver REST handlers to use typed objects (`appsv1alpha1.Application`) instead of `unstructured.Unstructured`, eliminating the need for runtime conversions and simplifying the codebase. Additionally, fixed an issue where `UnstructuredList` objects were using the first registered kind from `typeToGVK` instead of the kind from the object's field when multiple kinds are registered with the same Go type. This fix includes the upstream fix from kubernetes/kubernetes#135537 ([**@kvaps**](https://github.com/kvaps) in #1679).
-* **[dashboard] Fix CustomFormsOverride schema to nest properties under spec.properties**: Fixed the logic for generating CustomFormsOverride schema to properly nest properties under `spec.properties` instead of directly under `properties`, ensuring correct form schema generation ([**@kvaps**](https://github.com/kvaps) in #1692).
-* **[virtual-machine] Improve check for resizing job**: Improved storage resize logic to only expand persistent volume claims when storage is being increased, preventing unintended storage reduction operations. Added validation to accurately compare current and desired storage sizes before triggering resize operations ([**@kvaps**](https://github.com/kvaps) in #1688).
-* **[linstor] Update piraeus-operator v2.10.2**: Updated LINSTOR CSI to fix issues with the new fsck behaviour, resolving mount failures when fsck attempts to run on mounted devices ([**@kvaps**](https://github.com/kvaps) in #1689).
-* **[api] Revert dynamic list kinds representation fix (fixes namespace deletion regression)**: Reverted changes from #1630 that caused a regression affecting namespace deletion and upgrades from previous versions. The regression caused namespace deletion failures with errors like "content is not a list: []unstructured.Unstructured" during namespace finalization. This revert restores compatibility with namespace deletion controller and fixes upgrade issues from previous versions ([**@kvaps**](https://github.com/kvaps) in #1677).
-* **[talm] fix: normalize template paths for Windows compatibility**: Fixed template path handling to ensure Windows compatibility by normalizing paths ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm#88).
-
-## Dependencies
-
-* **Update SeaweedFS v4.02**: Updated SeaweedFS to version 4.02 ([**@kvaps**](https://github.com/kvaps) in #1725).
-* **[linstor] Update piraeus-operator v2.10.2**: Updated piraeus-operator to version 2.10.2 ([**@kvaps**](https://github.com/kvaps) in #1689).
-* **[talm] Cozystack: Update Talos Linux v1.11.3**: Updated talm to use Talos Linux v1.11.3 ([**@kvaps**](https://github.com/kvaps) in cozystack/talm#83).
-
-## Documentation
-
-* **[website] Add article: Talm v0.17: Built-in Age Encryption for Secrets Management**: Added comprehensive blog post announcing Talm v0.17 and its built-in age-based encryption for secrets. Covers initial setup and key generation, encryption/decryption workflows, idempotent encryption behavior, automatic .gitignore handling, file permission safeguards, security best practices, and guidance for GitOps and CI/CD integration ([**@kvaps**](https://github.com/kvaps) in [cozystack/website#384](https://github.com/cozystack/website/pull/384)).
-* **[website] docs(talm): update talm init syntax for mandatory --preset and --name flags**: Updated documentation to reflect breaking changes in talm, adding mandatory `--preset` and `--name` flags to the talm init command ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#386).
-
----
-
-## Contributors
-
-We'd like to thank all contributors who made this release possible:
-
-* [**@IvanHunters**](https://github.com/IvanHunters)
-* [**@kvaps**](https://github.com/kvaps)
-* [**@lexfrei**](https://github.com/lexfrei)
-* [**@nbykov0**](https://github.com/nbykov0)
-
----
-
-**Full Changelog**: [v0.38.0...v0.39.0](https://github.com/cozystack/cozystack/compare/v0.38.0...v0.39.0)
-
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.39.0
--->
-

docs/changelogs/v0.39.1.md

@@ -1,12 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.39.1
--->
-
-## Features and Improvements
-
-* **[monitoring] Add SLACK_SEVERITY_FILTER field and VMAgent for tenant monitoring**: Introduced the SLACK_SEVERITY_FILTER environment variable in the Alerta deployment to enable filtering of alert severities for Slack notifications based on the disabledSeverity configuration. Additionally, added a VMAgent resource template for scraping metrics within tenant namespaces, improving monitoring granularity and control. This enhancement allows administrators to configure which alert severities are sent to Slack and enables tenant-specific metrics collection for better observability ([**@IvanHunters**](https://github.com/IvanHunters) in #1712).
-
----
-
-**Full Changelog**: [v0.39.0...v0.39.1](https://github.com/cozystack/cozystack/compare/v0.39.0...v0.39.1)
-

examples/platform-example.yaml

@@ -0,0 +1,31 @@
+apiVersion: cozystack.io/v1alpha1
+kind: Platform
+metadata:
+  name: cozystack-platform
+  # Cluster-scoped resource, no namespace needed
+spec:
+  # SourceRef is required - reference to the OCIRepository or GitRepository
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-packages
+    namespace: cozy-system
+  
+  # Optional: Interval for HelmRelease reconciliation (default: 5m)
+  interval: 5m
+  
+  # Optional: BasePath is the base path where the platform chart is located in the source.
+  # For GitRepository, defaults to "packages/core/platform" if not specified.
+  # For OCIRepository, defaults to "core/platform" if not specified.
+  # basePath: core/platform
+  
+  # Optional: Values to pass to HelmRelease
+  # These values will be merged with sourceRef (which is automatically added)
+  values:
+    # Any custom values can be added here
+    # sourceRef will be automatically added by the controller
+    # Example custom values:
+    # customKey: customValue
+    # nested:
+    #   config:
+    #     enabled: true
+

go.mod

@@ -5,30 +5,29 @@ module github.com/cozystack/cozystack
 go 1.25.0
 
 require (
-	github.com/emicklei/dot v1.10.0
 	github.com/fluxcd/helm-controller/api v1.4.3
-	github.com/fluxcd/source-controller/api v1.7.4
-	github.com/fluxcd/source-watcher/api/v2 v2.0.3
+	github.com/fluxcd/source-controller/api v1.6.2
+	github.com/fluxcd/source-watcher/api/v2 v2.0.2
 	github.com/go-logr/logr v1.4.3
 	github.com/go-logr/zapr v1.3.0
 	github.com/google/gofuzz v1.2.0
 	github.com/onsi/ginkgo/v2 v2.23.3
 	github.com/onsi/gomega v1.37.0
 	github.com/prometheus/client_golang v1.22.0
-	github.com/robfig/cron/v3 v3.0.1
 	github.com/spf13/cobra v1.9.1
+	github.com/stretchr/testify v1.11.1
 	go.uber.org/zap v1.27.0
 	gopkg.in/yaml.v2 v2.4.0
 	k8s.io/api v0.34.1
 	k8s.io/apiextensions-apiserver v0.34.1
-	k8s.io/apimachinery v0.34.2
+	k8s.io/apimachinery v0.34.1
 	k8s.io/apiserver v0.34.1
 	k8s.io/client-go v0.34.1
 	k8s.io/component-base v0.34.1
 	k8s.io/klog/v2 v2.130.1
 	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b
 	k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d
-	sigs.k8s.io/controller-runtime v0.22.4
+	sigs.k8s.io/controller-runtime v0.22.2
 	sigs.k8s.io/structured-merge-diff/v4 v4.7.0
 )
 
@@ -49,7 +48,7 @@ require (
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fluxcd/pkg/apis/acl v0.9.0 // indirect
 	github.com/fluxcd/pkg/apis/kustomize v1.13.0 // indirect
-	github.com/fluxcd/pkg/apis/meta v1.23.0 // indirect
+	github.com/fluxcd/pkg/apis/meta v1.22.0 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
@@ -128,6 +127,3 @@ require (
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
-
-// See: issues.k8s.io/135537
-replace k8s.io/apimachinery => github.com/cozystack/apimachinery v0.0.0-20251219010959-1f91eabae46c

go.sum

@@ -18,8 +18,6 @@ github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
 github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/cozystack/apimachinery v0.0.0-20251219010959-1f91eabae46c h1:C2wIfH/OzhU9XOK/e6Ik9cg7nZ1z6fN4lf6a3yFdik8=
-github.com/cozystack/apimachinery v0.0.0-20251219010959-1f91eabae46c/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -27,8 +25,6 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/emicklei/dot v1.10.0 h1:z17n0ce/FBMz3QbShSzVGhiW447Qhu7fljzvp3Gs6ig=
-github.com/emicklei/dot v1.10.0/go.mod h1:DeV7GvQtIw4h2u73RKBkkFdvVAz0D9fzeJrgPW6gy/s=
 github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
 github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH5pOlLGNtQ5lPWQu84=
@@ -43,12 +39,12 @@ github.com/fluxcd/pkg/apis/acl v0.9.0 h1:wBpgsKT+jcyZEcM//OmZr9RiF8klL3ebrDp2u2T
 github.com/fluxcd/pkg/apis/acl v0.9.0/go.mod h1:TttNS+gocsGLwnvmgVi3/Yscwqrjc17+vhgYfqkfrV4=
 github.com/fluxcd/pkg/apis/kustomize v1.13.0 h1:GGf0UBVRIku+gebY944icVeEIhyg1P/KE3IrhOyJJnE=
 github.com/fluxcd/pkg/apis/kustomize v1.13.0/go.mod h1:TLKVqbtnzkhDuhWnAsN35977HvRfIjs+lgMuNro/LEc=
-github.com/fluxcd/pkg/apis/meta v1.23.0 h1:fLis5YcHnOsyKYptzBtituBm5EWNx13I0bXQsy0FG4s=
-github.com/fluxcd/pkg/apis/meta v1.23.0/go.mod h1:UWsIbBPCxYvoVklr2mV2uLFBf/n17dNAmKFjRfApdDo=
-github.com/fluxcd/source-controller/api v1.7.4 h1:+EOVnRA9LmLxOx7J273l7IOEU39m+Slt/nQGBy69ygs=
-github.com/fluxcd/source-controller/api v1.7.4/go.mod h1:ruf49LEgZRBfcP+eshl2n9SX1MfHayCcViAIGnZcaDY=
-github.com/fluxcd/source-watcher/api/v2 v2.0.3 h1:SsVGAaMBxzvcgrOz/Kl6c2ybMHVqoiEFwtI+bDuSeSs=
-github.com/fluxcd/source-watcher/api/v2 v2.0.3/go.mod h1:Nx3QZweVyuhaOtSNrw+oxifG+qrakPvjgNAN9qlUTb0=
+github.com/fluxcd/pkg/apis/meta v1.22.0 h1:EHWQH5ZWml7i8eZ/AMjm1jxid3j/PQ31p+hIwCt6crM=
+github.com/fluxcd/pkg/apis/meta v1.22.0/go.mod h1:Kc1+bWe5p0doROzuV9XiTfV/oL3ddsemYXt8ZYWdVVg=
+github.com/fluxcd/source-controller/api v1.6.2 h1:UmodAeqLIeF29HdTqf2GiacZyO+hJydJlepDaYsMvhc=
+github.com/fluxcd/source-controller/api v1.6.2/go.mod h1:ZJcAi0nemsnBxjVgmJl0WQzNvB0rMETxQMTdoFosmMw=
+github.com/fluxcd/source-watcher/api/v2 v2.0.2 h1:fWSxsDqYN7My2AEpQwbP7O6Qjix8nGBX+UE/qWHtZfM=
+github.com/fluxcd/source-watcher/api/v2 v2.0.2/go.mod h1:Hs6ueayPt23jlkIr/d1pGPZ+OHiibQwWjxvU6xqljzg=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
@@ -150,8 +146,6 @@ github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ
 github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
-github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
-github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
 github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
 github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
@@ -304,6 +298,8 @@ k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
 k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
 k8s.io/apiextensions-apiserver v0.34.1 h1:NNPBva8FNAPt1iSVwIE0FsdrVriRXMsaWFMqJbII2CI=
 k8s.io/apiextensions-apiserver v0.34.1/go.mod h1:hP9Rld3zF5Ay2Of3BeEpLAToP+l4s5UlxiHfqRaRcMc=
+k8s.io/apimachinery v0.34.1 h1:dTlxFls/eikpJxmAC7MVE8oOeP1zryV7iRyIjB0gky4=
+k8s.io/apimachinery v0.34.1/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
 k8s.io/apiserver v0.34.1 h1:U3JBGdgANK3dfFcyknWde1G6X1F4bg7PXuvlqt8lITA=
 k8s.io/apiserver v0.34.1/go.mod h1:eOOc9nrVqlBI1AFCvVzsob0OxtPZUCPiUJL45JOTBG0=
 k8s.io/client-go v0.34.1 h1:ZUPJKgXsnKwVwmKKdPfw4tB58+7/Ik3CrjOEhsiZ7mY=
@@ -320,8 +316,8 @@ k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d h1:wAhiDyZ4Tdtt7e46e9M5ZSAJ/MnPG
 k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 h1:jpcvIRr3GLoUoEKRkHKSmGjxb6lWwrBlJsXc+eUYQHM=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
-sigs.k8s.io/controller-runtime v0.22.4 h1:GEjV7KV3TY8e+tJ2LCTxUTanW4z/FmNB7l327UfMq9A=
-sigs.k8s.io/controller-runtime v0.22.4/go.mod h1:+QX1XUpTXN4mLoblf4tqr5CQcyHPAki2HLXqQMY6vh8=
+sigs.k8s.io/controller-runtime v0.22.2 h1:cK2l8BGWsSWkXz09tcS4rJh95iOLney5eawcK5A33r4=
+sigs.k8s.io/controller-runtime v0.22.2/go.mod h1:+QX1XUpTXN4mLoblf4tqr5CQcyHPAki2HLXqQMY6vh8=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=

hack/check-optional-repos.sh

@@ -48,7 +48,7 @@ echo "  End: $RELEASE_END"
 echo ""
 
 # Loop through ALL optional repositories
-for repo_name in talm boot-to-talos cozyhr cozy-proxy; do
+for repo_name in talm boot-to-talos cozypkg cozy-proxy; do
   echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
   echo "Checking repository: $repo_name"
   echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"

hack/common-envs.mk

@@ -1,10 +1,3 @@
-# macOS-compatible sed in-place
-ifeq ($(shell uname),Darwin)
-    SED_INPLACE := sed -i ''
-else
-    SED_INPLACE := sed -i
-endif
-
 REGISTRY ?= ghcr.io/cozystack/cozystack
 TAG = $(shell git describe --tags --exact-match 2>/dev/null || echo latest)
 PUSH := 1

hack/cozyreport.sh

@@ -12,13 +12,19 @@ command -V tar >/dev/null || exit $?
 
 echo "Collecting Cozystack information..."
 mkdir -p $REPORT_DIR/cozystack
-kubectl get deploy -n cozy-system cozystack -o jsonpath='{.spec.template.spec.containers[0].image}' > $REPORT_DIR/cozystack/image.txt 2>&1
-kubectl get cm -n cozy-system --no-headers | awk '$1 ~ /^cozystack/' |
-  while read NAME _; do
-    DIR=$REPORT_DIR/cozystack/configs
-    mkdir -p $DIR
-    kubectl get cm -n cozy-system $NAME -o yaml > $DIR/$NAME.yaml 2>&1
-  done
+kubectl get deploy -n cozy-system cozystack-operator cozystack-controller -o yaml > $REPORT_DIR/cozystack/deployments.yaml 2>&1
+
+echo "Collecting platforms..."
+kubectl get platforms.cozystack.io -A > $REPORT_DIR/cozystack/platforms.txt 2>&1
+kubectl get platforms.cozystack.io -A -o yaml > $REPORT_DIR/cozystack/platforms.yaml 2>&1
+
+echo "Collecting bundles..."
+kubectl get bundles.cozystack.io -A > $REPORT_DIR/cozystack/bundles.txt 2>&1
+kubectl get bundles.cozystack.io -A -o yaml > $REPORT_DIR/cozystack/bundles.yaml 2>&1
+
+echo "Collecting applicationdefinitions..."
+kubectl get applicationdefinitions.cozystack.io -A > $REPORT_DIR/cozystack/applicationdefinitions.txt 2>&1
+kubectl get applicationdefinitions.cozystack.io -A -o yaml > $REPORT_DIR/cozystack/applicationdefinitions.yaml 2>&1
 
 # -- kubernetes module
 
@@ -56,6 +62,36 @@ kubectl get hr -A --no-headers | awk '$4 != "True"' | \
     kubectl describe hr -n $NAMESPACE $NAME > $DIR/describe.txt 2>&1
   done
 
+echo "Collecting artifactgenerators..."
+kubectl get artifactgenerators.source.extensions.fluxcd.io -A > $REPORT_DIR/kubernetes/artifactgenerators.txt 2>&1
+kubectl get artifactgenerators.source.extensions.fluxcd.io -A --no-headers | awk '$4 != "True"' | \
+  while read NAMESPACE NAME _; do
+    DIR=$REPORT_DIR/kubernetes/artifactgenerators/$NAMESPACE/$NAME
+    mkdir -p $DIR
+    kubectl get artifactgenerators.source.extensions.fluxcd.io -n $NAMESPACE $NAME -o yaml > $DIR/artifactgenerator.yaml 2>&1
+    kubectl describe artifactgenerators.source.extensions.fluxcd.io -n $NAMESPACE $NAME > $DIR/describe.txt 2>&1
+  done
+
+echo "Collecting ocirepositories..."
+kubectl get ocirepositories.source.toolkit.fluxcd.io -A > $REPORT_DIR/kubernetes/ocirepositories.txt 2>&1
+kubectl get ocirepositories.source.toolkit.fluxcd.io -A --no-headers | awk '$4 != "True"' | \
+  while read NAMESPACE NAME _; do
+    DIR=$REPORT_DIR/kubernetes/ocirepositories/$NAMESPACE/$NAME
+    mkdir -p $DIR
+    kubectl get ocirepositories.source.toolkit.fluxcd.io -n $NAMESPACE $NAME -o yaml > $DIR/ocirepository.yaml 2>&1
+    kubectl describe ocirepositories.source.toolkit.fluxcd.io -n $NAMESPACE $NAME > $DIR/describe.txt 2>&1
+  done
+
+echo "Collecting gitrepositories..."
+kubectl get gitrepositories.source.toolkit.fluxcd.io -A > $REPORT_DIR/kubernetes/gitrepositories.txt 2>&1
+kubectl get gitrepositories.source.toolkit.fluxcd.io -A --no-headers | awk '$4 != "True"' | \
+  while read NAMESPACE NAME _; do
+    DIR=$REPORT_DIR/kubernetes/gitrepositories/$NAMESPACE/$NAME
+    mkdir -p $DIR
+    kubectl get gitrepositories.source.toolkit.fluxcd.io -n $NAMESPACE $NAME -o yaml > $DIR/gitrepository.yaml 2>&1
+    kubectl describe gitrepositories.source.toolkit.fluxcd.io -n $NAMESPACE $NAME > $DIR/describe.txt 2>&1
+  done
+
 echo "Collecting pods..."
 kubectl get pod -A -o wide > $REPORT_DIR/kubernetes/pods.txt 2>&1
 kubectl get pod -A --no-headers | awk '$4 !~ /Running|Succeeded|Completed/' |

hack/e2e-install-cozystack.bats

@@ -8,23 +8,51 @@
 }
 
 @test "Install Cozystack" {
-  # Create namespace & configmap required by installer
-  kubectl create namespace cozy-system --dry-run=client -o yaml | kubectl apply -f -
-  kubectl create configmap cozystack -n cozy-system \
-          --from-literal=bundle-name=paas-full \
-          --from-literal=ipv4-pod-cidr=10.244.0.0/16 \
-          --from-literal=ipv4-pod-gateway=10.244.0.1 \
-          --from-literal=ipv4-svc-cidr=10.96.0.0/16 \
-          --from-literal=ipv4-join-cidr=100.64.0.0/16 \
-          --from-literal=root-host=example.org \
-          --from-literal=api-server-endpoint=https://192.168.123.10:6443 \
-          --dry-run=client -o yaml | kubectl apply -f -
-
   # Apply installer manifests from file
   kubectl apply -f _out/assets/cozystack-installer.yaml
 
   # Wait for the installer deployment to become available
-  kubectl wait deployment/cozystack -n cozy-system --timeout=1m --for=condition=Available
+  kubectl wait deployment/cozystack-operator -n cozy-system --timeout=1m --for=condition=Available
+
+  # Wait for cozy-fluxcd namespace to be created
+  timeout 30 sh -ec 'until kubectl get namespace cozy-fluxcd >/dev/null 2>&1; do sleep 1; done'
+
+  # Wait for Flux deployment
+  timeout 30 sh -ec 'until kubectl get deployment/flux -n cozy-fluxcd >/dev/null 2>&1; do sleep 1; done'
+  kubectl wait deployment/flux -n cozy-fluxcd --timeout=1m --for=condition=Available
+
+  # Create Platform resource instead of configmap
+  kubectl apply -f - <<'EOF'
+apiVersion: cozystack.io/v1alpha1
+kind: Platform
+metadata:
+  name: cozystack-platform
+spec:
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-packages
+    namespace: cozy-system
+  values:
+    bundles:
+      system:
+        type: "full"
+    networking:
+      podCIDR: "10.244.0.0/16"
+      podGateway: "10.244.0.1"
+      serviceCIDR: "10.96.0.0/16"
+      joinCIDR: "100.64.0.0/16"
+    publishing:
+      host: "example.org"
+      apiServerEndpoint: "https://192.168.123.10:6443"
+EOF
+
+  # Wait for ArtifactGenerator for cozystack-packages
+  timeout 60 sh -ec 'until kubectl get artifactgenerators.source.extensions.fluxcd.io cozystack-packages -n cozy-system >/dev/null 2>&1; do sleep 1; done'
+  kubectl wait artifactgenerators.source.extensions.fluxcd.io/cozystack-packages -n cozy-system --for=condition=ready --timeout=5m
+
+  # Wait for bundle ArtifactGenerators
+  timeout 60 sh -ec 'until kubectl get artifactgenerators.source.extensions.fluxcd.io cozystack-system cozystack-iaas cozystack-paas cozystack-naas -n cozy-system >/dev/null 2>&1; do sleep 1; done'
+  kubectl wait artifactgenerators.source.extensions.fluxcd.io -n cozy-system --for=condition=ready --timeout=5m cozystack-system cozystack-iaas cozystack-paas cozystack-naas
 
   # Wait until HelmReleases appear & reconcile them
   timeout 60 sh -ec 'until kubectl get hr -A -l cozystack.io/system-app=true | grep -q cozys; do sleep 1; done'
@@ -140,9 +168,8 @@ EOF
     kubectl wait hr/seaweedfs-system -n tenant-root --timeout=2m --for=condition=ready
   fi
 
-
   # Expose Cozystack services through ingress
-  kubectl patch configmap/cozystack -n cozy-system --type merge -p '{"data":{"expose-services":"api,dashboard,cdi-uploadproxy,vm-exportproxy,keycloak"}}'
+  kubectl patch platform/cozystack-platform --type merge -p '{"spec":{"values":{"publishing":{"exposedServices":["api","dashboard","cdi-uploadproxy","vm-exportproxy","keycloak"]}}}}'
 
   # NGINX ingress controller
   timeout 60 sh -ec 'until kubectl get deploy root-ingress-controller -n tenant-root >/dev/null 2>&1; do sleep 1; done'
@@ -169,7 +196,7 @@ EOF
 }
 
 @test "Keycloak OIDC stack is healthy" {
-  kubectl patch configmap/cozystack -n cozy-system --type merge -p '{"data":{"oidc-enabled":"true"}}'
+  kubectl patch platform/cozystack-platform --type merge -p '{"spec":{"values":{"authentication":{"oidc":{"enabled":true}}}}}'
 
   timeout 120 sh -ec 'until kubectl get hr -n cozy-keycloak keycloak keycloak-configure keycloak-operator >/dev/null 2>&1; do sleep 1; done'
   kubectl wait hr/keycloak hr/keycloak-configure hr/keycloak-operator -n cozy-keycloak --timeout=10m --for=condition=ready

hack/e2e-test-openapi.bats

@@ -21,33 +21,14 @@
 }
 
 @test "Test kinds" {
-  val=$(kubectl get --raw /apis/apps.cozystack.io/v1alpha1/tenants | jq -r '.kind')
-  if [ "$val" != "TenantList" ]; then
-    echo "Expected kind to be TenantList, got $val"
-    exit 1
-  fi
   val=$(kubectl get --raw /apis/apps.cozystack.io/v1alpha1/tenants | jq -r '.items[0].kind')
   if [ "$val" != "Tenant" ]; then
     echo "Expected kind to be Tenant, got $val"
     exit 1
   fi
-  val=$(kubectl get --raw /apis/apps.cozystack.io/v1alpha1/ingresses | jq -r '.kind')
-  if [ "$val" != "IngressList" ]; then
-    echo "Expected kind to be IngressList, got $val"
-    exit 1
-  fi
   val=$(kubectl get --raw /apis/apps.cozystack.io/v1alpha1/ingresses | jq -r '.items[0].kind')
   if [ "$val" != "Ingress" ]; then
     echo "Expected kind to be Ingress, got $val"
     exit 1
   fi
 }
-
-@test "Create and delete namespace" {
-  kubectl create ns cozy-test-create-and-delete-namespace --dry-run=client -o yaml | kubectl apply -f -
-  if ! kubectl delete ns cozy-test-create-and-delete-namespace; then
-    echo "Failed to delete namespace"
-    kubectl describe ns cozy-test-create-and-delete-namespace
-    exit 1
-  fi
-}

hack/package.mk

@@ -5,22 +5,22 @@ help: ## Show this help.
 	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {sub("\\\\n",sprintf("\n%22c"," "), $$2);printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
 
 show: check ## Show output of rendered templates
-	cozyhr show -n $(NAMESPACE) $(NAME)
+	cozypkg show -n $(NAMESPACE) $(NAME)
 
 apply: check suspend ## Apply Helm release to a Kubernetes cluster
-	cozyhr apply -n $(NAMESPACE) $(NAME)
+	cozypkg apply -n $(NAMESPACE) $(NAME)
 
 diff: check ## Diff Helm release against objects in a Kubernetes cluster
-	cozyhr diff -n $(NAMESPACE) $(NAME)
+	cozypkg diff -n $(NAMESPACE) $(NAME)
 
 suspend: check ## Suspend reconciliation for an existing Helm release
-	cozyhr suspend -n $(NAMESPACE) $(NAME)
+	cozypkg suspend -n $(NAMESPACE) $(NAME)
 
 resume: check ## Resume reconciliation for an existing Helm release
-	cozyhr resume -n $(NAMESPACE) $(NAME)
+	cozypkg resume -n $(NAMESPACE) $(NAME)
 
 delete: check suspend ## Delete Helm release from a Kubernetes cluster
-	cozyhr delete -n $(NAMESPACE) $(NAME)
+	cozypkg delete -n $(NAMESPACE) $(NAME)
 
 check:
 	@if [ -z "$(NAME)" ]; then echo "env NAME is not set!" >&2; exit 1; fi

hack/update-codegen.sh

@@ -23,14 +23,6 @@ CODEGEN_PKG=${CODEGEN_PKG:-$(cd "${SCRIPT_ROOT}"; ls -d -1 ./vendor/k8s.io/code-
 API_KNOWN_VIOLATIONS_DIR="${API_KNOWN_VIOLATIONS_DIR:-"${SCRIPT_ROOT}/api/api-rules"}"
 UPDATE_API_KNOWN_VIOLATIONS="${UPDATE_API_KNOWN_VIOLATIONS:-true}"
 CONTROLLER_GEN="go run sigs.k8s.io/controller-tools/cmd/controller-gen@v0.16.4"
-TMPDIR=$(mktemp -d)
-OPERATOR_CRDDIR=packages/core/installer/definitions
-COZY_CONTROLLER_CRDDIR=packages/system/cozystack-controller/definitions
-COZY_RD_CRDDIR=packages/system/cozystack-resource-definition-crd/definition
-BACKUPS_CORE_CRDDIR=packages/system/backup-controller/definitions
-BACKUPSTRATEGY_CRDDIR=packages/system/backupstrategy-controller/definitions
-
-trap 'rm -rf ${TMPDIR}' EXIT
 
 source "${CODEGEN_PKG}/kube_codegen.sh"
 
