[cozystack-api] Fix List kinds

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

.github/workflows/backport.yaml

@@ -2,7 +2,7 @@ name: Automatic Backport
 
 on:
   pull_request_target:
-    types: [closed, labeled]   # fires when PR is closed (merged) or labeled
+    types: [closed]   # fires when PR is closed (merged)
 
 concurrency:
   group: backport-${{ github.workflow }}-${{ github.event.pull_request.number }}
@@ -13,46 +13,22 @@ permissions:
   pull-requests: write
 
 jobs:
-  # Determine which backports are needed
-  prepare:
+  backport:
     if: |
       github.event.pull_request.merged == true &&
-      (
-        contains(github.event.pull_request.labels.*.name, 'backport') ||
-        contains(github.event.pull_request.labels.*.name, 'backport-previous') ||
-        (github.event.action == 'labeled' && (github.event.label.name == 'backport' || github.event.label.name == 'backport-previous'))
-      )
+      contains(github.event.pull_request.labels.*.name, 'backport')
     runs-on: [self-hosted]
-    outputs:
-      backport_current: ${{ steps.labels.outputs.backport }}
-      backport_previous: ${{ steps.labels.outputs.backport_previous }}
-      current_branch: ${{ steps.branches.outputs.current_branch }}
-      previous_branch: ${{ steps.branches.outputs.previous_branch }}
+
     steps:
-      - name: Check which labels are present
-        id: labels
+      # 1. Decide which maintenance branch should receive the back‑port
+      - name: Determine target maintenance branch
+        id: target
         uses: actions/github-script@v7
         with:
           script: |
-            const pr = context.payload.pull_request;
-            const labels = pr.labels.map(l => l.name);
-            const isBackport = labels.includes('backport');
-            const isBackportPrevious = labels.includes('backport-previous');
-            
-            core.setOutput('backport', isBackport ? 'true' : 'false');
-            core.setOutput('backport_previous', isBackportPrevious ? 'true' : 'false');
-            
-            console.log(`backport label: ${isBackport}, backport-previous label: ${isBackportPrevious}`);
-      
-      - name: Determine target branches
-        id: branches
-        uses: actions/github-script@v7
-        with:
-          script: |
-            // Get latest release
-            let latestRelease;
+            let rel;
             try {
-              latestRelease = await github.rest.repos.getLatestRelease({
+              rel = await github.rest.repos.getLatestRelease({
                 owner: context.repo.owner,
                 repo: context.repo.repo
               });
@@ -60,70 +36,18 @@ jobs:
               core.setFailed('No existing releases found; cannot determine backport target.');
               return;
             }
-            
-            const [maj, min] = latestRelease.data.tag_name.replace(/^v/, '').split('.');
-            const currentBranch = `release-${maj}.${min}`;
-            const prevMin = parseInt(min) - 1;
-            const previousBranch = prevMin >= 0 ? `release-${maj}.${prevMin}` : '';
-            
-            core.setOutput('current_branch', currentBranch);
-            core.setOutput('previous_branch', previousBranch);
-            
-            console.log(`Current branch: ${currentBranch}, Previous branch: ${previousBranch || 'N/A'}`);
-            
-            // Verify previous branch exists if we need it
-            if (previousBranch && '${{ steps.labels.outputs.backport_previous }}' === 'true') {
-              try {
-                await github.rest.repos.getBranch({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  branch: previousBranch
-                });
-                console.log(`Previous branch ${previousBranch} exists`);
-              } catch (e) {
-                core.setFailed(`Previous branch ${previousBranch} does not exist.`);
-                return;
-              }
-            }
-
-  backport:
-    needs: prepare
-    if: |
-      github.event.pull_request.merged == true &&
-      (needs.prepare.outputs.backport_current == 'true' || needs.prepare.outputs.backport_previous == 'true')
-    runs-on: [self-hosted]
-    strategy:
-      matrix:
-        backport_type: [current, previous]
-    steps:
-      # 1. Determine target branch based on matrix
-      - name: Set target branch
-        id: target
-        if: |
-          (matrix.backport_type == 'current' && needs.prepare.outputs.backport_current == 'true') ||
-          (matrix.backport_type == 'previous' && needs.prepare.outputs.backport_previous == 'true')
-        run: |
-          if [ "${{ matrix.backport_type }}" == "current" ]; then
-            echo "branch=${{ needs.prepare.outputs.current_branch }}" >> $GITHUB_OUTPUT
-            echo "Target branch: ${{ needs.prepare.outputs.current_branch }}"
-          else
-            echo "branch=${{ needs.prepare.outputs.previous_branch }}" >> $GITHUB_OUTPUT
-            echo "Target branch: ${{ needs.prepare.outputs.previous_branch }}"
-          fi
-      
+            const [maj, min] = rel.data.tag_name.replace(/^v/, '').split('.');
+            const branch = `release-${maj}.${min}`;
+            core.setOutput('branch', branch);
+            console.log(`Latest release ${rel.data.tag_name}; backporting to ${branch}`);
       # 2. Checkout (required by backport‑action)
       - name: Checkout repository
-        if: steps.target.outcome == 'success'
         uses: actions/checkout@v4
 
       # 3. Create the back‑port pull request
       - name: Create back‑port PR
-        id: backport
-        if: steps.target.outcome == 'success'
-        uses: korthout/backport-action@v3.2.1
+        uses: korthout/backport-action@v3
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           label_pattern: '' # don't read labels for targets
           target_branches: ${{ steps.target.outputs.branch }}
-          merge_commits: skip
-          conflict_resolution: draft_commit_conflicts

.github/workflows/pre-commit.yml

@@ -28,7 +28,7 @@ jobs:
 
       - name: Install generate
         run: |
-          curl -sSL https://github.com/cozystack/cozyvalues-gen/releases/download/v1.0.6/cozyvalues-gen-linux-amd64.tar.gz | tar -xzvf- -C /usr/local/bin/ cozyvalues-gen
+          curl -sSL https://github.com/cozystack/cozyvalues-gen/releases/download/v1.0.5/cozyvalues-gen-linux-amd64.tar.gz | tar -xzvf- -C /usr/local/bin/ cozyvalues-gen
 
       - name: Run pre-commit hooks
         run: |

.github/workflows/pull-requests.yaml

@@ -33,9 +33,6 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
-      - name: Run unit tests
-        run: make unit-tests
-
       - name: Set up Docker config
         run: |
           if [ -d ~/.docker ]; then

.gitignore

@@ -1,5 +1,4 @@
 _out
-_repos
 .git
 .idea
 .vscode

ADOPTERS.md

@@ -32,4 +32,4 @@ This list is sorted in chronological order, based on the submission date.
 | [Urmanac](https://urmanac.com) | @kingdonb | 2024-12-04 | Urmanac is the future home of a hosting platform for the knowledge base of a community of personal server enthusiasts. We use Cozystack to provide support services for web sites hosted using both conventional deployments and on SpinKube, with WASM. |
 | [Hidora](https://hikube.cloud) | @matthieu-robin | 2025-09-17 | Hidora is a Swiss cloud provider delivering managed services and infrastructure solutions through datacenters located in Switzerland, ensuring data sovereignty and reliability. Its sovereign cloud platform, Hikube, is designed to run workloads with high availability across multiple datacenters, providing enterprises with a secure and scalable foundation for their applications based on Cozystack. |
 | [QOSI](https://qosi.kz) | @tabu-a | 2025-10-04 | QOSI is a non-profit organization driving open-source adoption and digital sovereignty across Kazakhstan and Central Asia. We use Cozystack as a platform for deploying sovereign, GPU-enabled clouds and educational environments under the National AI Program. Our goal is to accelerate the region’s transition toward open, self-hosted cloud-native technologies |
-| [Cloupard](https://cloupard.kz/) | @serjiott | 2025-12-18 | Cloupard is a public cloud provider offering IaaS and PaaS services via datacenters in Kazakhstan and Uzbekistan. Uses CozyStack on bare metal to extend its managed PaaS offerings. |
+|

AGENTS.md

@@ -1,38 +0,0 @@
-# AI Agents Overview
-
-This file provides structured guidance for AI coding assistants and agents
-working with the **Cozystack** project.
-
-## Agent Documentation
-
-| Agent | Purpose |
-|-------|---------|
-| [overview.md](./docs/agents/overview.md) | Project structure and conventions |
-| [contributing.md](./docs/agents/contributing.md) | Commits, pull requests, and git workflow |
-| [changelog.md](./docs/agents/changelog.md) | Changelog generation instructions |
-| [releasing.md](./docs/agents/releasing.md) | Release process and workflow |
-
-## Project Overview
-
-**Cozystack** is a Kubernetes-based platform for building cloud infrastructure with managed services (databases, VMs, K8s clusters), multi-tenancy, and GitOps delivery.
-
-## Quick Reference
-
-### Code Structure
-- `packages/core/` - Core platform charts (installer, platform)
-- `packages/system/` - System components (CSI, CNI, operators)
-- `packages/apps/` - User-facing applications in catalog
-- `packages/extra/` - Tenant-specific modules
-- `cmd/`, `internal/`, `pkg/` - Go code
-- `api/` - Kubernetes CRDs
-
-### Conventions
-- **Helm Charts**: Umbrella pattern, vendored upstream charts in `charts/`
-- **Go Code**: Controller-runtime patterns, kubebuilder style
-- **Git Commits**: `[component] Description` format with `--signoff`
-
-### What NOT to Do
-- ❌ Edit `/vendor/`, `zz_generated.*.go`, upstream charts directly
-- ❌ Modify `go.mod`/`go.sum` manually (use `go get`)
-- ❌ Force push to main/master
-- ❌ Commit built artifacts from `_out`

Makefile

@@ -1,4 +1,4 @@
-.PHONY: manifests repos assets unit-tests helm-unit-tests
+.PHONY: manifests repos assets
 
 build-deps:
 	@command -V find docker skopeo jq gh helm > /dev/null
@@ -15,9 +15,9 @@ build: build-deps
 	make -C packages/extra/monitoring image
 	make -C packages/system/cozystack-api image
 	make -C packages/system/cozystack-controller image
-	make -C packages/system/backup-controller image
 	make -C packages/system/lineage-controller-webhook image
 	make -C packages/system/cilium image
+	make -C packages/system/kubeovn image
 	make -C packages/system/kubeovn-webhook image
 	make -C packages/system/kubeovn-plunger image
 	make -C packages/system/dashboard image
@@ -26,7 +26,6 @@ build: build-deps
 	make -C packages/system/bucket image
 	make -C packages/system/objectstorage-controller image
 	make -C packages/core/testing image
-	make -C packages/core/platform image
 	make -C packages/core/installer image
 	make manifests
 
@@ -47,11 +46,6 @@ test:
 	make -C packages/core/testing apply
 	make -C packages/core/testing test
 
-unit-tests: helm-unit-tests
-
-helm-unit-tests:
-	hack/helm-unit-tests.sh
-
 prepare-env:
 	make -C packages/core/testing apply
 	make -C packages/core/testing prepare-cluster

api/.gitattributes

@@ -1 +0,0 @@
-zz_generated_deepcopy.go linguist-generated

api/backups/strategy/v1alpha1/groupversion_info.go

@@ -1,37 +0,0 @@
-/*
-Copyright 2025.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Package v1alpha1 contains API Schema definitions for the  v1alpha1 API group.
-// +kubebuilder:object:generate=true
-// +groupName=strategy.backups.cozystack.io
-package v1alpha1
-
-import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-)
-
-var (
-	GroupVersion  = schema.GroupVersion{Group: "strategy.backups.cozystack.io", Version: "v1alpha1"}
-	SchemeBuilder = runtime.NewSchemeBuilder(addGroupVersion)
-	AddToScheme   = SchemeBuilder.AddToScheme
-)
-
-func addGroupVersion(scheme *runtime.Scheme) error {
-	metav1.AddToGroupVersion(scheme, GroupVersion)
-	return nil
-}

api/backups/strategy/v1alpha1/job_types.go

@@ -1,63 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Package v1alpha1 defines strategy.backups.cozystack.io API types.
-//
-// Group: strategy.backups.cozystack.io
-// Version: v1alpha1
-package v1alpha1
-
-import (
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-func init() {
-	SchemeBuilder.Register(func(s *runtime.Scheme) error {
-		s.AddKnownTypes(GroupVersion,
-			&Job{},
-			&JobList{},
-		)
-		return nil
-	})
-}
-
-const (
-	JobStrategyKind = "Job"
-)
-
-// +kubebuilder:object:root=true
-// +kubebuilder:subresource:status
-// +kubebuilder:resource:scope=Cluster
-
-// Job defines a backup strategy using a one-shot Job
-type Job struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   JobSpec   `json:"spec,omitempty"`
-	Status JobStatus `json:"status,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// JobList contains a list of backup Jobs.
-type JobList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []Job `json:"items"`
-}
-
-// JobSpec specifies the desired behavior of a backup job.
-type JobSpec struct {
-	// Template holds a PodTemplateSpec with the right shape to
-	// run a single pod to completion and create a tarball with
-	// a given apps data. Helm-like Go templates are supported.
-	// The values of the source application are available under
-	// `.Values`. `.Release.Name` and `.Release.Namespace` are
-	// also exported.
-	Template corev1.PodTemplateSpec `json:"template"`
-}
-
-type JobStatus struct {
-	Conditions []metav1.Condition `json:"conditions,omitempty"`
-}

api/backups/strategy/v1alpha1/zz_generated.deepcopy.go

@@ -1,123 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Job) DeepCopyInto(out *Job) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Job.
-func (in *Job) DeepCopy() *Job {
-	if in == nil {
-		return nil
-	}
-	out := new(Job)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Job) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *JobList) DeepCopyInto(out *JobList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]Job, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JobList.
-func (in *JobList) DeepCopy() *JobList {
-	if in == nil {
-		return nil
-	}
-	out := new(JobList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *JobList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *JobSpec) DeepCopyInto(out *JobSpec) {
-	*out = *in
-	in.Template.DeepCopyInto(&out.Template)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JobSpec.
-func (in *JobSpec) DeepCopy() *JobSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(JobSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *JobStatus) DeepCopyInto(out *JobStatus) {
-	*out = *in
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]v1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JobStatus.
-func (in *JobStatus) DeepCopy() *JobStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(JobStatus)
-	in.DeepCopyInto(out)
-	return out
-}

api/backups/v1alpha1/DESIGN.md

@@ -1,421 +0,0 @@
-# Cozystack Backups – Core API & Contracts (Draft)
-
-## 1. Overview
-
-Cozystack’s backup subsystem provides a generic, composable way to back up and restore managed applications:
-
-* Every **application instance** can have one or more **backup plans**.
-* Backups are stored in configurable **storage locations**.
-* The mechanics of *how* a backup/restore is performed are delegated to **strategy drivers**, each implementing driver-specific **BackupStrategy** CRDs.
-
-The core API:
-
-* Orchestrates **when** backups happen and **where** they’re stored.
-* Tracks **what** backups exist and their status.
-* Defines contracts with drivers via shared resources (`BackupJob`, `Backup`, `RestoreJob`).
-
-It does **not** implement the backup logic itself.
-
-This document covers only the **core** API and its contracts with drivers, not driver implementations.
-
----
-
-## 2. Goals and non-goals
-
-### Goals
-
-* Provide a **stable core API** for:
-
-  * Declaring **backup plans** per application.
-  * Configuring **storage targets** (S3, in-cluster bucket, etc.).
-  * Tracking **backup artifacts**.
-  * Initiating and tracking **restores**.
-* Allow multiple **strategy drivers** to plug in, each supporting specific kinds of applications and strategies.
-* Let application/product authors implement backup for their kinds by:
-
-  * Creating **Plan** objects referencing a **driver-specific strategy**.
-  * Not having to write a backup engine themselves.
-
-### Non-goals
-
-* Implement backup logic for any specific application or storage backend.
-* Define the internal structure of driver-specific strategy CRDs.
-* Handle tenant-facing UI/UX (that’s built on top of these APIs).
-
----
-
-## 3. Architecture
-
-High-level components:
-
-* **Core backups controller(s)** (Cozystack-owned):
-
-  * Group: `backups.cozystack.io`
-  * Own:
-
-    * `Plan`
-    * `BackupJob`
-    * `Backup`
-    * `RestoreJob`
-  * Responsibilities:
-
-    * Schedule backups based on `Plan`.
-    * Create `BackupJob` objects when due.
-    * Provide stable contracts for drivers to:
-
-      * Perform backups and create `Backup`s.
-      * Perform restores based on `Backup`s.
-
-* **Strategy drivers** (pluggable, possibly third-party):
-
-  * Their own API groups, e.g. `jobdriver.backups.cozystack.io`.
-  * Own **strategy CRDs** (e.g. `JobBackupStrategy`).
-  * Implement controllers that:
-
-    * Watch `BackupJob` / `RestoreJob`.
-    * Match runs whose `strategyRef` GVK they support.
-    * Execute backup/restore logic.
-    * Create and update `Backup` and run statuses.
-
-Strategy drivers and core communicate entirely via Kubernetes objects; there are no webhook/HTTP calls between them.
-
-* **Storage drivers** (pluggable, possibly third-party):
-
-  * **TBD**
-
----
-
-## 4. Core API resources
-
-### 4.1 Plan
-
-**Group/Kind**
-`backups.cozystack.io/v1alpha1, Kind=Plan`
-
-**Purpose**
-Describe **when**, **how**, and **where** to back up a specific managed application.
-
-**Key fields (spec)**
-
-```go
-type PlanSpec struct {
-    // Application to back up.
-    ApplicationRef corev1.TypedLocalObjectReference `json:"applicationRef"`
-
-    // Where backups should be stored.
-    StorageRef corev1.TypedLocalObjectReference `json:"storageRef"`
-
-    // Driver-specific BackupStrategy to use.
-    StrategyRef corev1.TypedLocalObjectReference `json:"strategyRef"`
-
-    // When backups should run.
-    Schedule PlanSchedule `json:"schedule"`
-}
-```
-
-`PlanSchedule` (initially) supports only cron:
-
-```go
-type PlanScheduleType string
-
-const (
-    PlanScheduleTypeEmpty PlanScheduleType = ""
-    PlanScheduleTypeCron  PlanScheduleType = "cron"
-)
-```
-
-```go
-type PlanSchedule struct {
-    // Type is the schedule type. Currently only "cron" is supported.
-    // Defaults to "cron".
-    Type PlanScheduleType `json:"type,omitempty"`
-
-    // Cron expression (required for cron type).
-    Cron string `json:"cron,omitempty"`
-}
-```
-
-**Plan reconciliation contract**
-
-Core Plan controller:
-
-1. **Read schedule** from `spec.schedule` and compute the next fire time.
-2. When due:
-
-   * Create a `BackupJob` in the same namespace:
-
-     * `spec.planRef.name = plan.Name`
-     * `spec.applicationRef = plan.spec.applicationRef`
-     * `spec.storageRef = plan.spec.storageRef`
-     * `spec.strategyRef = plan.spec.strategyRef`
-     * `spec.triggeredBy = "Plan"`
-   * Set `ownerReferences` so the `BackupJob` is owned by the `Plan`.
-
-The Plan controller does **not**:
-
-* Execute backups itself.
-* Modify driver resources or `Backup` objects.
-* Touch `BackupJob.spec` after creation.
-
----
-
-### 4.2 Storage
-
-**API Shape**
-
-TBD
-
-**Storage usage**
-
-* `Plan` and `BackupJob` reference `Storage` via `TypedLocalObjectReference`.
-* Drivers read `Storage` to know how/where to store or read artifacts.
-* Core treats `Storage` spec as opaque; it does not directly talk to S3 or buckets.
-
----
-
-### 4.3 BackupJob
-
-**Group/Kind**
-`backups.cozystack.io/v1alpha1, Kind=BackupJob`
-
-**Purpose**
-Represent a single **execution** of a backup operation, typically created when a `Plan` fires or when a user triggers an ad-hoc backup.
-
-**Key fields (spec)**
-
-```go
-type BackupJobSpec struct {
-    // Plan that triggered this run, if any.
-    PlanRef *corev1.LocalObjectReference `json:"planRef,omitempty"`
-
-    // Application to back up.
-    ApplicationRef corev1.TypedLocalObjectReference `json:"applicationRef"`
-
-    // Storage to use.
-    StorageRef corev1.TypedLocalObjectReference `json:"storageRef"`
-
-    // Driver-specific BackupStrategy to use.
-    StrategyRef corev1.TypedLocalObjectReference `json:"strategyRef"`
-
-    // Informational: what triggered this run ("Plan", "Manual", etc.).
-    TriggeredBy string `json:"triggeredBy,omitempty"`
-}
-```
-
-**Key fields (status)**
-
-```go
-type BackupJobStatus struct {
-    Phase       BackupJobPhase         `json:"phase,omitempty"`
-    BackupRef   *corev1.LocalObjectReference `json:"backupRef,omitempty"`
-    StartedAt   *metav1.Time           `json:"startedAt,omitempty"`
-    CompletedAt *metav1.Time           `json:"completedAt,omitempty"`
-    Message     string                 `json:"message,omitempty"`
-    Conditions  []metav1.Condition     `json:"conditions,omitempty"`
-}
-```
-
-`BackupJobPhase` is one of: `Pending`, `Running`, `Succeeded`, `Failed`.
-
-**BackupJob contract with drivers**
-
-* Core **creates** `BackupJob` and must treat `spec` as immutable afterwards.
-* Each driver controller:
-
-  * Watches `BackupJob`.
-  * Reconciles runs where `spec.strategyRef.apiGroup/kind` matches its **strategy type(s)**.
-* Driver responsibilities:
-
-  1. On first reconcile:
-
-     * Set `status.startedAt` if unset.
-     * Set `status.phase = Running`.
-  2. Resolve inputs:
-
-     * Read `Strategy` (driver-owned CRD), `Storage`, `Application`, optionally `Plan`.
-  3. Execute backup logic (implementation-specific).
-  4. On success:
-
-     * Create a `Backup` resource (see below).
-     * Set `status.backupRef` to the created `Backup`.
-     * Set `status.completedAt`.
-     * Set `status.phase = Succeeded`.
-  5. On failure:
-
-     * Set `status.completedAt`.
-     * Set `status.phase = Failed`.
-     * Set `status.message` and conditions.
-
-Drivers must **not** modify `BackupJob.spec` or delete `BackupJob` themselves.
-
----
-
-### 4.4 Backup
-
-**Group/Kind**
-`backups.cozystack.io/v1alpha1, Kind=Backup`
-
-**Purpose**
-Represent a single **backup artifact** for a given application, decoupled from a particular run. usable as a stable, listable “thing you can restore from”.
-
-**Key fields (spec)**
-
-```go
-type BackupSpec struct {
-    ApplicationRef corev1.TypedLocalObjectReference `json:"applicationRef"`
-    PlanRef        *corev1.LocalObjectReference     `json:"planRef,omitempty"`
-    StorageRef     corev1.TypedLocalObjectReference `json:"storageRef"`
-    StrategyRef    corev1.TypedLocalObjectReference `json:"strategyRef"`
-    TakenAt        metav1.Time                      `json:"takenAt"`
-    DriverMetadata map[string]string                `json:"driverMetadata,omitempty"`
-}
-```
-
-**Key fields (status)**
-
-```go
-type BackupStatus struct {
-    Phase      BackupPhase       `json:"phase,omitempty"` // Pending, Ready, Failed, etc.
-    Artifact   *BackupArtifact   `json:"artifact,omitempty"`
-    Conditions []metav1.Condition `json:"conditions,omitempty"`
-}
-```
-
-`BackupArtifact` describes the artifact (URI, size, checksum).
-
-**Backup contract with drivers**
-
-* On successful completion of a `BackupJob`, the **driver**:
-
-  * Creates a `Backup` in the same namespace (typically owned by the `BackupJob`).
-  * Populates `spec` fields with:
-
-    * The application, storage, strategy references.
-    * `takenAt`.
-    * Optional `driverMetadata`.
-  * Sets `status` with:
-
-    * `phase = Ready` (or equivalent when fully usable).
-    * `artifact` describing the stored object.
-* Core:
-
-  * Treats `Backup` spec as mostly immutable and opaque.
-  * Uses it to:
-
-    * List backups for a given application/plan.
-    * Anchor `RestoreJob` operations.
-    * Implement higher-level policies (retention) if needed.
-
----
-
-### 4.5 RestoreJob
-
-**Group/Kind**
-`backups.cozystack.io/v1alpha1, Kind=RestoreJob`
-
-**Purpose**
-Represent a single **restore operation** from a `Backup`, either back into the same application or into a new target application.
-
-**Key fields (spec)**
-
-```go
-type RestoreJobSpec struct {
-    // Backup to restore from.
-    BackupRef corev1.LocalObjectReference `json:"backupRef"`
-
-    // Target application; if omitted, drivers SHOULD restore into
-    // backup.spec.applicationRef.
-    TargetApplicationRef *corev1.TypedLocalObjectReference `json:"targetApplicationRef,omitempty"`
-}
-```
-
-**Key fields (status)**
-
-```go
-type RestoreJobStatus struct {
-    Phase       RestoreJobPhase   `json:"phase,omitempty"` // Pending, Running, Succeeded, Failed
-    StartedAt   *metav1.Time      `json:"startedAt,omitempty"`
-    CompletedAt *metav1.Time      `json:"completedAt,omitempty"`
-    Message     string            `json:"message,omitempty"`
-    Conditions  []metav1.Condition `json:"conditions,omitempty"`
-}
-```
-
-**RestoreJob contract with drivers**
-
-* RestoreJob is created either manually or by core.
-* Driver controller:
-
-  1. Watches `RestoreJob`.
-  2. On reconcile:
-
-     * Fetches the referenced `Backup`.
-     * Determines effective:
-
-       * **Strategy**: `backup.spec.strategyRef`.
-       * **Storage**: `backup.spec.storageRef`.
-       * **Target application**: `spec.targetApplicationRef` or `backup.spec.applicationRef`.
-     * If effective strategy’s GVK is one of its supported strategy types → driver is responsible.
-  3. Behaviour:
-
-     * On first reconcile, set `status.startedAt` and `phase = Running`.
-     * Resolve `Backup`, `Storage`, `Strategy`, target application.
-     * Execute restore logic (implementation-specific).
-     * On success:
-
-       * Set `status.completedAt`.
-       * Set `status.phase = Succeeded`.
-     * On failure:
-
-       * Set `status.completedAt`.
-       * Set `status.phase = Failed`.
-       * Set `status.message` and conditions.
-
-Drivers must not modify `RestoreJob.spec` or delete `RestoreJob`.
-
----
-
-## 5. Strategy drivers (high-level)
-
-Strategy drivers are separate controllers that:
-
-* Define their own **strategy CRDs** (e.g. `JobBackupStrategy`) in their own API groups:
-
-  * e.g. `jobdriver.backups.cozystack.io/v1alpha1, Kind=JobBackupStrategy`
-* Implement the **BackupJob contract**:
-
-  * Watch `BackupJob`.
-  * Filter by `spec.strategyRef.apiGroup/kind`.
-  * Execute backup logic.
-  * Create/update `Backup`.
-* Implement the **RestoreJob contract**:
-
-  * Watch `RestoreJob`.
-  * Resolve `Backup`, then effective `strategyRef`.
-  * Filter by effective strategy GVK.
-  * Execute restore logic.
-
-The core backups API **does not** dictate:
-
-* The fields and structure of driver strategy specs.
-* How drivers implement backup/restore internally (Jobs, snapshots, native operator CRDs, etc.).
-
-Drivers are interchangeable as long as they respect:
-
-* The `BackupJob` and `RestoreJob` contracts.
-* The shapes and semantics of `Backup` objects.
-
----
-
-## 6. Summary
-
-The Cozystack backups core API:
-
-* Uses a single group, `backups.cozystack.io`, for all core CRDs.
-* Cleanly separates:
-
-  * **When & where** (Plan + Storage) – core-owned.
-  * **What backup artifacts exist** (Backup) – driver-created but cluster-visible.
-  * **Execution lifecycle** (BackupJob, RestoreJob) – shared contract boundary.
-* Allows multiple strategy drivers to implement backup/restore logic without entangling their implementation with the core API.
-

api/backups/v1alpha1/backup_types.go

@@ -1,118 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Package v1alpha1 defines backups.cozystack.io API types.
-//
-// Group: backups.cozystack.io
-// Version: v1alpha1
-package v1alpha1
-
-import (
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-func init() {
-	SchemeBuilder.Register(func(s *runtime.Scheme) error {
-		s.AddKnownTypes(GroupVersion,
-			&Backup{},
-			&BackupList{},
-		)
-		return nil
-	})
-}
-
-// BackupPhase represents the lifecycle phase of a Backup.
-type BackupPhase string
-
-const (
-	BackupPhaseEmpty   BackupPhase = ""
-	BackupPhasePending BackupPhase = "Pending"
-	BackupPhaseReady   BackupPhase = "Ready"
-	BackupPhaseFailed  BackupPhase = "Failed"
-)
-
-// BackupArtifact describes the stored backup object (tarball, snapshot, etc.).
-type BackupArtifact struct {
-	// URI is a driver-/storage-specific URI pointing to the backup artifact.
-	// For example: s3://bucket/prefix/file.tar.gz
-	URI string `json:"uri"`
-
-	// SizeBytes is the size of the artifact in bytes, if known.
-	// +optional
-	SizeBytes int64 `json:"sizeBytes,omitempty"`
-
-	// Checksum is the checksum of the artifact, if computed.
-	// For example: "sha256:<hex>".
-	// +optional
-	Checksum string `json:"checksum,omitempty"`
-}
-
-// BackupSpec describes an immutable backup artifact produced by a BackupJob.
-type BackupSpec struct {
-	// ApplicationRef refers to the application that was backed up.
-	ApplicationRef corev1.TypedLocalObjectReference `json:"applicationRef"`
-
-	// PlanRef refers to the Plan that produced this backup, if any.
-	// For manually triggered backups, this can be omitted.
-	// +optional
-	PlanRef *corev1.LocalObjectReference `json:"planRef,omitempty"`
-
-	// StorageRef refers to the Storage object that describes where the backup
-	// artifact is stored.
-	StorageRef corev1.TypedLocalObjectReference `json:"storageRef"`
-
-	// StrategyRef refers to the driver-specific BackupStrategy that was used
-	// to create this backup. This allows the driver to later perform restores.
-	StrategyRef corev1.TypedLocalObjectReference `json:"strategyRef"`
-
-	// TakenAt is the time at which the backup was taken (as reported by the
-	// driver). It may differ slightly from metadata.creationTimestamp.
-	TakenAt metav1.Time `json:"takenAt"`
-
-	// DriverMetadata holds driver-specific, opaque metadata associated with
-	// this backup (for example snapshot IDs, schema versions, etc.).
-	// This data is not interpreted by the core backup controllers.
-	// +optional
-	DriverMetadata map[string]string `json:"driverMetadata,omitempty"`
-}
-
-// BackupStatus represents the observed state of a Backup.
-type BackupStatus struct {
-	// Phase is a simple, high-level summary of the backup's state.
-	// Typical values are: Pending, Ready, Failed.
-	// +optional
-	Phase BackupPhase `json:"phase,omitempty"`
-
-	// Artifact describes the stored backup object, if available.
-	// +optional
-	Artifact *BackupArtifact `json:"artifact,omitempty"`
-
-	// Conditions represents the latest available observations of a Backup's state.
-	// +optional
-	Conditions []metav1.Condition `json:"conditions,omitempty"`
-}
-
-// The field indexing on applicationRef will be needed later to display per-app backup resources.
-
-// +kubebuilder:object:root=true
-// +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.apiGroup`
-// +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.kind`
-// +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.name`
-
-// Backup represents a single backup artifact for a given application.
-type Backup struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   BackupSpec   `json:"spec,omitempty"`
-	Status BackupStatus `json:"status,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// BackupList contains a list of Backups.
-type BackupList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []Backup `json:"items"`
-}

api/backups/v1alpha1/backupjob_types.go

@@ -1,109 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Package v1alpha1 defines backups.cozystack.io API types.
-//
-// Group: backups.cozystack.io
-// Version: v1alpha1
-package v1alpha1
-
-import (
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-func init() {
-	SchemeBuilder.Register(func(s *runtime.Scheme) error {
-		s.AddKnownTypes(GroupVersion,
-			&BackupJob{},
-			&BackupJobList{},
-		)
-		return nil
-	})
-}
-
-// BackupJobPhase represents the lifecycle phase of a BackupJob.
-type BackupJobPhase string
-
-const (
-	BackupJobPhaseEmpty     BackupJobPhase = ""
-	BackupJobPhasePending   BackupJobPhase = "Pending"
-	BackupJobPhaseRunning   BackupJobPhase = "Running"
-	BackupJobPhaseSucceeded BackupJobPhase = "Succeeded"
-	BackupJobPhaseFailed    BackupJobPhase = "Failed"
-)
-
-// BackupJobSpec describes the execution of a single backup operation.
-type BackupJobSpec struct {
-	// PlanRef refers to the Plan that requested this backup run.
-	// For ad-hoc/manual backups, this can be omitted.
-	// +optional
-	PlanRef *corev1.LocalObjectReference `json:"planRef,omitempty"`
-
-	// ApplicationRef holds a reference to the managed application whose state
-	// is being backed up.
-	ApplicationRef corev1.TypedLocalObjectReference `json:"applicationRef"`
-
-	// StorageRef holds a reference to the Storage object that describes where
-	// the backup will be stored.
-	StorageRef corev1.TypedLocalObjectReference `json:"storageRef"`
-
-	// StrategyRef holds a reference to the driver-specific BackupStrategy object
-	// that describes how the backup should be created.
-	StrategyRef corev1.TypedLocalObjectReference `json:"strategyRef"`
-}
-
-// BackupJobStatus represents the observed state of a BackupJob.
-type BackupJobStatus struct {
-	// Phase is a high-level summary of the run's state.
-	// Typical values: Pending, Running, Succeeded, Failed.
-	// +optional
-	Phase BackupJobPhase `json:"phase,omitempty"`
-
-	// BackupRef refers to the Backup object created by this run, if any.
-	// +optional
-	BackupRef *corev1.LocalObjectReference `json:"backupRef,omitempty"`
-
-	// StartedAt is the time at which the backup run started.
-	// +optional
-	StartedAt *metav1.Time `json:"startedAt,omitempty"`
-
-	// CompletedAt is the time at which the backup run completed (successfully
-	// or otherwise).
-	// +optional
-	CompletedAt *metav1.Time `json:"completedAt,omitempty"`
-
-	// Message is a human-readable message indicating details about why the
-	// backup run is in its current phase, if any.
-	// +optional
-	Message string `json:"message,omitempty"`
-
-	// Conditions represents the latest available observations of a BackupJob's state.
-	// +optional
-	Conditions []metav1.Condition `json:"conditions,omitempty"`
-}
-
-// The field indexing on applicationRef will be needed later to display per-app backup resources.
-
-// +kubebuilder:object:root=true
-// +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.apiGroup`
-// +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.kind`
-// +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.name`
-
-// BackupJob represents a single execution of a backup.
-// It is typically created by a Plan controller when a schedule fires.
-type BackupJob struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   BackupJobSpec   `json:"spec,omitempty"`
-	Status BackupJobStatus `json:"status,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// BackupJobList contains a list of BackupJobs.
-type BackupJobList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []BackupJob `json:"items"`
-}

api/backups/v1alpha1/groupversion_info.go

@@ -1,37 +0,0 @@
-/*
-Copyright 2025.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Package v1alpha1 contains API Schema definitions for the  v1alpha1 API group.
-// +kubebuilder:object:generate=true
-// +groupName=backups.cozystack.io
-package v1alpha1
-
-import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-)
-
-var (
-	GroupVersion  = schema.GroupVersion{Group: "backups.cozystack.io", Version: "v1alpha1"}
-	SchemeBuilder = runtime.NewSchemeBuilder(addGroupVersion)
-	AddToScheme   = SchemeBuilder.AddToScheme
-)
-
-func addGroupVersion(scheme *runtime.Scheme) error {
-	metav1.AddToGroupVersion(scheme, GroupVersion)
-	return nil
-}

api/backups/v1alpha1/plan_types.go

@@ -1,98 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Package v1alpha1 defines backups.cozystack.io API types.
-//
-// Group: backups.cozystack.io
-// Version: v1alpha1
-package v1alpha1
-
-import (
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-func init() {
-	SchemeBuilder.Register(func(s *runtime.Scheme) error {
-		s.AddKnownTypes(GroupVersion,
-			&Plan{},
-			&PlanList{},
-		)
-		return nil
-	})
-}
-
-type PlanScheduleType string
-
-const (
-	PlanScheduleTypeEmpty PlanScheduleType = ""
-	PlanScheduleTypeCron  PlanScheduleType = "cron"
-)
-
-// Condtions
-const (
-	PlanConditionError = "Error"
-)
-
-// The field indexing on applicationRef will be needed later to display per-app backup resources.
-
-// +kubebuilder:object:root=true
-// +kubebuilder:subresource:status
-// +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.apiGroup`
-// +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.kind`
-// +kubebuilder:selectablefield:JSONPath=`.spec.applicationRef.name`
-
-// Plan describes the schedule, method and storage location for the
-// backup of a given target application.
-type Plan struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   PlanSpec   `json:"spec,omitempty"`
-	Status PlanStatus `json:"status,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// PlanList contains a list of backup Plans.
-type PlanList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []Plan `json:"items"`
-}
-
-// PlanSpec references the storage, the strategy, the application to be
-// backed up and specifies the timetable on which the backups will run.
-type PlanSpec struct {
-	// ApplicationRef holds a reference to the managed application,
-	// whose state and configuration must be backed up.
-	ApplicationRef corev1.TypedLocalObjectReference `json:"applicationRef"`
-
-	// StorageRef holds a reference to the Storage object that
-	// describes the location where the backup will be stored.
-	StorageRef corev1.TypedLocalObjectReference `json:"storageRef"`
-
-	// StrategyRef holds a reference to the Strategy object that
-	// describes, how a backup copy is to be created.
-	StrategyRef corev1.TypedLocalObjectReference `json:"strategyRef"`
-
-	// Schedule specifies when backup copies are created.
-	Schedule PlanSchedule `json:"schedule"`
-}
-
-// PlanSchedule specifies when backup copies are created.
-type PlanSchedule struct {
-	// Type is the type of schedule specification. Supported values are
-	// [`cron`]. If omitted, defaults to `cron`.
-	// +optional
-	Type PlanScheduleType `json:"type,omitempty"`
-
-	// Cron contains the cron spec for scheduling backups. Must be
-	// specified if the schedule type is `cron`. Since only `cron` is
-	// supported, omitting this field is not allowed.
-	// +optional
-	Cron string `json:"cron,omitempty"`
-}
-
-type PlanStatus struct {
-	Conditions []metav1.Condition `json:"conditions,omitempty"`
-}

api/backups/v1alpha1/restorejob_types.go

@@ -1,91 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Package v1alpha1 defines backups.cozystack.io API types.
-//
-// Group: backups.cozystack.io
-// Version: v1alpha1
-package v1alpha1
-
-import (
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-func init() {
-	SchemeBuilder.Register(func(s *runtime.Scheme) error {
-		s.AddKnownTypes(GroupVersion,
-			&RestoreJob{},
-			&RestoreJobList{},
-		)
-		return nil
-	})
-}
-
-// RestoreJobPhase represents the lifecycle phase of a RestoreJob.
-type RestoreJobPhase string
-
-const (
-	RestoreJobPhaseEmpty     RestoreJobPhase = ""
-	RestoreJobPhasePending   RestoreJobPhase = "Pending"
-	RestoreJobPhaseRunning   RestoreJobPhase = "Running"
-	RestoreJobPhaseSucceeded RestoreJobPhase = "Succeeded"
-	RestoreJobPhaseFailed    RestoreJobPhase = "Failed"
-)
-
-// RestoreJobSpec describes the execution of a single restore operation.
-type RestoreJobSpec struct {
-	// BackupRef refers to the Backup that should be restored.
-	BackupRef corev1.LocalObjectReference `json:"backupRef"`
-
-	// TargetApplicationRef refers to the application into which the backup
-	// should be restored. If omitted, the driver SHOULD restore into the same
-	// application as referenced by backup.spec.applicationRef.
-	// +optional
-	TargetApplicationRef *corev1.TypedLocalObjectReference `json:"targetApplicationRef,omitempty"`
-}
-
-// RestoreJobStatus represents the observed state of a RestoreJob.
-type RestoreJobStatus struct {
-	// Phase is a high-level summary of the run's state.
-	// Typical values: Pending, Running, Succeeded, Failed.
-	// +optional
-	Phase RestoreJobPhase `json:"phase,omitempty"`
-
-	// StartedAt is the time at which the restore run started.
-	// +optional
-	StartedAt *metav1.Time `json:"startedAt,omitempty"`
-
-	// CompletedAt is the time at which the restore run completed (successfully
-	// or otherwise).
-	// +optional
-	CompletedAt *metav1.Time `json:"completedAt,omitempty"`
-
-	// Message is a human-readable message indicating details about why the
-	// restore run is in its current phase, if any.
-	// +optional
-	Message string `json:"message,omitempty"`
-
-	// Conditions represents the latest available observations of a RestoreJob's state.
-	// +optional
-	Conditions []metav1.Condition `json:"conditions,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// RestoreJob represents a single execution of a restore from a Backup.
-type RestoreJob struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   RestoreJobSpec   `json:"spec,omitempty"`
-	Status RestoreJobStatus `json:"status,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// RestoreJobList contains a list of RestoreJobs.
-type RestoreJobList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []RestoreJob `json:"items"`
-}

api/backups/v1alpha1/zz_generated.deepcopy.go

@@ -1,501 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Backup) DeepCopyInto(out *Backup) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backup.
-func (in *Backup) DeepCopy() *Backup {
-	if in == nil {
-		return nil
-	}
-	out := new(Backup)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Backup) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BackupArtifact) DeepCopyInto(out *BackupArtifact) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupArtifact.
-func (in *BackupArtifact) DeepCopy() *BackupArtifact {
-	if in == nil {
-		return nil
-	}
-	out := new(BackupArtifact)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BackupJob) DeepCopyInto(out *BackupJob) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupJob.
-func (in *BackupJob) DeepCopy() *BackupJob {
-	if in == nil {
-		return nil
-	}
-	out := new(BackupJob)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *BackupJob) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BackupJobList) DeepCopyInto(out *BackupJobList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]BackupJob, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupJobList.
-func (in *BackupJobList) DeepCopy() *BackupJobList {
-	if in == nil {
-		return nil
-	}
-	out := new(BackupJobList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *BackupJobList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BackupJobSpec) DeepCopyInto(out *BackupJobSpec) {
-	*out = *in
-	if in.PlanRef != nil {
-		in, out := &in.PlanRef, &out.PlanRef
-		*out = new(v1.LocalObjectReference)
-		**out = **in
-	}
-	in.ApplicationRef.DeepCopyInto(&out.ApplicationRef)
-	in.StorageRef.DeepCopyInto(&out.StorageRef)
-	in.StrategyRef.DeepCopyInto(&out.StrategyRef)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupJobSpec.
-func (in *BackupJobSpec) DeepCopy() *BackupJobSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(BackupJobSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BackupJobStatus) DeepCopyInto(out *BackupJobStatus) {
-	*out = *in
-	if in.BackupRef != nil {
-		in, out := &in.BackupRef, &out.BackupRef
-		*out = new(v1.LocalObjectReference)
-		**out = **in
-	}
-	if in.StartedAt != nil {
-		in, out := &in.StartedAt, &out.StartedAt
-		*out = (*in).DeepCopy()
-	}
-	if in.CompletedAt != nil {
-		in, out := &in.CompletedAt, &out.CompletedAt
-		*out = (*in).DeepCopy()
-	}
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]metav1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupJobStatus.
-func (in *BackupJobStatus) DeepCopy() *BackupJobStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(BackupJobStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BackupList) DeepCopyInto(out *BackupList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]Backup, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupList.
-func (in *BackupList) DeepCopy() *BackupList {
-	if in == nil {
-		return nil
-	}
-	out := new(BackupList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *BackupList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BackupSpec) DeepCopyInto(out *BackupSpec) {
-	*out = *in
-	in.ApplicationRef.DeepCopyInto(&out.ApplicationRef)
-	if in.PlanRef != nil {
-		in, out := &in.PlanRef, &out.PlanRef
-		*out = new(v1.LocalObjectReference)
-		**out = **in
-	}
-	in.StorageRef.DeepCopyInto(&out.StorageRef)
-	in.StrategyRef.DeepCopyInto(&out.StrategyRef)
-	in.TakenAt.DeepCopyInto(&out.TakenAt)
-	if in.DriverMetadata != nil {
-		in, out := &in.DriverMetadata, &out.DriverMetadata
-		*out = make(map[string]string, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupSpec.
-func (in *BackupSpec) DeepCopy() *BackupSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(BackupSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BackupStatus) DeepCopyInto(out *BackupStatus) {
-	*out = *in
-	if in.Artifact != nil {
-		in, out := &in.Artifact, &out.Artifact
-		*out = new(BackupArtifact)
-		**out = **in
-	}
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]metav1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupStatus.
-func (in *BackupStatus) DeepCopy() *BackupStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(BackupStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Plan) DeepCopyInto(out *Plan) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Plan.
-func (in *Plan) DeepCopy() *Plan {
-	if in == nil {
-		return nil
-	}
-	out := new(Plan)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Plan) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PlanList) DeepCopyInto(out *PlanList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]Plan, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PlanList.
-func (in *PlanList) DeepCopy() *PlanList {
-	if in == nil {
-		return nil
-	}
-	out := new(PlanList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *PlanList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PlanSchedule) DeepCopyInto(out *PlanSchedule) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PlanSchedule.
-func (in *PlanSchedule) DeepCopy() *PlanSchedule {
-	if in == nil {
-		return nil
-	}
-	out := new(PlanSchedule)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PlanSpec) DeepCopyInto(out *PlanSpec) {
-	*out = *in
-	in.ApplicationRef.DeepCopyInto(&out.ApplicationRef)
-	in.StorageRef.DeepCopyInto(&out.StorageRef)
-	in.StrategyRef.DeepCopyInto(&out.StrategyRef)
-	out.Schedule = in.Schedule
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PlanSpec.
-func (in *PlanSpec) DeepCopy() *PlanSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(PlanSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PlanStatus) DeepCopyInto(out *PlanStatus) {
-	*out = *in
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]metav1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PlanStatus.
-func (in *PlanStatus) DeepCopy() *PlanStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(PlanStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RestoreJob) DeepCopyInto(out *RestoreJob) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RestoreJob.
-func (in *RestoreJob) DeepCopy() *RestoreJob {
-	if in == nil {
-		return nil
-	}
-	out := new(RestoreJob)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *RestoreJob) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RestoreJobList) DeepCopyInto(out *RestoreJobList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]RestoreJob, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RestoreJobList.
-func (in *RestoreJobList) DeepCopy() *RestoreJobList {
-	if in == nil {
-		return nil
-	}
-	out := new(RestoreJobList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *RestoreJobList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RestoreJobSpec) DeepCopyInto(out *RestoreJobSpec) {
-	*out = *in
-	out.BackupRef = in.BackupRef
-	if in.TargetApplicationRef != nil {
-		in, out := &in.TargetApplicationRef, &out.TargetApplicationRef
-		*out = new(v1.TypedLocalObjectReference)
-		(*in).DeepCopyInto(*out)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RestoreJobSpec.
-func (in *RestoreJobSpec) DeepCopy() *RestoreJobSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(RestoreJobSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RestoreJobStatus) DeepCopyInto(out *RestoreJobStatus) {
-	*out = *in
-	if in.StartedAt != nil {
-		in, out := &in.StartedAt, &out.StartedAt
-		*out = (*in).DeepCopy()
-	}
-	if in.CompletedAt != nil {
-		in, out := &in.CompletedAt, &out.CompletedAt
-		*out = (*in).DeepCopy()
-	}
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]metav1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RestoreJobStatus.
-func (in *RestoreJobStatus) DeepCopy() *RestoreJobStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(RestoreJobStatus)
-	in.DeepCopyInto(out)
-	return out
-}

api/v1alpha1/cozystackresourcedefinitions_types.go

@@ -92,8 +92,7 @@ type CozystackResourceDefinitionApplication struct {
 
 type CozystackResourceDefinitionRelease struct {
 	// Helm chart configuration
-	// +optional
-	Chart CozystackResourceDefinitionChart `json:"chart,omitempty"`
+	Chart CozystackResourceDefinitionChart `json:"chart"`
 	// Labels for the release
 	Labels map[string]string `json:"labels,omitempty"`
 	// Prefix for the release name
@@ -111,18 +110,17 @@ type CozystackResourceDefinitionRelease struct {
 // - {{ .namespace }}: The namespace of the resource being processed
 //
 // Example YAML:
-//
-//	secrets:
-//	  include:
-//	  - matchExpressions:
-//	    - key: badlabel
-//	      operator: DoesNotExist
-//	    matchLabels:
-//	      goodlabel: goodvalue
-//	    resourceNames:
-//	    - "{{ .name }}-secret"
-//	    - "{{ .kind }}-{{ .name }}-tls"
-//	    - "specificname"
+//   secrets:
+//     include:
+//     - matchExpressions:
+//       - key: badlabel
+//         operator: DoesNotExist
+//       matchLabels:
+//         goodlabel: goodvalue
+//       resourceNames:
+//       - "{{ .name }}-secret"
+//       - "{{ .kind }}-{{ .name }}-tls"
+//       - "specificname"
 type CozystackResourceDefinitionResourceSelector struct {
 	metav1.LabelSelector `json:",inline"`
 	// ResourceNames is a list of resource names to match