@@ -61,15 +53,10 @@ kube::codegen::gen_openapi \
     "${SCRIPT_ROOT}/pkg/apis"
 
 $CONTROLLER_GEN object:headerFile="hack/boilerplate.go.txt" paths="./api/..."
-$CONTROLLER_GEN rbac:roleName=manager-role crd paths="./api/..." output:crd:artifacts:config=${TMPDIR} 
-
-mv ${TMPDIR}/cozystack.io_packages.yaml ${OPERATOR_CRDDIR}/cozystack.io_packages.yaml
-mv ${TMPDIR}/cozystack.io_packagesources.yaml ${OPERATOR_CRDDIR}/cozystack.io_packagesources.yaml
-
-mv ${TMPDIR}/cozystack.io_cozystackresourcedefinitions.yaml \
-        ${COZY_RD_CRDDIR}/cozystack.io_cozystackresourcedefinitions.yaml
-
-mv ${TMPDIR}/backups.cozystack.io*.yaml ${BACKUPS_CORE_CRDDIR}/
-mv ${TMPDIR}/strategy.backups.cozystack.io*.yaml ${BACKUPSTRATEGY_CRDDIR}/
-
-mv ${TMPDIR}/*.yaml ${COZY_CONTROLLER_CRDDIR}/
+$CONTROLLER_GEN rbac:roleName=manager-role crd paths="./api/..." output:crd:artifacts:config=packages/system/cozystack-controller/crds
+mv packages/system/cozystack-controller/crds/cozystack.io_applicationdefinitions.yaml \
+        packages/core/installer/crds/cozystack.io_applicationdefinitions.yaml
+mv packages/system/cozystack-controller/crds/cozystack.io_bundles.yaml \
+        packages/core/installer/crds/cozystack.io_bundles.yaml
+mv packages/system/cozystack-controller/crds/cozystack.io_platforms.yaml \
+        packages/core/installer/crds/cozystack.io_platforms.yaml

hack/update-crd.sh

@@ -8,7 +8,7 @@ need yq; need jq; need base64
 CHART_YAML="${CHART_YAML:-Chart.yaml}"
 VALUES_YAML="${VALUES_YAML:-values.yaml}"
 SCHEMA_JSON="${SCHEMA_JSON:-values.schema.json}"
-CRD_DIR="../../system/cozystack-resource-definitions/cozyrds"
+CRD_DIR="../../core/platform/bundles/*/applicationdefinitions"
 
 [[ -f "$CHART_YAML" ]] || { echo "No $CHART_YAML found"; exit 1; }
 [[ -f "$SCHEMA_JSON" ]] || { echo "No $SCHEMA_JSON found"; exit 1; }
@@ -54,37 +54,71 @@ fi
 # Base64 (portable: no -w / -b options)
 ICON_B64="$(base64 < "$ICON_PATH" | tr -d '\n' | tr -d '\r')"
 
-# Decide which HelmRepository name to use based on path
-#   .../apps/...  -> cozystack-apps
-#   .../extra/... -> cozystack-extra
-# default: cozystack-apps
-SOURCE_NAME="cozystack-apps"
-case "$PWD" in
-  *"/apps/"*)  SOURCE_NAME="cozystack-apps" ;;
-  *"/extra/"*) SOURCE_NAME="cozystack-extra" ;;
-esac
+# Find path to output CRD YAML
+OUT="$(find $CRD_DIR -type f -name "${NAME}.yaml" | head -n 1)"
+if [[ -z "$OUT" ]]; then
+  echo "Error: ApplicationDefinition file for '${NAME}' not found in ${CRD_DIR}"
+  echo "Please create the file first in one of the following directories:"
+  
+  # Auto-detect existing directories
+  BASE_DIR="../../core/platform/bundles"
+  if [[ -d "$BASE_DIR" ]]; then
+    for bundle_dir in "$BASE_DIR"/*/applicationdefinitions; do
+      if [[ -d "$bundle_dir" ]]; then
+        bundle_name="$(basename "$(dirname "$bundle_dir")")"
+        echo "  touch ${bundle_dir}/${NAME}.yaml  # ${bundle_name}"
+      fi
+    done
+  else
+    # Fallback if base directory doesn't exist
+    echo "  touch ../../core/platform/bundles/iaas/applicationdefinitions/${NAME}.yaml"
+    echo "  touch ../../core/platform/bundles/paas/applicationdefinitions/${NAME}.yaml"
+    echo "  touch ../../core/platform/bundles/naas/applicationdefinitions/${NAME}.yaml"
+    echo "  touch ../../core/platform/bundles/system/applicationdefinitions/${NAME}.yaml"
+  fi
+  exit 1
+fi
 
-# If file doesn't exist, create a minimal skeleton
-OUT="${OUT:-$CRD_DIR/$NAME.yaml}"
-if [[ ! -f "$OUT" ]]; then
+if [[ ! -s "$OUT" ]]; then
   cat >"$OUT" <<EOF
 apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
+kind: ApplicationDefinition
 metadata:
   name: ${NAME}
-spec: {}
+spec:
+  release:
+    values:
+      _cozystack:
 EOF
 fi
 
+# Determine package type (apps or extra) from current directory
+CURRENT_DIR="$(pwd)"
+PACKAGE_TYPE="apps"  # default
+if [[ "$CURRENT_DIR" == *"/packages/extra/"* ]]; then
+  PACKAGE_TYPE="extra"
+elif [[ "$CURRENT_DIR" == *"/packages/apps/"* ]]; then
+  PACKAGE_TYPE="apps"
+fi
+
+# Extract bundle type (iaas, paas, naas, system) from OUT path
+OUT_DIR="$(dirname "$OUT")"
+BUNDLE_DIR="$(dirname "$OUT_DIR")"
+BUNDLE_TYPE="$(basename "$BUNDLE_DIR")"
+ARTIFACT_PREFIX="cozystack-${BUNDLE_TYPE}"
+ARTIFACT_NAME="${ARTIFACT_PREFIX}-${NAME}"
+
 # Export vars for yq env()
 export RES_NAME="$NAME"
-export PREFIX="$NAME-"
-if [ "$SOURCE_NAME" == "cozystack-extra" ]; then
+# For packages/extra, prefix should be empty; for packages/apps, prefix is "${NAME}-"
+if [[ "$PACKAGE_TYPE" == "extra" ]]; then
   export PREFIX=""
+else
+  export PREFIX="${NAME}-"
 fi
 export DESCRIPTION="$DESC"
 export ICON_B64="$ICON_B64"
-export SOURCE_NAME="$SOURCE_NAME"
+export ARTIFACT_NAME="$ARTIFACT_NAME"
 export SCHEMA_JSON_MIN="$(jq -c . "$SCHEMA_JSON")"
 
 # Generate keysOrder from values.yaml
@@ -114,6 +148,12 @@ export KEYS_ORDER="$(
   '
 )"
 
+# Remove lines with cozystack.build-values before updating (Helm template syntax breaks yq parsing)
+if [[ -f "$OUT" && -n "$OUT" ]]; then
+  # Use grep to filter out the line, more reliable than sed
+  grep -v 'cozystack\.build-values' "$OUT" > "${OUT}.tmp" && mv "${OUT}.tmp" "$OUT"
+fi
+
 # Update only necessary fields in-place
 # - openAPISchema is loaded from file as a multi-line string (block scalar)
 # - labels ensure cozystack.io/ui: "true"
@@ -121,19 +161,26 @@ export KEYS_ORDER="$(
 # - sourceRef derived from directory (apps|extra)
 yq -i '
   .apiVersion = (.apiVersion // "cozystack.io/v1alpha1") |
-  .kind       = (.kind       // "CozystackResourceDefinition") |
+  .kind       = (.kind       // "ApplicationDefinition") |
   .metadata.name = strenv(RES_NAME) |
   .spec.application.openAPISchema = strenv(SCHEMA_JSON_MIN) |
   (.spec.application.openAPISchema style="literal") |
   .spec.release.prefix = (strenv(PREFIX)) |
   .spec.release.labels."cozystack.io/ui" = "true" |
-  .spec.release.chart.name = strenv(RES_NAME) |
-  .spec.release.chart.sourceRef.kind = "HelmRepository" |
-  .spec.release.chart.sourceRef.name = strenv(SOURCE_NAME) |
-  .spec.release.chart.sourceRef.namespace = "cozy-public" |
+  del(.spec.release.chart) |
+  .spec.release.chartRef.sourceRef.kind = "ExternalArtifact" |
+  .spec.release.chartRef.sourceRef.name = strenv(ARTIFACT_NAME) |
+  .spec.release.chartRef.sourceRef.namespace = "cozy-system" |
   .spec.dashboard.description = strenv(DESCRIPTION) |
   .spec.dashboard.icon = strenv(ICON_B64) |
   .spec.dashboard.keysOrder = env(KEYS_ORDER)
 ' "$OUT"
 
+# Add back the Helm template line after _cozystack
+if [[ -f "$OUT" && -n "$OUT" ]]; then
+  HELM_TEMPLATE='        {{- include "cozystack.build-values" . | nindent 8 }}'
+  # Use awk for more reliable insertion
+  awk -v template="$HELM_TEMPLATE" '/_cozystack:/ {print; print template; next} {print}' "$OUT" > "${OUT}.tmp" && mv "${OUT}.tmp" "$OUT"
+fi
+
 echo "Updated $OUT"

internal/backupcontroller/backupjob_controller.go

@@ -1,53 +0,0 @@
-package backupcontroller
-
-import (
-	"context"
-
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/types"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-
-	strategyv1alpha1 "github.com/cozystack/cozystack/api/backups/strategy/v1alpha1"
-	backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1"
-)
-
-// BackupVeleroStrategyReconciler reconciles BackupJob with a strategy referencing
-// Velero.strategy.backups.cozystack.io objects.
-type BackupJobReconciler struct {
-	client.Client
-	Scheme *runtime.Scheme
-}
-
-func (r *BackupJobReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
-	_ = log.FromContext(ctx)
-	j := &backupsv1alpha1.BackupJob{}
-	err := r.Get(ctx, types.NamespacedName{Namespace: req.Namespace, Name: req.Name}, j)
-	if err != nil {
-		if apierrors.IsNotFound(err) {
-			return ctrl.Result{}, nil
-		}
-		return ctrl.Result{}, err
-	}
-	if j.Spec.StrategyRef.APIGroup == nil || *j.Spec.StrategyRef.APIGroup != strategyv1alpha1.GroupVersion.Group {
-		return ctrl.Result{}, nil
-	}
-	switch j.Spec.StrategyRef.Kind {
-	case strategyv1alpha1.JobStrategyKind:
-		return r.reconcileJob(ctx, j)
-	case strategyv1alpha1.VeleroStrategyKind:
-		return r.reconcileVelero(ctx, j)
-	default:
-		return ctrl.Result{}, nil
-	}
-
-}
-
-// SetupWithManager registers our controller with the Manager and sets up watches.
-func (r *BackupJobReconciler) SetupWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewControllerManagedBy(mgr).
-		For(&backupsv1alpha1.BackupJob{}).
-		Complete(r)
-}

internal/backupcontroller/factory/backupjob.go

@@ -1,28 +0,0 @@
-package factory
-
-import (
-	"fmt"
-	"time"
-
-	backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1"
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-func BackupJob(p *backupsv1alpha1.Plan, scheduledFor time.Time) *backupsv1alpha1.BackupJob {
-	job := &backupsv1alpha1.BackupJob{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      fmt.Sprintf("%s-%d", p.Name, scheduledFor.Unix()/60),
-			Namespace: p.Namespace,
-		},
-		Spec: backupsv1alpha1.BackupJobSpec{
-			PlanRef: &corev1.LocalObjectReference{
-				Name: p.Name,
-			},
-			ApplicationRef: *p.Spec.ApplicationRef.DeepCopy(),
-			StorageRef:     *p.Spec.StorageRef.DeepCopy(),
-			StrategyRef:    *p.Spec.StrategyRef.DeepCopy(),
-		},
-	}
-	return job
-}

internal/backupcontroller/jobstrategy_controller.go

@@ -1,15 +0,0 @@
-package backupcontroller
-
-import (
-	"context"
-
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-
-	backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1"
-)
-
-func (r *BackupJobReconciler) reconcileJob(ctx context.Context, j *backupsv1alpha1.BackupJob) (ctrl.Result, error) {
-	_ = log.FromContext(ctx)
-	return ctrl.Result{}, nil
-}

internal/backupcontroller/plan_controller.go

@@ -1,104 +0,0 @@
-package backupcontroller
-
-import (
-	"context"
-	"fmt"
-	"time"
-
-	cron "github.com/robfig/cron/v3"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/api/meta"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-
-	backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1"
-	"github.com/cozystack/cozystack/internal/backupcontroller/factory"
-)
-
-const (
-	minRequeueDelay         = 30 * time.Second
-	startingDeadlineSeconds = 300 * time.Second
-)
-
-// PlanReconciler reconciles a Plan object
-type PlanReconciler struct {
-	client.Client
-	Scheme *runtime.Scheme
-}
-
-func (r *PlanReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
-	log := log.FromContext(ctx)
-
-	log.V(2).Info("reconciling")
-
-	p := &backupsv1alpha1.Plan{}
-
-	if err := r.Get(ctx, client.ObjectKey{Namespace: req.Namespace, Name: req.Name}, p); err != nil {
-		if apierrors.IsNotFound(err) {
-			log.V(3).Info("Plan not found")
-			return ctrl.Result{}, nil
-		}
-		return ctrl.Result{}, err
-	}
-
-	tCheck := time.Now().Add(-startingDeadlineSeconds)
-	sch, err := cron.ParseStandard(p.Spec.Schedule.Cron)
-	if err != nil {
-		errWrapped := fmt.Errorf("could not parse cron %s: %w", p.Spec.Schedule.Cron, err)
-		log.Error(err, "could not parse cron", "cron", p.Spec.Schedule.Cron)
-		meta.SetStatusCondition(&p.Status.Conditions, metav1.Condition{
-			Type:    backupsv1alpha1.PlanConditionError,
-			Status:  metav1.ConditionTrue,
-			Reason:  "Failed to parse cron spec",
-			Message: errWrapped.Error(),
-		})
-		if err := r.Status().Update(ctx, p); err != nil {
-			return ctrl.Result{}, err
-		}
-		return ctrl.Result{}, nil
-	}
-
-	// Clear error condition if cron parsing succeeds
-	if condition := meta.FindStatusCondition(p.Status.Conditions, backupsv1alpha1.PlanConditionError); condition != nil && condition.Status == metav1.ConditionTrue {
-		meta.SetStatusCondition(&p.Status.Conditions, metav1.Condition{
-			Type:    backupsv1alpha1.PlanConditionError,
-			Status:  metav1.ConditionFalse,
-			Reason:  "Cron spec is valid",
-			Message: "The cron schedule has been successfully parsed",
-		})
-		if err := r.Status().Update(ctx, p); err != nil {
-			return ctrl.Result{}, err
-		}
-	}
-
-	tNext := sch.Next(tCheck)
-
-	if time.Now().Before(tNext) {
-		return ctrl.Result{RequeueAfter: tNext.Sub(time.Now())}, nil
-	}
-
-	job := factory.BackupJob(p, tNext)
-	if err := controllerutil.SetControllerReference(p, job, r.Scheme); err != nil {
-		return ctrl.Result{}, err
-	}
-
-	if err := r.Create(ctx, job); err != nil {
-		if apierrors.IsAlreadyExists(err) {
-			return ctrl.Result{RequeueAfter: startingDeadlineSeconds}, nil
-		}
-		return ctrl.Result{}, err
-	}
-
-	return ctrl.Result{RequeueAfter: startingDeadlineSeconds}, nil
-}
-
-// SetupWithManager registers our controller with the Manager and sets up watches.
-func (r *PlanReconciler) SetupWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewControllerManagedBy(mgr).
-		For(&backupsv1alpha1.Plan{}).
-		Complete(r)
-}

internal/backupcontroller/velerostrategy_controller.go

@@ -1,15 +0,0 @@
-package backupcontroller
-
-import (
-	"context"
-
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-
-	backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1"
-)
-
-func (r *BackupJobReconciler) reconcileVelero(ctx context.Context, j *backupsv1alpha1.BackupJob) (ctrl.Result, error) {
-	_ = log.FromContext(ctx)
-	return ctrl.Result{}, nil
-}

internal/controller/applicationdefinition_controller.go

@@ -0,0 +1,502 @@
+package controller
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"slices"
+	"sync"
+	"time"
+
+	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
+	helmv2 "github.com/fluxcd/helm-controller/api/v2"
+
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
+	"github.com/cozystack/cozystack/pkg/cozylib"
+)
+
+// +kubebuilder:rbac:groups=cozystack.io,resources=applicationdefinitions,verbs=get;list;watch
+// +kubebuilder:rbac:groups=helm.toolkit.fluxcd.io,resources=helmreleases,verbs=get;list;watch;update;patch
+// +kubebuilder:rbac:groups=core,resources=namespaces,verbs=get;list;watch
+type ApplicationDefinitionReconciler struct {
+	client.Client
+	Scheme *runtime.Scheme
+
+	Debounce time.Duration
+
+	mu          sync.Mutex
+	lastEvent   time.Time
+	lastHandled time.Time
+
+	CozystackAPIKind string
+}
+
+func (r *ApplicationDefinitionReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	logger := log.FromContext(ctx)
+	logger.Info("Reconciling ApplicationDefinitions", "request", req.NamespacedName)
+
+	// Get all ApplicationDefinitions
+	crdList := &cozyv1alpha1.ApplicationDefinitionList{}
+	if err := r.List(ctx, crdList); err != nil {
+		logger.Error(err, "failed to list ApplicationDefinitions")
+		return ctrl.Result{}, err
+	}
+
+	logger.Info("Found ApplicationDefinitions", "count", len(crdList.Items))
+
+	// Update HelmReleases for each CRD
+	for i := range crdList.Items {
+		crd := &crdList.Items[i]
+		logger.V(4).Info("Processing CRD", "crd", crd.Name, "hasValues", crd.Spec.Release.Values != nil)
+		if err := r.updateHelmReleasesForCRD(ctx, crd); err != nil {
+			logger.Error(err, "failed to update HelmReleases for CRD", "crd", crd.Name)
+			// Continue with other CRDs even if one fails
+		}
+	}
+
+	// Continue with debounced restart logic
+	return r.debouncedRestart(ctx)
+}
+
+func (r *ApplicationDefinitionReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	if r.Debounce == 0 {
+		r.Debounce = 5 * time.Second
+	}
+
+	return ctrl.NewControllerManagedBy(mgr).
+		Named("applicationdefinition-controller").
+		Watches(
+			&cozyv1alpha1.ApplicationDefinition{},
+			handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, obj client.Object) []reconcile.Request {
+				r.mu.Lock()
+				r.lastEvent = time.Now()
+				r.mu.Unlock()
+				return []reconcile.Request{{
+					NamespacedName: types.NamespacedName{
+						Namespace: "cozy-system",
+						Name:      "cozystack-api",
+					},
+				}}
+			}),
+		).
+		Watches(
+			&helmv2.HelmRelease{},
+			handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, obj client.Object) []reconcile.Request {
+				hr, ok := obj.(*helmv2.HelmRelease)
+				if !ok {
+					return nil
+				}
+				// Only watch HelmReleases with cozystack.io/ui=true label
+				if hr.Labels == nil || hr.Labels["cozystack.io/ui"] != "true" {
+					return nil
+				}
+				// Trigger reconciliation of all CRDs when a HelmRelease with the label is created/updated
+				r.mu.Lock()
+				r.lastEvent = time.Now()
+				r.mu.Unlock()
+				return []reconcile.Request{{
+					NamespacedName: types.NamespacedName{
+						Namespace: "cozy-system",
+						Name:      "cozystack-api",
+					},
+				}}
+			}),
+		).
+		Complete(r)
+}
+
+type crdHashView struct {
+	Name string                           `json:"name"`
+	Spec cozyv1alpha1.ApplicationDefinitionSpec `json:"spec"`
+}
+
+func (r *ApplicationDefinitionReconciler) computeConfigHash(ctx context.Context) (string, error) {
+	list := &cozyv1alpha1.ApplicationDefinitionList{}
+	if err := r.List(ctx, list); err != nil {
+		return "", err
+	}
+
+	slices.SortFunc(list.Items, sortApplicationDefinitions)
+
+	views := make([]crdHashView, 0, len(list.Items))
+	for i := range list.Items {
+		views = append(views, crdHashView{
+			Name: list.Items[i].Name,
+			Spec: list.Items[i].Spec,
+		})
+	}
+	b, err := json.Marshal(views)
+	if err != nil {
+		return "", err
+	}
+	sum := sha256.Sum256(b)
+	return hex.EncodeToString(sum[:]), nil
+}
+
+func (r *ApplicationDefinitionReconciler) debouncedRestart(ctx context.Context) (ctrl.Result, error) {
+	logger := log.FromContext(ctx)
+
+	r.mu.Lock()
+	le := r.lastEvent
+	lh := r.lastHandled
+	debounce := r.Debounce
+	r.mu.Unlock()
+
+	if debounce <= 0 {
+		debounce = 5 * time.Second
+	}
+	if le.IsZero() {
+		return ctrl.Result{}, nil
+	}
+	if d := time.Since(le); d < debounce {
+		return ctrl.Result{RequeueAfter: debounce - d}, nil
+	}
+	if !lh.Before(le) {
+		return ctrl.Result{}, nil
+	}
+
+	newHash, err := r.computeConfigHash(ctx)
+	if err != nil {
+		return ctrl.Result{}, err
+	}
+
+	tpl, obj, patch, err := r.getWorkload(ctx, types.NamespacedName{Namespace: "cozy-system", Name: "cozystack-api"})
+	if err != nil {
+		return ctrl.Result{}, client.IgnoreNotFound(err)
+	}
+
+	oldHash := tpl.Annotations["cozystack.io/config-hash"]
+
+	if oldHash == newHash && oldHash != "" {
+		r.mu.Lock()
+		r.lastHandled = le
+		r.mu.Unlock()
+		logger.Info("No changes in CRD config; skipping restart", "hash", newHash)
+		return ctrl.Result{}, nil
+	}
+
+	tpl.Annotations["cozystack.io/config-hash"] = newHash
+
+	if err := r.Patch(ctx, obj, patch); err != nil {
+		return ctrl.Result{}, err
+	}
+
+	r.mu.Lock()
+	r.lastHandled = le
+	r.mu.Unlock()
+
+	logger.Info("Updated cozystack-api podTemplate config-hash; rollout triggered",
+		"old", oldHash, "new", newHash)
+	return ctrl.Result{}, nil
+}
+
+func (r *ApplicationDefinitionReconciler) getWorkload(
+	ctx context.Context,
+	key types.NamespacedName,
+) (tpl *corev1.PodTemplateSpec, obj client.Object, patch client.Patch, err error) {
+	if r.CozystackAPIKind == "Deployment" {
+		dep := &appsv1.Deployment{}
+		if err := r.Get(ctx, key, dep); err != nil {
+			return nil, nil, nil, err
+		}
+		obj = dep
+		tpl = &dep.Spec.Template
+		patch = client.MergeFrom(dep.DeepCopy())
+	} else {
+		ds := &appsv1.DaemonSet{}
+		if err := r.Get(ctx, key, ds); err != nil {
+			return nil, nil, nil, err
+		}
+		obj = ds
+		tpl = &ds.Spec.Template
+		patch = client.MergeFrom(ds.DeepCopy())
+	}
+	if tpl.Annotations == nil {
+		tpl.Annotations = make(map[string]string)
+	}
+	return tpl, obj, patch, nil
+}
+
+func sortApplicationDefinitions(a, b cozyv1alpha1.ApplicationDefinition) int {
+	if a.Name == b.Name {
+		return 0
+	}
+	if a.Name < b.Name {
+		return -1
+	}
+	return 1
+}
+
+// updateHelmReleasesForCRD updates all HelmReleases that match the application labels from ApplicationDefinition
+func (r *ApplicationDefinitionReconciler) updateHelmReleasesForCRD(ctx context.Context, crd *cozyv1alpha1.ApplicationDefinition) error {
+	logger := log.FromContext(ctx)
+
+	// Use application labels to find HelmReleases
+	// Labels: apps.cozystack.io/application.kind and apps.cozystack.io/application.group
+	applicationKind := crd.Spec.Application.Kind
+	applicationGroup := "apps.cozystack.io" // All applications use this group
+
+	// Build label selector for HelmReleases
+	// Only reconcile HelmReleases with cozystack.io/ui=true label
+	labelSelector := client.MatchingLabels{
+		"apps.cozystack.io/application.kind":  applicationKind,
+		"apps.cozystack.io/application.group": applicationGroup,
+		"cozystack.io/ui":                      "true",
+	}
+
+	// List all HelmReleases with matching labels
+	hrList := &helmv2.HelmReleaseList{}
+	if err := r.List(ctx, hrList, labelSelector); err != nil {
+		logger.Error(err, "failed to list HelmReleases", "kind", applicationKind, "group", applicationGroup)
+		return err
+	}
+
+	logger.Info("Found HelmReleases to update", "crd", crd.Name, "kind", applicationKind, "count", len(hrList.Items), "hasValues", crd.Spec.Release.Values != nil)
+	if crd.Spec.Release.Values != nil {
+		logger.V(4).Info("CRD has values", "crd", crd.Name, "valuesSize", len(crd.Spec.Release.Values.Raw))
+	}
+
+	// Log each HelmRelease that will be updated
+	for i := range hrList.Items {
+		hr := &hrList.Items[i]
+		logger.V(4).Info("Processing HelmRelease", "name", hr.Name, "namespace", hr.Namespace, "kind", applicationKind)
+	}
+
+	// Update each HelmRelease
+	for i := range hrList.Items {
+		hr := &hrList.Items[i]
+		if err := r.updateHelmReleaseChart(ctx, hr, crd); err != nil {
+			logger.Error(err, "failed to update HelmRelease", "name", hr.Name, "namespace", hr.Namespace)
+			continue
+		}
+	}
+
+	return nil
+}
+
+// updateHelmReleaseChart updates the chart/chartRef and values in HelmRelease based on ApplicationDefinition
+func (r *ApplicationDefinitionReconciler) updateHelmReleaseChart(ctx context.Context, hr *helmv2.HelmRelease, crd *cozyv1alpha1.ApplicationDefinition) error {
+	logger := log.FromContext(ctx)
+	updated := false
+	hrCopy := hr.DeepCopy()
+
+	// Update based on Chart or ChartRef configuration
+	if crd.Spec.Release.Chart != nil {
+		// Using Chart (HelmRepository)
+		if hrCopy.Spec.Chart == nil {
+			// Need to create Chart spec
+			hrCopy.Spec.Chart = &helmv2.HelmChartTemplate{
+				Spec: helmv2.HelmChartTemplateSpec{
+					Chart: crd.Spec.Release.Chart.Name,
+					SourceRef: helmv2.CrossNamespaceObjectReference{
+						Kind:      crd.Spec.Release.Chart.SourceRef.Kind,
+						Name:      crd.Spec.Release.Chart.SourceRef.Name,
+						Namespace: crd.Spec.Release.Chart.SourceRef.Namespace,
+					},
+				},
+			}
+			// Clear ChartRef if it exists
+			hrCopy.Spec.ChartRef = nil
+			updated = true
+		} else {
+			// Update existing Chart spec
+			if hrCopy.Spec.Chart.Spec.Chart != crd.Spec.Release.Chart.Name ||
+				hrCopy.Spec.Chart.Spec.SourceRef.Kind != crd.Spec.Release.Chart.SourceRef.Kind ||
+				hrCopy.Spec.Chart.Spec.SourceRef.Name != crd.Spec.Release.Chart.SourceRef.Name ||
+				hrCopy.Spec.Chart.Spec.SourceRef.Namespace != crd.Spec.Release.Chart.SourceRef.Namespace {
+				hrCopy.Spec.Chart.Spec.Chart = crd.Spec.Release.Chart.Name
+				hrCopy.Spec.Chart.Spec.SourceRef = helmv2.CrossNamespaceObjectReference{
+					Kind:      crd.Spec.Release.Chart.SourceRef.Kind,
+					Name:      crd.Spec.Release.Chart.SourceRef.Name,
+					Namespace: crd.Spec.Release.Chart.SourceRef.Namespace,
+				}
+				// Clear ChartRef if it exists
+				hrCopy.Spec.ChartRef = nil
+				updated = true
+			}
+		}
+	} else if crd.Spec.Release.ChartRef != nil {
+		// Using ChartRef (ExternalArtifact)
+		expectedChartRef := &helmv2.CrossNamespaceSourceReference{
+			Kind:      "ExternalArtifact",
+			Name:      crd.Spec.Release.ChartRef.SourceRef.Name,
+			Namespace: crd.Spec.Release.ChartRef.SourceRef.Namespace,
+		}
+
+		if hrCopy.Spec.ChartRef == nil {
+			// Need to create ChartRef
+			hrCopy.Spec.ChartRef = expectedChartRef
+			// Clear Chart if it exists
+			hrCopy.Spec.Chart = nil
+			updated = true
+		} else {
+			// Update existing ChartRef
+			if hrCopy.Spec.ChartRef.Kind != expectedChartRef.Kind ||
+				hrCopy.Spec.ChartRef.Name != expectedChartRef.Name ||
+				hrCopy.Spec.ChartRef.Namespace != expectedChartRef.Namespace {
+				hrCopy.Spec.ChartRef = expectedChartRef
+				// Clear Chart if it exists
+				hrCopy.Spec.Chart = nil
+				updated = true
+			}
+		}
+	}
+
+	// Update Values from CRD if specified
+	var mergedValues *apiextensionsv1.JSON
+	var err error
+	if crd.Spec.Release.Values != nil {
+		logger.V(4).Info("Merging values from CRD", "name", hr.Name, "namespace", hr.Namespace, "crd", crd.Name)
+		mergedValues, err = cozylib.MergeValuesWithCRDPriority(crd.Spec.Release.Values, hrCopy.Spec.Values)
+		if err != nil {
+			logger.Error(err, "failed to merge values", "name", hr.Name, "namespace", hr.Namespace)
+			return fmt.Errorf("failed to merge values: %w", err)
+		}
+	} else {
+		// Even if CRD has no values, we still need to ensure _namespace is set
+		mergedValues = hrCopy.Spec.Values
+	}
+
+	// Always inject namespace annotations (top-level _namespace field)
+	// This matches the behavior in cozystack-api and NamespaceHelmReconciler
+	namespace := &corev1.Namespace{}
+	if err := r.Get(ctx, client.ObjectKey{Name: hrCopy.Namespace}, namespace); err == nil {
+		mergedValues, err = cozylib.InjectNamespaceAnnotationsIntoValues(mergedValues, namespace)
+		if err != nil {
+			logger.Error(err, "failed to inject namespace annotations", "name", hr.Name, "namespace", hr.Namespace)
+			// Continue even if namespace annotations injection fails
+		}
+	}
+
+	// Always update values to ensure _cozystack and _namespace are applied
+	// This ensures that CRD values (especially _cozystack and _namespace) are always applied
+	// We always update to ensure CRD values are propagated, even if they appear equal
+	// This is important because JSON comparison might not catch all differences (e.g., field order)
+	if crd.Spec.Release.Values != nil || mergedValues != hrCopy.Spec.Values {
+		hrCopy.Spec.Values = mergedValues
+		updated = true
+		if crd.Spec.Release.Values != nil {
+			logger.Info("Updated values from CRD", "name", hr.Name, "namespace", hr.Namespace, "crd", crd.Name)
+		} else {
+			logger.V(4).Info("Updated values with namespace labels", "name", hr.Name, "namespace", hr.Namespace, "crd", crd.Name)
+		}
+	} else {
+		logger.V(4).Info("No values update needed", "name", hr.Name, "namespace", hr.Namespace, "crd", crd.Name)
+	}
+
+	if !updated {
+		return nil
+	}
+
+	// Update the HelmRelease
+	patch := client.MergeFrom(hr.DeepCopy())
+	if err := r.Patch(ctx, hrCopy, patch); err != nil {
+		return err
+	}
+
+	logger.Info("Updated HelmRelease", "name", hr.Name, "namespace", hr.Namespace, "crd", crd.Name)
+	return nil
+}
+
+// mergeHelmReleaseValues merges CRD default values with existing HelmRelease values
+// All fields are merged except "_cozystack" and "_namespace" which are fully overwritten from CRD values
+// Existing HelmRelease values (outside of _cozystack and _namespace) take precedence (user values override defaults)
+func (r *ApplicationDefinitionReconciler) mergeHelmReleaseValues(crdValues, existingValues *apiextensionsv1.JSON) (*apiextensionsv1.JSON, error) {
+	// If CRD has no values, preserve existing
+	if crdValues == nil || len(crdValues.Raw) == 0 {
+		return existingValues, nil
+	}
+
+	// If existing has no values, use CRD values
+	if existingValues == nil || len(existingValues.Raw) == 0 {
+		return crdValues, nil
+	}
+
+	var crdMap, existingMap map[string]interface{}
+
+	// Parse CRD values (defaults)
+	if err := json.Unmarshal(crdValues.Raw, &crdMap); err != nil {
+		return nil, fmt.Errorf("failed to unmarshal CRD values: %w", err)
+	}
+
+	// Parse existing HelmRelease values
+	if err := json.Unmarshal(existingValues.Raw, &existingMap); err != nil {
+		return nil, fmt.Errorf("failed to unmarshal existing values: %w", err)
+	}
+
+	// Start with existing values as base (user values take priority)
+	// Then merge CRD values on top, but _cozystack and _namespace from CRD completely overwrite
+	merged := deepMergeMaps(existingMap, crdMap)
+
+	// Explicitly handle "_cozystack" field: CRD values completely overwrite existing
+	// This ensures _cozystack field from CRD is always used, even if user modified it
+	if crdCozystack, exists := crdMap["_cozystack"]; exists {
+		merged["_cozystack"] = crdCozystack
+	}
+
+	// Explicitly handle "_namespace" field: CRD values completely overwrite existing
+	// This ensures _namespace field from CRD is always used, even if user modified it
+	if crdNamespace, exists := crdMap["_namespace"]; exists {
+		merged["_namespace"] = crdNamespace
+	}
+
+	mergedJSON, err := json.Marshal(merged)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal merged values: %w", err)
+	}
+
+	return &apiextensionsv1.JSON{Raw: mergedJSON}, nil
+}
+
+// deepMergeMaps performs a deep merge of two maps
+func deepMergeMaps(base, override map[string]interface{}) map[string]interface{} {
+	result := make(map[string]interface{})
+
+	// Copy base map
+	for k, v := range base {
+		result[k] = v
+	}
+
+	// Merge override map
+	for k, v := range override {
+		if baseVal, exists := result[k]; exists {
+			// If both are maps, recursively merge
+			if baseMap, ok := baseVal.(map[string]interface{}); ok {
+				if overrideMap, ok := v.(map[string]interface{}); ok {
+					result[k] = deepMergeMaps(baseMap, overrideMap)
+					continue
+				}
+			}
+		}
+		// Override takes precedence
+		result[k] = v
+	}
+
+	return result
+}
+
+// valuesEqual compares two JSON values for equality
+func valuesEqual(a, b *apiextensionsv1.JSON) bool {
+	if a == nil && b == nil {
+		return true
+	}
+	if a == nil || b == nil {
+		return false
+	}
+	// Simple byte comparison (could be improved with canonical JSON)
+	return string(a.Raw) == string(b.Raw)
+}
+

internal/controller/cozystackresource_controller.go

@@ -1,189 +0,0 @@
-package controller
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"slices"
-	"sync"
-	"time"
-
-	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
-
-	appsv1 "k8s.io/api/apps/v1"
-	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/types"
-
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/handler"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-	"sigs.k8s.io/controller-runtime/pkg/reconcile"
-)
-
-type CozystackResourceDefinitionReconciler struct {
-	client.Client
-	Scheme *runtime.Scheme
-
-	Debounce time.Duration
-
-	mu          sync.Mutex
-	lastEvent   time.Time
-	lastHandled time.Time
-
-	CozystackAPIKind string
-}
-
-func (r *CozystackResourceDefinitionReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
-	// Only handle debounced restart logic
-	// HelmRelease reconciliation is handled by CozystackResourceDefinitionHelmReconciler
-	return r.debouncedRestart(ctx)
-}
-
-func (r *CozystackResourceDefinitionReconciler) SetupWithManager(mgr ctrl.Manager) error {
-	if r.Debounce == 0 {
-		r.Debounce = 5 * time.Second
-	}
-
-	return ctrl.NewControllerManagedBy(mgr).
-		Named("cozystackresource-controller").
-		Watches(
-			&cozyv1alpha1.CozystackResourceDefinition{},
-			handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, obj client.Object) []reconcile.Request {
-				r.mu.Lock()
-				r.lastEvent = time.Now()
-				r.mu.Unlock()
-				return []reconcile.Request{{
-					NamespacedName: types.NamespacedName{
-						Namespace: "cozy-system",
-						Name:      "cozystack-api",
-					},
-				}}
-			}),
-		).
-		Complete(r)
-}
-
-type crdHashView struct {
-	Name string                                       `json:"name"`
-	Spec cozyv1alpha1.CozystackResourceDefinitionSpec `json:"spec"`
-}
-
-func (r *CozystackResourceDefinitionReconciler) computeConfigHash(ctx context.Context) (string, error) {
-	list := &cozyv1alpha1.CozystackResourceDefinitionList{}
-	if err := r.List(ctx, list); err != nil {
-		return "", err
-	}
-
-	slices.SortFunc(list.Items, sortCozyRDs)
-
-	views := make([]crdHashView, 0, len(list.Items))
-	for i := range list.Items {
-		views = append(views, crdHashView{
-			Name: list.Items[i].Name,
-			Spec: list.Items[i].Spec,
-		})
-	}
-	b, err := json.Marshal(views)
-	if err != nil {
-		return "", err
-	}
-	sum := sha256.Sum256(b)
-	return hex.EncodeToString(sum[:]), nil
-}
-
-func (r *CozystackResourceDefinitionReconciler) debouncedRestart(ctx context.Context) (ctrl.Result, error) {
-	logger := log.FromContext(ctx)
-
-	r.mu.Lock()
-	le := r.lastEvent
-	lh := r.lastHandled
-	debounce := r.Debounce
-	r.mu.Unlock()
-
-	if debounce <= 0 {
-		debounce = 5 * time.Second
-	}
-	if le.IsZero() {
-		return ctrl.Result{}, nil
-	}
-	if d := time.Since(le); d < debounce {
-		return ctrl.Result{RequeueAfter: debounce - d}, nil
-	}
-	if !lh.Before(le) {
-		return ctrl.Result{}, nil
-	}
-
-	newHash, err := r.computeConfigHash(ctx)
-	if err != nil {
-		return ctrl.Result{}, err
-	}
-
-	tpl, obj, patch, err := r.getWorkload(ctx, types.NamespacedName{Namespace: "cozy-system", Name: "cozystack-api"})
-	if err != nil {
-		return ctrl.Result{}, client.IgnoreNotFound(err)
-	}
-
-	oldHash := tpl.Annotations["cozystack.io/config-hash"]
-
-	if oldHash == newHash && oldHash != "" {
-		r.mu.Lock()
-		r.lastHandled = le
-		r.mu.Unlock()
-		logger.Info("No changes in CRD config; skipping restart", "hash", newHash)
-		return ctrl.Result{}, nil
-	}
-
-	tpl.Annotations["cozystack.io/config-hash"] = newHash
-
-	if err := r.Patch(ctx, obj, patch); err != nil {
-		return ctrl.Result{}, err
-	}
-
-	r.mu.Lock()
-	r.lastHandled = le
-	r.mu.Unlock()
-
-	logger.Info("Updated cozystack-api podTemplate config-hash; rollout triggered",
-		"old", oldHash, "new", newHash)
-	return ctrl.Result{}, nil
-}
-
-func (r *CozystackResourceDefinitionReconciler) getWorkload(
-	ctx context.Context,
-	key types.NamespacedName,
-) (tpl *corev1.PodTemplateSpec, obj client.Object, patch client.Patch, err error) {
-	if r.CozystackAPIKind == "Deployment" {
-		dep := &appsv1.Deployment{}
-		if err := r.Get(ctx, key, dep); err != nil {
-			return nil, nil, nil, err
-		}
-		obj = dep
-		tpl = &dep.Spec.Template
-		patch = client.MergeFrom(dep.DeepCopy())
-	} else {
-		ds := &appsv1.DaemonSet{}
-		if err := r.Get(ctx, key, ds); err != nil {
-			return nil, nil, nil, err
-		}
-		obj = ds
-		tpl = &ds.Spec.Template
-		patch = client.MergeFrom(ds.DeepCopy())
-	}
-	if tpl.Annotations == nil {
-		tpl.Annotations = make(map[string]string)
-	}
-	return tpl, obj, patch, nil
-}
-
-func sortCozyRDs(a, b cozyv1alpha1.CozystackResourceDefinition) int {
-	if a.Name == b.Name {
-		return 0
-	}
-	if a.Name < b.Name {
-		return -1
-	}
-	return 1
-}

internal/controller/cozystackresourcedefinition_helmreconciler.go

@@ -1,166 +0,0 @@
-package controller
-
-import (
-	"context"
-	"fmt"
-
-	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
-	helmv2 "github.com/fluxcd/helm-controller/api/v2"
-
-	"k8s.io/apimachinery/pkg/runtime"
-
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-)
-
-// +kubebuilder:rbac:groups=cozystack.io,resources=cozystackresourcedefinitions,verbs=get;list;watch
-// +kubebuilder:rbac:groups=helm.toolkit.fluxcd.io,resources=helmreleases,verbs=get;list;watch;update;patch
-
-// CozystackResourceDefinitionHelmReconciler reconciles CozystackResourceDefinitions
-// and updates related HelmReleases when a CozyRD changes.
-// This controller does NOT watch HelmReleases to avoid mutual reconciliation storms
-// with Flux's helm-controller.
-type CozystackResourceDefinitionHelmReconciler struct {
-	client.Client
-	Scheme *runtime.Scheme
-}
-
-func (r *CozystackResourceDefinitionHelmReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
-	logger := log.FromContext(ctx)
-
-	// Get the CozystackResourceDefinition that triggered this reconciliation
-	crd := &cozyv1alpha1.CozystackResourceDefinition{}
-	if err := r.Get(ctx, req.NamespacedName, crd); err != nil {
-		logger.Error(err, "failed to get CozystackResourceDefinition", "name", req.Name)
-		return ctrl.Result{}, client.IgnoreNotFound(err)
-	}
-
-	// Update HelmReleases related to this specific CozyRD
-	if err := r.updateHelmReleasesForCRD(ctx, crd); err != nil {
-		logger.Error(err, "failed to update HelmReleases for CRD", "crd", crd.Name)
-		return ctrl.Result{}, err
-	}
-
-	return ctrl.Result{}, nil
-}
-
-func (r *CozystackResourceDefinitionHelmReconciler) SetupWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewControllerManagedBy(mgr).
-		Named("cozystackresourcedefinition-helm-reconciler").
-		For(&cozyv1alpha1.CozystackResourceDefinition{}).
-		Complete(r)
-}
-
-// updateHelmReleasesForCRD updates all HelmReleases that match the application labels from CozystackResourceDefinition
-func (r *CozystackResourceDefinitionHelmReconciler) updateHelmReleasesForCRD(ctx context.Context, crd *cozyv1alpha1.CozystackResourceDefinition) error {
-	logger := log.FromContext(ctx)
-
-	// Use application labels to find HelmReleases
-	// Labels: apps.cozystack.io/application.kind and apps.cozystack.io/application.group
-	applicationKind := crd.Spec.Application.Kind
-
-	// Validate that applicationKind is non-empty
-	if applicationKind == "" {
-		logger.V(4).Info("Skipping HelmRelease update: Application.Kind is empty", "crd", crd.Name)
-		return nil
-	}
-
-	applicationGroup := "apps.cozystack.io" // All applications use this group
-
-	// Build label selector for HelmReleases
-	// Only reconcile HelmReleases with cozystack.io/ui=true label
-	labelSelector := client.MatchingLabels{
-		"apps.cozystack.io/application.kind":  applicationKind,
-		"apps.cozystack.io/application.group": applicationGroup,
-		"cozystack.io/ui":                      "true",
-	}
-
-	// List all HelmReleases with matching labels
-	hrList := &helmv2.HelmReleaseList{}
-	if err := r.List(ctx, hrList, labelSelector); err != nil {
-		logger.Error(err, "failed to list HelmReleases", "kind", applicationKind, "group", applicationGroup)
-		return err
-	}
-
-	logger.V(4).Info("Found HelmReleases to update", "crd", crd.Name, "kind", applicationKind, "count", len(hrList.Items))
-
-	// Update each HelmRelease
-	for i := range hrList.Items {
-		hr := &hrList.Items[i]
-		if err := r.updateHelmReleaseChart(ctx, hr, crd); err != nil {
-			logger.Error(err, "failed to update HelmRelease", "name", hr.Name, "namespace", hr.Namespace)
-			continue
-		}
-	}
-
-	return nil
-}
-
-// updateHelmReleaseChart updates the chart in HelmRelease based on CozystackResourceDefinition
-func (r *CozystackResourceDefinitionHelmReconciler) updateHelmReleaseChart(ctx context.Context, hr *helmv2.HelmRelease, crd *cozyv1alpha1.CozystackResourceDefinition) error {
-	logger := log.FromContext(ctx)
-	hrCopy := hr.DeepCopy()
-	updated := false
-
-	// Validate Chart configuration exists
-	if crd.Spec.Release.Chart.Name == "" {
-		logger.V(4).Info("Skipping HelmRelease chart update: Chart.Name is empty", "crd", crd.Name)
-		return nil
-	}
-
-	// Validate SourceRef fields
-	if crd.Spec.Release.Chart.SourceRef.Kind == "" ||
-		crd.Spec.Release.Chart.SourceRef.Name == "" ||
-		crd.Spec.Release.Chart.SourceRef.Namespace == "" {
-		logger.Error(fmt.Errorf("invalid SourceRef in CRD"), "Skipping HelmRelease chart update: SourceRef fields are incomplete",
-			"crd", crd.Name,
-			"kind", crd.Spec.Release.Chart.SourceRef.Kind,
-			"name", crd.Spec.Release.Chart.SourceRef.Name,
-			"namespace", crd.Spec.Release.Chart.SourceRef.Namespace)
-		return nil
-	}
-
-	// Get version and reconcileStrategy from CRD or use defaults
-	version := ">= 0.0.0-0"
-	reconcileStrategy := "Revision"
-	// TODO: Add Version and ReconcileStrategy fields to CozystackResourceDefinitionChart if needed
-
-	// Build expected SourceRef
-	expectedSourceRef := helmv2.CrossNamespaceObjectReference{
-		Kind:      crd.Spec.Release.Chart.SourceRef.Kind,
-		Name:      crd.Spec.Release.Chart.SourceRef.Name,
-		Namespace: crd.Spec.Release.Chart.SourceRef.Namespace,
-	}
-
-	if hrCopy.Spec.Chart == nil {
-		// Need to create Chart spec
-		hrCopy.Spec.Chart = &helmv2.HelmChartTemplate{
-			Spec: helmv2.HelmChartTemplateSpec{
-				Chart:             crd.Spec.Release.Chart.Name,
-				Version:           version,
-				ReconcileStrategy: reconcileStrategy,
-				SourceRef:         expectedSourceRef,
-			},
-		}
-		updated = true
-	} else {
-		// Update existing Chart spec
-		if hrCopy.Spec.Chart.Spec.Chart != crd.Spec.Release.Chart.Name ||
-			hrCopy.Spec.Chart.Spec.SourceRef != expectedSourceRef {
-			hrCopy.Spec.Chart.Spec.Chart = crd.Spec.Release.Chart.Name
-			hrCopy.Spec.Chart.Spec.SourceRef = expectedSourceRef
-			updated = true
-		}
-	}
-
-	if updated {
-		logger.V(4).Info("Updating HelmRelease chart", "name", hr.Name, "namespace", hr.Namespace)
-		if err := r.Update(ctx, hrCopy); err != nil {
-			return fmt.Errorf("failed to update HelmRelease: %w", err)
-		}
-	}
-
-	return nil
-}
-

internal/controller/dashboard/breadcrumb.go

@@ -14,7 +14,7 @@ import (
 )
 
 // ensureBreadcrumb creates or updates a Breadcrumb resource for the given CRD
-func (m *Manager) ensureBreadcrumb(ctx context.Context, crd *cozyv1alpha1.CozystackResourceDefinition) error {
+func (m *Manager) ensureBreadcrumb(ctx context.Context, crd *cozyv1alpha1.ApplicationDefinition) error {
 	group, version, kind := pickGVK(crd)
 
 	lowerKind := strings.ToLower(kind)

internal/controller/dashboard/customcolumns.go

@@ -21,7 +21,7 @@ import (
 //
 //	metadata.name: stock-namespace-<group>.<version>.<plural>
 //	spec.id:       stock-namespace-/<group>/<version>/<plural>
-func (m *Manager) ensureCustomColumnsOverride(ctx context.Context, crd *cozyv1alpha1.CozystackResourceDefinition) (controllerutil.OperationResult, error) {
+func (m *Manager) ensureCustomColumnsOverride(ctx context.Context, crd *cozyv1alpha1.ApplicationDefinition) (controllerutil.OperationResult, error) {
 	g, v, kind := pickGVK(crd)
 	plural := pickPlural(kind, crd)
 	// Details page segment uses lowercase kind, mirroring your example

internal/controller/dashboard/customformsoverride.go

@@ -15,7 +15,7 @@ import (
 )
 
 // ensureCustomFormsOverride creates or updates a CustomFormsOverride resource for the given CRD
-func (m *Manager) ensureCustomFormsOverride(ctx context.Context, crd *cozyv1alpha1.CozystackResourceDefinition) error {
+func (m *Manager) ensureCustomFormsOverride(ctx context.Context, crd *cozyv1alpha1.ApplicationDefinition) error {
 	g, v, kind := pickGVK(crd)
 	plural := pickPlural(kind, crd)
 
@@ -105,26 +105,8 @@ func buildMultilineStringSchema(openAPISchema string) (map[string]any, error) {
 		"properties": map[string]any{},
 	}
 