api/v1alpha1/package_types.go

@@ -1,89 +0,0 @@
-/*
-Copyright 2025.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1alpha1
-
-import (
-	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-// +kubebuilder:resource:scope=Cluster,shortName={pkg,pkgs}
-// +kubebuilder:subresource:status
-// +kubebuilder:printcolumn:name="Variant",type="string",JSONPath=".spec.variant",description="Selected variant"
-// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status",description="Ready status"
-// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].message",description="Ready message"
-
-// Package is the Schema for the packages API
-type Package struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   PackageSpec   `json:"spec,omitempty"`
-	Status PackageStatus `json:"status,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// PackageList contains a list of Packages
-type PackageList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []Package `json:"items"`
-}
-
-func init() {
-	SchemeBuilder.Register(&Package{}, &PackageList{})
-}
-
-// PackageSpec defines the desired state of Package
-type PackageSpec struct {
-	// Variant is the name of the variant to use from the PackageSource
-	// If not specified, defaults to "default"
-	// +optional
-	Variant string `json:"variant,omitempty"`
-
-	// IgnoreDependencies is a list of package source dependencies to ignore
-	// Dependencies listed here will not be installed even if they are specified in the PackageSource
-	// +optional
-	IgnoreDependencies []string `json:"ignoreDependencies,omitempty"`
-
-	// Components is a map of release name to component overrides
-	// Allows overriding values and enabling/disabling specific components from the PackageSource
-	// +optional
-	Components map[string]PackageComponent `json:"components,omitempty"`
-}
-
-// PackageRelease defines overrides for a specific component
-type PackageComponent struct {
-	// Enabled indicates whether this component should be installed
-	// If false, the component will be disabled even if it's defined in the PackageSource
-	// +optional
-	Enabled *bool `json:"enabled,omitempty"`
-
-	// Values contains Helm chart values as a JSON object
-	// These values will be merged with the default values from the PackageSource
-	// +optional
-	Values *apiextensionsv1.JSON `json:"values,omitempty"`
-}
-
-// PackageStatus defines the observed state of Package
-type PackageStatus struct {
-	// Conditions represents the latest available observations of a Package's state
-	// +optional
-	Conditions []metav1.Condition `json:"conditions,omitempty"`
-}

api/v1alpha1/packagesource_types.go

@@ -1,184 +0,0 @@
-/*
-Copyright 2025.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1alpha1
-
-import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-// +kubebuilder:resource:scope=Cluster,shortName={pkgsrc,pkgsrcs}
-// +kubebuilder:subresource:status
-// +kubebuilder:printcolumn:name="Variants",type="string",JSONPath=".status.variants",description="Package variants (comma-separated)"
-// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status",description="Ready status"
-// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].message",description="Ready message"
-
-// PackageSource is the Schema for the packagesources API
-type PackageSource struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   PackageSourceSpec   `json:"spec,omitempty"`
-	Status PackageSourceStatus `json:"status,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// PackageSourceList contains a list of PackageSources
-type PackageSourceList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []PackageSource `json:"items"`
-}
-
-func init() {
-	SchemeBuilder.Register(&PackageSource{}, &PackageSourceList{})
-}
-
-// PackageSourceSpec defines the desired state of PackageSource
-type PackageSourceSpec struct {
-	// SourceRef is the source reference for the package source charts
-	// +optional
-	SourceRef *PackageSourceRef `json:"sourceRef,omitempty"`
-
-	// Variants is a list of package source variants
-	// Each variant defines components, applications, dependencies, and libraries for a specific configuration
-	// +optional
-	Variants []Variant `json:"variants,omitempty"`
-}
-
-// Variant defines a single variant configuration
-type Variant struct {
-	// Name is the unique identifier for this variant
-	// +required
-	Name string `json:"name"`
-
-	// DependsOn is a list of package source dependencies
-	// For example: "cozystack.networking"
-	// +optional
-	DependsOn []string `json:"dependsOn,omitempty"`
-
-	// Libraries is a list of Helm library charts used by components in this variant
-	// +optional
-	Libraries []Library `json:"libraries,omitempty"`
-
-	// Components is a list of Helm releases to be installed as part of this variant
-	// +optional
-	Components []Component `json:"components,omitempty"`
-}
-
-// DependencyTarget defines a named group of packages that can be referenced
-// by other package sources via dependsOn
-type DependencyTarget struct {
-	// Name is the unique identifier for this dependency target
-	// +required
-	Name string `json:"name"`
-
-	// Packages is a list of package names that belong to this target
-	// These packages will be added as dependencies when this target is referenced
-	// +required
-	Packages []string `json:"packages"`
-}
-
-// Library defines a Helm library chart
-type Library struct {
-	// Name is the optional name for library placed in charts
-	// +optional
-	Name string `json:"name,omitempty"`
-
-	// Path is the path to the library chart directory
-	// +required
-	Path string `json:"path"`
-}
-
-// PackageSourceRef defines the source reference for package source charts
-type PackageSourceRef struct {
-	// Kind of the source reference
-	// +kubebuilder:validation:Enum=GitRepository;OCIRepository
-	// +required
-	Kind string `json:"kind"`
-
-	// Name of the source reference
-	// +required
-	Name string `json:"name"`
-
-	// Namespace of the source reference
-	// +required
-	Namespace string `json:"namespace"`
-
-	// Path is the base path where packages are located in the source.
-	// For GitRepository, defaults to "packages" if not specified.
-	// For OCIRepository, defaults to empty string (root) if not specified.
-	// +optional
-	Path string `json:"path,omitempty"`
-}
-
-// ComponentInstall defines installation parameters for a component
-type ComponentInstall struct {
-	// ReleaseName is the name of the HelmRelease resource that will be created
-	// If not specified, defaults to the component Name field
-	// +optional
-	ReleaseName string `json:"releaseName,omitempty"`
-
-	// Namespace is the Kubernetes namespace where the release will be installed
-	// +optional
-	Namespace string `json:"namespace,omitempty"`
-
-	// Privileged indicates whether this release requires privileged access
-	// +optional
-	Privileged bool `json:"privileged,omitempty"`
-
-	// DependsOn is a list of component names that must be installed before this component
-	// +optional
-	DependsOn []string `json:"dependsOn,omitempty"`
-}
-
-// Component defines a single Helm release component within a package source
-type Component struct {
-	// Name is the unique identifier for this component within the package source
-	// +required
-	Name string `json:"name"`
-
-	// Path is the path to the Helm chart directory
-	// +required
-	Path string `json:"path"`
-
-	// Install defines installation parameters for this component
-	// +optional
-	Install *ComponentInstall `json:"install,omitempty"`
-
-	// Libraries is a list of library names that this component depends on
-	// These libraries must be defined at the variant level
-	// +optional
-	Libraries []string `json:"libraries,omitempty"`
-
-	// ValuesFiles is a list of values file names to use
-	// +optional
-	ValuesFiles []string `json:"valuesFiles,omitempty"`
-}
-
-// PackageSourceStatus defines the observed state of PackageSource
-type PackageSourceStatus struct {
-	// Variants is a comma-separated list of package variant names
-	// This field is populated by the controller based on spec.variants keys
-	// +optional
-	Variants string `json:"variants,omitempty"`
-
-	// Conditions represents the latest available observations of a PackageSource's state
-	// +optional
-	Conditions []metav1.Condition `json:"conditions,omitempty"`
-}

api/v1alpha1/zz_generated.deepcopy.go

@@ -21,62 +21,10 @@ limitations under the License.
 package v1alpha1
 
 import (
-	"k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Component) DeepCopyInto(out *Component) {
-	*out = *in
-	if in.Install != nil {
-		in, out := &in.Install, &out.Install
-		*out = new(ComponentInstall)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.Libraries != nil {
-		in, out := &in.Libraries, &out.Libraries
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.ValuesFiles != nil {
-		in, out := &in.ValuesFiles, &out.ValuesFiles
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Component.
-func (in *Component) DeepCopy() *Component {
-	if in == nil {
-		return nil
-	}
-	out := new(Component)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ComponentInstall) DeepCopyInto(out *ComponentInstall) {
-	*out = *in
-	if in.DependsOn != nil {
-		in, out := &in.DependsOn, &out.DependsOn
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ComponentInstall.
-func (in *ComponentInstall) DeepCopy() *ComponentInstall {
-	if in == nil {
-		return nil
-	}
-	out := new(ComponentInstall)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CozystackResourceDefinition) DeepCopyInto(out *CozystackResourceDefinition) {
 	*out = *in
@@ -308,297 +256,6 @@ func (in *CozystackResourceDefinitionSpec) DeepCopy() *CozystackResourceDefiniti
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DependencyTarget) DeepCopyInto(out *DependencyTarget) {
-	*out = *in
-	if in.Packages != nil {
-		in, out := &in.Packages, &out.Packages
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DependencyTarget.
-func (in *DependencyTarget) DeepCopy() *DependencyTarget {
-	if in == nil {
-		return nil
-	}
-	out := new(DependencyTarget)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Library) DeepCopyInto(out *Library) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Library.
-func (in *Library) DeepCopy() *Library {
-	if in == nil {
-		return nil
-	}
-	out := new(Library)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Package) DeepCopyInto(out *Package) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Package.
-func (in *Package) DeepCopy() *Package {
-	if in == nil {
-		return nil
-	}
-	out := new(Package)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Package) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PackageComponent) DeepCopyInto(out *PackageComponent) {
-	*out = *in
-	if in.Enabled != nil {
-		in, out := &in.Enabled, &out.Enabled
-		*out = new(bool)
-		**out = **in
-	}
-	if in.Values != nil {
-		in, out := &in.Values, &out.Values
-		*out = new(v1.JSON)
-		(*in).DeepCopyInto(*out)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageComponent.
-func (in *PackageComponent) DeepCopy() *PackageComponent {
-	if in == nil {
-		return nil
-	}
-	out := new(PackageComponent)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PackageList) DeepCopyInto(out *PackageList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]Package, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageList.
-func (in *PackageList) DeepCopy() *PackageList {
-	if in == nil {
-		return nil
-	}
-	out := new(PackageList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *PackageList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PackageSource) DeepCopyInto(out *PackageSource) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageSource.
-func (in *PackageSource) DeepCopy() *PackageSource {
-	if in == nil {
-		return nil
-	}
-	out := new(PackageSource)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *PackageSource) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PackageSourceList) DeepCopyInto(out *PackageSourceList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]PackageSource, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageSourceList.
-func (in *PackageSourceList) DeepCopy() *PackageSourceList {
-	if in == nil {
-		return nil
-	}
-	out := new(PackageSourceList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *PackageSourceList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PackageSourceRef) DeepCopyInto(out *PackageSourceRef) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageSourceRef.
-func (in *PackageSourceRef) DeepCopy() *PackageSourceRef {
-	if in == nil {
-		return nil
-	}
-	out := new(PackageSourceRef)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PackageSourceSpec) DeepCopyInto(out *PackageSourceSpec) {
-	*out = *in
-	if in.SourceRef != nil {
-		in, out := &in.SourceRef, &out.SourceRef
-		*out = new(PackageSourceRef)
-		**out = **in
-	}
-	if in.Variants != nil {
-		in, out := &in.Variants, &out.Variants
-		*out = make([]Variant, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageSourceSpec.
-func (in *PackageSourceSpec) DeepCopy() *PackageSourceSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(PackageSourceSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PackageSourceStatus) DeepCopyInto(out *PackageSourceStatus) {
-	*out = *in
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]metav1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageSourceStatus.
-func (in *PackageSourceStatus) DeepCopy() *PackageSourceStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(PackageSourceStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PackageSpec) DeepCopyInto(out *PackageSpec) {
-	*out = *in
-	if in.IgnoreDependencies != nil {
-		in, out := &in.IgnoreDependencies, &out.IgnoreDependencies
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.Components != nil {
-		in, out := &in.Components, &out.Components
-		*out = make(map[string]PackageComponent, len(*in))
-		for key, val := range *in {
-			(*out)[key] = *val.DeepCopy()
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageSpec.
-func (in *PackageSpec) DeepCopy() *PackageSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(PackageSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PackageStatus) DeepCopyInto(out *PackageStatus) {
-	*out = *in
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]metav1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PackageStatus.
-func (in *PackageStatus) DeepCopy() *PackageStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(PackageStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in Selector) DeepCopyInto(out *Selector) {
 	{
@@ -635,38 +292,6 @@ func (in *SourceRef) DeepCopy() *SourceRef {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Variant) DeepCopyInto(out *Variant) {
-	*out = *in
-	if in.DependsOn != nil {
-		in, out := &in.DependsOn, &out.DependsOn
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.Libraries != nil {
-		in, out := &in.Libraries, &out.Libraries
-		*out = make([]Library, len(*in))
-		copy(*out, *in)
-	}
-	if in.Components != nil {
-		in, out := &in.Components, &out.Components
-		*out = make([]Component, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Variant.
-func (in *Variant) DeepCopy() *Variant {
-	if in == nil {
-		return nil
-	}
-	out := new(Variant)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Workload) DeepCopyInto(out *Workload) {
 	*out = *in

cmd/backup-controller/main.go

@@ -1,174 +0,0 @@
-/*
-Copyright 2025.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"crypto/tls"
-	"flag"
-	"os"
-
-	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
-	// to ensure that exec-entrypoint and run can make use of them.
-	_ "k8s.io/client-go/plugin/pkg/client/auth"
-
-	"k8s.io/apimachinery/pkg/runtime"
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/healthz"
-	"sigs.k8s.io/controller-runtime/pkg/log/zap"
-	"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
-	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-
-	backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1"
-	"github.com/cozystack/cozystack/internal/backupcontroller"
-	// +kubebuilder:scaffold:imports
-)
-
-var (
-	scheme   = runtime.NewScheme()
-	setupLog = ctrl.Log.WithName("setup")
-)
-
-func init() {
-	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
-
-	utilruntime.Must(backupsv1alpha1.AddToScheme(scheme))
-	// +kubebuilder:scaffold:scheme
-}
-
-func main() {
-	var metricsAddr string
-	var enableLeaderElection bool
-	var probeAddr string
-	var secureMetrics bool
-	var enableHTTP2 bool
-	var tlsOpts []func(*tls.Config)
-	flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+
-		"Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.")
-	flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
-	flag.BoolVar(&enableLeaderElection, "leader-elect", false,
-		"Enable leader election for controller manager. "+
-			"Enabling this will ensure there is only one active controller manager.")
-	flag.BoolVar(&secureMetrics, "metrics-secure", true,
-		"If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.")
-	flag.BoolVar(&enableHTTP2, "enable-http2", false,
-		"If set, HTTP/2 will be enabled for the metrics and webhook servers")
-	opts := zap.Options{
-		Development: false,
-	}
-	opts.BindFlags(flag.CommandLine)
-	flag.Parse()
-
-	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
-
-	// if the enable-http2 flag is false (the default), http/2 should be disabled
-	// due to its vulnerabilities. More specifically, disabling http/2 will
-	// prevent from being vulnerable to the HTTP/2 Stream Cancellation and
-	// Rapid Reset CVEs. For more information see:
-	// - https://github.com/advisories/GHSA-qppj-fm5r-hxr3
-	// - https://github.com/advisories/GHSA-4374-p667-p6c8
-	disableHTTP2 := func(c *tls.Config) {
-		setupLog.Info("disabling http/2")
-		c.NextProtos = []string{"http/1.1"}
-	}
-
-	if !enableHTTP2 {
-		tlsOpts = append(tlsOpts, disableHTTP2)
-	}
-
-	webhookServer := webhook.NewServer(webhook.Options{
-		TLSOpts: tlsOpts,
-	})
-
-	// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
-	// More info:
-	// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.19.1/pkg/metrics/server
-	// - https://book.kubebuilder.io/reference/metrics.html
-	metricsServerOptions := metricsserver.Options{
-		BindAddress:   metricsAddr,
-		SecureServing: secureMetrics,
-		TLSOpts:       tlsOpts,
-	}
-
-	if secureMetrics {
-		// FilterProvider is used to protect the metrics endpoint with authn/authz.
-		// These configurations ensure that only authorized users and service accounts
-		// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
-		// https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.19.1/pkg/metrics/filters#WithAuthenticationAndAuthorization
-		metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
-
-		// TODO(user): If CertDir, CertName, and KeyName are not specified, controller-runtime will automatically
-		// generate self-signed certificates for the metrics server. While convenient for development and testing,
-		// this setup is not recommended for production.
-	}
-
-	// Configure rate limiting for the Kubernetes client
-	config := ctrl.GetConfigOrDie()
-	config.QPS = 50.0  // Increased from default 5.0
-	config.Burst = 100 // Increased from default 10
-
-	mgr, err := ctrl.NewManager(config, ctrl.Options{
-		Scheme:                 scheme,
-		Metrics:                metricsServerOptions,
-		WebhookServer:          webhookServer,
-		HealthProbeBindAddress: probeAddr,
-		LeaderElection:         enableLeaderElection,
-		LeaderElectionID:       "core.backups.cozystack.io",
-		// LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily
-		// when the Manager ends. This requires the binary to immediately end when the
-		// Manager is stopped, otherwise, this setting is unsafe. Setting this significantly
-		// speeds up voluntary leader transitions as the new leader don't have to wait
-		// LeaseDuration time first.
-		//
-		// In the default scaffold provided, the program ends immediately after
-		// the manager stops, so would be fine to enable this option. However,
-		// if you are doing or is intended to do any operation such as perform cleanups
-		// after the manager stops then its usage might be unsafe.
-		// LeaderElectionReleaseOnCancel: true,
-	})
-	if err != nil {
-		setupLog.Error(err, "unable to start manager")
-		os.Exit(1)
-	}
-
-	if err = (&backupcontroller.PlanReconciler{
-		Client: mgr.GetClient(),
-		Scheme: mgr.GetScheme(),
-	}).SetupWithManager(mgr); err != nil {
-		setupLog.Error(err, "unable to create controller", "controller", "Plan")
-		os.Exit(1)
-	}
-
-	// +kubebuilder:scaffold:builder
-
-	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
-		setupLog.Error(err, "unable to set up health check")
-		os.Exit(1)
-	}
-	if err := mgr.AddReadyzCheck("readyz", healthz.Ping); err != nil {
-		setupLog.Error(err, "unable to set up ready check")
-		os.Exit(1)
-	}
-
-	setupLog.Info("starting manager")
-	if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {
-		setupLog.Error(err, "problem running manager")
-		os.Exit(1)
-	}
-}

cmd/backupstrategy-controller/main.go

@@ -1,174 +0,0 @@
-/*
-Copyright 2025.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"crypto/tls"
-	"flag"
-	"os"
-
-	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
-	// to ensure that exec-entrypoint and run can make use of them.
-	_ "k8s.io/client-go/plugin/pkg/client/auth"
-
-	"k8s.io/apimachinery/pkg/runtime"
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/healthz"
-	"sigs.k8s.io/controller-runtime/pkg/log/zap"
-	"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
-	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-
-	backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1"
-	"github.com/cozystack/cozystack/internal/backupcontroller"
-	// +kubebuilder:scaffold:imports
-)
-
-var (
-	scheme   = runtime.NewScheme()
-	setupLog = ctrl.Log.WithName("setup")
-)
-
-func init() {
-	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
-
-	utilruntime.Must(backupsv1alpha1.AddToScheme(scheme))
-	// +kubebuilder:scaffold:scheme
-}
-
-func main() {
-	var metricsAddr string
-	var enableLeaderElection bool
-	var probeAddr string
-	var secureMetrics bool
-	var enableHTTP2 bool
-	var tlsOpts []func(*tls.Config)
-	flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+
-		"Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.")
-	flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
-	flag.BoolVar(&enableLeaderElection, "leader-elect", false,
-		"Enable leader election for controller manager. "+
-			"Enabling this will ensure there is only one active controller manager.")
-	flag.BoolVar(&secureMetrics, "metrics-secure", true,
-		"If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.")
-	flag.BoolVar(&enableHTTP2, "enable-http2", false,
-		"If set, HTTP/2 will be enabled for the metrics and webhook servers")
-	opts := zap.Options{
-		Development: false,
-	}
-	opts.BindFlags(flag.CommandLine)
-	flag.Parse()
-
-	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
-
-	// if the enable-http2 flag is false (the default), http/2 should be disabled
-	// due to its vulnerabilities. More specifically, disabling http/2 will
-	// prevent from being vulnerable to the HTTP/2 Stream Cancellation and
-	// Rapid Reset CVEs. For more information see:
-	// - https://github.com/advisories/GHSA-qppj-fm5r-hxr3
-	// - https://github.com/advisories/GHSA-4374-p667-p6c8
-	disableHTTP2 := func(c *tls.Config) {
-		setupLog.Info("disabling http/2")
-		c.NextProtos = []string{"http/1.1"}
-	}
-
-	if !enableHTTP2 {
-		tlsOpts = append(tlsOpts, disableHTTP2)
-	}
-
-	webhookServer := webhook.NewServer(webhook.Options{
-		TLSOpts: tlsOpts,
-	})
-
-	// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
-	// More info:
-	// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.19.1/pkg/metrics/server
-	// - https://book.kubebuilder.io/reference/metrics.html
-	metricsServerOptions := metricsserver.Options{
-		BindAddress:   metricsAddr,
-		SecureServing: secureMetrics,
-		TLSOpts:       tlsOpts,
-	}
-
-	if secureMetrics {
-		// FilterProvider is used to protect the metrics endpoint with authn/authz.
-		// These configurations ensure that only authorized users and service accounts
-		// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
-		// https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.19.1/pkg/metrics/filters#WithAuthenticationAndAuthorization
-		metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
-
-		// TODO(user): If CertDir, CertName, and KeyName are not specified, controller-runtime will automatically
-		// generate self-signed certificates for the metrics server. While convenient for development and testing,
-		// this setup is not recommended for production.
-	}
-
-	// Configure rate limiting for the Kubernetes client
-	config := ctrl.GetConfigOrDie()
-	config.QPS = 50.0  // Increased from default 5.0
-	config.Burst = 100 // Increased from default 10
-
-	mgr, err := ctrl.NewManager(config, ctrl.Options{
-		Scheme:                 scheme,
-		Metrics:                metricsServerOptions,
-		WebhookServer:          webhookServer,
-		HealthProbeBindAddress: probeAddr,
-		LeaderElection:         enableLeaderElection,
-		LeaderElectionID:       "strategy.backups.cozystack.io",
-		// LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily
-		// when the Manager ends. This requires the binary to immediately end when the
-		// Manager is stopped, otherwise, this setting is unsafe. Setting this significantly
-		// speeds up voluntary leader transitions as the new leader don't have to wait
-		// LeaseDuration time first.
-		//
-		// In the default scaffold provided, the program ends immediately after
-		// the manager stops, so would be fine to enable this option. However,
-		// if you are doing or is intended to do any operation such as perform cleanups
-		// after the manager stops then its usage might be unsafe.
-		// LeaderElectionReleaseOnCancel: true,
-	})
-	if err != nil {
-		setupLog.Error(err, "unable to start manager")
-		os.Exit(1)
-	}
-
-	if err = (&backupcontroller.BackupJobStrategyReconciler{
-		Client: mgr.GetClient(),
-		Scheme: mgr.GetScheme(),
-	}).SetupWithManager(mgr); err != nil {
-		setupLog.Error(err, "unable to create controller", "controller", "Job")
-		os.Exit(1)
-	}
-
-	// +kubebuilder:scaffold:builder
-
-	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
-		setupLog.Error(err, "unable to set up health check")
-		os.Exit(1)
-	}
-	if err := mgr.AddReadyzCheck("readyz", healthz.Ping); err != nil {
-		setupLog.Error(err, "unable to set up ready check")
-		os.Exit(1)
-	}
-
-	setupLog.Info("starting manager")
-	if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {
-		setupLog.Error(err, "problem running manager")
-		os.Exit(1)
-	}
-}

cmd/cozypkg/cmd/add.go

@@ -1,565 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package cmd
-
-import (
-	"bufio"
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-
-	"github.com/spf13/cobra"
-	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/serializer/yaml"
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
-	"k8s.io/client-go/rest"
-	"k8s.io/client-go/tools/clientcmd"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	_ "k8s.io/client-go/plugin/pkg/client/auth"
-)
-
-var addCmdFlags struct {
-	files      []string
-	kubeconfig string
-}
-
-var addCmd = &cobra.Command{
-	Use:   "add [package]...",
-	Short: "Install PackageSource and its dependencies interactively",
-	Long: `Install PackageSource and its dependencies interactively.
-
-You can specify packages as arguments or use -f flag to read from files.
-Multiple -f flags can be specified, and they can point to files or directories.`,
-	Args: cobra.ArbitraryArgs,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		ctx := context.Background()
-
-		// Collect package names from arguments and files
-		packageNames := make(map[string]bool)
-		packagesFromFiles := make(map[string]string) // packageName -> filePath
-		
-		for _, arg := range args {
-			packageNames[arg] = true
-		}
-
-		// Read packages from files
-		for _, filePath := range addCmdFlags.files {
-			packages, err := readPackagesFromFile(filePath)
-			if err != nil {
-				return fmt.Errorf("failed to read packages from %s: %w", filePath, err)
-			}
-			for _, pkg := range packages {
-				packageNames[pkg] = true
-				packagesFromFiles[pkg] = filePath
-			}
-		}
-
-		if len(packageNames) == 0 {
-			return fmt.Errorf("no packages specified")
-		}
-
-		// Create Kubernetes client config
-		var config *rest.Config
-		var err error
-
-		if addCmdFlags.kubeconfig != "" {
-			config, err = clientcmd.BuildConfigFromFlags("", addCmdFlags.kubeconfig)
-			if err != nil {
-				return fmt.Errorf("failed to load kubeconfig from %s: %w", addCmdFlags.kubeconfig, err)
-			}
-		} else {
-			config, err = ctrl.GetConfig()
-			if err != nil {
-				return fmt.Errorf("failed to get kubeconfig: %w", err)
-			}
-		}
-
-		scheme := runtime.NewScheme()
-		utilruntime.Must(clientgoscheme.AddToScheme(scheme))
-		utilruntime.Must(cozyv1alpha1.AddToScheme(scheme))
-
-		k8sClient, err := client.New(config, client.Options{Scheme: scheme})
-		if err != nil {
-			return fmt.Errorf("failed to create k8s client: %w", err)
-		}
-
-		// Process each package
-		for packageName := range packageNames {
-			// Check if package comes from a file
-			if filePath, fromFile := packagesFromFiles[packageName]; fromFile {
-				// Try to create Package directly from file
-				if err := createPackageFromFile(ctx, k8sClient, filePath, packageName); err == nil {
-					fmt.Fprintf(os.Stderr, "✓ Added Package %s\n", packageName)
-					continue
-				}
-				// If failed, fall back to interactive installation
-			}
-			
-			// Interactive installation from PackageSource
-			if err := installPackage(ctx, k8sClient, packageName); err != nil {
-				return err
-			}
-		}
-
-		return nil
-	},
-}
-
-func readPackagesFromFile(filePath string) ([]string, error) {
-	info, err := os.Stat(filePath)
-	if err != nil {
-		return nil, err
-	}
-
-	var packages []string
-
-	if info.IsDir() {
-		// Read all YAML files from directory
-		err := filepath.Walk(filePath, func(path string, info os.FileInfo, err error) error {
-			if err != nil {
-				return err
-			}
-			if info.IsDir() || !strings.HasSuffix(path, ".yaml") && !strings.HasSuffix(path, ".yml") {
-				return nil
-			}
-
-			pkgs, err := readPackagesFromYAMLFile(path)
-			if err != nil {
-				return fmt.Errorf("failed to read %s: %w", path, err)
-			}
-			packages = append(packages, pkgs...)
-			return nil
-		})
-		if err != nil {
-			return nil, err
-		}
-	} else {
-		packages, err = readPackagesFromYAMLFile(filePath)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	return packages, nil
-}
-
-func readPackagesFromYAMLFile(filePath string) ([]string, error) {
-	data, err := os.ReadFile(filePath)
-	if err != nil {
-		return nil, err
-	}
-
-	var packages []string
-
-	// Split YAML documents (in case of multiple resources)
-	documents := strings.Split(string(data), "---")
-	
-	for _, doc := range documents {
-		doc = strings.TrimSpace(doc)
-		if doc == "" {
-			continue
-		}
-
-		// Parse using Kubernetes decoder
-		decoder := yaml.NewDecodingSerializer(unstructured.UnstructuredJSONScheme)
-		obj := &unstructured.Unstructured{}
-		_, _, err := decoder.Decode([]byte(doc), nil, obj)
-		if err != nil {
-			continue
-		}
-
-		// Check if it's a Package
-		if obj.GetKind() == "Package" {
-			name := obj.GetName()
-			if name != "" {
-				packages = append(packages, name)
-			}
-			continue
-		}
-
-		// Check if it's a PackageSource
-		if obj.GetKind() == "PackageSource" {
-			name := obj.GetName()
-			if name != "" {
-				packages = append(packages, name)
-			}
-			continue
-		}
-
-		// Try to parse as PackageList
-		if obj.GetKind() == "PackageList" {
-			items, found, err := unstructured.NestedSlice(obj.Object, "items")
-			if err == nil && found {
-				for _, item := range items {
-					if itemMap, ok := item.(map[string]interface{}); ok {
-						if metadata, ok := itemMap["metadata"].(map[string]interface{}); ok {
-							if name, ok := metadata["name"].(string); ok && name != "" {
-								packages = append(packages, name)
-							}
-						}
-					}
-				}
-			}
-			continue
-		}
-
-		// Try to parse as PackageSourceList
-		if obj.GetKind() == "PackageSourceList" {
-			items, found, err := unstructured.NestedSlice(obj.Object, "items")
-			if err == nil && found {
-				for _, item := range items {
-					if itemMap, ok := item.(map[string]interface{}); ok {
-						if metadata, ok := itemMap["metadata"].(map[string]interface{}); ok {
-							if name, ok := metadata["name"].(string); ok && name != "" {
-								packages = append(packages, name)
-							}
-						}
-					}
-				}
-			}
-			continue
-		}
-	}
-
-	if len(packages) == 0 {
-		return nil, fmt.Errorf("no valid packages found in file")
-	}
-
-	return packages, nil
-}
-
-// buildDependencyTree builds a dependency tree starting from the root PackageSource
-// Returns both the dependency tree and a map of dependencies to their requesters
-func buildDependencyTree(ctx context.Context, k8sClient client.Client, rootName string) (map[string][]string, map[string]string, error) {
-	tree := make(map[string][]string)
-	dependencyRequesters := make(map[string]string) // dep -> requester
-	visited := make(map[string]bool)
-	
-	// Ensure root is in tree even if it has no dependencies
-	tree[rootName] = []string{}
-
-	var buildTree func(string) error
-	buildTree = func(pkgName string) error {
-		if visited[pkgName] {
-			return nil
-		}
-		visited[pkgName] = true
-
-		// Get PackageSource
-		ps := &cozyv1alpha1.PackageSource{}
-		if err := k8sClient.Get(ctx, client.ObjectKey{Name: pkgName}, ps); err != nil {
-			// If PackageSource doesn't exist, just skip it
-			return nil
-		}
-
-		// Collect all dependencies from all variants
-		deps := make(map[string]bool)
-		for _, variant := range ps.Spec.Variants {
-			for _, dep := range variant.DependsOn {
-				deps[dep] = true
-			}
-		}
-
-		// Add dependencies to tree
-		for dep := range deps {
-			if _, exists := tree[pkgName]; !exists {
-				tree[pkgName] = []string{}
-			}
-			tree[pkgName] = append(tree[pkgName], dep)
-			// Track who requested this dependency
-			dependencyRequesters[dep] = pkgName
-			// Recursively build tree for dependencies
-			if err := buildTree(dep); err != nil {
-				return err
-			}
-		}
-
-		return nil
-	}
-
-	if err := buildTree(rootName); err != nil {
-		return nil, nil, err
-	}
-
-	return tree, dependencyRequesters, nil
-}
-
-// topologicalSort performs topological sort on the dependency tree
-// Returns order from root to leaves (dependencies first)
-func topologicalSort(tree map[string][]string) ([]string, error) {
-	// Build reverse graph (dependencies -> dependents)
-	reverseGraph := make(map[string][]string)
-	allNodes := make(map[string]bool)
-
-	for node, deps := range tree {
-		allNodes[node] = true
-		for _, dep := range deps {
-			allNodes[dep] = true
-			reverseGraph[dep] = append(reverseGraph[dep], node)
-		}
-	}
-
-	// Calculate in-degrees (how many dependencies a node has)
-	inDegree := make(map[string]int)
-	for node := range allNodes {
-		inDegree[node] = 0
-	}
-	for node, deps := range tree {
-		inDegree[node] = len(deps)
-	}
-
-	// Kahn's algorithm - start with nodes that have no dependencies
-	var queue []string
-	for node, degree := range inDegree {
-		if degree == 0 {
-			queue = append(queue, node)
-		}
-	}
-
-	var result []string
-	for len(queue) > 0 {
-		node := queue[0]
-		queue = queue[1:]
-		result = append(result, node)
-
-		// Process dependents (nodes that depend on this node)
-		for _, dependent := range reverseGraph[node] {
-			inDegree[dependent]--
-			if inDegree[dependent] == 0 {
-				queue = append(queue, dependent)
-			}
-		}
-	}
-
-	// Check for cycles
-	if len(result) != len(allNodes) {
-		return nil, fmt.Errorf("dependency cycle detected")
-	}
-
-	return result, nil
-}
-
-// createPackageFromFile creates a Package resource directly from a YAML file
-func createPackageFromFile(ctx context.Context, k8sClient client.Client, filePath string, packageName string) error {
-	data, err := os.ReadFile(filePath)
-	if err != nil {
-		return err
-	}
-
-	// Split YAML documents
-	documents := strings.Split(string(data), "---")
-	
-	for _, doc := range documents {
-		doc = strings.TrimSpace(doc)
-		if doc == "" {
-			continue
-		}
-
-		// Parse using Kubernetes decoder
-		decoder := yaml.NewDecodingSerializer(unstructured.UnstructuredJSONScheme)
-		obj := &unstructured.Unstructured{}
-		_, _, err := decoder.Decode([]byte(doc), nil, obj)
-		if err != nil {
-			continue
-		}
-
-		// Check if it's a Package with matching name
-		if obj.GetKind() == "Package" && obj.GetName() == packageName {
-			// Convert to Package
-			var pkg cozyv1alpha1.Package
-			if err := runtime.DefaultUnstructuredConverter.FromUnstructured(obj.Object, &pkg); err != nil {
-				return fmt.Errorf("failed to convert Package: %w", err)
-			}
-
-			// Create Package
-			if err := k8sClient.Create(ctx, &pkg); err != nil {
-				return fmt.Errorf("failed to create Package: %w", err)
-			}
-
-			return nil
-		}
-	}
-
-	return fmt.Errorf("Package %s not found in file", packageName)
-}
-
-func installPackage(ctx context.Context, k8sClient client.Client, packageSourceName string) error {
-	// Get PackageSource
-	packageSource := &cozyv1alpha1.PackageSource{}
-	if err := k8sClient.Get(ctx, client.ObjectKey{Name: packageSourceName}, packageSource); err != nil {
-		return fmt.Errorf("failed to get PackageSource %s: %w", packageSourceName, err)
-	}
-
-	// Build dependency tree
-	dependencyTree, dependencyRequesters, err := buildDependencyTree(ctx, k8sClient, packageSourceName)
-	if err != nil {
-		return fmt.Errorf("failed to build dependency tree: %w", err)
-	}
-
-	// Topological sort (install from root to leaves)
-	installOrder, err := topologicalSort(dependencyTree)
-	if err != nil {
-		return fmt.Errorf("failed to sort dependencies: %w", err)
-	}
-
-	// Get all PackageSources for variant selection
-	var allPackageSources cozyv1alpha1.PackageSourceList
-	if err := k8sClient.List(ctx, &allPackageSources); err != nil {
-		return fmt.Errorf("failed to list PackageSources: %w", err)
-	}
-
-	packageSourceMap := make(map[string]*cozyv1alpha1.PackageSource)
-	for i := range allPackageSources.Items {
-		packageSourceMap[allPackageSources.Items[i].Name] = &allPackageSources.Items[i]
-	}
-
-	// Get all installed Packages
-	var installedPackages cozyv1alpha1.PackageList
-	if err := k8sClient.List(ctx, &installedPackages); err != nil {
-		return fmt.Errorf("failed to list Packages: %w", err)
-	}
-
-	installedMap := make(map[string]*cozyv1alpha1.Package)
-	for i := range installedPackages.Items {
-		installedMap[installedPackages.Items[i].Name] = &installedPackages.Items[i]
-	}
-
-	// First, collect all variant selections
-	fmt.Fprintf(os.Stderr, "Installing %s and its dependencies...\n\n", packageSourceName)
-	packageVariants := make(map[string]string) // packageName -> variant
-
-	for _, pkgName := range installOrder {
-		// Check if already installed
-		if installed, exists := installedMap[pkgName]; exists {
-			variant := installed.Spec.Variant
-			if variant == "" {
-				variant = "default"
-			}
-			fmt.Fprintf(os.Stderr, "✓ %s (already installed, variant: %s)\n", pkgName, variant)
-			packageVariants[pkgName] = variant
-			continue
-		}
-
-		// Get PackageSource for this dependency
-		ps, exists := packageSourceMap[pkgName]
-		if !exists {
-			requester := dependencyRequesters[pkgName]
-			if requester != "" {
-				return fmt.Errorf("PackageSource %s not found (required by %s)", pkgName, requester)
-			}
-			return fmt.Errorf("PackageSource %s not found", pkgName)
-		}
-
-		// Select variant interactively
-		variant, err := selectVariantInteractive(ps)
-		if err != nil {
-			return fmt.Errorf("failed to select variant for %s: %w", pkgName, err)
-		}
-
-		packageVariants[pkgName] = variant
-	}
-
-		// Now create all Package resources
-		for _, pkgName := range installOrder {
-			// Skip if already installed
-			if _, exists := installedMap[pkgName]; exists {
-				continue
-			}
-
-			variant := packageVariants[pkgName]
-
-			// Create Package
-			pkg := &cozyv1alpha1.Package{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: pkgName,
-				},
-				Spec: cozyv1alpha1.PackageSpec{
-					Variant: variant,
-				},
-			}
-
-			if err := k8sClient.Create(ctx, pkg); err != nil {
-				return fmt.Errorf("failed to create Package %s: %w", pkgName, err)
-			}
-
-			fmt.Fprintf(os.Stderr, "✓ Added Package %s\n", pkgName)
-		}
-
-		return nil
-}
-
-// selectVariantInteractive prompts user to select a variant
-func selectVariantInteractive(ps *cozyv1alpha1.PackageSource) (string, error) {
-	if len(ps.Spec.Variants) == 0 {
-		return "", fmt.Errorf("no variants available for PackageSource %s", ps.Name)
-	}
-
-	reader := bufio.NewReader(os.Stdin)
-
-	fmt.Fprintf(os.Stderr, "\nPackageSource: %s\n", ps.Name)
-	fmt.Fprintf(os.Stderr, "Available variants:\n")
-	for i, variant := range ps.Spec.Variants {
-		fmt.Fprintf(os.Stderr, "  %d. %s\n", i+1, variant.Name)
-	}
-
-	// If only one variant, use it as default
-	defaultVariant := ps.Spec.Variants[0].Name
-	var prompt string
-	if len(ps.Spec.Variants) == 1 {
-		prompt = "Select variant [1]: "
-	} else {
-		prompt = fmt.Sprintf("Select variant (1-%d): ", len(ps.Spec.Variants))
-	}
-
-	for {
-		fmt.Fprintf(os.Stderr, prompt)
-		input, err := reader.ReadString('\n')
-		if err != nil {
-			return "", fmt.Errorf("failed to read input: %w", err)
-		}
-
-		input = strings.TrimSpace(input)
-
-		// If input is empty and there's a default variant, use it
-		if input == "" && len(ps.Spec.Variants) == 1 {
-			return defaultVariant, nil
-		}
-
-		choice, err := strconv.Atoi(input)
-		if err != nil || choice < 1 || choice > len(ps.Spec.Variants) {
-			fmt.Fprintf(os.Stderr, "Invalid choice. Please enter a number between 1 and %d.\n", len(ps.Spec.Variants))
-			continue
-		}
-
-		return ps.Spec.Variants[choice-1].Name, nil
-	}
-}
-
-func init() {
-	rootCmd.AddCommand(addCmd)
-	addCmd.Flags().StringArrayVarP(&addCmdFlags.files, "file", "f", []string{}, "Read packages from file or directory (can be specified multiple times)")
-	addCmd.Flags().StringVar(&addCmdFlags.kubeconfig, "kubeconfig", "", "Path to kubeconfig file (defaults to ~/.kube/config or KUBECONFIG env var)")
-}
-

cmd/cozypkg/cmd/del.go

@@ -1,121 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"os"
-
-	"github.com/spf13/cobra"
-	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
-	"k8s.io/apimachinery/pkg/runtime"
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
-	"k8s.io/client-go/rest"
-	"k8s.io/client-go/tools/clientcmd"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	_ "k8s.io/client-go/plugin/pkg/client/auth"
-)
-
-var delCmdFlags struct {
-	files      []string
-	kubeconfig string
-}
-
-var delCmd = &cobra.Command{
-	Use:   "del [package]...",
-	Short: "Delete Package resources",
-	Long: `Delete Package resources.
-
-You can specify packages as arguments or use -f flag to read from files.
-Multiple -f flags can be specified, and they can point to files or directories.`,
-	Args: cobra.ArbitraryArgs,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		ctx := context.Background()
-
-		// Collect package names from arguments and files
-		packageNames := make(map[string]bool)
-		for _, arg := range args {
-			packageNames[arg] = true
-		}
-
-		// Read packages from files (reuse function from add.go)
-		for _, filePath := range delCmdFlags.files {
-			packages, err := readPackagesFromFile(filePath)
-			if err != nil {
-				return fmt.Errorf("failed to read packages from %s: %w", filePath, err)
-			}
-			for _, pkg := range packages {
-				packageNames[pkg] = true
-			}
-		}
-
-		if len(packageNames) == 0 {
-			return fmt.Errorf("no packages specified")
-		}
-
-		// Create Kubernetes client config
-		var config *rest.Config
-		var err error
-
-		if delCmdFlags.kubeconfig != "" {
-			config, err = clientcmd.BuildConfigFromFlags("", delCmdFlags.kubeconfig)
-			if err != nil {
-				return fmt.Errorf("failed to load kubeconfig from %s: %w", delCmdFlags.kubeconfig, err)
-			}
-		} else {
-			config, err = ctrl.GetConfig()
-			if err != nil {
-				return fmt.Errorf("failed to get kubeconfig: %w", err)
-			}
-		}
-
-		scheme := runtime.NewScheme()
-		utilruntime.Must(clientgoscheme.AddToScheme(scheme))
-		utilruntime.Must(cozyv1alpha1.AddToScheme(scheme))
-
-		k8sClient, err := client.New(config, client.Options{Scheme: scheme})
-		if err != nil {
-			return fmt.Errorf("failed to create k8s client: %w", err)
-		}
-
-		// Delete each package
-		for packageName := range packageNames {
-			pkg := &cozyv1alpha1.Package{}
-			pkg.Name = packageName
-			if err := k8sClient.Delete(ctx, pkg); err != nil {
-				if client.IgnoreNotFound(err) == nil {
-					fmt.Fprintf(os.Stderr, "⚠ Package %s not found, skipping\n", packageName)
-					continue
-				}
-				return fmt.Errorf("failed to delete Package %s: %w", packageName, err)
-			}
-			fmt.Fprintf(os.Stderr, "✓ Deleted Package %s\n", packageName)
-		}
-
-		return nil
-	},
-}
-
-func init() {
-	rootCmd.AddCommand(delCmd)
-	delCmd.Flags().StringArrayVarP(&delCmdFlags.files, "file", "f", []string{}, "Read packages from file or directory (can be specified multiple times)")
-	delCmd.Flags().StringVar(&delCmdFlags.kubeconfig, "kubeconfig", "", "Path to kubeconfig file (defaults to ~/.kube/config or KUBECONFIG env var)")
-}
-