-	// Check if there's a spec property
-	specProp, ok := props["spec"].(map[string]any)
-	if !ok {
-		return map[string]any{}, nil
-	}
-
-	specProps, ok := specProp["properties"].(map[string]any)
-	if !ok {
-		return map[string]any{}, nil
-	}
-
-	// Create spec.properties structure in schema
-	schemaProps := schema["properties"].(map[string]any)
-	specSchema := map[string]any{
-		"properties": map[string]any{},
-	}
-	schemaProps["spec"] = specSchema
-
 	// Process spec properties recursively
-	processSpecProperties(specProps, specSchema["properties"].(map[string]any))
+	processSpecProperties(props, schema["properties"].(map[string]any))
 
 	return schema, nil
 }

internal/controller/dashboard/customformsoverride_test.go

@@ -9,46 +9,41 @@ func TestBuildMultilineStringSchema(t *testing.T) {
 	// Test OpenAPI schema with various field types
 	openAPISchema := `{
 		"properties": {
-			"spec": {
+			"simpleString": {
+				"type": "string",
+				"description": "A simple string field"
+			},
+			"stringWithEnum": {
+				"type": "string",
+				"enum": ["option1", "option2"],
+				"description": "String with enum should be skipped"
+			},
+			"numberField": {
+				"type": "number",
+				"description": "Number field should be skipped"
+			},
+			"nestedObject": {
 				"type": "object",
 				"properties": {
-					"simpleString": {
+					"nestedString": {
 						"type": "string",
-						"description": "A simple string field"
+						"description": "Nested string should get multilineString"
 					},
-					"stringWithEnum": {
+					"nestedStringWithEnum": {
 						"type": "string",
-						"enum": ["option1", "option2"],
-						"description": "String with enum should be skipped"
-					},
-					"numberField": {
-						"type": "number",
-						"description": "Number field should be skipped"
-					},
-					"nestedObject": {
-						"type": "object",
-						"properties": {
-							"nestedString": {
-								"type": "string",
-								"description": "Nested string should get multilineString"
-							},
-							"nestedStringWithEnum": {
-								"type": "string",
-								"enum": ["a", "b"],
-								"description": "Nested string with enum should be skipped"
-							}
-						}
-					},
-					"arrayOfObjects": {
-						"type": "array",
-						"items": {
-							"type": "object",
-							"properties": {
-								"itemString": {
-									"type": "string",
-									"description": "String in array item"
-								}
-							}
+						"enum": ["a", "b"],
+						"description": "Nested string with enum should be skipped"
+					}
+				}
+			},
+			"arrayOfObjects": {
+				"type": "array",
+				"items": {
+					"type": "object",
+					"properties": {
+						"itemString": {
+							"type": "string",
+							"description": "String in array item"
 						}
 					}
 				}
@@ -75,44 +70,33 @@ func TestBuildMultilineStringSchema(t *testing.T) {
 		t.Fatal("schema.properties is not a map")
 	}
 
-	// Check spec property exists
-	spec, ok := props["spec"].(map[string]any)
-	if !ok {
-		t.Fatal("spec not found in properties")
-	}
-
-	specProps, ok := spec["properties"].(map[string]any)
-	if !ok {
-		t.Fatal("spec.properties is not a map")
-	}
-
 	// Check simpleString
-	simpleString, ok := specProps["simpleString"].(map[string]any)
+	simpleString, ok := props["simpleString"].(map[string]any)
 	if !ok {
-		t.Fatal("simpleString not found in spec.properties")
+		t.Fatal("simpleString not found in properties")
 	}
 	if simpleString["type"] != "multilineString" {
 		t.Errorf("simpleString should have type multilineString, got %v", simpleString["type"])
 	}
 
 	// Check stringWithEnum should not be present (or should not have multilineString)
-	if stringWithEnum, ok := specProps["stringWithEnum"].(map[string]any); ok {
+	if stringWithEnum, ok := props["stringWithEnum"].(map[string]any); ok {
 		if stringWithEnum["type"] == "multilineString" {
 			t.Error("stringWithEnum should not have multilineString type")
 		}
 	}
 
 	// Check numberField should not be present
-	if numberField, ok := specProps["numberField"].(map[string]any); ok {
+	if numberField, ok := props["numberField"].(map[string]any); ok {
 		if numberField["type"] != nil {
 			t.Error("numberField should not have any type override")
 		}
 	}
 
 	// Check nested object
-	nestedObject, ok := specProps["nestedObject"].(map[string]any)
+	nestedObject, ok := props["nestedObject"].(map[string]any)
 	if !ok {
-		t.Fatal("nestedObject not found in spec.properties")
+		t.Fatal("nestedObject not found in properties")
 	}
 	nestedProps, ok := nestedObject["properties"].(map[string]any)
 	if !ok {
@@ -129,9 +113,9 @@ func TestBuildMultilineStringSchema(t *testing.T) {
 	}
 
 	// Check array of objects
-	arrayOfObjects, ok := specProps["arrayOfObjects"].(map[string]any)
+	arrayOfObjects, ok := props["arrayOfObjects"].(map[string]any)
 	if !ok {
-		t.Fatal("arrayOfObjects not found in spec.properties")
+		t.Fatal("arrayOfObjects not found in properties")
 	}
 	items, ok := arrayOfObjects["items"].(map[string]any)
 	if !ok {

internal/controller/dashboard/customformsprefill.go

@@ -16,7 +16,7 @@ import (
 )
 
 // ensureCustomFormsPrefill creates or updates a CustomFormsPrefill resource for the given CRD
-func (m *Manager) ensureCustomFormsPrefill(ctx context.Context, crd *cozyv1alpha1.CozystackResourceDefinition) (reconcile.Result, error) {
+func (m *Manager) ensureCustomFormsPrefill(ctx context.Context, crd *cozyv1alpha1.ApplicationDefinition) (reconcile.Result, error) {
 	logger := log.FromContext(ctx)
 
 	app := crd.Spec.Application

internal/controller/dashboard/factory.go

@@ -15,7 +15,7 @@ import (
 )
 
 // ensureFactory creates or updates a Factory resource for the given CRD
-func (m *Manager) ensureFactory(ctx context.Context, crd *cozyv1alpha1.CozystackResourceDefinition) error {
+func (m *Manager) ensureFactory(ctx context.Context, crd *cozyv1alpha1.ApplicationDefinition) error {
 	g, v, kind := pickGVK(crd)
 	plural := pickPlural(kind, crd)
 
@@ -557,7 +557,7 @@ type factoryFlags struct {
 
 // factoryFeatureFlags tries several conventional locations so you can evolve the API
 // without breaking the controller. Defaults are false (hidden).
-func factoryFeatureFlags(crd *cozyv1alpha1.CozystackResourceDefinition) factoryFlags {
+func factoryFeatureFlags(crd *cozyv1alpha1.ApplicationDefinition) factoryFlags {
 	var f factoryFlags
 
 	f.Workloads = true

internal/controller/dashboard/helpers.go

@@ -23,7 +23,7 @@ type fieldInfo struct {
 
 // pickGVK tries to read group/version/kind from the CRD. We prefer the "application" section,
 // falling back to other likely fields if your schema differs.
-func pickGVK(crd *cozyv1alpha1.CozystackResourceDefinition) (group, version, kind string) {
+func pickGVK(crd *cozyv1alpha1.ApplicationDefinition) (group, version, kind string) {
 	// Best guess based on your examples:
 	if crd.Spec.Application.Kind != "" {
 		kind = crd.Spec.Application.Kind
@@ -41,7 +41,7 @@ func pickGVK(crd *cozyv1alpha1.CozystackResourceDefinition) (group, version, kin
 }
 
 // pickPlural prefers a field on the CRD if you have it; otherwise do a simple lowercase + "s".
-func pickPlural(kind string, crd *cozyv1alpha1.CozystackResourceDefinition) string {
+func pickPlural(kind string, crd *cozyv1alpha1.ApplicationDefinition) string {
 	// If you have crd.Spec.Application.Plural, prefer it. Example:
 	if crd.Spec.Application.Plural != "" {
 		return crd.Spec.Application.Plural

internal/controller/dashboard/manager.go

@@ -56,7 +56,7 @@ func NewManager(c client.Client, scheme *runtime.Scheme) *Manager {
 func (m *Manager) SetupWithManager(mgr ctrl.Manager) error {
 	if err := ctrl.NewControllerManagedBy(mgr).
 		Named("dashboard-reconciler").
-		For(&cozyv1alpha1.CozystackResourceDefinition{}).
+		For(&cozyv1alpha1.ApplicationDefinition{}).
 		Complete(m); err != nil {
 		return err
 	}
@@ -72,7 +72,7 @@ func (m *Manager) SetupWithManager(mgr ctrl.Manager) error {
 func (m *Manager) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	l := log.FromContext(ctx)
 
-	crd := &cozyv1alpha1.CozystackResourceDefinition{}
+	crd := &cozyv1alpha1.ApplicationDefinition{}
 
 	err := m.Get(ctx, types.NamespacedName{Name: req.Name}, crd)
 	if err != nil {
@@ -99,7 +99,7 @@ func (m *Manager) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result,
 //   - ensureMarketplacePanel      (implemented)
 //   - ensureSidebar               (implemented)
 //   - ensureTableUriMapping 	     (implemented)
-func (m *Manager) EnsureForCRD(ctx context.Context, crd *cozyv1alpha1.CozystackResourceDefinition) (reconcile.Result, error) {
+func (m *Manager) EnsureForCRD(ctx context.Context, crd *cozyv1alpha1.ApplicationDefinition) (reconcile.Result, error) {
 	// Early return if crd.Spec.Dashboard is nil to prevent oscillation
 	if crd.Spec.Dashboard == nil {
 		return reconcile.Result{}, nil
@@ -148,7 +148,7 @@ func (m *Manager) InitializeStaticResources(ctx context.Context) error {
 }
 
 // addDashboardLabels adds standard dashboard management labels to a resource
-func (m *Manager) addDashboardLabels(obj client.Object, crd *cozyv1alpha1.CozystackResourceDefinition, resourceType string) {
+func (m *Manager) addDashboardLabels(obj client.Object, crd *cozyv1alpha1.ApplicationDefinition, resourceType string) {
 	labels := obj.GetLabels()
 	if labels == nil {
 		labels = make(map[string]string)
@@ -197,7 +197,7 @@ func (m *Manager) getStaticResourceSelector() client.MatchingLabels {
 // CleanupOrphanedResources removes dashboard resources that are no longer needed
 // This should be called after cache warming to ensure all current resources are known
 func (m *Manager) CleanupOrphanedResources(ctx context.Context) error {
-	var crdList cozyv1alpha1.CozystackResourceDefinitionList
+	var crdList cozyv1alpha1.ApplicationDefinitionList
 	if err := m.List(ctx, &crdList, &client.ListOptions{}); err != nil {
 		return err
 	}
@@ -228,7 +228,7 @@ func (m *Manager) CleanupOrphanedResources(ctx context.Context) error {
 }
 
 // buildExpectedResourceSet creates a map of expected resource names by type
-func (m *Manager) buildExpectedResourceSet(crds []cozyv1alpha1.CozystackResourceDefinition) map[string]map[string]bool {
+func (m *Manager) buildExpectedResourceSet(crds []cozyv1alpha1.ApplicationDefinition) map[string]map[string]bool {
 	expected := make(map[string]map[string]bool)
 
 	// Initialize maps for each resource type

internal/controller/dashboard/marketplacepanel.go

@@ -16,7 +16,7 @@ import (
 )
 
 // ensureMarketplacePanel creates or updates a MarketplacePanel resource for the given CRD
-func (m *Manager) ensureMarketplacePanel(ctx context.Context, crd *cozyv1alpha1.CozystackResourceDefinition) (reconcile.Result, error) {
+func (m *Manager) ensureMarketplacePanel(ctx context.Context, crd *cozyv1alpha1.ApplicationDefinition) (reconcile.Result, error) {
 	logger := log.FromContext(ctx)
 
 	mp := &dashv1alpha1.MarketplacePanel{}

internal/controller/dashboard/sidebar.go

@@ -28,12 +28,12 @@ import (
 //   - Categories are ordered strictly as:
 //     Marketplace, IaaS, PaaS, NaaS, <others A→Z>, Resources, Administration
 //   - Items within each category: sort by Weight (desc), then Label (A→Z).
-func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.CozystackResourceDefinition) error {
+func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.ApplicationDefinition) error {
 	// Build the full menu once.
 
 	// 1) Fetch all CRDs
-	var all []cozyv1alpha1.CozystackResourceDefinition
-	var crdList cozyv1alpha1.CozystackResourceDefinitionList
+	var all []cozyv1alpha1.ApplicationDefinition
+	var crdList cozyv1alpha1.ApplicationDefinitionList
 	if err := m.List(ctx, &crdList, &client.ListOptions{}); err != nil {
 		return err
 	}
@@ -228,7 +228,7 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Cozystack
 // upsertMultipleSidebars creates/updates several Sidebar resources with the same menu spec.
 func (m *Manager) upsertMultipleSidebars(
 	ctx context.Context,
-	crd *cozyv1alpha1.CozystackResourceDefinition,
+	crd *cozyv1alpha1.ApplicationDefinition,
 	ids []string,
 	keysAndTags map[string]any,
 	menuItems []any,
@@ -335,7 +335,7 @@ func orderCategoryLabels[T any](cats map[string][]T) []string {
 }
 
 // safeCategory returns spec.dashboard.category or "Resources" if not set.
-func safeCategory(def *cozyv1alpha1.CozystackResourceDefinition) string {
+func safeCategory(def *cozyv1alpha1.ApplicationDefinition) string {
 	if def == nil || def.Spec.Dashboard == nil {
 		return "Resources"
 	}

internal/controller/dashboard/tableurimapping.go

@@ -7,7 +7,7 @@ import (
 )
 
 // ensureTableUriMapping creates or updates a TableUriMapping resource for the given CRD
-func (m *Manager) ensureTableUriMapping(ctx context.Context, crd *cozyv1alpha1.CozystackResourceDefinition) error {
+func (m *Manager) ensureTableUriMapping(ctx context.Context, crd *cozyv1alpha1.ApplicationDefinition) error {
 	// Links are fully managed by the CustomColumnsOverride.
 	return nil
 }

internal/controller/namespace_helm_reconciler.go

@@ -0,0 +1,170 @@
+/*
+Copyright 2025.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	helmv2 "github.com/fluxcd/helm-controller/api/v2"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+
+	"github.com/cozystack/cozystack/pkg/cozylib"
+)
+
+// +kubebuilder:rbac:groups=core,resources=namespaces,verbs=get;list;watch
+// +kubebuilder:rbac:groups=helm.toolkit.fluxcd.io,resources=helmreleases,verbs=get;list;watch;update;patch
+type NamespaceHelmReconciler struct {
+	client.Client
+	Scheme *runtime.Scheme
+}
+
+// Reconcile processes namespace changes and updates HelmReleases with namespace labels
+func (r *NamespaceHelmReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	logger := log.FromContext(ctx)
+
+	// Get the namespace
+	namespace := &corev1.Namespace{}
+	if err := r.Get(ctx, req.NamespacedName, namespace); err != nil {
+		logger.Error(err, "unable to fetch Namespace")
+		return ctrl.Result{}, client.IgnoreNotFound(err)
+	}
+
+		// Extract namespace.cozystack.io/* annotations
+		namespaceLabels := cozylib.ExtractNamespaceAnnotations(namespace)
+	if len(namespaceLabels) == 0 {
+		// No namespace labels to process, skip
+		return ctrl.Result{}, nil
+	}
+
+	logger.Info("processing namespace labels", "namespace", namespace.Name, "labels", namespaceLabels)
+
+	// List all HelmReleases in this namespace
+	helmReleaseList := &helmv2.HelmReleaseList{}
+	if err := r.List(ctx, helmReleaseList, client.InNamespace(namespace.Name)); err != nil {
+		logger.Error(err, "unable to list HelmReleases in namespace", "namespace", namespace.Name)
+		return ctrl.Result{}, err
+	}
+
+	// Update each HelmRelease with namespace labels
+	updated := 0
+	for i := range helmReleaseList.Items {
+		hr := &helmReleaseList.Items[i]
+		if err := r.updateHelmReleaseWithNamespaceLabels(ctx, hr, namespaceLabels); err != nil {
+			logger.Error(err, "failed to update HelmRelease", "name", hr.Name, "namespace", hr.Namespace)
+			continue
+		}
+		updated++
+	}
+
+	if updated > 0 {
+		logger.Info("updated HelmReleases with namespace labels", "namespace", namespace.Name, "count", updated)
+	}
+
+	return ctrl.Result{}, nil
+}
+
+
+// updateHelmReleaseWithNamespaceLabels updates HelmRelease values with namespace labels
+func (r *NamespaceHelmReconciler) updateHelmReleaseWithNamespaceLabels(ctx context.Context, hr *helmv2.HelmRelease, namespaceLabels map[string]string) error {
+	logger := log.FromContext(ctx)
+
+	// Parse current values
+	var valuesMap map[string]interface{}
+	if hr.Spec.Values != nil && len(hr.Spec.Values.Raw) > 0 {
+		if err := json.Unmarshal(hr.Spec.Values.Raw, &valuesMap); err != nil {
+			return fmt.Errorf("failed to unmarshal HelmRelease values: %w", err)
+		}
+	} else {
+		valuesMap = make(map[string]interface{})
+	}
+
+	// Convert namespaceLabels from map[string]string to map[string]interface{}
+	namespaceLabelsMap := make(map[string]interface{})
+	for k, v := range namespaceLabels {
+		namespaceLabelsMap[k] = v
+	}
+
+	// Check if namespace labels need to be updated (top-level _namespace field)
+	needsUpdate := false
+	currentNamespace, exists := valuesMap["_namespace"]
+	if !exists {
+		needsUpdate = true
+		valuesMap["_namespace"] = namespaceLabelsMap
+	} else {
+		currentNamespaceMap, ok := currentNamespace.(map[string]interface{})
+		if !ok {
+			needsUpdate = true
+			valuesMap["_namespace"] = namespaceLabelsMap
+		} else {
+			// Compare and update if different
+			for k, v := range namespaceLabelsMap {
+				if currentVal, exists := currentNamespaceMap[k]; !exists || currentVal != v {
+					needsUpdate = true
+					currentNamespaceMap[k] = v
+				}
+			}
+			// Remove keys that are no longer in namespace labels
+			for k := range currentNamespaceMap {
+				if _, exists := namespaceLabelsMap[k]; !exists {
+					needsUpdate = true
+					delete(currentNamespaceMap, k)
+				}
+			}
+			if needsUpdate {
+				valuesMap["_namespace"] = currentNamespaceMap
+			}
+		}
+	}
+
+	if !needsUpdate {
+		// No changes needed
+		return nil
+	}
+
+	// Marshal back to JSON
+	mergedJSON, err := json.Marshal(valuesMap)
+	if err != nil {
+		return fmt.Errorf("failed to marshal values with namespace labels: %w", err)
+	}
+
+	// Update HelmRelease
+	patchTarget := hr.DeepCopy()
+	patchTarget.Spec.Values = &apiextensionsv1.JSON{Raw: mergedJSON}
+
+	patch := client.MergeFrom(hr)
+	if err := r.Patch(ctx, patchTarget, patch); err != nil {
+		return fmt.Errorf("failed to patch HelmRelease: %w", err)
+	}
+
+	logger.Info("updated HelmRelease with namespace labels", "name", hr.Name, "namespace", hr.Namespace)
+	return nil
+}
+
+// SetupWithManager sets up the controller with the Manager
+func (r *NamespaceHelmReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewControllerManagedBy(mgr).
+		For(&corev1.Namespace{}).
+		Complete(r)
+}
+

internal/controller/system_helm_reconciler.go

@@ -1,140 +0,0 @@
-package controller
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"fmt"
-	"sort"
-	"time"
-
-	helmv2 "github.com/fluxcd/helm-controller/api/v2"
-	corev1 "k8s.io/api/core/v1"
-	kerrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/event"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-	"sigs.k8s.io/controller-runtime/pkg/predicate"
-)
-
-type CozystackConfigReconciler struct {
-	client.Client
-	Scheme *runtime.Scheme
-}
-
-var configMapNames = []string{"cozystack", "cozystack-branding", "cozystack-scheduling"}
-
-const configMapNamespace = "cozy-system"
-const digestAnnotation = "cozystack.io/cozy-config-digest"
-const forceReconcileKey = "reconcile.fluxcd.io/forceAt"
-const requestedAt = "reconcile.fluxcd.io/requestedAt"
-
-func (r *CozystackConfigReconciler) Reconcile(ctx context.Context, _ ctrl.Request) (ctrl.Result, error) {
-	log := log.FromContext(ctx)
-	time.Sleep(2 * time.Second)
-
-	digest, err := r.computeDigest(ctx)
-	if err != nil {
-		log.Error(err, "failed to compute config digest")
-		return ctrl.Result{}, nil
-	}
-
-	var helmList helmv2.HelmReleaseList
-	if err := r.List(ctx, &helmList); err != nil {
-		return ctrl.Result{}, fmt.Errorf("failed to list HelmReleases: %w", err)
-	}
-
-	now := time.Now().Format(time.RFC3339Nano)
-	updated := 0
-
-	for _, hr := range helmList.Items {
-		isSystemApp := hr.Labels["cozystack.io/system-app"] == "true"
-		isTenantRoot := hr.Namespace == "tenant-root" && hr.Name == "tenant-root"
-		if !isSystemApp && !isTenantRoot {
-			continue
-		}
-		patchTarget := hr.DeepCopy()
-
-		if hr.Annotations == nil {
-			hr.Annotations = map[string]string{}
-		}
-
-		if hr.Annotations[digestAnnotation] == digest {
-			continue
-		}
-		patchTarget.Annotations[digestAnnotation] = digest
-		patchTarget.Annotations[forceReconcileKey] = now
-		patchTarget.Annotations[requestedAt] = now
-
-		patch := client.MergeFrom(hr.DeepCopy())
-		if err := r.Patch(ctx, patchTarget, patch); err != nil {
-			log.Error(err, "failed to patch HelmRelease", "name", hr.Name, "namespace", hr.Namespace)
-			continue
-		}
-		updated++
-		log.Info("patched HelmRelease with new config digest", "name", hr.Name, "namespace", hr.Namespace)
-	}
-
-	log.Info("finished reconciliation", "updatedHelmReleases", updated)
-	return ctrl.Result{}, nil
-}
-
-func (r *CozystackConfigReconciler) computeDigest(ctx context.Context) (string, error) {
-	hash := sha256.New()
-
-	for _, name := range configMapNames {
-		var cm corev1.ConfigMap
-		err := r.Get(ctx, client.ObjectKey{Namespace: configMapNamespace, Name: name}, &cm)
-		if err != nil {
-			if kerrors.IsNotFound(err) {
-				continue // ignore missing
-			}
-			return "", err
-		}
-
-		// Sort keys for consistent hashing
-		var keys []string
-		for k := range cm.Data {
-			keys = append(keys, k)
-		}
-		sort.Strings(keys)
-
-		for _, k := range keys {
-			v := cm.Data[k]
-			fmt.Fprintf(hash, "%s:%s=%s\n", name, k, v)
-		}
-	}
-
-	return hex.EncodeToString(hash.Sum(nil)), nil
-}
-
-func (r *CozystackConfigReconciler) SetupWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewControllerManagedBy(mgr).
-		WithEventFilter(predicate.Funcs{
-			UpdateFunc: func(e event.UpdateEvent) bool {
-				cm, ok := e.ObjectNew.(*corev1.ConfigMap)
-				return ok && cm.Namespace == configMapNamespace && contains(configMapNames, cm.Name)
-			},
-			CreateFunc: func(e event.CreateEvent) bool {
-				cm, ok := e.Object.(*corev1.ConfigMap)
-				return ok && cm.Namespace == configMapNamespace && contains(configMapNames, cm.Name)
-			},
-			DeleteFunc: func(e event.DeleteEvent) bool {
-				cm, ok := e.Object.(*corev1.ConfigMap)
-				return ok && cm.Namespace == configMapNamespace && contains(configMapNames, cm.Name)
-			},
-		}).
-		For(&corev1.ConfigMap{}).
-		Complete(r)
-}
-
-func contains(slice []string, val string) bool {
-	for _, s := range slice {
-		if s == val {
-			return true
-		}
-	}
-	return false
-}

internal/controller/tenant_helm_reconciler.go

@@ -1,159 +0,0 @@
-package controller
-
-import (
-	"context"
-	"fmt"
-	"strings"
-	"time"
-
-	e "errors"
-
-	helmv2 "github.com/fluxcd/helm-controller/api/v2"
-	"gopkg.in/yaml.v2"
-	corev1 "k8s.io/api/core/v1"
-	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-)
-
-type TenantHelmReconciler struct {
-	client.Client
-	Scheme *runtime.Scheme
-}
-
-func (r *TenantHelmReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
-	logger := log.FromContext(ctx)
-	time.Sleep(2 * time.Second)
-
-	hr := &helmv2.HelmRelease{}
-	if err := r.Get(ctx, req.NamespacedName, hr); err != nil {
-		if errors.IsNotFound(err) {
-			return ctrl.Result{}, nil
-		}
-		logger.Error(err, "unable to fetch HelmRelease")
-		return ctrl.Result{}, err
-	}
-
-	if !strings.HasPrefix(hr.Name, "tenant-") {
-		return ctrl.Result{}, nil
-	}
-
-	if len(hr.Status.Conditions) == 0 || hr.Status.Conditions[0].Type != "Ready" {
-		return ctrl.Result{}, nil
-	}
-
-	if len(hr.Status.History) == 0 {
-		logger.Info("no history in HelmRelease status", "name", hr.Name)
-		return ctrl.Result{}, nil
-	}
-
-	if hr.Status.History[0].Status != "deployed" {
-		return ctrl.Result{}, nil
-	}
-
-	newDigest := hr.Status.History[0].Digest
-	var hrList helmv2.HelmReleaseList
-	childNamespace := getChildNamespace(hr.Namespace, hr.Name)
-	if childNamespace == "tenant-root" && hr.Name == "tenant-root" {
-		if hr.Spec.Values == nil {
-			logger.Error(e.New("hr.Spec.Values is nil"), "cant annotate tenant-root ns")
-			return ctrl.Result{}, nil
-		}
-		err := annotateTenantRootNs(*hr.Spec.Values, r.Client)
-		if err != nil {
-			logger.Error(err, "cant annotate tenant-root ns")
-			return ctrl.Result{}, nil
-		}
-		logger.Info("namespace 'tenant-root' annotated")
-	}
-
-	if err := r.List(ctx, &hrList, client.InNamespace(childNamespace)); err != nil {
-		logger.Error(err, "unable to list HelmReleases in namespace", "namespace", hr.Name)
-		return ctrl.Result{}, err
-	}
-
-	for _, item := range hrList.Items {
-		if item.Name == hr.Name {
-			continue
-		}
-		oldDigest := item.GetAnnotations()["cozystack.io/tenant-config-digest"]
-		if oldDigest == newDigest {
-			continue
-		}
-		patchTarget := item.DeepCopy()
-
-		if patchTarget.Annotations == nil {
-			patchTarget.Annotations = map[string]string{}
-		}
-		ts := time.Now().Format(time.RFC3339Nano)
-
-		patchTarget.Annotations["cozystack.io/tenant-config-digest"] = newDigest
-		patchTarget.Annotations["reconcile.fluxcd.io/forceAt"] = ts
-		patchTarget.Annotations["reconcile.fluxcd.io/requestedAt"] = ts
-
-		patch := client.MergeFrom(item.DeepCopy())
-		if err := r.Patch(ctx, patchTarget, patch); err != nil {
-			logger.Error(err, "failed to patch HelmRelease", "name", patchTarget.Name)
-			continue
-		}
-
-		logger.Info("patched HelmRelease with new digest", "name", patchTarget.Name, "digest", newDigest, "version", hr.Status.History[0].Version)
-	}
-
-	return ctrl.Result{}, nil
-}
-
-func (r *TenantHelmReconciler) SetupWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewControllerManagedBy(mgr).
-		For(&helmv2.HelmRelease{}).
-		Complete(r)
-}
-
-func getChildNamespace(currentNamespace, hrName string) string {
-	tenantName := strings.TrimPrefix(hrName, "tenant-")
-
-	switch {
-	case currentNamespace == "tenant-root" && hrName == "tenant-root":
-		// 1) root tenant inside root namespace
-		return "tenant-root"
-
-	case currentNamespace == "tenant-root":
-		// 2) any other tenant in root namespace
-		return fmt.Sprintf("tenant-%s", tenantName)
-
-	default:
-		// 3) tenant in a dedicated namespace
-		return fmt.Sprintf("%s-%s", currentNamespace, tenantName)
-	}
-}
-
-func annotateTenantRootNs(values apiextensionsv1.JSON, c client.Client) error {
-	var data map[string]interface{}
-	if err := yaml.Unmarshal(values.Raw, &data); err != nil {
-		return fmt.Errorf("failed to parse HelmRelease values: %w", err)
-	}
-
-	host, ok := data["host"].(string)
-	if !ok || host == "" {
-		return fmt.Errorf("host field not found or not a string")
-	}
-
-	var ns corev1.Namespace
-	if err := c.Get(context.TODO(), client.ObjectKey{Name: "tenant-root"}, &ns); err != nil {
-		return fmt.Errorf("failed to get namespace tenant-root: %w", err)
-	}
-
-	if ns.Annotations == nil {
-		ns.Annotations = map[string]string{}
-	}
-	ns.Annotations["namespace.cozystack.io/host"] = host
-
-	if err := c.Update(context.TODO(), &ns); err != nil {
-		return fmt.Errorf("failed to update namespace: %w", err)
-	}
-
-	return nil
-}

internal/fluxinstall/install.go

@@ -28,6 +28,8 @@ import (
 	"time"
 
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/serializer/yaml"
 	k8syaml "k8s.io/apimachinery/pkg/util/yaml"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/log"
@@ -158,6 +160,7 @@ func readYAMLObjects(reader io.Reader) ([]*unstructured.Unstructured, error) {
 // applyManifests applies Kubernetes objects using server-side apply.
 func applyManifests(ctx context.Context, k8sClient client.Client, objects []*unstructured.Unstructured) error {
 	logger := log.FromContext(ctx)
+	decoder := yaml.NewDecodingSerializer(unstructured.UnstructuredJSONScheme)
 
 	// Separate CRDs and namespaces from other resources
 	var stageOne []*unstructured.Unstructured // CRDs and Namespaces
@@ -174,7 +177,7 @@ func applyManifests(ctx context.Context, k8sClient client.Client, objects []*uns
 	// Apply stage one (CRDs and Namespaces) first
 	if len(stageOne) > 0 {
 		logger.Info("Applying cluster definitions", "count", len(stageOne))
-		if err := applyObjects(ctx, k8sClient, stageOne); err != nil {
+		if err := applyObjects(ctx, k8sClient, decoder, stageOne); err != nil {
 			return fmt.Errorf("failed to apply cluster definitions: %w", err)
 		}
 
@@ -185,7 +188,7 @@ func applyManifests(ctx context.Context, k8sClient client.Client, objects []*uns
 	// Apply stage two (everything else)
 	if len(stageTwo) > 0 {
 		logger.Info("Applying resources", "count", len(stageTwo))
-		if err := applyObjects(ctx, k8sClient, stageTwo); err != nil {
+		if err := applyObjects(ctx, k8sClient, decoder, stageTwo); err != nil {
 			return fmt.Errorf("failed to apply resources: %w", err)
 		}
 	}
@@ -194,7 +197,7 @@ func applyManifests(ctx context.Context, k8sClient client.Client, objects []*uns
 }
 
 // applyObjects applies a list of objects using server-side apply.
-func applyObjects(ctx context.Context, k8sClient client.Client, objects []*unstructured.Unstructured) error {
+func applyObjects(ctx context.Context, k8sClient client.Client, decoder runtime.Decoder, objects []*unstructured.Unstructured) error {
 	for _, obj := range objects {
 		// Use server-side apply with force ownership and field manager
 		// FieldManager is required for apply patch operations
@@ -234,7 +237,6 @@ func isClusterDefinition(obj *unstructured.Unstructured) bool {
 // injectKubernetesServiceEnv injects KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT
 // environment variables into all containers of Deployment, StatefulSet, and DaemonSet objects
 // if these variables are set in the operator's environment.
-// Errors are logged but do not stop processing of other objects.
 func injectKubernetesServiceEnv(objects []*unstructured.Unstructured) error {
 	kubernetesHost := os.Getenv("KUBERNETES_SERVICE_HOST")
 	kubernetesPort := os.Getenv("KUBERNETES_SERVICE_PORT")
@@ -244,7 +246,6 @@ func injectKubernetesServiceEnv(objects []*unstructured.Unstructured) error {
 		return nil
 	}
 
-	var firstErr error
 	for _, obj := range objects {
 		kind := obj.GetKind()
 		if kind != "Deployment" && kind != "StatefulSet" && kind != "DaemonSet" {
@@ -253,62 +254,35 @@ func injectKubernetesServiceEnv(objects []*unstructured.Unstructured) error {
 
 		// Navigate to spec.template.spec.containers
 		spec, found, err := unstructured.NestedMap(obj.Object, "spec", "template", "spec")
-		if !found {
-			continue
-		}
-		if err != nil {
-			if firstErr == nil {
-				firstErr = fmt.Errorf("failed to get spec for %s/%s: %w", kind, obj.GetName(), err)
-			}
+		if !found || err != nil {
 			continue
 		}
 
 		// Update containers
 		containers, found, err := unstructured.NestedSlice(spec, "containers")
-		if err != nil {
-			if firstErr == nil {
-				firstErr = fmt.Errorf("failed to get containers for %s/%s: %w", kind, obj.GetName(), err)
-			}
-			continue
-		}
-		if found {
+		if found && err == nil {
 			containers = updateContainersEnv(containers, kubernetesHost, kubernetesPort)
 			if err := unstructured.SetNestedSlice(spec, containers, "containers"); err != nil {
-				if firstErr == nil {
-					firstErr = fmt.Errorf("failed to set containers for %s/%s: %w", kind, obj.GetName(), err)
-				}
 				continue
 			}
 		}
 
 		// Update initContainers
 		initContainers, found, err := unstructured.NestedSlice(spec, "initContainers")
-		if err != nil {
-			if firstErr == nil {
-				firstErr = fmt.Errorf("failed to get initContainers for %s/%s: %w", kind, obj.GetName(), err)
-			}
-			continue
-		}
-		if found {
+		if found && err == nil {
 			initContainers = updateContainersEnv(initContainers, kubernetesHost, kubernetesPort)
 			if err := unstructured.SetNestedSlice(spec, initContainers, "initContainers"); err != nil {
-				if firstErr == nil {
-					firstErr = fmt.Errorf("failed to set initContainers for %s/%s: %w", kind, obj.GetName(), err)
-				}
 				continue
 			}
 		}
 
 		// Update spec in the object
 		if err := unstructured.SetNestedMap(obj.Object, spec, "spec", "template", "spec"); err != nil {
-			if firstErr == nil {
-				firstErr = fmt.Errorf("failed to update spec for %s/%s: %w", kind, obj.GetName(), err)
-			}
 			continue
 		}
 	}
 
-	return firstErr
+	return nil
 }
 
 // updateContainersEnv updates environment variables for a slice of containers.

internal/lineagecontrollerwebhook/config.go

@@ -4,56 +4,28 @@ import (
 	"fmt"
 	"strings"
 
-	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
 	helmv2 "github.com/fluxcd/helm-controller/api/v2"
 )
 
-type appRef struct {
-	group string
-	kind  string
-}
-
-type runtimeConfig struct {
-	appCRDMap map[appRef]*cozyv1alpha1.CozystackResourceDefinition
-}
-
 func (l *LineageControllerWebhook) initConfig() {
-	l.initOnce.Do(func() {
-		if l.config.Load() == nil {
-			l.config.Store(&runtimeConfig{
-				appCRDMap: make(map[appRef]*cozyv1alpha1.CozystackResourceDefinition),
-			})
-		}
-	})
-}
-
-// getApplicationLabel safely extracts an application label from HelmRelease
-func getApplicationLabel(hr *helmv2.HelmRelease, key string) (string, error) {
-	if hr.Labels == nil {
-		return "", fmt.Errorf("cannot map helm release %s/%s to dynamic app: labels are nil", hr.Namespace, hr.Name)
-	}
-	val, ok := hr.Labels[key]
-	if !ok {
-		return "", fmt.Errorf("cannot map helm release %s/%s to dynamic app: missing %s label", hr.Namespace, hr.Name, key)
-	}
-	return val, nil
+	// No longer needed - we use labels directly from HelmRelease
 }
 
 func (l *LineageControllerWebhook) Map(hr *helmv2.HelmRelease) (string, string, string, error) {
 	// Extract application metadata from labels
-	appKind, err := getApplicationLabel(hr, "apps.cozystack.io/application.kind")
-	if err != nil {
-		return "", "", "", err
+	appKind, ok := hr.Labels["apps.cozystack.io/application.kind"]
+	if !ok {
+		return "", "", "", fmt.Errorf("cannot map helm release %s/%s to dynamic app: missing apps.cozystack.io/application.kind label", hr.Namespace, hr.Name)
 	}
 	
-	appGroup, err := getApplicationLabel(hr, "apps.cozystack.io/application.group")
-	if err != nil {
-		return "", "", "", err
+	appGroup, ok := hr.Labels["apps.cozystack.io/application.group"]
+	if !ok {
+		return "", "", "", fmt.Errorf("cannot map helm release %s/%s to dynamic app: missing apps.cozystack.io/application.group label", hr.Namespace, hr.Name)
 	}
 	
-	appName, err := getApplicationLabel(hr, "apps.cozystack.io/application.name")
-	if err != nil {
-		return "", "", "", err
+	appName, ok := hr.Labels["apps.cozystack.io/application.name"]
+	if !ok {
+		return "", "", "", fmt.Errorf("cannot map helm release %s/%s to dynamic app: missing apps.cozystack.io/application.name label", hr.Namespace, hr.Name)
 	}
 	
 	// Construct API version from group
@@ -63,11 +35,5 @@ func (l *LineageControllerWebhook) Map(hr *helmv2.HelmRelease) (string, string,
 	// HelmRelease name format: <prefix><application-name>
 	prefix := strings.TrimSuffix(hr.Name, appName)
 	
-	// Validate the derived prefix
-	// This ensures correctness when appName appears multiple times in hr.Name
-	if prefix+appName != hr.Name {
-		return "", "", "", fmt.Errorf("cannot derive prefix from helm release %s/%s: name does not end with application name %s", hr.Namespace, hr.Name, appName)
-	}
-	
 	return apiVersion, appKind, prefix, nil
 }

internal/lineagecontrollerwebhook/controller.go

@@ -1,44 +1,11 @@
 package lineagecontrollerwebhook
 
 import (
-	"context"
-
-	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
 	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/log"
 )
 
-// +kubebuilder:rbac:groups=cozystack.io,resources=cozystackresourcedefinitions,verbs=list;watch;get
-
+// SetupWithManagerAsController is no longer needed since we don't watch ApplicationDefinitions
 func (c *LineageControllerWebhook) SetupWithManagerAsController(mgr ctrl.Manager) error {
-	return ctrl.NewControllerManagedBy(mgr).
-		For(&cozyv1alpha1.CozystackResourceDefinition{}).
-		Complete(c)
-}
-
-func (c *LineageControllerWebhook) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
-	l := log.FromContext(ctx)
-	crds := &cozyv1alpha1.CozystackResourceDefinitionList{}
-	if err := c.List(ctx, crds); err != nil {
-		l.Error(err, "failed reading CozystackResourceDefinitions")
-		return ctrl.Result{}, err
-	}
-	cfg := &runtimeConfig{
-		appCRDMap: make(map[appRef]*cozyv1alpha1.CozystackResourceDefinition),
-	}
-	for _, crd := range crds.Items {
-		appRef := appRef{
-			"apps.cozystack.io",
-			crd.Spec.Application.Kind,
-		}
-
-		newRef := crd
-		if _, exists := cfg.appCRDMap[appRef]; exists {
-			l.Info("duplicate app mapping detected; ignoring subsequent entry", "key", appRef)
-		} else {
-			cfg.appCRDMap[appRef] = &newRef
-		}
-	}
-	c.config.Store(cfg)
-	return ctrl.Result{}, nil
+	// No controller needed - we use labels directly from HelmRelease
+	return nil
 }

internal/lineagecontrollerwebhook/matcher.go

@@ -42,7 +42,7 @@ func matchName(ctx context.Context, name string, templateContext map[string]stri
 	return false
 }
 
-func matchResourceToSelector(ctx context.Context, name string, templateContext, l map[string]string, s *cozyv1alpha1.CozystackResourceDefinitionResourceSelector) bool {
+func matchResourceToSelector(ctx context.Context, name string, templateContext, l map[string]string, s *cozyv1alpha1.ApplicationDefinitionResourceSelector) bool {
 	sel, err := metav1.LabelSelectorAsSelector(&s.LabelSelector)
 	if err != nil {
 		log.FromContext(ctx).Error(err, "failed to convert label selector to selector")
@@ -53,7 +53,7 @@ func matchResourceToSelector(ctx context.Context, name string, templateContext,
 	return labelMatches && nameMatches
 }
 
-func matchResourceToSelectorArray(ctx context.Context, name string, templateContext, l map[string]string, ss []*cozyv1alpha1.CozystackResourceDefinitionResourceSelector) bool {
+func matchResourceToSelectorArray(ctx context.Context, name string, templateContext, l map[string]string, ss []*cozyv1alpha1.ApplicationDefinitionResourceSelector) bool {
 	for _, s := range ss {
 		if matchResourceToSelector(ctx, name, templateContext, l, s) {
 			return true
@@ -62,7 +62,7 @@ func matchResourceToSelectorArray(ctx context.Context, name string, templateCont
 	return false
 }
 
-func matchResourceToExcludeInclude(ctx context.Context, name string, templateContext, l map[string]string, resources *cozyv1alpha1.CozystackResourceDefinitionResources) bool {
+func matchResourceToExcludeInclude(ctx context.Context, name string, templateContext, l map[string]string, resources *cozyv1alpha1.ApplicationDefinitionResources) bool {
 	if resources == nil {
 		return false
 	}

internal/lineagecontrollerwebhook/webhook.go

@@ -5,7 +5,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"strings"
 
 	"github.com/cozystack/cozystack/pkg/lineage"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
@@ -33,8 +32,8 @@ const (
 	ManagerNameKey   = "apps.cozystack.io/application.name"
 )
 
-// getResourceSelectors returns the appropriate CozystackResourceDefinitionResources for a given GroupKind
-func (h *LineageControllerWebhook) getResourceSelectors(gk schema.GroupKind, crd *cozyv1alpha1.CozystackResourceDefinition) *cozyv1alpha1.CozystackResourceDefinitionResources {
+// getResourceSelectors returns the appropriate ApplicationDefinitionResources for a given GroupKind
+func (h *LineageControllerWebhook) getResourceSelectors(gk schema.GroupKind, crd *cozyv1alpha1.ApplicationDefinition) *cozyv1alpha1.ApplicationDefinitionResources {
 	switch {
 	case gk.Group == "" && gk.Kind == "Secret":
 		return &crd.Spec.Secrets
@@ -88,13 +87,16 @@ func (h *LineageControllerWebhook) Handle(ctx context.Context, req admission.Req
 		"name", req.Name,
 		"operation", req.Operation,
 	)
+	logger.Info("webhook called", "gvk", req.Kind.String(), "namespace", req.Namespace, "name", req.Name, "operation", req.Operation)
 	warn := make(admission.Warnings, 0)
 
 	obj := &unstructured.Unstructured{}
 	if err := h.decodeUnstructured(req, obj); err != nil {
+		logger.Error(err, "failed to decode object")
 		return admission.Errored(400, fmt.Errorf("decode object: %w", err))
 	}
 
+	logger.V(1).Info("decoded object", "labels", obj.GetLabels(), "ownerReferences", obj.GetOwnerReferences())
 	labels, err := h.computeLabels(ctx, obj)
 	for {
 		if err != nil && errors.Is(err, NoAncestors) {
@@ -117,9 +119,10 @@ func (h *LineageControllerWebhook) Handle(ctx context.Context, req admission.Req
 
 	mutated, err := json.Marshal(obj)
 	if err != nil {
-		return admission.Errored(500, fmt.Errorf("marshal mutated pod: %w", err))
+		logger.Error(err, "failed to marshal mutated object")
+		return admission.Errored(500, fmt.Errorf("marshal mutated object: %w", err))
 	}
-	logger.V(1).Info("mutated pod", "namespace", obj.GetNamespace(), "name", obj.GetName())
+	logger.Info("mutated object", "namespace", obj.GetNamespace(), "name", obj.GetName(), "labels", labels)
 	return admission.PatchResponseFromRaw(req.Object.Raw, mutated).WithWarnings(warn...)
 }
 
@@ -156,21 +159,9 @@ func (h *LineageControllerWebhook) computeLabels(ctx context.Context, o *unstruc
 		ManagerKindKey: obj.GetKind(),
 		ManagerNameKey: obj.GetName(),
 	}
-	templateLabels := map[string]string{
-		"kind":      strings.ToLower(obj.GetKind()),
-		"name":      obj.GetName(),
-		"namespace": o.GetNamespace(),
-	}
-	cfg := h.config.Load().(*runtimeConfig)
-	crd := cfg.appCRDMap[appRef{gv.Group, obj.GetKind()}]
-	resourceSelectors := h.getResourceSelectors(o.GroupVersionKind().GroupKind(), crd)
-
-	labels[corev1alpha1.TenantResourceLabelKey] = func(b bool) string {
-		if b {
-			return corev1alpha1.TenantResourceLabelValue
-		}
-		return "false"
-	}(matchResourceToExcludeInclude(ctx, o.GetName(), templateLabels, o.GetLabels(), resourceSelectors))
+	// Resource selectors are no longer needed since we don't use ApplicationDefinitions
+	// Set tenant resource label to false by default (can be overridden by other logic if needed)
+	labels[corev1alpha1.TenantResourceLabelKey] = "false"
 	return labels, err
 }
 