cmd/cozypkg/cmd/dependencies.go

@@ -1,300 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"strings"
-
-	"github.com/emicklei/dot"
-	"github.com/spf13/cobra"
-	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
-	"k8s.io/apimachinery/pkg/runtime"
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
-	"k8s.io/client-go/rest"
-	"k8s.io/client-go/tools/clientcmd"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	_ "k8s.io/client-go/plugin/pkg/client/auth"
-)
-
-var dotCmdFlags struct {
-	installed  bool
-	components bool
-	files      []string
-	kubeconfig string
-}
-
-var dotCmd = &cobra.Command{
-	Use:   "dot [package]...",
-	Short: "Generate dependency graph as graphviz DOT format",
-	Long: `Generate dependency graph as graphviz DOT format.
-
-Pipe the output through the "dot" program (part of graphviz package) to render the graph:
-
-    cozypkg dot | dot -Tpng > graph.png
-
-By default, shows dependencies for all PackageSource resources.
-Use --installed to show only installed Package resources.
-Specify packages as arguments or use -f flag to read from files.`,
-	Args: cobra.ArbitraryArgs,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		ctx := context.Background()
-
-		// Collect package names from arguments and files
-		packageNames := make(map[string]bool)
-		for _, arg := range args {
-			packageNames[arg] = true
-		}
-
-		// Read packages from files (reuse function from add.go)
-		for _, filePath := range dotCmdFlags.files {
-			packages, err := readPackagesFromFile(filePath)
-			if err != nil {
-				return fmt.Errorf("failed to read packages from %s: %w", filePath, err)
-			}
-			for _, pkg := range packages {
-				packageNames[pkg] = true
-			}
-		}
-
-		// Convert to slice, empty means all packages
-		var selectedPackages []string
-		if len(packageNames) > 0 {
-			for pkg := range packageNames {
-				selectedPackages = append(selectedPackages, pkg)
-			}
-		}
-
-		// If multiple packages specified, show graph for all of them
-		// If single package, use packageName for backward compatibility
-		var packageName string
-		if len(selectedPackages) == 1 {
-			packageName = selectedPackages[0]
-		} else if len(selectedPackages) > 1 {
-			// Multiple packages - pass empty string to packageName, use selectedPackages
-			packageName = ""
-		}
-
-		// packagesOnly is inverse of components flag (if components=false, then packagesOnly=true)
-		packagesOnly := !dotCmdFlags.components
-		graph, allNodes, err := buildGraphFromCluster(ctx, dotCmdFlags.kubeconfig, packagesOnly, dotCmdFlags.installed, packageName, selectedPackages)
-		if err != nil {
-			return fmt.Errorf("error getting PackageSource dependencies: %w", err)
-		}
-
-		dotGraph := generateDOTGraph(graph, allNodes, packagesOnly)
-		dotGraph.Write(os.Stdout)
-
-		return nil
-	},
-}
-
-func init() {
-	rootCmd.AddCommand(dotCmd)
-	dotCmd.Flags().BoolVarP(&dotCmdFlags.installed, "installed", "i", false, "show dependencies only for installed Package resources")
-	dotCmd.Flags().BoolVar(&dotCmdFlags.components, "components", true, "show component-level dependencies (default: true)")
-	dotCmd.Flags().StringArrayVarP(&dotCmdFlags.files, "file", "f", []string{}, "Read packages from file or directory (can be specified multiple times)")
-	dotCmd.Flags().StringVar(&dotCmdFlags.kubeconfig, "kubeconfig", "", "Path to kubeconfig file (defaults to ~/.kube/config or KUBECONFIG env var)")
-}
-
-var (
-	dependenciesScheme = runtime.NewScheme()
-)
-
-func init() {
-	utilruntime.Must(clientgoscheme.AddToScheme(dependenciesScheme))
-	utilruntime.Must(cozyv1alpha1.AddToScheme(dependenciesScheme))
-}
-
-// buildGraphFromCluster builds a dependency graph from PackageSource resources in the cluster.
-func buildGraphFromCluster(ctx context.Context, kubeconfig string, packagesOnly bool, installedOnly bool, packageName string, selectedPackages []string) (map[string][]string, map[string]bool, error) {
-	// Create Kubernetes client config
-	var config *rest.Config
-	var err error
-
-	if kubeconfig != "" {
-		// Load kubeconfig from explicit path
-		config, err = clientcmd.BuildConfigFromFlags("", kubeconfig)
-		if err != nil {
-			return nil, nil, fmt.Errorf("failed to load kubeconfig from %s: %w", kubeconfig, err)
-		}
-	} else {
-		// Use default kubeconfig loading (from env var or ~/.kube/config)
-		config, err = ctrl.GetConfig()
-		if err != nil {
-			return nil, nil, fmt.Errorf("failed to get kubeconfig: %w", err)
-		}
-	}
-
-	k8sClient, err := client.New(config, client.Options{Scheme: dependenciesScheme})
-	if err != nil {
-		return nil, nil, fmt.Errorf("failed to create k8s client: %w", err)
-	}
-
-	// Get installed Packages if needed
-	installedPackages := make(map[string]bool)
-	if installedOnly || packageName != "" {
-		var packageList cozyv1alpha1.PackageList
-		if err := k8sClient.List(ctx, &packageList); err != nil {
-			return nil, nil, fmt.Errorf("failed to list Packages: %w", err)
-		}
-		for _, pkg := range packageList.Items {
-			installedPackages[pkg.Name] = true
-		}
-	}
-
-	// List all PackageSource resources
-	var packageSourceList cozyv1alpha1.PackageSourceList
-	if err := k8sClient.List(ctx, &packageSourceList); err != nil {
-		return nil, nil, fmt.Errorf("failed to list PackageSources: %w", err)
-	}
-
-	graph := make(map[string][]string)
-	allNodes := make(map[string]bool)
-
-	// Process each PackageSource
-	for _, ps := range packageSourceList.Items {
-		psName := ps.Name
-		if psName == "" {
-			continue
-		}
-
-		// Filter by package name if specified
-		if packageName != "" && psName != packageName {
-			continue
-		}
-
-		// Filter by selected packages if specified
-		if len(selectedPackages) > 0 {
-			found := false
-			for _, selected := range selectedPackages {
-				if psName == selected {
-					found = true
-					break
-				}
-			}
-			if !found {
-				continue
-			}
-		}
-
-		// Filter by installed packages if flag is set
-		if installedOnly && !installedPackages[psName] {
-			continue
-		}
-
-		allNodes[psName] = true
-
-		// Extract dependencies from variants
-		for _, variant := range ps.Spec.Variants {
-			// Variant-level dependencies
-			for _, dep := range variant.DependsOn {
-				// If installedOnly is set, only include dependencies that are installed
-				if installedOnly && !installedPackages[dep] {
-					continue
-				}
-				graph[psName] = append(graph[psName], dep)
-				allNodes[dep] = true
-			}
-
-			// Component-level dependencies
-			if !packagesOnly {
-				for _, component := range variant.Components {
-					componentName := fmt.Sprintf("%s.%s", psName, component.Name)
-					allNodes[componentName] = true
-
-					if component.Install != nil {
-						for _, dep := range component.Install.DependsOn {
-							// Check if it's a local component dependency or external
-							if strings.Contains(dep, ".") {
-								graph[componentName] = append(graph[componentName], dep)
-								allNodes[dep] = true
-							} else {
-								// Local component dependency
-								localDep := fmt.Sprintf("%s.%s", psName, dep)
-								graph[componentName] = append(graph[componentName], localDep)
-								allNodes[localDep] = true
-							}
-						}
-					}
-				}
-			}
-		}
-	}
-
-	return graph, allNodes, nil
-}
-
-// generateDOTGraph generates a DOT graph from the dependency graph.
-func generateDOTGraph(graph map[string][]string, allNodes map[string]bool, packagesOnly bool) *dot.Graph {
-	g := dot.NewGraph(dot.Directed)
-	g.Attr("rankdir", "LR")
-	g.Attr("nodesep", "0.5")
-	g.Attr("ranksep", "1.0")
-
-	// Add nodes
-	for node := range allNodes {
-		if packagesOnly && strings.Contains(node, ".") && !strings.HasPrefix(node, "cozystack.") {
-			// Skip component nodes when packages-only is enabled
-			continue
-		}
-
-		n := g.Node(node)
-
-		// Style nodes based on type
-		if strings.Contains(node, ".") && !strings.HasPrefix(node, "cozystack.") {
-			// Component node
-			n.Attr("shape", "box")
-			n.Attr("style", "rounded,filled")
-			n.Attr("fillcolor", "lightyellow")
-			n.Attr("label", strings.Split(node, ".")[len(strings.Split(node, "."))-1])
-		} else {
-			// Package node
-			n.Attr("shape", "box")
-			n.Attr("style", "rounded,filled")
-			n.Attr("fillcolor", "lightblue")
-			n.Attr("label", node)
-		}
-	}
-
-	// Add edges
-	for source, targets := range graph {
-		if packagesOnly && strings.Contains(source, ".") && !strings.HasPrefix(source, "cozystack.") {
-			// Skip component edges when packages-only is enabled
-			continue
-		}
-
-		for _, target := range targets {
-			if packagesOnly && strings.Contains(target, ".") && !strings.HasPrefix(target, "cozystack.") {
-				// Skip component edges when packages-only is enabled
-				continue
-			}
-
-			// Only add edge if both nodes exist
-			if allNodes[source] && allNodes[target] {
-				g.Edge(g.Node(source), g.Node(target))
-			}
-		}
-	}
-
-	return g
-}
-

cmd/cozypkg/cmd/list.go

@@ -1,201 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"strings"
-
-	"github.com/spf13/cobra"
-	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
-	"k8s.io/apimachinery/pkg/runtime"
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
-	"k8s.io/client-go/rest"
-	"k8s.io/client-go/tools/clientcmd"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	_ "k8s.io/client-go/plugin/pkg/client/auth"
-)
-
-var listCmdFlags struct {
-	installed   bool
-	components  bool
-	kubeconfig  string
-}
-
-var listCmd = &cobra.Command{
-	Use:   "list",
-	Short: "List PackageSource or Package resources",
-	Long: `List PackageSource or Package resources in table format.
-
-By default, lists PackageSource resources. Use --installed flag to list installed Package resources.
-Use --components flag to show components on separate lines.`,
-	Args: cobra.NoArgs,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		ctx := context.Background()
-
-		// Create Kubernetes client config
-		var config *rest.Config
-		var err error
-
-		if listCmdFlags.kubeconfig != "" {
-			config, err = clientcmd.BuildConfigFromFlags("", listCmdFlags.kubeconfig)
-			if err != nil {
-				return fmt.Errorf("failed to load kubeconfig from %s: %w", listCmdFlags.kubeconfig, err)
-			}
-		} else {
-			config, err = ctrl.GetConfig()
-			if err != nil {
-				return fmt.Errorf("failed to get kubeconfig: %w", err)
-			}
-		}
-
-		scheme := runtime.NewScheme()
-		utilruntime.Must(clientgoscheme.AddToScheme(scheme))
-		utilruntime.Must(cozyv1alpha1.AddToScheme(scheme))
-
-		k8sClient, err := client.New(config, client.Options{Scheme: scheme})
-		if err != nil {
-			return fmt.Errorf("failed to create k8s client: %w", err)
-		}
-
-		if listCmdFlags.installed {
-			return listPackages(ctx, k8sClient, listCmdFlags.components)
-		}
-		return listPackageSources(ctx, k8sClient, listCmdFlags.components)
-	},
-}
-
-func listPackageSources(ctx context.Context, k8sClient client.Client, showComponents bool) error {
-	var psList cozyv1alpha1.PackageSourceList
-	if err := k8sClient.List(ctx, &psList); err != nil {
-		return fmt.Errorf("failed to list PackageSources: %w", err)
-	}
-
-	// Print header
-	fmt.Fprintf(os.Stdout, "%-50s %-30s %-10s %s\n", "NAME", "VARIANTS", "READY", "STATUS")
-	fmt.Fprintf(os.Stdout, "%-50s %-30s %-10s %s\n", strings.Repeat("-", 50), strings.Repeat("-", 30), strings.Repeat("-", 10), strings.Repeat("-", 50))
-
-		// Print rows
-		for _, ps := range psList.Items {
-			// Get variants
-			var variants []string
-			for _, variant := range ps.Spec.Variants {
-				variants = append(variants, variant.Name)
-			}
-			variantsStr := strings.Join(variants, ",")
-			if len(variantsStr) > 28 {
-				variantsStr = variantsStr[:25] + "..."
-			}
-
-			// Get Ready condition
-			ready := "Unknown"
-			status := ""
-			for _, condition := range ps.Status.Conditions {
-				if condition.Type == "Ready" {
-					ready = string(condition.Status)
-					status = condition.Message
-					if len(status) > 48 {
-						status = status[:45] + "..."
-					}
-					break
-				}
-			}
-
-			fmt.Fprintf(os.Stdout, "%-50s %-30s %-10s %s\n", ps.Name, variantsStr, ready, status)
-
-			// Show components if requested
-			if showComponents {
-				for _, variant := range ps.Spec.Variants {
-					for _, component := range variant.Components {
-						fmt.Fprintf(os.Stdout, "  %-48s %-30s %-10s %s\n", 
-							fmt.Sprintf("%s.%s", ps.Name, component.Name), 
-							variant.Name, "", "")
-					}
-				}
-			}
-		}
-
-	return nil
-}
-
-func listPackages(ctx context.Context, k8sClient client.Client, showComponents bool) error {
-	var pkgList cozyv1alpha1.PackageList
-	if err := k8sClient.List(ctx, &pkgList); err != nil {
-		return fmt.Errorf("failed to list Packages: %w", err)
-	}
-
-	// Print header
-	fmt.Fprintf(os.Stdout, "%-50s %-20s %-10s %s\n", "NAME", "VARIANT", "READY", "STATUS")
-	fmt.Fprintf(os.Stdout, "%-50s %-20s %-10s %s\n", strings.Repeat("-", 50), strings.Repeat("-", 20), strings.Repeat("-", 10), strings.Repeat("-", 50))
-
-	// Print rows
-	for _, pkg := range pkgList.Items {
-		variant := pkg.Spec.Variant
-		if variant == "" {
-			variant = "default"
-		}
-
-		// Get Ready condition
-		ready := "Unknown"
-		status := ""
-		for _, condition := range pkg.Status.Conditions {
-			if condition.Type == "Ready" {
-				ready = string(condition.Status)
-				status = condition.Message
-				if len(status) > 48 {
-					status = status[:45] + "..."
-				}
-				break
-			}
-		}
-
-		fmt.Fprintf(os.Stdout, "%-50s %-20s %-10s %s\n", pkg.Name, variant, ready, status)
-
-		// Show components if requested
-		if showComponents {
-			// Get PackageSource to show components
-			ps := &cozyv1alpha1.PackageSource{}
-			if err := k8sClient.Get(ctx, client.ObjectKey{Name: pkg.Name}, ps); err == nil {
-				// Find the variant
-				for _, v := range ps.Spec.Variants {
-					if v.Name == variant {
-						for _, component := range v.Components {
-							fmt.Fprintf(os.Stdout, "  %-48s %-20s %-10s %s\n", 
-								fmt.Sprintf("%s.%s", pkg.Name, component.Name), 
-								variant, "", "")
-						}
-						break
-					}
-				}
-			}
-		}
-	}
-
-	return nil
-}
-
-func init() {
-	rootCmd.AddCommand(listCmd)
-	listCmd.Flags().BoolVarP(&listCmdFlags.installed, "installed", "i", false, "list installed Package resources instead of PackageSource resources")
-	listCmd.Flags().BoolVar(&listCmdFlags.components, "components", false, "show components on separate lines")
-	listCmd.Flags().StringVar(&listCmdFlags.kubeconfig, "kubeconfig", "", "Path to kubeconfig file (defaults to ~/.kube/config or KUBECONFIG env var)")
-}
-

cmd/cozypkg/cmd/root.go

@@ -1,49 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package cmd
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/spf13/cobra"
-)
-
-// rootCmd represents the base command when called without any subcommands.
-var rootCmd = &cobra.Command{
-	Use:               "cozypkg",
-	Short:             "A CLI for managing Cozystack packages",
-	Long:              ``,
-	SilenceErrors:     true,
-	SilenceUsage:      true,
-	DisableAutoGenTag: true,
-}
-
-// Execute adds all child commands to the root command and sets flags appropriately.
-// This is called by main.main(). It only needs to happen once to the rootCmd.
-func Execute() error {
-	if err := rootCmd.Execute(); err != nil {
-		fmt.Fprintln(os.Stderr, err.Error())
-		return err
-	}
-	return nil
-}
-
-func init() {
-	// Commands are registered in their respective init() functions
-}
-

cmd/cozypkg/main.go

@@ -1,30 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"os"
-
-	"github.com/cozystack/cozystack/cmd/cozypkg/cmd"
-)
-
-func main() {
-	if err := cmd.Execute(); err != nil {
-		os.Exit(1)
-	}
-}
-

cmd/cozystack-operator/main.go

@@ -1,481 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"flag"
-	"fmt"
-	"net/url"
-	"os"
-	"strings"
-	"time"
-
-	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
-	// to ensure that exec-entrypoint and run can make use of them.
-	_ "k8s.io/client-go/plugin/pkg/client/auth"
-
-	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
-	helmv2 "github.com/fluxcd/helm-controller/api/v2"
-	sourcev1 "github.com/fluxcd/source-controller/api/v1"
-	sourcewatcherv1beta1 "github.com/fluxcd/source-watcher/api/v2/v1beta1"
-	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-	"k8s.io/apimachinery/pkg/runtime"
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/healthz"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-	"sigs.k8s.io/controller-runtime/pkg/log/zap"
-	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
-
-	"github.com/cozystack/cozystack/internal/fluxinstall"
-	"github.com/cozystack/cozystack/internal/operator"
-	// +kubebuilder:scaffold:imports
-)
-
-var (
-	scheme   = runtime.NewScheme()
-	setupLog = ctrl.Log.WithName("setup")
-)
-
-// stringSliceFlag is a custom flag type that allows multiple values
-type stringSliceFlag []string
-
-func (f *stringSliceFlag) String() string {
-	return strings.Join(*f, ",")
-}
-
-func (f *stringSliceFlag) Set(value string) error {
-	*f = append(*f, value)
-	return nil
-}
-
-func init() {
-	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
-	utilruntime.Must(apiextensionsv1.AddToScheme(scheme))
-	utilruntime.Must(cozyv1alpha1.AddToScheme(scheme))
-	utilruntime.Must(helmv2.AddToScheme(scheme))
-	utilruntime.Must(sourcev1.AddToScheme(scheme))
-	utilruntime.Must(sourcewatcherv1beta1.AddToScheme(scheme))
-	// +kubebuilder:scaffold:scheme
-}
-
-func main() {
-	var metricsAddr string
-	var enableLeaderElection bool
-	var probeAddr string
-	var secureMetrics bool
-	var enableHTTP2 bool
-	var installFlux bool
-	var cozystackVersion string
-	var installFluxResources stringSliceFlag
-	var platformSource string
-	var platformSourceName string
-
-	flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
-	flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
-	flag.BoolVar(&enableLeaderElection, "leader-elect", false,
-		"Enable leader election for controller manager. "+
-			"Enabling this will ensure there is only one active controller manager.")
-	flag.BoolVar(&secureMetrics, "metrics-secure", false,
-		"If set the metrics endpoint is served securely")
-	flag.BoolVar(&enableHTTP2, "enable-http2", false,
-		"If set, HTTP/2 will be enabled for the metrics and webhook servers")
-	flag.BoolVar(&installFlux, "install-flux", false, "Install Flux components before starting reconcile loop")
-	flag.Var(&installFluxResources, "install-flux-resource", "Install Flux resource (JSON format). Can be specified multiple times. Applied after Flux installation.")
-	flag.StringVar(&cozystackVersion, "cozystack-version", "unknown",
-		"Version of Cozystack")
-	flag.StringVar(&platformSource, "platform-source", "", "Platform source URL (oci:// or git://). If specified, generates OCIRepository or GitRepository resource.")
-	flag.StringVar(&platformSourceName, "platform-source-name", "cozystack-packages", "Name for the generated platform source resource (default: cozystack-packages)")
-
-	opts := zap.Options{
-		Development: true,
-	}
-	opts.BindFlags(flag.CommandLine)
-	flag.Parse()
-
-	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
-
-	config := ctrl.GetConfigOrDie()
-
-	// Start the controller manager
-	setupLog.Info("Starting controller manager")
-	mgr, err := ctrl.NewManager(config, ctrl.Options{
-		Scheme: scheme,
-		Metrics: metricsserver.Options{
-			BindAddress:   metricsAddr,
-			SecureServing: secureMetrics,
-		},
-		WebhookServer: webhook.NewServer(webhook.Options{
-			Port: 9443,
-		}),
-		HealthProbeBindAddress: probeAddr,
-		LeaderElection:         enableLeaderElection,
-		LeaderElectionID:       "cozystack-operator.cozystack.io",
-		// LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily
-		// when the Manager ends. This requires the binary to immediately end when the
-		// Manager is stopped, otherwise, setting this significantly speeds up voluntary
-		// leader transitions as the new leader don't have to wait LeaseDuration time first.
-		//
-		// In the default scaffold provided, the program ends immediately after
-		// the manager stops, so would be fine to enable this option. However,
-		// if you are doing or is intended to do any operation such as perform cleanups
-		// after the manager stops then its usage might be unsafe.
-		// LeaderElectionReleaseOnCancel: true,
-	})
-	if err != nil {
-		setupLog.Error(err, "unable to start manager")
-		os.Exit(1)
-	}
-
-	// Install Flux before starting reconcile loop
-	if installFlux {
-		setupLog.Info("Installing Flux components before starting reconcile loop")
-		installCtx, installCancel := context.WithTimeout(context.Background(), 5*time.Minute)
-		defer installCancel()
-
-		// The namespace will be automatically extracted from the embedded manifests
-		if err := fluxinstall.Install(installCtx, mgr.GetClient(), fluxinstall.WriteEmbeddedManifests); err != nil {
-			setupLog.Error(err, "failed to install Flux, continuing anyway")
-			// Don't exit - allow operator to start even if Flux install fails
-			// This allows the operator to work in environments where Flux is already installed
-		} else {
-			setupLog.Info("Flux installation completed successfully")
-		}
-	}
-
-	// Install Flux resources after Flux installation
-	if len(installFluxResources) > 0 {
-		setupLog.Info("Installing Flux resources", "count", len(installFluxResources))
-		installCtx, installCancel := context.WithTimeout(context.Background(), 2*time.Minute)
-		defer installCancel()
-
-		if err := installFluxResourcesFunc(installCtx, mgr.GetClient(), installFluxResources); err != nil {
-			setupLog.Error(err, "failed to install Flux resources, continuing anyway")
-			// Don't exit - allow operator to start even if resource installation fails
-		} else {
-			setupLog.Info("Flux resources installation completed successfully")
-		}
-	}
-
-	// Generate and install platform source resource if specified
-	if platformSource != "" {
-		setupLog.Info("Generating platform source resource", "source", platformSource, "name", platformSourceName)
-		installCtx, installCancel := context.WithTimeout(context.Background(), 2*time.Minute)
-		defer installCancel()
-
-		if err := installPlatformSourceResource(installCtx, mgr.GetClient(), platformSource, platformSourceName); err != nil {
-			setupLog.Error(err, "failed to install platform source resource")
-			os.Exit(1)
-		} else {
-			setupLog.Info("Platform source resource installation completed successfully")
-		}
-	}
-
-	// Setup PackageSource reconciler
-	if err := (&operator.PackageSourceReconciler{
-		Client: mgr.GetClient(),
-		Scheme: mgr.GetScheme(),
-	}).SetupWithManager(mgr); err != nil {
-		setupLog.Error(err, "unable to create controller", "controller", "PackageSource")
-		os.Exit(1)
-	}
-
-	// Setup Package reconciler
-	if err := (&operator.PackageReconciler{
-		Client: mgr.GetClient(),
-		Scheme: mgr.GetScheme(),
-	}).SetupWithManager(mgr); err != nil {
-		setupLog.Error(err, "unable to create controller", "controller", "Package")
-		os.Exit(1)
-	}
-
-	// +kubebuilder:scaffold:builder
-
-	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
-		setupLog.Error(err, "unable to set up health check")
-		os.Exit(1)
-	}
-	if err := mgr.AddReadyzCheck("readyz", healthz.Ping); err != nil {
-		setupLog.Error(err, "unable to set up ready check")
-		os.Exit(1)
-	}
-
-	setupLog.Info("Starting controller manager")
-	mgrCtx := ctrl.SetupSignalHandler()
-	if err := mgr.Start(mgrCtx); err != nil {
-		setupLog.Error(err, "problem running manager")
-		os.Exit(1)
-	}
-}
-
-// installFluxResourcesFunc installs Flux resources from JSON strings
-func installFluxResourcesFunc(ctx context.Context, k8sClient client.Client, resources []string) error {
-	logger := log.FromContext(ctx)
-
-	for i, resourceJSON := range resources {
-		logger.Info("Installing Flux resource", "index", i+1, "total", len(resources))
-
-		// Parse JSON into unstructured object
-		var obj unstructured.Unstructured
-		if err := json.Unmarshal([]byte(resourceJSON), &obj.Object); err != nil {
-			return fmt.Errorf("failed to parse resource JSON at index %d: %w", i, err)
-		}
-
-		// Validate that it has required fields
-		if obj.GetAPIVersion() == "" {
-			return fmt.Errorf("resource at index %d missing apiVersion", i)
-		}
-		if obj.GetKind() == "" {
-			return fmt.Errorf("resource at index %d missing kind", i)
-		}
-		if obj.GetName() == "" {
-			return fmt.Errorf("resource at index %d missing metadata.name", i)
-		}
-
-		// Apply the resource (create or update)
-		logger.Info("Applying Flux resource",
-			"apiVersion", obj.GetAPIVersion(),
-			"kind", obj.GetKind(),
-			"name", obj.GetName(),
-			"namespace", obj.GetNamespace(),
-		)
-
-		// Use server-side apply or create/update
-		existing := &unstructured.Unstructured{}
-		existing.SetGroupVersionKind(obj.GroupVersionKind())
-		key := client.ObjectKey{
-			Name:      obj.GetName(),
-			Namespace: obj.GetNamespace(),
-		}
-
-		err := k8sClient.Get(ctx, key, existing)
-		if err != nil {
-			if client.IgnoreNotFound(err) == nil {
-				// Resource doesn't exist, create it
-				if err := k8sClient.Create(ctx, &obj); err != nil {
-					return fmt.Errorf("failed to create resource %s/%s: %w", obj.GetKind(), obj.GetName(), err)
-				}
-				logger.Info("Created Flux resource", "kind", obj.GetKind(), "name", obj.GetName())
-			} else {
-				return fmt.Errorf("failed to check if resource exists: %w", err)
-			}
-		} else {
-			// Resource exists, update it
-			obj.SetResourceVersion(existing.GetResourceVersion())
-			if err := k8sClient.Update(ctx, &obj); err != nil {
-				return fmt.Errorf("failed to update resource %s/%s: %w", obj.GetKind(), obj.GetName(), err)
-			}
-			logger.Info("Updated Flux resource", "kind", obj.GetKind(), "name", obj.GetName())
-		}
-	}
-
-	return nil
-}
-
-// installPlatformSourceResource generates and installs a Flux source resource (OCIRepository or GitRepository)
-// based on the platform source URL
-func installPlatformSourceResource(ctx context.Context, k8sClient client.Client, sourceURL, resourceName string) error {
-	logger := log.FromContext(ctx)
-
-	// Parse the source URL to determine type
-	sourceType, repoURL, ref, err := parsePlatformSource(sourceURL)
-	if err != nil {
-		return fmt.Errorf("failed to parse platform source URL: %w", err)
-	}
-
-	var obj *unstructured.Unstructured
-	switch sourceType {
-	case "oci":
-		obj, err = generateOCIRepository(resourceName, repoURL, ref)
-		if err != nil {
-			return fmt.Errorf("failed to generate OCIRepository: %w", err)
-		}
-	case "git":
-		obj, err = generateGitRepository(resourceName, repoURL, ref)
-		if err != nil {
-			return fmt.Errorf("failed to generate GitRepository: %w", err)
-		}
-	default:
-		return fmt.Errorf("unsupported source type: %s (expected oci:// or git://)", sourceType)
-	}
-
-	// Apply the resource (create or update)
-	logger.Info("Applying platform source resource",
-		"apiVersion", obj.GetAPIVersion(),
-		"kind", obj.GetKind(),
-		"name", obj.GetName(),
-		"namespace", obj.GetNamespace(),
-	)
-
-	existing := &unstructured.Unstructured{}
-	existing.SetGroupVersionKind(obj.GroupVersionKind())
-	key := client.ObjectKey{
-		Name:      obj.GetName(),
-		Namespace: obj.GetNamespace(),
-	}
-
-	err = k8sClient.Get(ctx, key, existing)
-	if err != nil {
-		if client.IgnoreNotFound(err) == nil {
-			// Resource doesn't exist, create it
-			if err := k8sClient.Create(ctx, obj); err != nil {
-				return fmt.Errorf("failed to create resource %s/%s: %w", obj.GetKind(), obj.GetName(), err)
-			}
-			logger.Info("Created platform source resource", "kind", obj.GetKind(), "name", obj.GetName())
-		} else {
-			return fmt.Errorf("failed to check if resource exists: %w", err)
-		}
-	} else {
-		// Resource exists, update it
-		obj.SetResourceVersion(existing.GetResourceVersion())
-		if err := k8sClient.Update(ctx, obj); err != nil {
-			return fmt.Errorf("failed to update resource %s/%s: %w", obj.GetKind(), obj.GetName(), err)
-		}
-		logger.Info("Updated platform source resource", "kind", obj.GetKind(), "name", obj.GetName())
-	}
-
-	return nil
-}
-
-// parsePlatformSource parses the source URL and returns the type, repository URL, and reference
-// Supports formats:
-//   - oci://registry.example.com/repo@sha256:digest
-//   - oci://registry.example.com/repo (ref will be empty)
-//   - git://github.com/user/repo@branch
-//   - git://github.com/user/repo (ref will default to "main")
-//   - https://github.com/user/repo@branch (treated as git)
-func parsePlatformSource(sourceURL string) (sourceType, repoURL, ref string, err error) {
-	// Normalize the URL by trimming whitespace
-	sourceURL = strings.TrimSpace(sourceURL)
-
-	// Check for oci:// prefix
-	if strings.HasPrefix(sourceURL, "oci://") {
-		// Remove oci:// prefix
-		rest := strings.TrimPrefix(sourceURL, "oci://")
-
-		// Check for @sha256: digest (look for @ followed by sha256:)
-		// We need to find the last @ before sha256: to handle paths with @ symbols
-		sha256Idx := strings.Index(rest, "@sha256:")
-		if sha256Idx != -1 {
-			repoURL = "oci://" + rest[:sha256Idx]
-			ref = rest[sha256Idx+1:] // sha256:digest
-		} else {
-			// Check for @ without sha256: (might be a tag)
-			if atIdx := strings.LastIndex(rest, "@"); atIdx != -1 {
-				// Could be a tag, but for OCI we expect sha256: digest
-				// For now, treat everything after @ as the ref
-				repoURL = "oci://" + rest[:atIdx]
-				ref = rest[atIdx+1:]
-			} else {
-				repoURL = "oci://" + rest
-				ref = "" // No digest specified
-			}
-		}
-		return "oci", repoURL, ref, nil
-	}
-
-	// Check for git:// prefix or treat as git for http/https
-	if strings.HasPrefix(sourceURL, "git://") || strings.HasPrefix(sourceURL, "http://") || strings.HasPrefix(sourceURL, "https://") || strings.HasPrefix(sourceURL, "ssh://") {
-		// Parse URL to extract ref if present
-		parsedURL, err := url.Parse(sourceURL)
-		if err != nil {
-			return "", "", "", fmt.Errorf("invalid URL: %w", err)
-		}
-
-		// Check for @ref in the path (e.g., git://host/path@branch)
-		path := parsedURL.Path
-		if idx := strings.LastIndex(path, "@"); idx != -1 {
-			repoURL = fmt.Sprintf("%s://%s%s", parsedURL.Scheme, parsedURL.Host, path[:idx])
-			if parsedURL.RawQuery != "" {
-				repoURL += "?" + parsedURL.RawQuery
-			}
-			ref = path[idx+1:]
-		} else {
-			// Default to main branch if no ref specified
-			repoURL = sourceURL
-			ref = "main"
-		}
-
-		// Normalize git:// to https:// for GitRepository
-		if strings.HasPrefix(repoURL, "git://") {
-			repoURL = strings.Replace(repoURL, "git://", "https://", 1)
-		}
-
-		return "git", repoURL, ref, nil
-	}
-
-	return "", "", "", fmt.Errorf("unsupported source URL scheme (expected oci:// or git://): %s", sourceURL)
-}
-
-// generateOCIRepository creates an OCIRepository resource
-func generateOCIRepository(name, repoURL, digest string) (*unstructured.Unstructured, error) {
-	obj := &unstructured.Unstructured{}
-	obj.SetAPIVersion("source.toolkit.fluxcd.io/v1")
-	obj.SetKind("OCIRepository")
-	obj.SetName(name)
-	obj.SetNamespace("cozy-system")
-
-	spec := map[string]interface{}{
-		"interval": "5m0s",
-		"url":      repoURL,
-	}
-
-	if digest != "" {
-		// Ensure digest starts with sha256:
-		if !strings.HasPrefix(digest, "sha256:") {
-			digest = "sha256:" + digest
-		}
-		spec["ref"] = map[string]interface{}{
-			"digest": digest,
-		}
-	}
-
-	if err := unstructured.SetNestedField(obj.Object, spec, "spec"); err != nil {
-		return nil, fmt.Errorf("failed to set spec: %w", err)
-	}
-
-	return obj, nil
-}
-
-// generateGitRepository creates a GitRepository resource
-func generateGitRepository(name, repoURL, ref string) (*unstructured.Unstructured, error) {
-	obj := &unstructured.Unstructured{}
-	obj.SetAPIVersion("source.toolkit.fluxcd.io/v1")
-	obj.SetKind("GitRepository")
-	obj.SetName(name)
-	obj.SetNamespace("cozy-system")
-
-	spec := map[string]interface{}{
-		"interval": "5m0s",
-		"url":      repoURL,
-		"ref": map[string]interface{}{
-			"branch": ref,
-		},
-	}
-
-	if err := unstructured.SetNestedField(obj.Object, spec, "spec"); err != nil {
-		return nil, fmt.Errorf("failed to set spec: %w", err)
-	}
-
-	return obj, nil
-}

docs/agents/changelog.md

@@ -1,666 +0,0 @@
-# Changelog Generation Instructions
-
-This file contains detailed instructions for AI-powered IDE on how to generate changelogs for Cozystack releases.
-
-## When to use these instructions
-
-Follow these instructions when the user explicitly asks to generate a changelog.
-
-## Required Tools
-
-Before generating changelogs, ensure you have access to `gh` (GitHub CLI) tool, which is used to fetch commit and PR author information. The GitHub CLI is used to correctly identify PR authors from commits and pull requests.
-
-## Changelog Generation Process
-
-When the user asks to generate a changelog, follow these steps in the specified order:
-
-**CHECKLIST - All actions that must be completed:**
-- [ ] Step 1: Update information from remote (git fetch)
-- [ ] Step 2: Check current branch (must be main)
-- [ ] Step 3: Determine release type and previous version (minor vs patch release)
-- [ ] Step 4: Determine versions and analyze existing changelogs
-- [ ] Step 5: Get the list of commits for the release period
-- [ ] Step 6: Check additional repositories (website is REQUIRED, optional repos if tags exist)
-  - [ ] **MANDATORY**: Check website repository for documentation changes WITH authors and PR links via GitHub CLI
-  - [ ] **MANDATORY**: Check ALL optional repositories (talm, boot-to-talos, cozypkg, cozy-proxy) for tags during release period
-  - [ ] **MANDATORY**: For ALL commits from additional repos, get GitHub username via CLI, prioritizing PR author over commit author.
-- [ ] Step 7: Analyze commits (extract PR numbers, authors, user impact)
-  - [ ] **MANDATORY**: For EVERY PR in main repo, get PR author via `gh pr view <PR_NUMBER> --json author --jq .author.login` (do NOT skip this step)
-  - [ ] **MANDATORY**: Extract PR numbers from commit messages, then use `gh pr view` for each PR to get the PR author. Do NOT use commit author. Only for commits without PR numbers (rare), fall back to `gh api repos/cozystack/cozystack/commits/<hash> --jq '.author.login'`
-- [ ] Step 8: Form new changelog (structure, format, generate contributors list)
-- [ ] Step 9: Verify completeness and save
-
-### 1. Updating information from remote
-
-```bash
-git fetch --tags --force --prune
-```
-
-This is necessary to get up-to-date information about tags and commits from the remote repository.
-
-### 2. Checking current branch
-
-Make sure we are on the `main` branch:
-
-```bash
-git branch --show-current
-```
-
-### 3. Determining release type and previous version
-
-**Important**: Determine if you're generating a changelog for a **minor release** (vX.Y.0) or a **patch release** (vX.Y.Z where Z > 0).
-
-**For minor releases (vX.Y.0):**
-- Each minor version lives and evolves in its own branch (`release-X.Y`)
-- You MUST compare with the **previous minor version** (v(X-1).Y.0), not the last patch release
-- This ensures you capture all changes from the entire minor version cycle, including all patch releases
-- Example: For v0.38.0, compare with v0.37.0 (not v0.37.8)
-- Run a separate cycle to check the diff with the zero version of the previous minor release
-
-**For patch releases (vX.Y.Z where Z > 0):**
-- Compare with the previous patch version (vX.Y.(Z-1))
-- Example: For v0.37.2, compare with v0.37.1
-
-### 4. Determining versions and analyzing existing changelogs
-
-**Determine the last published version:**
-1. Get the list of version tags:
-   ```bash
-   git tag -l 'v[0-9]*.[0-9]*.[0-9]*' | sort -V
-   ```
-
-2. Get the last tag:
-   ```bash
-   git tag -l 'v[0-9]*.[0-9]*.[0-9]*' | sort -V | tail -1
-   ```
-
-3. Compare tags with existing changelog files in `docs/changelogs/` to determine the last published version (the newest file `vX.Y.Z.md`)
-
-**Study existing changelog format:**
-- Review recent changelog files to understand the format and structure
-- Pay attention to:
-  - **Feature Highlights format** (for minor releases): Use `## Feature Highlights` with `### Feature Name` subsections containing detailed descriptions (2-4 paragraphs each). See v0.35.0 and v0.36.0 for examples.
-  - Section structure (Major Features and Improvements, Security, Fixes, Dependencies, etc.)
-  - PR link format (e.g., `[**@username**](https://github.com/username) in #1234`)
-  - Change description style
-  - Presence of Breaking changes sections, etc.
-
-### 5. Getting the list of commits
-
-**Important**: Determine if you're generating a changelog for a **minor release** (vX.Y.0) or a **patch release** (vX.Y.Z where Z > 0).
-
-**For patch releases (vX.Y.Z where Z > 0):**
-Get the list of commits starting from the previous patch version to HEAD:
-
-**⚠️ CRITICAL: Do NOT use --first-parent flag! It will skip merge commits including backports!**
-
-```bash
-# Get all commits including merge commits (backports)
-git log <previous_version>..HEAD --pretty=format:"%h - %s (%an, %ar)"
-```
-
-For example, if generating changelog for `v0.37.2`:
-```bash
-git log v0.37.1..HEAD --pretty=format:"%h - %s (%an, %ar)"
-```
-
-**⚠️ IMPORTANT: Check for backports:**
-- Look for commits with "[Backport release-X.Y]" in the commit message
-- For backport PRs, find the original PR number mentioned in the backport commit message or PR description
-- Use the original PR author (not the backport PR author) when creating changelog entries
-- Include both the original PR number and backport PR number in the changelog entry (e.g., `#1606, #1609`)
-
-**For minor releases (vX.Y.0):**
-Minor releases must include **all changes** from patch releases of the previous minor version. Get commits from the previous minor release:
-
-**⚠️ CRITICAL: Do NOT use --first-parent flag! It will skip merge commits including backports!**
-
-```bash
-# For v0.38.0, get all commits since v0.37.0 (including all patch releases v0.37.1, v0.37.2, etc.)
-git log v<previous_minor_version>..HEAD --pretty=format:"%h - %s (%an, %ar)"
-```
-
-For example, if generating changelog for `v0.38.0`:
-```bash
-git log v0.37.0..HEAD --pretty=format:"%h - %s (%an, %ar)"
-```
-
-This will include all commits from v0.37.1, v0.37.2, v0.37.3, etc., up to v0.38.0.
-
-**⚠️ IMPORTANT: Always check merge commits:**
-- Merge commits may contain backports that need to be included
-- Check all commits in the range, including merge commits
-- For backports, always find and reference the original PR
-
-### 6. Analyzing additional repositories
-
-**⚠️ CRITICAL: This step is MANDATORY and must NOT be skipped!**
-
-Cozystack release may include changes from related repositories. Check and include commits from these repositories if tags were released during the release period:
-
-**Required repositories:**
-- **Documentation**: [https://github.com/cozystack/website](https://github.com/cozystack/website)
-  - **MANDATORY**: Always check this repository for documentation changes during the release period
-  - **MANDATORY**: Get GitHub username for EVERY commit. Extract PR number from commit message, then use `gh pr view <PR_NUMBER> --repo cozystack/website --json author --jq .author.login` to get PR author. Only if no PR number, fall back to `gh api repos/cozystack/website/commits/<hash> --jq '.author.login'`
-
-**Optional repositories (MUST check ALL of them for tags during release period):**
-- [https://github.com/cozystack/talm](https://github.com/cozystack/talm)
-- [https://github.com/cozystack/boot-to-talos](https://github.com/cozystack/boot-to-talos)
-- [https://github.com/cozystack/cozypkg](https://github.com/cozystack/cozypkg)
-- [https://github.com/cozystack/cozy-proxy](https://github.com/cozystack/cozy-proxy)
-
-**⚠️ IMPORTANT**: You MUST check ALL optional repositories for tags created during the release period. Do NOT skip this step even if you think there might not be any tags. Use the process below to verify.
-
-**Process for each repository:**
-
-1. **Get release period dates:**
-   ```bash
-   # Get dates for the release period
-   cd /path/to/cozystack
-   RELEASE_START=$(git log -1 --format=%ai v<previous_version>)
-   RELEASE_END=$(git log -1 --format=%ai HEAD)
-   ```
-
-2. **Check for commits in website repository (always required):**
-   ```bash
-   # Ensure website repository is cloned and up-to-date
-   mkdir -p _repos
-   if [ ! -d "_repos/website" ]; then
-     cd _repos && git clone https://github.com/cozystack/website.git && cd ..
-   fi
-   cd _repos/website
-   git fetch --all --tags --force
-   git checkout main 2>/dev/null || git checkout master
-   git pull
-   
-   # Get commits between release dates (with some buffer)
-   git log --since="$RELEASE_START" --until="$RELEASE_END" --format="%H|%s|%an" | while IFS='|' read -r commit_hash subject author_name; do
-     # Extract PR number from commit message
-     PR_NUMBER=$(git log -1 --format="%B" "$commit_hash" | grep -oE '#[0-9]+' | head -1 | tr -d '#')
-     
-     # ALWAYS use PR author if PR number found, not commit author
-     if [ -n "$PR_NUMBER" ]; then
-       GITHUB_USERNAME=$(gh pr view "$PR_NUMBER" --repo cozystack/website --json author --jq '.author.login // empty' 2>/dev/null)
-       echo "$commit_hash|$subject|$author_name|$GITHUB_USERNAME|cozystack/website#$PR_NUMBER"
-     else
-       # Only fallback to commit author if no PR number found (rare)
-       GITHUB_USERNAME=$(gh api repos/cozystack/website/commits/$commit_hash --jq '.author.login // empty')
-       echo "$commit_hash|$subject|$author_name|$GITHUB_USERNAME|cozystack/website@${commit_hash:0:7}"
-     fi
-   done
-   
-   # Look for documentation updates, new pages, or significant content changes
-   # Include these in the "Documentation" section of the changelog WITH authors and PR links
-   ```
-
-3. **For optional repositories, check if tags exist during release period:**
-
-   **⚠️ MANDATORY: You MUST check ALL optional repositories (talm, boot-to-talos, cozypkg, cozy-proxy). Do NOT skip any repository!**
-
-   **Use the helper script:**
-   ```bash
-   # Get release period dates
-   RELEASE_START=$(git log -1 --format=%ai v<previous_version>)
-   RELEASE_END=$(git log -1 --format=%ai HEAD)
-   
-   # Run the script to check all optional repositories
-   ./docs/changelogs/hack/check-optional-repos.sh "$RELEASE_START" "$RELEASE_END"
-   ```
-   
-   The script will:
-   - Check ALL optional repositories (talm, boot-to-talos, cozypkg, cozy-proxy)
-   - Look for tags created during the release period
-   - Get commits between tags (if tags exist) or by date range (if no tags)
-   - Extract PR numbers from commit messages
-   - For EVERY commit with PR number, get PR author via CLI: `gh pr view <PR_NUMBER> --repo cozystack/<repo> --json author --jq .author.login` (ALWAYS use PR author, not commit author)
-   - For commits without PR numbers (rare), fallback to: `gh api repos/cozystack/<repo>/commits/<hash> --jq '.author.login'`
-   - Output results in format: `commit_hash|subject|author_name|github_username|cozystack/repo#PR_NUMBER` or `cozystack/repo@commit_hash`
-
-4. **Extract PR numbers and authors using GitHub CLI:**
-   - **ALWAYS use PR author, not commit author** for commits from additional repositories
-   - For each commit, extract PR number from commit message first: Extract `#123` pattern from commit message
-   - If PR number found, use `gh pr view <PR_NUMBER> --repo cozystack/<repo> --json author --jq .author.login` to get PR author (the person who wrote the code)
-   - Only if no PR number found (rare), fallback to commit author: `gh api repos/cozystack/<repo>/commits/<hash> --jq '.author.login'`
-   - **Prefer PR numbers**: Use format `cozystack/website#123` if PR number found in commit message
-   - **Fallback to commit hash**: Use format `cozystack/website@abc1234` if no PR number
-   - **ALWAYS include author**: Every entry from additional repositories MUST include author in format `([**@username**](https://github.com/username) in cozystack/repo#123)`
-   - Determine user impact and categorize appropriately
-   - Format entries with repository prefix: `[website]`, `[talm]`, etc.
-
-**Example entry format for additional repositories:**
-```markdown
-# If PR number found in commit message (REQUIRED format):
-* **[website] Update installation documentation**: Improved installation guide with new examples ([**@username**](https://github.com/username) in cozystack/website#123).
-
-# If no PR number (fallback, use commit hash):
-* **[website] Update installation documentation**: Improved installation guide with new examples ([**@username**](https://github.com/username) in cozystack/website@abc1234).
-
-# For optional repositories:
-* **[talm] Add new feature**: Description of the change ([**@username**](https://github.com/username) in cozystack/talm#456).
-```
-
-**CRITICAL**: 
-- **ALWAYS include author** for every entry from additional repositories
-- **ALWAYS include PR link or commit hash** for every entry
-- Never add entries without author and PR/commit reference
-- **ALWAYS use PR author, not commit author**: Extract PR number from commit message, then use `gh pr view <PR_NUMBER> --repo cozystack/<repo> --json author --jq .author.login` to get the PR author (the person who wrote the code)
-- Only if no PR number found (rare), fallback to commit author: `gh api repos/cozystack/<repo>/commits/<hash> --jq '.author.login'`
-- The commit author (especially for squash/merge commits) is usually the person who merged the PR, not the person who wrote the code
-
-### 7. Analyzing commits and PRs
-
-**⚠️ CRITICAL: You MUST get the author from PR, not from commit! Always use `gh pr view` to get the PR author. Do NOT use commit author!**
-
-**Get all PR numbers from commits:**
-**⚠️ CRITICAL: Do NOT use --no-merges flag! It will skip merge commits including backports!**
-
-```bash
-# Extract all PR numbers from commit messages in the release range (including merge commits)
-git log <previous_version>..<new_version> --format="%s%n%b" | grep -oE '#[0-9]+' | sort -u | tr -d '#'
-```
-
-**⚠️ IMPORTANT: Handle backports correctly:**
-- Backport PRs have format: `[Backport release-X.Y] <original title> (#BACKPORT_PR_NUMBER)`
-- The backport commit message or PR description usually mentions the original PR number
-- For backport entries in changelog, use the original PR author (not the backport PR author)
-- Include both original and backport PR numbers in the changelog entry (e.g., `#1606, #1609`)
-- To find original PR from backport: Check the backport PR description or commit message for "Backport of #ORIGINAL_PR"
-
-**For each PR number, get the author:**
-   
-   **CRITICAL**: The commit author (especially for squash/merge commits) is usually the person who merged the PR (or GitHub bot), NOT the person who wrote the code. **ALWAYS use the PR author**, not the commit author.
-   
-   **⚠️ MANDATORY: ALWAYS use `gh pr view` to get the PR author. Do NOT use commit author!**
-   
-   **ALWAYS use GitHub CLI** to get the PR author:
-   
-   ```bash
-   # Usage: Get PR author - MANDATORY for EVERY PR
-   # Loop through ALL PR numbers and get PR author (including backports)
-   git log <previous_version>..<new_version> --format="%s%n%b" | grep -oE '#[0-9]+' | sort -u | tr -d '#' | while read PR_NUMBER; do
-     # Check if this is a backport PR
-     BACKPORT_INFO=$(gh pr view "$PR_NUMBER" --json body --jq '.body' 2>/dev/null | grep -i "backport of #" || echo "")
-     if [ -n "$BACKPORT_INFO" ]; then
-       # Extract original PR number from backport description
-       ORIGINAL_PR=$(echo "$BACKPORT_INFO" | grep -oE 'backport of #([0-9]+)' | grep -oE '[0-9]+' | head -1)
-       if [ -n "$ORIGINAL_PR" ]; then
-         # Use original PR author
-         GITHUB_USERNAME=$(gh pr view "$ORIGINAL_PR" --json author --jq '.author.login // empty')
-         PR_TITLE=$(gh pr view "$ORIGINAL_PR" --json title --jq '.title // empty')
-         echo "$PR_NUMBER|$ORIGINAL_PR|$GITHUB_USERNAME|$PR_TITLE|BACKPORT"
-       else
-         # Fallback to backport PR author if original not found
-         GITHUB_USERNAME=$(gh pr view "$PR_NUMBER" --json author --jq '.author.login // empty')
-         PR_TITLE=$(gh pr view "$PR_NUMBER" --json title --jq '.title // empty')
-         echo "$PR_NUMBER||$GITHUB_USERNAME|$PR_TITLE|BACKPORT"
-       fi
-     else
-       # Regular PR
-       GITHUB_USERNAME=$(gh pr view "$PR_NUMBER" --json author --jq '.author.login // empty')
-       PR_TITLE=$(gh pr view "$PR_NUMBER" --json title --jq '.title // empty')
-       echo "$PR_NUMBER||$GITHUB_USERNAME|$PR_TITLE|REGULAR"
-     fi
-   done
-   ```
-   
-   **⚠️ IMPORTANT**: You must run this for EVERY PR in the release period. Do NOT skip any PRs or assume the GitHub username based on the git author name.
-   
-   **CRITICAL**: Always use `gh pr view <PR_NUMBER> --json author --jq .author.login` to get the PR author. This correctly identifies the person who wrote the code, not the person who merged it (which is especially important for squash merges).
-   
-   **Why this matters**: Using the wrong author in changelogs gives incorrect credit and can confuse contributors. The merge/squash commit is created by the person who clicks "Merge" in GitHub, not the PR author.
-   
-**For commits without PR numbers (rare):**
-- Only if a commit has no PR number, fall back to commit author: `gh api repos/cozystack/cozystack/commits/<hash> --jq '.author.login'`
-- But this should be very rare - most commits should have PR numbers
-
-**Extract PR number from commit messages:**
-- Check commit message subject (`%s`) and body (`%b`) for PR references: `#1234` or `(#1234)`
-- **Primary method**: Extract from commit message format `(#PR_NUMBER)` or `in #PR_NUMBER` or `Merge pull request #1234`
-- Use regex: `grep -oE '#[0-9]+'` to find all PR numbers
-
-**⚠️ CRITICAL: Verify PR numbers match commit messages!**
-- Always verify that the PR number in the changelog matches the PR number in the commit message
-- Common mistake: Using wrong PR number (e.g., #1614 instead of #1617) when multiple similar commits exist
-- To verify: Check the actual commit message: `git log <commit_hash> -1 --format="%s%n%b" | grep -oE '#[0-9]+'`
-- If multiple PR numbers appear in a commit, use the one that matches the PR title/description
-- For merge commits, check the merged branch commits, not just the merge commit message
-
-3. **Understand the change:**
-   ```bash
-   # Get PR details (preferred method)
-   gh pr view <PR_NUMBER> --json title,body,url
-   
-   # Or get commit details if no PR number
-   git show <commit_hash> --stat
-   git show <commit_hash>
-   ```
-   - Review PR description and changed files
-   - Understand functionality added/changed/fixed
-   - **Determine user impact**: What can users do now? What problems are fixed? What improvements do users experience?
-
-4. **For release branches (backports):**
-   - If commit is from `release-X.Y` branch, check if it's a backport
-   - Find original commit in `main` to get correct PR number:
-     ```bash
-     git log origin/main --grep="<part of commit message>" --oneline
-     ```
-
-### 8. Forming a new changelog
-
-Create a new changelog file in the format matching previous versions:
-
-1. **Determine the release type:**
-   - **Minor release (vX.Y.0)** - use full format with **Feature Highlights** section. **Must include all changes from patch releases of the previous minor version** (e.g., v0.38.0 should include changes from v0.37.1, v0.37.2, v0.37.3, etc.)
-   - **Patch release (vX.Y.Z, where Z > 0)** - use more compact format, includes only changes since the previous patch release
-
-   **Feature Highlights format for minor releases:**
-   - Use section header: `## Feature Highlights`
-   - Include 3-6 major features as subsections with `### Feature Name` headers
-   - Each feature subsection should contain:
-     - **Detailed description** (2-4 paragraphs) explaining:
-       - What the feature is and what problem it solves
-       - How it works and what users can do with it
-       - How to use it (if applicable)
-       - Benefits and impact for users
-     - **Links to documentation** when available (use markdown links)
-     - **Code examples or configuration snippets** if helpful
-   - Focus on user value and practical implications, not just technical details
-   - Each feature should be substantial enough to warrant its own subsection
-   - Order features by importance/impact (most important first)
-   - Example format:
-     ```markdown
-     ## Feature Highlights
-     
-     ### Feature Name
-     
-     Detailed description paragraph explaining what the feature is...
-     
-     Another paragraph explaining how it works and what users can do...
-     
-     Learn more in the [documentation](https://cozystack.io/docs/...).
-     ```
-
-   **Important for minor releases**: After collecting all commits, **systematically verify** that all PRs from patch releases are included:
-   ```bash
-   # Extract all PR numbers from patch release changelogs
-   grep -h "#[0-9]\+" docs/changelogs/v<previous_minor>.*.md | sort -u
-   
-   # Extract all PR numbers from the new minor release changelog
-   grep -h "#[0-9]\+" docs/changelogs/v<new_minor>.0.md | sort -u
-   
-   # Compare and identify missing PRs
-   # Ensure every PR from patch releases appears in the minor release changelog
-   ```
-
-2. **Structure changes by categories:**
-   
-   **For minor releases (vX.Y.0):**
-   - **Feature Highlights** (required) - see format above
-   - **Major Features and Improvements** - detailed list of all major features and improvements
-   - **Improvements (minor)** - smaller improvements and enhancements
-   - **Bug fixes** - all bug fixes
-   - **Security** - security-related changes
-   - **Dependencies & version updates** - dependency updates
-   - **System Configuration** - system-level configuration changes
-   - **Development, Testing, and CI/CD** - development and testing improvements
-   - **Documentation** (include changes from website repository here - **MUST include authors and PR links for all entries**)
-   - **Breaking changes & upgrade notes** (if any)
-   - **Refactors & chores** (if any)
-   
-   **For patch releases (vX.Y.Z where Z > 0):**
-   - **Features and Improvements** - new features and improvements
-   - **Fixes** - bug fixes
-   - **Security** - security-related changes
-   - **Dependencies** - dependency updates
-   - **System Configuration** - system-level configuration changes
-   - **Development, Testing, and CI/CD** - development and testing improvements
-   - **Documentation** (include changes from website repository here - **MUST include authors and PR links for all entries**)
-   - **Migration and Upgrades** (if applicable)
-   
-   **Note**: When including changes from additional repositories, group them logically with main repository changes, or create separate subsections if there are many changes from a specific repository.
-
-3. **Entry format:**
-   - Use the format: `* **Brief description**: detailed description ([**@username**](https://github.com/username) in #PR_NUMBER)`
-   - **CRITICAL - Get authorship correctly**: 
-     - **ALWAYS use PR author, not commit author**: Extract PR number from commit message, then use `gh pr view` to get the PR author. The commit author (especially for squash/merge commits) is usually the person who merged the PR (or GitHub bot), NOT the person who wrote the code.
-       ```bash
-       # Get PR author from GitHub CLI (correct method)
-       # Step 1: Extract PR number from commit message
-       PR_NUMBER=$(git log <commit_hash> -1 --format="%s%n%b" | grep -oE '#[0-9]+' | head -1 | tr -d '#')
-       
-       # Step 2: Get PR author (the person who wrote the code)
-       if [ -n "$PR_NUMBER" ]; then
-         GITHUB_USERNAME=$(gh pr view "$PR_NUMBER" --json author --jq '.author.login')
-       else
-         # Only fallback to commit author if no PR number found (rare)
-         GITHUB_USERNAME=$(gh api repos/cozystack/cozystack/commits/<commit_hash> --jq '.author.login')
-       fi
-       ```
-       **Example**: For PR #1507, the squash commit has author "kvaps" (who merged), but the PR author is "lllamnyp" (who wrote the code). Using `gh pr view 1507 --json author --jq .author.login` correctly returns "lllamnyp".
-     - **For regular commits**: Use the commit author directly:
-       ```bash
-       git log <commit_hash> -1 --format="%an|%ae"
-       ```
-     - **Validation**: Before adding to changelog, verify the author by checking:
-       - For merge commits: Compare merge commit author vs PR author (they should be different)
-       - Check existing changelogs for author name to GitHub username mappings
-       - Verify with: `git log <merge_commit>^1..<merge_commit>^2 --format="%an" --no-merges`
-   - **Map author name to GitHub username**: Check existing changelogs for author name mappings, or extract from PR links in commit messages
-   - **Always include user impact**: Each entry must explain how the change affects users
-     - For new features: explain what users can now do
-     - For bug fixes: explain what problem is solved for users
-     - For improvements: explain what users will experience better
-     - For breaking changes: clearly state what users need to do
-   - Group related changes
-   - Use bold font for important components/modules
-   - Focus on user value, not just technical details
-
-4. **Add a link to the full changelog:**
-   
-   **For patch releases (vX.Y.Z where Z > 0):**
-   ```markdown
-   **Full Changelog**: https://github.com/cozystack/cozystack/compare/v<previous_patch_version>...v<new_version>
-   ```
-   Example: For v0.37.2, use `v0.37.1...v0.37.2`
-   
-   **For minor releases (vX.Y.0):**
-   ```markdown
-   **Full Changelog**: https://github.com/cozystack/cozystack/compare/v<previous_minor_version>...v<new_version>
-   ```
-   Example: For v0.38.0, use `v0.37.0...v0.38.0` (NOT `v0.37.8...v0.38.0`)
-   
-   **Important**: Minor releases must reference the previous minor release (vX.Y.0), not the last patch release, to include all changes from the entire minor version cycle.
-
-5. **Generate contributors list:**
-
-   **⚠️ SIMPLIFIED APPROACH: Extract contributors from the generated changelog itself!**
-   
-   Since you've already generated the changelog with all PR authors correctly identified, simply extract GitHub usernames from the changelog entries:
-   
-   ```bash
-   # Extract all GitHub usernames from the current release changelog
-   # This method is simpler and more reliable than extracting from git history
-   
-   # For patch releases: extract from the current changelog file
-   grep -oE '\[@[a-zA-Z0-9_-]+\]' docs/changelogs/v<version>.md | \
-     sed 's/\[@/@/' | sed 's/\]//' | \
-     sort -u
-   
-   # For minor releases: extract from the current changelog file
-   grep -oE '\[@[a-zA-Z0-9_-]+\]' docs/changelogs/v<version>.md | \
-     sed 's/\[@/@/' | sed 's/\]//' | \
-     sort -u
-   ```
-   
-   **Get all previous contributors (to identify new ones):**
-   ```bash
-   # Extract GitHub usernames from all previous changelogs
-   grep -hE '\[@[a-zA-Z0-9_-]+\]' docs/changelogs/v*.md | \
-     grep -oE '@[a-zA-Z0-9_-]+' | \
-     sort -u > /tmp/previous_contributors.txt
-   ```
-   
-   **Identify new contributors (first-time contributors):**
-   ```bash
-   # Get current release contributors from the changelog
-   grep -oE '@[a-zA-Z0-9_-]+' docs/changelogs/v<version>.md | \
-     sort -u > /tmp/current_contributors.txt
-   
-   # Get all previous contributors
-   grep -hE '@[a-zA-Z0-9_-]+' docs/changelogs/v*.md | \
-     grep -oE '@[a-zA-Z0-9_-]+' | \
-     sort -u > /tmp/all_previous_contributors.txt
-   
-   # Find new contributors (those in current but not in previous)
-   comm -23 <(sort /tmp/current_contributors.txt) <(sort /tmp/all_previous_contributors.txt)
-   ```
-   
-   **Why this approach is better:**
-   - ✅ Uses the already-verified PR authors from the changelog (no need to query GitHub API again)
-   - ✅ Automatically handles backports correctly (original PR authors are already in the changelog)
-   - ✅ Simpler and faster (no git log parsing or API calls)
-   - ✅ More reliable (matches exactly what's in the changelog)
-   - ✅ Works for both patch and minor releases
-   
-   **Add contributors section to changelog:**
-   
-   Place the contributors section at the end of the changelog, before the "Full Changelog" link:
-   ```markdown
-   ## Contributors
-   
-   We'd like to thank all contributors who made this release possible:
-   
-   * [**@username1**](https://github.com/username1)
-   * [**@username2**](https://github.com/username2)
-   * [**@username3**](https://github.com/username3)
-   * ...
-   
-   ### New Contributors
-   
-   We're excited to welcome our first-time contributors:
-   
-   * [**@newuser1**](https://github.com/newuser1) - First contribution!
-   * [**@newuser2**](https://github.com/newuser2) - First contribution!
-   ```
-   
-   **Formatting guidelines:**
-   - List contributors in alphabetical order by GitHub username
-   - Use the format: `* [**@username**](https://github.com/username)`
-   - For new contributors, add " - First contribution!" note
-   - If GitHub username cannot be determined, you can skip that contributor or use their git author name
-   
-   **When to include:**
-   - **For patch releases**: Contributors section is optional, but can be included for significant releases
-   - **For minor releases (vX.Y.0)**: Contributors section is required - you must generate and include the contributors list
-   - Always verify GitHub usernames by checking commit messages, PR links in changelog entries, or by examining PR details
-
-6. **Add a comment with a link to the GitHub release:**
-   ```markdown
-   <!--
-   https://github.com/cozystack/cozystack/releases/tag/v<new_version>
-   -->
-   ```
-
-### 9. Verification and saving
-
-**Before saving, verify completeness:**
-
-**For ALL releases:**
-- [ ] Step 5 completed: **ALL commits included** (including merge commits and backports) - do not skip any commits
-- [ ] Step 5 completed: **Backports identified and handled correctly** - original PR author used, both original and backport PR numbers included
-- [ ] Step 6 completed: Website repository checked for documentation changes WITH authors and PR links via GitHub CLI
-- [ ] Step 6 completed: **ALL** optional repositories (talm, boot-to-talos, cozypkg, cozy-proxy) checked for tags during release period
-- [ ] Step 6 completed: For ALL commits from additional repos, GitHub username obtained via GitHub CLI (not skipped). For commits with PR numbers, PR author used via `gh pr view` (not commit author)
-- [ ] Step 7 completed: For EVERY PR in main repo (including backports), PR author obtained via `gh pr view <PR_NUMBER> --json author --jq .author.login` (not skipped or assumed). Commit author NOT used - always use PR author
-- [ ] Step 7 completed: **Backports verified** - for each backport PR, original PR found and original PR author used in changelog
-- [ ] Step 8 completed: Contributors list generated
-- [ ] All commits from main repository included (including merge commits)
-- [ ] User impact described for each change
-- [ ] Format matches existing changelogs
-
-**For patch releases:**
-- [ ] All commits from the release period are included (including merge commits with backports)
-- [ ] PR numbers match commit messages
-- [ ] Backports are properly identified and linked to original PRs
-
-**For minor releases (vX.Y.0):**
-- [ ] All changes from patch releases (vX.Y.1, vX.Y.2, etc.) are included
-- [ ] Contributors section is present and complete
-- [ ] Full Changelog link references previous minor version (vX.Y.0), not last patch
-- [ ] Verify all PRs from patch releases are included:
-  ```bash
-  # Extract and compare PR numbers
-  PATCH_PRS=$(grep -hE "#[0-9]+" docs/changelogs/v<previous_minor>.*.md | grep -oE "#[0-9]+" | sort -u)
-  MINOR_PRS=$(grep -hE "#[0-9]+" docs/changelogs/v<new_minor>.0.md | grep -oE "#[0-9]+" | sort -u)
-  MISSING=$(comm -23 <(echo "$PATCH_PRS") <(echo "$MINOR_PRS"))
-  
-  if [ -n "$MISSING" ]; then
-    echo "Missing PRs from patch releases:"
-    echo "$MISSING"
-    # For each missing PR, check if it's a backport and verify change is included by description
-  fi
-  ```
-
-**Only proceed to save after all checkboxes are verified!**
-
-**Save the changelog:**
-Save the changelog to file `docs/changelogs/v<version>.md` according to the version for which the changelog is being generated.
-
-### Important notes
-
-- **After fetch with --force** local tags are up-to-date, use them for work
-- **For release branches** always check original commits in `main` to get correct PR numbers
-- **Preserve the format** of existing changelog files
-- **Group related changes** logically
-- **Be accurate** in describing changes, based on actual commit diffs
-- **Check for PR numbers** and commit authors
-- **CRITICAL - Get authorship from PR, not from commit**: 
-  - **ALWAYS use PR author**: Extract PR number from commit message, then use `gh pr view <PR_NUMBER> --json author --jq .author.login` to get the PR author
-  - Do NOT use commit author - the commit author (especially for squash/merge commits) is usually the person who merged the PR, not the person who wrote the code
-  - For commits without PR numbers (rare), fall back to commit author: `gh api repos/cozystack/cozystack/commits/<commit_hash> --jq '.author.login'`
-  - **Workflow**: Extract PR numbers from commits → Use `gh pr view` for each PR → Get PR author (the person who wrote the code)
-  - Example: For PR #1507, the commit author is `@kvaps` (who merged), but `gh pr view 1507 --json author --jq .author.login` correctly returns `@lllamnyp` (who wrote the code)
-  - Check existing changelogs for author name to GitHub username mappings
-  - **Validation**: Before adding to changelog, always verify the author using `gh pr view` - never use commit author for PRs
--  **MANDATORY**: Always describe user impact: Every changelog entry must explain how the change affects end users, not just what was changed technically. Focus on user value and practical implications.
-
-**Required steps:**
-
-- **Additional repositories (Step 6) - MANDATORY**: 
-  - **⚠️ CRITICAL**: Always check the **website** repository for documentation changes during the release period. This is a required step and MUST NOT be skipped.
-  - **⚠️ CRITICAL**: You MUST check ALL optional repositories (talm, boot-to-talos, cozypkg, cozy-proxy) for tags during the release period. Do NOT skip any repository even if you think there might not be tags.
-  - **CRITICAL**: For ALL entries from additional repositories (website and optional), you MUST:
-    - **MANDATORY**: Extract PR number from commit message first
-    - **MANDATORY**: For commits with PR numbers, ALWAYS use `gh pr view <PR_NUMBER> --repo cozystack/<repo> --json author --jq .author.login` to get PR author (not commit author)
-    - **MANDATORY**: Only for commits without PR numbers (rare), fallback to: `gh api repos/cozystack/<repo>/commits/<hash> --jq '.author.login'`
-    - **MANDATORY**: Do NOT skip getting GitHub username via CLI - do this for EVERY commit
-    - **MANDATORY**: Do NOT use commit author for PRs - always use PR author
-    - Include PR link or commit hash reference
-    - Format: `* **[repo] Description**: details ([**@username**](https://github.com/username) in cozystack/repo#123)`
-  - For **optional repositories** (talm, boot-to-talos, cozypkg, cozy-proxy), you MUST check ALL of them for tags during the release period. Use the loop provided in Step 6 to check each repository systematically.
-  - When including changes from additional repositories, use the format: `[repo-name] Description` and link to the repository's PR/issue if available
-  - **Prefer PR numbers over commit hashes**: For commits from additional repositories, extract PR number from commit message using GitHub API. Use PR format (`cozystack/website#123`) instead of commit hash (`cozystack/website@abc1234`) when available
-  - **Never add entries without author and PR/commit reference**: Every entry from additional repositories must have both author and link
-  - Group changes from additional repositories with main repository changes, or create separate subsections if there are many changes from a specific repository
-
-- **PR author verification (Step 7) - MANDATORY**:
-  - **⚠️ CRITICAL**: You MUST get the author from PR using `gh pr view`, NOT from commit
-  - **⚠️ CRITICAL**: Extract PR numbers from commit messages, then use `gh pr view <PR_NUMBER> --json author --jq .author.login` for each PR
-  - **⚠️ CRITICAL**: Do NOT use commit author - commit author is usually the person who merged, not the person who wrote the code
-  - **⚠️ CRITICAL**: Do NOT skip this step for any PR, even if the author seems obvious
-  - For commits without PR numbers (rare), fall back to: `gh api repos/cozystack/cozystack/commits/<hash> --jq '.author.login'`
-  - This ensures correct attribution and prevents errors in changelog entries (especially important for squash/merge commits)
-
-- **Contributors list (Step 8)**: 
-  - For minor releases (vX.Y.0): You must generate a list of all contributors and identify first-time contributors.
-  - For patch releases: Contributors section is optional, but recommended for significant releases
-  - Extract GitHub usernames from PR links in commit messages or changelog entries
-  - This helps recognize community contributions and welcome new contributors
-- **Minor releases (vX.Y.0)**:
-  - Must include **all changes** from patch releases of the previous minor version (e.g., v0.38.0 includes all changes from v0.37.1, v0.37.2, v0.37.3, etc.)
-  - The "Full Changelog" link must reference the previous minor release (v0.37.0...v0.38.0), NOT the last patch release (v0.37.8...v0.38.0)
-  - This ensures users can see the complete set of changes for the entire minor version cycle
-  - **Verification step**: After creating the changelog, extract all PR numbers from patch release changelogs and verify they all appear in the minor release changelog to prevent missing entries
-  - **Backport handling**: Patch releases may contain backports with different PR numbers (e.g., #1624 in patch release vs #1622 in main). For minor releases, use original PR numbers from main when available, but verify that all changes from patch releases are included regardless of PR number differences
-  - **Content verification**: Don't rely solely on PR number matching - verify that change descriptions from patch releases appear in the minor release changelog, as backports may have different PR numbers
-