internal/operator/package_reconciler.go

@@ -1,944 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package operator
-
-import (
-	"context"
-	"fmt"
-	"strings"
-
-	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
-	helmv2 "github.com/fluxcd/helm-controller/api/v2"
-	corev1 "k8s.io/api/core/v1"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/api/meta"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/types"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/client/apiutil"
-	"sigs.k8s.io/controller-runtime/pkg/handler"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-	"sigs.k8s.io/controller-runtime/pkg/reconcile"
-)
-
-// PackageReconciler reconciles Package resources
-type PackageReconciler struct {
-	client.Client
-	Scheme *runtime.Scheme
-}
-
-// +kubebuilder:rbac:groups=cozystack.io,resources=packages,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=cozystack.io,resources=packages/status,verbs=get;update;patch
-// +kubebuilder:rbac:groups=cozystack.io,resources=packagesources,verbs=get;list;watch
-// +kubebuilder:rbac:groups=helm.toolkit.fluxcd.io,resources=helmreleases,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=core,resources=namespaces,verbs=get;list;watch;create;update;patch
-
-// Reconcile is part of the main kubernetes reconciliation loop
-func (r *PackageReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
-	logger := log.FromContext(ctx)
-
-	pkg := &cozyv1alpha1.Package{}
-	if err := r.Get(ctx, req.NamespacedName, pkg); err != nil {
-		if apierrors.IsNotFound(err) {
-			// Resource not found, return (ownerReference will handle cleanup)
-			return ctrl.Result{}, nil
-		}
-		return ctrl.Result{}, err
-	}
-
-	// Get PackageSource with the same name
-	packageSource := &cozyv1alpha1.PackageSource{}
-	if err := r.Get(ctx, types.NamespacedName{Name: pkg.Name}, packageSource); err != nil {
-		if apierrors.IsNotFound(err) {
-			meta.SetStatusCondition(&pkg.Status.Conditions, metav1.Condition{
-				Type:    "Ready",
-				Status:  metav1.ConditionFalse,
-				Reason:  "PackageSourceNotFound",
-				Message: fmt.Sprintf("PackageSource %s not found", pkg.Name),
-			})
-			if err := r.Status().Update(ctx, pkg); err != nil {
-				return ctrl.Result{}, err
-			}
-			return ctrl.Result{}, nil
-		}
-		return ctrl.Result{}, err
-	}
-
-	// Determine variant (default to "default" if not specified)
-	variantName := pkg.Spec.Variant
-	if variantName == "" {
-		variantName = "default"
-	}
-
-	// Find the variant in PackageSource
-	var variant *cozyv1alpha1.Variant
-	for i := range packageSource.Spec.Variants {
-		if packageSource.Spec.Variants[i].Name == variantName {
-			variant = &packageSource.Spec.Variants[i]
-			break
-		}
-	}
-
-	if variant == nil {
-		meta.SetStatusCondition(&pkg.Status.Conditions, metav1.Condition{
-			Type:    "Ready",
-			Status:  metav1.ConditionFalse,
-			Reason:  "VariantNotFound",
-			Message: fmt.Sprintf("Variant %s not found in PackageSource %s", variantName, pkg.Name),
-		})
-		if err := r.Status().Update(ctx, pkg); err != nil {
-			return ctrl.Result{}, err
-		}
-		return ctrl.Result{}, nil
-	}
-
-	// Reconcile namespaces from components
-	if err := r.reconcileNamespaces(ctx, pkg, variant); err != nil {
-		logger.Error(err, "failed to reconcile namespaces")
-		return ctrl.Result{}, err
-	}
-
-	// Update dependencies status
-	if err := r.updateDependenciesStatus(ctx, pkg, variant); err != nil {
-		logger.Error(err, "failed to update dependencies status")
-		// Don't return error, continue with reconciliation
-	}
-
-	// Validate variant dependencies before creating HelmReleases
-	// Check if all dependencies are ready based on status
-	if !r.areDependenciesReady(pkg, variant) {
-		logger.Info("variant dependencies not ready, skipping HelmRelease creation", "package", pkg.Name)
-		meta.SetStatusCondition(&pkg.Status.Conditions, metav1.Condition{
-			Type:    "Ready",
-			Status:  metav1.ConditionFalse,
-			Reason:  "DependenciesNotReady",
-			Message: "One or more dependencies are not ready",
-		})
-		if err := r.Status().Update(ctx, pkg); err != nil {
-			return ctrl.Result{}, err
-		}
-		// Return success to avoid requeue, but don't create HelmReleases
-		return ctrl.Result{}, nil
-	}
-
-	// Create HelmReleases for components with Install section
-	helmReleaseCount := 0
-	for _, component := range variant.Components {
-		// Skip components without Install section
-		if component.Install == nil {
-			continue
-		}
-
-		// Check if component is disabled via Package spec
-		if pkgComponent, ok := pkg.Spec.Components[component.Name]; ok {
-			if pkgComponent.Enabled != nil && !*pkgComponent.Enabled {
-				logger.V(1).Info("skipping disabled component", "package", pkg.Name, "component", component.Name)
-				continue
-			}
-		}
-
-		// Build artifact name: <packagesource>-<variant>-<componentname> (with dots replaced by dashes)
-		artifactName := fmt.Sprintf("%s-%s-%s",
-			strings.ReplaceAll(packageSource.Name, ".", "-"),
-			strings.ReplaceAll(variantName, ".", "-"),
-			strings.ReplaceAll(component.Name, ".", "-"))
-
-		// Namespace must be set
-		namespace := component.Install.Namespace
-		if namespace == "" {
-			logger.Error(fmt.Errorf("component %s has empty namespace in Install section", component.Name), "namespace validation failed")
-			meta.SetStatusCondition(&pkg.Status.Conditions, metav1.Condition{
-				Type:    "Ready",
-				Status:  metav1.ConditionFalse,
-				Reason:  "InvalidConfiguration",
-				Message: fmt.Sprintf("Component %s has empty namespace in Install section", component.Name),
-			})
-			if err := r.Status().Update(ctx, pkg); err != nil {
-				return ctrl.Result{}, err
-			}
-			return ctrl.Result{}, fmt.Errorf("component %s has empty namespace in Install section", component.Name)
-		}
-
-		// Determine release name (from Install or use component name)
-		releaseName := component.Install.ReleaseName
-		if releaseName == "" {
-			releaseName = component.Name
-		}
-
-		// Build labels
-		labels := make(map[string]string)
-		labels["cozystack.io/package"] = pkg.Name
-		if component.Install.Privileged {
-			labels["cozystack.io/privileged"] = "true"
-		}
-
-		// Create HelmRelease
-		hr := &helmv2.HelmRelease{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      releaseName,
-				Namespace: namespace,
-				Labels:    labels,
-			},
-			Spec: helmv2.HelmReleaseSpec{
-				Interval: metav1.Duration{Duration: 5 * 60 * 1000000000}, // 5m
-				ChartRef: &helmv2.CrossNamespaceSourceReference{
-					Kind:      "ExternalArtifact",
-					Name:      artifactName,
-					Namespace: "cozy-system",
-				},
-				Install: &helmv2.Install{
-					Remediation: &helmv2.InstallRemediation{
-						Retries: -1,
-					},
-				},
-				Upgrade: &helmv2.Upgrade{
-					Remediation: &helmv2.UpgradeRemediation{
-						Retries: -1,
-					},
-				},
-			},
-		}
-
-		// Set ownerReference
-		gvk, err := apiutil.GVKForObject(pkg, r.Scheme)
-		if err != nil {
-			logger.Error(err, "failed to get GVK for Package")
-			meta.SetStatusCondition(&pkg.Status.Conditions, metav1.Condition{
-				Type:    "Ready",
-				Status:  metav1.ConditionFalse,
-				Reason:  "InternalError",
-				Message: fmt.Sprintf("Failed to get GVK for Package: %v", err),
-			})
-			if err := r.Status().Update(ctx, pkg); err != nil {
-				return ctrl.Result{}, err
-			}
-			return ctrl.Result{}, fmt.Errorf("failed to get GVK for Package: %w", err)
-		}
-		hr.OwnerReferences = []metav1.OwnerReference{
-			{
-				APIVersion: gvk.GroupVersion().String(),
-				Kind:       gvk.Kind,
-				Name:       pkg.Name,
-				UID:        pkg.UID,
-				Controller: func() *bool { b := true; return &b }(),
-			},
-		}
-
-		// Merge values from Package spec if provided
-		if pkgComponent, ok := pkg.Spec.Components[component.Name]; ok && pkgComponent.Values != nil {
-			hr.Spec.Values = pkgComponent.Values
-		}
-
-		// Build DependsOn from component Install and variant DependsOn
-		dependsOn, err := r.buildDependsOn(ctx, pkg, packageSource, variant, &component)
-		if err != nil {
-			logger.Error(err, "failed to build DependsOn", "component", component.Name)
-			meta.SetStatusCondition(&pkg.Status.Conditions, metav1.Condition{
-				Type:    "Ready",
-				Status:  metav1.ConditionFalse,
-				Reason:  "DependsOnFailed",
-				Message: fmt.Sprintf("Failed to build DependsOn for component %s: %v", component.Name, err),
-			})
-			if err := r.Status().Update(ctx, pkg); err != nil {
-				return ctrl.Result{}, err
-			}
-			// Return nil to stop reconciliation, error is recorded in status
-			return ctrl.Result{}, nil
-		}
-		if len(dependsOn) > 0 {
-			hr.Spec.DependsOn = dependsOn
-		}
-
-		// Set valuesFiles annotation
-		if len(component.ValuesFiles) > 0 {
-			if hr.Annotations == nil {
-				hr.Annotations = make(map[string]string)
-			}
-			hr.Annotations["cozyhr.cozystack.io/values-files"] = strings.Join(component.ValuesFiles, ",")
-		}
-
-		if err := r.createOrUpdateHelmRelease(ctx, hr); err != nil {
-			logger.Error(err, "failed to reconcile HelmRelease", "name", releaseName, "namespace", namespace)
-			meta.SetStatusCondition(&pkg.Status.Conditions, metav1.Condition{
-				Type:    "Ready",
-				Status:  metav1.ConditionFalse,
-				Reason:  "HelmReleaseFailed",
-				Message: fmt.Sprintf("Failed to create HelmRelease %s: %v", releaseName, err),
-			})
-			if err := r.Status().Update(ctx, pkg); err != nil {
-				return ctrl.Result{}, err
-			}
-			return ctrl.Result{}, err
-		}
-
-		helmReleaseCount++
-		logger.Info("reconciled HelmRelease", "package", pkg.Name, "component", component.Name, "releaseName", releaseName, "namespace", namespace)
-	}
-
-	// Cleanup orphaned HelmReleases
-	if err := r.cleanupOrphanedHelmReleases(ctx, pkg, variant); err != nil {
-		logger.Error(err, "failed to cleanup orphaned HelmReleases")
-		// Don't return error, continue with status update
-	}
-
-	// Update status with success message
-	message := fmt.Sprintf("reconciliation succeeded, generated %d helmrelease(s)", helmReleaseCount)
-	meta.SetStatusCondition(&pkg.Status.Conditions, metav1.Condition{
-		Type:    "Ready",
-		Status:  metav1.ConditionTrue,
-		Reason:  "ReconciliationSucceeded",
-		Message: message,
-	})
-
-	if err := r.Status().Update(ctx, pkg); err != nil {
-		return ctrl.Result{}, err
-	}
-
-	logger.Info("reconciled Package", "name", pkg.Name, "helmReleaseCount", helmReleaseCount)
-
-	// Update dependencies status for Packages that depend on this Package
-	// This ensures they get re-enqueued when their dependency becomes ready
-	if err := r.updateDependentPackagesDependencies(ctx, pkg.Name); err != nil {
-		logger.V(1).Error(err, "failed to update dependent packages dependencies", "package", pkg.Name)
-		// Don't return error, this is best-effort
-	}
-
-	// Dependent Packages will be automatically enqueued by the watch handler
-	// when this Package's status is updated (see SetupWithManager watch handler)
-
-	return ctrl.Result{}, nil
-}
-
-// createOrUpdateHelmRelease creates or updates a HelmRelease
-func (r *PackageReconciler) createOrUpdateHelmRelease(ctx context.Context, hr *helmv2.HelmRelease) error {
-	existing := &helmv2.HelmRelease{}
-	key := types.NamespacedName{
-		Name:      hr.Name,
-		Namespace: hr.Namespace,
-	}
-
-	err := r.Get(ctx, key, existing)
-	if apierrors.IsNotFound(err) {
-		return r.Create(ctx, hr)
-	} else if err != nil {
-		return err
-	}
-
-	// Preserve resource version
-	hr.SetResourceVersion(existing.GetResourceVersion())
-
-	// Merge labels
-	labels := hr.GetLabels()
-	if labels == nil {
-		labels = make(map[string]string)
-	}
-	for k, v := range existing.GetLabels() {
-		if _, ok := labels[k]; !ok {
-			labels[k] = v
-		}
-	}
-	hr.SetLabels(labels)
-
-	// Merge annotations
-	annotations := hr.GetAnnotations()
-	if annotations == nil {
-		annotations = make(map[string]string)
-	}
-	for k, v := range existing.GetAnnotations() {
-		if _, ok := annotations[k]; !ok {
-			annotations[k] = v
-		}
-	}
-	hr.SetAnnotations(annotations)
-
-	// Update Spec
-	existing.Spec = hr.Spec
-	existing.SetLabels(hr.GetLabels())
-	existing.SetAnnotations(hr.GetAnnotations())
-	existing.SetOwnerReferences(hr.GetOwnerReferences())
-
-	return r.Update(ctx, existing)
-}
-
-// getVariantForPackage retrieves the Variant for a given Package
-// Returns the Variant and an error if not found
-// If c is nil, uses the reconciler's client
-func (r *PackageReconciler) getVariantForPackage(ctx context.Context, pkg *cozyv1alpha1.Package, c client.Client) (*cozyv1alpha1.Variant, error) {
-	// Use provided client or fall back to reconciler's client
-	cl := c
-	if cl == nil {
-		cl = r.Client
-	}
-
-	// Determine variant name (default to "default" if not specified)
-	variantName := pkg.Spec.Variant
-	if variantName == "" {
-		variantName = "default"
-	}
-
-	// Get the PackageSource
-	packageSource := &cozyv1alpha1.PackageSource{}
-	if err := cl.Get(ctx, types.NamespacedName{Name: pkg.Name}, packageSource); err != nil {
-		if apierrors.IsNotFound(err) {
-			return nil, fmt.Errorf("PackageSource %s not found", pkg.Name)
-		}
-		return nil, fmt.Errorf("failed to get PackageSource %s: %w", pkg.Name, err)
-	}
-
-	// Find the variant in PackageSource
-	var variant *cozyv1alpha1.Variant
-	for i := range packageSource.Spec.Variants {
-		if packageSource.Spec.Variants[i].Name == variantName {
-			variant = &packageSource.Spec.Variants[i]
-			break
-		}
-	}
-
-	if variant == nil {
-		return nil, fmt.Errorf("variant %s not found in PackageSource %s", variantName, pkg.Name)
-	}
-
-	return variant, nil
-}
-
-// buildDependsOn builds DependsOn list for a component
-// Includes:
-// 1. Dependencies from component.Install.DependsOn (with namespace from referenced component)
-// 2. Dependencies from variant.DependsOn (all components with Install from referenced Package)
-func (r *PackageReconciler) buildDependsOn(ctx context.Context, pkg *cozyv1alpha1.Package, packageSource *cozyv1alpha1.PackageSource, variant *cozyv1alpha1.Variant, component *cozyv1alpha1.Component) ([]helmv2.DependencyReference, error) {
-	logger := log.FromContext(ctx)
-	dependsOn := []helmv2.DependencyReference{}
-
-	// Build map of component names to their release names and namespaces in current variant
-	componentMap := make(map[string]struct {
-		releaseName string
-		namespace   string
-	})
-	for _, comp := range variant.Components {
-		if comp.Install == nil {
-			continue
-		}
-		compNamespace := comp.Install.Namespace
-		if compNamespace == "" {
-			return nil, fmt.Errorf("component %s has empty namespace in Install section", comp.Name)
-		}
-		compReleaseName := comp.Install.ReleaseName
-		if compReleaseName == "" {
-			compReleaseName = comp.Name
-		}
-		componentMap[comp.Name] = struct {
-			releaseName string
-			namespace   string
-		}{
-			releaseName: compReleaseName,
-			namespace:   compNamespace,
-		}
-	}
-
-	// Add dependencies from component.Install.DependsOn
-	if len(component.Install.DependsOn) > 0 {
-		for _, depName := range component.Install.DependsOn {
-			depComp, ok := componentMap[depName]
-			if !ok {
-				return nil, fmt.Errorf("component %s not found in variant for dependency %s", depName, component.Name)
-			}
-			dependsOn = append(dependsOn, helmv2.DependencyReference{
-				Name:      depComp.releaseName,
-				Namespace: depComp.namespace,
-			})
-			logger.V(1).Info("added component dependency", "component", component.Name, "dependsOn", depName, "releaseName", depComp.releaseName, "namespace", depComp.namespace)
-		}
-	}
-
-	// Add dependencies from variant.DependsOn
-	if len(variant.DependsOn) > 0 {
-		for _, depPackageName := range variant.DependsOn {
-			// Check if dependency is in IgnoreDependencies
-			ignore := false
-			for _, ignoreDep := range pkg.Spec.IgnoreDependencies {
-				if ignoreDep == depPackageName {
-					ignore = true
-					break
-				}
-			}
-			if ignore {
-				logger.V(1).Info("ignoring dependency", "package", pkg.Name, "dependency", depPackageName)
-				continue
-			}
-
-			// Get the Package
-			depPackage := &cozyv1alpha1.Package{}
-			if err := r.Get(ctx, types.NamespacedName{Name: depPackageName}, depPackage); err != nil {
-				if apierrors.IsNotFound(err) {
-					return nil, fmt.Errorf("dependent Package %s not found", depPackageName)
-				}
-				return nil, fmt.Errorf("failed to get dependent Package %s: %w", depPackageName, err)
-			}
-
-			// Get the variant from dependent Package
-			depVariant, err := r.getVariantForPackage(ctx, depPackage, nil)
-			if err != nil {
-				return nil, fmt.Errorf("failed to get variant for dependent Package %s: %w", depPackageName, err)
-			}
-
-			// Add all components with Install from dependent variant
-			for _, depComp := range depVariant.Components {
-				if depComp.Install == nil {
-					continue
-				}
-
-				// Check if component is disabled in dependent Package
-				if depPkgComponent, ok := depPackage.Spec.Components[depComp.Name]; ok {
-					if depPkgComponent.Enabled != nil && !*depPkgComponent.Enabled {
-						continue
-					}
-				}
-
-				depCompNamespace := depComp.Install.Namespace
-				if depCompNamespace == "" {
-					return nil, fmt.Errorf("component %s in dependent Package %s has empty namespace in Install section", depComp.Name, depPackageName)
-				}
-				depCompReleaseName := depComp.Install.ReleaseName
-				if depCompReleaseName == "" {
-					depCompReleaseName = depComp.Name
-				}
-
-				dependsOn = append(dependsOn, helmv2.DependencyReference{
-					Name:      depCompReleaseName,
-					Namespace: depCompNamespace,
-				})
-				logger.V(1).Info("added variant dependency", "package", pkg.Name, "dependency", depPackageName, "component", depComp.Name, "releaseName", depCompReleaseName, "namespace", depCompNamespace)
-			}
-		}
-	}
-
-	return dependsOn, nil
-}
-
-// updateDependenciesStatus updates the dependencies status in Package status
-// It checks the readiness of each dependency and updates pkg.Status.Dependencies
-// Old dependency keys that are no longer in the dependency list are removed
-func (r *PackageReconciler) updateDependenciesStatus(ctx context.Context, pkg *cozyv1alpha1.Package, variant *cozyv1alpha1.Variant) error {
-	logger := log.FromContext(ctx)
-
-	// Initialize dependencies map if nil
-	if pkg.Status.Dependencies == nil {
-		pkg.Status.Dependencies = make(map[string]cozyv1alpha1.DependencyStatus)
-	}
-
-	// Build set of current dependencies (excluding ignored ones)
-	currentDeps := make(map[string]bool)
-	if len(variant.DependsOn) > 0 {
-		for _, depPackageName := range variant.DependsOn {
-			// Check if dependency is in IgnoreDependencies
-			ignore := false
-			for _, ignoreDep := range pkg.Spec.IgnoreDependencies {
-				if ignoreDep == depPackageName {
-					ignore = true
-					break
-				}
-			}
-			if ignore {
-				logger.V(1).Info("ignoring dependency", "package", pkg.Name, "dependency", depPackageName)
-				continue
-			}
-			currentDeps[depPackageName] = true
-		}
-	}
-
-	// Remove old dependencies that are no longer in the list
-	for depName := range pkg.Status.Dependencies {
-		if !currentDeps[depName] {
-			delete(pkg.Status.Dependencies, depName)
-			logger.V(1).Info("removed old dependency from status", "package", pkg.Name, "dependency", depName)
-		}
-	}
-
-	// Update status for each current dependency
-	for depPackageName := range currentDeps {
-		// Get the Package
-		depPackage := &cozyv1alpha1.Package{}
-		if err := r.Get(ctx, types.NamespacedName{Name: depPackageName}, depPackage); err != nil {
-			if apierrors.IsNotFound(err) {
-				// Dependency not found, mark as not ready
-				pkg.Status.Dependencies[depPackageName] = cozyv1alpha1.DependencyStatus{
-					Ready: false,
-				}
-				logger.V(1).Info("dependency not found, marking as not ready", "package", pkg.Name, "dependency", depPackageName)
-				continue
-			}
-			// Error getting dependency, keep existing status or mark as not ready
-			if _, exists := pkg.Status.Dependencies[depPackageName]; !exists {
-				pkg.Status.Dependencies[depPackageName] = cozyv1alpha1.DependencyStatus{
-					Ready: false,
-				}
-			}
-			logger.V(1).Error(err, "failed to get dependency, keeping existing status", "package", pkg.Name, "dependency", depPackageName)
-			continue
-		}
-
-		// Check Ready condition
-		readyCondition := meta.FindStatusCondition(depPackage.Status.Conditions, "Ready")
-		isReady := readyCondition != nil && readyCondition.Status == metav1.ConditionTrue
-
-		// Update dependency status
-		pkg.Status.Dependencies[depPackageName] = cozyv1alpha1.DependencyStatus{
-			Ready: isReady,
-		}
-		logger.V(1).Info("updated dependency status", "package", pkg.Name, "dependency", depPackageName, "ready", isReady)
-	}
-
-	return nil
-}
-
-// areDependenciesReady checks if all dependencies are ready based on status
-func (r *PackageReconciler) areDependenciesReady(pkg *cozyv1alpha1.Package, variant *cozyv1alpha1.Variant) bool {
-	if len(variant.DependsOn) == 0 {
-		return true
-	}
-
-	for _, depPackageName := range variant.DependsOn {
-		// Check if dependency is in IgnoreDependencies
-		ignore := false
-		for _, ignoreDep := range pkg.Spec.IgnoreDependencies {
-			if ignoreDep == depPackageName {
-				ignore = true
-				break
-			}
-		}
-		if ignore {
-			continue
-		}
-
-		// Check dependency status
-		depStatus, exists := pkg.Status.Dependencies[depPackageName]
-		if !exists || !depStatus.Ready {
-			return false
-		}
-	}
-
-	return true
-}
-
-// updateDependentPackagesDependencies updates dependencies status for all Packages that depend on the given Package
-// This ensures dependent packages get re-enqueued when their dependency status changes
-func (r *PackageReconciler) updateDependentPackagesDependencies(ctx context.Context, packageName string) error {
-	logger := log.FromContext(ctx)
-
-	// Get all Packages
-	packageList := &cozyv1alpha1.PackageList{}
-	if err := r.List(ctx, packageList); err != nil {
-		return fmt.Errorf("failed to list Packages: %w", err)
-	}
-
-	// Get the updated Package to check its readiness
-	updatedPkg := &cozyv1alpha1.Package{}
-	if err := r.Get(ctx, types.NamespacedName{Name: packageName}, updatedPkg); err != nil {
-		if apierrors.IsNotFound(err) {
-			return nil // Package not found, nothing to update
-		}
-		return fmt.Errorf("failed to get Package %s: %w", packageName, err)
-	}
-
-	// Check Ready condition of the updated Package
-	readyCondition := meta.FindStatusCondition(updatedPkg.Status.Conditions, "Ready")
-	isReady := readyCondition != nil && readyCondition.Status == metav1.ConditionTrue
-
-	// For each Package, check if it depends on the given Package
-	for _, pkg := range packageList.Items {
-		// Skip the Package itself
-		if pkg.Name == packageName {
-			continue
-		}
-
-		// Get variant
-		variant, err := r.getVariantForPackage(ctx, &pkg, nil)
-		if err != nil {
-			// Continue if PackageSource or variant not found (best-effort operation)
-			logger.V(1).Info("skipping package, failed to get variant", "package", pkg.Name, "error", err)
-			continue
-		}
-
-		// Check if this Package depends on the given Package
-		dependsOn := false
-		for _, dep := range variant.DependsOn {
-			// Check if dependency is in IgnoreDependencies
-			ignore := false
-			for _, ignoreDep := range pkg.Spec.IgnoreDependencies {
-				if ignoreDep == dep {
-					ignore = true
-					break
-				}
-			}
-			if ignore {
-				continue
-			}
-
-			if dep == packageName {
-				dependsOn = true
-				break
-			}
-		}
-
-		if dependsOn {
-			// Update the dependency status in this Package
-			if pkg.Status.Dependencies == nil {
-				pkg.Status.Dependencies = make(map[string]cozyv1alpha1.DependencyStatus)
-			}
-			pkg.Status.Dependencies[packageName] = cozyv1alpha1.DependencyStatus{
-				Ready: isReady,
-			}
-			if err := r.Status().Update(ctx, &pkg); err != nil {
-				logger.V(1).Error(err, "failed to update dependency status for dependent Package", "package", pkg.Name, "dependency", packageName)
-				continue
-			}
-			logger.V(1).Info("updated dependency status for dependent Package", "package", pkg.Name, "dependency", packageName, "ready", isReady)
-		}
-	}
-
-	return nil
-}
-
-// reconcileNamespaces creates or updates namespaces based on components in the variant
-func (r *PackageReconciler) reconcileNamespaces(ctx context.Context, pkg *cozyv1alpha1.Package, variant *cozyv1alpha1.Variant) error {
-	logger := log.FromContext(ctx)
-
-	// Collect namespaces from components
-	// Map: namespace -> {isPrivileged}
-	type namespaceInfo struct {
-		privileged bool
-	}
-	namespacesMap := make(map[string]namespaceInfo)
-
-	for _, component := range variant.Components {
-		// Skip components without Install section
-		if component.Install == nil {
-			continue
-		}
-
-		// Check if component is disabled via Package spec
-		if pkgComponent, ok := pkg.Spec.Components[component.Name]; ok {
-			if pkgComponent.Enabled != nil && !*pkgComponent.Enabled {
-				continue
-			}
-		}
-
-		// Namespace must be set
-		namespace := component.Install.Namespace
-		if namespace == "" {
-			return fmt.Errorf("component %s has empty namespace in Install section", component.Name)
-		}
-
-		info, exists := namespacesMap[namespace]
-		if !exists {
-			info = namespaceInfo{
-				privileged: false,
-			}
-		}
-
-		// If component is privileged, mark namespace as privileged
-		if component.Install.Privileged {
-			info.privileged = true
-		}
-
-		namespacesMap[namespace] = info
-	}
-
-	// Create or update all namespaces
-	for nsName, info := range namespacesMap {
-		namespace := &corev1.Namespace{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:   nsName,
-				Labels: make(map[string]string),
-				Annotations: map[string]string{
-					"helm.sh/resource-policy": "keep",
-				},
-			},
-		}
-
-		// Add system label only for non-tenant namespaces
-		if !strings.HasPrefix(nsName, "tenant-") {
-			namespace.Labels["cozystack.io/system"] = "true"
-		}
-
-		// Add privileged label if needed
-		if info.privileged {
-			namespace.Labels["pod-security.kubernetes.io/enforce"] = "privileged"
-		}
-
-		if err := r.createOrUpdateNamespace(ctx, namespace); err != nil {
-			logger.Error(err, "failed to reconcile namespace", "name", nsName, "privileged", info.privileged)
-			return fmt.Errorf("failed to reconcile namespace %s: %w", nsName, err)
-		}
-		logger.Info("reconciled namespace", "name", nsName, "privileged", info.privileged)
-	}
-
-	return nil
-}
-
-// createOrUpdateNamespace creates or updates a namespace using server-side apply
-func (r *PackageReconciler) createOrUpdateNamespace(ctx context.Context, namespace *corev1.Namespace) error {
-	// Ensure TypeMeta is set for server-side apply
-	namespace.SetGroupVersionKind(corev1.SchemeGroupVersion.WithKind("Namespace"))
-	
-	// Use server-side apply with field manager
-	// This is atomic and avoids race conditions from Get/Create/Update pattern
-	// Labels and annotations will be merged automatically by the server
-	// Each label/annotation key is treated as a separate field, so existing ones are preserved
-	return r.Patch(ctx, namespace, client.Apply, client.FieldOwner("cozystack-package-controller"))
-}
-
-// cleanupOrphanedHelmReleases removes HelmReleases that are no longer needed
-func (r *PackageReconciler) cleanupOrphanedHelmReleases(ctx context.Context, pkg *cozyv1alpha1.Package, variant *cozyv1alpha1.Variant) error {
-	logger := log.FromContext(ctx)
-
-	// Build map of desired HelmRelease names (from components with Install)
-	desiredReleases := make(map[types.NamespacedName]bool)
-	for _, component := range variant.Components {
-		if component.Install == nil {
-			continue
-		}
-
-		// Check if component is disabled via Package spec
-		if pkgComponent, ok := pkg.Spec.Components[component.Name]; ok {
-			if pkgComponent.Enabled != nil && !*pkgComponent.Enabled {
-				continue
-			}
-		}
-
-		namespace := component.Install.Namespace
-		if namespace == "" {
-			// Skip components with empty namespace (they shouldn't exist anyway)
-			continue
-		}
-
-		releaseName := component.Install.ReleaseName
-		if releaseName == "" {
-			releaseName = component.Name
-		}
-
-		desiredReleases[types.NamespacedName{
-			Name:      releaseName,
-			Namespace: namespace,
-		}] = true
-	}
-
-	// Find all HelmReleases owned by this Package
-	hrList := &helmv2.HelmReleaseList{}
-	if err := r.List(ctx, hrList, client.MatchingLabels{
-		"cozystack.io/package": pkg.Name,
-	}); err != nil {
-		return err
-	}
-
-	// Delete HelmReleases that are not in desired list
-	for _, hr := range hrList.Items {
-		key := types.NamespacedName{
-			Name:      hr.Name,
-			Namespace: hr.Namespace,
-		}
-		if !desiredReleases[key] {
-			logger.Info("deleting orphaned HelmRelease", "name", hr.Name, "namespace", hr.Namespace, "package", pkg.Name)
-			if err := r.Delete(ctx, &hr); err != nil && !apierrors.IsNotFound(err) {
-				logger.Error(err, "failed to delete orphaned HelmRelease", "name", hr.Name, "namespace", hr.Namespace)
-			}
-		}
-	}
-
-	return nil
-}
-
-// SetupWithManager sets up the controller with the Manager.
-func (r *PackageReconciler) SetupWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewControllerManagedBy(mgr).
-		Named("cozystack-package").
-		For(&cozyv1alpha1.Package{}).
-		Watches(
-			&cozyv1alpha1.PackageSource{},
-			handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, obj client.Object) []reconcile.Request {
-				ps, ok := obj.(*cozyv1alpha1.PackageSource)
-				if !ok {
-					return nil
-				}
-				// Find Package with the same name as PackageSource
-				// PackageSource and Package share the same name
-				pkg := &cozyv1alpha1.Package{}
-				if err := mgr.GetClient().Get(ctx, types.NamespacedName{Name: ps.Name}, pkg); err != nil {
-					// Package not found, that's ok - it might not exist yet
-					return nil
-				}
-				// Trigger reconcile for the corresponding Package
-				return []reconcile.Request{{
-					NamespacedName: types.NamespacedName{
-						Name: pkg.Name,
-					},
-				}}
-			}),
-		).
-		Watches(
-			&cozyv1alpha1.Package{},
-			handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, obj client.Object) []reconcile.Request {
-				updatedPkg, ok := obj.(*cozyv1alpha1.Package)
-				if !ok {
-					return nil
-				}
-				// Find all Packages that depend on this Package
-				packageList := &cozyv1alpha1.PackageList{}
-				if err := mgr.GetClient().List(ctx, packageList); err != nil {
-					return nil
-				}
-				var requests []reconcile.Request
-				for _, pkg := range packageList.Items {
-					if pkg.Name == updatedPkg.Name {
-						continue // Skip the Package itself
-					}
-					// Get variant to check dependencies
-					variant, err := r.getVariantForPackage(ctx, &pkg, mgr.GetClient())
-					if err != nil {
-						// Continue if PackageSource or variant not found
-						continue
-					}
-					// Check if this variant depends on updatedPkg
-					for _, dep := range variant.DependsOn {
-						// Check if dependency is in IgnoreDependencies
-						ignore := false
-						for _, ignoreDep := range pkg.Spec.IgnoreDependencies {
-							if ignoreDep == dep {
-								ignore = true
-								break
-							}
-						}
-						if ignore {
-							continue
-						}
-						if dep == updatedPkg.Name {
-							requests = append(requests, reconcile.Request{
-								NamespacedName: types.NamespacedName{
-									Name: pkg.Name,
-								},
-							})
-							break
-						}
-					}
-				}
-				return requests
-			}),
-		).
-		Complete(r)
-}

internal/operator/packagesource_reconciler.go

@@ -1,434 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package operator
-
-import (
-	"context"
-	"fmt"
-	"strings"
-
-	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
-	sourcewatcherv1beta1 "github.com/fluxcd/source-watcher/api/v2/v1beta1"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/api/meta"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/types"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/client/apiutil"
-	"sigs.k8s.io/controller-runtime/pkg/handler"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-	"sigs.k8s.io/controller-runtime/pkg/reconcile"
-)
-
-// PackageSourceReconciler reconciles PackageSource resources
-type PackageSourceReconciler struct {
-	client.Client
-	Scheme *runtime.Scheme
-}
-
-// +kubebuilder:rbac:groups=cozystack.io,resources=packagesources,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=cozystack.io,resources=packagesources/status,verbs=get;update;patch
-// +kubebuilder:rbac:groups=source.extensions.fluxcd.io,resources=artifactgenerators,verbs=get;list;watch;create;update;patch;delete
-
-// Reconcile is part of the main kubernetes reconciliation loop
-func (r *PackageSourceReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
-	logger := log.FromContext(ctx)
-
-	packageSource := &cozyv1alpha1.PackageSource{}
-	if err := r.Get(ctx, req.NamespacedName, packageSource); err != nil {
-		if apierrors.IsNotFound(err) {
-			// Resource not found, return (ownerReference will handle cleanup)
-			return ctrl.Result{}, nil
-		}
-		return ctrl.Result{}, err
-	}
-
-	// Generate ArtifactGenerator for package source
-	if err := r.reconcileArtifactGenerators(ctx, packageSource); err != nil {
-		logger.Error(err, "failed to reconcile ArtifactGenerator")
-		return ctrl.Result{}, err
-	}
-
-	// Update PackageSource status (variants and conditions from ArtifactGenerator)
-	if err := r.updateStatus(ctx, packageSource); err != nil {
-		logger.Error(err, "failed to update status")
-		// Don't return error, status update is not critical
-	}
-
-	return ctrl.Result{}, nil
-}
-
-// reconcileArtifactGenerators generates a single ArtifactGenerator for the package source
-// Creates one ArtifactGenerator per package source with all OutputArtifacts from components
-func (r *PackageSourceReconciler) reconcileArtifactGenerators(ctx context.Context, packageSource *cozyv1alpha1.PackageSource) error {
-	logger := log.FromContext(ctx)
-
-	// Check if SourceRef is set
-	if packageSource.Spec.SourceRef == nil {
-		logger.Info("skipping ArtifactGenerator creation, SourceRef not set", "packageSource", packageSource.Name)
-		return nil
-	}
-
-	// Namespace is always cozy-system
-	namespace := "cozy-system"
-	// ArtifactGenerator name is the package source name
-	agName := packageSource.Name
-
-	// Collect all OutputArtifacts
-	outputArtifacts := []sourcewatcherv1beta1.OutputArtifact{}
-
-	// Process all variants and their components
-	for _, variant := range packageSource.Spec.Variants {
-		// Build library map for this variant
-		// Map key is the library name (from lib.Name or extracted from path)
-		// This allows components in this variant to reference libraries by name
-		// Libraries are scoped per variant to avoid conflicts between variants
-		libraryMap := make(map[string]cozyv1alpha1.Library)
-		for _, lib := range variant.Libraries {
-			libName := lib.Name
-			if libName == "" {
-				// If library name is not set, extract from path
-				libName = r.getPackageNameFromPath(lib.Path)
-			}
-			if libName != "" {
-				// Store library with the resolved name
-				libraryMap[libName] = lib
-			}
-		}
-
-		for _, component := range variant.Components {
-			// Skip components without path
-			if component.Path == "" {
-				logger.V(1).Info("skipping component without path", "packageSource", packageSource.Name, "variant", variant.Name, "component", component.Name)
-				continue
-			}
-
-			logger.V(1).Info("processing component", "packageSource", packageSource.Name, "variant", variant.Name, "component", component.Name, "path", component.Path)
-
-			// Extract component name from path (last component)
-			componentPathName := r.getPackageNameFromPath(component.Path)
-			if componentPathName == "" {
-				logger.Info("skipping component with invalid path", "packageSource", packageSource.Name, "variant", variant.Name, "component", component.Name, "path", component.Path)
-				continue
-			}
-
-			// Get basePath with default values
-			basePath := r.getBasePath(packageSource)
-
-			// Build copy operations
-			copyOps := []sourcewatcherv1beta1.CopyOperation{
-				{
-					From: r.buildSourcePath(packageSource.Spec.SourceRef.Name, basePath, component.Path),
-					To:   fmt.Sprintf("@artifact/%s/", componentPathName),
-				},
-			}
-
-			// Add libraries if specified
-			for _, libName := range component.Libraries {
-				if lib, ok := libraryMap[libName]; ok {
-					copyOps = append(copyOps, sourcewatcherv1beta1.CopyOperation{
-						From: r.buildSourcePath(packageSource.Spec.SourceRef.Name, basePath, lib.Path),
-						To:   fmt.Sprintf("@artifact/%s/charts/%s/", componentPathName, libName),
-					})
-				}
-			}
-
-			// Add valuesFiles if specified
-			for i, valuesFile := range component.ValuesFiles {
-				strategy := "Merge"
-				if i == 0 {
-					strategy = "Overwrite"
-				}
-				copyOps = append(copyOps, sourcewatcherv1beta1.CopyOperation{
-					From:     r.buildSourceFilePath(packageSource.Spec.SourceRef.Name, basePath, fmt.Sprintf("%s/%s", component.Path, valuesFile)),
-					To:       fmt.Sprintf("@artifact/%s/values.yaml", componentPathName),
-					Strategy: strategy,
-				})
-			}
-
-			// Artifact name: <packagesource>-<variant>-<componentname>
-			// Replace dots with dashes to comply with Kubernetes naming requirements
-			artifactName := fmt.Sprintf("%s-%s-%s",
-				strings.ReplaceAll(packageSource.Name, ".", "-"),
-				strings.ReplaceAll(variant.Name, ".", "-"),
-				strings.ReplaceAll(component.Name, ".", "-"))
-
-			outputArtifacts = append(outputArtifacts, sourcewatcherv1beta1.OutputArtifact{
-				Name: artifactName,
-				Copy: copyOps,
-			})
-
-			logger.Info("added OutputArtifact for component", "packageSource", packageSource.Name, "variant", variant.Name, "component", component.Name, "artifactName", artifactName)
-		}
-	}
-
-	// If there are no OutputArtifacts, return (ownerReference will handle cleanup if needed)
-	if len(outputArtifacts) == 0 {
-		logger.Info("no OutputArtifacts to generate, skipping ArtifactGenerator creation", "packageSource", packageSource.Name)
-		return nil
-	}
-
-	// Build labels
-	labels := make(map[string]string)
-	labels["cozystack.io/packagesource"] = packageSource.Name
-
-	// Create single ArtifactGenerator for the package source
-	ag := &sourcewatcherv1beta1.ArtifactGenerator{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      agName,
-			Namespace: namespace,
-			Labels:    labels,
-		},
-		Spec: sourcewatcherv1beta1.ArtifactGeneratorSpec{
-			Sources: []sourcewatcherv1beta1.SourceReference{
-				{
-					Alias:     packageSource.Spec.SourceRef.Name,
-					Kind:      packageSource.Spec.SourceRef.Kind,
-					Name:      packageSource.Spec.SourceRef.Name,
-					Namespace: packageSource.Spec.SourceRef.Namespace,
-				},
-			},
-			OutputArtifacts: outputArtifacts,
-		},
-	}
-
-	// Set ownerReference
-	gvk, err := apiutil.GVKForObject(packageSource, r.Scheme)
-	if err != nil {
-		return fmt.Errorf("failed to get GVK for PackageSource: %w", err)
-	}
-	ag.OwnerReferences = []metav1.OwnerReference{
-		{
-			APIVersion: gvk.GroupVersion().String(),
-			Kind:       gvk.Kind,
-			Name:       packageSource.Name,
-			UID:        packageSource.UID,
-			Controller: func() *bool { b := true; return &b }(),
-		},
-	}
-
-	logger.Info("creating ArtifactGenerator for package source", "packageSource", packageSource.Name, "agName", agName, "namespace", namespace, "outputArtifactCount", len(outputArtifacts))
-
-	if err := r.createOrUpdate(ctx, ag); err != nil {
-		return fmt.Errorf("failed to reconcile ArtifactGenerator %s: %w", agName, err)
-	}
-
-	logger.Info("reconciled ArtifactGenerator for package source", "name", agName, "namespace", namespace, "outputArtifactCount", len(outputArtifacts))
-
-	return nil
-}
-
-// Helper functions
-func (r *PackageSourceReconciler) getPackageNameFromPath(path string) string {
-	parts := strings.Split(path, "/")
-	if len(parts) > 0 {
-		return parts[len(parts)-1]
-	}
-	return ""
-}
-
-// getBasePath returns the basePath with default values based on source kind
-func (r *PackageSourceReconciler) getBasePath(packageSource *cozyv1alpha1.PackageSource) string {
-	// If path is explicitly set in SourceRef, use it (but normalize "/" to empty)
-	if packageSource.Spec.SourceRef.Path != "" {
-		path := strings.Trim(packageSource.Spec.SourceRef.Path, "/")
-		// If path is "/" or empty after trim, return empty string
-		if path == "" {
-			return ""
-		}
-		return path
-	}
-	// Default values based on kind
-	if packageSource.Spec.SourceRef.Kind == "OCIRepository" {
-		return "" // Root for OCI
-	}
-	// Default for GitRepository
-	return "packages"
-}
-
-// buildSourcePath builds the full source path using basePath with glob pattern
-func (r *PackageSourceReconciler) buildSourcePath(sourceName, basePath, path string) string {
-	// Remove leading/trailing slashes and combine
-	parts := []string{}
-	if basePath != "" {
-		trimmed := strings.Trim(basePath, "/")
-		if trimmed != "" {
-			parts = append(parts, trimmed)
-		}
-	}
-	if path != "" {
-		trimmed := strings.Trim(path, "/")
-		if trimmed != "" {
-			parts = append(parts, trimmed)
-		}
-	}
-
-	fullPath := strings.Join(parts, "/")
-	if fullPath == "" {
-		return fmt.Sprintf("@%s/**", sourceName)
-	}
-	return fmt.Sprintf("@%s/%s/**", sourceName, fullPath)
-}
-
-// buildSourceFilePath builds the full source path for a specific file (without glob pattern)
-func (r *PackageSourceReconciler) buildSourceFilePath(sourceName, basePath, path string) string {
-	// Remove leading/trailing slashes and combine
-	parts := []string{}
-	if basePath != "" {
-		trimmed := strings.Trim(basePath, "/")
-		if trimmed != "" {
-			parts = append(parts, trimmed)
-		}
-	}
-	if path != "" {
-		trimmed := strings.Trim(path, "/")
-		if trimmed != "" {
-			parts = append(parts, trimmed)
-		}
-	}
-
-	fullPath := strings.Join(parts, "/")
-	if fullPath == "" {
-		return fmt.Sprintf("@%s", sourceName)
-	}
-	return fmt.Sprintf("@%s/%s", sourceName, fullPath)
-}
-
-// createOrUpdate creates or updates a resource using server-side apply
-func (r *PackageSourceReconciler) createOrUpdate(ctx context.Context, obj client.Object) error {
-	// Ensure TypeMeta is set for server-side apply
-	// Use type assertion to set GVK if the object supports it
-	if runtimeObj, ok := obj.(runtime.Object); ok {
-		gvk, err := apiutil.GVKForObject(obj, r.Scheme)
-		if err != nil {
-			return fmt.Errorf("failed to get GVK for object: %w", err)
-		}
-		runtimeObj.GetObjectKind().SetGroupVersionKind(gvk)
-	}
-
-	// Use server-side apply with field manager
-	// This is atomic and avoids race conditions from Get/Create/Update pattern
-	// Labels, annotations, and spec will be merged automatically by the server
-	// Each field is treated separately, so existing ones are preserved
-	return r.Patch(ctx, obj, client.Apply, client.FieldOwner("cozystack-packagesource-controller"))
-}
-
-// updateStatus updates PackageSource status (variants and conditions from ArtifactGenerator)
-func (r *PackageSourceReconciler) updateStatus(ctx context.Context, packageSource *cozyv1alpha1.PackageSource) error {
-	logger := log.FromContext(ctx)
-
-	// Update variants in status from spec
-	variantNames := make([]string, 0, len(packageSource.Spec.Variants))
-	for _, variant := range packageSource.Spec.Variants {
-		variantNames = append(variantNames, variant.Name)
-	}
-	packageSource.Status.Variants = strings.Join(variantNames, ",")
-
-	// Check if SourceRef is set
-	if packageSource.Spec.SourceRef == nil {
-		// Set status to unknown if SourceRef is not set
-		meta.SetStatusCondition(&packageSource.Status.Conditions, metav1.Condition{
-			Type:    "Ready",
-			Status:  metav1.ConditionUnknown,
-			Reason:  "SourceRefNotSet",
-			Message: "SourceRef is not configured",
-		})
-		return r.Status().Update(ctx, packageSource)
-	}
-
-	// Get ArtifactGenerator
-	ag := &sourcewatcherv1beta1.ArtifactGenerator{}
-	agKey := types.NamespacedName{
-		Name:      packageSource.Name,
-		Namespace: "cozy-system",
-	}
-
-	if err := r.Get(ctx, agKey, ag); err != nil {
-		if apierrors.IsNotFound(err) {
-			// ArtifactGenerator not found, set status to unknown
-			meta.SetStatusCondition(&packageSource.Status.Conditions, metav1.Condition{
-				Type:    "Ready",
-				Status:  metav1.ConditionUnknown,
-				Reason:  "ArtifactGeneratorNotFound",
-				Message: "ArtifactGenerator not found",
-			})
-			return r.Status().Update(ctx, packageSource)
-		}
-		return fmt.Errorf("failed to get ArtifactGenerator: %w", err)
-	}
-
-	// Find Ready condition in ArtifactGenerator
-	readyCondition := meta.FindStatusCondition(ag.Status.Conditions, "Ready")
-	if readyCondition == nil {
-		// No Ready condition in ArtifactGenerator, set status to unknown
-		meta.SetStatusCondition(&packageSource.Status.Conditions, metav1.Condition{
-			Type:    "Ready",
-			Status:  metav1.ConditionUnknown,
-			Reason:  "ArtifactGeneratorNotReady",
-			Message: "ArtifactGenerator Ready condition not found",
-		})
-		return r.Status().Update(ctx, packageSource)
-	}
-
-	// Copy Ready condition from ArtifactGenerator to PackageSource
-	meta.SetStatusCondition(&packageSource.Status.Conditions, metav1.Condition{
-		Type:               "Ready",
-		Status:             readyCondition.Status,
-		Reason:             readyCondition.Reason,
-		Message:            readyCondition.Message,
-		ObservedGeneration: packageSource.Generation,
-		LastTransitionTime: readyCondition.LastTransitionTime,
-	})
-
-	logger.V(1).Info("updated PackageSource status from ArtifactGenerator",
-		"packageSource", packageSource.Name,
-		"status", readyCondition.Status,
-		"reason", readyCondition.Reason)
-
-	return r.Status().Update(ctx, packageSource)
-}
-
-// SetupWithManager sets up the controller with the Manager.
-func (r *PackageSourceReconciler) SetupWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewControllerManagedBy(mgr).
-		Named("cozystack-packagesource").
-		For(&cozyv1alpha1.PackageSource{}).
-		Watches(
-			&sourcewatcherv1beta1.ArtifactGenerator{},
-			handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, obj client.Object) []reconcile.Request {
-				ag, ok := obj.(*sourcewatcherv1beta1.ArtifactGenerator)
-				if !ok {
-					return nil
-				}
-				// Find the PackageSource that owns this ArtifactGenerator by ownerReference
-				for _, ownerRef := range ag.OwnerReferences {
-					if ownerRef.Kind == "PackageSource" {
-						return []reconcile.Request{{
-							NamespacedName: types.NamespacedName{
-								Name: ownerRef.Name,
-							},
-						}}
-					}
-				}
-				return nil
-			}),
-		).
-		Complete(r)
-}
-