docs/agents/contributing.md

@@ -1,190 +0,0 @@
-# Instructions for AI Agents
-
-Guidelines for AI agents contributing to Cozystack.
-
-## Checklist for Creating a Pull Request
-
-- [ ] Changes are made and tested
-- [ ] Commit message uses correct `[component]` prefix
-- [ ] Commit is signed off with `--signoff`
-- [ ] Branch is rebased on `upstream/main` (no extra commits)
-- [ ] PR body includes description and release note
-- [ ] PR is pushed and created with `gh pr create`
-
-## How to Commit and Create Pull Requests
-
-### 1. Make Your Changes
-
-Edit the necessary files in the codebase.
-
-### 2. Commit with Proper Format
-
-Use the `[component]` prefix and `--signoff` flag:
-
-```bash
-git commit --signoff -m "[component] Brief description of changes"
-```
-
-**Component prefixes:**
-- System: `[dashboard]`, `[platform]`, `[cilium]`, `[kube-ovn]`, `[linstor]`, `[fluxcd]`, `[cluster-api]`
-- Apps: `[postgres]`, `[mysql]`, `[redis]`, `[kafka]`, `[clickhouse]`, `[virtual-machine]`, `[kubernetes]`
-- Other: `[tests]`, `[ci]`, `[docs]`, `[maintenance]`
-
-**Examples:**
-```bash
-git commit --signoff -m "[dashboard] Add config hash annotations to restart pods on config changes"
-git commit --signoff -m "[postgres] Update operator to version 1.2.3"
-git commit --signoff -m "[docs] Add installation guide"
-```
-
-### 3. Rebase on upstream/main (if needed)
-
-If your branch has extra commits, clean it up:
-
-```bash
-# Fetch latest
-git fetch upstream
-
-# Create clean branch from upstream/main
-git checkout -b my-feature upstream/main
-
-# Cherry-pick only your commit
-git cherry-pick <your-commit-hash>
-
-# Force push to your branch
-git push -f origin my-feature:my-branch-name
-```
-
-### 4. Push Your Branch
-
-```bash
-git push origin <branch-name>
-```
-
-### 5. Create Pull Request
-
-Write the PR body to a temporary file:
-
-```bash
-cat > /tmp/pr_body.md << 'EOF'
-## What this PR does
-
-Brief description of the changes.
-
-Changes:
-- Change 1
-- Change 2
-
-### Release note
-
-```release-note
-[component] Description for changelog
-```
-EOF
-```
-
-Create the PR:
-
-```bash
-gh pr create --title "[component] Brief description" --body-file /tmp/pr_body.md
-```
-
-Clean up:
-
-```bash
-rm /tmp/pr_body.md
-```
-
-## Addressing AI Bot Reviewer Comments
-
-When the user asks to fix comments from AI bot reviewers (like Qodo, Copilot, etc.):
-
-### 1. Get PR Comments
-
-View all comments on the pull request:
-
-```bash
-gh pr view <PR-number> --comments
-```
-
-Or for the current branch:
-
-```bash
-gh pr view --comments
-```
-
-### 2. Review Each Comment Carefully
-
-**Important**: Do NOT blindly apply all suggestions. Each comment should be evaluated:
-
-- **Consider context** - Does the suggestion make sense for this specific case?
-- **Check project conventions** - Does it align with Cozystack patterns?
-- **Evaluate impact** - Will this improve code quality or introduce issues?
-- **Question validity** - AI bots can be wrong or miss context
-
-**When to apply:**
-- ✅ Legitimate bugs or security issues
-- ✅ Clear improvements to code quality
-- ✅ Better error handling or edge cases
-- ✅ Conformance to project conventions
-
-**When to skip:**
-- ❌ Stylistic preferences that don't match project style
-- ❌ Over-engineering simple code
-- ❌ Changes that break existing patterns
-- ❌ Suggestions that show misunderstanding of the code
-
-### 3. Apply Valid Fixes
-
-Make changes addressing the valid comments. Use your judgment.
-
-### 4. Leave Changes Uncommitted
-
-**Critical**: Do NOT commit or push the changes automatically.
-
-Leave the changes in the working directory so the user can:
-- Review the fixes
-- Decide whether to commit them
-- Make additional adjustments if needed
-
-```bash
-# After making changes, show status but DON'T commit
-git status
-git diff
-```
-
-The user will commit and push when ready.
-
-### Example Workflow
-
-```bash
-# Get PR comments
-gh pr view 1234 --comments
-
-# Review comments and identify valid ones
-# Make necessary changes to address valid comments
-# ... edit files ...
-
-# Show what was changed (but don't commit)
-git status
-git diff
-
-# Tell the user what was fixed and what was skipped
-```
-
-## Git Permissions
-
-Request these permissions when needed:
-- `git_write` - For commit, rebase, cherry-pick, branch operations
-- `network` - For push, fetch, pull operations
-
-## Common Issues
-
-**PR has extra commits?**  
-→ Rebase on `upstream/main` and cherry-pick only your commits
-
-**Wrong commit message?**  
-→ `git commit --amend --signoff -m "[correct] message"` then `git push -f`
-
-**Need to update PR?**  
-→ `gh pr edit <number> --body "new description"`

docs/agents/overview.md

@@ -1,115 +0,0 @@
-# Cozystack Project Overview
-
-This document provides detailed information about Cozystack project structure and conventions for AI agents.
-
-## About Cozystack
-
-Cozystack is an open-source Kubernetes-based platform and framework for building cloud infrastructure. It provides:
-
-- **Managed Services**: Databases, VMs, Kubernetes clusters, object storage, and more
-- **Multi-tenancy**: Full isolation and self-service for tenants
-- **GitOps-driven**: FluxCD-based continuous delivery
-- **Modular Architecture**: Extensible with custom packages and services
-- **Developer Experience**: Simplified local development with cozypkg tool
-
-The platform exposes infrastructure services via the Kubernetes API with ready-made configs, built-in monitoring, and alerts.
-
-## Code Layout
-
-```
-.
-├── packages/               # Main directory for cozystack packages
-│   ├── core/              # Core platform logic charts (installer, platform)
-│   ├── system/            # System charts (CSI, CNI, operators, etc.)
-│   ├── apps/              # User-facing charts shown in dashboard catalog
-│   └── extra/             # Tenant-specific modules, singleton charts which are used as dependencies
-├── dashboards/            # Grafana dashboards for monitoring
-├── hack/                  # Helper scripts for local development
-│   └── e2e-apps/         # End-to-end application tests
-├── scripts/               # Scripts used by cozystack container
-│   └── migrations/       # Version migration scripts
-├── docs/                  # Documentation
-│   ├── agents/           # AI agent instructions
-│   └── changelogs/       # Release changelogs
-├── cmd/                   # Go command entry points
-│   ├── cozystack-api/
-│   ├── cozystack-controller/
-│   └── cozystack-assets-server/
-├── internal/              # Internal Go packages
-│   ├── controller/       # Controller implementations
-│   └── lineagecontrollerwebhook/
-├── pkg/                   # Public Go packages
-│   ├── apis/
-│   ├── apiserver/
-│   └── registry/
-└── api/                   # Kubernetes API definitions (CRDs)
-    └── v1alpha1/
-```
-
-## Package Structure
-
-Every package is a Helm chart following the umbrella chart pattern:
-
-```
-packages/<category>/<package-name>/
-├── Chart.yaml                           # Chart definition and parameter docs
-├── Makefile                             # Development workflow targets
-├── charts/                              # Vendored upstream charts
-├── images/                              # Dockerfiles and image build context
-├── patches/                             # Optional upstream chart patches
-├── templates/                           # Additional manifests
-├── templates/dashboard-resourcemap.yaml # Dashboard resource mapping
-├── values.yaml                          # Override values for upstream
-└── values.schema.json                   # JSON schema for validation and UI
-```
-
-## Conventions
-
-### Helm Charts
-- Follow **umbrella chart** pattern for system components
-- Include upstream charts in `charts/` directory (vendored, not referenced)
-- Override configuration in root `values.yaml`
-- Use `values.schema.json` for input validation and dashboard UI rendering
-
-### Go Code
-- Follow standard **Go conventions** and idioms
-- Use **controller-runtime** patterns for Kubernetes controllers
-- Prefer **kubebuilder** for API definitions and controllers
-- Add proper error handling and structured logging
-
-### Git Commits
-- Use format: `[component] Description`
-- Always use `--signoff` flag
-- Reference PR numbers when available
-- Keep commits atomic and focused
-- Follow conventional commit format for changelogs
-
-### Documentation
-
-Documentation is organized as follows:
-- `docs/` - General documentation
-- `docs/agents/` - Instructions for AI agents
-- `docs/changelogs/` - Release changelogs
-- Main website: https://github.com/cozystack/website
-
-## Things Agents Should Not Do
-
-### Never Edit These
-- Do not modify files in `/vendor/` (Go dependencies)
-- Do not edit generated files: `zz_generated.*.go`
-- Do not change `go.mod`/`go.sum` manually (use `go get`)
-- Do not edit upstream charts in `packages/*/charts/` directly (use patches)
-- Do not modify image digests in `values.yaml` (generated by build)
-
-### Version Control
-- Do not commit built artifacts from `_out`
-- Do not commit test artifacts or temporary files
-
-### Git Operations
-- Do not force push to main/master
-- Do not update git config
-- Do not perform destructive operations without explicit request
-
-### Core Components
-- Do not modify `packages/core/platform/` without understanding migration impact
-

docs/agents/releasing.md

@@ -1,29 +0,0 @@
-# Release Process
-
-This document provides instructions for AI agents on how to handle release-related tasks.
-
-## When to Use
-
-Follow these instructions when the user asks to:
-- Create a new release
-- Prepare a release
-- Tag a release
-- Perform release-related tasks
-
-## Instructions
-
-For detailed release process instructions, follow the steps documented in:
-
-**[docs/release.md](../release.md)**
-
-## Quick Reference
-
-The release process typically involves:
-1. Preparing the release branch
-2. Generating changelog
-3. Updating version numbers
-4. Creating git tags
-5. Building and publishing artifacts
-
-All detailed steps are documented in `docs/release.md`.
-

docs/changelogs/unreleased.md

@@ -0,0 +1,3 @@
+# Changes after v0.37.0
+
+* [lineage] Break webhook out into a separate daemonset. Reduce unnecessary webhook calls by marking handled resources and excluding them from consideration by the webhook's object selector (@lllamnyp in #1515). 

docs/changelogs/v0.37.1.md

@@ -1,31 +0,0 @@
-
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.37.1
--->
-
-## Features and Improvements
-
-* **[api] Efficient listing of TenantNamespaces**: Optimized TenantNamespace listing by replacing per-namespace SubjectAccessReview calls with group-based rolebinding checks, significantly reducing API latency and improving performance ([**@lllamnyp**](https://github.com/lllamnyp) in #1507).
-
-## Fixes
-
-* **[api] Fix RBAC for listing of TenantNamespaces and handle system:masters**: Fixed regression in TenantNamespace listing RBAC and added proper handling for system:masters group to ensure correct authorization ([**@kvaps**](https://github.com/kvaps) in #1511).
-* **[dashboard] Fix logout**: Fixed dashboard logout functionality to properly clear session and redirect users ([**@kvaps**](https://github.com/kvaps) in #1510).
-* **[installer] Add additional check to wait for lineage-webhook**: Added additional readiness check to ensure lineage-webhook is fully ready before proceeding with installation, improving upgrade reliability ([**@kvaps**](https://github.com/kvaps) in #1506).
-
-## Development, Testing, and CI/CD
-
-* **[tests] Make Kubernetes tests POSIX-compatible**: Replaced bash-specific constructs with POSIX-compliant code, ensuring tests work reliably with /bin/sh and improving compatibility across different shell environments ([**@IvanHunters**](https://github.com/IvanHunters) in #1509).
-
-## Documentation
-
-* **[website] Update troubleshooting documentation**: Updated Kubernetes installation troubleshooting guide with additional information and fixes ([**@lb0o**](https://github.com/lb0o) in cozystack/website@82beddd).
-* **[website] Add LLDPD disabling documentation**: Added minimal patch documentation for disabling lldpd based on official LLDPD usage guide ([**@lb0o**](https://github.com/lb0o) in cozystack/website@7ec5d7b).
-* **[website] Fix typo in utility command**: Fixed typo in utility command documentation ([**@lb0o**](https://github.com/lb0o) in cozystack/website@6c76cb5).
-* **[website] Update backup and recovery docs**: Updated backup and recovery documentation with latest information ([**@kvaps**](https://github.com/kvaps) in cozystack/website@2781aa5).
-* **[website] Add Troubleshooting checklist**: Added troubleshooting checklist to help users diagnose and resolve common issues ([**@kvaps**](https://github.com/kvaps) in cozystack/website@59fc304).
-
----
-
-**Full Changelog**: [v0.37.0...v0.37.1](https://github.com/cozystack/cozystack/compare/v0.37.0...v0.37.1)
-

docs/changelogs/v0.37.2.md

@@ -1,21 +0,0 @@
-
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.37.2
--->
-
-## Features and Improvements
-
-* **[lineage] Separate webhook from cozy controller**: Separated the lineage-controller-webhook from cozystack-controller into a separate daemonset component deployed on all control-plane nodes, reducing API server latency and improving performance by decreasing outgoing API calls. Introduced internal label to track resources already handled by the webhook ([**@lllamnyp**](https://github.com/lllamnyp) in #1515).
-
-## Fixes
-
-* **[api] Fix listing tenantnamespaces for non-oidc users**: Fixed TenantNamespace listing functionality for users not using OIDC authentication, ensuring proper namespace visibility for all authentication methods ([**@kvaps**](https://github.com/kvaps) in #1517, #1519).
-
-## Migration and Upgrades
-
-* **[platform] Better migration for 0.36.2->0.37.2+**: Improved migration script for users upgrading directly from 0.36.2 to 0.37.2+, ensuring the new lineage webhook daemonset is properly deployed and fixing a bug where webhook readiness was not appropriately verified during migration ([**@lllamnyp**](https://github.com/lllamnyp) in #1521, #1522).
-
----
-
-**Full Changelog**: [v0.37.1...v0.37.2](https://github.com/cozystack/cozystack/compare/v0.37.1...v0.37.2)
-

docs/changelogs/v0.37.3.md

@@ -1,45 +0,0 @@
-
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.37.3
--->
-
-## Features and Improvements
-
-* **[apps] Make VM service user facing**: Virtual machine services are now marked as user-facing, improving service discovery and visibility in the dashboard ([**@lllamnyp**](https://github.com/lllamnyp) in #1523).
-* **[seaweedfs] Allow users to discover their buckets**: Users can now discover and list their S3 buckets in SeaweedFS, improving usability and bucket management ([**@kvaps**](https://github.com/kvaps) in #1528).
-* **[seaweedfs] Update SeaweedFS v3.99 and deploy S3 as stacked service**: Updated SeaweedFS to version 3.99 and deployed S3 gateway as a stacked service for better integration and performance ([**@kvaps**](https://github.com/kvaps) in #1562).
-* **[dashboard] Show service LB IP**: Fixed JSON path issue to correctly display Service LoadBalancer IPs in the dashboard table view, improving visibility of service endpoints ([**@lllamnyp**](https://github.com/lllamnyp) in #1524).
-* **[dashboard] Update openapi-ui v1.0.3 + fixes**: Updated OpenAPI UI to version 1.0.3 with various fixes and improvements ([**@kvaps**](https://github.com/kvaps) in #1564).
-* **[kubernetes] Use controlPlane.replicas field**: Fixed managed Kubernetes app to properly use the `controlPlane.replicas` field instead of hardcoding the value, allowing users to configure control plane replica count ([**@lllamnyp**](https://github.com/lllamnyp) in #1556).
-* **[monitoring] add settings alert for slack**: Added Slack integration configuration for Alerta alerts, enabling notifications to Slack channels ([**@scooby87**](https://github.com/scooby87) in #1545).
-
-## Fixes
-
-* **[lineage] Check for nil chart in HelmRelease**: Added nil check to prevent crashes when lineage webhook encounters HelmReleases using `chartRef` instead of `chart`, improving stability ([**@lllamnyp**](https://github.com/lllamnyp) in #1525).
-* **[kamaji] Respect 3rd party labels**: Applied patch to Kamaji controller to respect third-party labels, preventing reconciliation loops between lineage webhook and Kamaji controller ([**@lllamnyp**](https://github.com/lllamnyp) in #1531, #1534).
-* **[redis-operator] Build patched operator in-tree**: Moved Redis operator build into Cozystack organization and patched it to prevent overwriting third-party labels on owned resources ([**@lllamnyp**](https://github.com/lllamnyp) in #1547).
-* **[mariadb-operator] Add post-delete job to remove PVCs**: Added post-delete job to automatically remove PersistentVolumeClaims when MariaDB instances are deleted, preventing orphaned storage resources ([**@IvanHunters**](https://github.com/IvanHunters) in #1553).
-* **[velero] Set defaultItemOperationTimeout=24h**: Set default item operation timeout to 24 hours for Velero backups, preventing timeouts on large backup operations ([**@kvaps**](https://github.com/kvaps) in #1542).
-
-## Dependencies
-
-* **Update LINSTOR v1.32.3**: Updated LINSTOR to version 1.32.3 with latest features and bug fixes ([**@kvaps**](https://github.com/kvaps) in #1565).
-
-## System Configuration
-
-* **[system] kube-ovn: turn off enableLb**: Disabled load balancer functionality in Kube-OVN configuration ([**@nbykov0**](https://github.com/nbykov0) in #1548).
-
-## Documentation
-
-* **[website] Update LINSTOR documentation**: Updated LINSTOR guide and set failmode=continue for ZFS configurations ([**@kvaps**](https://github.com/kvaps) in cozystack/website@033804e).
-* **[website] Update managed apps reference**: Updated managed applications reference documentation ([**@kvaps**](https://github.com/kvaps) in cozystack/website@b886a74).
-* **[website] Update external apps documentation**: Updated documentation for external applications ([**@kvaps**](https://github.com/kvaps) in cozystack/website@565dad9).
-* **[website] Add naming conventions**: Added naming conventions documentation ([**@kvaps**](https://github.com/kvaps) in cozystack/website@b227abb).
-* **[website] Update golden image documentation**: Updated documentation for creating golden images for virtual machines ([**@kvaps**](https://github.com/kvaps) in cozystack/website@34c2f3a, cozystack/website@ef65593).
-* **[website] Fix documentation formatting**: Fixed alerts, infoboxes, tabs styles and main page formatting ([**@kvaps**](https://github.com/kvaps) in cozystack/website@e992e97, cozystack/website@b2c4dee).
-* **[website] Fix typo in blog article**: Fixed typo in blog article ([**@kvaps**](https://github.com/kvaps) in cozystack/website@0a4bbf3).
-
----
-
-**Full Changelog**: [v0.37.2...v0.37.3](https://github.com/cozystack/cozystack/compare/v0.37.2...v0.37.3)
-

docs/changelogs/v0.37.4.md

@@ -1,29 +0,0 @@
-
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.37.4
--->
-
-## Features and Improvements
-
-* **[tenant] Allow listing workloads**: Enabled listing of workloads for tenants, improving visibility and management of tenant resources ([**@kvaps**](https://github.com/kvaps) in #1576, #1577).
-
-## Fixes
-
-* **[seaweedfs] Fix migration to v3.99**: Fixed migration issues when upgrading SeaweedFS to version 3.99, ensuring smooth upgrades ([**@kvaps**](https://github.com/kvaps) in #1572, #1575).
-* **[nats] Merge container spec, not podTemplate**: Fixed NATS configuration to properly merge container specifications instead of podTemplate, ensuring correct container configuration ([**@lllamnyp**](https://github.com/lllamnyp) in #1571, #1574).
-
-## Development, Testing, and CI/CD
-
-* **[e2e] Increase Kubernetes connection timeouts**: Increased connection and request timeouts in E2E tests when communicating with Kubernetes API, improving test stability under high load and slow cluster response conditions ([**@IvanHunters**](https://github.com/IvanHunters) in #1570, #1573).
-
-## Documentation
-
-* **[website] Optimize website for mobile devices**: Improved website layout and responsiveness for mobile devices ([**@kvaps**](https://github.com/kvaps) in cozystack/website@3ab2338).
-* **[website] Add OpenAPI UI**: Added OpenAPI UI documentation and integration ([**@kvaps**](https://github.com/kvaps) in cozystack/website@b1c1668).
-* **[website] Update Cozystack video in hero banner**: Updated hero banner with new Cozystack video ([**@kvaps**](https://github.com/kvaps) in cozystack/website@e351137).
-* **[website] Add screenshots carousel**: Added screenshots carousel to showcase Cozystack features ([**@kvaps**](https://github.com/kvaps) in cozystack/website@8422bd0).
-
----
-
-**Full Changelog**: [v0.37.3...v0.37.4](https://github.com/cozystack/cozystack/compare/v0.37.3...v0.37.4)
-

docs/changelogs/v0.37.5.md

@@ -1,28 +0,0 @@
-
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.37.5
--->
-
-## Features and Improvements
-
-* **[dashboard-controller] Move badges generation logic to internal dashboard component**: Moved badges generation logic to internal dashboard component for better code organization and maintainability ([**@kvaps**](https://github.com/kvaps) in #1567).
-
-## Security
-
-* **[redis] Bump Redis image version for security fixes**: Updated Redis image version to include latest security fixes, improving cluster security ([**@IvanHunters**](https://github.com/IvanHunters) in #1580).
-* **[flux] Close Flux Operator ports to external access**: Removed hostPort and hostNetwork from Flux Operator Deployment, ensuring ports 8080 and 8081 are only accessible within the cluster, preventing external exposure and improving security ([**@IvanHunters**](https://github.com/IvanHunters) in #1581).
-* **[ingress] Enforce HTTPS-only for API**: Added force-ssl-redirect annotation to default API Ingress, ensuring all HTTP traffic is redirected to HTTPS, preventing unencrypted external access and improving security ([**@IvanHunters**](https://github.com/IvanHunters) in #1582, #1585).
-
-## Fixes
-
-* **[nats] Fixes for NATS App Helm chart, fix template issues with config.merge**: Fixed template issues in NATS Helm chart related to config.merge value, ensuring correct configuration ([**@insignia96**](https://github.com/insignia96) in #1583, #1591).
-* **[kubevirt] Fix: kubevirt metrics rule**: Fixed KubeVirt metrics rule configuration ([**@kvaps**](https://github.com/kvaps) in #1584, #1588).
-
-## System Configuration
-
-* **[core] rm talos lldp extension**: Removed Talos LLDP extension from core configuration ([**@nbykov0**](https://github.com/nbykov0) in #1586).
-
----
-
-**Full Changelog**: [v0.37.4...v0.37.5](https://github.com/cozystack/cozystack/compare/v0.37.4...v0.37.5)
-

docs/changelogs/v0.37.6.md

@@ -1,30 +0,0 @@
-
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.37.6
--->
-
-## Features and Improvements
-
-* **[api] Use shared informer cache**: Optimized API server by using shared informer cache, reducing API server load and improving performance ([**@lllamnyp**](https://github.com/lllamnyp) in #1539).
-* **[dashboard] sync with upstream & enhancements**: Synchronized dashboard with upstream and added various enhancements ([**@kvaps**](https://github.com/kvaps) in #1603).
-* **[cozystack-api][dashboard] Fix filtering for application services/ingresses/secrets**: Fixed filtering functionality for application services, ingresses, and secrets in both API and dashboard ([**@kvaps**](https://github.com/kvaps) in #1612).
-
-## Fixes
-
-* **[controller] Remove crdmem, handle DaemonSet**: Removed crdmem and improved DaemonSet handling in controller ([**@lllamnyp**](https://github.com/lllamnyp) in #1555).
-* **[dashboard] Revert reconciler removal**: Reverted reconciler removal to restore proper dashboard functionality ([**@lllamnyp**](https://github.com/lllamnyp) in #1559).
-* **[dashboard-controller] Fix static resources reconciliation and showing secrets**: Fixed static resources reconciliation and improved secret display in dashboard controller ([**@kvaps**](https://github.com/kvaps) in #1605).
-* **[api,lineage] Ensure node-local traffic**: Ensured node-local traffic handling for API and lineage components ([**@lllamnyp**](https://github.com/lllamnyp) in #1606).
-* **[virtual-machine] Revert per-vm network policies**: Reverted per-VM network policies to previous behavior ([**@lllamnyp**](https://github.com/lllamnyp) in #1611).
-* **[cozy-lib] Fix: handling resources=nil**: Fixed handling of nil resources in cozy-lib templates ([**@kvaps**](https://github.com/kvaps) in #1607).
-* **[nats] Use dig function to check for existing secret and prevent nil indexing**: Fixed NATS app chart to use dig function for checking existing secrets and prevent nil indexing errors ([**@kvaps**](https://github.com/kvaps) in #1609, #1610).
-
-## Development, Testing, and CI/CD
-
-* **[cozystack-controller] improve API tests**: Improved API tests for cozystack-controller ([**@lllamnyp**](https://github.com/lllamnyp) in #1599).
-* **[kubernetes] Helm hooks for cleanup**: Added Helm hooks for cleanup operations in Kubernetes app ([**@lllamnyp**](https://github.com/lllamnyp) in #1616).
-
----
-
-**Full Changelog**: [v0.37.5...v0.37.6](https://github.com/cozystack/cozystack/compare/v0.37.5...v0.37.6)
-

docs/changelogs/v0.37.7.md

@@ -1,18 +0,0 @@
-
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.37.7
--->
-
-## Fixes
-
-* **[kubernetes] Cleanup loadbalancer services**: Added cleanup functionality for load balancer services in Kubernetes app ([**@lllamnyp**](https://github.com/lllamnyp) in #1622).
-* **[rbac] Fix permissions for high-privilege users**: Fixed RBAC permissions for high-privilege users, ensuring proper access control ([**@lllamnyp**](https://github.com/lllamnyp) in #1624).
-
-## System Configuration
-
-* **[system] kubeovn: increase limits**: Increased resource limits for Kube-OVN components to improve stability and performance ([**@nbykov0**](https://github.com/nbykov0) in #1629).
-
----
-
-**Full Changelog**: [v0.37.6...v0.37.7](https://github.com/cozystack/cozystack/compare/v0.37.6...v0.37.7)
-

docs/changelogs/v0.37.8.md

@@ -1,19 +0,0 @@
-
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.37.8
--->
-
-## Fixes
-
-* **[cozy-lib] Fix malformed ResourceQuota rendering for LoadBalancer services**: Fixed malformed ResourceQuota rendering for LoadBalancer services in cozy-lib templates ([**@IvanHunters**](https://github.com/IvanHunters) in #1642).
-* **[extra] ingress: rm spaces from external ip list**: Removed spaces from external IP list in ingress configuration, fixing formatting issues ([**@nbykov0**](https://github.com/nbykov0) in #1652).
-* **scripts: fix 20 migration**: Fixed migration script #20 to ensure proper execution during upgrades ([**@nbykov0**](https://github.com/nbykov0) in #1653).
-
-## System Configuration
-
-* **Increase strimzi memory limit**: Increased memory limit for Strimzi Kafka operator to improve stability and performance ([**@nbykov0**](https://github.com/nbykov0) in #1651).
-
----
-
-**Full Changelog**: [v0.37.7...v0.37.8](https://github.com/cozystack/cozystack/compare/v0.37.7...v0.37.8)
-

docs/changelogs/v0.37.9.md

@@ -1,19 +0,0 @@
-
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.37.9
--->
-
-## Improvements
-
-* **[seaweedfs] Extended CA certificate duration to reduce disruptive CA rotations**: Extended CA certificate duration to reduce disruptive CA rotations. ([**@IvanHunters**](https://github.com/IvanHunters) in #1657, #1666).
-* **[dashboard] Add config hash annotations to restart pods on config changes**: Added config hash annotations to restart pods when configuration changes, ensuring pods are automatically restarted when their configuration is updated ([**@kvaps**](https://github.com/kvaps) in #1662, #1665).
-
-## Fixes
-
-* **[tenant][kubernetes] Introduce better cleanup logic**: Improved cleanup logic for tenant Kubernetes resources, ensuring proper resource cleanup when tenants are deleted or updated ([**@kvaps**](https://github.com/kvaps) in #1661).
-* **[dashboard] Fix loading arrays in forms when editing existing objects**: Fixed issue where arrays in forms were not loading correctly when editing existing objects in the dashboard ([**@kvaps**](https://github.com/kvaps)).
-
----
-
-**Full Changelog**: [v0.37.8...v0.37.9](https://github.com/cozystack/cozystack/compare/v0.37.8...v0.37.9)
-

docs/changelogs/v0.38.0.md

@@ -1,235 +0,0 @@
-# Cozystack v0.38 — "VPC & Enhanced Networking"
-
-This release introduces **Virtual Private Cloud (VPC)** support, enabling advanced networking capabilities for tenant applications. We've also added VNC console support in the dashboard, made Kubernetes worker versions configurable, and delivered numerous improvements and fixes across the platform.
-
-### Virtual Private Cloud (VPC) Networking
-
-Cozystack v0.38.0 introduces Virtual Private Cloud (VPC) support, enabling platform administrators to create isolated network segments for tenant applications. VPCs provide network isolation and allow fine-grained control over network topology, subnets, and routing. Each VPC can contain multiple subnets, and administrators can configure subnet details including IP ranges, gateway settings, and DNS configuration.
-
-The VPC feature integrates seamlessly with the Cozystack dashboard, allowing users to view and manage VPCs and their subnets through an intuitive interface. Subnet details are exposed in the dashboard as tables, making it easy to understand network configuration at a glance. VPC configuration is stored in ConfigMaps with predictable naming, ensuring reliable access to subnet information.
-
-This feature is particularly valuable for multi-tenant environments where network isolation is critical, and for applications that require specific network configurations or routing rules.
-
-### VNC Console for Virtual Machines
-
-The Cozystack dashboard now includes a built-in VNC console for virtual machines, enabling users to access VM console directly from the web interface without requiring external tools. This feature provides immediate access to virtual machine consoles for troubleshooting, configuration, and maintenance tasks. The VNC console integration streamlines VM management workflows and improves the user experience by keeping all VM operations within the Cozystack dashboard.
-
-## Highlights
-
-* **Virtual Private Cloud (VPC)**: New VPC system module enables advanced networking with Multus CNI, subnet management, and network isolation for tenant applications ([**@nbykov0**](https://github.com/nbykov0) in #1543; [**@lllamnyp**](https://github.com/lllamnyp) in #1587, #1590, #1600, #1621, #1638).
-* **VNC Console in Dashboard**: Users can now access virtual machine consoles directly from the dashboard, improving VM management experience ([**@kvaps**](https://github.com/kvaps) in #1627).
-* **Configurable Kubernetes Worker Versions**: Platform administrators can now configure Kubernetes worker node versions independently, providing more flexibility in cluster management ([**@lllamnyp**](https://github.com/lllamnyp) in #1619).
-* **Security Enhancements**: Multiple security improvements including HTTPS-only enforcement for API, closed Flux Operator ports, and Redis security updates ([**@IvanHunters**](https://github.com/IvanHunters) in #1580, #1581, #1582).
-* **Cozy-lib Improvements**: Enhanced flatten function with better ResourceQuota handling and nil resource support ([**@lllamnyp**](https://github.com/lllamnyp) in #1647; [**@IvanHunters**](https://github.com/IvanHunters) in #1642; [**@kvaps**](https://github.com/kvaps) in #1607).
-
----
-
-## New features
-
-### VPC (Virtual Private Cloud)
-
-* **[system] Add VPC**: Introduced Virtual Private Cloud system module with Multus CNI integration, enabling advanced networking capabilities for tenant applications ([**@nbykov0**](https://github.com/nbykov0) in #1543).
-* **[vpc] Install Multus by default**: Multus CNI is now installed by default when VPC is enabled, providing multi-network interface support ([**@lllamnyp**](https://github.com/lllamnyp) in #1587).
-* **[vpc] Give predictable name to subnet configmap**: Subnet configuration maps now use predictable naming for better management and debugging ([**@lllamnyp**](https://github.com/lllamnyp) in #1590).
-* **[vpc] Entry per subnet in the subnets configmap**: Each subnet now has its own entry in the subnets configmap, improving subnet organization and management ([**@lllamnyp**](https://github.com/lllamnyp) in #1600).
-* **[vpc,dashboard] Print subnet details as table**: Subnet details are now displayed as a table in the dashboard, improving visibility and management ([**@lllamnyp**](https://github.com/lllamnyp) in #1621).
-* **[apps] Add VPC app**: Added VPC application for tenant use, enabling users to create and manage VPCs ([**@nbykov0**](https://github.com/nbykov0) in #1543).
-
-### Dashboard
-
-* **[dashboard] Introduce VNC console**: Added VNC console support in the dashboard, allowing users to access virtual machine consoles directly from the web interface ([**@kvaps**](https://github.com/kvaps) in #1627).
-* **[dashboard] sync with upstream & enhancements**: Synchronized dashboard with upstream project and added various enhancements ([**@kvaps**](https://github.com/kvaps) in #1603).
-* **[dashboard] Migrate patches to upstream project**: Migrated dashboard patches to upstream project for better maintainability ([**@kvaps**](https://github.com/kvaps) in #1569).
-
-### Kubernetes
-
-* **[kubernetes] Make worker version configurable**: Platform administrators can now configure Kubernetes worker node versions independently from control plane versions, providing more flexibility ([**@lllamnyp**](https://github.com/lllamnyp) in #1619).
-* **[kubernetes] Use controlPlane.replicas field**: Fixed managed Kubernetes app to properly use the `controlPlane.replicas` field instead of hardcoding the value ([**@lllamnyp**](https://github.com/lllamnyp) in #1556).
-* **[kubernetes] Helm hooks for cleanup**: Added Helm hooks for cleanup operations in Kubernetes app ([**@lllamnyp**](https://github.com/lllamnyp) in #1606).
-
-### API & Platform
-
-* **[api] Efficient listing of TenantNamespaces**: Optimized TenantNamespace listing by replacing per-namespace SubjectAccessReview calls with group-based rolebinding checks, significantly reducing API latency ([**@lllamnyp**](https://github.com/lllamnyp) in #1507).
-* **[api] Use shared informer cache**: Optimized API server by using shared informer cache, reducing API server load and improving performance ([**@lllamnyp**](https://github.com/lllamnyp) in #1539).
-* **[api] Fix representation of dynamic list kinds**: Fixed API representation of dynamic list kinds for better compatibility ([**@lllamnyp**](https://github.com/lllamnyp) in #1630).
-* **[api] Delete previous instance when changing type**: API now properly deletes previous instance when changing application type ([**@lllamnyp**](https://github.com/lllamnyp) in #1579).
-
-### Applications
-
-* **[tenant] Allow listing workloads**: Enabled listing of workloads for tenants, improving visibility and management of tenant resources ([**@kvaps**](https://github.com/kvaps) in #1576).
-* **[apps] Make VM service user facing**: Virtual machine services are now marked as user-facing, improving service discovery and visibility in the dashboard ([**@lllamnyp**](https://github.com/lllamnyp) in #1523).
-* **[foundationdb] Upgrade FDB app for latest Cozy**: Upgraded FoundationDB application for compatibility with latest Cozystack version ([**@lllamnyp**](https://github.com/lllamnyp) in #1505).
-
-### Storage & Backups
-
-* **[seaweedfs] Update SeaweedFS v3.99 and deploy S3 as stacked service**: Updated SeaweedFS to version 3.99 and deployed S3 gateway as a stacked service for better integration and performance ([**@kvaps**](https://github.com/kvaps) in #1562).
-* **[seaweedfs] Allow users to discover their buckets**: Users can now discover and list their S3 buckets in SeaweedFS, improving usability and bucket management ([**@kvaps**](https://github.com/kvaps) in #1528).
-* **[velero] Set defaultItemOperationTimeout=24h**: Set default item operation timeout to 24 hours for Velero backups, preventing timeouts on large backup operations ([**@kvaps**](https://github.com/kvaps) in #1542).
-
-### Monitoring & Operations
-
-* **[monitoring] add settings alert for slack**: Added Slack integration configuration for Alerta alerts, enabling notifications to Slack channels ([**@scooby87**](https://github.com/scooby87) in #1545).
-
----
-
-## Improvements (minor)
-
-* **[lineage] Separate webhook from cozy controller**: Separated the lineage-controller-webhook from cozystack-controller into a separate daemonset component deployed on all control-plane nodes, reducing API server latency ([**@lllamnyp**](https://github.com/lllamnyp) in #1515).
-* **[dashboard] Show service LB IP**: Fixed JSON path issue to correctly display Service LoadBalancer IPs in the dashboard table view ([**@lllamnyp**](https://github.com/lllamnyp) in #1524).
-* **[dashboard] Update openapi-ui v1.0.3 + fixes**: Updated OpenAPI UI to version 1.0.3 with various fixes and improvements ([**@kvaps**](https://github.com/kvaps) in #1564).
-* **[dashboard-controller] Move badges generation logic to internal dashboard component**: Moved badges generation logic to internal dashboard component for better code organization ([**@kvaps**](https://github.com/kvaps) in #1567).
-* **[bucket] Expose bucket name in secrets**: Bucket names are now exposed in secrets for better integration with applications ([**@lllamnyp**](https://github.com/lllamnyp) in #1518).
-* **[platform] Better migration for 0.36.2->0.37.2+**: Improved migration script for users upgrading directly from 0.36.2 to 0.37.2+ ([**@lllamnyp**](https://github.com/lllamnyp) in #1521).
-* **[cozy-lib] Improve flatten function**: Improved flatten function in cozy-lib with better handling of complex resource structures ([**@lllamnyp**](https://github.com/lllamnyp) in #1647).
-* **[dx] JSDoc compatible syntax for values.yaml**: Added JSDoc compatible syntax for values.yaml documentation ([**@kvaps**](https://github.com/kvaps) in #1536).
-* **[system] Tune kubevirt rollout and eviction settings**: Tuned KubeVirt rollout and eviction settings for better stability ([**@nbykov0**](https://github.com/nbykov0) in #1544).
-* **[system] multus: update to the latest version**: Updated Multus CNI to the latest version ([**@nbykov0**](https://github.com/nbykov0) in #1628).
-* **[system] kubeovn: increase limits**: Increased resource limits for Kube-OVN components to improve stability and performance ([**@nbykov0**](https://github.com/nbykov0) in #1629).
-* **[linstor] Update Piraeus Operator to v2.10.1 to enable RWX support**: Updated Piraeus Operator to v2.10.1, enabling ReadWriteMany (RWX) volume support ([**@kvaps**](https://github.com/kvaps) in #1650).
-* **[ci,dx] Bump MariaDB operator version**: Bumped MariaDB operator version for latest features and bug fixes ([**@IvanHunters**](https://github.com/IvanHunters) in #1646).
-
----
-
-## Bug fixes
-
-* **[api] Fix RBAC for listing of TenantNamespaces and handle system:masters**: Fixed regression in TenantNamespace listing RBAC and added proper handling for system:masters group ([**@kvaps**](https://github.com/kvaps) in #1511).
-* **[api] Fix listing tenantnamespaces for non-oidc users**: Fixed TenantNamespace listing functionality for users not using OIDC authentication ([**@kvaps**](https://github.com/kvaps) in #1517).
-* **[dashboard] Fix logout**: Fixed dashboard logout functionality to properly clear session and redirect users ([**@kvaps**](https://github.com/kvaps) in #1510).
-* **[installer] Add additional check to wait for lineage-webhook**: Added additional readiness check to ensure lineage-webhook is fully ready before proceeding with installation ([**@kvaps**](https://github.com/kvaps) in #1506).
-* **[lineage] Check for nil chart in HelmRelease**: Added nil check to prevent crashes when lineage webhook encounters HelmReleases using `chartRef` instead of `chart` ([**@lllamnyp**](https://github.com/lllamnyp) in #1525).
-* **[kamaji] Respect 3rd party labels**: Applied patch to Kamaji controller to respect third-party labels, preventing reconciliation loops ([**@lllamnyp**](https://github.com/lllamnyp) in #1531).
-* **[redis-operator] Build patched operator in-tree**: Moved Redis operator build into Cozystack organization and patched it to prevent overwriting third-party labels ([**@lllamnyp**](https://github.com/lllamnyp) in #1547).
-* **[mariadb-operator] Add post-delete job to remove PVCs**: Added post-delete job to automatically remove PersistentVolumeClaims when MariaDB instances are deleted ([**@IvanHunters**](https://github.com/IvanHunters) in #1553).
-* **[seaweedfs] Fix migration to v3.99**: Fixed migration issues when upgrading SeaweedFS to version 3.99 ([**@kvaps**](https://github.com/kvaps) in #1572).
-* **[nats] Merge container spec, not podTemplate**: Fixed NATS configuration to properly merge container specifications instead of podTemplate ([**@lllamnyp**](https://github.com/lllamnyp) in #1571).
-* **[nats] Fixes for NATS App Helm chart, fix template issues with config.merge**: Fixed template issues in NATS Helm chart related to config.merge value ([**@insignia96**](https://github.com/insignia96) in #1583).
-* **[nats] Fix NATS app chart to use existing secret credentials when present**: Fixed NATS app chart to use existing secret credentials when present, preventing credential regeneration ([**@insignia96**](https://github.com/insignia96) in #1599).
-* **[kubevirt] Fix: kubevirt metrics rule**: Fixed KubeVirt metrics rule configuration ([**@kvaps**](https://github.com/kvaps) in #1584).
-* **[controller] Remove crdmem, handle DaemonSet**: Removed crdmem and improved DaemonSet handling in controller ([**@lllamnyp**](https://github.com/lllamnyp) in #1555).
-* **[dashboard] Revert reconciler removal**: Reverted reconciler removal to restore proper dashboard functionality ([**@lllamnyp**](https://github.com/lllamnyp) in #1559).
-* **[dashboard-controller] Fix static resources reconciliation and showing secrets**: Fixed static resources reconciliation and improved secret display in dashboard controller ([**@kvaps**](https://github.com/kvaps) in #1615).
-* **[cozystack-api][dashboard] Fix filtering for application services/ingresses/secrets**: Fixed filtering functionality for application services, ingresses, and secrets in both API and dashboard ([**@kvaps**](https://github.com/kvaps) in #1612).
-* **[virtual-machine] Revert per-vm network policies**: Reverted per-VM network policies to previous behavior ([**@kvaps**](https://github.com/kvaps) in #1611).
-* **[cozy-lib] Fix: handling resources=nil**: Fixed handling of nil resources in cozy-lib templates ([**@kvaps**](https://github.com/kvaps) in #1607).
-* **[cozy-lib] Fix malformed ResourceQuota rendering for LoadBalancer services**: Fixed malformed ResourceQuota rendering for LoadBalancer services in cozy-lib templates ([**@IvanHunters**](https://github.com/IvanHunters) in #1642).
-* **[kubernetes] Cleanup loadbalancer services**: Added cleanup functionality for load balancer services in Kubernetes app ([**@lllamnyp**](https://github.com/lllamnyp) in #1631).
-* **[rbac] Fix permissions for high-privilege users**: Fixed RBAC permissions for high-privilege users, ensuring proper access control ([**@lllamnyp**](https://github.com/lllamnyp) in #1622).
-* **[vpc] Fix access to subnet details configmap**: Fixed access to subnet details configmap in VPC functionality ([**@lllamnyp**](https://github.com/lllamnyp) in #1638).
-* **[api,lineage] Ensure node-local traffic**: Ensured node-local traffic handling for API and lineage components ([**@lllamnyp**](https://github.com/lllamnyp) in #1554).
-* **[extra] ingress: rm spaces from external ip list**: Removed spaces from external IP list in ingress configuration, fixing formatting issues ([**@nbykov0**](https://github.com/nbykov0) in #1652).
-* **scripts: fix 20 migration**: Fixed migration script #20 to ensure proper execution during upgrades ([**@nbykov0**](https://github.com/nbykov0) in #1653).
-
----
-
-## Security
-
-* **[redis] Bump Redis image version for security fixes**: Updated Redis image version to include latest security fixes, improving cluster security ([**@IvanHunters**](https://github.com/IvanHunters) in #1580).
-* **[flux] Close Flux Operator ports to external access**: Removed hostPort and hostNetwork from Flux Operator Deployment, ensuring ports 8080 and 8081 are only accessible within the cluster ([**@IvanHunters**](https://github.com/IvanHunters) in #1581).
-* **[ingress] Enforce HTTPS-only for API**: Added force-ssl-redirect annotation to default API Ingress, ensuring all HTTP traffic is redirected to HTTPS ([**@IvanHunters**](https://github.com/IvanHunters) in #1582).
-
----
-
-## Dependencies & version updates
-
-* **Update LINSTOR v1.32.3**: Updated LINSTOR to version 1.32.3 with latest features and bug fixes ([**@kvaps**](https://github.com/kvaps) in #1565).
-* **Update Talos Linux v1.11.3**: Updated Talos Linux to version 1.11.3 ([**@kvaps**](https://github.com/kvaps) in #1527).
-* **Update Kube-OVN v1.14.11**: Updated Kube-OVN to version 1.14.11 ([**@kvaps**](https://github.com/kvaps) in #1514).
-* **[linstor] Update Piraeus Operator to v2.10.1**: Updated Piraeus Operator to v2.10.1 to enable RWX support ([**@kvaps**](https://github.com/kvaps) in #1650).
-* **[system] multus: update to the latest version**: Updated Multus CNI to the latest version ([**@nbykov0**](https://github.com/nbykov0) in #1628).
-* **[ci,dx] Bump MariaDB operator version**: Bumped MariaDB operator version ([**@IvanHunters**](https://github.com/IvanHunters) in #1646).
-* **Increase strimzi memory limit**: Increased memory limit for Strimzi Kafka operator to improve stability and performance ([**@nbykov0**](https://github.com/nbykov0) in #1651).
-
----
-
-## System Configuration
-
-* **[system] kube-ovn: turn off enableLb**: Disabled load balancer functionality in Kube-OVN configuration ([**@nbykov0**](https://github.com/nbykov0) in #1548).
-* **[core] rm talos lldp extension**: Removed Talos LLDP extension from core configuration ([**@nbykov0**](https://github.com/nbykov0) in #1586).
-
----
-
-## Development, Testing, and CI/CD
-
-* **[tests] Make Kubernetes tests POSIX-compatible**: Replaced bash-specific constructs with POSIX-compliant code, ensuring tests work reliably with /bin/sh ([**@IvanHunters**](https://github.com/IvanHunters) in #1509).
-* **[ferretdb] fix tests**: Fixed FerretDB tests to ensure proper execution ([**@IvanHunters**](https://github.com/IvanHunters) in #1540).
-* **[e2e] Increase Kubernetes connection timeouts**: Increased connection and request timeouts in E2E tests when communicating with Kubernetes API ([**@IvanHunters**](https://github.com/IvanHunters) in #1570).
-* **[cozystack-controller] improve API tests**: Improved API tests for cozystack-controller ([**@kvaps**](https://github.com/kvaps) in #1617).
-* **[ci] Fix build from external forks**: Fixed build process to work correctly from external forks ([**@kvaps**](https://github.com/kvaps) in #1530).
-* **[ci,dx] Add unit tests for cozy-lib**: Added unit tests for cozy-lib to improve code quality and reliability ([**@lllamnyp**](https://github.com/lllamnyp) in #1643).
-
----
-
-## Documentation
-
-* **[website] Add VPC page**: Added VPC documentation page explaining VPC features and usage ([**@nbykov0**](https://github.com/nbykov0) in cozystack/website@9ccac78).
-* **[website] Add VPC to auto-update list**: Added VPC to auto-update list in documentation ([**@nbykov0**](https://github.com/nbykov0) in cozystack/website@ca2bce6).
-* **[website] Update dashboard part in OIDC configuration doc**: Updated OIDC configuration documentation with dashboard information ([**@nbykov0**](https://github.com/nbykov0) in cozystack/website@6c44b93).
-* **[website] Update storage requirements**: Updated storage requirements documentation ([**@nbykov0**](https://github.com/nbykov0) in cozystack/website@cac3af6).
-* **[website] Add System Resource Planning Recommendations**: Added system resource planning recommendations documentation ([**@kvaps**](https://github.com/kvaps) in cozystack/website@c877c2a).
-* **[website] Optimize website for mobile devices**: Improved website layout and responsiveness for mobile devices ([**@kvaps**](https://github.com/kvaps) in cozystack/website@3ab2338).
-* **[website] Add OpenAPI UI**: Added OpenAPI UI documentation and integration ([**@kvaps**](https://github.com/kvaps) in cozystack/website@b1c1668).
-* **[website] Update Cozystack video in hero banner**: Updated hero banner with new Cozystack video ([**@kvaps**](https://github.com/kvaps) in cozystack/website@e351137).
-* **[website] Add screenshots carousel**: Added screenshots carousel to showcase Cozystack features ([**@kvaps**](https://github.com/kvaps) in cozystack/website@8422bd0).
-* **[website] Update LINSTOR documentation**: Updated LINSTOR guide and set failmode=continue for ZFS configurations ([**@kvaps**](https://github.com/kvaps) in cozystack/website@033804e).
-* **[website] Update managed apps reference**: Updated managed applications reference documentation ([**@kvaps**](https://github.com/kvaps) in cozystack/website@b886a74, cozystack/website@41c1849, cozystack/website@0ab71fd).
-* **[website] Update external apps documentation**: Updated documentation for external applications ([**@kvaps**](https://github.com/kvaps) in cozystack/website@565dad9).
-* **[website] Add naming conventions**: Added naming conventions documentation ([**@kvaps**](https://github.com/kvaps) in cozystack/website@b227abb).
-* **[website] Update golden image documentation**: Updated documentation for creating golden images for virtual machines ([**@kvaps**](https://github.com/kvaps) in cozystack/website@34c2f3a, cozystack/website@ef65593).
-* **[website] Fix documentation formatting**: Fixed alerts, infoboxes, tabs styles and main page formatting ([**@kvaps**](https://github.com/kvaps) in cozystack/website@e992e97, cozystack/website@b2c4dee).
-* **[website] Fix typo in blog article**: Fixed typo in blog article ([**@kvaps**](https://github.com/kvaps) in cozystack/website@0a4bbf3).
-* **[apps] vpc: more docs**: Added more VPC documentation ([**@nbykov0**](https://github.com/nbykov0) in #1594).
-* **[apps] vpc: fix typo in README**: Fixed typo in VPC README ([**@nbykov0**](https://github.com/nbykov0) in #1637).
-
----
-
-## Additional Repositories
-
-### boot-to-talos
-
-* **[boot-to-talos] Introduce boot/install mode**: Introduced boot/install mode in boot-to-talos tool ([**@kvaps**](https://github.com/kvaps) in cozystack/boot-to-talos#5).
-
-### cozypkg
-
-* **[cozypkg] Handle valuesFiles from cozypkg.cozystack.io/values-files annotation**: Added support for handling valuesFiles from annotation in cozypkg ([**@kvaps**](https://github.com/kvaps) in cozystack/cozypkg#8).
-
----
-
-## Refactors & chores
-
-* **[dashboard] Migrate patches to upstream project**: Migrated dashboard patches to upstream project for better maintainability ([**@kvaps**](https://github.com/kvaps) in #1569).
-* **Update CODEOWNERS**: Updated CODEOWNERS file ([**@nbykov0**](https://github.com/nbykov0) in #1537).
-* **Add QOSI to ADOPTERS.md**: Added QOSI to adopters list ([**@tabu-a**](https://github.com/tabu-a) in #1589).
-
----
-
-## Breaking changes & upgrade notes
-
-No breaking changes in this release.
-
----
-
-## Contributors
-
-We'd like to thank all contributors who made this release possible:
-
-* [**@IvanHunters**](https://github.com/IvanHunters)
-* [**@insignia96**](https://github.com/insignia96)
-* [**@kvaps**](https://github.com/kvaps)
-* [**@lllamnyp**](https://github.com/lllamnyp)
-* [**@nbykov0**](https://github.com/nbykov0)
-* [**@scooby87**](https://github.com/scooby87)
-* [**@tabu-a**](https://github.com/tabu-a)
-
-### New Contributors
-
-We're excited to welcome our first-time contributors:
-
-* [**@tabu-a**](https://github.com/tabu-a) - First contribution!
-
----
-
-**Full Changelog**: [v0.37.0...v0.38.0](https://github.com/cozystack/cozystack/compare/v0.37.0...v0.38.0)
-
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.38.0
--->

docs/changelogs/v0.38.1.md

@@ -1,19 +0,0 @@
-
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.38.1
--->
-
-## Improvements
-
-* **[seaweedfs] Extended CA certificate duration to reduce disruptive CA rotations**: Extended CA certificate duration to reduce disruptive CA rotations. ([**@IvanHunters**](https://github.com/IvanHunters) in #1657, #1666).
-* **[dashboard] Add config hash annotations to restart pods on config changes**: Added config hash annotations to restart pods when configuration changes, ensuring pods are automatically restarted when their configuration is updated ([**@kvaps**](https://github.com/kvaps) in #1662, #1665).
-
-## Fixes
-
-* **[tenant][kubernetes] Introduce better cleanup logic**: Improved cleanup logic for tenant Kubernetes resources, ensuring proper resource cleanup when tenants are deleted or updated ([**@kvaps**](https://github.com/kvaps) in #1661).
-* **[dashboard] Fix loading arrays in forms when editing existing objects**: Fixed issue where arrays in forms were not loading correctly when editing existing objects in the dashboard ([**@kvaps**](https://github.com/kvaps)).
-
----
-
-**Full Changelog**: [v0.38.0...v0.38.1](https://github.com/cozystack/cozystack/compare/v0.38.0...v0.38.1)
-

docs/changelogs/v0.38.2.md

@@ -1,13 +0,0 @@
-
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.38.2
--->
-
-## Fixes
-
-* **[api] Revert dynamic list kinds representation fix (fixes namespace deletion regression)**: Reverted changes from #1630 that caused a regression affecting namespace deletion and upgrades from previous versions. The regression caused namespace deletion failures with errors like "content is not a list: []unstructured.Unstructured" during namespace finalization. This revert restores compatibility with namespace deletion controller and fixes upgrade issues from previous versions, particularly when running migration 20 ([**@kvaps**](https://github.com/kvaps) in #1677).
-
----
-
-**Full Changelog**: [v0.38.1...v0.38.2](https://github.com/cozystack/cozystack/compare/v0.38.1...v0.38.2)
-

go.mod

@@ -2,41 +2,33 @@
 
 module github.com/cozystack/cozystack
 
-go 1.25.0
+go 1.23.0
 
 require (
-	github.com/emicklei/dot v1.10.0
-	github.com/fluxcd/helm-controller/api v1.4.3
-	github.com/fluxcd/source-controller/api v1.6.2
-	github.com/fluxcd/source-watcher/api/v2 v2.0.2
-	github.com/go-logr/logr v1.4.3
-	github.com/go-logr/zapr v1.3.0
+	github.com/fluxcd/helm-controller/api v1.1.0
 	github.com/google/gofuzz v1.2.0
-	github.com/onsi/ginkgo/v2 v2.23.3
-	github.com/onsi/gomega v1.37.0
-	github.com/prometheus/client_golang v1.22.0
-	github.com/robfig/cron/v3 v3.0.1
-	github.com/spf13/cobra v1.9.1
-	go.uber.org/zap v1.27.0
+	github.com/onsi/ginkgo/v2 v2.19.0
+	github.com/onsi/gomega v1.33.1
+	github.com/spf13/cobra v1.8.1
+	github.com/stretchr/testify v1.9.0
 	gopkg.in/yaml.v2 v2.4.0
-	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/api v0.34.1
-	k8s.io/apiextensions-apiserver v0.34.1
-	k8s.io/apimachinery v0.34.1
-	k8s.io/apiserver v0.34.1
-	k8s.io/client-go v0.34.1
-	k8s.io/component-base v0.34.1
+	k8s.io/api v0.31.2
+	k8s.io/apiextensions-apiserver v0.31.2
+	k8s.io/apimachinery v0.31.2
+	k8s.io/apiserver v0.31.2
+	k8s.io/client-go v0.31.2
+	k8s.io/component-base v0.31.2
 	k8s.io/klog/v2 v2.130.1
-	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b
-	k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d
-	sigs.k8s.io/controller-runtime v0.22.2
-	sigs.k8s.io/structured-merge-diff/v4 v4.7.0
+	k8s.io/kube-openapi v0.0.0-20240827152857-f7e401e7b4c2
+	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8
+	sigs.k8s.io/controller-runtime v0.19.0
+	sigs.k8s.io/structured-merge-diff/v4 v4.4.1
 )
 
 require (
-	cel.dev/expr v0.24.0 // indirect
 	github.com/NYTimes/gziphandler v1.1.1 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
@@ -44,90 +36,86 @@ require (
 	github.com/coreos/go-semver v0.3.1 // indirect
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
+	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
 	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
-	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
+	github.com/evanphx/json-patch/v5 v5.9.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fluxcd/pkg/apis/acl v0.9.0 // indirect
-	github.com/fluxcd/pkg/apis/kustomize v1.13.0 // indirect
-	github.com/fluxcd/pkg/apis/meta v1.22.0 // indirect
-	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/fluxcd/pkg/apis/kustomize v1.6.1 // indirect
+	github.com/fluxcd/pkg/apis/meta v1.6.1 // indirect
+	github.com/fsnotify/fsnotify v1.7.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-logr/zapr v1.3.0 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
-	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/google/btree v1.1.3 // indirect
-	github.com/google/cel-go v0.26.0 // indirect
-	github.com/google/gnostic-models v0.7.0 // indirect
-	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad // indirect
+	github.com/google/cel-go v0.21.0 // indirect
+	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
+	github.com/gorilla/websocket v1.5.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 // indirect
+	github.com/imdario/mergo v0.3.6 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/kylelemons/godebug v1.1.0 // indirect
-	github.com/mailru/easyjson v0.9.0 // indirect
-	github.com/moby/spdystream v0.5.0 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/moby/spdystream v0.4.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/prometheus/client_golang v1.19.1 // indirect
 	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.62.0 // indirect
+	github.com/prometheus/common v0.55.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
-	github.com/spf13/pflag v1.0.7 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/stoewer/go-strcase v1.3.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	go.etcd.io/etcd/api/v3 v3.6.4 // indirect
-	go.etcd.io/etcd/client/pkg/v3 v3.6.4 // indirect
-	go.etcd.io/etcd/client/v3 v3.6.4 // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
-	go.opentelemetry.io/otel v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 // indirect
-	go.opentelemetry.io/otel/metric v1.35.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.34.0 // indirect
-	go.opentelemetry.io/otel/trace v1.35.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
+	go.etcd.io/etcd/api/v3 v3.5.16 // indirect
+	go.etcd.io/etcd/client/pkg/v3 v3.5.16 // indirect
+	go.etcd.io/etcd/client/v3 v3.5.16 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.53.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 // indirect
+	go.opentelemetry.io/otel v1.28.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 // indirect
+	go.opentelemetry.io/otel/metric v1.28.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.28.0 // indirect
+	go.opentelemetry.io/otel/trace v1.28.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.42.0 // indirect
+	go.uber.org/zap v1.27.0 // indirect
+	golang.org/x/crypto v0.31.0 // indirect
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
-	golang.org/x/net v0.45.0 // indirect
-	golang.org/x/oauth2 v0.29.0 // indirect
-	golang.org/x/sync v0.17.0 // indirect
-	golang.org/x/sys v0.36.0 // indirect
-	golang.org/x/term v0.35.0 // indirect
-	golang.org/x/text v0.29.0 // indirect
-	golang.org/x/time v0.11.0 // indirect
-	golang.org/x/tools v0.37.0 // indirect
+	golang.org/x/net v0.33.0 // indirect
+	golang.org/x/oauth2 v0.23.0 // indirect
+	golang.org/x/sync v0.10.0 // indirect
+	golang.org/x/sys v0.28.0 // indirect
+	golang.org/x/term v0.27.0 // indirect
+	golang.org/x/text v0.21.0 // indirect
+	golang.org/x/time v0.7.0 // indirect
+	golang.org/x/tools v0.26.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb // indirect
-	google.golang.org/grpc v1.72.1 // indirect
-	google.golang.org/protobuf v1.36.5 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240528184218-531527333157 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 // indirect
+	google.golang.org/grpc v1.65.0 // indirect
+	google.golang.org/protobuf v1.34.2 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
-	k8s.io/kms v0.34.1 // indirect
-	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
-	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
-	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
-	sigs.k8s.io/yaml v1.6.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/kms v0.31.2 // indirect
+	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.0 // indirect
+	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
 )
-
-// See: issues.k8s.io/135537
-replace k8s.io/apimachinery => github.com/cozystack/apimachinery v0.0.0-20251219010959-1f91eabae46c

go.sum

@@ -1,11 +1,11 @@
-cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
-cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
 github.com/NYTimes/gziphandler v1.1.1 h1:ZUDjpQae29j0ryrS0u/B8HZfJBtBQHjqw2rQ2cqUQ3I=
 github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMomdKFjzJNB0c=
 github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
 github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
@@ -18,52 +18,45 @@ github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
 github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/cozystack/apimachinery v0.0.0-20251219010959-1f91eabae46c h1:C2wIfH/OzhU9XOK/e6Ik9cg7nZ1z6fN4lf6a3yFdik8=
-github.com/cozystack/apimachinery v0.0.0-20251219010959-1f91eabae46c/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
-github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/emicklei/dot v1.10.0 h1:z17n0ce/FBMz3QbShSzVGhiW447Qhu7fljzvp3Gs6ig=
-github.com/emicklei/dot v1.10.0/go.mod h1:DeV7GvQtIw4h2u73RKBkkFdvVAz0D9fzeJrgPW6gy/s=
-github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
-github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
+github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH5pOlLGNtQ5lPWQu84=
 github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
-github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
+github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg=
+github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/fluxcd/helm-controller/api v1.4.3 h1:CdZwjL1liXmYCWyk2jscmFEB59tICIlnWB9PfDDW5q4=
-github.com/fluxcd/helm-controller/api v1.4.3/go.mod h1:0XrBhKEaqvxyDj/FziG1Q8Fmx2UATdaqLgYqmZh6wW4=
-github.com/fluxcd/pkg/apis/acl v0.9.0 h1:wBpgsKT+jcyZEcM//OmZr9RiF8klL3ebrDp2u2ThsnA=
-github.com/fluxcd/pkg/apis/acl v0.9.0/go.mod h1:TttNS+gocsGLwnvmgVi3/Yscwqrjc17+vhgYfqkfrV4=
-github.com/fluxcd/pkg/apis/kustomize v1.13.0 h1:GGf0UBVRIku+gebY944icVeEIhyg1P/KE3IrhOyJJnE=
-github.com/fluxcd/pkg/apis/kustomize v1.13.0/go.mod h1:TLKVqbtnzkhDuhWnAsN35977HvRfIjs+lgMuNro/LEc=
-github.com/fluxcd/pkg/apis/meta v1.22.0 h1:EHWQH5ZWml7i8eZ/AMjm1jxid3j/PQ31p+hIwCt6crM=
-github.com/fluxcd/pkg/apis/meta v1.22.0/go.mod h1:Kc1+bWe5p0doROzuV9XiTfV/oL3ddsemYXt8ZYWdVVg=
-github.com/fluxcd/source-controller/api v1.6.2 h1:UmodAeqLIeF29HdTqf2GiacZyO+hJydJlepDaYsMvhc=
-github.com/fluxcd/source-controller/api v1.6.2/go.mod h1:ZJcAi0nemsnBxjVgmJl0WQzNvB0rMETxQMTdoFosmMw=
-github.com/fluxcd/source-watcher/api/v2 v2.0.2 h1:fWSxsDqYN7My2AEpQwbP7O6Qjix8nGBX+UE/qWHtZfM=
-github.com/fluxcd/source-watcher/api/v2 v2.0.2/go.mod h1:Hs6ueayPt23jlkIr/d1pGPZ+OHiibQwWjxvU6xqljzg=
-github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
-github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
-github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/fluxcd/helm-controller/api v1.1.0 h1:NS5Wm3U6Kv4w7Cw2sDOV++vf2ecGfFV00x1+2Y3QcOY=
+github.com/fluxcd/helm-controller/api v1.1.0/go.mod h1:BgHMgMY6CWynzl4KIbHpd6Wpn3FN9BqgkwmvoKCp6iE=
+github.com/fluxcd/pkg/apis/kustomize v1.6.1 h1:22FJc69Mq4i8aCxnKPlddHhSMyI4UPkQkqiAdWFcqe0=
+github.com/fluxcd/pkg/apis/kustomize v1.6.1/go.mod h1:5dvQ4IZwz0hMGmuj8tTWGtarsuxW0rWsxJOwC6i+0V8=
+github.com/fluxcd/pkg/apis/meta v1.6.1 h1:maLhcRJ3P/70ArLCY/LF/YovkxXbX+6sTWZwZQBeNq0=
+github.com/fluxcd/pkg/apis/meta v1.6.1/go.mod h1:YndB/gxgGZmKfqpAfFxyCDNFJFP0ikpeJzs66jwq280=
+github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
+github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
+github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
+github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
 github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
+github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
 github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
 github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
-github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
-github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
+github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
+github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
+github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
 github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
 github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
@@ -71,171 +64,162 @@ github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZ
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
-github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
+github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
-github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
-github.com/google/cel-go v0.26.0 h1:DPGjXackMpJWH680oGY4lZhYjIameYmR+/6RBdDGmaI=
-github.com/google/cel-go v0.26.0/go.mod h1:A9O8OU9rdvrK5MQyrqfIxo1a0u4g3sF8KB6PUIaryMM=
-github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
-github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/btree v1.0.1 h1:gK4Kx5IaGY9CD5sPJ36FHiBJ6ZXl0kilRiiCj+jdYp4=
+github.com/google/btree v1.0.1/go.mod h1:xXMiIv4Fb/0kKde4SpL7qlzvu5cMJDRkFDxJfI9uaxA=
+github.com/google/cel-go v0.21.0 h1:cl6uW/gxN+Hy50tNYvI691+sXxioCnstFzLp2WO4GCI=
+github.com/google/cel-go v0.21.0/go.mod h1:rHUlWCcBKgyEk+eV03RPdZUekPp6YcJwV0FxuUksYxc=
+github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
+github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad h1:a6HEuzUHeKH6hwfN/ZoQgRgVIWFJljSWa/zetS2WTvg=
-github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
+github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 h1:FKHo8hFI3A+7w0aUQuYXQ+6EN5stWmeY/AZqtM8xk9k=
+github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
-github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
-github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1 h1:qnpSQwGEnkcRpTqNOIR6bJbR0gAorgP9CSALpRcKoAA=
-github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1/go.mod h1:lXGCsh6c22WGtjr+qGHj1otzZpV/1kwTMAqkwZsnWRU=
-github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.0 h1:FbSCl+KggFl+Ocym490i/EyXF4lPgLoUtcSWquBM0Rs=
-github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.0/go.mod h1:qOchhhIlmRcqk/O9uCo/puJlyo07YINaIqdZfZG3Jkc=
+github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
+github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 h1:+9834+KizmvFV7pXQGSXQTsaWhq2GjuNUt0aUU0YBYw=
+github.com/grpc-ecosystem/go-grpc-middleware v1.3.0/go.mod h1:z0ButlSOZa5vEBq9m2m2hlwIgKw+rp3sdCBRoJY+30Y=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 h1:Ovs26xHkKqVztRpIrF/92BcuyuQ/YW4NSIpoGtfXNho=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
+github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
+github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 h1:bkypFPDjIYGfCYD5mRBvpqxfYX1YCS1PXdKYWi8FsN0=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0/go.mod h1:P+Lt/0by1T8bfcF3z737NnSbmxQAppXMRziHUxPOC8k=
+github.com/imdario/mergo v0.3.6 h1:xTNEAn+kxVO7dTZGu0CegyqKZmoWFI0rF8UxjlB2d28=
+github.com/imdario/mergo v0.3.6/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
-github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
+github.com/jonboulle/clockwork v0.2.2 h1:UOGuzwb1PwsrDAObMuhUnj0p5ULPj8V/xJ7Kx9qUBdQ=
+github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
-github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
-github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
-github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
-github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
-github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
+github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
+github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/moby/spdystream v0.4.0 h1:Vy79D6mHeJJjiPdFEL2yku1kl0chZpJfZcPpb16BRl8=
+github.com/moby/spdystream v0.4.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
-github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
-github.com/onsi/ginkgo/v2 v2.23.3 h1:edHxnszytJ4lD9D5Jjc4tiDkPBZ3siDeJJkUZJJVkp0=
-github.com/onsi/ginkgo/v2 v2.23.3/go.mod h1:zXTP6xIp3U8aVuXN8ENK9IXRaTjFnpVB9mGmaSRvxnM=
-github.com/onsi/gomega v1.37.0 h1:CdEG8g0S133B4OswTDC/5XPSzE1OeP29QOioj2PID2Y=
-github.com/onsi/gomega v1.37.0/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
+github.com/onsi/ginkgo/v2 v2.19.0 h1:9Cnnf7UHo57Hy3k6/m5k3dRfGTMXGvxhHFvkDTCTpvA=
+github.com/onsi/ginkgo/v2 v2.19.0/go.mod h1:rlwLi9PilAFJ8jCg9UE1QP6VBpd6/xj3SRC0d6TU0To=
+github.com/onsi/gomega v1.33.1 h1:dsYjIxxSR755MDmKVsaFQTE22ChNBcuuTWgkUDSubOk=
+github.com/onsi/gomega v1.33.1/go.mod h1:U4R44UsT+9eLIaYRB2a5qajjtQYn0hauxvRm16AVYg0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
-github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
+github.com/prometheus/client_golang v1.19.1 h1:wZWJDwK+NameRJuPGDhlnFgx8e8HN3XHQeLaYJFJBOE=
+github.com/prometheus/client_golang v1.19.1/go.mod h1:mP78NwGzrVks5S2H6ab8+ZZGJLZUq1hoULYBAYBw1Ho=
 github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
 github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
-github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
-github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
+github.com/prometheus/common v0.55.0 h1:KEi6DK7lXW/m7Ig5i47x0vRzuBsHuvJdi5ee6Y3G1dc=
+github.com/prometheus/common v0.55.0/go.mod h1:2SECS4xJG1kd8XF9IcM1gMX6510RAEL65zxzNImwdc8=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
-github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
-github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
-github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
-github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
+github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/soheilhy/cmux v0.1.5 h1:jjzc5WVemNEDTLwv9tlmemhC73tI08BNOIGwBOo10Js=
 github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
-github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
-github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
-github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
+github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stoewer/go-strcase v1.3.0 h1:g0eASXYtp+yvN9fK8sH94oCIk0fau9uV1/ZdJ0AVEzs=
 github.com/stoewer/go-strcase v1.3.0/go.mod h1:fAH5hQ5pehh+j3nZfvwdk2RgEgQjAoM8wodgtPmh1xo=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75 h1:6fotK7otjonDflCTK0BCfls4SPy3NcCVb5dqqmbRknE=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75/go.mod h1:KO6IkyS8Y3j8OdNO85qEYBsRPuteD+YciPomcXdrMnk=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
-github.com/xiang90/probing v0.0.0-20221125231312-a49e3df8f510 h1:S2dVYn90KE98chqDkyE9Z4N61UnQd+KOfgp5Iu53llk=
-github.com/xiang90/probing v0.0.0-20221125231312-a49e3df8f510/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
+github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2 h1:eY9dn8+vbi4tKz5Qo6v2eYzo7kUS51QINcR5jNpbZS8=
+github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-go.etcd.io/bbolt v1.4.2 h1:IrUHp260R8c+zYx/Tm8QZr04CX+qWS5PGfPdevhdm1I=
-go.etcd.io/bbolt v1.4.2/go.mod h1:Is8rSHO/b4f3XigBC0lL0+4FwAQv3HXEEIgFMuKHceM=
-go.etcd.io/etcd/api/v3 v3.6.4 h1:7F6N7toCKcV72QmoUKa23yYLiiljMrT4xCeBL9BmXdo=
-go.etcd.io/etcd/api/v3 v3.6.4/go.mod h1:eFhhvfR8Px1P6SEuLT600v+vrhdDTdcfMzmnxVXXSbk=
-go.etcd.io/etcd/client/pkg/v3 v3.6.4 h1:9HBYrjppeOfFjBjaMTRxT3R7xT0GLK8EJMVC4xg6ok0=
-go.etcd.io/etcd/client/pkg/v3 v3.6.4/go.mod h1:sbdzr2cl3HzVmxNw//PH7aLGVtY4QySjQFuaCgcRFAI=
-go.etcd.io/etcd/client/v3 v3.6.4 h1:YOMrCfMhRzY8NgtzUsHl8hC2EBSnuqbR3dh84Uryl7A=
-go.etcd.io/etcd/client/v3 v3.6.4/go.mod h1:jaNNHCyg2FdALyKWnd7hxZXZxZANb0+KGY+YQaEMISo=
-go.etcd.io/etcd/pkg/v3 v3.6.4 h1:fy8bmXIec1Q35/jRZ0KOes8vuFxbvdN0aAFqmEfJZWA=
-go.etcd.io/etcd/pkg/v3 v3.6.4/go.mod h1:kKcYWP8gHuBRcteyv6MXWSN0+bVMnfgqiHueIZnKMtE=
-go.etcd.io/etcd/server/v3 v3.6.4 h1:LsCA7CzjVt+8WGrdsnh6RhC0XqCsLkBly3ve5rTxMAU=
-go.etcd.io/etcd/server/v3 v3.6.4/go.mod h1:aYCL/h43yiONOv0QIR82kH/2xZ7m+IWYjzRmyQfnCAg=
-go.etcd.io/raft/v3 v3.6.0 h1:5NtvbDVYpnfZWcIHgGRk9DyzkBIXOi8j+DDp1IcnUWQ=
-go.etcd.io/raft/v3 v3.6.0/go.mod h1:nLvLevg6+xrVtHUmVaTcTz603gQPHfh7kUAwV6YpfGo=
-go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
-go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 h1:x7wzEgXfnzJcHDwStJT+mxOz4etr2EcexjqhBvmoakw=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0/go.mod h1:rg+RlpR5dKwaS95IyyZqj5Wd4E13lk/msnTS0Xl9lJM=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 h1:yd02MEjBdJkG3uabWP9apV+OuWRIXGDuJEUJbOHmCFU=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0/go.mod h1:umTcuxiv1n/s/S6/c2AT/g2CQ7u5C59sHDNmfSwgz7Q=
-go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
-go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 h1:OeNbIYk/2C15ckl7glBlOBp5+WlYsOElzTNmiPW/x60=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0/go.mod h1:7Bept48yIeqxP2OZ9/AqIpYS94h2or0aB4FypJTc8ZM=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 h1:tgJ0uaNS4c98WRNUEx5U3aDlrDOI5Rs+1Vifcw4DJ8U=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0/go.mod h1:U7HYyW0zt/a9x5J1Kjs+r1f/d4ZHnYFclhYY2+YbeoE=
-go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
-go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
-go.opentelemetry.io/otel/sdk v1.34.0 h1:95zS4k/2GOy069d321O8jWgYsW3MzVV+KuSPKp7Wr1A=
-go.opentelemetry.io/otel/sdk v1.34.0/go.mod h1:0e/pNiaMAqaykJGKbi+tSjWfNNHMTxoC9qANsCzbyxU=
-go.opentelemetry.io/otel/sdk/metric v1.34.0 h1:5CeK9ujjbFVL5c1PhLuStg1wxA7vQv7ce1EK0Gyvahk=
-go.opentelemetry.io/otel/sdk/metric v1.34.0/go.mod h1:jQ/r8Ze28zRKoNRdkjCZxfs6YvBTG1+YIqyFVFYec5w=
-go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
-go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
-go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
-go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
+go.etcd.io/bbolt v1.3.9 h1:8x7aARPEXiXbHmtUwAIv7eV2fQFHrLLavdiJ3uzJXoI=
+go.etcd.io/bbolt v1.3.9/go.mod h1:zaO32+Ti0PK1ivdPtgMESzuzL2VPoIG1PCQNvOdo/dE=
+go.etcd.io/etcd/api/v3 v3.5.16 h1:WvmyJVbjWqK4R1E+B12RRHz3bRGy9XVfh++MgbN+6n0=
+go.etcd.io/etcd/api/v3 v3.5.16/go.mod h1:1P4SlIP/VwkDmGo3OlOD7faPeP8KDIFhqvciH5EfN28=
+go.etcd.io/etcd/client/pkg/v3 v3.5.16 h1:ZgY48uH6UvB+/7R9Yf4x574uCO3jIx0TRDyetSfId3Q=
+go.etcd.io/etcd/client/pkg/v3 v3.5.16/go.mod h1:V8acl8pcEK0Y2g19YlOV9m9ssUe6MgiDSobSoaBAM0E=
+go.etcd.io/etcd/client/v2 v2.305.13 h1:RWfV1SX5jTU0lbCvpVQe3iPQeAHETWdOTb6pxhd77C8=
+go.etcd.io/etcd/client/v2 v2.305.13/go.mod h1:iQnL7fepbiomdXMb3om1rHq96htNNGv2sJkEcZGDRRg=
+go.etcd.io/etcd/client/v3 v3.5.16 h1:sSmVYOAHeC9doqi0gv7v86oY/BTld0SEFGaxsU9eRhE=
+go.etcd.io/etcd/client/v3 v3.5.16/go.mod h1:X+rExSGkyqxvu276cr2OwPLBaeqFu1cIl4vmRjAD/50=
+go.etcd.io/etcd/pkg/v3 v3.5.13 h1:st9bDWNsKkBNpP4PR1MvM/9NqUPfvYZx/YXegsYEH8M=
+go.etcd.io/etcd/pkg/v3 v3.5.13/go.mod h1:N+4PLrp7agI/Viy+dUYpX7iRtSPvKq+w8Y14d1vX+m0=
+go.etcd.io/etcd/raft/v3 v3.5.13 h1:7r/NKAOups1YnKcfro2RvGGo2PTuizF/xh26Z2CTAzA=
+go.etcd.io/etcd/raft/v3 v3.5.13/go.mod h1:uUFibGLn2Ksm2URMxN1fICGhk8Wu96EfDQyuLhAcAmw=
+go.etcd.io/etcd/server/v3 v3.5.13 h1:V6KG+yMfMSqWt+lGnhFpP5z5dRUj1BDRJ5k1fQ9DFok=
+go.etcd.io/etcd/server/v3 v3.5.13/go.mod h1:K/8nbsGupHqmr5MkgaZpLlH1QdX1pcNQLAkODy44XcQ=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.53.0 h1:9G6E0TXzGFVfTnawRzrPl83iHOAV7L8NJiR8RSGYV1g=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.53.0/go.mod h1:azvtTADFQJA8mX80jIH/akaE7h+dbm/sVuaHqN13w74=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 h1:4K4tsIXefpVJtvA/8srF4V4y0akAoPHkIslgAkjixJA=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0/go.mod h1:jjdQuTGVsXV4vSs+CJ2qYDeDPf9yIJV23qlIzBm73Vg=
+go.opentelemetry.io/otel v1.28.0 h1:/SqNcYk+idO0CxKEUOtKQClMK/MimZihKYMruSMViUo=
+go.opentelemetry.io/otel v1.28.0/go.mod h1:q68ijF8Fc8CnMHKyzqL6akLO46ePnjkgfIMIjUIX9z4=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 h1:3Q/xZUyC1BBkualc9ROb4G8qkH90LXEIICcs5zv1OYY=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0/go.mod h1:s75jGIWA9OfCMzF0xr+ZgfrB5FEbbV7UuYo32ahUiFI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 h1:qFffATk0X+HD+f1Z8lswGiOQYKHRlzfmdJm0wEaVrFA=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0/go.mod h1:MOiCmryaYtc+V0Ei+Tx9o5S1ZjA7kzLucuVuyzBZloQ=
+go.opentelemetry.io/otel/metric v1.28.0 h1:f0HGvSl1KRAU1DLgLGFjrwVyismPlnuU6JD6bOeuA5Q=
+go.opentelemetry.io/otel/metric v1.28.0/go.mod h1:Fb1eVBFZmLVTMb6PPohq3TO9IIhUisDsbJoL/+uQW4s=
+go.opentelemetry.io/otel/sdk v1.28.0 h1:b9d7hIry8yZsgtbmM0DKyPWMMUMlK9NEKuIG4aBqWyE=
+go.opentelemetry.io/otel/sdk v1.28.0/go.mod h1:oYj7ClPUA7Iw3m+r7GeEjz0qckQRJK2B8zjcZEfu7Pg=
+go.opentelemetry.io/otel/trace v1.28.0 h1:GhQ9cUuQGmNDd5BTCP2dAvv75RdMxEfTmYejp+lkx9g=
+go.opentelemetry.io/otel/trace v1.28.0/go.mod h1:jPyXzNPg6da9+38HEwElrQiHlVMTnVfM3/yv2OlIHaI=
+go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
+go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
-go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
-go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
-golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
+golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -244,48 +228,50 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.45.0 h1:RLBg5JKixCy82FtLJpeNlVM0nrSqpCRYzVU1n8kj0tM=
-golang.org/x/net v0.45.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
-golang.org/x/oauth2 v0.29.0 h1:WdYw2tdTK1S8olAzWHdgeqfy+Mtm9XNhv/xJsY65d98=
-golang.org/x/oauth2 v0.29.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
+golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
+golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
+golang.org/x/oauth2 v0.23.0 h1:PbgcYx2W7i4LvjJWEbf0ngHV6qJYr86PkAV3bXdLEbs=
+golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
-golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
-golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ=
-golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA=
+golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
+golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
-golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
-golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
-golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/time v0.7.0 h1:ntUhktv3OPE6TgYxXWv9vKvUSJyIFJlyohwbkEwPrKQ=
+golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.37.0 h1:DVSRzp7FwePZW356yEAChSdNcQo6Nsp+fex1SUW09lE=
-golang.org/x/tools v0.37.0/go.mod h1:MBN5QPQtLMHVdvsbtarmTNukZDdgwdwlO5qGacAzF0w=
+golang.org/x/tools v0.26.0 h1:v/60pFQmzmT9ExmjDv2gGIfi3OqfKoEP6I5+umXlbnQ=
+golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
 gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
-google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb h1:p31xT4yrYrSM/G4Sn2+TNUkVhFCbG9y8itM2S6Th950=
-google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:jbe3Bkdp+Dh2IrslsFCklNhweNTBgSYanP1UXhJDhKg=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb h1:TLPQVbx1GJ8VKZxz52VAxl1EBgKXXbTiU9Fc5fZeLn4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:LuRYeWDFV6WOn90g357N17oMCaxpgCnbi/44qJvDn2I=
-google.golang.org/grpc v1.72.1 h1:HR03wO6eyZ7lknl75XlxABNVLLFc2PAb6mHlYh756mA=
-google.golang.org/grpc v1.72.1/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
-google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
-google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d h1:VBu5YqKPv6XiJ199exd8Br+Aetz+o08F+PLMnwJQHAY=
+google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d/go.mod h1:yZTlhN0tQnXo3h00fuXNCxJdLdIdnVFVBaRJ5LWBbw4=
+google.golang.org/genproto/googleapis/api v0.0.0-20240528184218-531527333157 h1:7whR9kGa5LUwFtpLm2ArCEejtnxlGeLbAyjFY8sGNFw=
+google.golang.org/genproto/googleapis/api v0.0.0-20240528184218-531527333157/go.mod h1:99sLkeliLXfdj2J75X3Ho+rrVCaJze0uwN7zDDkjPVU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 h1:BwIjyKYGsK9dMCBOorzRri8MQwmi7mT9rGHsCEinZkA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
+google.golang.org/grpc v1.65.0 h1:bs/cUb4lp1G5iImFFd3u5ixQzweKizoZJAwBNLR42lc=
+google.golang.org/grpc v1.65.0/go.mod h1:WgYC2ypjlB0EiQi6wdKixMqukr6lBc0Vo+oOgjrM5ZQ=
+google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
+google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -295,42 +281,39 @@ gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
-k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
-k8s.io/apiextensions-apiserver v0.34.1 h1:NNPBva8FNAPt1iSVwIE0FsdrVriRXMsaWFMqJbII2CI=
-k8s.io/apiextensions-apiserver v0.34.1/go.mod h1:hP9Rld3zF5Ay2Of3BeEpLAToP+l4s5UlxiHfqRaRcMc=
-k8s.io/apiserver v0.34.1 h1:U3JBGdgANK3dfFcyknWde1G6X1F4bg7PXuvlqt8lITA=
-k8s.io/apiserver v0.34.1/go.mod h1:eOOc9nrVqlBI1AFCvVzsob0OxtPZUCPiUJL45JOTBG0=
-k8s.io/client-go v0.34.1 h1:ZUPJKgXsnKwVwmKKdPfw4tB58+7/Ik3CrjOEhsiZ7mY=
-k8s.io/client-go v0.34.1/go.mod h1:kA8v0FP+tk6sZA0yKLRG67LWjqufAoSHA2xVGKw9Of8=
-k8s.io/component-base v0.34.1 h1:v7xFgG+ONhytZNFpIz5/kecwD+sUhVE6HU7qQUiRM4A=
-k8s.io/component-base v0.34.1/go.mod h1:mknCpLlTSKHzAQJJnnHVKqjxR7gBeHRv0rPXA7gdtQ0=
+k8s.io/api v0.31.2 h1:3wLBbL5Uom/8Zy98GRPXpJ254nEFpl+hwndmk9RwmL0=
+k8s.io/api v0.31.2/go.mod h1:bWmGvrGPssSK1ljmLzd3pwCQ9MgoTsRCuK35u6SygUk=
+k8s.io/apiextensions-apiserver v0.31.2 h1:W8EwUb8+WXBLu56ser5IudT2cOho0gAKeTOnywBLxd0=
+k8s.io/apiextensions-apiserver v0.31.2/go.mod h1:i+Geh+nGCJEGiCGR3MlBDkS7koHIIKWVfWeRFiOsUcM=
+k8s.io/apimachinery v0.31.2 h1:i4vUt2hPK56W6mlT7Ry+AO8eEsyxMD1U44NR22CLTYw=
+k8s.io/apimachinery v0.31.2/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
+k8s.io/apiserver v0.31.2 h1:VUzOEUGRCDi6kX1OyQ801m4A7AUPglpsmGvdsekmcI4=
+k8s.io/apiserver v0.31.2/go.mod h1:o3nKZR7lPlJqkU5I3Ove+Zx3JuoFjQobGX1Gctw6XuE=
+k8s.io/client-go v0.31.2 h1:Y2F4dxU5d3AQj+ybwSMqQnpZH9F30//1ObxOKlTI9yc=
+k8s.io/client-go v0.31.2/go.mod h1:NPa74jSVR/+eez2dFsEIHNa+3o09vtNaWwWwb1qSxSs=
+k8s.io/component-base v0.31.2 h1:Z1J1LIaC0AV+nzcPRFqfK09af6bZ4D1nAOpWsy9owlA=
+k8s.io/component-base v0.31.2/go.mod h1:9PeyyFN/drHjtJZMCTkSpQJS3U9OXORnHQqMLDz0sUQ=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kms v0.34.1 h1:iCFOvewDPzWM9fMTfyIPO+4MeuZ0tcZbugxLNSHFG4w=
-k8s.io/kms v0.34.1/go.mod h1:s1CFkLG7w9eaTYvctOxosx88fl4spqmixnNpys0JAtM=
-k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b h1:MloQ9/bdJyIu9lb1PzujOPolHyvO06MXG5TUIj2mNAA=
-k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b/go.mod h1:UZ2yyWbFTpuhSbFhv24aGNOdoRdJZgsIObGBUaYVsts=
-k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d h1:wAhiDyZ4Tdtt7e46e9M5ZSAJ/MnPGPs+Ki1gHw4w1R0=
-k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 h1:jpcvIRr3GLoUoEKRkHKSmGjxb6lWwrBlJsXc+eUYQHM=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
-sigs.k8s.io/controller-runtime v0.22.2 h1:cK2l8BGWsSWkXz09tcS4rJh95iOLney5eawcK5A33r4=
-sigs.k8s.io/controller-runtime v0.22.2/go.mod h1:+QX1XUpTXN4mLoblf4tqr5CQcyHPAki2HLXqQMY6vh8=
-sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
-sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
-sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
-sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v4 v4.7.0 h1:qPeWmscJcXP0snki5IYF79Z8xrl8ETFxgMd7wez1XkI=
-sigs.k8s.io/structured-merge-diff/v4 v4.7.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+k8s.io/kms v0.31.2 h1:pyx7l2qVOkClzFMIWMVF/FxsSkgd+OIGH7DecpbscJI=
+k8s.io/kms v0.31.2/go.mod h1:OZKwl1fan3n3N5FFxnW5C4V3ygrah/3YXeJWS3O6+94=
+k8s.io/kube-openapi v0.0.0-20240827152857-f7e401e7b4c2 h1:GKE9U8BH16uynoxQii0auTjmmmuZ3O0LFMN6S0lPPhI=
+k8s.io/kube-openapi v0.0.0-20240827152857-f7e401e7b4c2/go.mod h1:coRQXBK9NxO98XUv3ZD6AK3xzHCxV6+b7lrquKwaKzA=
+k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A=
+k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.0 h1:CPT0ExVicCzcpeN4baWEV2ko2Z/AsiZgEdwgcfwLgMo=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.0/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
+sigs.k8s.io/controller-runtime v0.19.0 h1:nWVM7aq+Il2ABxwiCizrVDSlmDcshi9llbaFbC0ji/Q=
+sigs.k8s.io/controller-runtime v0.19.0/go.mod h1:iRmWllt8IlaLjvTTDLhRBXIEtkCK6hwVBJJsYS9Ajf4=
+sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
+sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
+sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
 sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
-sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
-sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=