internal/operator/platform_reconciler.go

@@ -0,0 +1,541 @@
+/*
+Copyright 2025 The Cozystack Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package operator
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
+	helmv2 "github.com/fluxcd/helm-controller/api/v2"
+	sourcewatcherv1beta1 "github.com/fluxcd/source-watcher/api/v2/v1beta1"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/builder"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/predicate"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+)
+
+// PlatformReconciler reconciles Platform resources
+type PlatformReconciler struct {
+	client.Client
+	Scheme *runtime.Scheme
+}
+
+// +kubebuilder:rbac:groups=cozystack.io,resources=platforms,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=cozystack.io,resources=platforms/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=helm.toolkit.fluxcd.io,resources=helmreleases,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=source.extensions.fluxcd.io,resources=artifactgenerators,verbs=get;list;watch;create;update;patch;delete
+
+// Reconcile is part of the main kubernetes reconciliation loop
+func (r *PlatformReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	logger := log.FromContext(ctx)
+
+	platform := &cozyv1alpha1.Platform{}
+	if err := r.Get(ctx, req.NamespacedName, platform); err != nil {
+		if apierrors.IsNotFound(err) {
+			// Cleanup orphaned resources
+			return r.cleanupOrphanedResources(ctx, req.NamespacedName)
+		}
+		return ctrl.Result{}, err
+	}
+
+	// Set defaults
+	if platform.Spec.Interval == nil {
+		platform.Spec.Interval = &metav1.Duration{Duration: 5 * 60 * 1000000000} // 5m
+	}
+
+	// Reconcile ArtifactGenerator
+	if err := r.reconcileArtifactGenerator(ctx, platform); err != nil {
+		logger.Error(err, "failed to reconcile ArtifactGenerator")
+		return ctrl.Result{}, err
+	}
+
+	// Reconcile HelmRelease
+	if err := r.reconcileHelmRelease(ctx, platform); err != nil {
+		logger.Error(err, "failed to reconcile HelmRelease")
+		return ctrl.Result{}, err
+	}
+
+	// Cleanup orphaned resources with platform label
+	if err := r.cleanupOrphanedPlatformResources(ctx, platform); err != nil {
+		logger.Error(err, "failed to cleanup orphaned platform resources")
+		// Don't return error, just log it - cleanup is best effort
+	}
+
+	return ctrl.Result{}, nil
+}
+
+// reconcileArtifactGenerator creates or updates the ArtifactGenerator for the platform
+func (r *PlatformReconciler) reconcileArtifactGenerator(ctx context.Context, platform *cozyv1alpha1.Platform) error {
+	logger := log.FromContext(ctx)
+
+	// Use fixed namespace for cluster-scoped resource
+	namespace := "cozy-system"
+
+	// Get basePath with default values (already includes full path to platform)
+	basePath := r.getBasePath(platform)
+
+	// Build full path from basePath (basePath already contains the full path)
+	fullPath := r.buildSourcePath(platform.Spec.SourceRef.Name, basePath, "")
+	// Extract the last component for the artifact name
+	artifactPathParts := strings.Split(strings.Trim(basePath, "/"), "/")
+	artifactName := artifactPathParts[len(artifactPathParts)-1]
+
+	copyOps := []sourcewatcherv1beta1.CopyOperation{
+		{
+			From: fullPath + "/**",
+			To:   fmt.Sprintf("@artifact/%s/", artifactName),
+		},
+	}
+
+	// Create ArtifactGenerator
+	ag := &sourcewatcherv1beta1.ArtifactGenerator{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      platform.Name,
+			Namespace: namespace,
+			Labels: map[string]string{
+				"cozystack.io/platform": platform.Name,
+			},
+		},
+		Spec: sourcewatcherv1beta1.ArtifactGeneratorSpec{
+			Sources: []sourcewatcherv1beta1.SourceReference{
+				{
+					Alias:     platform.Spec.SourceRef.Name,
+					Kind:      platform.Spec.SourceRef.Kind,
+					Name:      platform.Spec.SourceRef.Name,
+					Namespace: platform.Spec.SourceRef.Namespace,
+				},
+			},
+			OutputArtifacts: []sourcewatcherv1beta1.OutputArtifact{
+				{
+					Name: artifactName,
+					Copy: copyOps,
+				},
+			},
+		},
+	}
+
+	// Set ownerReference
+	ag.OwnerReferences = []metav1.OwnerReference{
+		{
+			APIVersion: platform.APIVersion,
+			Kind:       platform.Kind,
+			Name:       platform.Name,
+			UID:        platform.UID,
+			Controller: func() *bool { b := true; return &b }(),
+		},
+	}
+
+	logger.Info("reconciling ArtifactGenerator", "name", platform.Name, "namespace", namespace)
+
+	if err := r.createOrUpdate(ctx, ag); err != nil {
+		return fmt.Errorf("failed to reconcile ArtifactGenerator %s: %w", platform.Name, err)
+	}
+
+	logger.Info("reconciled ArtifactGenerator", "name", platform.Name, "namespace", namespace)
+	return nil
+}
+
+// reconcileHelmRelease creates or updates the HelmRelease for the platform
+func (r *PlatformReconciler) reconcileHelmRelease(ctx context.Context, platform *cozyv1alpha1.Platform) error {
+	logger := log.FromContext(ctx)
+
+	// HelmRelease name is fixed: cozystack-platform
+	// Use fixed namespace for cluster-scoped resource
+	namespace := "cozy-system"
+
+	// Get artifact name (last component of basePath)
+	basePath := r.getBasePath(platform)
+	artifactPathParts := strings.Split(strings.Trim(basePath, "/"), "/")
+	artifactName := artifactPathParts[len(artifactPathParts)-1]
+
+	// Merge values with sourceRef
+	values := r.mergeValuesWithSourceRef(platform.Spec.Values, platform.Spec.SourceRef)
+
+	// Create HelmRelease
+	hr := &helmv2.HelmRelease{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      platform.Name,
+			Namespace: namespace,
+			Labels: map[string]string{
+				"cozystack.io/platform": platform.Name,
+			},
+		},
+		Spec: helmv2.HelmReleaseSpec{
+			Interval:        *platform.Spec.Interval,
+			TargetNamespace: "cozy-system",
+			ReleaseName:     "cozystack-platform",
+			ChartRef: &helmv2.CrossNamespaceSourceReference{
+				Kind:      "ExternalArtifact",
+				Name:      artifactName,
+				Namespace: namespace,
+			},
+			Values: values,
+			Install: &helmv2.Install{
+				Remediation: &helmv2.InstallRemediation{
+					Retries: -1,
+				},
+			},
+			Upgrade: &helmv2.Upgrade{
+				Remediation: &helmv2.UpgradeRemediation{
+					Retries: -1,
+				},
+			},
+		},
+	}
+
+	// Set ownerReference
+	hr.OwnerReferences = []metav1.OwnerReference{
+		{
+			APIVersion: platform.APIVersion,
+			Kind:       platform.Kind,
+			Name:       platform.Name,
+			UID:        platform.UID,
+			Controller: func() *bool { b := true; return &b }(),
+		},
+	}
+
+	logger.Info("reconciling HelmRelease", "name", platform.Name, "namespace", namespace)
+
+	if err := r.createOrUpdate(ctx, hr); err != nil {
+		return fmt.Errorf("failed to reconcile HelmRelease %s: %w", platform.Name, err)
+	}
+
+	logger.Info("reconciled HelmRelease", "name", platform.Name, "namespace", namespace)
+	return nil
+}
+
+// mergeValuesWithSourceRef merges platform values with sourceRef
+func (r *PlatformReconciler) mergeValuesWithSourceRef(values *apiextensionsv1.JSON, sourceRef cozyv1alpha1.SourceRef) *apiextensionsv1.JSON {
+	// Build sourceRef map
+	sourceRefMap := map[string]interface{}{
+		"kind":      sourceRef.Kind,
+		"name":      sourceRef.Name,
+		"namespace": sourceRef.Namespace,
+	}
+
+	// If values is nil or empty, create new values with sourceRef
+	if values == nil || len(values.Raw) == 0 {
+		valuesMap := map[string]interface{}{
+			"sourceRef": sourceRefMap,
+		}
+		raw, _ := json.Marshal(valuesMap)
+		return &apiextensionsv1.JSON{Raw: raw}
+	}
+
+	// Parse existing values
+	var valuesMap map[string]interface{}
+	if err := json.Unmarshal(values.Raw, &valuesMap); err != nil {
+		// If unmarshal fails, create new values with sourceRef
+		valuesMap = map[string]interface{}{
+			"sourceRef": sourceRefMap,
+		}
+		raw, _ := json.Marshal(valuesMap)
+		return &apiextensionsv1.JSON{Raw: raw}
+	}
+
+	// Merge sourceRef into values (overwrite if exists)
+	valuesMap["sourceRef"] = sourceRefMap
+
+	// Marshal back to JSON
+	raw, err := json.Marshal(valuesMap)
+	if err != nil {
+		// If marshal fails, return original values
+		return values
+	}
+
+	return &apiextensionsv1.JSON{Raw: raw}
+}
+
+// getBasePath returns the basePath with default values based on source kind
+func (r *PlatformReconciler) getBasePath(platform *cozyv1alpha1.Platform) string {
+	if platform.Spec.BasePath != "" {
+		return platform.Spec.BasePath
+	}
+	// Default values based on kind
+	if platform.Spec.SourceRef.Kind == "OCIRepository" {
+		return "core/platform" // Full path for OCI
+	}
+	// Default for GitRepository
+	return "packages/core/platform" // Full path for Git
+}
+
+// buildSourcePath builds the full source path from basePath and chart path
+func (r *PlatformReconciler) buildSourcePath(sourceName, basePath, chartPath string) string {
+	// Remove leading/trailing slashes and combine
+	parts := []string{}
+	if basePath != "" {
+		parts = append(parts, strings.Trim(basePath, "/"))
+	}
+	if chartPath != "" {
+		parts = append(parts, strings.Trim(chartPath, "/"))
+	}
+	fullPath := strings.Join(parts, "/")
+	if fullPath == "" {
+		return fmt.Sprintf("@%s", sourceName)
+	}
+	return fmt.Sprintf("@%s/%s", sourceName, fullPath)
+}
+
+// cleanupOrphanedResources removes ArtifactGenerator and HelmRelease when Platform is deleted
+func (r *PlatformReconciler) cleanupOrphanedResources(ctx context.Context, name client.ObjectKey) (ctrl.Result, error) {
+	logger := log.FromContext(ctx)
+	namespace := "cozy-system"
+
+	// Cleanup HelmReleases with the platform label that don't match
+	hrList := &helmv2.HelmReleaseList{}
+	if err := r.List(ctx, hrList, client.InNamespace(namespace), client.MatchingLabels{
+		"cozystack.io/platform": name.Name,
+	}); err != nil {
+		logger.Error(err, "failed to list HelmReleases for cleanup")
+		return ctrl.Result{}, err
+	}
+
+	for i := range hrList.Items {
+		hr := &hrList.Items[i]
+		// Check if this HelmRelease should exist (matches current Platform name)
+		// Since Platform is being deleted, all matching HelmReleases should be deleted
+		// OwnerReferences should handle this, but we'll also delete explicitly
+		if err := r.Delete(ctx, hr); err != nil {
+			if !apierrors.IsNotFound(err) {
+				logger.Error(err, "failed to delete orphaned HelmRelease", "name", hr.Name)
+			}
+		} else {
+			logger.Info("deleted orphaned HelmRelease", "name", hr.Name)
+		}
+	}
+
+	// Cleanup ArtifactGenerators with the platform label
+	agList := &sourcewatcherv1beta1.ArtifactGeneratorList{}
+	if err := r.List(ctx, agList, client.InNamespace(namespace), client.MatchingLabels{
+		"cozystack.io/platform": name.Name,
+	}); err != nil {
+		logger.Error(err, "failed to list ArtifactGenerators for cleanup")
+		return ctrl.Result{}, err
+	}
+
+	for i := range agList.Items {
+		ag := &agList.Items[i]
+		if err := r.Delete(ctx, ag); err != nil {
+			if !apierrors.IsNotFound(err) {
+				logger.Error(err, "failed to delete orphaned ArtifactGenerator", "name", ag.Name)
+			}
+		} else {
+			logger.Info("deleted orphaned ArtifactGenerator", "name", ag.Name)
+		}
+	}
+
+	return ctrl.Result{}, nil
+}
+
+// cleanupOrphanedPlatformResources removes HelmRelease and ArtifactGenerator resources
+// that have the platform label but don't match the current Platform
+func (r *PlatformReconciler) cleanupOrphanedPlatformResources(ctx context.Context, platform *cozyv1alpha1.Platform) error {
+	logger := log.FromContext(ctx)
+	namespace := "cozy-system"
+	platformName := platform.Name
+
+	// Cleanup orphaned HelmReleases
+	hrList := &helmv2.HelmReleaseList{}
+	if err := r.List(ctx, hrList, client.InNamespace(namespace), client.MatchingLabels{
+		"cozystack.io/platform": platformName,
+	}); err != nil {
+		return fmt.Errorf("failed to list HelmReleases: %w", err)
+	}
+
+	for i := range hrList.Items {
+		hr := &hrList.Items[i]
+		// Only delete if it doesn't match the current Platform name
+		// (in case Platform name changed)
+		if hr.Name != platformName {
+			logger.Info("deleting orphaned HelmRelease", "name", hr.Name, "expected", platformName)
+			if err := r.Delete(ctx, hr); err != nil {
+				if !apierrors.IsNotFound(err) {
+					logger.Error(err, "failed to delete orphaned HelmRelease", "name", hr.Name)
+					// Continue with other resources
+				}
+			}
+		}
+	}
+
+	// Cleanup orphaned ArtifactGenerators
+	agList := &sourcewatcherv1beta1.ArtifactGeneratorList{}
+	if err := r.List(ctx, agList, client.InNamespace(namespace), client.MatchingLabels{
+		"cozystack.io/platform": platformName,
+	}); err != nil {
+		return fmt.Errorf("failed to list ArtifactGenerators: %w", err)
+	}
+
+	for i := range agList.Items {
+		ag := &agList.Items[i]
+		// Only delete if it doesn't match the current Platform name
+		if ag.Name != platformName {
+			logger.Info("deleting orphaned ArtifactGenerator", "name", ag.Name, "expected", platformName)
+			if err := r.Delete(ctx, ag); err != nil {
+				if !apierrors.IsNotFound(err) {
+					logger.Error(err, "failed to delete orphaned ArtifactGenerator", "name", ag.Name)
+					// Continue with other resources
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
+// createOrUpdate creates or updates a resource
+func (r *PlatformReconciler) createOrUpdate(ctx context.Context, obj client.Object) error {
+	existing := obj.DeepCopyObject().(client.Object)
+	key := client.ObjectKeyFromObject(obj)
+
+	err := r.Get(ctx, key, existing)
+	if apierrors.IsNotFound(err) {
+		return r.Create(ctx, obj)
+	} else if err != nil {
+		return err
+	}
+
+	// Preserve resource version
+	obj.SetResourceVersion(existing.GetResourceVersion())
+	// Merge labels and annotations
+	labels := obj.GetLabels()
+	if labels == nil {
+		labels = make(map[string]string)
+	}
+	for k, v := range existing.GetLabels() {
+		if _, ok := labels[k]; !ok {
+			labels[k] = v
+		}
+	}
+	obj.SetLabels(labels)
+
+	annotations := obj.GetAnnotations()
+	if annotations == nil {
+		annotations = make(map[string]string)
+	}
+	for k, v := range existing.GetAnnotations() {
+		if _, ok := annotations[k]; !ok {
+			annotations[k] = v
+		}
+	}
+	obj.SetAnnotations(annotations)
+
+	// For ArtifactGenerator, explicitly update Spec and ownerReferences
+	if ag, ok := obj.(*sourcewatcherv1beta1.ArtifactGenerator); ok {
+		if existingAG, ok := existing.(*sourcewatcherv1beta1.ArtifactGenerator); ok {
+			logger := log.FromContext(ctx)
+			logger.V(1).Info("updating ArtifactGenerator Spec", "name", ag.Name, "namespace", ag.Namespace)
+			existingAG.Spec = ag.Spec
+			existingAG.SetLabels(ag.GetLabels())
+			existingAG.SetAnnotations(ag.GetAnnotations())
+			// Always use ownerReferences from the new object (set in reconcileArtifactGenerator)
+			existingAG.SetOwnerReferences(ag.GetOwnerReferences())
+			obj = existingAG
+		}
+	}
+
+	// For HelmRelease, explicitly update Spec and ownerReferences
+	if hr, ok := obj.(*helmv2.HelmRelease); ok {
+		if existingHR, ok := existing.(*helmv2.HelmRelease); ok {
+			logger := log.FromContext(ctx)
+			logger.V(1).Info("updating HelmRelease Spec", "name", hr.Name, "namespace", hr.Namespace)
+			existingHR.Spec = hr.Spec
+			existingHR.SetLabels(hr.GetLabels())
+			existingHR.SetAnnotations(hr.GetAnnotations())
+			// Always use ownerReferences from the new object (set in reconcileHelmRelease)
+			existingHR.SetOwnerReferences(hr.GetOwnerReferences())
+			obj = existingHR
+		}
+	}
+
+	return r.Update(ctx, obj)
+}
+
+// SetupWithManager sets up the controller with the Manager
+func (r *PlatformReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewControllerManagedBy(mgr).
+		Named("cozystack-platform").
+		For(&cozyv1alpha1.Platform{}).
+		Watches(
+			&helmv2.HelmRelease{},
+			handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, obj client.Object) []reconcile.Request {
+				hr, ok := obj.(*helmv2.HelmRelease)
+				if !ok {
+					return nil
+				}
+				// Only watch HelmReleases with cozystack.io/platform label
+				platformName := hr.Labels["cozystack.io/platform"]
+				if platformName == "" {
+					return nil
+				}
+				return []reconcile.Request{
+					{
+						NamespacedName: client.ObjectKey{
+							Name: platformName,
+							// Cluster-scoped resource has no namespace
+						},
+					},
+				}
+			}),
+			builder.WithPredicates(
+				predicate.NewPredicateFuncs(func(obj client.Object) bool {
+					// Only watch resources with cozystack.io/platform label
+					labels := obj.GetLabels()
+					return labels != nil && labels["cozystack.io/platform"] != ""
+				}),
+			),
+		).
+		Watches(
+			&sourcewatcherv1beta1.ArtifactGenerator{},
+			handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, obj client.Object) []reconcile.Request {
+				ag, ok := obj.(*sourcewatcherv1beta1.ArtifactGenerator)
+				if !ok {
+					return nil
+				}
+				// Only watch ArtifactGenerators with cozystack.io/platform label
+				platformName := ag.Labels["cozystack.io/platform"]
+				if platformName == "" {
+					return nil
+				}
+				return []reconcile.Request{
+					{
+						NamespacedName: client.ObjectKey{
+							Name: platformName,
+							// Cluster-scoped resource has no namespace
+						},
+					},
+				}
+			}),
+			builder.WithPredicates(
+				predicate.NewPredicateFuncs(func(obj client.Object) bool {
+					// Only watch resources with cozystack.io/platform label
+					labels := obj.GetLabels()
+					return labels != nil && labels["cozystack.io/platform"] != ""
+				}),
+			),
+		).
+		Complete(r)
+}

internal/shared/crdmem/memory.go

@@ -11,13 +11,13 @@ import (
 
 type Memory struct {
 	mu        sync.RWMutex
-	data      map[string]cozyv1alpha1.CozystackResourceDefinition
+	data      map[string]cozyv1alpha1.ApplicationDefinition
 	primed    bool
 	primeOnce sync.Once
 }
 
 func New() *Memory {
-	return &Memory{data: make(map[string]cozyv1alpha1.CozystackResourceDefinition)}
+	return &Memory{data: make(map[string]cozyv1alpha1.ApplicationDefinition)}
 }
 
 var (
@@ -30,7 +30,7 @@ func Global() *Memory {
 	return global
 }
 
-func (m *Memory) Upsert(obj *cozyv1alpha1.CozystackResourceDefinition) {
+func (m *Memory) Upsert(obj *cozyv1alpha1.ApplicationDefinition) {
 	if obj == nil {
 		return
 	}
@@ -45,10 +45,10 @@ func (m *Memory) Delete(name string) {
 	m.mu.Unlock()
 }
 
-func (m *Memory) Snapshot() []cozyv1alpha1.CozystackResourceDefinition {
+func (m *Memory) Snapshot() []cozyv1alpha1.ApplicationDefinition {
 	m.mu.RLock()
 	defer m.mu.RUnlock()
-	out := make([]cozyv1alpha1.CozystackResourceDefinition, 0, len(m.data))
+	out := make([]cozyv1alpha1.ApplicationDefinition, 0, len(m.data))
 	for _, v := range m.data {
 		out = append(out, v)
 	}
@@ -72,7 +72,7 @@ func (m *Memory) EnsurePrimingWithManager(mgr ctrl.Manager) error {
 			if ok := mgr.GetCache().WaitForCacheSync(ctx); !ok {
 				return nil
 			}
-			var list cozyv1alpha1.CozystackResourceDefinitionList
+			var list cozyv1alpha1.ApplicationDefinitionList
 			if err := mgr.GetClient().List(ctx, &list); err == nil {
 				for i := range list.Items {
 					m.Upsert(&list.Items[i])
@@ -87,11 +87,11 @@ func (m *Memory) EnsurePrimingWithManager(mgr ctrl.Manager) error {
 	return errOut
 }
 
-func (m *Memory) ListFromCacheOrAPI(ctx context.Context, c client.Client) ([]cozyv1alpha1.CozystackResourceDefinition, error) {
+func (m *Memory) ListFromCacheOrAPI(ctx context.Context, c client.Client) ([]cozyv1alpha1.ApplicationDefinition, error) {
 	if m.IsPrimed() {
 		return m.Snapshot(), nil
 	}
-	var list cozyv1alpha1.CozystackResourceDefinitionList
+	var list cozyv1alpha1.ApplicationDefinitionList
 	if err := c.List(ctx, &list); err != nil {
 		return nil, err
 	}

internal/telemetry/collector.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"fmt"
 	"net/http"
+	"sort"
 	"strings"
 	"time"
 
@@ -120,16 +121,50 @@ func (c *Collector) collect(ctx context.Context) {
 
 	clusterID := string(kubeSystemNS.UID)
 
-	var cozystackCM corev1.ConfigMap
-	if err := c.client.Get(ctx, types.NamespacedName{Namespace: "cozy-system", Name: "cozystack"}, &cozystackCM); err != nil {
-		logger.Info(fmt.Sprintf("Failed to get cozystack configmap in cozy-system namespace: %v", err))
-		return
-	}
+	// Get all Bundles
+	var bundleList cozyv1alpha1.BundleList
+	bundleNameStr := ""
+	bundleEnable := ""
+	bundleDisable := ""
+	oidcEnabled := "false"
 
-	oidcEnabled := cozystackCM.Data["oidc-enabled"]
-	bundle := cozystackCM.Data["bundle-name"]
-	bundleEnable := cozystackCM.Data["bundle-enable"]
-	bundleDisable := cozystackCM.Data["bundle-disable"]
+	if err := c.client.List(ctx, &bundleList); err != nil {
+		logger.Info(fmt.Sprintf("Failed to list Bundles: %v", err))
+		// Continue with empty bundle data instead of returning
+	} else {
+		// Collect bundle names (sorted alphabetically)
+		bundleNames := make([]string, 0, len(bundleList.Items))
+		for _, bundle := range bundleList.Items {
+			bundleNames = append(bundleNames, bundle.Name)
+		}
+		sort.Strings(bundleNames)
+		bundleNameStr = strings.Join(bundleNames, ",")
+
+		// Collect all packages from all bundles
+		var allEnabledPackages []string
+		var allDisabledPackages []string
+
+		for _, bundle := range bundleList.Items {
+			for _, pkg := range bundle.Spec.Packages {
+				if pkg.Disabled {
+					allDisabledPackages = append(allDisabledPackages, pkg.Name)
+				} else {
+					allEnabledPackages = append(allEnabledPackages, pkg.Name)
+					// Check if keycloak package is enabled
+					if pkg.Name == "keycloak" {
+						oidcEnabled = "true"
+					}
+				}
+			}
+		}
+
+		// Sort package lists alphabetically
+		sort.Strings(allEnabledPackages)
+		sort.Strings(allDisabledPackages)
+
+		bundleEnable = strings.Join(allEnabledPackages, ",")
+		bundleDisable = strings.Join(allDisabledPackages, ",")
+	}
 
 	// Get Kubernetes version from nodes
 	var nodeList corev1.NodeList
@@ -143,32 +178,41 @@ func (c *Collector) collect(ctx context.Context) {
 
 	// Add Cozystack info metric
 	if len(nodeList.Items) > 0 {
-		k8sVersion, _ := c.discoveryClient.ServerVersion()
+		k8sVersion := "unknown"
+		if version, err := c.discoveryClient.ServerVersion(); err == nil && version != nil {
+			k8sVersion = version.String()
+		}
 		metrics.WriteString(fmt.Sprintf(
-			"cozy_cluster_info{cozystack_version=\"%s\",kubernetes_version=\"%s\",oidc_enabled=\"%s\",bundle_name=\"%s\",bunde_enable=\"%s\",bunde_disable=\"%s\"} 1\n",
+			"cozy_cluster_info{cozystack_version=\"%s\",kubernetes_version=\"%s\",oidc_enabled=\"%s\",bundle_name=\"%s\",bundle_enable=\"%s\",bundle_disable=\"%s\"} 1\n",
 			c.config.CozystackVersion,
 			k8sVersion,
 			oidcEnabled,
-			bundle,
+			bundleNameStr,
 			bundleEnable,
 			bundleDisable,
 		))
 	}
 
 	// Collect node metrics
+	if len(nodeList.Items) > 0 {
 	nodeOSCount := make(map[string]int)
+		kernelVersion := "unknown"
 	for _, node := range nodeList.Items {
 		key := fmt.Sprintf("%s (%s)", node.Status.NodeInfo.OperatingSystem, node.Status.NodeInfo.OSImage)
 		nodeOSCount[key] = nodeOSCount[key] + 1
+			if kernelVersion == "unknown" && node.Status.NodeInfo.KernelVersion != "" {
+				kernelVersion = node.Status.NodeInfo.KernelVersion
+			}
 	}
 
 	for osKey, count := range nodeOSCount {
 		metrics.WriteString(fmt.Sprintf(
 			"cozy_nodes_count{os=\"%s\",kernel=\"%s\"} %d\n",
 			osKey,
-			nodeList.Items[0].Status.NodeInfo.KernelVersion,
+				kernelVersion,
 			count,
 		))
+		}
 	}
 
 	// Collect LoadBalancer services metrics
@@ -248,9 +292,8 @@ func (c *Collector) collect(ctx context.Context) {
 	var monitorList cozyv1alpha1.WorkloadMonitorList
 	if err := c.client.List(ctx, &monitorList); err != nil {
 		logger.Info(fmt.Sprintf("Failed to list WorkloadMonitors: %v", err))
-		return
-	}
-
+		// Continue without workload metrics instead of returning
+	} else {
 	for _, monitor := range monitorList.Items {
 		metrics.WriteString(fmt.Sprintf(
 			"cozy_workloads_count{uid=\"%s\",kind=\"%s\",type=\"%s\",version=\"%s\"} %d\n",
@@ -260,6 +303,7 @@ func (c *Collector) collect(ctx context.Context) {
 			monitor.Spec.Version,
 			monitor.Status.ObservedReplicas,
 		))
+		}
 	}
 
 	// Send metrics

packages/apps/Makefile

@@ -1,12 +1,7 @@
 OUT=../../_out/repos/apps
 CHARTS := $(shell find . -maxdepth 2 -name Chart.yaml | awk -F/ '{print $$2}')
 
-include ../../scripts/common-envs.mk
-
-repo:
-	rm -rf "$(OUT)"
-	helm package -d "$(OUT)" $(CHARTS) --version $(COZYSTACK_VERSION)
-	helm repo index "$(OUT)"
+include ../../hack/common-envs.mk
 
 fix-charts:
 	find . -maxdepth 2 -name Chart.yaml | awk -F/ '{print $$2}' | while read i; do sed -i -e "s/^name: .*/name: $$i/" -e "s/^version: .*/version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process/g" "$$i/Chart.yaml"; done

packages/apps/README.md

@@ -1,8 +0,0 @@
-### How to test packages local
-
-```bash
-cd packages/core/installer
-make image-cozystack REGISTRY=YOUR_CUSTOM_REGISTRY
-make apply
-kubectl delete po -l app=source-controller -n cozy-fluxcd
-```

packages/apps/bucket/.helmignore

@@ -1,4 +0,0 @@
-.helmignore
-/logos
-/Makefile
-/hack

packages/apps/bucket/Makefile

@@ -1,4 +1,4 @@
-include ../../../scripts/package.mk
+include ../../../hack/package.mk
 
 generate:
 	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md

packages/apps/bucket/hack/bucket-lock.sh

@@ -1,78 +0,0 @@
-#!/bin/sh
-
-set -e
-
-usage() {
-    echo "Usage: $0 <lock|unlock> <namespace> <bucket-name>"
-    echo ""
-    echo "Commands:"
-    echo "  lock    - Block deletion and modification of objects in the bucket"
-    echo "  unlock  - Restore full access to the bucket"
-    echo ""
-    echo "Example:"
-    echo "  $0 lock tenant-root somebucket"
-    echo "  $0 unlock tenant-root somebucket"
-    exit 1
-}
-
-if [ $# -ne 3 ]; then
-    usage
-fi
-
-ACTION="$1"
-NAMESPACE="$2"
-BUCKET_NAME="$3"
-
-if [ "$ACTION" != "lock" ] && [ "$ACTION" != "unlock" ]; then
-    echo "Error: First argument must be 'lock' or 'unlock'"
-    usage
-fi
-
-# Check if bucket exists
-if ! kubectl get buckets.apps.cozystack.io -n "$NAMESPACE" "$BUCKET_NAME" > /dev/null 2>&1; then
-    echo "Error: Bucket '$BUCKET_NAME' not found in namespace '$NAMESPACE'"
-    exit 1
-fi
-
-# Get secret and extract bucket config and bucket name using go-template + jq
-SECRET_NAME="bucket-$BUCKET_NAME"
-BUCKET_INFO=$(kubectl get secret -n "$NAMESPACE" "$SECRET_NAME" -o go-template='{{ .data.BucketInfo | base64decode }}')
-BUCKET_CONFIG=$(echo "$BUCKET_INFO" | jq -r '.metadata.name')
-S3_BUCKET_NAME=$(echo "$BUCKET_INFO" | jq -r '.spec.bucketName')
-
-# Convert bc- prefix to ba- for bucket account username
-BUCKET_ACCOUNT=$(echo "$BUCKET_CONFIG" | sed 's/^bc-/ba-/')
-
-if [ -z "$BUCKET_ACCOUNT" ] || [ -z "$S3_BUCKET_NAME" ]; then
-    echo "Error: Could not extract bucket account or bucket name from secret '$SECRET_NAME'"
-    exit 1
-fi
-
-# Get seaweedfs namespace from namespace annotation
-SEAWEEDFS_NS=$(kubectl get namespace "$NAMESPACE" -o jsonpath='{.metadata.annotations.namespace\.cozystack\.io/seaweedfs}')
-
-if [ -z "$SEAWEEDFS_NS" ]; then
-    echo "Error: Could not find seaweedfs namespace annotation on namespace '$NAMESPACE'"
-    exit 1
-fi
-
-# Build the s3.configure command
-ACTIONS="Read:$S3_BUCKET_NAME,Write:$S3_BUCKET_NAME,List:$S3_BUCKET_NAME,Tagging:$S3_BUCKET_NAME"
-
-if [ "$ACTION" = "lock" ]; then
-    S3_CMD="s3.configure -actions $ACTIONS -user $BUCKET_ACCOUNT --delete --apply"
-    echo "Locking bucket '$BUCKET_NAME' in namespace '$NAMESPACE'..."
-else
-    S3_CMD="s3.configure -actions $ACTIONS -user $BUCKET_ACCOUNT --apply"
-    echo "Unlocking bucket '$BUCKET_NAME' in namespace '$NAMESPACE'..."
-fi
-
-echo "Executing command in seaweedfs-master-0 (namespace: $SEAWEEDFS_NS):"
-echo "  $S3_CMD"
-echo ""
-
-# Execute the command
-echo "$S3_CMD" | kubectl exec -i -n "$SEAWEEDFS_NS" seaweedfs-master-0 -- weed shell
-
-echo ""
-echo "Done. Bucket '$BUCKET_NAME' has been ${ACTION}ed."

packages/apps/bucket/templates/bucketclaim.yaml

@@ -1,5 +1,6 @@
-{{- $myNS := lookup "v1" "Namespace" "" .Release.Namespace }}
-{{- $seaweedfs := index $myNS.metadata.annotations "namespace.cozystack.io/seaweedfs" }}
+{{- $cozystack := .Values._cozystack | default dict }}
+{{- $namespace := .Values._namespace | default dict }}
+{{- $seaweedfs := dig "seaweedfs" "" $namespace }}
 apiVersion: objectstorage.k8s.io/v1alpha1
 kind: BucketClaim
 metadata:

packages/apps/bucket/templates/helmrelease.yaml

@@ -3,15 +3,10 @@ kind: HelmRelease
 metadata:
   name: {{ .Release.Name }}-system
 spec:
-  chart:
-    spec:
-      chart: cozy-bucket
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-iaas-bucket
+    namespace: cozy-system
   interval: 5m
   timeout: 10m
   install:

packages/apps/clickhouse/Makefile

@@ -1,7 +1,7 @@
 CLICKHOUSE_BACKUP_TAG = $(shell awk '$$0 ~ /^version:/ {print $$2}' Chart.yaml)
 
-include ../../../scripts/common-envs.mk
-include ../../../scripts/package.mk
+include ../../../hack/common-envs.mk
+include ../../../hack/package.mk
 
 generate:
 	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md

packages/apps/clickhouse/templates/chkeeper.yaml

@@ -1,5 +1,5 @@
-{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
-{{- $clusterDomain := (index $cozyConfig.data "cluster-domain") | default "cozy.local" }}
+{{- $cozystack := .Values._cozystack | default dict }}
+{{- $clusterDomain := dig "networking" "clusterDomain" "cozy.local" $cozystack }}
 
 {{- if .Values.clickhouseKeeper.enabled }}
 apiVersion: "clickhouse-keeper.altinity.com/v1"

packages/apps/clickhouse/templates/clickhouse.yaml

@@ -1,5 +1,5 @@
-{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
-{{- $clusterDomain := (index $cozyConfig.data "cluster-domain") | default "cozy.local" }}
+{{- $cozystack := .Values._cozystack | default dict }}
+{{- $clusterDomain := dig "networking" "clusterDomain" "cozy.local" $cozystack }}
 {{- $existingSecret := lookup "v1" "Secret" .Release.Namespace (printf "%s-credentials" .Release.Name) }}
 {{- $passwords := dict }}
 {{- $users := .Values.users }}

packages/apps/ferretdb/Makefile

@@ -1,4 +1,4 @@
-include ../../../scripts/package.mk
+include ../../../hack/package.mk
 
 generate:
 	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md