hack/check-optional-repos.sh

@@ -1,145 +0,0 @@
-#!/bin/bash
-###############################################################################
-# check-optional-repos.sh - Check optional repositories for tags and commits #
-# during a release period                                                     #
-###############################################################################
-set -eu
-
-# Function to ensure repository is cloned and up-to-date
-update_repo() {
-  local repo_name=$1
-  local repo_url="https://github.com/cozystack/${repo_name}.git"
-  
-  mkdir -p _repos
-  cd _repos
-  
-  if [ -d "$repo_name" ]; then
-    cd "$repo_name"
-    git fetch --all --tags --force
-    git checkout main 2>/dev/null || git checkout master
-    git pull
-  else
-    git clone "$repo_url"
-    cd "$repo_name"
-  fi
-  
-  cd ../..
-}
-
-# Check if required parameters are provided
-if [ $# -lt 2 ]; then
-  echo "Usage: $0 <RELEASE_START> <RELEASE_END>"
-  echo "Example: $0 '2025-10-10 12:27:31 +0400' '2025-10-13 16:04:33 +0200'"
-  exit 1
-fi
-
-RELEASE_START="$1"
-RELEASE_END="$2"
-
-# Get the script directory to return to it later
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-COZYSTACK_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-
-cd "$COZYSTACK_ROOT"
-
-echo "Checking optional repositories for tags and commits between:"
-echo "  Start: $RELEASE_START"
-echo "  End: $RELEASE_END"
-echo ""
-
-# Loop through ALL optional repositories
-for repo_name in talm boot-to-talos cozypkg cozy-proxy; do
-  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  echo "Checking repository: $repo_name"
-  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  
-  # Update/clone repository
-  update_repo "$repo_name"
-  
-  cd "_repos/$repo_name"
-  REPO_NAME=$(basename "$(pwd)")
-  git fetch --all --tags --force
-  
-  # Check for tags matching release version pattern or created during release period
-  TAGS=$(git for-each-ref --format='%(refname:short) %(creatordate)' refs/tags 2>/dev/null | \
-    awk -v start="$RELEASE_START" -v end="$RELEASE_END" '$2 >= start && $2 <= end {print $1}' || true)
-  
-  if [ -n "$TAGS" ]; then
-    echo "Found tags in $repo_name: $TAGS"
-    PREV_TAG=$(echo "$TAGS" | head -1)
-    NEW_TAG=$(echo "$TAGS" | tail -1)
-    
-    echo ""
-    echo "Commits between $PREV_TAG and $NEW_TAG:"
-    # Include merge commits to capture backports
-    git log "$PREV_TAG..$NEW_TAG" --format="%H|%s|%an" 2>/dev/null | while IFS='|' read -r commit_hash subject author_name; do
-      if [ -z "$commit_hash" ]; then
-        continue
-      fi
-      
-      # Get PR number from commit message
-      COMMIT_MSG=$(git log -1 --format=%B "$commit_hash" 2>/dev/null || echo "")
-      PR_NUMBER=$(echo "$COMMIT_MSG" | grep -oE '#[0-9]+' | head -1 | tr -d '#' || echo "")
-      
-      # Get author: prioritize PR author, fallback to commit author
-      GITHUB_USERNAME=""
-      if [ -n "$PR_NUMBER" ]; then
-        GITHUB_USERNAME=$(gh pr view "$PR_NUMBER" --repo "cozystack/$REPO_NAME" --json author --jq '.author.login // empty' 2>/dev/null || echo "")
-      fi
-      if [ -z "$GITHUB_USERNAME" ]; then
-        GITHUB_USERNAME=$(gh api "repos/cozystack/$REPO_NAME/commits/$commit_hash" --jq '.author.login // empty' 2>/dev/null || echo "")
-      fi
-      
-      if [ -n "$PR_NUMBER" ]; then
-        echo "  $commit_hash|$subject|$author_name|$GITHUB_USERNAME|cozystack/$REPO_NAME#$PR_NUMBER"
-      else
-        echo "  $commit_hash|$subject|$author_name|$GITHUB_USERNAME|cozystack/$REPO_NAME@${commit_hash:0:7}"
-      fi
-    done
-  else
-    echo "No tags found in $repo_name during release period"
-    
-    # Check for commits by dates if no exact version tags
-    # Include merge commits to capture backports
-    COMMITS=$(git log --since="$RELEASE_START" --until="$RELEASE_END" --format="%H|%s|%an" 2>/dev/null || true)
-    
-    if [ -n "$COMMITS" ]; then
-      echo ""
-      echo "Commits found by date range:"
-      echo "$COMMITS" | while IFS='|' read -r commit_hash subject author_name; do
-        if [ -z "$commit_hash" ]; then
-          continue
-        fi
-        
-        # Get PR number from commit message
-        COMMIT_MSG=$(git log -1 --format=%B "$commit_hash" 2>/dev/null || echo "")
-        PR_NUMBER=$(echo "$COMMIT_MSG" | grep -oE '#[0-9]+' | head -1 | tr -d '#' || echo "")
-        
-        # Get author: prioritize PR author, fallback to commit author
-        GITHUB_USERNAME=""
-        if [ -n "$PR_NUMBER" ]; then
-          GITHUB_USERNAME=$(gh pr view "$PR_NUMBER" --repo "cozystack/$REPO_NAME" --json author --jq '.author.login // empty' 2>/dev/null || echo "")
-        fi
-        if [ -z "$GITHUB_USERNAME" ]; then
-          GITHUB_USERNAME=$(gh api "repos/cozystack/$REPO_NAME/commits/$commit_hash" --jq '.author.login // empty' 2>/dev/null || echo "")
-        fi
-        
-        if [ -n "$PR_NUMBER" ]; then
-          echo "  $commit_hash|$subject|$author_name|$GITHUB_USERNAME|cozystack/$REPO_NAME#$PR_NUMBER"
-        else
-          echo "  $commit_hash|$subject|$author_name|$GITHUB_USERNAME|cozystack/$REPO_NAME@${commit_hash:0:7}"
-        fi
-      done
-    else
-      echo "No commits found in $repo_name during release period"
-    fi
-  fi
-  
-  echo ""
-  cd "$COZYSTACK_ROOT"
-done
-
-echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-echo "Finished checking all optional repositories"
-echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-

hack/e2e-apps/run-kubernetes.sh

@@ -80,41 +80,58 @@ EOF
   # Wait for the machine deployment to scale to 2 replicas (timeout after 1 minute)
   kubectl wait machinedeployment kubernetes-${test_name}-md0 -n tenant-test --timeout=1m --for=jsonpath='{.status.replicas}'=2
   # Get the admin kubeconfig and save it to a file
-  kubectl get secret kubernetes-${test_name}-admin-kubeconfig -ojsonpath='{.data.super-admin\.conf}' -n tenant-test | base64 -d > tenantkubeconfig-${test_name}
+  kubectl get secret kubernetes-${test_name}-admin-kubeconfig -ojsonpath='{.data.super-admin\.conf}' -n tenant-test | base64 -d > tenantkubeconfig
 
   # Update the kubeconfig to use localhost for the API server
-  yq -i ".clusters[0].cluster.server = \"https://localhost:${port}\"" tenantkubeconfig-${test_name}
+  yq -i ".clusters[0].cluster.server = \"https://localhost:${port}\"" tenantkubeconfig
 
 
   # Set up port forwarding to the Kubernetes API server for a 200 second timeout
   bash -c 'timeout 300s kubectl port-forward service/kubernetes-'"${test_name}"' -n tenant-test '"${port}"':6443 > /dev/null 2>&1 &'
   # Verify the Kubernetes version matches what we expect (retry for up to 20 seconds)
-  timeout 20 sh -ec 'until kubectl --kubeconfig tenantkubeconfig-'"${test_name}"' version 2>/dev/null | grep -Fq "Server Version: ${k8s_version}"; do sleep 5; done'
+  timeout 20 sh -ec 'until kubectl --kubeconfig tenantkubeconfig version 2>/dev/null | grep -Fq "Server Version: ${k8s_version}"; do sleep 5; done'
 
   # Wait for the nodes to be ready (timeout after 2 minutes)
   timeout 3m bash -c '
-    until [ "$(kubectl --kubeconfig tenantkubeconfig-'"${test_name}"' get nodes -o jsonpath="{.items[*].metadata.name}" | wc -w)" -eq 2 ]; do
+    until [ "$(kubectl --kubeconfig tenantkubeconfig get nodes -o jsonpath="{.items[*].metadata.name}" | wc -w)" -eq 2 ]; do
       sleep 2
     done
   '
   # Verify the nodes are ready
-  kubectl --kubeconfig tenantkubeconfig-${test_name} wait node --all --timeout=2m --for=condition=Ready
-  kubectl --kubeconfig tenantkubeconfig-${test_name} get nodes -o wide
+  kubectl --kubeconfig tenantkubeconfig wait node --all --timeout=2m --for=condition=Ready
+  kubectl --kubeconfig tenantkubeconfig get nodes -o wide
 
   # Verify the kubelet version matches what we expect
-  versions=$(kubectl --kubeconfig "tenantkubeconfig-${test_name}" \
-    get nodes -o jsonpath='{.items[*].status.nodeInfo.kubeletVersion}')
-  
+  versions=$(kubectl --kubeconfig tenantkubeconfig get nodes -o jsonpath='{.items[*].status.nodeInfo.kubeletVersion}')
   node_ok=true
-  
+
+  case "$k8s_version" in
+    v1.32*)
+      echo "⚠️  TODO: Temporary stub — allowing nodes with v1.33 while k8s_version is v1.32"
+      ;;
+  esac
+
   for v in $versions; do
-    case "$v" in
-      "${k8s_version}" | "${k8s_version}".* | "${k8s_version}"-*)
-        # acceptable
+    case "$k8s_version" in
+      v1.32|v1.32.*)
+        case "$v" in
+          v1.32 | v1.32.* | v1.32-* | v1.33 | v1.33.* | v1.33-*)
+            ;;
+          *)
+            node_ok=false
+            break
+            ;;
+        esac
         ;;
       *)
-        node_ok=false
-        break
+        case "$v" in
+          "${k8s_version}" | "${k8s_version}".* | "${k8s_version}"-*)
+            ;;
+          *)
+            node_ok=false
+            break
+            ;;
+        esac
         ;;
     esac
   done

hack/e2e-test-openapi.bats

@@ -42,12 +42,3 @@
     exit 1
   fi
 }
-
-@test "Create and delete namespace" {
-  kubectl create ns cozy-test-create-and-delete-namespace --dry-run=client -o yaml | kubectl apply -f -
-  if ! kubectl delete ns cozy-test-create-and-delete-namespace; then
-    echo "Failed to delete namespace"
-    kubectl describe ns cozy-test-create-and-delete-namespace
-    exit 1
-  fi
-}

hack/helm-unit-tests.sh

@@ -1,59 +0,0 @@
-#!/bin/sh
-set -eu
-
-# Script to run unit tests for all Helm charts.
-# It iterates through directories in packages/apps, packages/extra,
-# packages/system, and packages/library and runs the 'test' Makefile
-# target if it exists.
-
-FAILED_DIRS_FILE="$(mktemp)"
-trap 'rm -f "$FAILED_DIRS_FILE"' EXIT
-
-tests_found=0
-
-check_and_run_test() {
-    dir="$1"
-    makefile="$dir/Makefile"
-
-    if [ ! -f "$makefile" ]; then
-        return 0
-    fi
-
-    if make -C "$dir" -n test >/dev/null 2>&1; then
-        echo "Running tests in $dir"
-        tests_found=$((tests_found + 1))
-        if ! make -C "$dir" test; then
-            printf '%s\n' "$dir" >> "$FAILED_DIRS_FILE"
-            return 1
-        fi
-    fi
-
-    return 0
-}
-
-for package_dir in packages/apps packages/extra packages/system packages/library; do
-    if [ ! -d "$package_dir" ]; then
-        echo "Warning: Directory $package_dir does not exist, skipping..." >&2
-        continue
-    fi
-
-    for dir in "$package_dir"/*; do
-        [ -d "$dir" ] || continue
-        check_and_run_test "$dir" || true
-    done
-done
-
-if [ "$tests_found" -eq 0 ]; then
-    echo "No directories with 'test' Makefile targets found."
-    exit 0
-fi
-
-if [ -s "$FAILED_DIRS_FILE" ]; then
-    echo "ERROR: Tests failed in the following directories:" >&2
-    while IFS= read -r dir; do
-        echo "  - $dir" >&2
-    done < "$FAILED_DIRS_FILE"
-    exit 1
-fi
-
-echo "All Helm unit tests passed."

hack/update-codegen.sh

@@ -23,15 +23,6 @@ CODEGEN_PKG=${CODEGEN_PKG:-$(cd "${SCRIPT_ROOT}"; ls -d -1 ./vendor/k8s.io/code-
 API_KNOWN_VIOLATIONS_DIR="${API_KNOWN_VIOLATIONS_DIR:-"${SCRIPT_ROOT}/api/api-rules"}"
 UPDATE_API_KNOWN_VIOLATIONS="${UPDATE_API_KNOWN_VIOLATIONS:-true}"
 CONTROLLER_GEN="go run sigs.k8s.io/controller-tools/cmd/controller-gen@v0.16.4"
-TMPDIR=$(mktemp -d)
-OPERATOR_CRDDIR=packages/core/installer/crds
-BACKUPSTRATEGY_CRDDIR=packages/system/backupstrategy-controller/definitions
-COZY_CONTROLLER_CRDDIR=packages/system/cozystack-controller/crds
-COZY_RD_CRDDIR=packages/system/cozystack-resource-definition-crd/definition
-BACKUPS_CORE_CRDDIR=packages/system/backup-controller/definitions
-BACKUPSTRATEGY_CRDDIR=packages/system/backupstrategy-controller/definitions
-
-trap 'rm -rf ${TMPDIR}' EXIT
 
 source "${CODEGEN_PKG}/kube_codegen.sh"
 
@@ -62,15 +53,6 @@ kube::codegen::gen_openapi \
     "${SCRIPT_ROOT}/pkg/apis"
 
 $CONTROLLER_GEN object:headerFile="hack/boilerplate.go.txt" paths="./api/..."
-$CONTROLLER_GEN rbac:roleName=manager-role crd paths="./api/..." output:crd:artifacts:config=${TMPDIR} 
-
-mv ${TMPDIR}/cozystack.io_packages.yaml ${OPERATOR_CRDDIR}/cozystack.io_packages.yaml
-mv ${TMPDIR}/cozystack.io_packagesources.yaml ${OPERATOR_CRDDIR}/cozystack.io_packagesources.yaml
-
-mv ${TMPDIR}/cozystack.io_cozystackresourcedefinitions.yaml \
-        ${COZY_RD_CRDDIR}/cozystack.io_cozystackresourcedefinitions.yaml
-
-mv ${TMPDIR}/backups.cozystack.io*.yaml ${BACKUPS_CORE_CRDDIR}/
-mv ${TMPDIR}/strategy.backups.cozystack.io*.yaml ${BACKUPSTRATEGY_CRDDIR}/
-
-mv ${TMPDIR}/*.yaml ${COZY_CONTROLLER_CRDDIR}/
+$CONTROLLER_GEN rbac:roleName=manager-role crd paths="./api/..." output:crd:artifacts:config=packages/system/cozystack-controller/crds
+mv packages/system/cozystack-controller/crds/cozystack.io_cozystackresourcedefinitions.yaml \
+        packages/system/cozystack-resource-definition-crd/definition/cozystack.io_cozystackresourcedefinitions.yaml

hack/upload-releasenotes.sh

@@ -1,40 +0,0 @@
-#!/bin/sh
-
-if [ $# -ne 1 ]; then
-  echo "Usage: $0 <version>"
-  echo "Example: 0.37.*"
-  exit 1
-fi
-
-VERSION_PATTERN="$1"
-
-# Collect matching files first
-FILES=$(find docs/changelogs -name "v${VERSION_PATTERN}.md" 2>/dev/null || true)
-
-if [ -z "$FILES" ]; then
-  echo "No changelog files found matching pattern: v${VERSION_PATTERN}.md"
-  exit 1
-fi
-
-# Process each file
-echo "$FILES" | while IFS= read -r file; do
-  if [ -z "$file" ]; then
-    continue
-  fi
-  
-  # Extract version from filename safely (basename without extension)
-  version=$(basename "$file" .md)
-  
-  if [ -z "$version" ]; then
-    echo "Warning: Could not extract version from file: $file"
-    continue
-  fi
-  
-  echo "Uploading release notes for version: $version"
-  
-  # Check exit status of gh release edit
-  if ! gh release edit "$version" --notes-file "docs/changelogs/${version}.md"; then
-    echo "Error: Failed to upload release notes for version: $version"
-    exit 1
-  fi
-done

internal/backupcontroller/factory/backupjob.go

@@ -1,28 +0,0 @@
-package factory
-
-import (
-	"fmt"
-	"time"
-
-	backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1"
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-func BackupJob(p *backupsv1alpha1.Plan, scheduledFor time.Time) *backupsv1alpha1.BackupJob {
-	job := &backupsv1alpha1.BackupJob{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      fmt.Sprintf("%s-%d", p.Name, scheduledFor.Unix()/60),
-			Namespace: p.Namespace,
-		},
-		Spec: backupsv1alpha1.BackupJobSpec{
-			PlanRef: &corev1.LocalObjectReference{
-				Name: p.Name,
-			},
-			ApplicationRef: *p.Spec.ApplicationRef.DeepCopy(),
-			StorageRef:     *p.Spec.StorageRef.DeepCopy(),
-			StrategyRef:    *p.Spec.StrategyRef.DeepCopy(),
-		},
-	}
-	return job
-}

internal/backupcontroller/jobstrategy_controller.go

@@ -1,31 +0,0 @@
-package backupcontroller
-
-import (
-	"context"
-
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-
-	backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1"
-)
-
-// BackupJobStrategyReconciler reconciles BackupJob with a strategy referencing
-// Job.strategy.backups.cozystack.io objects.
-type BackupJobStrategyReconciler struct {
-	client.Client
-	Scheme *runtime.Scheme
-}
-
-func (r *BackupJobStrategyReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
-	_ = log.FromContext(ctx)
-	return ctrl.Result{}, nil
-}
-
-// SetupWithManager registers our controller with the Manager and sets up watches.
-func (r *BackupJobStrategyReconciler) SetupWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewControllerManagedBy(mgr).
-		For(&backupsv1alpha1.BackupJob{}).
-		Complete(r)
-}

internal/backupcontroller/plan_controller.go

@@ -1,104 +0,0 @@
-package backupcontroller
-
-import (
-	"context"
-	"fmt"
-	"time"
-
-	cron "github.com/robfig/cron/v3"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/api/meta"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-
-	backupsv1alpha1 "github.com/cozystack/cozystack/api/backups/v1alpha1"
-	"github.com/cozystack/cozystack/internal/backupcontroller/factory"
-)
-
-const (
-	minRequeueDelay         = 30 * time.Second
-	startingDeadlineSeconds = 300 * time.Second
-)
-
-// PlanReconciler reconciles a Plan object
-type PlanReconciler struct {
-	client.Client
-	Scheme *runtime.Scheme
-}
-
-func (r *PlanReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
-	log := log.FromContext(ctx)
-
-	log.V(2).Info("reconciling")
-
-	p := &backupsv1alpha1.Plan{}
-
-	if err := r.Get(ctx, client.ObjectKey{Namespace: req.Namespace, Name: req.Name}, p); err != nil {
-		if apierrors.IsNotFound(err) {
-			log.V(3).Info("Plan not found")
-			return ctrl.Result{}, nil
-		}
-		return ctrl.Result{}, err
-	}
-
-	tCheck := time.Now().Add(-startingDeadlineSeconds)
-	sch, err := cron.ParseStandard(p.Spec.Schedule.Cron)
-	if err != nil {
-		errWrapped := fmt.Errorf("could not parse cron %s: %w", p.Spec.Schedule.Cron, err)
-		log.Error(err, "could not parse cron", "cron", p.Spec.Schedule.Cron)
-		meta.SetStatusCondition(&p.Status.Conditions, metav1.Condition{
-			Type:    backupsv1alpha1.PlanConditionError,
-			Status:  metav1.ConditionTrue,
-			Reason:  "Failed to parse cron spec",
-			Message: errWrapped.Error(),
-		})
-		if err := r.Status().Update(ctx, p); err != nil {
-			return ctrl.Result{}, err
-		}
-		return ctrl.Result{}, nil
-	}
-
-	// Clear error condition if cron parsing succeeds
-	if condition := meta.FindStatusCondition(p.Status.Conditions, backupsv1alpha1.PlanConditionError); condition != nil && condition.Status == metav1.ConditionTrue {
-		meta.SetStatusCondition(&p.Status.Conditions, metav1.Condition{
-			Type:    backupsv1alpha1.PlanConditionError,
-			Status:  metav1.ConditionFalse,
-			Reason:  "Cron spec is valid",
-			Message: "The cron schedule has been successfully parsed",
-		})
-		if err := r.Status().Update(ctx, p); err != nil {
-			return ctrl.Result{}, err
-		}
-	}
-
-	tNext := sch.Next(tCheck)
-
-	if time.Now().Before(tNext) {
-		return ctrl.Result{RequeueAfter: tNext.Sub(time.Now())}, nil
-	}
-
-	job := factory.BackupJob(p, tNext)
-	if err := controllerutil.SetControllerReference(p, job, r.Scheme); err != nil {
-		return ctrl.Result{}, err
-	}
-
-	if err := r.Create(ctx, job); err != nil {
-		if apierrors.IsAlreadyExists(err) {
-			return ctrl.Result{RequeueAfter: startingDeadlineSeconds}, nil
-		}
-		return ctrl.Result{}, err
-	}
-
-	return ctrl.Result{RequeueAfter: startingDeadlineSeconds}, nil
-}
-
-// SetupWithManager registers our controller with the Manager and sets up watches.
-func (r *PlanReconciler) SetupWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewControllerManagedBy(mgr).
-		For(&backupsv1alpha1.Plan{}).
-		Complete(r)
-}

internal/controller/cozystackresource_controller.go

@@ -5,13 +5,11 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
-	"fmt"
 	"slices"
 	"sync"
 	"time"
 
 	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
-	helmv2 "github.com/fluxcd/helm-controller/api/v2"
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -39,11 +37,6 @@ type CozystackResourceDefinitionReconciler struct {
 }
 
 func (r *CozystackResourceDefinitionReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
-	if err := r.reconcileCozyRDAndUpdateHelmReleases(ctx); err != nil {
-		return ctrl.Result{}, err
-	}
-
-	// Continue with debounced restart logic
 	return r.debouncedRestart(ctx)
 }
 
@@ -192,138 +185,3 @@ func sortCozyRDs(a, b cozyv1alpha1.CozystackResourceDefinition) int {
 	}
 	return 1
 }
-
-// reconcileCozyRDAndUpdateHelmReleases reconciles all CozystackResourceDefinitions and updates HelmReleases from them
-func (r *CozystackResourceDefinitionReconciler) reconcileCozyRDAndUpdateHelmReleases(ctx context.Context) error {
-	logger := log.FromContext(ctx)
-
-	// List all CozystackResourceDefinitions
-	crdList := &cozyv1alpha1.CozystackResourceDefinitionList{}
-	if err := r.List(ctx, crdList); err != nil {
-		logger.Error(err, "failed to list CozystackResourceDefinitions")
-		return err
-	}
-
-	// Update HelmReleases for each CRD
-	for i := range crdList.Items {
-		crd := &crdList.Items[i]
-		if err := r.updateHelmReleasesForCRD(ctx, crd); err != nil {
-			logger.Error(err, "failed to update HelmReleases for CRD", "crd", crd.Name)
-			// Continue with other CRDs even if one fails
-		}
-	}
-
-	return nil
-}
-
-// updateHelmReleasesForCRD updates all HelmReleases that match the application labels from CozystackResourceDefinition
-func (r *CozystackResourceDefinitionReconciler) updateHelmReleasesForCRD(ctx context.Context, crd *cozyv1alpha1.CozystackResourceDefinition) error {
-	logger := log.FromContext(ctx)
-
-	// Use application labels to find HelmReleases
-	// Labels: apps.cozystack.io/application.kind and apps.cozystack.io/application.group
-	applicationKind := crd.Spec.Application.Kind
-	
-	// Validate that applicationKind is non-empty
-	if applicationKind == "" {
-		logger.Error(fmt.Errorf("Application.Kind is empty"), "Skipping HelmRelease update: invalid CozystackResourceDefinition", "crd", crd.Name)
-		return nil
-	}
-	
-	applicationGroup := "apps.cozystack.io" // All applications use this group
-
-	// Build label selector for HelmReleases
-	// Only reconcile HelmReleases with cozystack.io/ui=true label
-	labelSelector := client.MatchingLabels{
-		"apps.cozystack.io/application.kind":  applicationKind,
-		"apps.cozystack.io/application.group": applicationGroup,
-		"cozystack.io/ui":                      "true",
-	}
-
-	// List all HelmReleases with matching labels
-	hrList := &helmv2.HelmReleaseList{}
-	if err := r.List(ctx, hrList, labelSelector); err != nil {
-		logger.Error(err, "failed to list HelmReleases", "kind", applicationKind, "group", applicationGroup)
-		return err
-	}
-
-	logger.V(4).Info("Found HelmReleases to update", "crd", crd.Name, "kind", applicationKind, "count", len(hrList.Items))
-
-	// Update each HelmRelease
-	for i := range hrList.Items {
-		hr := &hrList.Items[i]
-		if err := r.updateHelmReleaseChart(ctx, hr, crd); err != nil {
-			logger.Error(err, "failed to update HelmRelease", "name", hr.Name, "namespace", hr.Namespace)
-			continue
-		}
-	}
-
-	return nil
-}
-
-// updateHelmReleaseChart updates the chart in HelmRelease based on CozystackResourceDefinition
-func (r *CozystackResourceDefinitionReconciler) updateHelmReleaseChart(ctx context.Context, hr *helmv2.HelmRelease, crd *cozyv1alpha1.CozystackResourceDefinition) error {
-	logger := log.FromContext(ctx)
-	hrCopy := hr.DeepCopy()
-	updated := false
-
-	// Validate Chart configuration exists
-	if crd.Spec.Release.Chart.Name == "" {
-		logger.V(4).Info("Skipping HelmRelease chart update: Chart.Name is empty", "crd", crd.Name)
-		return nil
-	}
-
-	// Validate SourceRef fields
-	if crd.Spec.Release.Chart.SourceRef.Kind == "" ||
-		crd.Spec.Release.Chart.SourceRef.Name == "" ||
-		crd.Spec.Release.Chart.SourceRef.Namespace == "" {
-		logger.Error(fmt.Errorf("invalid SourceRef in CRD"), "Skipping HelmRelease chart update: SourceRef fields are incomplete",
-			"crd", crd.Name,
-			"kind", crd.Spec.Release.Chart.SourceRef.Kind,
-			"name", crd.Spec.Release.Chart.SourceRef.Name,
-			"namespace", crd.Spec.Release.Chart.SourceRef.Namespace)
-		return nil
-	}
-
-	// Get version and reconcileStrategy from CRD or use defaults
-	version := ">= 0.0.0-0"
-	reconcileStrategy := "Revision"
-	// TODO: Add Version and ReconcileStrategy fields to CozystackResourceDefinitionChart if needed
-
-	// Build expected SourceRef
-	expectedSourceRef := helmv2.CrossNamespaceObjectReference{
-		Kind:      crd.Spec.Release.Chart.SourceRef.Kind,
-		Name:      crd.Spec.Release.Chart.SourceRef.Name,
-		Namespace: crd.Spec.Release.Chart.SourceRef.Namespace,
-	}
-
-	if hrCopy.Spec.Chart == nil {
-		// Need to create Chart spec
-		hrCopy.Spec.Chart = &helmv2.HelmChartTemplate{
-			Spec: helmv2.HelmChartTemplateSpec{
-				Chart:             crd.Spec.Release.Chart.Name,
-				Version:           version,
-				ReconcileStrategy: reconcileStrategy,
-				SourceRef:         expectedSourceRef,
-			},
-		}
-		updated = true
-	} else {
-		// Update existing Chart spec
-		if hrCopy.Spec.Chart.Spec.Chart != crd.Spec.Release.Chart.Name ||
-			hrCopy.Spec.Chart.Spec.SourceRef != expectedSourceRef {
-			hrCopy.Spec.Chart.Spec.Chart = crd.Spec.Release.Chart.Name
-			hrCopy.Spec.Chart.Spec.SourceRef = expectedSourceRef
-			updated = true
-		}
-	}
-
-	if updated {
-		logger.V(4).Info("Updating HelmRelease chart", "name", hr.Name, "namespace", hr.Namespace)
-		if err := r.Update(ctx, hrCopy); err != nil {
-			return fmt.Errorf("failed to update HelmRelease: %w", err)
-		}
-	}
-
-	return nil
-}

internal/controller/dashboard/customformsoverride.go

@@ -105,26 +105,8 @@ func buildMultilineStringSchema(openAPISchema string) (map[string]any, error) {
 		"properties": map[string]any{},
 	}
 
-	// Check if there's a spec property
-	specProp, ok := props["spec"].(map[string]any)
-	if !ok {
-		return map[string]any{}, nil
-	}
-
-	specProps, ok := specProp["properties"].(map[string]any)
-	if !ok {
-		return map[string]any{}, nil
-	}
-
-	// Create spec.properties structure in schema
-	schemaProps := schema["properties"].(map[string]any)
-	specSchema := map[string]any{
-		"properties": map[string]any{},
-	}
-	schemaProps["spec"] = specSchema
-
 	// Process spec properties recursively
-	processSpecProperties(specProps, specSchema["properties"].(map[string]any))
+	processSpecProperties(props, schema["properties"].(map[string]any))
 
 	return schema, nil
 }

internal/controller/dashboard/customformsoverride_test.go

@@ -9,46 +9,41 @@ func TestBuildMultilineStringSchema(t *testing.T) {
 	// Test OpenAPI schema with various field types
 	openAPISchema := `{
 		"properties": {
-			"spec": {
+			"simpleString": {
+				"type": "string",
+				"description": "A simple string field"
+			},
+			"stringWithEnum": {
+				"type": "string",
+				"enum": ["option1", "option2"],
+				"description": "String with enum should be skipped"
+			},
+			"numberField": {
+				"type": "number",
+				"description": "Number field should be skipped"
+			},
+			"nestedObject": {
 				"type": "object",
 				"properties": {
-					"simpleString": {
+					"nestedString": {
 						"type": "string",
-						"description": "A simple string field"
+						"description": "Nested string should get multilineString"
 					},
-					"stringWithEnum": {
+					"nestedStringWithEnum": {
 						"type": "string",
-						"enum": ["option1", "option2"],
-						"description": "String with enum should be skipped"
-					},
-					"numberField": {
-						"type": "number",
-						"description": "Number field should be skipped"
-					},
-					"nestedObject": {
-						"type": "object",
-						"properties": {
-							"nestedString": {
-								"type": "string",
-								"description": "Nested string should get multilineString"
-							},
-							"nestedStringWithEnum": {
-								"type": "string",
-								"enum": ["a", "b"],
-								"description": "Nested string with enum should be skipped"
-							}
-						}
-					},
-					"arrayOfObjects": {
-						"type": "array",
-						"items": {
-							"type": "object",
-							"properties": {
-								"itemString": {
-									"type": "string",
-									"description": "String in array item"
-								}
-							}
+						"enum": ["a", "b"],
+						"description": "Nested string with enum should be skipped"
+					}
+				}
+			},
+			"arrayOfObjects": {
+				"type": "array",
+				"items": {
+					"type": "object",
+					"properties": {
+						"itemString": {
+							"type": "string",
+							"description": "String in array item"
 						}
 					}
 				}
@@ -75,44 +70,33 @@ func TestBuildMultilineStringSchema(t *testing.T) {
 		t.Fatal("schema.properties is not a map")
 	}
 
-	// Check spec property exists
-	spec, ok := props["spec"].(map[string]any)
-	if !ok {
-		t.Fatal("spec not found in properties")
-	}
-
-	specProps, ok := spec["properties"].(map[string]any)
-	if !ok {
-		t.Fatal("spec.properties is not a map")
-	}
-
 	// Check simpleString
-	simpleString, ok := specProps["simpleString"].(map[string]any)
+	simpleString, ok := props["simpleString"].(map[string]any)
 	if !ok {
-		t.Fatal("simpleString not found in spec.properties")
+		t.Fatal("simpleString not found in properties")
 	}
 	if simpleString["type"] != "multilineString" {
 		t.Errorf("simpleString should have type multilineString, got %v", simpleString["type"])
 	}
 
 	// Check stringWithEnum should not be present (or should not have multilineString)
-	if stringWithEnum, ok := specProps["stringWithEnum"].(map[string]any); ok {
+	if stringWithEnum, ok := props["stringWithEnum"].(map[string]any); ok {
 		if stringWithEnum["type"] == "multilineString" {
 			t.Error("stringWithEnum should not have multilineString type")
 		}
 	}
 
 	// Check numberField should not be present
-	if numberField, ok := specProps["numberField"].(map[string]any); ok {
+	if numberField, ok := props["numberField"].(map[string]any); ok {
 		if numberField["type"] != nil {
 			t.Error("numberField should not have any type override")
 		}
 	}
 
 	// Check nested object
-	nestedObject, ok := specProps["nestedObject"].(map[string]any)
+	nestedObject, ok := props["nestedObject"].(map[string]any)
 	if !ok {
-		t.Fatal("nestedObject not found in spec.properties")
+		t.Fatal("nestedObject not found in properties")
 	}
 	nestedProps, ok := nestedObject["properties"].(map[string]any)
 	if !ok {
@@ -129,9 +113,9 @@ func TestBuildMultilineStringSchema(t *testing.T) {
 	}
 
 	// Check array of objects
-	arrayOfObjects, ok := specProps["arrayOfObjects"].(map[string]any)
+	arrayOfObjects, ok := props["arrayOfObjects"].(map[string]any)
 	if !ok {
-		t.Fatal("arrayOfObjects not found in spec.properties")
+		t.Fatal("arrayOfObjects not found in properties")
 	}
 	items, ok := arrayOfObjects["items"].(map[string]any)
 	if !ok {

internal/controller/dashboard/factory.go

@@ -44,9 +44,6 @@ func (m *Manager) ensureFactory(ctx context.Context, crd *cozyv1alpha1.Cozystack
 	if flags.Secrets {
 		tabs = append(tabs, secretsTab(kind))
 	}
-	if prefix, ok := vncTabPrefix(kind); ok {
-		tabs = append(tabs, vncTab(prefix))
-	}
 	tabs = append(tabs, yamlTab(plural))
 
 	// Use unified factory creation
@@ -153,27 +150,6 @@ func detailsTab(kind, endpoint, schemaJSON string, keysOrder [][]string) map[str
 		}),
 		paramsList,
 	}
-	if kind == "VirtualPrivateCloud" {
-		rightColStack = append(rightColStack,
-			antdFlexVertical("vpc-subnets-block", 4, []any{
-				antdText("vpc-subnets-label", true, "Subnets", nil),
-				map[string]any{
-					"type": "EnrichedTable",
-					"data": map[string]any{
-						"id":                   "vpc-subnets-table",
-						"baseprefix":           "/openapi-ui",
-						"clusterNamePartOfUrl": "{2}",
-						"customizationId":      "virtualprivatecloud-subnets",
-						"fetchUrl":             "/api/clusters/{2}/k8s/api/v1/namespaces/{3}/configmaps",
-						"fieldSelector": map[string]any{
-							"metadata.name": "virtualprivatecloud-{6}-subnets",
-						},
-						"pathToItems": []any{"items"},
-					},
-				},
-			}),
-		)
-	}
 
 	return map[string]any{
 		"key":   "details",
@@ -355,36 +331,6 @@ func yamlTab(plural string) map[string]any {
 	}
 }
 
-func vncTabPrefix(kind string) (string, bool) {
-	switch kind {
-	case "VirtualMachine":
-		return "virtual-machine", true
-	case "VMInstance":
-		return "vm-instance", true
-	default:
-		return "", false
-	}
-}
-
-func vncTab(prefix string) map[string]any {
-	return map[string]any{
-		"key":   "vnc",
-		"label": "VNC",
-		"children": []any{
-			map[string]any{
-				"type": "VMVNC",
-				"data": map[string]any{
-					"id":              "vm-vnc",
-					"cluster":         "{2}",
-					"namespace":       "{reqsJsonPath[0]['.metadata.namespace']['-']}",
-					"substractHeight": float64(400),
-					"vmName":          fmt.Sprintf("%s-{reqsJsonPath[0]['.metadata.name']['-']}", prefix),
-				},
-			},
-		},
-	}
-}
-
 // ---------------- OpenAPI → Right column ----------------
 
 func buildOpenAPIParamsBlocks(schemaJSON string, keysOrder [][]string) []any {

internal/controller/dashboard/static_refactored.go

@@ -182,13 +182,6 @@ func CreateAllCustomColumnsOverrides() []*dashboardv1alpha1.CustomColumnsOverrid
 			createTimestampColumn("Created", ".metadata.creationTimestamp"),
 		}),
 
-		// Virtual private cloud subnets
-		createCustomColumnsOverride("virtualprivatecloud-subnets", []any{
-			createFlatMapColumn("Data", ".data"),
-			createStringColumn("Subnet Parameters", "_flatMapData_Key"),
-			createStringColumn("Values", "_flatMapData_Value"),
-		}),
-
 		// Factory ingress details rules
 		createCustomColumnsOverride("factory-kube-ingress-details-rules", []any{
 			createStringColumn("Host", ".host"),

internal/fluxinstall/install.go

@@ -1,352 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package fluxinstall
-
-import (
-	"bufio"
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/serializer/yaml"
-	k8syaml "k8s.io/apimachinery/pkg/util/yaml"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-)
-
-// Install installs Flux components using embedded manifests.
-// It extracts the manifests and applies them to the cluster.
-// The namespace is automatically determined from the Namespace object in the manifests.
-func Install(ctx context.Context, k8sClient client.Client, writeEmbeddedManifests func(string) error) error {
-	logger := log.FromContext(ctx)
-
-	// Create temporary directory for manifests
-	tmpDir, err := os.MkdirTemp("", "flux-install-*")
-	if err != nil {
-		return fmt.Errorf("failed to create temp directory: %w", err)
-	}
-	defer os.RemoveAll(tmpDir)
-
-	// Extract embedded manifests (generated by cozypkg)
-	manifestsDir := filepath.Join(tmpDir, "manifests")
-	if err := os.MkdirAll(manifestsDir, 0755); err != nil {
-		return fmt.Errorf("failed to create manifests directory: %w", err)
-	}
-
-	if err := writeEmbeddedManifests(manifestsDir); err != nil {
-		return fmt.Errorf("failed to extract embedded manifests: %w", err)
-	}
-
-	// Find the manifest file (should be fluxcd.yaml from cozypkg)
-	manifestPath := filepath.Join(manifestsDir, "fluxcd.yaml")
-	if _, err := os.Stat(manifestPath); err != nil {
-		// Try to find any YAML file if fluxcd.yaml doesn't exist
-		entries, err := os.ReadDir(manifestsDir)
-		if err != nil {
-			return fmt.Errorf("failed to read manifests directory: %w", err)
-		}
-		for _, entry := range entries {
-			if strings.HasSuffix(entry.Name(), ".yaml") {
-				manifestPath = filepath.Join(manifestsDir, entry.Name())
-				break
-			}
-		}
-	}
-
-	// Parse and apply manifests
-	objects, err := parseManifests(manifestPath)
-	if err != nil {
-		return fmt.Errorf("failed to parse manifests: %w", err)
-	}
-
-	if len(objects) == 0 {
-		return fmt.Errorf("no objects found in manifests")
-	}
-
-	// Inject KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT if set in operator environment
-	if err := injectKubernetesServiceEnv(objects); err != nil {
-		logger.Info("Failed to inject KUBERNETES_SERVICE_* env vars, continuing anyway", "error", err)
-	}
-
-	// Extract namespace from Namespace object in manifests
-	namespace, err := extractNamespace(objects)
-	if err != nil {
-		return fmt.Errorf("failed to extract namespace from manifests: %w", err)
-	}
-
-	logger.Info("Installing Flux components", "namespace", namespace)
-
-	// Apply manifests using server-side apply
-	logger.Info("Applying Flux manifests", "count", len(objects), "manifest", manifestPath, "namespace", namespace)
-	if err := applyManifests(ctx, k8sClient, objects); err != nil {
-		return fmt.Errorf("failed to apply manifests: %w", err)
-	}
-
-	logger.Info("Flux installation completed successfully")
-	return nil
-}
-
-// parseManifests parses YAML manifests into unstructured objects.
-func parseManifests(manifestPath string) ([]*unstructured.Unstructured, error) {
-	data, err := os.ReadFile(manifestPath)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read manifest file: %w", err)
-	}
-
-	return readYAMLObjects(bytes.NewReader(data))
-}
-
-// readYAMLObjects parses multi-document YAML into unstructured objects.
-func readYAMLObjects(reader io.Reader) ([]*unstructured.Unstructured, error) {
-	var objects []*unstructured.Unstructured
-	yamlReader := k8syaml.NewYAMLReader(bufio.NewReader(reader))
-
-	for {
-		doc, err := yamlReader.Read()
-		if err != nil {
-			if err == io.EOF {
-				break
-			}
-			return nil, fmt.Errorf("failed to read YAML document: %w", err)
-		}
-
-		// Skip empty documents
-		if len(bytes.TrimSpace(doc)) == 0 {
-			continue
-		}
-
-		obj := &unstructured.Unstructured{}
-		decoder := k8syaml.NewYAMLOrJSONDecoder(bytes.NewReader(doc), len(doc))
-		if err := decoder.Decode(obj); err != nil {
-			// Skip documents that can't be decoded (might be comments or empty)
-			if err == io.EOF {
-				continue
-			}
-			return nil, fmt.Errorf("failed to decode YAML document: %w", err)
-		}
-
-		// Skip empty objects (no kind)
-		if obj.GetKind() == "" {
-			continue
-		}
-
-		objects = append(objects, obj)
-	}
-
-	return objects, nil
-}
-
-// applyManifests applies Kubernetes objects using server-side apply.
-func applyManifests(ctx context.Context, k8sClient client.Client, objects []*unstructured.Unstructured) error {
-	logger := log.FromContext(ctx)
-	decoder := yaml.NewDecodingSerializer(unstructured.UnstructuredJSONScheme)
-
-	// Separate CRDs and namespaces from other resources
-	var stageOne []*unstructured.Unstructured // CRDs and Namespaces
-	var stageTwo []*unstructured.Unstructured // Everything else
-
-	for _, obj := range objects {
-		if isClusterDefinition(obj) {
-			stageOne = append(stageOne, obj)
-		} else {
-			stageTwo = append(stageTwo, obj)
-		}
-	}
-
-	// Apply stage one (CRDs and Namespaces) first
-	if len(stageOne) > 0 {
-		logger.Info("Applying cluster definitions", "count", len(stageOne))
-		if err := applyObjects(ctx, k8sClient, decoder, stageOne); err != nil {
-			return fmt.Errorf("failed to apply cluster definitions: %w", err)
-		}
-
-		// Wait a bit for CRDs to be registered
-		time.Sleep(2 * time.Second)
-	}
-
-	// Apply stage two (everything else)
-	if len(stageTwo) > 0 {
-		logger.Info("Applying resources", "count", len(stageTwo))
-		if err := applyObjects(ctx, k8sClient, decoder, stageTwo); err != nil {
-			return fmt.Errorf("failed to apply resources: %w", err)
-		}
-	}
-
-	return nil
-}
-
-// applyObjects applies a list of objects using server-side apply.
-func applyObjects(ctx context.Context, k8sClient client.Client, decoder runtime.Decoder, objects []*unstructured.Unstructured) error {
-	for _, obj := range objects {
-		// Use server-side apply with force ownership and field manager
-		// FieldManager is required for apply patch operations
-		patchOptions := &client.PatchOptions{
-			FieldManager: "cozystack-operator",
-			Force:        func() *bool { b := true; return &b }(),
-		}
-
-		if err := k8sClient.Patch(ctx, obj, client.Apply, patchOptions); err != nil {
-			return fmt.Errorf("failed to apply object %s/%s: %w", obj.GetKind(), obj.GetName(), err)
-		}
-	}
-	return nil
-}
-
-
-// extractNamespace extracts the namespace name from the Namespace object in the manifests.
-func extractNamespace(objects []*unstructured.Unstructured) (string, error) {
-	for _, obj := range objects {
-		if obj.GetKind() == "Namespace" {
-			namespace := obj.GetName()
-			if namespace == "" {
-				return "", fmt.Errorf("Namespace object has no name")
-			}
-			return namespace, nil
-		}
-	}
-	return "", fmt.Errorf("no Namespace object found in manifests")
-}
-
-// isClusterDefinition checks if an object is a CRD or Namespace.
-func isClusterDefinition(obj *unstructured.Unstructured) bool {
-	kind := obj.GetKind()
-	return kind == "CustomResourceDefinition" || kind == "Namespace"
-}
-
-// injectKubernetesServiceEnv injects KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT
-// environment variables into all containers of Deployment, StatefulSet, and DaemonSet objects
-// if these variables are set in the operator's environment.
-func injectKubernetesServiceEnv(objects []*unstructured.Unstructured) error {
-	kubernetesHost := os.Getenv("KUBERNETES_SERVICE_HOST")
-	kubernetesPort := os.Getenv("KUBERNETES_SERVICE_PORT")
-
-	// If neither variable is set, nothing to do
-	if kubernetesHost == "" && kubernetesPort == "" {
-		return nil
-	}
-
-	for _, obj := range objects {
-		kind := obj.GetKind()
-		if kind != "Deployment" && kind != "StatefulSet" && kind != "DaemonSet" {
-			continue
-		}
-
-		// Navigate to spec.template.spec.containers
-		spec, found, err := unstructured.NestedMap(obj.Object, "spec", "template", "spec")
-		if !found || err != nil {
-			continue
-		}
-
-		// Update containers
-		containers, found, err := unstructured.NestedSlice(spec, "containers")
-		if found && err == nil {
-			containers = updateContainersEnv(containers, kubernetesHost, kubernetesPort)
-			if err := unstructured.SetNestedSlice(spec, containers, "containers"); err != nil {
-				continue
-			}
-		}
-
-		// Update initContainers
-		initContainers, found, err := unstructured.NestedSlice(spec, "initContainers")
-		if found && err == nil {
-			initContainers = updateContainersEnv(initContainers, kubernetesHost, kubernetesPort)
-			if err := unstructured.SetNestedSlice(spec, initContainers, "initContainers"); err != nil {
-				continue
-			}
-		}
-
-		// Update spec in the object
-		if err := unstructured.SetNestedMap(obj.Object, spec, "spec", "template", "spec"); err != nil {
-			continue
-		}
-	}
-
-	return nil
-}
-
-// updateContainersEnv updates environment variables for a slice of containers.
-func updateContainersEnv(containers []interface{}, kubernetesHost, kubernetesPort string) []interface{} {
-	for i, container := range containers {
-		containerMap, ok := container.(map[string]interface{})
-		if !ok {
-			continue
-		}
-
-		env, found, err := unstructured.NestedSlice(containerMap, "env")
-		if err != nil {
-			continue
-		}
-
-		if !found {
-			env = []interface{}{}
-		}
-
-		// Update or add KUBERNETES_SERVICE_HOST
-		if kubernetesHost != "" {
-			env = setEnvVar(env, "KUBERNETES_SERVICE_HOST", kubernetesHost)
-		}
-
-		// Update or add KUBERNETES_SERVICE_PORT
-		if kubernetesPort != "" {
-			env = setEnvVar(env, "KUBERNETES_SERVICE_PORT", kubernetesPort)
-		}
-
-		// Update the container's env
-		if err := unstructured.SetNestedSlice(containerMap, env, "env"); err != nil {
-			continue
-		}
-
-		// Update the container in the slice
-		containers[i] = containerMap
-	}
-
-	return containers
-}
-
-// setEnvVar updates or adds an environment variable in the env slice.
-func setEnvVar(env []interface{}, name, value string) []interface{} {
-	// Check if variable already exists
-	for i, envVar := range env {
-		envVarMap, ok := envVar.(map[string]interface{})
-		if !ok {
-			continue
-		}
-
-		if envVarMap["name"] == name {
-			// Update existing variable
-			envVarMap["value"] = value
-			env[i] = envVarMap
-			return env
-		}
-	}
-
-	// Add new variable
-	env = append(env, map[string]interface{}{
-		"name":  name,
-		"value": value,
-	})
-
-	return env
-}
-

internal/fluxinstall/manifests.embed.go

@@ -1,51 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package fluxinstall
-
-import (
-	"embed"
-	"fmt"
-	"io/fs"
-	"os"
-	"path"
-)
-
-//go:embed manifests/*.yaml
-var embeddedFluxManifests embed.FS
-
-// WriteEmbeddedManifests extracts embedded Flux manifests to a temporary directory.
-func WriteEmbeddedManifests(dir string) error {
-	manifests, err := fs.ReadDir(embeddedFluxManifests, "manifests")
-	if err != nil {
-		return fmt.Errorf("failed to read embedded manifests: %w", err)
-	}
-
-	for _, manifest := range manifests {
-		data, err := fs.ReadFile(embeddedFluxManifests, path.Join("manifests", manifest.Name()))
-		if err != nil {
-			return fmt.Errorf("failed to read file %s: %w", manifest.Name(), err)
-		}
-
-		outputPath := path.Join(dir, manifest.Name())
-		if err := os.WriteFile(outputPath, data, 0666); err != nil {
-			return fmt.Errorf("failed to write file %s: %w", outputPath, err)
-		}
-	}
-
-	return nil
-}
-

internal/lineagecontrollerwebhook/config.go

@@ -2,72 +2,49 @@ package lineagecontrollerwebhook
 
 import (
 	"fmt"
-	"strings"
 
 	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
 	helmv2 "github.com/fluxcd/helm-controller/api/v2"
 )
 
+type chartRef struct {
+	repo  string
+	chart string
+}
+
 type appRef struct {
 	group string
 	kind  string
 }
 
 type runtimeConfig struct {
-	appCRDMap map[appRef]*cozyv1alpha1.CozystackResourceDefinition
+	chartAppMap map[chartRef]*cozyv1alpha1.CozystackResourceDefinition
+	appCRDMap   map[appRef]*cozyv1alpha1.CozystackResourceDefinition
 }
 
 func (l *LineageControllerWebhook) initConfig() {
 	l.initOnce.Do(func() {
 		if l.config.Load() == nil {
 			l.config.Store(&runtimeConfig{
-				appCRDMap: make(map[appRef]*cozyv1alpha1.CozystackResourceDefinition),
+				chartAppMap: make(map[chartRef]*cozyv1alpha1.CozystackResourceDefinition),
+				appCRDMap:   make(map[appRef]*cozyv1alpha1.CozystackResourceDefinition),
 			})
 		}
 	})
 }
 
-// getApplicationLabel safely extracts an application label from HelmRelease
-func getApplicationLabel(hr *helmv2.HelmRelease, key string) (string, error) {
-	if hr.Labels == nil {
-		return "", fmt.Errorf("cannot map helm release %s/%s to dynamic app: labels are nil", hr.Namespace, hr.Name)
-	}
-	val, ok := hr.Labels[key]
-	if !ok {
-		return "", fmt.Errorf("cannot map helm release %s/%s to dynamic app: missing %s label", hr.Namespace, hr.Name, key)
-	}
-	return val, nil
-}
-
 func (l *LineageControllerWebhook) Map(hr *helmv2.HelmRelease) (string, string, string, error) {
-	// Extract application metadata from labels
-	appKind, err := getApplicationLabel(hr, "apps.cozystack.io/application.kind")
-	if err != nil {
-		return "", "", "", err
+	cfg, ok := l.config.Load().(*runtimeConfig)
+	if !ok {
+		return "", "", "", fmt.Errorf("failed to load chart-app mapping from config")
 	}
-	
-	appGroup, err := getApplicationLabel(hr, "apps.cozystack.io/application.group")
-	if err != nil {
-		return "", "", "", err
+	if hr.Spec.Chart == nil {
+		return "", "", "", fmt.Errorf("cannot map helm release %s/%s to dynamic app", hr.Namespace, hr.Name)
 	}
-	
-	appName, err := getApplicationLabel(hr, "apps.cozystack.io/application.name")
-	if err != nil {
-		return "", "", "", err
+	s := hr.Spec.Chart.Spec
+	val, ok := cfg.chartAppMap[chartRef{s.SourceRef.Name, s.Chart}]
+	if !ok {
+		return "", "", "", fmt.Errorf("cannot map helm release %s/%s to dynamic app", hr.Namespace, hr.Name)
 	}
-	
-	// Construct API version from group
-	apiVersion := fmt.Sprintf("%s/v1alpha1", appGroup)
-	
-	// Extract prefix from HelmRelease name by removing the application name
-	// HelmRelease name format: <prefix><application-name>
-	prefix := strings.TrimSuffix(hr.Name, appName)
-	
-	// Validate the derived prefix
-	// This ensures correctness when appName appears multiple times in hr.Name
-	if prefix+appName != hr.Name {
-		return "", "", "", fmt.Errorf("cannot derive prefix from helm release %s/%s: name does not end with application name %s", hr.Namespace, hr.Name, appName)
-	}
-	
-	return apiVersion, appKind, prefix, nil
+	return "apps.cozystack.io/v1alpha1", val.Spec.Application.Kind, val.Spec.Release.Prefix, nil
 }

internal/lineagecontrollerwebhook/controller.go

@@ -24,15 +24,25 @@ func (c *LineageControllerWebhook) Reconcile(ctx context.Context, req ctrl.Reque
 		return ctrl.Result{}, err
 	}
 	cfg := &runtimeConfig{
-		appCRDMap: make(map[appRef]*cozyv1alpha1.CozystackResourceDefinition),
+		chartAppMap: make(map[chartRef]*cozyv1alpha1.CozystackResourceDefinition),
+		appCRDMap:   make(map[appRef]*cozyv1alpha1.CozystackResourceDefinition),
 	}
 	for _, crd := range crds.Items {
+		chRef := chartRef{
+			crd.Spec.Release.Chart.SourceRef.Name,
+			crd.Spec.Release.Chart.Name,
+		}
 		appRef := appRef{
 			"apps.cozystack.io",
 			crd.Spec.Application.Kind,
 		}
 
 		newRef := crd
+		if _, exists := cfg.chartAppMap[chRef]; exists {
+			l.Info("duplicate chart mapping detected; ignoring subsequent entry", "key", chRef)
+		} else {
+			cfg.chartAppMap[chRef] = &newRef
+		}
 		if _, exists := cfg.appCRDMap[appRef]; exists {
 			l.Info("duplicate app mapping detected; ignoring subsequent entry", "key", appRef)
 		} else {

internal/operator/package_reconciler.go

@@ -1,889 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package operator
-
-import (
-	"context"
-	"fmt"
-	"strings"
-
-	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
-	helmv2 "github.com/fluxcd/helm-controller/api/v2"
-	corev1 "k8s.io/api/core/v1"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/api/meta"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/types"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/handler"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-	"sigs.k8s.io/controller-runtime/pkg/reconcile"
-)
-
-// PackageReconciler reconciles Package resources
-type PackageReconciler struct {
-	client.Client
-	Scheme *runtime.Scheme
-}
-
-// +kubebuilder:rbac:groups=cozystack.io,resources=packages,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=cozystack.io,resources=packages/status,verbs=get;update;patch
-// +kubebuilder:rbac:groups=cozystack.io,resources=packagesources,verbs=get;list;watch
-// +kubebuilder:rbac:groups=helm.toolkit.fluxcd.io,resources=helmreleases,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=core,resources=namespaces,verbs=get;list;watch;create;update;patch
-
-// Reconcile is part of the main kubernetes reconciliation loop
-func (r *PackageReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
-	logger := log.FromContext(ctx)
-
-	pkg := &cozyv1alpha1.Package{}
-	if err := r.Get(ctx, req.NamespacedName, pkg); err != nil {
-		if apierrors.IsNotFound(err) {
-			// Resource not found, return (ownerReference will handle cleanup)
-			return ctrl.Result{}, nil
-		}
-		return ctrl.Result{}, err
-	}
-
-	// Get PackageSource with the same name
-	packageSource := &cozyv1alpha1.PackageSource{}
-	if err := r.Get(ctx, types.NamespacedName{Name: pkg.Name}, packageSource); err != nil {
-		if apierrors.IsNotFound(err) {
-			meta.SetStatusCondition(&pkg.Status.Conditions, metav1.Condition{
-				Type:    "Ready",
-				Status:  metav1.ConditionFalse,
-				Reason:  "PackageSourceNotFound",
-				Message: fmt.Sprintf("PackageSource %s not found", pkg.Name),
-			})
-			if err := r.Status().Update(ctx, pkg); err != nil {
-				return ctrl.Result{}, err
-			}
-			return ctrl.Result{}, nil
-		}
-		return ctrl.Result{}, err
-	}
-
-	// Determine variant (default to "default" if not specified)
-	variantName := pkg.Spec.Variant
-	if variantName == "" {
-		variantName = "default"
-	}
-
-	// Find the variant in PackageSource
-	var variant *cozyv1alpha1.Variant
-	for i := range packageSource.Spec.Variants {
-		if packageSource.Spec.Variants[i].Name == variantName {
-			variant = &packageSource.Spec.Variants[i]
-			break
-		}
-	}
-
-	if variant == nil {
-		meta.SetStatusCondition(&pkg.Status.Conditions, metav1.Condition{
-			Type:    "Ready",
-			Status:  metav1.ConditionFalse,
-			Reason:  "VariantNotFound",
-			Message: fmt.Sprintf("Variant %s not found in PackageSource %s", variantName, pkg.Name),
-		})
-		if err := r.Status().Update(ctx, pkg); err != nil {
-			return ctrl.Result{}, err
-		}
-		return ctrl.Result{}, nil
-	}
-
-	// Reconcile namespaces from components
-	if err := r.reconcileNamespaces(ctx, pkg, variant); err != nil {
-		logger.Error(err, "failed to reconcile namespaces")
-		return ctrl.Result{}, err
-	}
-
-	// Validate variant dependencies before creating HelmReleases
-	// If dependencies are missing, we don't create new HelmReleases but don't delete existing ones
-	if err := r.validateVariantDependencies(ctx, pkg, variant); err != nil {
-		logger.Info("variant dependencies not ready, skipping HelmRelease creation", "package", pkg.Name, "error", err)
-		meta.SetStatusCondition(&pkg.Status.Conditions, metav1.Condition{
-			Type:    "Ready",
-			Status:  metav1.ConditionFalse,
-			Reason:  "DependenciesNotReady",
-			Message: fmt.Sprintf("Variant dependencies not ready: %v", err),
-		})
-		if err := r.Status().Update(ctx, pkg); err != nil {
-			return ctrl.Result{}, err
-		}
-		// Return success to avoid requeue, but don't create HelmReleases
-		return ctrl.Result{}, nil
-	}
-
-	// Create HelmReleases for components with Install section
-	helmReleaseCount := 0
-	for _, component := range variant.Components {
-		// Skip components without Install section
-		if component.Install == nil {
-			continue
-		}
-
-		// Check if component is disabled via Package spec
-		if pkgComponent, ok := pkg.Spec.Components[component.Name]; ok {
-			if pkgComponent.Enabled != nil && !*pkgComponent.Enabled {
-				logger.V(1).Info("skipping disabled component", "package", pkg.Name, "component", component.Name)
-				continue
-			}
-		}
-
-		// Build artifact name: <packagesource>-<variant>-<componentname> (with dots replaced by dashes)
-		artifactName := fmt.Sprintf("%s-%s-%s",
-			strings.ReplaceAll(packageSource.Name, ".", "-"),
-			strings.ReplaceAll(variantName, ".", "-"),
-			strings.ReplaceAll(component.Name, ".", "-"))
-
-		// Determine namespace (from Install or default to cozy-system)
-		namespace := component.Install.Namespace
-		if namespace == "" {
-			namespace = "cozy-system"
-		}
-
-		// Determine release name (from Install or use component name)
-		releaseName := component.Install.ReleaseName
-		if releaseName == "" {
-			releaseName = component.Name
-		}
-
-		// Build labels
-		labels := make(map[string]string)
-		labels["cozystack.io/package"] = pkg.Name
-		if component.Install.Privileged {
-			labels["cozystack.io/privileged"] = "true"
-		}
-
-		// Create HelmRelease
-		hr := &helmv2.HelmRelease{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      releaseName,
-				Namespace: namespace,
-				Labels:    labels,
-			},
-			Spec: helmv2.HelmReleaseSpec{
-				Interval: metav1.Duration{Duration: 5 * 60 * 1000000000}, // 5m
-				ChartRef: &helmv2.CrossNamespaceSourceReference{
-					Kind:      "ExternalArtifact",
-					Name:      artifactName,
-					Namespace: "cozy-system",
-				},
-				Install: &helmv2.Install{
-					Remediation: &helmv2.InstallRemediation{
-						Retries: -1,
-					},
-				},
-				Upgrade: &helmv2.Upgrade{
-					Remediation: &helmv2.UpgradeRemediation{
-						Retries: -1,
-					},
-				},
-			},
-		}
-
-		// Set ownerReference
-		hr.OwnerReferences = []metav1.OwnerReference{
-			{
-				APIVersion: pkg.APIVersion,
-				Kind:       pkg.Kind,
-				Name:       pkg.Name,
-				UID:        pkg.UID,
-				Controller: func() *bool { b := true; return &b }(),
-			},
-		}
-
-		// Merge values from Package spec if provided
-		if pkgComponent, ok := pkg.Spec.Components[component.Name]; ok && pkgComponent.Values != nil {
-			hr.Spec.Values = pkgComponent.Values
-		}
-
-		// Build DependsOn from component Install and variant DependsOn
-		dependsOn, err := r.buildDependsOn(ctx, pkg, packageSource, variant, &component)
-		if err != nil {
-			logger.Error(err, "failed to build DependsOn", "component", component.Name)
-			meta.SetStatusCondition(&pkg.Status.Conditions, metav1.Condition{
-				Type:    "Ready",
-				Status:  metav1.ConditionFalse,
-				Reason:  "DependsOnFailed",
-				Message: fmt.Sprintf("Failed to build DependsOn for component %s: %v", component.Name, err),
-			})
-			if err := r.Status().Update(ctx, pkg); err != nil {
-				return ctrl.Result{}, err
-			}
-			return ctrl.Result{}, err
-		}
-		if len(dependsOn) > 0 {
-			hr.Spec.DependsOn = dependsOn
-		}
-
-		if err := r.createOrUpdateHelmRelease(ctx, hr); err != nil {
-			logger.Error(err, "failed to reconcile HelmRelease", "name", releaseName, "namespace", namespace)
-			meta.SetStatusCondition(&pkg.Status.Conditions, metav1.Condition{
-				Type:    "Ready",
-				Status:  metav1.ConditionFalse,
-				Reason:  "HelmReleaseFailed",
-				Message: fmt.Sprintf("Failed to create HelmRelease %s: %v", releaseName, err),
-			})
-			if err := r.Status().Update(ctx, pkg); err != nil {
-				return ctrl.Result{}, err
-			}
-			return ctrl.Result{}, err
-		}
-
-		helmReleaseCount++
-		logger.Info("reconciled HelmRelease", "package", pkg.Name, "component", component.Name, "releaseName", releaseName, "namespace", namespace)
-	}
-
-	// Cleanup orphaned HelmReleases
-	if err := r.cleanupOrphanedHelmReleases(ctx, pkg, variant); err != nil {
-		logger.Error(err, "failed to cleanup orphaned HelmReleases")
-		// Don't return error, continue with status update
-	}
-
-	// Update status with success message
-	message := fmt.Sprintf("reconciliation succeeded, generated %d helmrelease(s)", helmReleaseCount)
-	meta.SetStatusCondition(&pkg.Status.Conditions, metav1.Condition{
-		Type:    "Ready",
-		Status:  metav1.ConditionTrue,
-		Reason:  "ReconciliationSucceeded",
-		Message: message,
-	})
-
-	if err := r.Status().Update(ctx, pkg); err != nil {
-		return ctrl.Result{}, err
-	}
-
-	logger.Info("reconciled Package", "name", pkg.Name, "helmReleaseCount", helmReleaseCount)
-
-	// Trigger reconcile for Packages that depend on this Package
-	if err := r.triggerDependentPackages(ctx, pkg.Name); err != nil {
-		logger.Error(err, "failed to trigger dependent Packages", "package", pkg.Name)
-		// Don't return error, this is best-effort
-	}
-
-	return ctrl.Result{}, nil
-}
-
-// createOrUpdateHelmRelease creates or updates a HelmRelease
-func (r *PackageReconciler) createOrUpdateHelmRelease(ctx context.Context, hr *helmv2.HelmRelease) error {
-	existing := &helmv2.HelmRelease{}
-	key := types.NamespacedName{
-		Name:      hr.Name,
-		Namespace: hr.Namespace,
-	}
-
-	err := r.Get(ctx, key, existing)
-	if apierrors.IsNotFound(err) {
-		return r.Create(ctx, hr)
-	} else if err != nil {
-		return err
-	}
-
-	// Preserve resource version
-	hr.SetResourceVersion(existing.GetResourceVersion())
-
-	// Merge labels
-	labels := hr.GetLabels()
-	if labels == nil {
-		labels = make(map[string]string)
-	}
-	for k, v := range existing.GetLabels() {
-		if _, ok := labels[k]; !ok {
-			labels[k] = v
-		}
-	}
-	hr.SetLabels(labels)
-
-	// Merge annotations
-	annotations := hr.GetAnnotations()
-	if annotations == nil {
-		annotations = make(map[string]string)
-	}
-	for k, v := range existing.GetAnnotations() {
-		if _, ok := annotations[k]; !ok {
-			annotations[k] = v
-		}
-	}
-	hr.SetAnnotations(annotations)
-
-	// Update Spec
-	existing.Spec = hr.Spec
-	existing.SetLabels(hr.GetLabels())
-	existing.SetAnnotations(hr.GetAnnotations())
-	existing.SetOwnerReferences(hr.GetOwnerReferences())
-
-	return r.Update(ctx, existing)
-}
-
-// buildDependsOn builds DependsOn list for a component
-// Includes:
-// 1. Dependencies from component.Install.DependsOn (with namespace from referenced component)
-// 2. Dependencies from variant.DependsOn (all components with Install from referenced Package)
-func (r *PackageReconciler) buildDependsOn(ctx context.Context, pkg *cozyv1alpha1.Package, packageSource *cozyv1alpha1.PackageSource, variant *cozyv1alpha1.Variant, component *cozyv1alpha1.Component) ([]helmv2.DependencyReference, error) {
-	logger := log.FromContext(ctx)
-	dependsOn := []helmv2.DependencyReference{}
-
-	// Build map of component names to their release names and namespaces in current variant
-	componentMap := make(map[string]struct {
-		releaseName string
-		namespace   string
-	})
-	for _, comp := range variant.Components {
-		if comp.Install == nil {
-			continue
-		}
-		compNamespace := comp.Install.Namespace
-		if compNamespace == "" {
-			compNamespace = "cozy-system"
-		}
-		compReleaseName := comp.Install.ReleaseName
-		if compReleaseName == "" {
-			compReleaseName = comp.Name
-		}
-		componentMap[comp.Name] = struct {
-			releaseName string
-			namespace   string
-		}{
-			releaseName: compReleaseName,
-			namespace:   compNamespace,
-		}
-	}
-
-	// Add dependencies from component.Install.DependsOn
-	if len(component.Install.DependsOn) > 0 {
-		for _, depName := range component.Install.DependsOn {
-			depComp, ok := componentMap[depName]
-			if !ok {
-				return nil, fmt.Errorf("component %s not found in variant for dependency %s", depName, component.Name)
-			}
-			dependsOn = append(dependsOn, helmv2.DependencyReference{
-				Name:      depComp.releaseName,
-				Namespace: depComp.namespace,
-			})
-			logger.V(1).Info("added component dependency", "component", component.Name, "dependsOn", depName, "releaseName", depComp.releaseName, "namespace", depComp.namespace)
-		}
-	}
-
-	// Add dependencies from variant.DependsOn
-	if len(variant.DependsOn) > 0 {
-		for _, depPackageName := range variant.DependsOn {
-			// Check if dependency is in IgnoreDependencies
-			ignore := false
-			for _, ignoreDep := range pkg.Spec.IgnoreDependencies {
-				if ignoreDep == depPackageName {
-					ignore = true
-					break
-				}
-			}
-			if ignore {
-				logger.V(1).Info("ignoring dependency", "package", pkg.Name, "dependency", depPackageName)
-				continue
-			}
-
-			// Get the Package
-			depPackage := &cozyv1alpha1.Package{}
-			if err := r.Get(ctx, types.NamespacedName{Name: depPackageName}, depPackage); err != nil {
-				if apierrors.IsNotFound(err) {
-					return nil, fmt.Errorf("dependent Package %s not found", depPackageName)
-				}
-				return nil, fmt.Errorf("failed to get dependent Package %s: %w", depPackageName, err)
-			}
-
-			// Get the variant from dependent Package
-			depVariantName := depPackage.Spec.Variant
-			if depVariantName == "" {
-				depVariantName = "default"
-			}
-
-			// Get the PackageSource
-			depPackageSource := &cozyv1alpha1.PackageSource{}
-			if err := r.Get(ctx, types.NamespacedName{Name: depPackageName}, depPackageSource); err != nil {
-				if apierrors.IsNotFound(err) {
-					return nil, fmt.Errorf("dependent PackageSource %s not found", depPackageName)
-				}
-				return nil, fmt.Errorf("failed to get dependent PackageSource %s: %w", depPackageName, err)
-			}
-
-			// Find the variant in PackageSource
-			var depVariant *cozyv1alpha1.Variant
-			for i := range depPackageSource.Spec.Variants {
-				if depPackageSource.Spec.Variants[i].Name == depVariantName {
-					depVariant = &depPackageSource.Spec.Variants[i]
-					break
-				}
-			}
-
-			if depVariant == nil {
-				return nil, fmt.Errorf("dependent variant %s not found in PackageSource %s", depVariantName, depPackageName)
-			}
-
-			// Add all components with Install from dependent variant
-			for _, depComp := range depVariant.Components {
-				if depComp.Install == nil {
-					continue
-				}
-
-				// Check if component is disabled in dependent Package
-				if depPkgComponent, ok := depPackage.Spec.Components[depComp.Name]; ok {
-					if depPkgComponent.Enabled != nil && !*depPkgComponent.Enabled {
-						continue
-					}
-				}
-
-				depCompNamespace := depComp.Install.Namespace
-				if depCompNamespace == "" {
-					depCompNamespace = "cozy-system"
-				}
-				depCompReleaseName := depComp.Install.ReleaseName
-				if depCompReleaseName == "" {
-					depCompReleaseName = depComp.Name
-				}
-
-				dependsOn = append(dependsOn, helmv2.DependencyReference{
-					Name:      depCompReleaseName,
-					Namespace: depCompNamespace,
-				})
-				logger.V(1).Info("added variant dependency", "package", pkg.Name, "dependency", depPackageName, "component", depComp.Name, "releaseName", depCompReleaseName, "namespace", depCompNamespace)
-			}
-		}
-	}
-
-	return dependsOn, nil
-}
-
-// validateVariantDependencies validates that all variant dependencies exist
-// Returns error if any dependency is missing
-func (r *PackageReconciler) validateVariantDependencies(ctx context.Context, pkg *cozyv1alpha1.Package, variant *cozyv1alpha1.Variant) error {
-	logger := log.FromContext(ctx)
-
-	if len(variant.DependsOn) == 0 {
-		return nil
-	}
-
-	for _, depPackageName := range variant.DependsOn {
-		// Check if dependency is in IgnoreDependencies
-		ignore := false
-		for _, ignoreDep := range pkg.Spec.IgnoreDependencies {
-			if ignoreDep == depPackageName {
-				ignore = true
-				break
-			}
-		}
-		if ignore {
-			logger.V(1).Info("ignoring dependency", "package", pkg.Name, "dependency", depPackageName)
-			continue
-		}
-
-		// Get the Package
-		depPackage := &cozyv1alpha1.Package{}
-		if err := r.Get(ctx, types.NamespacedName{Name: depPackageName}, depPackage); err != nil {
-			if apierrors.IsNotFound(err) {
-				return fmt.Errorf("dependent Package %s not found", depPackageName)
-			}
-			return fmt.Errorf("failed to get dependent Package %s: %w", depPackageName, err)
-		}
-
-		// Get the PackageSource
-		depPackageSource := &cozyv1alpha1.PackageSource{}
-		if err := r.Get(ctx, types.NamespacedName{Name: depPackageName}, depPackageSource); err != nil {
-			if apierrors.IsNotFound(err) {
-				return fmt.Errorf("dependent PackageSource %s not found", depPackageName)
-			}
-			return fmt.Errorf("failed to get dependent PackageSource %s: %w", depPackageName, err)
-		}
-
-		// Get the variant from dependent Package
-		depVariantName := depPackage.Spec.Variant
-		if depVariantName == "" {
-			depVariantName = "default"
-		}
-
-		// Find the variant in PackageSource
-		var depVariant *cozyv1alpha1.Variant
-		for i := range depPackageSource.Spec.Variants {
-			if depPackageSource.Spec.Variants[i].Name == depVariantName {
-				depVariant = &depPackageSource.Spec.Variants[i]
-				break
-			}
-		}
-
-		if depVariant == nil {
-			return fmt.Errorf("dependent variant %s not found in PackageSource %s", depVariantName, depPackageName)
-		}
-	}
-
-	return nil
-}
-
-// reconcileNamespaces creates or updates namespaces based on components in the variant
-func (r *PackageReconciler) reconcileNamespaces(ctx context.Context, pkg *cozyv1alpha1.Package, variant *cozyv1alpha1.Variant) error {
-	logger := log.FromContext(ctx)
-
-	// Collect namespaces from components
-	// Map: namespace -> {isPrivileged}
-	type namespaceInfo struct {
-		privileged bool
-	}
-	namespacesMap := make(map[string]namespaceInfo)
-
-	for _, component := range variant.Components {
-		// Skip components without Install section
-		if component.Install == nil {
-			continue
-		}
-
-		// Check if component is disabled via Package spec
-		if pkgComponent, ok := pkg.Spec.Components[component.Name]; ok {
-			if pkgComponent.Enabled != nil && !*pkgComponent.Enabled {
-				continue
-			}
-		}
-
-		// Namespace must be set
-		namespace := component.Install.Namespace
-		if namespace == "" {
-			return fmt.Errorf("component %s has empty namespace in Install section", component.Name)
-		}
-
-		info, exists := namespacesMap[namespace]
-		if !exists {
-			info = namespaceInfo{
-				privileged: false,
-			}
-		}
-
-		// If component is privileged, mark namespace as privileged
-		if component.Install.Privileged {
-			info.privileged = true
-		}
-
-		namespacesMap[namespace] = info
-	}
-
-	// Create or update all namespaces
-	for nsName, info := range namespacesMap {
-		namespace := &corev1.Namespace{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:   nsName,
-				Labels: make(map[string]string),
-				Annotations: map[string]string{
-					"helm.sh/resource-policy": "keep",
-				},
-			},
-		}
-
-		// Add system label only for non-tenant namespaces
-		if !strings.HasPrefix(nsName, "tenant-") {
-			namespace.Labels["cozystack.io/system"] = "true"
-		}
-
-		// Add privileged label if needed
-		if info.privileged {
-			namespace.Labels["pod-security.kubernetes.io/enforce"] = "privileged"
-		}
-
-		if err := r.createOrUpdateNamespace(ctx, namespace); err != nil {
-			logger.Error(err, "failed to reconcile namespace", "name", nsName, "privileged", info.privileged)
-			return fmt.Errorf("failed to reconcile namespace %s: %w", nsName, err)
-		}
-		logger.Info("reconciled namespace", "name", nsName, "privileged", info.privileged)
-	}
-
-	return nil
-}
-
-// createOrUpdateNamespace creates or updates a namespace
-func (r *PackageReconciler) createOrUpdateNamespace(ctx context.Context, namespace *corev1.Namespace) error {
-	existing := &corev1.Namespace{}
-	key := types.NamespacedName{Name: namespace.Name}
-
-	err := r.Get(ctx, key, existing)
-	if apierrors.IsNotFound(err) {
-		return r.Create(ctx, namespace)
-	} else if err != nil {
-		return err
-	}
-
-	// Preserve resource version
-	namespace.SetResourceVersion(existing.GetResourceVersion())
-
-	// Merge labels
-	labels := namespace.GetLabels()
-	if labels == nil {
-		labels = make(map[string]string)
-	}
-	for k, v := range existing.GetLabels() {
-		if _, ok := labels[k]; !ok {
-			labels[k] = v
-		}
-	}
-	namespace.SetLabels(labels)
-
-	// Merge annotations
-	annotations := namespace.GetAnnotations()
-	if annotations == nil {
-		annotations = make(map[string]string)
-	}
-	for k, v := range existing.GetAnnotations() {
-		if _, ok := annotations[k]; !ok {
-			annotations[k] = v
-		}
-	}
-	namespace.SetAnnotations(annotations)
-
-	return r.Update(ctx, namespace)
-}
-
-// cleanupOrphanedHelmReleases removes HelmReleases that are no longer needed
-func (r *PackageReconciler) cleanupOrphanedHelmReleases(ctx context.Context, pkg *cozyv1alpha1.Package, variant *cozyv1alpha1.Variant) error {
-	logger := log.FromContext(ctx)
-
-	// Build map of desired HelmRelease names (from components with Install)
-	desiredReleases := make(map[types.NamespacedName]bool)
-	for _, component := range variant.Components {
-		if component.Install == nil {
-			continue
-		}
-
-		// Check if component is disabled via Package spec
-		if pkgComponent, ok := pkg.Spec.Components[component.Name]; ok {
-			if pkgComponent.Enabled != nil && !*pkgComponent.Enabled {
-				continue
-			}
-		}
-
-		namespace := component.Install.Namespace
-		if namespace == "" {
-			namespace = "cozy-system"
-		}
-
-		releaseName := component.Install.ReleaseName
-		if releaseName == "" {
-			releaseName = component.Name
-		}
-
-		desiredReleases[types.NamespacedName{
-			Name:      releaseName,
-			Namespace: namespace,
-		}] = true
-	}
-
-	// Find all HelmReleases owned by this Package
-	hrList := &helmv2.HelmReleaseList{}
-	if err := r.List(ctx, hrList, client.MatchingLabels{
-		"cozystack.io/package": pkg.Name,
-	}); err != nil {
-		return err
-	}
-
-	// Delete HelmReleases that are not in desired list
-	for _, hr := range hrList.Items {
-		key := types.NamespacedName{
-			Name:      hr.Name,
-			Namespace: hr.Namespace,
-		}
-		if !desiredReleases[key] {
-			logger.Info("deleting orphaned HelmRelease", "name", hr.Name, "namespace", hr.Namespace, "package", pkg.Name)
-			if err := r.Delete(ctx, &hr); err != nil && !apierrors.IsNotFound(err) {
-				logger.Error(err, "failed to delete orphaned HelmRelease", "name", hr.Name, "namespace", hr.Namespace)
-			}
-		}
-	}
-
-	return nil
-}
-
-// triggerDependentPackages triggers reconcile for all Packages that depend on the given Package
-func (r *PackageReconciler) triggerDependentPackages(ctx context.Context, packageName string) error {
-	logger := log.FromContext(ctx)
-
-	// Get all Packages
-	packageList := &cozyv1alpha1.PackageList{}
-	if err := r.List(ctx, packageList); err != nil {
-		return fmt.Errorf("failed to list Packages: %w", err)
-	}
-
-	// For each Package, check if it depends on the given Package
-	for _, pkg := range packageList.Items {
-		// Skip the Package itself
-		if pkg.Name == packageName {
-			continue
-		}
-
-		// Get PackageSource
-		packageSource := &cozyv1alpha1.PackageSource{}
-		if err := r.Get(ctx, types.NamespacedName{Name: pkg.Name}, packageSource); err != nil {
-			if apierrors.IsNotFound(err) {
-				continue
-			}
-			logger.V(1).Error(err, "failed to get PackageSource", "package", pkg.Name)
-			continue
-		}
-
-		// Determine variant
-		variantName := pkg.Spec.Variant
-		if variantName == "" {
-			variantName = "default"
-		}
-
-		// Find variant
-		var variant *cozyv1alpha1.Variant
-		for i := range packageSource.Spec.Variants {
-			if packageSource.Spec.Variants[i].Name == variantName {
-				variant = &packageSource.Spec.Variants[i]
-				break
-			}
-		}
-
-		if variant == nil {
-			continue
-		}
-
-		// Check if this Package depends on the given Package
-		dependsOn := false
-		for _, dep := range variant.DependsOn {
-			// Check if dependency is in IgnoreDependencies
-			ignore := false
-			for _, ignoreDep := range pkg.Spec.IgnoreDependencies {
-				if ignoreDep == dep {
-					ignore = true
-					break
-				}
-			}
-			if ignore {
-				continue
-			}
-
-			if dep == packageName {
-				dependsOn = true
-				break
-			}
-		}
-
-		if dependsOn {
-			logger.V(1).Info("triggering reconcile for dependent Package", "package", pkg.Name, "dependency", packageName)
-			// Trigger reconcile by updating the Package (add annotation or just requeue)
-			// We can't directly requeue from here, but we can update the Package to trigger reconcile
-			// Actually, we can use the client to trigger an update, but that might cause infinite loop
-			// Better approach: use event handler or just log and let the watch handle it
-			// For now, we'll just log - the watch on PackageSource should handle it
-			// But we need a way to trigger reconcile...
-			// Let's add an annotation to trigger reconcile
-			if pkg.Annotations == nil {
-				pkg.Annotations = make(map[string]string)
-			}
-			pkg.Annotations["cozystack.io/trigger-reconcile"] = fmt.Sprintf("%d", metav1.Now().Unix())
-			if err := r.Update(ctx, &pkg); err != nil {
-				logger.V(1).Error(err, "failed to trigger reconcile for dependent Package", "package", pkg.Name)
-			}
-		}
-	}
-
-	return nil
-}
-
-// SetupWithManager sets up the controller with the Manager.
-func (r *PackageReconciler) SetupWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewControllerManagedBy(mgr).
-		Named("cozystack-package").
-		For(&cozyv1alpha1.Package{}).
-		Watches(
-			&cozyv1alpha1.PackageSource{},
-			handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, obj client.Object) []reconcile.Request {
-				ps, ok := obj.(*cozyv1alpha1.PackageSource)
-				if !ok {
-					return nil
-				}
-				// Find Package with the same name as PackageSource
-				// PackageSource and Package share the same name
-				pkg := &cozyv1alpha1.Package{}
-				if err := mgr.GetClient().Get(ctx, types.NamespacedName{Name: ps.Name}, pkg); err != nil {
-					// Package not found, that's ok - it might not exist yet
-					return nil
-				}
-				// Trigger reconcile for the corresponding Package
-				return []reconcile.Request{{
-					NamespacedName: types.NamespacedName{
-						Name: pkg.Name,
-					},
-				}}
-			}),
-		).
-		Watches(
-			&cozyv1alpha1.Package{},
-			handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, obj client.Object) []reconcile.Request {
-				updatedPkg, ok := obj.(*cozyv1alpha1.Package)
-				if !ok {
-					return nil
-				}
-				// Find all Packages that depend on this Package
-				packageList := &cozyv1alpha1.PackageList{}
-				if err := mgr.GetClient().List(ctx, packageList); err != nil {
-					return nil
-				}
-				var requests []reconcile.Request
-				for _, pkg := range packageList.Items {
-					if pkg.Name == updatedPkg.Name {
-						continue // Skip the Package itself
-					}
-					// Get PackageSource to check dependencies
-					packageSource := &cozyv1alpha1.PackageSource{}
-					if err := mgr.GetClient().Get(ctx, types.NamespacedName{Name: pkg.Name}, packageSource); err != nil {
-						continue
-					}
-					// Determine variant
-					variantName := pkg.Spec.Variant
-					if variantName == "" {
-						variantName = "default"
-					}
-					// Find variant
-					for _, variant := range packageSource.Spec.Variants {
-						if variant.Name == variantName {
-							// Check if this variant depends on updatedPkg
-							for _, dep := range variant.DependsOn {
-								// Check if dependency is in IgnoreDependencies
-								ignore := false
-								for _, ignoreDep := range pkg.Spec.IgnoreDependencies {
-									if ignoreDep == dep {
-										ignore = true
-										break
-									}
-								}
-								if ignore {
-									continue
-								}
-								if dep == updatedPkg.Name {
-									requests = append(requests, reconcile.Request{
-										NamespacedName: types.NamespacedName{
-											Name: pkg.Name,
-										},
-									})
-									break
-								}
-							}
-							break
-						}
-					}
-				}
-				return requests
-			}),
-		).
-		Complete(r)
-}

internal/operator/packagesource_reconciler.go

@@ -1,468 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package operator
-
-import (
-	"context"
-	"fmt"
-	"strings"
-
-	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
-	sourcewatcherv1beta1 "github.com/fluxcd/source-watcher/api/v2/v1beta1"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/api/meta"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/types"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/handler"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-	"sigs.k8s.io/controller-runtime/pkg/reconcile"
-)
-
-// PackageSourceReconciler reconciles PackageSource resources
-type PackageSourceReconciler struct {
-	client.Client
-	Scheme *runtime.Scheme
-}
-
-// +kubebuilder:rbac:groups=cozystack.io,resources=packagesources,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=cozystack.io,resources=packagesources/status,verbs=get;update;patch
-// +kubebuilder:rbac:groups=source.extensions.fluxcd.io,resources=artifactgenerators,verbs=get;list;watch;create;update;patch;delete
-
-// Reconcile is part of the main kubernetes reconciliation loop
-func (r *PackageSourceReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
-	logger := log.FromContext(ctx)
-
-	packageSource := &cozyv1alpha1.PackageSource{}
-	if err := r.Get(ctx, req.NamespacedName, packageSource); err != nil {
-		if apierrors.IsNotFound(err) {
-			// Resource not found, return (ownerReference will handle cleanup)
-			return ctrl.Result{}, nil
-		}
-		return ctrl.Result{}, err
-	}
-
-	// Generate ArtifactGenerator for package source
-	if err := r.reconcileArtifactGenerators(ctx, packageSource); err != nil {
-		logger.Error(err, "failed to reconcile ArtifactGenerator")
-		return ctrl.Result{}, err
-	}
-
-	// Update PackageSource status (variants and conditions from ArtifactGenerator)
-	if err := r.updateStatus(ctx, packageSource); err != nil {
-		logger.Error(err, "failed to update status")
-		// Don't return error, status update is not critical
-	}
-
-	return ctrl.Result{}, nil
-}
-
-// reconcileArtifactGenerators generates a single ArtifactGenerator for the package source
-// Creates one ArtifactGenerator per package source with all OutputArtifacts from components
-func (r *PackageSourceReconciler) reconcileArtifactGenerators(ctx context.Context, packageSource *cozyv1alpha1.PackageSource) error {
-	logger := log.FromContext(ctx)
-
-	// Check if SourceRef is set
-	if packageSource.Spec.SourceRef == nil {
-		logger.Info("skipping ArtifactGenerator creation, SourceRef not set", "packageSource", packageSource.Name)
-		return nil
-	}
-
-	// Build library map from all variants
-	// Map key is the library name (from lib.Name or extracted from path)
-	// This allows components to reference libraries by name
-	libraryMap := make(map[string]cozyv1alpha1.Library)
-	for _, variant := range packageSource.Spec.Variants {
-		for _, lib := range variant.Libraries {
-			libName := lib.Name
-			if libName == "" {
-				// If library name is not set, extract from path
-				libName = r.getPackageNameFromPath(lib.Path)
-			}
-			if libName != "" {
-				// Store library with the resolved name
-				libraryMap[libName] = lib
-			}
-		}
-	}
-
-	// Namespace is always cozy-system
-	namespace := "cozy-system"
-	// ArtifactGenerator name is the package source name
-	agName := packageSource.Name
-
-	// Collect all OutputArtifacts
-	outputArtifacts := []sourcewatcherv1beta1.OutputArtifact{}
-
-	// Process all variants and their components
-	for _, variant := range packageSource.Spec.Variants {
-		for _, component := range variant.Components {
-			// Skip components without path
-			if component.Path == "" {
-				logger.V(1).Info("skipping component without path", "packageSource", packageSource.Name, "variant", variant.Name, "component", component.Name)
-				continue
-			}
-
-			logger.V(1).Info("processing component", "packageSource", packageSource.Name, "variant", variant.Name, "component", component.Name, "path", component.Path)
-
-			// Extract component name from path (last component)
-			componentPathName := r.getPackageNameFromPath(component.Path)
-			if componentPathName == "" {
-				logger.Info("skipping component with invalid path", "packageSource", packageSource.Name, "variant", variant.Name, "component", component.Name, "path", component.Path)
-				continue
-			}
-
-			// Get basePath with default values
-			basePath := r.getBasePath(packageSource)
-
-			// Build copy operations
-			copyOps := []sourcewatcherv1beta1.CopyOperation{
-				{
-					From: r.buildSourcePath(packageSource.Spec.SourceRef.Name, basePath, component.Path),
-					To:   fmt.Sprintf("@artifact/%s/", componentPathName),
-				},
-			}
-
-			// Add libraries if specified
-			for _, libName := range component.Libraries {
-				if lib, ok := libraryMap[libName]; ok {
-					copyOps = append(copyOps, sourcewatcherv1beta1.CopyOperation{
-						From: r.buildSourcePath(packageSource.Spec.SourceRef.Name, basePath, lib.Path),
-						To:   fmt.Sprintf("@artifact/%s/charts/%s/", componentPathName, libName),
-					})
-				}
-			}
-
-			// Add valuesFiles if specified
-			for i, valuesFile := range component.ValuesFiles {
-				strategy := "Merge"
-				if i == 0 {
-					strategy = "Overwrite"
-				}
-				copyOps = append(copyOps, sourcewatcherv1beta1.CopyOperation{
-					From:     r.buildSourceFilePath(packageSource.Spec.SourceRef.Name, basePath, fmt.Sprintf("%s/%s", component.Path, valuesFile)),
-					To:       fmt.Sprintf("@artifact/%s/values.yaml", componentPathName),
-					Strategy: strategy,
-				})
-			}
-
-			// Artifact name: <packagesource>-<variant>-<componentname>
-			// Replace dots with dashes to comply with Kubernetes naming requirements
-			artifactName := fmt.Sprintf("%s-%s-%s",
-				strings.ReplaceAll(packageSource.Name, ".", "-"),
-				strings.ReplaceAll(variant.Name, ".", "-"),
-				strings.ReplaceAll(component.Name, ".", "-"))
-
-			outputArtifacts = append(outputArtifacts, sourcewatcherv1beta1.OutputArtifact{
-				Name: artifactName,
-				Copy: copyOps,
-			})
-
-			logger.Info("added OutputArtifact for component", "packageSource", packageSource.Name, "variant", variant.Name, "component", component.Name, "artifactName", artifactName)
-		}
-	}
-
-	// If there are no OutputArtifacts, return (ownerReference will handle cleanup if needed)
-	if len(outputArtifacts) == 0 {
-		logger.Info("no OutputArtifacts to generate, skipping ArtifactGenerator creation", "packageSource", packageSource.Name)
-		return nil
-	}
-
-	// Build labels
-	labels := make(map[string]string)
-	labels["cozystack.io/packagesource"] = packageSource.Name
-
-	// Create single ArtifactGenerator for the package source
-	ag := &sourcewatcherv1beta1.ArtifactGenerator{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      agName,
-			Namespace: namespace,
-			Labels:    labels,
-		},
-		Spec: sourcewatcherv1beta1.ArtifactGeneratorSpec{
-			Sources: []sourcewatcherv1beta1.SourceReference{
-				{
-					Alias:     packageSource.Spec.SourceRef.Name,
-					Kind:      packageSource.Spec.SourceRef.Kind,
-					Name:      packageSource.Spec.SourceRef.Name,
-					Namespace: packageSource.Spec.SourceRef.Namespace,
-				},
-			},
-			OutputArtifacts: outputArtifacts,
-		},
-	}
-
-	// Set ownerReference
-	ag.OwnerReferences = []metav1.OwnerReference{
-		{
-			APIVersion: packageSource.APIVersion,
-			Kind:       packageSource.Kind,
-			Name:       packageSource.Name,
-			UID:        packageSource.UID,
-			Controller: func() *bool { b := true; return &b }(),
-		},
-	}
-
-	logger.Info("creating ArtifactGenerator for package source", "packageSource", packageSource.Name, "agName", agName, "namespace", namespace, "outputArtifactCount", len(outputArtifacts))
-
-	if err := r.createOrUpdate(ctx, ag); err != nil {
-		return fmt.Errorf("failed to reconcile ArtifactGenerator %s: %w", agName, err)
-	}
-
-	logger.Info("reconciled ArtifactGenerator for package source", "name", agName, "namespace", namespace, "outputArtifactCount", len(outputArtifacts))
-
-	return nil
-}
-
-// Helper functions
-func (r *PackageSourceReconciler) getPackageNameFromPath(path string) string {
-	parts := strings.Split(path, "/")
-	if len(parts) > 0 {
-		return parts[len(parts)-1]
-	}
-	return ""
-}
-
-// getBasePath returns the basePath with default values based on source kind
-func (r *PackageSourceReconciler) getBasePath(packageSource *cozyv1alpha1.PackageSource) string {
-	// If path is explicitly set in SourceRef, use it (but normalize "/" to empty)
-	if packageSource.Spec.SourceRef.Path != "" {
-		path := strings.Trim(packageSource.Spec.SourceRef.Path, "/")
-		// If path is "/" or empty after trim, return empty string
-		if path == "" {
-			return ""
-		}
-		return path
-	}
-	// Default values based on kind
-	if packageSource.Spec.SourceRef.Kind == "OCIRepository" {
-		return "" // Root for OCI
-	}
-	// Default for GitRepository
-	return "packages"
-}
-
-// buildSourcePath builds the full source path using basePath with glob pattern
-func (r *PackageSourceReconciler) buildSourcePath(sourceName, basePath, path string) string {
-	// Remove leading/trailing slashes and combine
-	parts := []string{}
-	if basePath != "" {
-		trimmed := strings.Trim(basePath, "/")
-		if trimmed != "" {
-			parts = append(parts, trimmed)
-		}
-	}
-	if path != "" {
-		trimmed := strings.Trim(path, "/")
-		if trimmed != "" {
-			parts = append(parts, trimmed)
-		}
-	}
-
-	fullPath := strings.Join(parts, "/")
-	if fullPath == "" {
-		return fmt.Sprintf("@%s/**", sourceName)
-	}
-	return fmt.Sprintf("@%s/%s/**", sourceName, fullPath)
-}
-
-// buildSourceFilePath builds the full source path for a specific file (without glob pattern)
-func (r *PackageSourceReconciler) buildSourceFilePath(sourceName, basePath, path string) string {
-	// Remove leading/trailing slashes and combine
-	parts := []string{}
-	if basePath != "" {
-		trimmed := strings.Trim(basePath, "/")
-		if trimmed != "" {
-			parts = append(parts, trimmed)
-		}
-	}
-	if path != "" {
-		trimmed := strings.Trim(path, "/")
-		if trimmed != "" {
-			parts = append(parts, trimmed)
-		}
-	}
-
-	fullPath := strings.Join(parts, "/")
-	if fullPath == "" {
-		return fmt.Sprintf("@%s", sourceName)
-	}
-	return fmt.Sprintf("@%s/%s", sourceName, fullPath)
-}
-
-// createOrUpdate creates or updates a resource
-func (r *PackageSourceReconciler) createOrUpdate(ctx context.Context, obj client.Object) error {
-	existing := obj.DeepCopyObject().(client.Object)
-	key := client.ObjectKeyFromObject(obj)
-
-	err := r.Get(ctx, key, existing)
-	if apierrors.IsNotFound(err) {
-		return r.Create(ctx, obj)
-	} else if err != nil {
-		return err
-	}
-
-	// Preserve resource version
-	obj.SetResourceVersion(existing.GetResourceVersion())
-	// Merge labels and annotations
-	labels := obj.GetLabels()
-	if labels == nil {
-		labels = make(map[string]string)
-	}
-	for k, v := range existing.GetLabels() {
-		if _, ok := labels[k]; !ok {
-			labels[k] = v
-		}
-	}
-	obj.SetLabels(labels)
-
-	annotations := obj.GetAnnotations()
-	if annotations == nil {
-		annotations = make(map[string]string)
-	}
-	for k, v := range existing.GetAnnotations() {
-		if _, ok := annotations[k]; !ok {
-			annotations[k] = v
-		}
-	}
-	obj.SetAnnotations(annotations)
-
-	// For ArtifactGenerator, explicitly update Spec (OutputArtifacts and Sources)
-	if ag, ok := obj.(*sourcewatcherv1beta1.ArtifactGenerator); ok {
-		if existingAG, ok := existing.(*sourcewatcherv1beta1.ArtifactGenerator); ok {
-			logger := log.FromContext(ctx)
-			logger.V(1).Info("updating ArtifactGenerator Spec", "name", ag.Name, "namespace", ag.Namespace,
-				"outputArtifactCount", len(ag.Spec.OutputArtifacts))
-			// Update Spec from obj (which contains the desired state with all OutputArtifacts)
-			existingAG.Spec = ag.Spec
-			// Preserve metadata updates we made above
-			existingAG.SetLabels(ag.GetLabels())
-			existingAG.SetAnnotations(ag.GetAnnotations())
-			existingAG.SetOwnerReferences(ag.GetOwnerReferences())
-			// Use existingAG for Update
-			obj = existingAG
-		}
-	}
-
-	return r.Update(ctx, obj)
-}
-
-// updateStatus updates PackageSource status (variants and conditions from ArtifactGenerator)
-func (r *PackageSourceReconciler) updateStatus(ctx context.Context, packageSource *cozyv1alpha1.PackageSource) error {
-	logger := log.FromContext(ctx)
-
-	// Update variants in status from spec
-	variantNames := make([]string, 0, len(packageSource.Spec.Variants))
-	for _, variant := range packageSource.Spec.Variants {
-		variantNames = append(variantNames, variant.Name)
-	}
-	packageSource.Status.Variants = strings.Join(variantNames, ",")
-
-	// Check if SourceRef is set
-	if packageSource.Spec.SourceRef == nil {
-		// Set status to unknown if SourceRef is not set
-		meta.SetStatusCondition(&packageSource.Status.Conditions, metav1.Condition{
-			Type:    "Ready",
-			Status:  metav1.ConditionUnknown,
-			Reason:  "SourceRefNotSet",
-			Message: "SourceRef is not configured",
-		})
-		return r.Status().Update(ctx, packageSource)
-	}
-
-	// Get ArtifactGenerator
-	ag := &sourcewatcherv1beta1.ArtifactGenerator{}
-	agKey := types.NamespacedName{
-		Name:      packageSource.Name,
-		Namespace: "cozy-system",
-	}
-
-	if err := r.Get(ctx, agKey, ag); err != nil {
-		if apierrors.IsNotFound(err) {
-			// ArtifactGenerator not found, set status to unknown
-			meta.SetStatusCondition(&packageSource.Status.Conditions, metav1.Condition{
-				Type:    "Ready",
-				Status:  metav1.ConditionUnknown,
-				Reason:  "ArtifactGeneratorNotFound",
-				Message: "ArtifactGenerator not found",
-			})
-			return r.Status().Update(ctx, packageSource)
-		}
-		return fmt.Errorf("failed to get ArtifactGenerator: %w", err)
-	}
-
-	// Find Ready condition in ArtifactGenerator
-	readyCondition := meta.FindStatusCondition(ag.Status.Conditions, "Ready")
-	if readyCondition == nil {
-		// No Ready condition in ArtifactGenerator, set status to unknown
-		meta.SetStatusCondition(&packageSource.Status.Conditions, metav1.Condition{
-			Type:    "Ready",
-			Status:  metav1.ConditionUnknown,
-			Reason:  "ArtifactGeneratorNotReady",
-			Message: "ArtifactGenerator Ready condition not found",
-		})
-		return r.Status().Update(ctx, packageSource)
-	}
-
-	// Copy Ready condition from ArtifactGenerator to PackageSource
-	meta.SetStatusCondition(&packageSource.Status.Conditions, metav1.Condition{
-		Type:               "Ready",
-		Status:             readyCondition.Status,
-		Reason:             readyCondition.Reason,
-		Message:            readyCondition.Message,
-		ObservedGeneration: packageSource.Generation,
-		LastTransitionTime: readyCondition.LastTransitionTime,
-	})
-
-	logger.V(1).Info("updated PackageSource status from ArtifactGenerator",
-		"packageSource", packageSource.Name,
-		"status", readyCondition.Status,
-		"reason", readyCondition.Reason)
-
-	return r.Status().Update(ctx, packageSource)
-}
-
-// SetupWithManager sets up the controller with the Manager.
-func (r *PackageSourceReconciler) SetupWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewControllerManagedBy(mgr).
-		Named("cozystack-packagesource").
-		For(&cozyv1alpha1.PackageSource{}).
-		Watches(
-			&sourcewatcherv1beta1.ArtifactGenerator{},
-			handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, obj client.Object) []reconcile.Request {
-				ag, ok := obj.(*sourcewatcherv1beta1.ArtifactGenerator)
-				if !ok {
-					return nil
-				}
-				// Find the PackageSource that owns this ArtifactGenerator by ownerReference
-				for _, ownerRef := range ag.OwnerReferences {
-					if ownerRef.Kind == "PackageSource" {
-						return []reconcile.Request{{
-							NamespacedName: types.NamespacedName{
-								Name: ownerRef.Name,
-							},
-						}}
-					}
-				}
-				return nil
-			}),
-		).
-		Complete(r)
-}
-

packages/apps/bucket/templates/helmrelease.yaml

@@ -3,10 +3,15 @@ kind: HelmRelease
 metadata:
   name: {{ .Release.Name }}-system
 spec:
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-bucket-application-default-bucket-system
-    namespace: cozy-system
+  chart:
+    spec:
+      chart: cozy-bucket
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+      version: '>= 0.0.0-0'
   interval: 5m
   timeout: 10m
   install:

packages/apps/http-cache/images/nginx-cache.tag

@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/nginx-cache:0.0.0@sha256:e0a07082bb6fc6aeaae2315f335386f1705a646c72f9e0af512aebbca5cb2b15
+ghcr.io/cozystack/cozystack/nginx-cache:0.0.0@sha256:50ac1581e3100bd6c477a71161cb455a341ffaf9e5e2f6086802e4e25271e8af

packages/apps/kubernetes/.helmignore

@@ -1,4 +1,3 @@
 .helmignore
 /logos
 /Makefile
-/hack

packages/apps/kubernetes/Makefile

@@ -6,12 +6,9 @@ include ../../../scripts/package.mk
 
 generate:
 	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	yq -o=json -i '.properties.version.enum = (load("files/versions.yaml") | keys)' values.schema.json
 	../../../hack/update-crd.sh
 
-update:
-	hack/update-versions.sh
-	make generate
-
 image: image-ubuntu-container-disk image-kubevirt-cloud-provider image-kubevirt-csi-driver image-cluster-autoscaler
 
 image-ubuntu-container-disk:

packages/apps/kubernetes/README.md

@@ -104,7 +104,7 @@ See the reference for components utilized in this service:
 | `nodeGroups[name].resources.memory` | Memory (RAM) available.                                                                        | `quantity`          | `""`        |
 | `nodeGroups[name].gpus`             | List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).                            | `[]object`          | `[]`        |
 | `nodeGroups[name].gpus[i].name`     | Name of GPU, such as "nvidia.com/AD102GL_L40S".                                                | `string`            | `""`        |
-| `version`                           | Kubernetes major.minor version to deploy                                                       | `string`            | `v1.33`     |
+| `version`                           | Kubernetes version (vMAJOR.MINOR). Supported: 1.28–1.33.                                     | `string`            | `v1.33`     |
 | `host`                              | External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty. | `string`            | `""`        |
 
 

packages/apps/kubernetes/files/versions.yaml

@@ -1,6 +1,6 @@
-"v1.33": "v1.33.0"
-"v1.32": "v1.32.10"
-"v1.31": "v1.31.14"
-"v1.30": "v1.30.14"
-"v1.29": "v1.29.15"
 "v1.28": "v1.28.15"
+"v1.29": "v1.29.15"
+"v1.30": "v1.30.14"
+"v1.31": "v1.31.10"
+"v1.32": "v1.32.6"
+"v1.33": "v1.33.0"

packages/apps/kubernetes/hack/update-versions.sh

@@ -1,260 +0,0 @@
-#!/usr/bin/env bash
-
-set -o errexit
-set -o nounset
-set -o pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-KUBERNETES_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
-VALUES_FILE="${KUBERNETES_DIR}/values.yaml"
-VERSIONS_FILE="${KUBERNETES_DIR}/files/versions.yaml"
-MAKEFILE="${KUBERNETES_DIR}/Makefile"
-KAMAJI_DOCKERFILE="${KUBERNETES_DIR}/../../system/kamaji/images/kamaji/Dockerfile"
-
-# Check if skopeo is installed
-if ! command -v skopeo &> /dev/null; then
-    echo "Error: skopeo is not installed. Please install skopeo and try again." >&2
-    exit 1
-fi
-
-# Check if jq is installed
-if ! command -v jq &> /dev/null; then
-    echo "Error: jq is not installed. Please install jq and try again." >&2
-    exit 1
-fi
-
-# Get kamaji version from Dockerfile
-echo "Reading kamaji version from Dockerfile..."
-if [ ! -f "$KAMAJI_DOCKERFILE" ]; then
-    echo "Error: Kamaji Dockerfile not found at $KAMAJI_DOCKERFILE" >&2
-    exit 1
-fi
-
-KAMAJI_VERSION=$(grep "^ARG VERSION=" "$KAMAJI_DOCKERFILE" | cut -d= -f2 | tr -d '"')
-if [ -z "$KAMAJI_VERSION" ]; then
-    echo "Error: Could not extract kamaji version from Dockerfile" >&2
-    exit 1
-fi
-
-echo "Kamaji version: $KAMAJI_VERSION"
-
-# Get Kubernetes version from kamaji repository
-echo "Fetching Kubernetes version from kamaji repository..."
-KUBERNETES_VERSION_FROM_KAMAJI=$(curl -sSL "https://raw.githubusercontent.com/clastix/kamaji/${KAMAJI_VERSION}/internal/upgrade/kubeadm_version.go" | grep "KubeadmVersion" | sed -E 's/.*KubeadmVersion = "([^"]+)".*/\1/')
-
-if [ -z "$KUBERNETES_VERSION_FROM_KAMAJI" ]; then
-    echo "Error: Could not fetch Kubernetes version from kamaji repository" >&2
-    exit 1
-fi
-
-echo "Kubernetes version from kamaji: $KUBERNETES_VERSION_FROM_KAMAJI"
-
-# Extract major.minor version (e.g., "1.33" from "v1.33.0")
-KUBERNETES_MAJOR_MINOR=$(echo "$KUBERNETES_VERSION_FROM_KAMAJI" | sed -E 's/v([0-9]+)\.([0-9]+)\.[0-9]+/\1.\2/')
-KUBERNETES_MAJOR=$(echo "$KUBERNETES_MAJOR_MINOR" | cut -d. -f1)
-KUBERNETES_MINOR=$(echo "$KUBERNETES_MAJOR_MINOR" | cut -d. -f2)
-
-echo "Kubernetes major.minor: $KUBERNETES_MAJOR_MINOR"
-
-# Get available image tags
-echo "Fetching available image tags from registry..."
-AVAILABLE_TAGS=$(skopeo list-tags docker://registry.k8s.io/kube-apiserver | jq -r '.Tags[] | select(test("^v[0-9]+\\.[0-9]+\\.[0-9]+$"))' | sort -V)
-
-if [ -z "$AVAILABLE_TAGS" ]; then
-    echo "Error: Could not fetch available image tags" >&2
-    exit 1
-fi
-
-# Filter out versions higher than KUBERNETES_VERSION_FROM_KAMAJI
-echo "Filtering versions above ${KUBERNETES_VERSION_FROM_KAMAJI}..."
-FILTERED_TAGS=$(echo "$AVAILABLE_TAGS" | while read tag; do
-    if [ -n "$tag" ]; then
-        # Compare tag with KUBERNETES_VERSION_FROM_KAMAJI using version sort
-        # Include tag if it's less than or equal to KUBERNETES_VERSION_FROM_KAMAJI
-        if [ "$(printf '%s\n%s\n' "$tag" "$KUBERNETES_VERSION_FROM_KAMAJI" | sort -V | head -1)" = "$tag" ] || [ "$tag" = "$KUBERNETES_VERSION_FROM_KAMAJI" ]; then
-            echo "$tag"
-        fi
-    fi
-done)
-
-if [ -z "$FILTERED_TAGS" ]; then
-    echo "Error: No versions found after filtering" >&2
-    exit 1
-fi
-
-AVAILABLE_TAGS="$FILTERED_TAGS"
-echo "Filtered to $(echo "$AVAILABLE_TAGS" | wc -l | tr -d ' ') versions"
-
-# Find the latest patch version for the supported major.minor version
-echo "Finding latest patch version for ${KUBERNETES_MAJOR_MINOR}..."
-SUPPORTED_PATCH_TAGS=$(echo "$AVAILABLE_TAGS" | grep "^v${KUBERNETES_MAJOR}\\.${KUBERNETES_MINOR}\\.")
-if [ -z "$SUPPORTED_PATCH_TAGS" ]; then
-    echo "Error: Could not find any patch versions for ${KUBERNETES_MAJOR_MINOR}" >&2
-    exit 1
-fi
-KUBERNETES_VERSION=$(echo "$SUPPORTED_PATCH_TAGS" | tail -n1)
-echo "Using latest patch version: $KUBERNETES_VERSION"
-
-# Build versions map: major.minor -> latest patch version
-# First, collect all unique major.minor versions from available tags
-echo "Collecting all available major.minor versions..."
-ALL_MAJOR_MINOR_VERSIONS=$(echo "$AVAILABLE_TAGS" | sed -E 's/v([0-9]+)\.([0-9]+)\.[0-9]+/v\1.\2/' | sort -V -u)
-
-# Find the position of the supported version in the sorted list
-SUPPORTED_MAJOR_MINOR="v${KUBERNETES_MAJOR}.${KUBERNETES_MINOR}"
-echo "Looking for supported version: $SUPPORTED_MAJOR_MINOR"
-
-# Get all versions that are <= supported version
-# Create a temporary file for filtering
-TEMP_VERSIONS=$(mktemp)
-
-echo "$ALL_MAJOR_MINOR_VERSIONS" | while read version; do
-    # Compare versions using sort -V (version sort)
-    # If version <= supported, include it
-    if [ "$(printf '%s\n%s\n' "$version" "$SUPPORTED_MAJOR_MINOR" | sort -V | head -1)" = "$version" ] || [ "$version" = "$SUPPORTED_MAJOR_MINOR" ]; then
-        echo "$version"
-    fi
-done > "$TEMP_VERSIONS"
-
-# Get the supported version and 5 previous versions (total 6 versions)
-# First, find the position of supported version
-SUPPORTED_POS=$(grep -n "^${SUPPORTED_MAJOR_MINOR}$" "$TEMP_VERSIONS" | cut -d: -f1)
-
-if [ -z "$SUPPORTED_POS" ]; then
-    echo "Error: Supported version $SUPPORTED_MAJOR_MINOR not found in available versions" >&2
-    exit 1
-fi
-
-# Calculate start position (5 versions before supported, or from beginning if less than 5 available)
-TOTAL_LINES=$(wc -l < "$TEMP_VERSIONS" | tr -d ' ')
-START_POS=$((SUPPORTED_POS - 5))
-if [ $START_POS -lt 1 ]; then
-    START_POS=1
-fi
-
-# Extract versions from START_POS to SUPPORTED_POS (inclusive)
-CANDIDATE_VERSIONS=$(sed -n "${START_POS},${SUPPORTED_POS}p" "$TEMP_VERSIONS")
-
-if [ -z "$CANDIDATE_VERSIONS" ]; then
-    echo "Error: Could not find supported version $SUPPORTED_MAJOR_MINOR in available versions" >&2
-    exit 1
-fi
-
-declare -A VERSION_MAP
-VERSIONS=()
-
-# Process each candidate version
-for major_minor_key in $CANDIDATE_VERSIONS; do
-    # Extract major and minor for matching
-    major=$(echo "$major_minor_key" | sed -E 's/v([0-9]+)\.([0-9]+)/\1/')
-    minor=$(echo "$major_minor_key" | sed -E 's/v([0-9]+)\.([0-9]+)/\2/')
-    
-    # Find all tags that match this major.minor version
-    matching_tags=$(echo "$AVAILABLE_TAGS" | grep "^v${major}\\.${minor}\\.")
-    
-    if [ -n "$matching_tags" ]; then
-        # Get the latest patch version for this major.minor version
-        latest_tag=$(echo "$matching_tags" | tail -n1)
-        
-        VERSION_MAP["${major_minor_key}"]="${latest_tag}"
-        VERSIONS+=("${major_minor_key}")
-        echo "Found version: ${major_minor_key} -> ${latest_tag}"
-    fi
-done
-
-if [ ${#VERSIONS[@]} -eq 0 ]; then
-    echo "Error: No matching versions found" >&2
-    exit 1
-fi
-
-# Sort versions in descending order (newest first)
-IFS=$'\n' VERSIONS=($(printf '%s\n' "${VERSIONS[@]}" | sort -V -r))
-unset IFS
-
-echo "Versions to add: ${VERSIONS[*]}"
-
-# Create/update versions.yaml file
-echo "Updating $VERSIONS_FILE..."
-{
-    for ver in "${VERSIONS[@]}"; do
-        echo "\"${ver}\": \"${VERSION_MAP[$ver]}\""
-    done
-} > "$VERSIONS_FILE"
-
-echo "Successfully updated $VERSIONS_FILE"
-
-# Update values.yaml - enum with major.minor versions only
-TEMP_FILE=$(mktemp)
-trap "rm -f $TEMP_FILE $TEMP_VERSIONS" EXIT
-
-# Build new version section
-NEW_VERSION_SECTION="## @enum {string} Version"
-for ver in "${VERSIONS[@]}"; do
-    NEW_VERSION_SECTION="${NEW_VERSION_SECTION}
-## @value $ver"
-done
-NEW_VERSION_SECTION="${NEW_VERSION_SECTION}
-
-## @param {Version} version - Kubernetes major.minor version to deploy
-version: \"${VERSIONS[0]}\""
-
-# Check if version section already exists
-if grep -q "^## @enum {string} Version" "$VALUES_FILE"; then
-    # Version section exists, update it using awk
-    echo "Updating existing version section in $VALUES_FILE..."
-    
-    # Use awk to replace the section from "## @enum {string} Version" to "version: " (inclusive)
-    # Delete the old section and insert the new one
-    awk -v new_section="$NEW_VERSION_SECTION" '
-        /^## @enum {string} Version/ {
-            in_section = 1
-            print new_section
-            next
-        }
-        in_section && /^version: / {
-            in_section = 0
-            next
-        }
-        in_section {
-            next
-        }
-        { print }
-    ' "$VALUES_FILE" > "$TEMP_FILE.tmp"
-    mv "$TEMP_FILE.tmp" "$VALUES_FILE"
-else
-    # Version section doesn't exist, insert it before Application-specific parameters section
-    echo "Inserting new version section in $VALUES_FILE..."
-    
-    # Use awk to insert before "## @section Application-specific parameters"
-    awk -v new_section="$NEW_VERSION_SECTION" '
-        /^## @section Application-specific parameters/ {
-            print new_section
-            print ""
-        }
-        { print }
-    ' "$VALUES_FILE" > "$TEMP_FILE.tmp"
-    mv "$TEMP_FILE.tmp" "$VALUES_FILE"
-fi
-
-echo "Successfully updated $VALUES_FILE with versions: ${VERSIONS[*]}"
-
-# Update KUBERNETES_VERSION in Makefile
-# Extract major.minor from KUBERNETES_VERSION (e.g., "v1.33" from "v1.33.4")
-KUBERNETES_MAJOR_MINOR_FOR_MAKEFILE=$(echo "$KUBERNETES_VERSION" | sed -E 's/v([0-9]+)\.([0-9]+)\.[0-9]+/v\1.\2/')
-
-if grep -q "^KUBERNETES_VERSION" "$MAKEFILE"; then
-    # Update existing KUBERNETES_VERSION line using awk
-    echo "Updating KUBERNETES_VERSION in $MAKEFILE..."
-    awk -v new_version="${KUBERNETES_MAJOR_MINOR_FOR_MAKEFILE}" '
-        /^KUBERNETES_VERSION = / {
-            print "KUBERNETES_VERSION = " new_version
-            next
-        }
-        { print }
-    ' "$MAKEFILE" > "$TEMP_FILE.tmp"
-    mv "$TEMP_FILE.tmp" "$MAKEFILE"
-    echo "Successfully updated KUBERNETES_VERSION in $MAKEFILE to ${KUBERNETES_MAJOR_MINOR_FOR_MAKEFILE}"
-else
-    echo "Warning: KUBERNETES_VERSION not found in $MAKEFILE" >&2
-fi
-

packages/apps/kubernetes/images/kubevirt-csi-driver.tag

@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:d5c836ba33cf5dbed7e6f866784f668f80ffe69179e7c75847b680111984eefb
+ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.0.0@sha256:c8b08084a86251cdd18e237de89b695bca0e4f7eb1f1f6ddc2b903b4d74ea5ff

packages/apps/kubernetes/templates/cluster.yaml

@@ -182,33 +182,6 @@ metadata:
 spec:
   template:
     spec:
-      files:
-      - path: /usr/bin/update-k8s.sh
-        owner: root:root
-        permissions: "0755"
-        content: |
-          #!/usr/bin/env bash
-          set -euo pipefail
-
-          # Expected to be passed in via preKubeadmCommands
-          : "${KUBELET_VERSION:?KUBELET_VERSION must be set, e.g. v1.31.0}"
-
-          ARCH="$(uname -m)"
-          case "${ARCH}" in
-            x86_64) ARCH=amd64 ;;
-            aarch64) ARCH=arm64 ;;
-          esac
-
-          # Use your internal mirror here for real-world use.
-          BASE_URL="https://dl.k8s.io/release/${KUBELET_VERSION}/bin/linux/${ARCH}"
-
-          echo "Installing kubelet and kubeadm  ${KUBELET_VERSION} for ${ARCH}..."
-          curl -fsSL "${BASE_URL}/kubelet" -o /root/kubelet
-          curl -fsSL "${BASE_URL}/kubeadm" -o /root/kubeadm
-          chmod 0755 /root/kubelet
-          chmod 0755 /root/kubeadm
-          if /root/kubelet --version ; then mv /root/kubelet /usr/bin/kubelet ; fi
-          if /root/kubeadm version ; then mv /root/kubeadm /usr/bin/kubeadm ; fi
       diskSetup:
         filesystems:
         - device: /dev/vdb
@@ -232,7 +205,6 @@ spec:
         {{- end }}
       {{- end }}
       preKubeadmCommands:
-      - KUBELET_VERSION={{ include "kubernetes.versionMap" $}} /usr/bin/update-k8s.sh || true
       - sed -i 's|root:x:|root::|' /etc/passwd
       - systemctl stop containerd.service
       - mkdir -p /ephemeral/kubelet /ephemeral/containerd

packages/apps/kubernetes/templates/csi/delete.yaml

@@ -0,0 +1,76 @@
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  annotations:
+    "helm.sh/hook": post-delete
+    "helm.sh/hook-weight": "10"
+    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation,hook-failed
+  name: {{ .Release.Name }}-datavolume-cleanup
+spec:
+  template:
+    spec:
+      serviceAccountName: {{ .Release.Name }}-datavolume-cleanup
+      restartPolicy: Never
+      tolerations:
+        - key: CriticalAddonsOnly
+          operator: Exists
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: "NoSchedule"
+      containers:
+        - name: kubectl
+          image: docker.io/clastix/kubectl:v1.32
+          command:
+            - /bin/sh
+            - -c
+            - kubectl -n {{ .Release.Namespace }} delete datavolumes
+              -l "cluster.x-k8s.io/cluster-name={{ .Release.Name }}"
+              --ignore-not-found=true
+
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Release.Name }}-datavolume-cleanup
+  annotations:
+    helm.sh/hook: post-delete
+    helm.sh/hook-delete-policy: before-hook-creation,hook-failed,hook-succeeded
+    helm.sh/hook-weight: "0"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  annotations:
+    "helm.sh/hook": post-delete
+    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation,hook-failed
+    "helm.sh/hook-weight": "5"
+  name: {{ .Release.Name }}-datavolume-cleanup
+rules:
+  - apiGroups:
+      - "cdi.kubevirt.io"
+    resources:
+      - datavolumes
+    verbs:
+      - get
+      - list
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  annotations:
+    "helm.sh/hook": post-delete
+    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation,hook-failed
+    "helm.sh/hook-weight": "5"
+  name: {{ .Release.Name }}-datavolume-cleanup
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-datavolume-cleanup
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Release.Name }}-datavolume-cleanup
+    namespace: {{ .Release.Namespace }}
+

packages/apps/kubernetes/templates/delete.yaml

@@ -1,149 +0,0 @@
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  annotations:
-    "helm.sh/hook": pre-delete
-    "helm.sh/hook-weight": "10"
-    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
-  name: {{ .Release.Name }}-pre-cleanup
-spec:
-  template:
-    metadata:
-      labels:
-        policy.cozystack.io/allow-to-apiserver: "true"
-    spec:
-      serviceAccountName: {{ .Release.Name }}-cleanup
-      restartPolicy: Never
-      tolerations:
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - key: node-role.kubernetes.io/control-plane
-          operator: Exists
-          effect: "NoSchedule"
-      containers:
-        - name: kubectl
-          image: docker.io/clastix/kubectl:v1.32
-          command:
-            - /bin/sh
-            - -c
-            - |
-              set -e
-              echo "Step 1: Suspending all HelmReleases with label cozystack.io/target-cluster-name={{ .Release.Name }}"
-              for hr in $(kubectl -n {{ .Release.Namespace }} get helmreleases.helm.toolkit.fluxcd.io -l "cozystack.io/target-cluster-name={{ .Release.Name }}" -o name 2>/dev/null || true); do
-                if [ -n "$hr" ]; then           
-                  echo "  Suspending $hr"
-                  kubectl -n {{ .Release.Namespace }} patch "$hr" \
-                    -p '{"spec": {"suspend": true}}' \
-                    --type=merge --field-manager=flux-client-side-apply
-                fi
-              done
-
-              echo "Step 2: Deleting HelmReleases with label cozystack.io/target-cluster-name={{ .Release.Name }}"
-              kubectl -n {{ .Release.Namespace }} delete helmreleases.helm.toolkit.fluxcd.io \
-                -l "cozystack.io/target-cluster-name={{ .Release.Name }}" \
-                --ignore-not-found=true --wait=true
-
-              echo "Step 3: Deleting KamajiControlPlane {{ .Release.Name }}"
-              kubectl -n {{ .Release.Namespace }} delete kamajicontrolplanes.controlplane.cluster.x-k8s.io {{ .Release.Name }} \
-                --ignore-not-found=true
-
-              echo "Step 4: Deleting TenantControlPlane {{ .Release.Name }}"
-              kubectl -n {{ .Release.Namespace }} delete tenantcontrolplanes.kamaji.clastix.io {{ .Release.Name }} \
-                --ignore-not-found=true
-
-              echo "Step 5: Cleaning up DataVolumes"
-              kubectl -n {{ .Release.Namespace }} delete datavolumes \
-                -l "cluster.x-k8s.io/cluster-name={{ .Release.Name }}" \
-                --ignore-not-found=true
-
-              echo "Step 6: Cleaning up LoadBalancer Services"
-              kubectl -n {{ .Release.Namespace }} delete services \
-                -l "cluster.x-k8s.io/cluster-name={{ .Release.Name }}" \
-                --field-selector spec.type=LoadBalancer \
-                --ignore-not-found=true
-
-              echo "Cleanup completed successfully"
-
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ .Release.Name }}-cleanup
-  annotations:
-    helm.sh/hook: pre-delete
-    helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation,hook-failed
-    helm.sh/hook-weight: "0"
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  annotations:
-    "helm.sh/hook": pre-delete
-    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation,hook-failed
-    "helm.sh/hook-weight": "5"
-  name: {{ .Release.Name }}-cleanup
-rules:
-  - apiGroups:
-      - "helm.toolkit.fluxcd.io"
-    resources:
-      - helmreleases
-    verbs:
-      - get
-      - list
-      - watch
-      - patch
-      - delete
-  - apiGroups:
-      - "controlplane.cluster.x-k8s.io"
-    resources:
-      - kamajicontrolplanes
-    verbs:
-      - get
-      - list
-      - watch
-      - delete
-  - apiGroups:
-      - "kamaji.clastix.io"
-    resources:
-      - tenantcontrolplanes
-    verbs:
-      - get
-      - list
-      - watch
-      - delete
-  - apiGroups:
-      - "cdi.kubevirt.io"
-    resources:
-      - datavolumes
-    verbs:
-      - get
-      - list
-      - watch
-      - delete
-  - apiGroups:
-      - ""
-    resources:
-      - services
-    verbs:
-      - get
-      - list
-      - watch
-      - delete
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  annotations:
-    "helm.sh/hook": pre-delete
-    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation,hook-failed
-    "helm.sh/hook-weight": "5"
-  name: {{ .Release.Name }}-cleanup
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ .Release.Name }}-cleanup
-subjects:
-  - kind: ServiceAccount
-    name: {{ .Release.Name }}-cleanup
-    namespace: {{ .Release.Namespace }}

packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml

@@ -8,10 +8,15 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: cert-manager-crds
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-kubernetes-application-kubevirt-kubernetes-cert-manager-crds
-    namespace: cozy-system
+  chart:
+    spec:
+      chart: cozy-cert-manager-crds
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+      version: '>= 0.0.0-0'
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig
@@ -40,6 +45,8 @@ spec:
   - name: {{ .Release.Name }}
     namespace: {{ .Release.Namespace }}
   {{- end }}
+  - name: {{ .Release.Name }}-cilium
+    namespace: {{ .Release.Namespace }}
 {{- if .Values.addons.certManager.valuesOverride }}
 ---
 apiVersion: v1

packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml

@@ -8,10 +8,15 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: cert-manager
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-kubernetes-application-kubevirt-kubernetes-cert-manager
-    namespace: cozy-system
+  chart:
+    spec:
+      chart: cozy-cert-manager
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+      version: '>= 0.0.0-0'
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/cilium.yaml

@@ -22,10 +22,15 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: cilium
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-kubernetes-application-kubevirt-kubernetes-cilium
-    namespace: cozy-system
+  chart:
+    spec:
+      chart: cozy-cilium
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+      version: '>= 0.0.0-0'
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/coredns.yaml

@@ -13,10 +13,15 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: coredns
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-kubernetes-application-kubevirt-kubernetes-coredns
-    namespace: cozy-system
+  chart:
+    spec:
+      chart: cozy-coredns
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+      version: '>= 0.0.0-0'
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/csi.yaml

@@ -8,10 +8,15 @@ metadata:
 spec:
   interval: 5m
   releaseName: csi
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-kubernetes-application-kubevirt-kubernetes-kubevirt-csi-node
-    namespace: cozy-system
+  chart:
+    spec:
+      chart: cozy-kubevirt-csi-node
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+      version: '>= 0.0.0-0'
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig
@@ -32,8 +37,6 @@ spec:
   dependsOn:
   - name: {{ .Release.Name }}-vsnap-crd
     namespace: {{ .Release.Namespace }}
-  - name: {{ .Release.Name }}-cilium
-    namespace: {{ .Release.Namespace }}
   {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
   - name: {{ .Release.Name }}
     namespace: {{ .Release.Namespace }}

packages/apps/kubernetes/templates/helmreleases/delete.yaml

@@ -0,0 +1,104 @@
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  annotations:
+    "helm.sh/hook": pre-delete
+    "helm.sh/hook-weight": "10"
+    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation,hook-failed
+  name: {{ .Release.Name }}-flux-teardown
+spec:
+  template:
+    spec:
+      serviceAccountName: {{ .Release.Name }}-flux-teardown
+      restartPolicy: Never
+      tolerations:
+        - key: CriticalAddonsOnly
+          operator: Exists
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: "NoSchedule"
+      containers:
+        - name: kubectl
+          image: docker.io/clastix/kubectl:v1.32
+          command:
+            - /bin/sh
+            - -c
+            - >-
+              kubectl
+              --namespace={{ .Release.Namespace }}
+              patch
+              helmrelease
+              {{ .Release.Name }}-cilium
+              {{ .Release.Name }}-gateway-api-crds
+              {{ .Release.Name }}-csi
+              {{ .Release.Name }}-cert-manager
+              {{ .Release.Name }}-cert-manager-crds
+              {{ .Release.Name }}-vertical-pod-autoscaler
+              {{ .Release.Name }}-vertical-pod-autoscaler-crds
+              {{ .Release.Name }}-ingress-nginx
+              {{ .Release.Name }}-fluxcd-operator
+              {{ .Release.Name }}-fluxcd
+              {{ .Release.Name }}-gpu-operator
+              {{ .Release.Name }}-velero
+              {{ .Release.Name }}-coredns
+              -p '{"spec": {"suspend": true}}'
+              --type=merge --field-manager=flux-client-side-apply || true
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Release.Name }}-flux-teardown
+  annotations:
+    helm.sh/hook: pre-delete
+    helm.sh/hook-delete-policy: before-hook-creation,hook-failed,hook-succeeded
+    helm.sh/hook-weight: "0"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  annotations:
+    "helm.sh/hook": pre-install,post-install,pre-delete
+    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation,hook-failed
+    "helm.sh/hook-weight": "5"
+  name: {{ .Release.Name }}-flux-teardown
+rules:
+  - apiGroups:
+      - "helm.toolkit.fluxcd.io"
+    resources:
+      - helmreleases
+    verbs:
+      - get
+      - patch
+    resourceNames:
+      - {{ .Release.Name }}-cilium
+      - {{ .Release.Name }}-csi
+      - {{ .Release.Name }}-cert-manager
+      - {{ .Release.Name }}-cert-manager-crds
+      - {{ .Release.Name }}-gateway-api-crds
+      - {{ .Release.Name }}-vertical-pod-autoscaler
+      - {{ .Release.Name }}-vertical-pod-autoscaler-crds
+      - {{ .Release.Name }}-ingress-nginx
+      - {{ .Release.Name }}-fluxcd-operator
+      - {{ .Release.Name }}-fluxcd
+      - {{ .Release.Name }}-gpu-operator
+      - {{ .Release.Name }}-velero
+      - {{ .Release.Name }}-coredns
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  annotations:
+    helm.sh/hook: pre-delete
+    helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation,hook-failed
+    helm.sh/hook-weight: "5"
+  name: {{ .Release.Name }}-flux-teardown
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-flux-teardown
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Release.Name }}-flux-teardown
+    namespace: {{ .Release.Namespace }}

packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml

@@ -8,10 +8,15 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: fluxcd-operator
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-kubernetes-application-kubevirt-kubernetes-fluxcd-operator
-    namespace: cozy-system
+  chart:
+    spec:
+      chart: cozy-fluxcd-operator
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+      version: '>= 0.0.0-0'
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig
@@ -51,10 +56,15 @@ metadata:
 spec:
   interval: 5m
   releaseName: fluxcd
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-kubernetes-application-kubevirt-kubernetes-fluxcd
-    namespace: cozy-system
+  chart:
+    spec:
+      chart: cozy-fluxcd
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+      version: '>= 0.0.0-0'
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-kubeconfig

packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml

@@ -8,10 +8,15 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: gateway-api-crds
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-kubernetes-application-kubevirt-kubernetes-gateway-api-crds
-    namespace: cozy-system
+  chart:
+    spec:
+      chart: cozy-gateway-api-crds
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+      version: '>= 0.0.0-0'
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml

@@ -8,10 +8,15 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: gpu-operator
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-kubernetes-application-kubevirt-kubernetes-gpu-operator
-    namespace: cozy-system
+  chart:
+    spec:
+      chart: cozy-gpu-operator
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+      version: '>= 0.0.0-0'
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml

@@ -27,10 +27,15 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: ingress-nginx
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-kubernetes-application-kubevirt-kubernetes-ingress-nginx
-    namespace: cozy-system
+  chart:
+    spec:
+      chart: cozy-ingress-nginx
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+      version: '>= 0.0.0-0'
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/metrics-server.yaml

@@ -1,37 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: {{ .Release.Name }}-metrics-server
-  labels:
-    cozystack.io/repository: system
-    cozystack.io/target-cluster-name: {{ .Release.Name }}
-spec:
-  releaseName: metrics-server
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-kubernetes-application-kubevirt-kubernetes-metrics-server
-    namespace: cozy-system
-  kubeConfig:
-    secretRef:
-      name: {{ .Release.Name }}-admin-kubeconfig
-      key: super-admin.svc
-  targetNamespace: cozy-monitoring
-  storageNamespace: cozy-monitoring
-  interval: 5m
-  timeout: 10m
-  install:
-    createNamespace: true
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
-  dependsOn:
-  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
-  - name: {{ .Release.Name }}
-    namespace: {{ .Release.Namespace }}
-  {{- end }}
-  - name: {{ .Release.Name }}-cilium
-    namespace: {{ .Release.Namespace }}
-  - name: {{ .Release.Name }}-prometheus-operator-crds
-    namespace: {{ .Release.Namespace }}

packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml

@@ -10,10 +10,15 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: cozy-monitoring-agents
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-kubernetes-application-kubevirt-kubernetes-monitoring-agents
-    namespace: cozy-system
+  chart:
+    spec:
+      chart: cozy-monitoring-agents
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+      version: '>= 0.0.0-0'
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig
@@ -39,10 +44,6 @@ spec:
     namespace: {{ .Release.Namespace }}
   - name: {{ .Release.Name }}-vertical-pod-autoscaler-crds
     namespace: {{ .Release.Namespace }}
-  - name: {{ .Release.Name }}-prometheus-operator-crds
-    namespace: {{ .Release.Namespace }}
-  - name: {{ .Release.Name }}-metrics-server
-    namespace: {{ .Release.Namespace }}
   values:
     vmagent:
       externalLabels:

packages/apps/kubernetes/templates/helmreleases/prometheus-operator-crds.yaml

@@ -1,32 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: {{ .Release.Name }}-prometheus-operator-crds
-  labels:
-    cozystack.io/repository: system
-    cozystack.io/target-cluster-name: {{ .Release.Name }}
-spec:
-  releaseName: prometheus-operator-crds
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-kubernetes-application-kubevirt-kubernetes-prometheus-operator-crds
-    namespace: cozy-system
-  kubeConfig:
-    secretRef:
-      name: {{ .Release.Name }}-admin-kubeconfig
-      key: super-admin.svc
-  targetNamespace: cozy-victoria-metrics-operator
-  storageNamespace: cozy-victoria-metrics-operator
-  interval: 5m
-  install:
-    createNamespace: true
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
-  dependsOn:
-  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
-  - name: {{ .Release.Name }}
-    namespace: {{ .Release.Namespace }}
-  {{- end }}

packages/apps/kubernetes/templates/helmreleases/velero.yaml

@@ -8,10 +8,15 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: velero
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-kubernetes-application-kubevirt-kubernetes-velero
-    namespace: cozy-system
+  chart:
+    spec:
+      chart: cozy-velero
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+      version: '>= 0.0.0-0'
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler-crds.yaml

@@ -9,10 +9,15 @@ metadata:
 spec:
   interval: 5m
   releaseName: vertical-pod-autoscaler-crds
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-kubernetes-application-kubevirt-kubernetes-vertical-pod-autoscaler-crds
-    namespace: cozy-system
+  chart:
+    spec:
+      chart: cozy-vertical-pod-autoscaler-crds
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+      version: '>= 0.0.0-0'
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig
@@ -32,4 +37,6 @@ spec:
   - name: {{ .Release.Name }}
     namespace: {{ .Release.Namespace }}
   {{- end }}
+  - name: {{ .Release.Name }}-cilium
+    namespace: {{ .Release.Namespace }}
 {{- end }}

packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml

@@ -36,10 +36,15 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: vertical-pod-autoscaler
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-kubernetes-application-kubevirt-kubernetes-vertical-pod-autoscaler
-    namespace: cozy-system
+  chart:
+    spec:
+      chart: cozy-vertical-pod-autoscaler
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+      version: '>= 0.0.0-0'
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml

@@ -8,10 +8,15 @@ metadata:
     cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
   releaseName: cozy-victoria-metrics-operator
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-kubernetes-application-kubevirt-kubernetes-victoria-metrics-operator
-    namespace: cozy-system
+  chart:
+    spec:
+      chart: cozy-victoria-metrics-operator
+      reconcileStrategy: Revision
+      sourceRef:
+        kind: HelmRepository
+        name: cozystack-system
+        namespace: cozy-system
+      version: '>= 0.0.0-0'
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig