Release v1.0.3 (#2159 )

This PR prepares the release `v1.0.3`.
Prepare release v1.0.3
2026-03-14 19:08:57 +00:00 · 2026-03-06 12:21:14 +03:00 · 2026-03-06 01:37:07 +00:00 · 2026-03-05 17:25:11 +01:00 · 2026-03-03 23:22:55 +00:00 · 2026-03-02 21:48:54 +01:00
429 changed files with 78951 additions and 67912 deletions
--- a/.github/workflows/pull-requests.yaml
+++ b/.github/workflows/pull-requests.yaml
@@ -6,6 +6,8 @@ env:
 on:
  pull_request:
    types: [opened, synchronize, reopened]
+    paths-ignore:
+      - 'docs/**/*'

 # Cancel in‑flight runs for the same PR when a new push arrives.
 concurrency:
@@ -13,19 +15,6 @@ concurrency:
  cancel-in-progress: true

 jobs:
-  detect-changes:
-    name: Detect changes
-    runs-on: ubuntu-latest
-    outputs:
-      code: ${{ steps.filter.outputs.code }}
-    steps:
-      - uses: dorny/paths-filter@v3
-        id: filter
-        with:
-          filters: |
-            code:
-              - '!docs/**'
-
  build:
    name: Build
    runs-on: [self-hosted]
@@ -33,11 +22,9 @@ jobs:
      contents: read
      packages: write

-    needs: ["detect-changes"]
-    # Never run when the PR carries the "release" label or only docs changed.
+    # Never run when the PR carries the "release" label.
    if: |
-      needs.detect-changes.outputs.code == 'true'
-      && !contains(github.event.pull_request.labels.*.name, 'release')
+      !contains(github.event.pull_request.labels.*.name, 'release')

    steps:
      - name: Checkout code
--- a/dashboards/mongodb/mongodb-inmemory.json
+++ b/dashboards/mongodb/mongodb-inmemory.json
--- a/dashboards/mongodb/mongodb-overview.json
+++ b/dashboards/mongodb/mongodb-overview.json
--- a/docs/changelogs/v1.0.0.md
+++ b/docs/changelogs/v1.0.0.md
@@ -1,289 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v1.0.0
-->
-
-# Cozystack v1.0.0 — "Stable"
-
-We are thrilled to announce **Cozystack v1.0.0**, the first stable major release of the Cozystack platform. This milestone represents a fundamental architectural evolution from the v0.x series, introducing a fully operator-driven package management system, a comprehensive backup and restore framework, a redesigned virtual machine architecture, and a rich set of new managed applications — all hardened through an extensive alpha, beta, and release-candidate cycle.
-
-## Feature Highlights
-
-### Package-Based Architecture with Cozystack Operator
-
-The most significant architectural change in v1.0.0 is the replacement of HelmRelease bundle deployments with a declarative **Package** and **PackageSource** model managed by the new `cozystack-operator`. Operators now define their platform configuration in a structured `values.yaml` and the operator reconciles the desired state by managing Package and PackageSource resources across the cluster.
-
-The operator also takes ownership of CRD lifecycle — installing and updating CRDs from embedded manifests at every startup — eliminating the stale-CRD problem that affected Helm-only installations. Flux sharding has been added to distribute tenant HelmRelease reconciliation across multiple Flux controllers, providing horizontal scalability in large multi-tenant environments.
-
-A migration script (`hack/migrate-to-version-1.0.sh`) is provided for upgrading existing v0.x clusters, along with 33 incremental migration steps that automate resource renaming, secret cleanup, and configuration conversion.
-
-### Comprehensive Backup and Restore System
-
-v1.0.0 ships a fully featured, production-ready backup and restore framework built on Velero integration. Users can define **BackupClass** resources to describe backup storage targets, create **BackupPlan** schedules, and trigger **RestoreJob** resources for end-to-end application recovery.
-
-Virtual machine backups are supported natively via the Velero KubeVirt plugin, which captures consistent VM disk snapshots alongside metadata. The backup controller and the backup strategy sub-controllers (including the VM-specific strategy) are installed by default, and a full dashboard UI allows users to monitor backup status, view backup job history, and initiate restore workflows.
-
-### Redesigned Virtual Machine Architecture
-
-The legacy `virtual-machine` application has been replaced with a two-resource architecture: **`vm-disk`** for managing persistent disks and **`vm-instance`** for managing VM lifecycle. This separation provides cleaner disk/instance management, allows disks to be reused across VM instances, and aligns with modern KubeVirt patterns.
-
-New capabilities include: a `cpuModel` field for direct CPU model specification without using an instanceType; the ability to switch between `instanceType`-based and custom resource-based configurations; migration from the deprecated `running` field to `runStrategy`; and native **RWX (NFS) filesystem support** in the KubeVirt CSI driver, enabling multiple pods to mount the same persistent volume simultaneously.
-
-### New Managed Applications
-
-v1.0.0 expands the application catalog significantly:
-
- **MongoDB**: A fully managed MongoDB replica set with persistent storage, monitoring integration, and unified user/database configuration API.
- **Qdrant**: A high-performance vector database for AI and machine learning workloads, supporting single-replica and clustered modes with API key authentication and optional external LoadBalancer access.
- **Harbor**: A fully managed OCI container registry backed by CloudNativePG, Redis operator, and COSI BucketClaim (SeaweedFS). Includes Trivy vulnerability scanner, auto-generated admin credentials, and TLS via cert-manager.
- **NATS**: Enhanced with full Grafana monitoring dashboards for JetStream and server metrics, Prometheus support with TLS-aware configuration, and updated image customization options.
- **MariaDB**: The `mysql` application is renamed to `mariadb`, accurately reflecting the underlying engine. An automatic migration (migration 27) converts all existing MySQL resources to use the `mariadb` naming.
-
-FerretDB has been removed from the catalog as it is superseded by native MongoDB support.
-
-### Multi-Location Networking with Kilo and cilium-kilo
-
-Cozystack v1.0.0 introduces first-class support for multi-location clusters via the **Kilo** WireGuard mesh networking package. Kilo automatically establishes encrypted WireGuard tunnels between nodes in different network segments, enabling seamless cross-region communication.
-
-A new integrated **`cilium-kilo`** networking variant combines Cilium eBPF CNI with Kilo's WireGuard overlay in a single platform configuration selection. This variant enables `enable-ipip-termination` in Cilium and deploys Kilo with `--compatibility=cilium`, allowing Cilium network policies to function correctly over the WireGuard mesh — without any manual configuration of the two components.
-
-### Flux Sharding for Scalable Multi-Tenancy
-
-Tenant HelmRelease reconciliation is now distributed across multiple Flux controllers via sharding labels. Each tenant workload is assigned to a shard based on a deterministic hash, preventing a single Flux controller from becoming a bottleneck in large multi-tenant environments. The platform operator manages the shard assignment automatically, and new shards can be added by scaling the Flux deployment.
-
-## Major Features and Improvements
-
-### Cozystack Operator
-
-* **[cozystack-operator] Introduce Package and PackageSource APIs**: Added new CRDs for declarative package management, defining the full API for Package and PackageSource resources ([**@kvaps**](https://github.com/kvaps) in #1740, #1741, #1755, #1756, #1760, #1761).
-* **[platform] Migrate from HelmRelease bundles to Package-based deployment**: Replaced HelmRelease bundle system with Package resources managed by cozystack-operator, including restructured values.yaml with full configuration support for networking, publishing, authentication, scheduling, branding, and resources ([**@kvaps**](https://github.com/kvaps) in #1816).
-* **[cozystack-operator] Add automatic CRD installation at startup**: Added `--install-crds` flag to install embedded CRD manifests on every startup via server-side apply, ensuring CRDs and the PackageSource are always up to date ([**@lexfrei**](https://github.com/lexfrei) in #2060).
-* **[installer] Remove CRDs from Helm chart, delegate lifecycle to operator**: The `cozy-installer` Helm chart no longer ships CRDs; CRD lifecycle is fully managed by the Cozystack operator ([**@lexfrei**](https://github.com/lexfrei) in #2074).
-* **[cozystack-operator] Preserve existing suspend field in package reconciler**: Fixed package reconciler to properly preserve the suspend field state during reconciliation ([**@sircthulhu**](https://github.com/sircthulhu) in #2043).
-* **[cozystack-operator] Fix namespace privileged flag resolution and field ownership**: Fixed operator to correctly check all Packages in a namespace when determining privileged status, and resolved SSA field ownership conflicts ([**@kvaps**](https://github.com/kvaps) in #2046).
-* **[platform] Add flux-plunger controller**: Added flux-plunger controller to automatically fix stuck HelmRelease errors by cleaning up failed resources and retrying reconciliation ([**@kvaps**](https://github.com/kvaps) in #1843).
-* **[installer] Add variant-aware templates for generic Kubernetes support**: Extended the installer to support generic and hosted Kubernetes deployments via the `cozystackOperator.variant=generic` parameter ([**@lexfrei**](https://github.com/lexfrei) in #2010).
-* **[installer] Unify operator templates**: Merged separate operator templates into a single variant-based template supporting Talos and non-Talos deployments ([**@kvaps**](https://github.com/kvaps) in #2034).
-
-### API and Platform
-
-* **[api] Rename CozystackResourceDefinition to ApplicationDefinition**: Renamed CRD and all related types for clarity and consistency, with migration 24 handling the transition automatically ([**@kvaps**](https://github.com/kvaps) in #1864).
-* **[platform] Add DNS-1035 validation for Application names**: Added dynamic DNS-1035 label validation for Application names at creation time, preventing resources with invalid names that would fail downstream ([**@lexfrei**](https://github.com/lexfrei) in #1771).
-* **[platform] Make cluster issuer name and ACME solver configurable**: Added `publishing.certificates.solver` and `publishing.certificates.issuerName` parameters to allow pointing all ingress TLS annotations at any ClusterIssuer ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2077).
-* **[platform] Add cilium-kilo networking variant**: Added integrated `cilium-kilo` networking variant combining Cilium CNI with Kilo WireGuard mesh overlay ([**@kvaps**](https://github.com/kvaps) in #2064).
-* **[cozystack-api] Switch from DaemonSet to Deployment**: Migrated cozystack-api to a Deployment with PreferClose topology spread constraints, reducing resource consumption while maintaining high availability ([**@kvaps**](https://github.com/kvaps) in #2041, #2048).
-
-### Virtual Machines
-
-* **[vm-instance] Complete migration from virtual-machine to vm-disk and vm-instance**: Fully migrated from `virtual-machine` to the new `vm-disk` and `vm-instance` architecture, with automatic migration script (migration 28) for existing VMs ([**@kvaps**](https://github.com/kvaps) in #2040).
-* **[kubevirt-csi-driver] Add RWX Filesystem (NFS) support**: Added Read-Write-Many filesystem support to kubevirt-csi-driver via automatic NFS server deployment per PVC ([**@kvaps**](https://github.com/kvaps) in #2042).
-* **[vm] Add cpuModel field to specify CPU model without instanceType**: Added cpuModel field to VirtualMachine API for granular CPU control ([**@sircthulhu**](https://github.com/sircthulhu) in #2007).
-* **[vm] Allow switching between instancetype and custom resources**: Implemented atomic upgrade hook for switching between instanceType-based and custom resource VM configurations ([**@sircthulhu**](https://github.com/sircthulhu) in #2008).
-* **[vm] Migrate to runStrategy instead of running**: Migrated VirtualMachine API from deprecated `running` field to `runStrategy` ([**@sircthulhu**](https://github.com/sircthulhu) in #2004).
-* **[vm] Always expose VMs with a service**: Virtual machines are now always exposed with at least a ClusterIP service, ensuring in-cluster DNS names ([**@lllamnyp**](https://github.com/lllamnyp) in #1738, #1751).
-* **[dashboard] VMInstance dropdowns for disks and instanceType**: VM instance creation form now renders API-backed dropdowns for `instanceType` and disk `name` fields ([**@sircthulhu**](https://github.com/sircthulhu) in #2071).
-
-### Backup System
-
-* **[backups] Implement comprehensive backup and restore functionality**: Core backup Plan controller, Velero strategy controller, RestoreJob resource with end-to-end restore workflows, and enhanced backup plans UI ([**@lllamnyp**](https://github.com/lllamnyp) in #1640, #1685, #1687, #1719, #1720, #1737, #1967; [**@androndo**](https://github.com/androndo) in #1762, #1967, #1968, #1811).
-* **[backups] Add kubevirt plugin to velero**: Added KubeVirt plugin to Velero for consistent VM state and data snapshots ([**@lllamnyp**](https://github.com/lllamnyp) in #2017).
-* **[backups] Install backupstrategy controller by default**: Enabled backupstrategy controller by default for automatic backup scheduling ([**@lllamnyp**](https://github.com/lllamnyp) in #2020).
-* **[backups] Better selectors for VM strategy**: Improved VM backup strategy selectors for accurate and reliable backup targeting ([**@lllamnyp**](https://github.com/lllamnyp) in #2023).
-* **[backups] Create RBAC for backup resources**: Added comprehensive RBAC configuration for backup operations and restore jobs ([**@lllamnyp**](https://github.com/lllamnyp) in #2018).
-
-### Networking
-
-* **[kilo] Introduce Kilo WireGuard mesh networking**: Added Kilo as a system package providing secure WireGuard-based VPN mesh for connecting Kubernetes nodes across different networks and regions ([**@kvaps**](https://github.com/kvaps) in #1691).
-* **[kilo] Add Cilium compatibility variant**: Added `cilium` variant enabling Cilium-aware IPIP encapsulation for full network policy enforcement with Kilo mesh ([**@kvaps**](https://github.com/kvaps) in #2055).
-* **[kilo] Update to v0.8.0 with configurable MTU**: Updated Kilo to v0.8.0 with configurable MTU parameter and performance improvements ([**@kvaps**](https://github.com/kvaps) in #2003, #2049, #2053).
-* **[local-ccm] Add local-ccm package**: Added local cloud controller manager for managing load balancer services in bare-metal environments ([**@kvaps**](https://github.com/kvaps) in #1831).
-* **[local-ccm] Add node-lifecycle-controller component**: Added optional node-lifecycle-controller that automatically deletes unreachable NotReady nodes, solving the "zombie" node problem in autoscaled clusters ([**@IvanHunters**](https://github.com/IvanHunters) in #1992).
-* **[tenant] Allow egress to parent ingress pods**: Updated tenant network policies to allow egress traffic to parent cluster ingress pods ([**@lexfrei**](https://github.com/lexfrei) in #1765, #1776).
-
-### New Applications
-
-* **[mongodb] Add MongoDB managed application**: Added MongoDB as a fully managed database with replica sets, persistent storage, and unified user/database configuration ([**@lexfrei**](https://github.com/lexfrei) in #1822; [**@kvaps**](https://github.com/kvaps) in #1923).
-* **[qdrant] Add Qdrant vector database**: Added Qdrant as a high-performance vector database for AI/ML workloads with API key authentication and optional LoadBalancer access ([**@lexfrei**](https://github.com/lexfrei) in #1987).
-* **[harbor] Add managed Harbor container registry**: Added Harbor v2.14.2 as a managed tenant-level container registry with CloudNativePG, Redis operator, COSI BucketClaim storage, and Trivy scanner ([**@lexfrei**](https://github.com/lexfrei) in #2058).
-* **[nats] Add monitoring**: Added Grafana dashboards for NATS JetStream and server metrics, Prometheus monitoring with TLS support ([**@klinch0**](https://github.com/klinch0) in #1381).
-* **[mariadb] Rename mysql application to mariadb**: Renamed MySQL application to MariaDB with automatic migration (migration 27) for all existing resources ([**@kvaps**](https://github.com/kvaps) in #2026).
-* **[ferretdb] Remove FerretDB application**: Removed FerretDB, superseded by native MongoDB support ([**@kvaps**](https://github.com/kvaps) in #2028).
-
-### Kubernetes and System Components
-
-* **[kubernetes] Update supported Kubernetes versions to v1.30–v1.35**: Updated the tenant Kubernetes version matrix, with v1.35 as the new default. Kamaji updated to edge-26.2.4 and CAPI Kamaji provider to v0.16.0 ([**@lexfrei**](https://github.com/lexfrei) in #2073).
-* **[kubernetes] Auto-enable Gateway API support in cert-manager**: Added automatic Gateway API support in cert-manager for tenant clusters ([**@kvaps**](https://github.com/kvaps) in #1997).
-* **[kubernetes] Use ingress-nginx nodeport service**: Changed tenant Kubernetes clusters to use ingress-nginx NodePort service for improved compatibility ([**@sircthulhu**](https://github.com/sircthulhu) in #1948).
-* **[system] Add cluster-autoscaler for Hetzner and Azure**: Added cluster-autoscaler system package for automatically scaling management cluster nodes on Hetzner and Azure ([**@kvaps**](https://github.com/kvaps) in #1964).
-* **[cluster-autoscaler] Enable enforce-node-group-min-size by default**: Ensures node groups are always scaled up to their configured minimum size ([**@kvaps**](https://github.com/kvaps) in #2050).
-* **[system] Add clustersecret-operator package**: Added clustersecret-operator for managing secrets across multiple namespaces ([**@sircthulhu**](https://github.com/sircthulhu) in #2025).
-
-### Monitoring
-
-* **[monitoring] Enable monitoring for core components**: Enhanced monitoring capabilities with dashboards and metrics for core Cozystack components ([**@IvanHunters**](https://github.com/IvanHunters) in #1937).
-* **[monitoring] Add SLACK_SEVERITY_FILTER and VMAgent for tenant monitoring**: Added SLACK_SEVERITY_FILTER for Slack alert filtering and VMAgent for tenant namespace metrics scraping ([**@IvanHunters**](https://github.com/IvanHunters) in #1712).
-* **[monitoring-agents] Fix FQDN resolution for tenant workload clusters**: Fixed monitoring agents in tenant clusters to use full DNS names with cluster domain suffix ([**@IvanHunters**](https://github.com/IvanHunters) in #2075; [**@kvaps**](https://github.com/kvaps) in #2086).
-
-### Storage
-
-* **[linstor] Move CRDs to dedicated piraeus-operator-crds chart**: Moved LINSTOR CRDs to a dedicated chart, ensuring reliable installation of all CRDs including `linstorsatellites.io` ([**@kvaps**](https://github.com/kvaps) in #2036; [**@IvanHunters**](https://github.com/IvanHunters) in #1991).
-* **[seaweedfs] Increase certificate duration to 10 years**: Increased SeaweedFS certificate validity to 10 years to reduce rotation overhead ([**@IvanHunters**](https://github.com/IvanHunters) in #1986).
-
-## Improvements
-
-* **[dashboard] Upgrade dashboard to version 1.4.0**: Updated Cozystack dashboard to v1.4.0 with new features and improvements ([**@sircthulhu**](https://github.com/sircthulhu) in #2051).
-* **[dashboard] Hide Ingresses/Services/Secrets tabs when no selectors defined**: Tabs are now conditionally shown based on whether the ApplicationDefinition has resource selectors configured, reducing UI clutter ([**@kvaps**](https://github.com/kvaps) in #2087).
-* **[dashboard] Add startupProbe to prevent container restarts on slow hardware**: Added startup probe to dashboard pods to prevent unnecessary restarts ([**@kvaps**](https://github.com/kvaps) in #1996).
-* **[keycloak] Allow custom Ingress hostname via values**: Added `ingress.host` field to cozy-keycloak chart values for overriding the default `keycloak.<root-host>` hostname ([**@sircthulhu**](https://github.com/sircthulhu) in #2101).
-* **[branding] Separate values for Keycloak**: Separated Keycloak branding values for better customization capabilities ([**@nbykov0**](https://github.com/nbykov0) in #1947).
-* **[rbac] Use hierarchical naming scheme**: Refactored RBAC to use hierarchical naming for cluster roles and role bindings ([**@lllamnyp**](https://github.com/lllamnyp) in #2019).
-* **[tenant,rbac] Use shared clusterroles**: Refactored tenant RBAC to use shared ClusterRoles for improved consistency ([**@lllamnyp**](https://github.com/lllamnyp) in #1999).
-* **[kubernetes] Increase default apiServer resourcesPreset to large**: Increased kube-apiserver resource preset to `large` for more reliable operation under higher workloads ([**@kvaps**](https://github.com/kvaps) in #1875).
-* **[kubernetes] Increase kube-apiserver startup probe threshold**: Increased startup probe threshold to allow more time for API server readiness ([**@kvaps**](https://github.com/kvaps) in #1876).
-* **[etcd] Increase probe thresholds for better recovery**: Increased etcd probe thresholds to improve cluster resilience during temporary slowdowns ([**@kvaps**](https://github.com/kvaps) in #1874).
-* **[etcd-operator] Add vertical-pod-autoscaler dependency**: Added VPA as a dependency to etcd-operator for proper resource scaling ([**@sircthulhu**](https://github.com/sircthulhu) in #2047).
-* **[cilium] Change cilium-operator replicas to 1**: Reduced Cilium operator replicas to decrease resource consumption in smaller deployments ([**@IvanHunters**](https://github.com/IvanHunters) in #1784).
-* **[keycloak-configure,dashboard] Enable insecure TLS verification by default**: Made SSL certificate verification configurable with insecure mode enabled by default for local development ([**@IvanHunters**](https://github.com/IvanHunters) in #2005).
-* **[platform] Split telemetry between operator and controller**: Separated telemetry collection for better metrics isolation ([**@kvaps**](https://github.com/kvaps) in #1869).
-* **[system] Add resource requests and limits to etcd-defrag**: Added resource requests and limits to etcd-defrag job to prevent resource contention ([**@matthieu-robin**](https://github.com/matthieu-robin) in #1785, #1786).
-
-## Fixes
-
-* **[dashboard] Fix sidebar visibility on cluster-level pages**: Fixed broken URLs with double `//` on cluster-level pages by hiding namespace-scoped sidebar items when no tenant is selected ([**@sircthulhu**](https://github.com/sircthulhu) in #2106).
-* **[platform] Fix upgrade issues in migrations, etcd timeout, and migration script**: Fixed multiple upgrade failures discovered during v0.41.1 → v1.0 upgrade testing, including migration 26-29 fixes, RFC3339 format for annotations, and extended etcd HelmRelease timeout to 30m ([**@kvaps**](https://github.com/kvaps) in #2096).
-* **[platform] Fix orphaned -rd HelmReleases after application renames**: Migrations 28-29 updated to remove orphaned `-rd` HelmReleases in `cozy-system` after `ferretdb→mongodb`, `mysql→mariadb`, and `virtual-machine→vm-disk+vm-instance` renames, with migration 33 as a safety net ([**@kvaps**](https://github.com/kvaps) in #2102).
-* **[platform] Adopt tenant-root into cozystack-basics during migration**: Added migration 31 to adopt existing `tenant-root` Namespace and HelmRelease into `cozystack-basics` for a safe v0.41.x → v1.0 upgrade path ([**@kvaps**](https://github.com/kvaps) in #2065).
-* **[platform] Preserve tenant-root HelmRelease during migration**: Fixed data-loss risk during migration where `tenant-root` HelmRelease could be deleted ([**@sircthulhu**](https://github.com/sircthulhu) in #2063).
-* **[platform] Fix cozystack-values secret race condition**: Fixed race condition in cozystack-values secret creation that could cause initialization failures ([**@lllamnyp**](https://github.com/lllamnyp) in #2024).
-* **[cozystack-basics] Preserve existing HelmRelease values during reconciliations**: Fixed data-loss bug where changes to `tenant-root` HelmRelease were dropped on the next reconciliation ([**@sircthulhu**](https://github.com/sircthulhu) in #2068).
-* **[cozystack-basics] Deny resourcequotas deletion for tenant admin**: Fixed `cozy:tenant:admin:base` ClusterRole to explicitly deny deletion of ResourceQuota objects ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2076).
-* **[dashboard] Fix legacy templating and cluster identifier in sidebar links**: Standardized cluster identifier across dashboard menu links resolving broken link targets for Backups and External IPs ([**@androndo**](https://github.com/androndo) in #2093).
-* **[dashboard] Fix backupjobs creation form and sidebar backup category identifier**: Fixed backup job creation form fields and fixed sidebar backup category identifier ([**@androndo**](https://github.com/androndo) in #2103).
-* **[kubevirt] Update KubeVirt to v1.6.4 and CDI to v1.64.0, fix VM pod initialization**: Updated KubeVirt and CDI and disabled serial console logging globally to fix the `guest-console-log` init container blocking virt-launcher pods ([**@nbykov0**](https://github.com/nbykov0) in #1833; [**@kvaps**](https://github.com/kvaps)).
-* **[linstor] Fix DRBD+LUKS+STORAGE resource creation failure**: Applied upstream fix for all newly created encrypted volumes failing due to missing `setExists(true)` call in `LuksLayer` ([**@kvaps**](https://github.com/kvaps) in #2072).
-* **[platform] Clean up Helm secrets for removed releases**: Added cleanup logic to migration 23 to remove orphaned Helm secrets from removed `-rd` releases ([**@kvaps**](https://github.com/kvaps) in #2035).
-* **[monitoring] Fix YAML parse error in vmagent template**: Fixed YAML parsing error in monitoring-agents vmagent template ([**@kvaps**](https://github.com/kvaps) in #2037).
-* **[monitoring] Remove cozystack-controller dependency**: Fixed monitoring package to remove unnecessary cozystack-controller dependency ([**@IvanHunters**](https://github.com/IvanHunters) in #1990).
-* **[monitoring] Remove duplicate dashboards.list**: Fixed duplicate dashboards.list configuration in extra/monitoring package ([**@IvanHunters**](https://github.com/IvanHunters) in #2016).
-* **[linstor] Update piraeus-server patches with critical fixes**: Backported critical patches fixing edge cases in device management and DRBD resource handling ([**@kvaps**](https://github.com/kvaps) in #1850).
-* **[apiserver] Fix Watch resourceVersion and bookmark handling**: Fixed Watch API handling of resourceVersion and bookmarks for proper event streaming ([**@kvaps**](https://github.com/kvaps) in #1860).
-* **[bootbox] Auto-create bootbox-application as dependency**: Fixed bootbox package to automatically create required bootbox-application dependency ([**@kvaps**](https://github.com/kvaps) in #1974).
-* **[postgres-operator] Correct PromQL syntax in CNPGClusterOffline alert**: Fixed incorrect PromQL syntax in the CNPGClusterOffline Prometheus alert ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #1981).
-* **[coredns] Fix serviceaccount to match kubernetes bootstrap RBAC**: Fixed CoreDNS service account to correctly match Kubernetes bootstrap RBAC requirements ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #1958).
-* **[dashboard] Verify JWT token**: Added JWT token verification to dashboard for improved security ([**@lllamnyp**](https://github.com/lllamnyp) in #1980).
-* **[codegen] Fix missing gen_client in update-codegen.sh**: Fixed build error in `pkg/generated/applyconfiguration/utils.go` by including `gen_client` in the codegen script ([**@lexfrei**](https://github.com/lexfrei) in #2061).
-* **[kubevirt-operator] Fix typo in VMNotRunningFor10Minutes alert**: Fixed typo in VM alert name ensuring proper alert triggering ([**@lexfrei**](https://github.com/lexfrei) in #1770, #1775).
-
-## Security
-
-* **[dashboard] Verify JWT token**: Added JWT token verification to the dashboard for improved authentication security ([**@lllamnyp**](https://github.com/lllamnyp) in #1980).
-
-## Dependencies
-
-* **[cilium] Update to v1.18.6**: Updated Cilium CNI to v1.18.6 with security fixes and performance improvements ([**@sircthulhu**](https://github.com/sircthulhu) in #1868).
-* **[kube-ovn] Update to v1.15.3**: Updated Kube-OVN CNI to v1.15.3 with performance improvements and bug fixes ([**@kvaps**](https://github.com/kvaps) in #2022).
-* **[kilo] Update to v0.8.0**: Updated Kilo WireGuard mesh to v0.8.0 with performance improvements and new compatibility features ([**@kvaps**](https://github.com/kvaps) in #2053).
-* **Update Talos Linux to v1.12.1**: Updated Talos Linux to v1.12.1 with latest features and security patches ([**@kvaps**](https://github.com/kvaps) in #1877).
-
-## System Configuration
-
-* **[vpc] Migrate subnets definition from map to array format**: Migrated VPC subnets from `map[string]Subnet` to `[]Subnet` with explicit `name` field, with automatic migration via migration 30 ([**@kvaps**](https://github.com/kvaps) in #2052).
-* **[migrations] Add migrations 23-33 for v1.0 upgrade path**: Added 11 incremental migrations handling CRD ownership, resource renaming, secret cleanup, Helm adoption, and configuration conversion for the v0.41.x → v1.0.0 upgrade path ([**@kvaps**](https://github.com/kvaps) in #1975, #2035, #2036, #2040, #2026, #2065, #2052, #2102).
-* **[tenant] Run cleanup job from system namespace**: Moved tenant cleanup job to system namespace for improved security and resource isolation ([**@lllamnyp**](https://github.com/lllamnyp) in #1774, #1777).
-
-## Development, Testing, and CI/CD
-
-* **[ci] Use GitHub Copilot CLI for changelog generation**: Automated changelog generation using GitHub Copilot CLI ([**@androndo**](https://github.com/androndo) in #1753).
-* **[ci] Choose runner conditional on label**: Added conditional runner selection in CI based on PR labels ([**@lllamnyp**](https://github.com/lllamnyp) in #1998).
-* **[e2e] Use helm install instead of kubectl apply for cozystack installation**: Replaced static YAML apply flow with direct `helm upgrade --install` of the installer chart in E2E tests ([**@lexfrei**](https://github.com/lexfrei) in #2060).
-* **[e2e] Make kubernetes test retries effective by cleaning up stale resources**: Fixed E2E test retries by adding pre-creation cleanup and increasing deployment wait timeout to 300s ([**@lexfrei**](https://github.com/lexfrei) in #2062).
-* **[e2e] Increase HelmRelease readiness timeout for kubernetes test**: Increased HelmRelease readiness timeout to prevent false failures on slower hardware ([**@lexfrei**](https://github.com/lexfrei) in #2033).
-* **[ci] Improve cozyreport functionality**: Enhanced cozyreport tool with improved reporting for CI/CD pipelines ([**@lllamnyp**](https://github.com/lllamnyp) in #2032).
-* **feat(cozypkg): add cross-platform build targets with version injection**: Added cross-platform build targets for cozypkg/cozyhr tool for linux/amd64, linux/arm64, darwin/amd64, darwin/arm64 ([**@kvaps**](https://github.com/kvaps) in #1862).
-* **refactor: move scripts to hack directory**: Reorganized scripts to the standard `hack/` location ([**@kvaps**](https://github.com/kvaps) in #1863).
-* **Update CODEOWNERS**: Updated CODEOWNERS to include new maintainers ([**@lllamnyp**](https://github.com/lllamnyp) in #1972; [**@IvanHunters**](https://github.com/IvanHunters) in #2015).
-* **[talm] Skip config loading for completion subcommands**: Fixed talm CLI to skip config loading for shell completion commands ([**@kitsunoff**](https://github.com/kitsunoff) in cozystack/talm#109).
-* **[talm] Fix metadata.id type casting in physical_links_info**: Fixed Prometheus query to properly cast metadata.id to string for regexMatch operations ([**@kvaps**](https://github.com/kvaps) in cozystack/talm#110).
-
-## Documentation
-
-* **[website] Add documentation versioning**: Implemented comprehensive documentation versioning with separate v0 and v1 documentation trees and a version selector in the UI ([**@IvanStukov**](https://github.com/IvanStukov) in cozystack/website#415).
-* **[website] Describe upgrade to v1.0**: Added detailed upgrade instructions for migrating from v0.x to v1.0 ([**@nbykov0**](https://github.com/nbykov0) in cozystack/website@21bbe84).
-* **[website] Migrate ConfigMap references to Platform Package in v1 docs**: Updated entire v1 documentation to replace legacy ConfigMap-based configuration with the new Platform Package API ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#426).
-* **[website] Add generic Kubernetes deployment guide for v1**: Added installation guide for deploying Cozystack on any generic Kubernetes cluster ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#408).
-* **[website] Describe operator-based and HelmRelease-based package patterns**: Added development documentation explaining operator-based and HelmRelease-based package patterns ([**@kvaps**](https://github.com/kvaps) in cozystack/website#413).
-* **[website] Add Helm chart development principles guide**: Added developer guide documenting Cozystack's four core Helm chart principles ([**@kvaps**](https://github.com/kvaps) in cozystack/website#418).
-* **[website] Add network architecture overview**: Added comprehensive network architecture documentation covering the multi-layered networking stack with Mermaid diagrams ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#422).
-* **[website] Add LINSTOR disk preparation guide**: Added comprehensive documentation for preparing disks for LINSTOR storage ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#411).
-* **[website] Add Proxmox VM migration guide**: Added detailed guide for migrating virtual machines from Proxmox to Cozystack ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#410).
-* **[website] Add cluster autoscaler documentation**: Added documentation for Hetzner setup with Talos, vSwitch, and Kilo mesh integration ([**@kvaps**](https://github.com/kvaps) in #1964).
-* **[website] Improve Azure autoscaling troubleshooting guide**: Enhanced Azure autoscaling documentation with serial console instructions and `az vmss update --custom-data` guidance ([**@kvaps**](https://github.com/kvaps) in cozystack/website#424).
-* **[website] Update multi-location documentation for cilium-kilo variant**: Updated multi-location networking docs to reflect the integrated `cilium-kilo` variant selection ([**@kvaps**](https://github.com/kvaps) in cozystack/website@02d63f0).
-* **[website] Update documentation to use jsonpatch for service exposure**: Improved `kubectl patch` commands to use JSON Patch `add` operations ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#427).
-* **[website] Update certificates section in Platform Package documentation**: Updated certificate configuration docs to reflect new `solver` and `issuerName` fields ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#429).
-* **[website] Add tenant Kubernetes cluster log querying guide**: Added documentation for querying logs from tenant clusters in Grafana using VictoriaLogs labels ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#430).
-* **[website] Replace non-idempotent commands with idempotent alternatives**: Updated `helm install` to `helm upgrade --install` and `kubectl create` to `kubectl apply` across all installation guides ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#431).
-* **[website] Fix broken documentation links with .md suffix**: Fixed incorrect internal links across virtualization guides for v0 and v1 documentation ([**@cheese**](https://github.com/cheese) in cozystack/website#432).
-* **[website] Refactor resource planning documentation**: Improved resource planning guide with clearer structure and more comprehensive coverage ([**@IvanStukov**](https://github.com/IvanStukov) in cozystack/website#423).
-* **[website] Add ServiceAccount API access documentation and update FAQ**: Added documentation for ServiceAccount API access token configuration and updated FAQ ([**@IvanStukov**](https://github.com/IvanStukov) in cozystack/website#421).
-* **[website] Update networking-mesh allowed-location-ips example**: Replaced provider-specific CLI with standard `kubectl` commands in multi-location networking guide ([**@kvaps**](https://github.com/kvaps) in cozystack/website#425).
-* **[website] docs(storage): simplify NFS driver setup instructions**: Simplified NFS driver setup documentation ([**@kvaps**](https://github.com/kvaps) in cozystack/website#399).
-* **[website] Add Hetzner RobotLB documentation**: Added documentation for configuring public IP with Hetzner RobotLB ([**@kvaps**](https://github.com/kvaps) in cozystack/website#394).
-* **[website] Add documentation for creating and managing cloned VMs**: Added comprehensive guide for VM cloning operations ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#401).
-* **[website] Update Talos installation docs for Hetzner and Servers.com**: Updated installation documentation for Hetzner and Servers.com environments ([**@kvaps**](https://github.com/kvaps) in cozystack/website#395).
-* **[website] Add Hidora organization support details**: Added Hidora to the support page ([**@matthieu-robin**](https://github.com/matthieu-robin) in cozystack/website#397, cozystack/website#398).
-* **[website] Check quotas before an upgrade**: Added troubleshooting documentation for checking resource quotas before upgrades ([**@nbykov0**](https://github.com/nbykov0) in cozystack/website#405).
-* **[website] Update support documentation**: Updated support documentation with current contact information ([**@xrmtech-isk**](https://github.com/xrmtech-isk) in cozystack/website#420).
-* **[website] Correct typo in kubeconfig reference in Kubernetes installation guide**: Fixed documentation typo in kubeconfig reference ([**@shkarface**](https://github.com/shkarface) in cozystack/website#414).
-
-## Breaking Changes & Upgrade Notes
-
-* **[api] CozystackResourceDefinition renamed to ApplicationDefinition**: The `CozystackResourceDefinition` CRD has been renamed to `ApplicationDefinition`. Migration 24 handles the transition automatically during upgrade ([**@kvaps**](https://github.com/kvaps) in #1864).
-
-* **[platform] Certificate issuer configuration parameters renamed**: The `publishing.certificates.issuerType` field is renamed to `publishing.certificates.solver`, and the value `cloudflare` is renamed to `dns01`. A new `publishing.certificates.issuerName` field (default: `letsencrypt-prod`) is added. Migration 32 automatically converts existing configurations — no manual action required ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2077).
-
-* **[vpc] VPC subnets definition migrated from map to array format**: VPC subnets are now defined as `[]Subnet` with an explicit `name` field instead of `map[string]Subnet`. Migration 30 handles the conversion automatically ([**@kvaps**](https://github.com/kvaps) in #2052).
-
-* **[vm] virtual-machine application replaced by vm-disk and vm-instance**: The legacy `virtual-machine` application has been fully replaced. Migration 28 automatically converts existing VMs to the new architecture ([**@kvaps**](https://github.com/kvaps) in #2040).
-
-* **[mysql] mysql application renamed to mariadb**: Existing MySQL deployments are automatically renamed to MariaDB via migration 27 ([**@kvaps**](https://github.com/kvaps) in #2026).
-
-### Upgrade Guide
-
-To upgrade from v0.41.x to v1.0.0:
-1. **Backup your cluster** before upgrading.
-2. Run the provided migration script: `hack/migrate-to-version-1.0.sh`.
-3. The 33 incremental migration steps will automatically handle all resource renaming, configuration conversion, CRD adoption, and secret cleanup.
-4. Refer to the [upgrade documentation](https://cozystack.io/docs/v1/upgrade) for detailed instructions and troubleshooting.
-
-## Contributors
-
-We'd like to thank all contributors who made this release possible:
-
-* [**@androndo**](https://github.com/androndo)
-* [**@cheese**](https://github.com/cheese)
-* [**@IvanHunters**](https://github.com/IvanHunters)
-* [**@IvanStukov**](https://github.com/IvanStukov)
-* [**@kitsunoff**](https://github.com/kitsunoff)
-* [**@klinch0**](https://github.com/klinch0)
-* [**@kvaps**](https://github.com/kvaps)
-* [**@lexfrei**](https://github.com/lexfrei)
-* [**@lllamnyp**](https://github.com/lllamnyp)
-* [**@matthieu-robin**](https://github.com/matthieu-robin)
-* [**@mattia-eleuteri**](https://github.com/mattia-eleuteri)
-* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil)
-* [**@nbykov0**](https://github.com/nbykov0)
-* [**@shkarface**](https://github.com/shkarface)
-* [**@sircthulhu**](https://github.com/sircthulhu)
-* [**@xrmtech-isk**](https://github.com/xrmtech-isk)
-
-### New Contributors
-
-We're excited to welcome our first-time contributors:
-
-* [**@cheese**](https://github.com/cheese) - First contribution!
-* [**@IvanStukov**](https://github.com/IvanStukov) - First contribution!
-* [**@kitsunoff**](https://github.com/kitsunoff) - First contribution!
-* [**@shkarface**](https://github.com/shkarface) - First contribution!
-* [**@xrmtech-isk**](https://github.com/xrmtech-isk) - First contribution!
-
-**Full Changelog**: https://github.com/cozystack/cozystack/compare/v0.41.0...v1.0.0
--- a/docs/changelogs/v1.0.1.md
+++ b/docs/changelogs/v1.0.1.md
@@ -1,21 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v1.0.1
-->
-
-## Fixes
-
-* **[platform] Prevent cozystack-version ConfigMap from deletion**: Added resource protection to prevent the `cozystack-version` ConfigMap from being accidentally deleted, improving platform stability and reliability ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2112, #2114).
-
-* **[installer] Add keep annotation to Namespace and update migration script**: Added `helm.sh/resource-policy: keep` annotation to the `cozy-system` Namespace in the installer Helm chart to prevent Helm from deleting the namespace (and all HelmReleases within it) when the installer release is removed. The v1.0 migration script is also updated to annotate the `cozy-system` namespace and `cozystack-version` ConfigMap with this policy before migration ([**@kvaps**](https://github.com/kvaps) in #2122, #2123).
-
-* **[dashboard] Add FlowSchema to exempt BFF from API throttling**: Added a `cozy-dashboard-exempt` FlowSchema to exempt the dashboard Back-End-for-Frontend (BFF) service account from Kubernetes API Priority and Fairness throttling. Previously, the BFF fell under the `workload-low` priority level, causing 429 (Too Many Requests) errors under load, resulting in dashboard unresponsiveness ([**@kvaps**](https://github.com/kvaps) in #2121, #2124).
-
-## Documentation
-
-* **[website] Replace bundles documentation with variants**: Renamed the "Bundles" documentation section to "Variants" to match current Cozystack terminology. Removed deprecated variants (`iaas-full`, `distro-full`, `distro-hosted`) and added new variants: `default` (PackageSources only, for manual package management via cozypkg) and `isp-full-generic` (full PaaS/IaaS on k3s, kubeadm, or RKE2). Updated all cross-references throughout the documentation ([**@kvaps**](https://github.com/kvaps) in cozystack/website#433).
-
-* **[website] Add step to protect namespace before upgrading**: Updated the cluster upgrade guide and v0.41→v1.0 migration guide with a required step to annotate the `cozy-system` namespace and `cozystack-version` ConfigMap with `helm.sh/resource-policy=keep` before running `helm upgrade`, preventing accidental namespace deletion ([**@kvaps**](https://github.com/kvaps) in cozystack/website#435).
-
---
-
-**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.0...v1.0.1
--- a/docs/changelogs/v1.0.2.md
+++ b/docs/changelogs/v1.0.2.md
@@ -1,19 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v1.0.2
-->
-
-## Fixes
-
-* **[platform] Suspend cozy-proxy if it conflicts with installer release during migration**: Added a check in the v0.41→v1.0 migration script to detect and automatically suspend the `cozy-proxy` HelmRelease when its `releaseName` is set to `cozystack`, which conflicts with the installer release and would cause `cozystack-operator` deletion during the upgrade ([**@kvaps**](https://github.com/kvaps) in #2128, #2130).
-
-* **[platform] Fix off-by-one error in run-migrations script**: Fixed a bug in the migration runner where the first required migration was always skipped due to an off-by-one error in the migration range calculation, ensuring all upgrade steps execute correctly ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2126, #2132).
-
-* **[system] Fix Keycloak proxy configuration for v26.x**: Replaced the deprecated `KC_PROXY=edge` environment variable with `KC_PROXY_HEADERS=xforwarded` and `KC_HTTP_ENABLED=true` in the Keycloak StatefulSet template. `KC_PROXY` was removed in Keycloak 26.x, previously causing "Non-secure context detected" warnings and broken cookie handling when running behind a reverse proxy with TLS termination ([**@sircthulhu**](https://github.com/sircthulhu) in #2125, #2134).
-
-* **[dashboard] Allow clearing instanceType field and preserve newlines in secret copy**: Added `allowEmpty: true` to the `instanceType` field in the VMInstance form so users can explicitly clear it to use custom KubeVirt resources without a named instance type. Also fixed newline preservation when copying secrets with CMD+C ([**@sircthulhu**](https://github.com/sircthulhu) in #2135, #2137).
-
-* **[dashboard] Restore stock-instance sidebars for namespace-level pages**: Restored `stock-instance-api-form`, `stock-instance-api-table`, `stock-instance-builtin-form`, and `stock-instance-builtin-table` sidebar resources that were inadvertently removed in #2106. Without these sidebars, namespace-level pages such as Backup Plans rendered as empty pages with no interactive content ([**@sircthulhu**](https://github.com/sircthulhu) in #2136, #2138).
-
---
-
-**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.1...v1.0.2
--- a/docs/changelogs/v1.0.3.md
+++ b/docs/changelogs/v1.0.3.md
@@ -1,17 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v1.0.3
-->
-
-## Fixes
-
-* **[platform] Fix package name conversion in migration script**: Fixed the `migrate-to-version-1.0.sh` script to correctly prepend the `cozystack.` prefix when converting `BUNDLE_DISABLE` and `BUNDLE_ENABLE` package name lists, ensuring packages are properly identified during the v0.41→v1.0 upgrade ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2144, #2148).
-
-## Documentation
-
-* **[website] Add white labeling guide**: Added a comprehensive guide for configuring white labeling (branding) in Cozystack v1, covering Dashboard fields (`titleText`, `footerText`, `tenantText`, `logoText`, `logoSvg`, `iconSvg`) and Keycloak fields (`brandName`, `brandHtmlName`). Includes SVG preparation workflow with theme-aware template variables, portable base64 encoding, and migration notes from the v0 ConfigMap approach ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#441).
-
-* **[website] Actualize backup and recovery documentation**: Reworked the backup and recovery docs to be user-focused, separating operator and tenant workflows. Added tenant-facing documentation for `BackupJob` and `Plan` resources and status inspection commands, and added a new Velero administration guide for operators covering storage credentials and backup storage configuration ([**@androndo**](https://github.com/androndo) in cozystack/website#434).
-
---
-
-**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.2...v1.0.3
--- a/docs/changelogs/v1.0.4.md
+++ b/docs/changelogs/v1.0.4.md
@@ -1,25 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v1.0.4
-->
-
-## Fixes
-
-* **[system] Fix Keycloak probe crashloop with management port health endpoints**: Fixed a crashloop where Keycloak 26.x was endlessly restarting because liveness and readiness probes were sending HTTP requests to port 8080. Keycloak 26.x redirects all requests on port 8080 to `KC_HOSTNAME` (HTTPS), and since kubelet does not follow redirects, probes failed, eventually triggering container restarts. The fix switches probes to the dedicated management port 9000 (`/health/live`, `/health/ready`) enabled via `KC_HEALTH_ENABLED=true`, exposes management port 9000, and adds a `startupProbe` with appropriate failure thresholds for better startup tolerance ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2162, #2178).
-
-* **[system] Fix etcd-operator deprecated kube-rbac-proxy image**: Replaced the deprecated `gcr.io/kubebuilder/kube-rbac-proxy:v0.16.0` image with `quay.io/brancz/kube-rbac-proxy:v0.18.1` in the vendored etcd-operator chart. The GCR-hosted image became unavailable after March 18, 2025, causing etcd-operator pods to fail on image pull ([**@kvaps**](https://github.com/kvaps) in #2181, #2183).
-
-* **[platform] Fix VM MAC address not preserved during virtual-machine to vm-instance migration**: During the `virtual-machine` → `vm-instance` migration (script 29), VM MAC addresses were not preserved. Kube-OVN reads MAC addresses exclusively from the pod annotation `ovn.kubernetes.io/mac_address`, not from `spec.macAddress` of the IP resource. Without this annotation, migrated VMs received a new random MAC address, breaking OS-level network configuration that matches by MAC (e.g., netplan). The fix adds a Helm `lookup` in the vm-instance chart template to read the Kube-OVN IP resource and automatically inject the MAC and IP addresses as pod annotations ([**@sircthulhu**](https://github.com/sircthulhu) in #2169, #2191).
-
-* **[dashboard] Fix External IPs page showing empty rows**: Fixed the External IPs administration page displaying empty rows instead of service data. The `EnrichedTable` configuration in the `external-ips` factory was using incorrect property names — replaced `clusterNamePartOfUrl` with `cluster` and changed `pathToItems` from array format to dot-path string format, matching the convention used by all other `EnrichedTable` instances ([**@IvanHunters**](https://github.com/IvanHunters) in #2175, #2192).
-
-* **[dashboard] Fix disabled/hidden state reset on MarketplacePanel reconciliation**: Fixed a bug where the dashboard controller was hardcoding `disabled=false` and `hidden=false` on every reconcile loop, overwriting changes made through the dashboard UI. Services disabled or hidden via the marketplace panel now correctly retain their state after controller reconciliation ([**@IvanHunters**](https://github.com/IvanHunters) in #2176, #2202).
-
-* **[dashboard] Fix hidden MarketplacePanel resources appearing in sidebar menu**: Fixed the sidebar navigation showing all resources regardless of their MarketplacePanel `hidden` state. The controller now fetches MarketplacePanels during sidebar reconciliation and filters out resources where `hidden=true`, ensuring that hiding a resource from the marketplace also removes it from the sidebar navigation. Listing failures are non-fatal — if the configuration fetch fails, no hiding is applied and the dashboard remains functional ([**@IvanHunters**](https://github.com/IvanHunters) in #2177, #2204).
-
-## Documentation
-
-* **[website] Add OIDC self-signed certificates configuration guide**: Added a comprehensive guide for configuring OIDC authentication with Keycloak when using self-signed certificates (the default in Cozystack). Covers Talos machine configuration with certificate mounting and host entries, kubelogin setup instructions, and a troubleshooting section. The guide is available for both v0 and v1 versioned documentation paths ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#443).
-
---
-
-**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.3...v1.0.4
--- a/docs/changelogs/v1.1.0.md
+++ b/docs/changelogs/v1.1.0.md
@@ -1,126 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v1.1.0
-->
-
-# Cozystack v1.1.0
-
-Cozystack v1.1.0 delivers a major expansion of the managed application catalog with **OpenBAO** (open-source HashiCorp Vault fork) for secrets management, comprehensive **tiered object storage** with SeaweedFS storage pools, a new bucket **user model** with per-user credentials and S3 login support, **RabbitMQ version selection**, and **MongoDB Grafana dashboards**. The dashboard gains storageClass dropdowns for all stateful apps. This release also incorporates all fixes from the v1.0.x patch series.
-
-## Feature Highlights
-
-### OpenBAO: Managed Secrets Management Service
-
-Cozystack now ships **OpenBAO** as a fully managed PaaS application — an open-source fork of HashiCorp Vault providing enterprise-grade secrets management. Users can deploy OpenBAO instances in standalone mode (single replica with file storage) or in high-availability Raft mode (multiple replicas with integrated Raft consensus), with the mode switching automatically based on the `replicas` field.
-
-Each OpenBAO instance gets TLS enabled by default via cert-manager self-signed certificates, with DNS SANs covering all service endpoints and pod addresses. The Vault injector and CSI provider are intentionally disabled (they are cluster-scoped components not safe for per-tenant use). OpenBAO requires manual initialization and unsealing by design — no auto-unseal is configured.
-
-A full end-to-end E2E test covers the complete lifecycle: deploy, wait for certificate and API readiness, init, unseal, verify, and cleanup. OpenBAO is available in the application catalog for tenant namespaces.
-
-### SeaweedFS Tiered Storage Pools
-
-SeaweedFS now supports **tiered storage pools** — operators can define separate storage pools per disk type (SSD, HDD, NVMe) in the `volume.pools` field (Simple topology) or `volume.zones[name].pools` (MultiZone topology). Each pool creates an additional Volume StatefulSet alongside the default one, with SeaweedFS distinguishing storage via the `-disk=<type>` flag on volume servers.
-
-Each pool automatically generates its own set of COSI resources: a standard `BucketClass`, a `-lock` BucketClass (COMPLIANCE mode, 365-day retention), a read-write `BucketAccessClass`, and a `-readonly` BucketAccessClass. This allows applications to place data on specific storage tiers and request appropriate access policies per pool.
-
-In MultiZone topology, pools are defined per zone and each zone × pool combination creates a dedicated StatefulSet (e.g., `us-east-ssd`, `us-west-hdd`), with nodes selected via `topology.kubernetes.io/zone` labels. Existing deployments with no pools defined produce output identical to previous versions — no migration is required.
-
-### Bucket User Model with S3 Login
-
-The bucket application introduces a new **user model** for access management. Instead of a single implicit BucketAccess resource, operators now define a `users` map where each entry creates a dedicated `BucketAccess` with its own credentials secret and an optional `readonly` flag. The S3 Manager UI has been updated with a login screen that uses per-session credentials from the user's own secret, replacing the previous basic-auth approach.
-
-Two new bucket parameters are available: `locking` provisions from the `-lock` BucketClass (COMPLIANCE mode, 365-day object lock retention) for write-once-read-many use cases, and `storagePool` selects a specific pool's BucketClass for tiered storage placement. The COSI driver has been updated to v0.3.0 to support the new `diskType` parameter.
-
-**⚠️ Breaking change**: The implicit default BucketAccess resource is no longer created. Existing buckets that relied on the single auto-generated BucketAccess will need to explicitly define users in the `users` map after upgrading.
-
-### RabbitMQ Version Selection
-
-RabbitMQ instances now support a configurable **version selector** (`version` field with values: `v4.2`, `v4.1`, `v4.0`, `v3.13`; default `v4.2`). The chart validates the selection at deploy time and uses it to pin the runtime image, giving operators control over the RabbitMQ release channel per instance. An automatic migration backfills the `version` field on all existing RabbitMQ resources to `v4.2`.
-
-## Major Features and Improvements
-
-* **[apps] Add OpenBAO as a managed secrets management service**: Deployed as a PaaS application with standalone (file storage) and HA Raft modes, TLS enabled by default via cert-manager, injector and CSI provider disabled for tenant safety, and a full E2E lifecycle test ([**@lexfrei**](https://github.com/lexfrei) in #2059).
-
-* **[seaweedfs] Add storage pools support for tiered storage**: Added `volume.pools` (Simple) and `volume.zones[name].pools` (MultiZone) for per-disk-type StatefulSets, zone overrides (`nodeSelector`, `storageClass`, `dataCenter`), per-pool COSI BucketClass and BucketAccessClass resources, and bumped seaweedfs-cosi-driver to v0.3.0 ([**@sircthulhu**](https://github.com/sircthulhu) in #2097).
-
-* **[apps][system] Add bucket user model with locking and storage pool selection**: Replaced implicit BucketAccess with per-user `users` map, added `locking` and `storagePool` parameters, renamed COSI BucketClass suffix from `-worm` to `-lock`, added `-readonly` BucketAccessClass for all topologies, and updated S3 Manager with login screen using per-user credentials ([**@IvanHunters**](https://github.com/IvanHunters) in #2119).
-
-* **[rabbitmq] Add version selection for RabbitMQ instances**: Added `version` field (`v4.2`, `v4.1`, `v4.0`, `v3.13`) with chart-level validation, default `v4.2`, and an automatic migration to backfill the field on existing instances ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2092).
-
-* **[system] Add MongoDB Overview and InMemory Details Grafana dashboards**: Added two comprehensive Grafana dashboards for MongoDB monitoring — Overview (command operations, connections, cursors, query efficiency, write time) and InMemory Details (WiredTiger cache, transactions, concurrency, eviction). Dashboards are registered in `dashboards.list` for automatic GrafanaDashboard CRD generation ([**@IvanHunters**](https://github.com/IvanHunters) in #2158).
-
-* **[dashboard] Add storageClass dropdown for all stateful apps**: Replaced the free-text `storageClass` input with an API-backed dropdown listing available StorageClasses from the cluster. Affects ClickHouse, Harbor, HTTPCache, Kubernetes, MariaDB, MongoDB, NATS, OpenBAO, Postgres, Qdrant, RabbitMQ, Redis, VMDisk (top-level `storageClass`), FoundationDB (`storage.storageClass`), and Kafka (`kafka.storageClass`, `zookeeper.storageClass`) ([**@sircthulhu**](https://github.com/sircthulhu) in #2131).
-
-* **[bucket] Add readonly S3 access credentials**: Added a readonly `BucketAccessClass` to the SeaweedFS COSI chart and updated the bucket application to automatically provision two sets of S3 credentials per bucket: read-write (for UI) and readonly ([**@IvanHunters**](https://github.com/IvanHunters) in #2105).
-
-* **[dashboard] Hide sidebar on cluster-level pages when no tenant selected**: Fixed broken URLs with double `//` on the main cluster page (before tenant selection) by clearing `CUSTOMIZATION_SIDEBAR_FALLBACK_ID` so no sidebar renders when no namespace is selected ([**@sircthulhu**](https://github.com/sircthulhu) in #2106).
-
-* **[cert-manager] Update cert-manager to v1.19.3**: Upgraded cert-manager with new CRDs moved into a dedicated CRD package, added global `nodeSelector` and `hostUsers` (pod user-namespace isolation), and renamed `ServiceMonitor` targetPort default to `http-metrics` ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2070).
-
-* **[dashboard] Add backupClasses dropdown to Plan/BackupJob forms**: Replaced free-text input for `backupClass` field with an API-backed dropdown populated with available BackupClass resources, making it easier to select the correct backup target ([**@androndo**](https://github.com/androndo) in #2104).
-
-## Fixes
-
-* **[platform] Fix package name conversion in migration script**: Fixed the `migrate-to-version-1.0.sh` script to correctly prepend the `cozystack.` prefix when converting `BUNDLE_DISABLE` and `BUNDLE_ENABLE` package name lists, ensuring packages are properly identified during the v0.41→v1.0 upgrade ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2144, #2148).
-
-* **[backups] Fix RBAC for backup controllers**: Updated RBAC permissions for the backup strategy controller to support enhanced backup and restore capabilities, including Velero integration and status management ([**@androndo**](https://github.com/androndo) in #2145).
-
-* **[kubernetes] Set explicit MTU for Cilium in tenant clusters**: Set explicit MTU 1350 for Cilium in KubeVirt-based tenant Kubernetes clusters to prevent packet drops caused by VXLAN encapsulation overhead. Cilium's auto-detection does not account for VXLAN overhead (50 bytes) when the VM interface inherits MTU 1400 from the parent OVN/Geneve overlay, causing intermittent connectivity issues and HTTP 499 errors under load ([**@IvanHunters**](https://github.com/IvanHunters) in #2147).
-
-* **[platform] Prevent cozystack-version ConfigMap from deletion**: Added resource protection annotations to prevent the `cozystack-version` ConfigMap from being accidentally deleted, improving platform stability ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2112, #2114).
-
-* **[installer] Add keep annotation to Namespace and update migration script**: Added `helm.sh/resource-policy: keep` annotation to the `cozy-system` Namespace in the installer Helm chart to prevent Helm from deleting the namespace and all HelmReleases within it when the installer release is removed. The v1.0 migration script is also updated to annotate the namespace and `cozystack-version` ConfigMap before migration ([**@kvaps**](https://github.com/kvaps) in #2122, #2123).
-
-* **[dashboard] Add FlowSchema to exempt BFF from API throttling**: Added a `cozy-dashboard-exempt` FlowSchema to exempt the dashboard Back-End-for-Frontend service account from Kubernetes API Priority and Fairness throttling, preventing 429 errors under load ([**@kvaps**](https://github.com/kvaps) in #2121, #2124).
-
-* **[platform] Suspend cozy-proxy if it conflicts with installer release during migration**: Added a check in the v0.41→v1.0 migration script to detect and suspend the `cozy-proxy` HelmRelease when its `releaseName` is set to `cozystack`, which conflicts with the installer release and would cause `cozystack-operator` deletion during the upgrade ([**@kvaps**](https://github.com/kvaps) in #2128, #2130).
-
-* **[platform] Fix off-by-one error in run-migrations script**: Fixed a bug in the migration runner where the first required migration was always skipped due to an off-by-one error in the migration range calculation ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2126, #2132).
-
-* **[system] Fix Keycloak proxy configuration for v26.x**: Replaced the deprecated `KC_PROXY=edge` environment variable with `KC_PROXY_HEADERS=xforwarded` and `KC_HTTP_ENABLED=true` in the Keycloak StatefulSet. `KC_PROXY` was removed in Keycloak 26.x, previously causing "Non-secure context detected" warnings and broken cookie handling behind a reverse proxy with TLS termination ([**@sircthulhu**](https://github.com/sircthulhu) in #2125, #2134).
-
-* **[dashboard] Allow clearing instanceType field and preserve newlines in secret copy**: Added `allowEmpty: true` to the `instanceType` field in the VMInstance form so users can explicitly clear it to use custom KubeVirt resources without a named instance type. Also fixed newline preservation when copying secrets with CMD+C ([**@sircthulhu**](https://github.com/sircthulhu) in #2135, #2137).
-
-* **[dashboard] Restore stock-instance sidebars for namespace-level pages**: Restored `stock-instance-api-form`, `stock-instance-api-table`, `stock-instance-builtin-form`, and `stock-instance-builtin-table` sidebar resources that were inadvertently removed in #2106. Without these sidebars, namespace-level pages such as Backup Plans rendered as empty pages ([**@sircthulhu**](https://github.com/sircthulhu) in #2136, #2138).
-
-## System Configuration
-
-* **[platform] Disable private key rotation in CA certs**: Set `rotationPolicy: Never` for all CA/root certificates used by system components (ingress-nginx, linstor, linstor-scheduler, seaweedfs, victoria-metrics-operator, kubeovn-webhook, lineage-controller-webhook, cozystack-api, etcd, linstor API/internal) to prevent trust chain problems when CA certificates are reissued ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2113).
-
-## Development, Testing, and CI/CD
-
-* **[ci] Add debug improvements for CI tests**: Added extra debug commands for Kubernetes startup diagnostics and improved error output in CI test runs ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2111).
-
-## Documentation
-
-* **[website] Add object storage guide (pools, buckets, users)**: Added a comprehensive guide covering SeaweedFS object storage configuration including storage pools for tiered storage, bucket creation with access classes, per-user credential management, and credential rotation procedures ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#438).
-
-* **[website] Add Build Your Own Platform (BYOP) guide**: Added a new "Build Your Own Platform" guide and split the installation documentation into platform installation and BYOP sub-pages, with cross-references throughout the documentation ([**@kvaps**](https://github.com/kvaps) in cozystack/website#437).
-
-* **[website] Add white labeling guide**: Added a comprehensive guide for configuring white labeling (branding) in Cozystack v1, covering Dashboard fields (`titleText`, `footerText`, `tenantText`, `logoText`, `logoSvg`, `iconSvg`) and Keycloak fields (`brandName`, `brandHtmlName`). Includes SVG preparation workflow with theme-aware template variables and portable base64 encoding ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#441).
-
-* **[website] Actualize backup and recovery documentation**: Reworked the backup and recovery docs to be user-focused, separating operator and tenant workflows. Added tenant-facing documentation for `BackupJob` and `Plan` resources and a new Velero administration guide for operators ([**@androndo**](https://github.com/androndo) in cozystack/website#434).
-
-* **[website] Add step to protect namespace before upgrading**: Updated the cluster upgrade guide and v0.41→v1.0 migration guide with a required step to annotate the `cozy-system` namespace and `cozystack-version` ConfigMap with `helm.sh/resource-policy=keep` before running `helm upgrade` ([**@kvaps**](https://github.com/kvaps) in cozystack/website#435).
-
-* **[website] Replace bundles documentation with variants**: Renamed the "Bundles" documentation section to "Variants" to match current Cozystack terminology. Removed deprecated variants and added new ones: `default` and `isp-full-generic` ([**@kvaps**](https://github.com/kvaps) in cozystack/website#433).
-
-* **[website] Fix component values override instructions**: Corrected the component values override documentation to reflect current configuration patterns ([**@kvaps**](https://github.com/kvaps) in cozystack/website#436).
-
-## Breaking Changes & Upgrade Notes
-
-* **[bucket] Bucket user model now requires explicit user definitions**: The implicit default `BucketAccess` resource is no longer created automatically. Existing buckets that relied on a single auto-generated credential secret will need to define users explicitly in the `users` map after upgrading. Each user entry creates its own `BucketAccess` resource and credential secret (optionally with `readonly: true`). The COSI BucketClass suffix has also been renamed from `-worm` to `-lock` ([**@IvanHunters**](https://github.com/IvanHunters) in #2119).
-
-## Contributors
-
-We'd like to thank all contributors who made this release possible:
-
-* [**@androndo**](https://github.com/androndo)
-* [**@IvanHunters**](https://github.com/IvanHunters)
-* [**@kvaps**](https://github.com/kvaps)
-* [**@lexfrei**](https://github.com/lexfrei)
-* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil)
-* [**@sircthulhu**](https://github.com/sircthulhu)
-
---
-
-**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.0...v1.1.0
--- a/docs/changelogs/v1.1.1.md
+++ b/docs/changelogs/v1.1.1.md
@@ -1,23 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v1.1.1
-->
-
-## Fixes
-
-* **[dashboard] Fix hidden MarketplacePanel resources appearing in sidebar menu**: The sidebar was generated independently from MarketplacePanels, always showing all resources regardless of their `hidden` state. Fixed by fetching MarketplacePanels during sidebar reconciliation and skipping resources where `hidden=true`, so hiding a resource from the marketplace also removes it from the sidebar navigation ([**@IvanHunters**](https://github.com/IvanHunters) in #2177, #2203).
-
-* **[dashboard] Fix disabled/hidden state overwritten on every MarketplacePanel reconciliation**: The controller was hardcoding `disabled=false` and `hidden=false` on every reconciliation, silently overwriting any user changes made through the dashboard UI. Fixed by reading and preserving the current `disabled`/`hidden` values from the existing resource before updating ([**@IvanHunters**](https://github.com/IvanHunters) in #2176, #2201).
-
-* **[dashboard] Fix External IPs factory EnrichedTable rendering**: The external-IPs table displayed empty rows because the factory used incorrect `EnrichedTable` properties. Replaced `clusterNamePartOfUrl` with `cluster` and changed `pathToItems` from array to dot-path string format, consistent with all other working `EnrichedTable` instances ([**@IvanHunters**](https://github.com/IvanHunters) in #2175, #2193).
-
-* **[platform] Fix VM MAC address not preserved during virtual-machine to vm-instance migration**: Kube-OVN reads MAC address exclusively from the pod annotation `ovn.kubernetes.io/mac_address`, not from the IP resource `spec.macAddress`. Without the annotation, migrated VMs received a new random MAC, breaking OS-level network configurations that match by MAC (e.g. netplan). Added a Helm `lookup` for the Kube-OVN IP resource in the vm-instance chart so that MAC and IP addresses are automatically injected as pod annotations when the resource exists ([**@sircthulhu**](https://github.com/sircthulhu) in #2169, #2190).
-
-* **[etcd-operator] Replace deprecated kube-rbac-proxy image**: The `gcr.io/kubebuilder/kube-rbac-proxy` image became unavailable after Google Container Registry was deprecated. Replaced it with `quay.io/brancz/kube-rbac-proxy` from the original upstream author, restoring etcd-operator functionality ([**@kvaps**](https://github.com/kvaps) in #2181, #2182).
-
-* **[migrations] Handle missing RabbitMQ CRD in migration 34**: Migration 34 failed with an error when the `rabbitmqs.apps.cozystack.io` CRD did not exist — which occurs on clusters where RabbitMQ was never installed. Added a CRD presence check before attempting to list resources so that migration 34 completes cleanly on such clusters ([**@IvanHunters**](https://github.com/IvanHunters) in #2168, #2180).
-
-* **[keycloak] Fix Keycloak crashloop due to misconfigured health probes**: Keycloak 26.x redirects all HTTP requests on port 8080 to the configured HTTPS hostname; since kubelet does not follow redirects, liveness and readiness probes failed causing a crashloop. Fixed by enabling `KC_HEALTH_ENABLED=true`, exposing management port 9000, and switching all probes to `/health/live` and `/health/ready` on port 9000. Also added a `startupProbe` for improved startup tolerance ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2162, #2179).
-
---
-
-**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.1.0...v1.1.1
--- a/hack/cozytest.sh
+++ b/hack/cozytest.sh
@@ -10,11 +10,7 @@ PATTERN=${2:-*}
 LINE='----------------------------------------------------------------'

 cols() { stty size 2>/dev/null | awk '{print $2}' || echo 80; }
-if [ -t 1 ]; then
-  MAXW=$(( $(cols) - 12 )); [ "$MAXW" -lt 40 ] && MAXW=70
-else
-  MAXW=0  # no truncation when not a tty (e.g. CI)
-fi
+MAXW=$(( $(cols) - 12 )); [ "$MAXW" -lt 40 ] && MAXW=70
 BEGIN=$(date +%s)
 timestamp() { s=$(( $(date +%s) - BEGIN )); printf '[%02d:%02d]' $((s/60)) $((s%60)); }

@@ -49,7 +45,7 @@ run_one() {
          *)       out=$line ;;
        esac
        now=$(( $(date +%s) - START ))
-        [ "$MAXW" -gt 0 ] && [ ${#out} -gt "$MAXW" ] && out="$(printf '%.*s…' "$MAXW" "$out")"
+        [ ${#out} -gt "$MAXW" ] && out="$(printf '%.*s…' "$MAXW" "$out")"
        printf '┊[%02d:%02d] %s\n' $((now/60)) $((now%60)) "$out"
  done

--- a/hack/e2e-apps/bucket.bats
+++ b/hack/e2e-apps/bucket.bats
@@ -1,7 +1,7 @@
 #!/usr/bin/env bats

@test "Create and Verify Seeweedfs Bucket" {
-  # Create the bucket resource with readwrite and readonly users
+  # Create the bucket resource
  name='test'
  kubectl apply -f - <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
@@ -9,29 +9,21 @@ kind: Bucket
 metadata:
  name: ${name}
  namespace: tenant-test
-spec:
-  users:
-    admin: {}
-    viewer:
-      readonly: true
+spec: {}
 EOF

  # Wait for the bucket to be ready
  kubectl -n tenant-test wait hr bucket-${name} --timeout=100s --for=condition=ready
  kubectl -n tenant-test wait bucketclaims.objectstorage.k8s.io bucket-${name} --timeout=300s --for=jsonpath='{.status.bucketReady}'
-  kubectl -n tenant-test wait bucketaccesses.objectstorage.k8s.io bucket-${name}-admin --timeout=300s --for=jsonpath='{.status.accessGranted}'
-  kubectl -n tenant-test wait bucketaccesses.objectstorage.k8s.io bucket-${name}-viewer --timeout=300s --for=jsonpath='{.status.accessGranted}'
+  kubectl -n tenant-test wait bucketaccesses.objectstorage.k8s.io bucket-${name} --timeout=300s --for=jsonpath='{.status.accessGranted}'

-  # Get admin (readwrite) credentials
-  kubectl -n tenant-test get secret bucket-${name}-admin -ojsonpath='{.data.BucketInfo}' | base64 -d > bucket-admin-credentials.json
-  ADMIN_ACCESS_KEY=$(jq -r '.spec.secretS3.accessKeyID' bucket-admin-credentials.json)
-  ADMIN_SECRET_KEY=$(jq -r '.spec.secretS3.accessSecretKey' bucket-admin-credentials.json)
-  BUCKET_NAME=$(jq -r '.spec.bucketName' bucket-admin-credentials.json)
+  # Get and decode credentials
+  kubectl -n tenant-test get secret bucket-${name} -ojsonpath='{.data.BucketInfo}' | base64 -d > bucket-test-credentials.json

-  # Get viewer (readonly) credentials
-  kubectl -n tenant-test get secret bucket-${name}-viewer -ojsonpath='{.data.BucketInfo}' | base64 -d > bucket-viewer-credentials.json
-  VIEWER_ACCESS_KEY=$(jq -r '.spec.secretS3.accessKeyID' bucket-viewer-credentials.json)
-  VIEWER_SECRET_KEY=$(jq -r '.spec.secretS3.accessSecretKey' bucket-viewer-credentials.json)
+  # Get credentials from the secret
+  ACCESS_KEY=$(jq -r '.spec.secretS3.accessKeyID' bucket-test-credentials.json)
+  SECRET_KEY=$(jq -r '.spec.secretS3.accessSecretKey' bucket-test-credentials.json)
+  BUCKET_NAME=$(jq -r '.spec.bucketName' bucket-test-credentials.json)

  # Start port-forwarding
  bash -c 'timeout 100s kubectl port-forward service/seaweedfs-s3 -n tenant-root 8333:8333 > /dev/null 2>&1 &'
@@ -39,33 +31,17 @@ EOF
  # Wait for port-forward to be ready
  timeout 30 sh -ec 'until nc -z localhost 8333; do sleep 1; done'

-  # --- Test readwrite user (admin) ---
-  mc alias set rw-user https://localhost:8333 $ADMIN_ACCESS_KEY $ADMIN_SECRET_KEY --insecure
+  # Set up MinIO alias with error handling
+  mc alias set local https://localhost:8333 $ACCESS_KEY $SECRET_KEY --insecure

-  # Admin can upload
-  echo "readwrite test" > /tmp/rw-test.txt
-  mc cp --insecure /tmp/rw-test.txt rw-user/$BUCKET_NAME/rw-test.txt
+  # Upload file to bucket
+  mc cp bucket-test-credentials.json $BUCKET_NAME/bucket-test-credentials.json

-  # Admin can list
-  mc ls --insecure rw-user/$BUCKET_NAME/rw-test.txt
+  # Verify file was uploaded
+  mc ls $BUCKET_NAME/bucket-test-credentials.json

-  # Admin can download
-  mc cp --insecure rw-user/$BUCKET_NAME/rw-test.txt /tmp/rw-test-download.txt
+  # Clean up uploaded file
+  mc rm $BUCKET_NAME/bucket-test-credentials.json

-  # --- Test readonly user (viewer) ---
-  mc alias set ro-user https://localhost:8333 $VIEWER_ACCESS_KEY $VIEWER_SECRET_KEY --insecure
-
-  # Viewer can list
-  mc ls --insecure ro-user/$BUCKET_NAME/rw-test.txt
-
-  # Viewer can download
-  mc cp --insecure ro-user/$BUCKET_NAME/rw-test.txt /tmp/ro-test-download.txt
-
-  # Viewer cannot upload (must fail with Access Denied)
-  echo "readonly test" > /tmp/ro-test.txt
-  ! mc cp --insecure /tmp/ro-test.txt ro-user/$BUCKET_NAME/ro-test.txt
-
-  # --- Cleanup ---
-  mc rm --insecure rw-user/$BUCKET_NAME/rw-test.txt
  kubectl -n tenant-test delete bucket.apps.cozystack.io ${name}
 }
--- a/hack/e2e-apps/external-dns.bats
+++ b/hack/e2e-apps/external-dns.bats
@@ -1,50 +0,0 @@
-#!/usr/bin/env bats
-
-teardown() {
-  kubectl -n tenant-test delete externaldns.apps.cozystack.io --all --ignore-not-found 2>/dev/null || true
-}
-
-@test "Create and Verify ExternalDNS with inmemory provider" {
-  name='test'
-  kubectl apply -f - <<EOF
-apiVersion: apps.cozystack.io/v1alpha1
-kind: ExternalDNS
-metadata:
-  name: ${name}
-  namespace: tenant-test
-spec:
-  provider: inmemory
-  domainFilters:
-    - example.com
-EOF
-
-  sleep 5
-  kubectl -n tenant-test wait hr ${name} --timeout=120s --for=condition=ready
-  kubectl -n tenant-test wait hr ${name}-system --timeout=120s --for=condition=ready
-  timeout 60 sh -ec "until kubectl -n tenant-test get deploy -l app.kubernetes.io/instance=${name}-system -o jsonpath='{.items[0].status.readyReplicas}' | grep -q '1'; do sleep 5; done"
-
-  kubectl -n tenant-test delete externaldns.apps.cozystack.io ${name}
-}
-
-@test "Create and Verify ExternalDNS with custom annotationPrefix" {
-  name='test-prefix'
-  kubectl apply -f - <<EOF
-apiVersion: apps.cozystack.io/v1alpha1
-kind: ExternalDNS
-metadata:
-  name: ${name}
-  namespace: tenant-test
-spec:
-  provider: inmemory
-  annotationPrefix: custom-dns/
-  domainFilters:
-    - example.org
-EOF
-
-  sleep 5
-  kubectl -n tenant-test wait hr ${name} --timeout=120s --for=condition=ready
-  kubectl -n tenant-test wait hr ${name}-system --timeout=120s --for=condition=ready
-  timeout 60 sh -ec "until kubectl -n tenant-test get deploy -l app.kubernetes.io/instance=${name}-system -o jsonpath='{.items[0].status.readyReplicas}' | grep -q '1'; do sleep 5; done"
-
-  kubectl -n tenant-test delete externaldns.apps.cozystack.io ${name}
-}
--- a/hack/e2e-apps/openbao.bats
+++ b/hack/e2e-apps/openbao.bats
@@ -1,59 +0,0 @@
-#!/usr/bin/env bats
-
-@test "Create OpenBAO (standalone)" {
-  name='test'
-  kubectl apply -f- <<EOF
-apiVersion: apps.cozystack.io/v1alpha1
-kind: OpenBAO
-metadata:
-  name: $name
-  namespace: tenant-test
-spec:
-  replicas: 1
-  size: 10Gi
-  storageClass: ""
-  resourcesPreset: "small"
-  resources: {}
-  external: false
-  ui: true
-EOF
-  sleep 5
-  kubectl -n tenant-test wait hr openbao-$name --timeout=60s --for=condition=ready
-  kubectl -n tenant-test wait hr openbao-$name-system --timeout=120s --for=condition=ready
-
-  # Wait for container to be started (pod Running does not guarantee container is ready for exec on slow CI)
-  if ! timeout 120 sh -ec "until kubectl -n tenant-test get pod openbao-$name-0 --output jsonpath='{.status.containerStatuses[0].started}' 2>/dev/null | grep -q true; do sleep 5; done"; then
-    echo "=== DEBUG: Container did not start in time ===" >&2
-    kubectl -n tenant-test describe pod openbao-$name-0 >&2 || true
-    kubectl -n tenant-test logs openbao-$name-0 --previous >&2 || true
-    kubectl -n tenant-test logs openbao-$name-0 >&2 || true
-    return 1
-  fi
-
-  # Wait for OpenBAO API to accept connections
-  # bao status exit codes: 0 = unsealed, 1 = error/not ready, 2 = sealed but responsive
-  if ! timeout 60 sh -ec "until kubectl -n tenant-test exec openbao-$name-0 -- bao status >/dev/null 2>&1; rc=\$?; test \$rc -eq 0 -o \$rc -eq 2; do sleep 3; done"; then
-    echo "=== DEBUG: OpenBAO API did not become responsive ===" >&2
-    kubectl -n tenant-test describe pod openbao-$name-0 >&2 || true
-    kubectl -n tenant-test logs openbao-$name-0 --previous >&2 || true
-    kubectl -n tenant-test logs openbao-$name-0 >&2 || true
-    return 1
-  fi
-
-  # Initialize OpenBAO (single key share for testing simplicity)
-  init_output=$(kubectl -n tenant-test exec openbao-$name-0 -- bao operator init -key-shares=1 -key-threshold=1 -format=json)
-  unseal_key=$(echo "$init_output" | jq -r '.unseal_keys_b64[0]')
-  if [ -z "$unseal_key" ] || [ "$unseal_key" = "null" ]; then
-    echo "Failed to extract unseal key. Init output: $init_output" >&2
-    return 1
-  fi
-
-  # Unseal OpenBAO
-  kubectl -n tenant-test exec openbao-$name-0 -- bao operator unseal "$unseal_key"
-
-  # Now wait for pod to become ready (readiness probe checks seal status)
-  kubectl -n tenant-test wait sts openbao-$name --timeout=90s --for=jsonpath='{.status.readyReplicas}'=1
-  kubectl -n tenant-test wait pvc data-openbao-$name-0 --timeout=50s --for=jsonpath='{.status.phase}'=Bound
-  kubectl -n tenant-test delete openbao.apps.cozystack.io $name
-  kubectl -n tenant-test delete pvc data-openbao-$name-0 --ignore-not-found
-}
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -102,19 +102,15 @@ EOF
    done
  '
  # Verify the nodes are ready
-  if ! kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait node --all --timeout=2m --for=condition=Ready; then
-    # Additional debug messages
-    kubectl --kubeconfig "tenantkubeconfig-${test_name}" describe nodes
-    kubectl -n tenant-test get hr
-  fi
+  kubectl --kubeconfig "tenantkubeconfig-${test_name}" wait node --all --timeout=2m --for=condition=Ready
  kubectl --kubeconfig "tenantkubeconfig-${test_name}" get nodes -o wide

  # Verify the kubelet version matches what we expect
  versions=$(kubectl --kubeconfig "tenantkubeconfig-${test_name}" \
    get nodes -o jsonpath='{.items[*].status.nodeInfo.kubeletVersion}')
-
+  
  node_ok=true
-
+  
  for v in $versions; do
    case "$v" in
      "${k8s_version}" | "${k8s_version}".* | "${k8s_version}"-*)
@@ -197,7 +193,7 @@ EOF

  # Wait for pods readiness
  kubectl wait deployment --kubeconfig "tenantkubeconfig-${test_name}" "${test_name}-backend" -n tenant-test --for=condition=Available --timeout=300s
-
+  
  # Wait for LoadBalancer to be provisioned (IP or hostname)
  timeout 90 sh -ec "
    until kubectl get svc ${test_name}-backend --kubeconfig tenantkubeconfig-${test_name} -n tenant-test \
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -46,9 +46,6 @@ spec:
        publishing:
          host: "example.org"
          apiServerEndpoint: "https://192.168.123.10:6443"
-        bundles:
-          enabledPackages:
-            - cozystack.external-dns-application
 EOF

  # Wait until HelmReleases appear & reconcile them
@@ -178,8 +175,8 @@ EOF

  # VictoriaMetrics components
  kubectl wait vmalert/vmalert-shortterm vmalertmanager/alertmanager -n tenant-root --for=jsonpath='{.status.updateStatus}'=operational --timeout=15m
-  kubectl wait vlclusters/generic -n tenant-root --for=jsonpath='{.status.updateStatus}'=operational --timeout=5m
-  kubectl wait vmcluster/shortterm vmcluster/longterm -n tenant-root --for=jsonpath='{.status.updateStatus}'=operational --timeout=5m
+  kubectl wait vlogs/generic -n tenant-root --for=jsonpath='{.status.updateStatus}'=operational --timeout=5m
+  kubectl wait vmcluster/shortterm vmcluster/longterm -n tenant-root --for=jsonpath='{.status.clusterStatus}'=operational --timeout=5m

  # Grafana
  kubectl wait clusters.postgresql.cnpg.io/grafana-db -n tenant-root --for=condition=ready --timeout=5m
--- a/internal/controller/dashboard/customformsoverride.go
+++ b/internal/controller/dashboard/customformsoverride.go
@@ -215,34 +215,6 @@ func applyListInputOverrides(schema map[string]any, kind string, openAPIProps ma
 				"keysToLabel": []any{"metadata", "name"},
 			},
 		}
-
-	case "ClickHouse", "Harbor", "HTTPCache", "Kubernetes", "MariaDB", "MongoDB",
-		"NATS", "OpenBAO", "Postgres", "Qdrant", "RabbitMQ", "Redis", "VMDisk":
-		specProps := ensureSchemaPath(schema, "spec")
-		specProps["storageClass"] = storageClassListInput()
-
-	case "FoundationDB":
-		storageProps := ensureSchemaPath(schema, "spec", "storage")
-		storageProps["storageClass"] = storageClassListInput()
-
-	case "Kafka":
-		kafkaProps := ensureSchemaPath(schema, "spec", "kafka")
-		kafkaProps["storageClass"] = storageClassListInput()
-		zkProps := ensureSchemaPath(schema, "spec", "zookeeper")
-		zkProps["storageClass"] = storageClassListInput()
-	}
-}
-
-// storageClassListInput returns a listInput field config for a storageClass dropdown
-// backed by the cluster's available StorageClasses.
-func storageClassListInput() map[string]any {
-	return map[string]any{
-		"type": "listInput",
-		"customProps": map[string]any{
-			"valueUri":    "/api/clusters/{cluster}/k8s/apis/storage.k8s.io/v1/storageclasses",
-			"keysToValue": []any{"metadata", "name"},
-			"keysToLabel": []any{"metadata", "name"},
-		},
 	}
 }

--- a/internal/controller/dashboard/customformsoverride_test.go
+++ b/internal/controller/dashboard/customformsoverride_test.go
@@ -236,72 +236,6 @@ func TestApplyListInputOverrides_VMInstance(t *testing.T) {
 	}
 }

-func TestApplyListInputOverrides_StorageClassSimple(t *testing.T) {
-	for _, kind := range []string{
-		"ClickHouse", "Harbor", "HTTPCache", "Kubernetes", "MariaDB", "MongoDB",
-		"NATS", "OpenBAO", "Postgres", "Qdrant", "RabbitMQ", "Redis", "VMDisk",
-	} {
-		t.Run(kind, func(t *testing.T) {
-			schema := map[string]any{}
-			applyListInputOverrides(schema, kind, map[string]any{})
-
-			specProps := schema["properties"].(map[string]any)["spec"].(map[string]any)["properties"].(map[string]any)
-			sc, ok := specProps["storageClass"].(map[string]any)
-			if !ok {
-				t.Fatalf("storageClass not found in spec.properties for kind %s", kind)
-			}
-			assertStorageClassListInput(t, sc)
-		})
-	}
-}
-
-func TestApplyListInputOverrides_StorageClassFoundationDB(t *testing.T) {
-	schema := map[string]any{}
-	applyListInputOverrides(schema, "FoundationDB", map[string]any{})
-
-	storageProps := schema["properties"].(map[string]any)["spec"].(map[string]any)["properties"].(map[string]any)["storage"].(map[string]any)["properties"].(map[string]any)
-	sc, ok := storageProps["storageClass"].(map[string]any)
-	if !ok {
-		t.Fatal("storageClass not found in spec.storage.properties")
-	}
-	assertStorageClassListInput(t, sc)
-}
-
-func TestApplyListInputOverrides_StorageClassKafka(t *testing.T) {
-	schema := map[string]any{}
-	applyListInputOverrides(schema, "Kafka", map[string]any{})
-
-	specProps := schema["properties"].(map[string]any)["spec"].(map[string]any)["properties"].(map[string]any)
-
-	kafkaSC, ok := specProps["kafka"].(map[string]any)["properties"].(map[string]any)["storageClass"].(map[string]any)
-	if !ok {
-		t.Fatal("storageClass not found in spec.kafka.properties")
-	}
-	assertStorageClassListInput(t, kafkaSC)
-
-	zkSC, ok := specProps["zookeeper"].(map[string]any)["properties"].(map[string]any)["storageClass"].(map[string]any)
-	if !ok {
-		t.Fatal("storageClass not found in spec.zookeeper.properties")
-	}
-	assertStorageClassListInput(t, zkSC)
-}
-
-// assertStorageClassListInput verifies that a field is a correctly configured storageClass listInput.
-func assertStorageClassListInput(t *testing.T, field map[string]any) {
-	t.Helper()
-	if field["type"] != "listInput" {
-		t.Errorf("expected type listInput, got %v", field["type"])
-	}
-	customProps, ok := field["customProps"].(map[string]any)
-	if !ok {
-		t.Fatal("customProps not found")
-	}
-	expectedURI := "/api/clusters/{cluster}/k8s/apis/storage.k8s.io/v1/storageclasses"
-	if customProps["valueUri"] != expectedURI {
-		t.Errorf("expected valueUri %s, got %v", expectedURI, customProps["valueUri"])
-	}
-}
-
 func TestApplyListInputOverrides_UnknownKind(t *testing.T) {
 	schema := map[string]any{}
 	applyListInputOverrides(schema, "SomeOtherKind", map[string]any{})
--- a/internal/controller/dashboard/marketplacepanel.go
+++ b/internal/controller/dashboard/marketplacepanel.go
@@ -68,46 +68,31 @@ func (m *Manager) ensureMarketplacePanel(ctx context.Context, crd *cozyv1alpha1.
 		tags[i] = t
 	}

-	_, err := controllerutil.CreateOrUpdate(ctx, m.Client, mp, func() error {
+	specMap := map[string]any{
+		"description": d.Description,
+		"name":        displayName,
+		"type":        "nonCrd",
+		"apiGroup":    "apps.cozystack.io",
+		"apiVersion":  "v1alpha1",
+		"plural":      app.Plural, // e.g., "buckets"
+		"disabled":    false,
+		"hidden":      false,
+		"tags":        tags,
+		"icon":        d.Icon,
+	}
+
+	specBytes, err := json.Marshal(specMap)
+	if err != nil {
+		return reconcile.Result{}, err
+	}
+
+	_, err = controllerutil.CreateOrUpdate(ctx, m.Client, mp, func() error {
 		if err := controllerutil.SetOwnerReference(crd, mp, m.Scheme); err != nil {
 			return err
 		}
 		// Add dashboard labels to dynamic resources
 		m.addDashboardLabels(mp, crd, ResourceTypeDynamic)

-		// Preserve user-set disabled/hidden values from existing resource
-		disabled := false
-		hidden := false
-		if mp.Spec.Raw != nil {
-			var existing map[string]any
-			if err := json.Unmarshal(mp.Spec.Raw, &existing); err == nil {
-				if v, ok := existing["disabled"].(bool); ok {
-					disabled = v
-				}
-				if v, ok := existing["hidden"].(bool); ok {
-					hidden = v
-				}
-			}
-		}
-
-		specMap := map[string]any{
-			"description": d.Description,
-			"name":        displayName,
-			"type":        "nonCrd",
-			"apiGroup":    "apps.cozystack.io",
-			"apiVersion":  "v1alpha1",
-			"plural":      app.Plural, // e.g., "buckets"
-			"disabled":    disabled,
-			"hidden":      hidden,
-			"tags":        tags,
-			"icon":        d.Icon,
-		}
-
-		specBytes, err := json.Marshal(specMap)
-		if err != nil {
-			return err
-		}
-
 		// Only update spec if it's different to avoid unnecessary updates
 		newSpec := dashv1alpha1.ArbitrarySpec{
 			JSON: apiextv1.JSON{Raw: specBytes},
--- a/internal/controller/dashboard/sidebar.go
+++ b/internal/controller/dashboard/sidebar.go
@@ -38,23 +38,6 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati
 	}
 	all = crdList.Items

-	// 1b) Fetch all MarketplacePanels to determine which resources are hidden
-	hiddenResources := map[string]bool{}
-	var mpList dashv1alpha1.MarketplacePanelList
-	if err := m.List(ctx, &mpList, &client.ListOptions{}); err == nil {
-		for i := range mpList.Items {
-			mp := &mpList.Items[i]
-			if mp.Spec.Raw != nil {
-				var spec map[string]any
-				if err := json.Unmarshal(mp.Spec.Raw, &spec); err == nil {
-					if hidden, ok := spec["hidden"].(bool); ok && hidden {
-						hiddenResources[mp.Name] = true
-					}
-				}
-			}
-		}
-	}
-
 	// 2) Build category -> []item map (only for CRDs with spec.dashboard != nil)
 	type item struct {
 		Key    string
@@ -80,11 +63,6 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati
 		plural := pickPlural(kind, def)
 		lowerKind := strings.ToLower(kind)

-		// Skip resources hidden via MarketplacePanel
-		if hiddenResources[def.Name] {
-			continue
-		}
-
 		// Check if this resource is a module
 		if def.Spec.Dashboard.Module {
 			// Special case: info should have its own keysAndTags, not be in modules
--- a/internal/controller/dashboard/static_refactored.go
+++ b/internal/controller/dashboard/static_refactored.go
@@ -503,12 +503,18 @@ func CreateAllCustomFormsOverrides() []*dashboardv1alpha1.CustomFormsOverride {
 				createFormItem("metadata.namespace", "Namespace", "text"),
 				createFormItem("spec.applicationRef.kind", "Application Kind", "text"),
 				createFormItem("spec.applicationRef.name", "Application Name", "text"),
+				createFormItemWithAPI("spec.backupClassName", "Backup Class", "select", map[string]any{
+					"api": map[string]any{
+						"fetchUrl":       "/api/clusters/{cluster}/k8s/apis/backups.cozystack.io/v1alpha1/backupclasses",
+						"pathToItems":    []any{"items"},
+						"pathToValue":    []any{"metadata", "name"},
+						"pathToLabel":    []any{"metadata", "name"},
+						"clusterNameVar": "clusterName",
+					},
+				}),
 				createFormItem("spec.schedule.type", "Schedule Type", "text"),
 				createFormItem("spec.schedule.cron", "Schedule Cron", "text"),
 			},
-			"schema": createSchema(map[string]any{
-				"backupClassName": listInputScemaItemBackupClass(),
-			}),
 		}),

 		// BackupJobs form override - backups.cozystack.io/v1alpha1
@@ -520,10 +526,16 @@ func CreateAllCustomFormsOverrides() []*dashboardv1alpha1.CustomFormsOverride {
 				createFormItem("spec.applicationRef.apiGroup", "Application API Group", "text"),
 				createFormItem("spec.applicationRef.kind", "Application Kind", "text"),
 				createFormItem("spec.applicationRef.name", "Application Name", "text"),
+				createFormItemWithAPI("spec.backupClassName", "Backup Class", "select", map[string]any{
+					"api": map[string]any{
+						"fetchUrl":       "/api/clusters/{cluster}/k8s/apis/backups.cozystack.io/v1alpha1/backupclasses",
+						"pathToItems":    []any{"items"},
+						"pathToValue":    []any{"metadata", "name"},
+						"pathToLabel":    []any{"metadata", "name"},
+						"clusterNameVar": "clusterName",
+					},
+				}),
 			},
-			"schema": createSchema(map[string]any{
-				"backupClassName": listInputScemaItemBackupClass(),
-			}),
 		}),
 	}
 }
@@ -1924,12 +1936,12 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 				map[string]any{
 					"type": "EnrichedTable",
 					"data": map[string]any{
-						"id":              "external-ips-table",
-						"fetchUrl":        "/api/clusters/{2}/k8s/api/v1/namespaces/{3}/services",
-						"cluster":         "{2}",
-						"baseprefix":      "/openapi-ui",
-						"customizationId": "factory-details-v1.services",
-						"pathToItems":     ".items",
+						"id":                   "external-ips-table",
+						"fetchUrl":             "/api/clusters/{2}/k8s/api/v1/namespaces/{3}/services",
+						"clusterNamePartOfUrl": "{2}",
+						"baseprefix":           "/openapi-ui",
+						"customizationId":      "factory-details-v1.services",
+						"pathToItems":          []any{"items"},
 						"fieldSelector": map[string]any{
 							"spec.type": "LoadBalancer",
 						},
@@ -2051,9 +2063,9 @@ func createCustomFormsOverride(customizationId string, spec map[string]any) *das
 		"strategy":        "merge",
 	}

-	// Merge into newSpec caller-provided fields without: customizationId, hidden, strategy
+	// Merge caller-provided fields (like formItems) into newSpec
 	for key, value := range spec {
-		if key != "customizationId" && key != "hidden" && key != "strategy" {
+		if key != "customizationId" && key != "hidden" && key != "schema" && key != "strategy" {
 			newSpec[key] = value
 		}
 	}
@@ -2098,28 +2110,6 @@ func createNavigation(name string, spec map[string]any) *dashboardv1alpha1.Navig
 	}
 }

-func listInputScemaItemBackupClass() map[string]any {
-	return map[string]any{
-		"type": "listInput",
-		"customProps": map[string]any{
-			"valueUri":    "/api/clusters/{cluster}/k8s/apis/backups.cozystack.io/v1alpha1/backupclasses",
-			"keysToValue": []any{"metadata", "name"},
-			"keysToLabel": []any{"metadata", "name"},
-		},
-	}
-}
-
-// backupClassSchema returns the schema for spec.backupClassName as listInput (BackupJob/Plan).
-func createSchema(customProps map[string]any) map[string]any {
-	return map[string]any{
-		"properties": map[string]any{
-			"spec": map[string]any{
-				"properties": customProps,
-			},
-		},
-	}
-}
-
 // createFormItem creates a form item for CustomFormsOverride
 func createFormItem(path, label, fieldType string) map[string]any {
 	return map[string]any{
--- a/packages/apps/bucket/Makefile
+++ b/packages/apps/bucket/Makefile
@@ -2,4 +2,5 @@ include ../../../hack/package.mk

 generate:
 	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	yq -o json -i '.properties = {}' values.schema.json
 	../../../hack/update-crd.sh
--- a/packages/apps/bucket/README.md
+++ b/packages/apps/bucket/README.md
@@ -1,13 +1,3 @@
 # S3 bucket

 ## Parameters
-
-### Parameters
-
-| Name                   | Description                                                                | Type                | Value   |
-| ---------------------- | -------------------------------------------------------------------------- | ------------------- | ------- |
-| `locking`              | Provisions bucket from the `-lock` BucketClass (with object lock enabled). | `bool`              | `false` |
-| `storagePool`          | Selects a specific BucketClass by storage pool name.                       | `string`            | `""`    |
-| `users`                | Users configuration map.                                                   | `map[string]object` | `{}`    |
-| `users[name].readonly` | Whether the user has read-only access.                                     | `bool`              | `false` |
-
--- a/packages/apps/bucket/templates/bucketclaim.yaml
+++ b/packages/apps/bucket/templates/bucketclaim.yaml
@@ -1,22 +1,19 @@
 {{- $seaweedfs := .Values._namespace.seaweedfs }}
-{{- $pool := .Values.storagePool }}
 apiVersion: objectstorage.k8s.io/v1alpha1
 kind: BucketClaim
 metadata:
  name: {{ .Release.Name }}
 spec:
-  bucketClassName: {{ $seaweedfs }}{{- if $pool }}-{{ $pool }}{{- end }}{{- if .Values.locking }}-lock{{- end }}
+  bucketClassName: {{ $seaweedfs }}
  protocols:
    - s3
-{{- range $name, $user := .Values.users }}
 ---
 apiVersion: objectstorage.k8s.io/v1alpha1
 kind: BucketAccess
 metadata:
-  name: {{ $.Release.Name }}-{{ $name }}
+  name: {{ .Release.Name }}
 spec:
-  bucketAccessClassName: {{ $seaweedfs }}{{- if $pool }}-{{ $pool }}{{- end }}{{- if $user.readonly }}-readonly{{- end }}
-  bucketClaimName: {{ $.Release.Name }}
-  credentialsSecretName: {{ $.Release.Name }}-{{ $name }}
+  bucketAccessClassName: {{ $seaweedfs }}
+  bucketClaimName: {{ .Release.Name }}
+  credentialsSecretName: {{ .Release.Name }}
  protocol: s3
-{{- end }}
--- a/packages/apps/bucket/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/bucket/templates/dashboard-resourcemap.yaml
@@ -8,9 +8,8 @@ rules:
  resources:
  - secrets
  resourceNames:
-  {{- range $name, $user := .Values.users }}
-  - {{ $.Release.Name }}-{{ $name }}-credentials
-  {{- end }}
+  - {{ .Release.Name }}
+  - {{ .Release.Name }}-credentials
  verbs: ["get", "list", "watch"]
 - apiGroups:
  - networking.k8s.io
--- a/packages/apps/bucket/templates/helmrelease.yaml
+++ b/packages/apps/bucket/templates/helmrelease.yaml
@@ -23,4 +23,3 @@ spec:
    name: cozystack-values
  values:
    bucketName: {{ .Release.Name }}
-    users: {{ .Values.users | toJson }}
--- a/packages/apps/bucket/values.schema.json
+++ b/packages/apps/bucket/values.schema.json
@@ -1,30 +1,5 @@
 {
  "title": "Chart Values",
  "type": "object",
-  "properties": {
-    "locking": {
-      "description": "Provisions bucket from the `-lock` BucketClass (with object lock enabled).",
-      "type": "boolean",
-      "default": false
-    },
-    "storagePool": {
-      "description": "Selects a specific BucketClass by storage pool name.",
-      "type": "string",
-      "default": ""
-    },
-    "users": {
-      "description": "Users configuration map.",
-      "type": "object",
-      "default": {},
-      "additionalProperties": {
-        "type": "object",
-        "properties": {
-          "readonly": {
-            "description": "Whether the user has read-only access.",
-            "type": "boolean"
-          }
-        }
-      }
-    }
-  }
-}
+  "properties": {}
+}
--- a/packages/apps/bucket/values.yaml
+++ b/packages/apps/bucket/values.yaml
@@ -1,11 +1 @@
-## @param {bool} locking=false - Provisions bucket from the `-lock` BucketClass (with object lock enabled).
-locking: false
-
-## @param {string} [storagePool] - Selects a specific BucketClass by storage pool name.
-storagePool: ""
-
-## @typedef {struct} User - Bucket user configuration.
-## @field {bool} [readonly] - Whether the user has read-only access.
-
-## @param {map[string]User} users - Users configuration map.
-users: {}
+{}
--- a/packages/apps/foundationdb/README.md
+++ b/packages/apps/foundationdb/README.md
@@ -1,4 +1,4 @@
-# Managed FoundationDB Service
+# FoundationDB

 A managed FoundationDB service for Cozystack.

--- a/packages/apps/harbor/README.md
+++ b/packages/apps/harbor/README.md
@@ -1,6 +1,6 @@
 # Managed Harbor Container Registry

-Harbor is an open-source trusted cloud-native registry project that stores, signs, and scans content.
+Harbor is an open source trusted cloud native registry project that stores, signs, and scans content.

 ## Parameters

--- a/packages/apps/harbor/templates/httproute.yaml
+++ b/packages/apps/harbor/templates/httproute.yaml
@@ -1,75 +0,0 @@
-{{- $gatewayAPI := (index .Values._cluster "gateway-api") | default "false" }}
-{{- $clusterIssuer := (index .Values._cluster "issuer-name") | default "letsencrypt-prod" }}
-{{- $gateway := .Values._namespace.gateway | default "" }}
-{{- $host := .Values._namespace.host }}
-{{- $harborHost := .Values.host | default (printf "%s.%s" .Release.Name $host) }}
-
-{{- if and (eq $gatewayAPI "true") (ne $gateway "") }}
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  name: {{ .Release.Name }}-harbor
-  annotations:
-    cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
-spec:
-  gatewayClassName: cilium
-  infrastructure:
-    labels:
-      cozystack.io/gateway: {{ $gateway }}
-  listeners:
-  - name: http
-    protocol: HTTP
-    port: 80
-    hostname: {{ $harborHost | quote }}
-    allowedRoutes:
-      namespaces:
-        from: Same
-  - name: https
-    protocol: HTTPS
-    port: 443
-    hostname: {{ $harborHost | quote }}
-    tls:
-      mode: Terminate
-      certificateRefs:
-      - name: {{ .Release.Name }}-harbor-gateway-tls
-    allowedRoutes:
-      namespaces:
-        from: Same
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ .Release.Name }}-harbor-redirect-to-https
-spec:
-  parentRefs:
-  - name: {{ .Release.Name }}-harbor
-    sectionName: http
-  hostnames:
-  - {{ $harborHost | quote }}
-  rules:
-  - filters:
-    - type: RequestRedirect
-      requestRedirect:
-        scheme: https
-        statusCode: 301
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ .Release.Name }}-harbor
-spec:
-  parentRefs:
-  - name: {{ .Release.Name }}-harbor
-    sectionName: https
-  hostnames:
-  - {{ $harborHost | quote }}
-  rules:
-  - matches:
-    - path:
-        type: PathPrefix
-        value: /
-    backendRefs:
-    - name: {{ .Release.Name }}
-      port: 80
-{{- end }}
--- a/packages/apps/kubernetes/templates/helmreleases/cilium.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/cilium.yaml
@@ -3,7 +3,6 @@ cilium:
  k8sServiceHost: {{ .Release.Name }}.{{ .Release.Namespace }}.svc
  k8sServicePort: 6443
  routingMode: tunnel
-  MTU: 1350
  enableIPv4Masquerade: true
  ipv4NativeRoutingCIDR: ""
  {{- if $.Values.addons.gatewayAPI.enabled }}
--- a/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml
@@ -73,8 +73,8 @@ spec:
          [OUTPUT]
              Name http
              Match kube.*
-              Host vlinsert-generic.{{ $targetTenant }}.svc.{{ $clusterDomain }}
-              port 9481
+              Host vlogs-generic.{{ $targetTenant }}.svc.{{ $clusterDomain }}
+              port 9428
              compress gzip
              uri /insert/jsonline?_stream_fields=stream,kubernetes_pod_name,kubernetes_container_name,kubernetes_namespace_name&_msg_field=log&_time_field=date
              format json_lines
--- a/packages/apps/mariadb/README.md
+++ b/packages/apps/mariadb/README.md
@@ -15,7 +15,7 @@ This managed service is controlled by mariadb-operator, ensuring efficient manag
 ### How to switch master/slave replica

 ```bash
-kubectl edit mariadb <instance>
+kubectl edit mariadb <instnace>
 ```
 update:

@@ -54,11 +54,11 @@ more details:
 - **Replication can't be finished with various errors**
 - **Replication can't be finished in case if `binlog` purged**

-  Until `mariadbbackup` is not used to bootstrap a node by mariadb-operator (this feature is not implemented yet), follow these manual steps to fix it:
+  Until `mariadbbackup` is not used to bootstrap a node by mariadb-operator (this feature is not inmplemented yet), follow these manual steps to fix it:
  https://github.com/mariadb-operator/mariadb-operator/issues/141#issuecomment-1804760231

- **Corrupted indices**
-  Sometimes some indices can be corrupted on master replica, you can recover them from slave:
+- **Corrupted indicies**
+  Sometimes some indecies can be corrupted on master replica, you can recover them from slave:

  ```bash
  mysqldump -h <slave> -P 3306 -u<user> -p<password> --column-statistics=0 <database> <table> ~/tmp/fix-table.sql
--- a/packages/apps/openbao/.helmignore
+++ b/packages/apps/openbao/.helmignore
@@ -1,3 +0,0 @@
-.helmignore
-/logos
-/Makefile
--- a/packages/apps/openbao/Chart.yaml
+++ b/packages/apps/openbao/Chart.yaml
@@ -1,7 +0,0 @@
-apiVersion: v2
-name: openbao
-description: Managed OpenBAO secrets management service
-icon: /logos/openbao.svg
-type: application
-version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
-appVersion: "2.5.0"
--- a/packages/apps/openbao/Makefile
+++ b/packages/apps/openbao/Makefile
@@ -1,5 +0,0 @@
-include ../../../hack/package.mk
-
-generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
-	../../../hack/update-crd.sh
--- a/packages/apps/openbao/README.md
+++ b/packages/apps/openbao/README.md
@@ -1,27 +0,0 @@
-# Managed OpenBAO Service
-
-OpenBAO is an open-source secrets management solution forked from HashiCorp Vault.
-It provides identity-based secrets and encryption management for cloud infrastructure.
-
-## Parameters
-
-### Common parameters
-
-| Name               | Description                                                                                                                                                                           | Type       | Value   |
-| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | ------- |
-| `replicas`         | Number of OpenBAO replicas. HA with Raft is automatically enabled when replicas > 1. Switching between standalone (file storage) and HA (Raft storage) modes requires data migration. | `int`      | `1`     |
-| `resources`        | Explicit CPU and memory configuration for each OpenBAO replica. When omitted, the preset defined in `resourcesPreset` is applied.                                                     | `object`   | `{}`    |
-| `resources.cpu`    | CPU available to each replica.                                                                                                                                                        | `quantity` | `""`    |
-| `resources.memory` | Memory (RAM) available to each replica.                                                                                                                                               | `quantity` | `""`    |
-| `resourcesPreset`  | Default sizing preset used when `resources` is omitted.                                                                                                                               | `string`   | `small` |
-| `size`             | Persistent Volume Claim size for data storage.                                                                                                                                        | `quantity` | `10Gi`  |
-| `storageClass`     | StorageClass used to store the data.                                                                                                                                                  | `string`   | `""`    |
-| `external`         | Enable external access from outside the cluster.                                                                                                                                      | `bool`     | `false` |
-
-
-### Application-specific parameters
-
-| Name | Description                | Type   | Value  |
-| ---- | -------------------------- | ------ | ------ |
-| `ui` | Enable the OpenBAO web UI. | `bool` | `true` |
-
--- a/packages/apps/openbao/charts/cozy-lib
+++ b/packages/apps/openbao/charts/cozy-lib
@@ -1 +0,0 @@
-../../../library/cozy-lib
--- a/packages/apps/openbao/logos/openbao.svg
+++ b/packages/apps/openbao/logos/openbao.svg
@@ -1,11 +0,0 @@
-<svg width="144" height="144" viewBox="0 0 144 144" fill="none" xmlns="http://www.w3.org/2000/svg">
-<rect width="144" height="144" rx="24" fill="url(#paint0_linear)"/>
-<rect width="144" height="144" rx="24" fill="black" fill-opacity="0.3"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M72 30C53.222 30 38 45.222 38 64v8c-3.314 0-6 2.686-6 6v30c0 3.314 2.686 6 6 6h68c3.314 0 6-2.686 6-6V78c0-3.314-2.686-6-6-6v-8C106 45.222 90.778 30 72 30zm-8 42v-8c0-4.418 3.582-8 8-8s8 3.582 8 8v8H64zm26 0v-8c0-8.837-7.163-16-16-16s-16 7.163-16 16v8h-2v28h60V72H90zm-22 14a4 4 0 118 0 4 4 0 01-8 0zm4-8a8 8 0 100 16 8 8 0 000-16z" fill="white"/>
-<defs>
-<linearGradient id="paint0_linear" x1="10" y1="15.5" x2="144" y2="131.5" gradientUnits="userSpaceOnUse">
-<stop stop-color="#87d6be"/>
-<stop offset="1" stop-color="#79c0ab"/>
-</linearGradient>
-</defs>
-</svg>
--- a/packages/apps/openbao/templates/_resources.tpl
+++ b/packages/apps/openbao/templates/_resources.tpl
@@ -1,49 +0,0 @@
-{{/*
-Copyright Broadcom, Inc. All Rights Reserved.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{/* vim: set filetype=mustache: */}}
-
-{{/*
-Return a resource request/limit object based on a given preset.
-These presets are for basic testing and not meant to be used in production
-{{ include "resources.preset" (dict "type" "nano") -}}
-*/}}
-{{- define "resources.preset" -}}
-{{- $presets := dict
-  "nano" (dict
-      "requests" (dict "cpu" "100m" "memory" "128Mi" "ephemeral-storage" "50Mi")
-      "limits" (dict "memory" "128Mi" "ephemeral-storage" "2Gi")
-   )
-  "micro" (dict
-      "requests" (dict "cpu" "250m" "memory" "256Mi" "ephemeral-storage" "50Mi")
-      "limits" (dict "memory" "256Mi" "ephemeral-storage" "2Gi")
-   )
-  "small" (dict
-      "requests" (dict "cpu" "500m" "memory" "512Mi" "ephemeral-storage" "50Mi")
-      "limits" (dict "memory" "512Mi" "ephemeral-storage" "2Gi")
-   )
-  "medium" (dict
-      "requests" (dict "cpu" "500m" "memory" "1Gi" "ephemeral-storage" "50Mi")
-      "limits" (dict "memory" "1Gi" "ephemeral-storage" "2Gi")
-   )
-  "large" (dict
-      "requests" (dict "cpu" "1" "memory" "2Gi" "ephemeral-storage" "50Mi")
-      "limits" (dict "memory" "2Gi" "ephemeral-storage" "2Gi")
-   )
-  "xlarge" (dict
-      "requests" (dict "cpu" "2" "memory" "4Gi" "ephemeral-storage" "50Mi")
-      "limits" (dict "memory" "4Gi" "ephemeral-storage" "2Gi")
-   )
-  "2xlarge" (dict
-      "requests" (dict "cpu" "4" "memory" "8Gi" "ephemeral-storage" "50Mi")
-      "limits" (dict "memory" "8Gi" "ephemeral-storage" "2Gi")
-   )
- }}
-{{- if hasKey $presets .type -}}
-{{- index $presets .type | toYaml -}}
-{{- else -}}
-{{- printf "ERROR: Preset key '%s' invalid. Allowed values are %s" .type (join "," (keys $presets)) | fail -}}
-{{- end -}}
-{{- end -}}
--- a/packages/apps/openbao/templates/dashboard-resourcemap.yaml
+++ b/packages/apps/openbao/templates/dashboard-resourcemap.yaml
@@ -1,31 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ .Release.Name }}-dashboard-resources
-rules:
- apiGroups:
-  - ""
-  resources:
-  - services
-  resourceNames:
-  - {{ .Release.Name }}
-  - {{ .Release.Name }}-internal
-  verbs: ["get", "list", "watch"]
- apiGroups:
-  - cozystack.io
-  resources:
-  - workloadmonitors
-  resourceNames:
-  - {{ .Release.Name }}
-  verbs: ["get", "list", "watch"]
---
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-dashboard-resources
-subjects:
-{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "use" .Release.Namespace) }}
-roleRef:
-  kind: Role
-  name: {{ .Release.Name }}-dashboard-resources
-  apiGroup: rbac.authorization.k8s.io
--- a/packages/apps/openbao/templates/openbao.yaml
+++ b/packages/apps/openbao/templates/openbao.yaml
@@ -1,99 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: {{ .Release.Name }}-system
-  labels:
-    sharding.fluxcd.io/key: tenants
-spec:
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-openbao-application-default-openbao-system
-    namespace: cozy-system
-  interval: 5m
-  timeout: 10m
-  install:
-    remediation:
-      retries: -1
-  upgrade:
-    force: true
-    remediation:
-      retries: -1
-  valuesFrom:
-  - kind: Secret
-    name: cozystack-values
-  values:
-    openbao:
-      fullnameOverride: {{ .Release.Name }}
-      global:
-        tlsDisable: true
-      server:
-        podManagementPolicy: Parallel
-        resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.resourcesPreset .Values.resources $) | nindent 10 }}
-        dataStorage:
-          enabled: true
-          size: {{ .Values.size }}
-          {{- with .Values.storageClass }}
-          storageClass: {{ . }}
-          {{- end }}
-        {{- if gt (int .Values.replicas) 1 }}
-        standalone:
-          enabled: false
-        ha:
-          enabled: true
-          replicas: {{ .Values.replicas }}
-          raft:
-            enabled: true
-            setNodeId: true
-            config: |
-              ui = {{ .Values.ui }}
-
-              listener "tcp" {
-                address = "[::]:8200"
-                cluster_address = "[::]:8201"
-                tls_disable = true
-              }
-
-              storage "raft" {
-                path = "/openbao/data"
-              {{- range $i := until (int $.Values.replicas) }}
-                retry_join {
-                  leader_api_addr = "http://{{ $.Release.Name }}-{{ $i }}.{{ $.Release.Name }}-internal:8200"
-                }
-              {{- end }}
-              }
-
-              service_registration "kubernetes" {}
-        {{- else }}
-        standalone:
-          enabled: true
-          config: |
-            ui = {{ .Values.ui }}
-
-            listener "tcp" {
-              address = "[::]:8200"
-              cluster_address = "[::]:8201"
-              tls_disable = true
-            }
-
-            storage "file" {
-              path = "/openbao/data"
-            }
-            # Note: service_registration "kubernetes" {} is intentionally omitted
-            # in standalone mode — it requires an HA-capable storage backend and
-            # causes a fatal error with storage "file".
-        ha:
-          enabled: false
-        {{- end }}
-        {{- if .Values.external }}
-        service:
-          type: LoadBalancer
-        {{- end }}
-      ui:
-        enabled: {{ .Values.ui }}
-        {{- if .Values.external }}
-        serviceType: LoadBalancer
-        {{- end }}
-      injector:
-        enabled: false
-      csi:
-        enabled: false
--- a/packages/apps/openbao/templates/workloadmonitor.yaml
+++ b/packages/apps/openbao/templates/workloadmonitor.yaml
@@ -1,13 +0,0 @@
---
-apiVersion: cozystack.io/v1alpha1
-kind: WorkloadMonitor
-metadata:
-  name: {{ $.Release.Name }}
-spec:
-  replicas: {{ .Values.replicas }}
-  minReplicas: 1
-  kind: openbao
-  type: openbao
-  selector:
-    app.kubernetes.io/instance: {{ $.Release.Name }}-system
-  version: {{ $.Chart.Version }}
--- a/packages/apps/openbao/values.schema.json
+++ b/packages/apps/openbao/values.schema.json
@@ -1,87 +0,0 @@
-{
-  "title": "Chart Values",
-  "type": "object",
-  "properties": {
-    "external": {
-      "description": "Enable external access from outside the cluster.",
-      "type": "boolean",
-      "default": false
-    },
-    "replicas": {
-      "description": "Number of OpenBAO replicas. HA with Raft is automatically enabled when replicas \u003e 1. Switching between standalone (file storage) and HA (Raft storage) modes requires data migration.",
-      "type": "integer",
-      "default": 1
-    },
-    "resources": {
-      "description": "Explicit CPU and memory configuration for each OpenBAO replica. When omitted, the preset defined in `resourcesPreset` is applied.",
-      "type": "object",
-      "default": {},
-      "properties": {
-        "cpu": {
-          "description": "CPU available to each replica.",
-          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "string"
-            }
-          ],
-          "x-kubernetes-int-or-string": true
-        },
-        "memory": {
-          "description": "Memory (RAM) available to each replica.",
-          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "string"
-            }
-          ],
-          "x-kubernetes-int-or-string": true
-        }
-      }
-    },
-    "resourcesPreset": {
-      "description": "Default sizing preset used when `resources` is omitted.",
-      "type": "string",
-      "default": "small",
-      "enum": [
-        "nano",
-        "micro",
-        "small",
-        "medium",
-        "large",
-        "xlarge",
-        "2xlarge"
-      ]
-    },
-    "size": {
-      "description": "Persistent Volume Claim size for data storage.",
-      "default": "10Gi",
-      "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-      "anyOf": [
-        {
-          "type": "integer"
-        },
-        {
-          "type": "string"
-        }
-      ],
-      "x-kubernetes-int-or-string": true
-    },
-    "storageClass": {
-      "description": "StorageClass used to store the data.",
-      "type": "string",
-      "default": ""
-    },
-    "ui": {
-      "description": "Enable the OpenBAO web UI.",
-      "type": "boolean",
-      "default": true
-    }
-  }
-}
--- a/packages/apps/openbao/values.yaml
+++ b/packages/apps/openbao/values.yaml
@@ -1,41 +0,0 @@
-##
-## @section Common parameters
-##
-
-## @typedef {struct} Resources - Explicit CPU and memory configuration for each OpenBAO replica.
-## @field {quantity} [cpu] - CPU available to each replica.
-## @field {quantity} [memory] - Memory (RAM) available to each replica.
-
-## @enum {string} ResourcesPreset - Default sizing preset.
-## @value nano
-## @value micro
-## @value small
-## @value medium
-## @value large
-## @value xlarge
-## @value 2xlarge
-
-## @param {int} replicas - Number of OpenBAO replicas. HA with Raft is automatically enabled when replicas > 1. Switching between standalone (file storage) and HA (Raft storage) modes requires data migration.
-replicas: 1
-
-## @param {Resources} [resources] - Explicit CPU and memory configuration for each OpenBAO replica. When omitted, the preset defined in `resourcesPreset` is applied.
-resources: {}
-
-## @param {ResourcesPreset} resourcesPreset="small" - Default sizing preset used when `resources` is omitted.
-resourcesPreset: "small"
-
-## @param {quantity} size - Persistent Volume Claim size for data storage.
-size: 10Gi
-
-## @param {string} storageClass - StorageClass used to store the data.
-storageClass: ""
-
-## @param {bool} external - Enable external access from outside the cluster.
-external: false
-
-##
-## @section Application-specific parameters
-##
-
-## @param {bool} ui - Enable the OpenBAO web UI.
-ui: true
--- a/packages/apps/rabbitmq/Chart.yaml
+++ b/packages/apps/rabbitmq/Chart.yaml
@@ -4,4 +4,4 @@ description: Managed RabbitMQ service
 icon: /logos/rabbitmq.svg
 type: application
 version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
-appVersion: "4.2.4"
+appVersion: "3.13.2"
--- a/packages/apps/rabbitmq/Makefile
+++ b/packages/apps/rabbitmq/Makefile
@@ -3,7 +3,3 @@ include ../../../hack/package.mk
 generate:
 	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
 	../../../hack/update-crd.sh
-
-update:
-	hack/update-versions.sh
-	make generate
--- a/packages/apps/rabbitmq/README.md
+++ b/packages/apps/rabbitmq/README.md
@@ -23,7 +23,6 @@ The service utilizes official RabbitMQ operator. This ensures the reliability an
 | `size`             | Persistent Volume Claim size available for application data.                                                                       | `quantity` | `10Gi`  |
 | `storageClass`     | StorageClass used to store the data.                                                                                               | `string`   | `""`    |
 | `external`         | Enable external access from outside the cluster.                                                                                   | `bool`     | `false` |
-| `version`          | RabbitMQ major.minor version to deploy                                                                                             | `string`   | `v4.2`  |


 ### Application-specific parameters
--- a/packages/apps/rabbitmq/files/versions.yaml
+++ b/packages/apps/rabbitmq/files/versions.yaml
@@ -1,4 +0,0 @@
-"v4.2": "4.2.4"
-"v4.1": "4.1.8"
-"v4.0": "4.0.9"
-"v3.13": "3.13.7"
--- a/packages/apps/rabbitmq/hack/update-versions.sh
+++ b/packages/apps/rabbitmq/hack/update-versions.sh
@@ -1,129 +0,0 @@
-#!/usr/bin/env bash
-
-set -o errexit
-set -o nounset
-set -o pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-RABBITMQ_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
-VALUES_FILE="${RABBITMQ_DIR}/values.yaml"
-VERSIONS_FILE="${RABBITMQ_DIR}/files/versions.yaml"
-GITHUB_API_URL="https://api.github.com/repos/rabbitmq/rabbitmq-server/releases"
-
-# Check if jq is installed
-if ! command -v jq &> /dev/null; then
-    echo "Error: jq is not installed. Please install jq and try again." >&2
-    exit 1
-fi
-
-# Fetch releases from GitHub API
-echo "Fetching releases from GitHub API..."
-RELEASES_JSON=$(curl -sSL "${GITHUB_API_URL}?per_page=100")
-
-if [ -z "$RELEASES_JSON" ]; then
-    echo "Error: Could not fetch releases from GitHub API" >&2
-    exit 1
-fi
-
-# Extract stable release tags (format: v3.13.7, v4.0.3, etc.)
-# Filter out pre-releases and draft releases
-RELEASE_TAGS=$(echo "$RELEASES_JSON" | jq -r '.[] | select(.prerelease == false) | select(.draft == false) | .tag_name' | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | sort -V)
-
-if [ -z "$RELEASE_TAGS" ]; then
-    echo "Error: Could not find any stable release tags" >&2
-    exit 1
-fi
-
-echo "Found release tags: $(echo "$RELEASE_TAGS" | tr '\n' ' ')"
-
-# Supported major.minor versions (newest first)
-# We support the last few minor releases of each active major
-SUPPORTED_MAJORS=("4.2" "4.1" "4.0" "3.13")
-
-# Build versions map: major.minor -> latest patch version
-declare -A VERSION_MAP
-MAJOR_VERSIONS=()
-
-for major_minor in "${SUPPORTED_MAJORS[@]}"; do
-    # Find the latest patch version for this major.minor
-    MATCHING=$(echo "$RELEASE_TAGS" | grep -E "^v${major_minor//./\\.}\.[0-9]+$" | tail -n1)
-
-    if [ -n "$MATCHING" ]; then
-        # Strip the 'v' prefix for the value (Docker tag format is e.g. 3.13.7)
-        TAG_VERSION="${MATCHING#v}"
-        VERSION_MAP["v${major_minor}"]="${TAG_VERSION}"
-        MAJOR_VERSIONS+=("v${major_minor}")
-        echo "Found version: v${major_minor} -> ${TAG_VERSION}"
-    else
-        echo "Warning: No stable releases found for ${major_minor}, skipping..." >&2
-    fi
-done
-
-if [ ${#MAJOR_VERSIONS[@]} -eq 0 ]; then
-    echo "Error: No matching versions found" >&2
-    exit 1
-fi
-
-echo "Major versions to add: ${MAJOR_VERSIONS[*]}"
-
-# Create/update versions.yaml file
-echo "Updating $VERSIONS_FILE..."
-{
-    for major_ver in "${MAJOR_VERSIONS[@]}"; do
-        echo "\"${major_ver}\": \"${VERSION_MAP[$major_ver]}\""
-    done
-} > "$VERSIONS_FILE"
-
-echo "Successfully updated $VERSIONS_FILE"
-
-# Update values.yaml - enum with major.minor versions only
-TEMP_FILE=$(mktemp)
-trap "rm -f $TEMP_FILE" EXIT
-
-# Build new version section
-NEW_VERSION_SECTION="## @enum {string} Version"
-for major_ver in "${MAJOR_VERSIONS[@]}"; do
-    NEW_VERSION_SECTION="${NEW_VERSION_SECTION}
-## @value $major_ver"
-done
-NEW_VERSION_SECTION="${NEW_VERSION_SECTION}
-
-## @param {Version} version - RabbitMQ major.minor version to deploy
-version: ${MAJOR_VERSIONS[0]}"
-
-# Check if version section already exists
-if grep -q "^## @enum {string} Version" "$VALUES_FILE"; then
-    # Version section exists, update it using awk
-    echo "Updating existing version section in $VALUES_FILE..."
-
-    awk -v new_section="$NEW_VERSION_SECTION" '
-        /^## @enum {string} Version/ {
-            in_section = 1
-            print new_section
-            next
-        }
-        in_section && /^version: / {
-            in_section = 0
-            next
-        }
-        in_section {
-            next
-        }
-        { print }
-    ' "$VALUES_FILE" > "$TEMP_FILE.tmp"
-    mv "$TEMP_FILE.tmp" "$VALUES_FILE"
-else
-    # Version section doesn't exist, insert it before Application-specific parameters section
-    echo "Inserting new version section in $VALUES_FILE..."
-
-    awk -v new_section="$NEW_VERSION_SECTION" '
-        /^## @section Application-specific parameters/ {
-            print new_section
-            print ""
-        }
-        { print }
-    ' "$VALUES_FILE" > "$TEMP_FILE.tmp"
-    mv "$TEMP_FILE.tmp" "$VALUES_FILE"
-fi
-
-echo "Successfully updated $VALUES_FILE with major.minor versions: ${MAJOR_VERSIONS[*]}"
--- a/packages/apps/rabbitmq/templates/_versions.tpl
+++ b/packages/apps/rabbitmq/templates/_versions.tpl
@@ -1,8 +0,0 @@
-{{- define "rabbitmq.versionMap" }}
-{{- $versionMap := .Files.Get "files/versions.yaml" | fromYaml }}
-{{- if not (hasKey $versionMap .Values.version) }}
-    {{- printf `RabbitMQ version %s is not supported, allowed versions are %s` $.Values.version (keys $versionMap) | fail }}
-{{- end }}
-{{- index $versionMap .Values.version }}
-{{- end }}
-
--- a/packages/apps/rabbitmq/templates/rabbitmq.yaml
+++ b/packages/apps/rabbitmq/templates/rabbitmq.yaml
@@ -7,7 +7,6 @@ metadata:
    app.kubernetes.io/managed-by: {{ .Release.Service }}
 spec:
  replicas: {{ .Values.replicas }}
-  image: 'rabbitmq:{{ include "rabbitmq.versionMap" $ }}-management'
  {{- if .Values.external }}
  service:
    type: LoadBalancer
--- a/packages/apps/rabbitmq/values.schema.json
+++ b/packages/apps/rabbitmq/values.schema.json
@@ -92,17 +92,6 @@
        }
      }
    },
-    "version": {
-      "description": "RabbitMQ major.minor version to deploy",
-      "type": "string",
-      "default": "v4.2",
-      "enum": [
-        "v4.2",
-        "v4.1",
-        "v4.0",
-        "v3.13"
-      ]
-    },
    "vhosts": {
      "description": "Virtual hosts configuration map.",
      "type": "object",
--- a/packages/apps/rabbitmq/values.yaml
+++ b/packages/apps/rabbitmq/values.yaml
@@ -34,15 +34,6 @@ storageClass: ""
 external: false

 ##
-## @enum {string} Version
-## @value v4.2
-## @value v4.1
-## @value v4.0
-## @value v3.13
-
-## @param {Version} version - RabbitMQ major.minor version to deploy
-version: v4.2
-
 ## @section Application-specific parameters
 ##

--- a/packages/apps/tenant/README.md
+++ b/packages/apps/tenant/README.md
@@ -80,7 +80,6 @@ tenant-u1
 | `etcd`           | Deploy own Etcd cluster.                                                                                                   | `bool`                | `false` |
 | `monitoring`     | Deploy own Monitoring Stack.                                                                                               | `bool`                | `false` |
 | `ingress`        | Deploy own Ingress Controller.                                                                                             | `bool`                | `false` |
-| `gateway`        | Deploy own Gateway API gateway (separate LB for this tenant).                                                              | `bool`                | `false` |
 | `seaweedfs`      | Deploy own SeaweedFS.                                                                                                      | `bool`                | `false` |
 | `resourceQuotas` | Define resource quotas for the tenant.                                                                                     | `map[string]quantity` | `{}`    |

--- a/packages/apps/tenant/templates/namespace.yaml
+++ b/packages/apps/tenant/templates/namespace.yaml
@@ -29,11 +29,6 @@
 {{- $ingress = $tenantName }}
 {{- end }}

-{{- $gateway := $parentNamespace.gateway | default "" }}
-{{- if .Values.gateway }}
-{{- $gateway = $tenantName }}
-{{- end }}
-
 {{- $monitoring := $parentNamespace.monitoring | default "" }}
 {{- if .Values.monitoring }}
 {{- $monitoring = $tenantName }}
@@ -60,7 +55,6 @@ metadata:
    {{/* Labels for network policies */}}
    namespace.cozystack.io/etcd: {{ $etcd | quote }}
    namespace.cozystack.io/ingress: {{ $ingress | quote }}
-    namespace.cozystack.io/gateway: {{ $gateway | quote }}
    namespace.cozystack.io/monitoring: {{ $monitoring | quote }}
    namespace.cozystack.io/seaweedfs: {{ $seaweedfs | quote }}
    namespace.cozystack.io/host: {{ $computedHost | quote }}
@@ -89,7 +83,6 @@ stringData:
    _namespace:
      etcd: {{ $etcd | quote }}
      ingress: {{ $ingress | quote }}
-      gateway: {{ $gateway | quote }}
      monitoring: {{ $monitoring | quote }}
      seaweedfs: {{ $seaweedfs | quote }}
      host: {{ $computedHost | quote }}
--- a/packages/apps/tenant/templates/networkpolicy.yaml
+++ b/packages/apps/tenant/templates/networkpolicy.yaml
@@ -207,27 +207,6 @@ spec:
  - toEndpoints:
      - matchLabels:
          "k8s:io.kubernetes.pod.namespace": cozy-kubevirt-cdi
-{{- if .Values.monitoring }}
---
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: {{ include "tenant.name" . }}-egress-virt-handler
-spec:
-  endpointSelector:
-    matchLabels:
-      "k8s:io.kubernetes.pod.namespace": "{{ include "tenant.name" . }}"
-      "k8s:app.kubernetes.io/name": "vmagent"
-  egress:
-  - toEndpoints:
-    - matchLabels:
-        "k8s:kubevirt.io": "virt-handler"
-        "k8s:io.kubernetes.pod.namespace": "cozy-kubevirt"
-    toPorts:
-    - ports:
-      - port: "8443"
-        protocol: TCP
-{{- end }}
 ---
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
--- a/packages/apps/tenant/values.schema.json
+++ b/packages/apps/tenant/values.schema.json
@@ -7,11 +7,6 @@
      "type": "boolean",
      "default": false
    },
-    "gateway": {
-      "description": "Deploy own Gateway API gateway (separate LB for this tenant).",
-      "type": "boolean",
-      "default": false
-    },
    "host": {
      "description": "The hostname used to access tenant services (defaults to using the tenant name as a subdomain for its parent tenant host).",
      "type": "string",
--- a/packages/apps/tenant/values.yaml
+++ b/packages/apps/tenant/values.yaml
@@ -14,9 +14,6 @@ monitoring: false
 ## @param {bool} ingress - Deploy own Ingress Controller.
 ingress: false

-## @param {bool} gateway - Deploy own Gateway API gateway (separate LB for this tenant).
-gateway: false
-
 ## @param {bool} seaweedfs - Deploy own SeaweedFS.
 seaweedfs: false

--- a/packages/apps/vm-instance/templates/vm.yaml
+++ b/packages/apps/vm-instance/templates/vm.yaml
@@ -34,12 +34,6 @@ spec:
    metadata:
      annotations:
        kubevirt.io/allow-pod-bridge-network-live-migration: "true"
-        {{- $ovnIPName := printf "%s.%s" (include "virtual-machine.fullname" .) .Release.Namespace }}
-        {{- $ovnIP := lookup "kubeovn.io/v1" "IP" "" $ovnIPName }}
-        {{- if $ovnIP }}
-        ovn.kubernetes.io/mac_address: {{ $ovnIP.spec.macAddress | quote }}
-        ovn.kubernetes.io/ip_address: {{ $ovnIP.spec.ipAddress | quote }}
-        {{- end }}
      labels:
        {{- include "virtual-machine.labels" . | nindent 8 }}
    spec:
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -1,9 +1,9 @@
 cozystackOperator:
  # Deployment variant: talos, generic, hosted
  variant: talos
-  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.1.0@sha256:9367001a8d1d2dcf08ae74a42ac234eaa6af18f1af64ac28ce8a5946af9c5d3f
+  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.0.3@sha256:dffbd74674ce2241850e9bc9acb8f1037de2946465748f34a82915b5b550d095
  platformSourceUrl: 'oci://ghcr.io/cozystack/cozystack/cozystack-packages'
-  platformSourceRef: 'digest=sha256:7c6da38e7b99ec80d35ba2cef721ea1579f8a0824989454544fa85318bb7bf15'
+  platformSourceRef: 'digest=sha256:451d4a70040abffbb644aaa323b284b2cbee640db1fe337314e89f19cbe57247'
 # Generic variant configuration (only used when cozystackOperator.variant=generic)
 cozystack:
  # Kubernetes API server host (IP only, no protocol/port)
--- a/packages/core/platform/images/migrations/migrations/34
+++ b/packages/core/platform/images/migrations/migrations/34
@@ -1,46 +0,0 @@
-#!/bin/sh
-# Migration 34 --> 35
-# Backfill spec.version on rabbitmq.apps.cozystack.io resources.
-#
-# Before this migration RabbitMQ had no user-selectable version; the
-# operator always used its built-in default image (v3.x).  A version field
-# was added in this release.  Without this migration every existing cluster
-# would be upgraded to the new default (v4.2) on the next reconcile.
-#
-# Set spec.version to "v3.13" for any rabbitmq app resource that does not
-# already have it set.
-
-set -euo pipefail
-
-DEFAULT_VERSION="v3.13"
-
-# Skip if the CRD does not exist (rabbitmq was never installed)
-if ! kubectl api-resources --api-group=apps.cozystack.io -o name 2>/dev/null | grep -q '^rabbitmqs\.'; then
-  echo "CRD rabbitmqs.apps.cozystack.io not found, skipping migration"
-  kubectl create configmap -n cozy-system cozystack-version \
-    --from-literal=version=35 --dry-run=client -o yaml | kubectl apply -f-
-  exit 0
-fi
-
-RABBITMQS=$(kubectl get rabbitmqs.apps.cozystack.io -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\n"}{end}')
-for resource in $RABBITMQS; do
-  NS="${resource%%/*}"
-  APP_NAME="${resource##*/}"
-
-  # Skip if spec.version is already set
-  CURRENT_VER=$(kubectl get rabbitmqs.apps.cozystack.io -n "$NS" "$APP_NAME" \
-    -o jsonpath='{.spec.version}')
-  if [ -n "$CURRENT_VER" ]; then
-    echo "SKIP $NS/$APP_NAME: spec.version already set to '$CURRENT_VER'"
-    continue
-  fi
-
-  echo "Patching rabbitmq/$APP_NAME in $NS: setting version=$DEFAULT_VERSION"
-
-  kubectl patch rabbitmqs.apps.cozystack.io -n "$NS" "$APP_NAME" --type=merge \
-    --patch "{\"spec\":{\"version\":\"${DEFAULT_VERSION}\"}}"
-done
-
-# Stamp version
-kubectl create configmap -n cozy-system cozystack-version \
-  --from-literal=version=35 --dry-run=client -o yaml | kubectl apply -f-
--- a/packages/core/platform/images/migrations/migrations/35
+++ b/packages/core/platform/images/migrations/migrations/35
@@ -1,21 +0,0 @@
-#!/bin/sh
-# Migration 35 --> 36
-# Add helm.sh/resource-policy=keep annotation to existing VLogs resources
-# so they are preserved when the monitoring helm release upgrades to VLCluster.
-# Users will need to manually verify the new cluster is working, then optionally
-# migrate historical data and delete old VLogs resources.
-
-set -euo pipefail
-
-VLOGS=$(kubectl get vlogs.operator.victoriametrics.com --all-namespaces --output jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\n"}{end}' 2>/dev/null || true)
-for resource in $VLOGS; do
-  NS="${resource%%/*}"
-  NAME="${resource##*/}"
-  echo "Adding keep annotation to VLogs/$NAME in $NS"
-  kubectl annotate vlogs.operator.victoriametrics.com --namespace "$NS" "$NAME" \
-    helm.sh/resource-policy=keep \
-    --overwrite
-done
-
-kubectl create configmap --namespace cozy-system cozystack-version \
-  --from-literal=version=36 --dry-run=client --output yaml | kubectl apply --filename -
--- a/packages/core/platform/sources/cozystack-gateway.yaml
+++ b/packages/core/platform/sources/cozystack-gateway.yaml
@@ -1,22 +0,0 @@
---
-apiVersion: cozystack.io/v1alpha1
-kind: PackageSource
-metadata:
-  name: cozystack.cozystack-gateway
-spec:
-  sourceRef:
-    kind: OCIRepository
-    name: cozystack-packages
-    namespace: cozy-system
-    path: /
-  variants:
-  - name: default
-    dependsOn:
-    - cozystack.networking
-    - cozystack.cert-manager
-    components:
-    - name: cozystack-gateway
-      path: system/cozystack-gateway
-      install:
-        namespace: cozy-gateway
-        releaseName: cozystack-gateway
--- a/packages/core/platform/sources/external-dns-application.yaml
+++ b/packages/core/platform/sources/external-dns-application.yaml
@@ -1,29 +0,0 @@
---
-apiVersion: cozystack.io/v1alpha1
-kind: PackageSource
-metadata:
-  name: cozystack.external-dns-application
-spec:
-  sourceRef:
-    kind: OCIRepository
-    name: cozystack-packages
-    namespace: cozy-system
-    path: /
-  variants:
-    - name: default
-      dependsOn:
-        - cozystack.networking
-      libraries:
-        - name: cozy-lib
-          path: library/cozy-lib
-      components:
-        - name: external-dns-system
-          path: system/external-dns
-        - name: external-dns
-          path: extra/external-dns
-          libraries: ["cozy-lib"]
-        - name: external-dns-rd
-          path: system/external-dns-rd
-          install:
-            namespace: cozy-system
-            releaseName: external-dns-rd
--- a/packages/core/platform/sources/networking.yaml
+++ b/packages/core/platform/sources/networking.yaml
@@ -15,12 +15,6 @@ spec:
  - name: cilium
    dependsOn: []
    components:
-    - name: gateway-api-crds
-      path: system/gateway-api-crds
-      install:
-        namespace: cozy-gateway-api-crds
-        releaseName: gateway-api-crds
-        dependsOn: []
    - name: cilium
      path: system/cilium
      valuesFiles:
@@ -30,8 +24,7 @@ spec:
        privileged: true
        namespace: cozy-cilium
        releaseName: cilium
-        dependsOn:
-        - gateway-api-crds
+        dependsOn: []
    - name: cilium-networkpolicy
      path: system/cilium-networkpolicy
      install:
@@ -43,12 +36,6 @@ spec:
  - name: cilium-kilo
    dependsOn: []
    components:
-    - name: gateway-api-crds
-      path: system/gateway-api-crds
-      install:
-        namespace: cozy-gateway-api-crds
-        releaseName: gateway-api-crds
-        dependsOn: []
    - name: cilium
      path: system/cilium
      valuesFiles:
@@ -59,8 +46,7 @@ spec:
        privileged: true
        namespace: cozy-cilium
        releaseName: cilium
-        dependsOn:
-        - gateway-api-crds
+        dependsOn: []
    - name: kilo
      path: system/kilo
      valuesFiles:
@@ -76,12 +62,6 @@ spec:
  - name: cilium-generic
    dependsOn: []
    components:
-    - name: gateway-api-crds
-      path: system/gateway-api-crds
-      install:
-        namespace: cozy-gateway-api-crds
-        releaseName: gateway-api-crds
-        dependsOn: []
    - name: cilium
      path: system/cilium
      valuesFiles:
@@ -90,8 +70,7 @@ spec:
        privileged: true
        namespace: cozy-cilium
        releaseName: cilium
-        dependsOn:
-        - gateway-api-crds
+        dependsOn: []
    - name: cilium-networkpolicy
      path: system/cilium-networkpolicy
      install:
@@ -103,12 +82,6 @@ spec:
  - name: kubeovn-cilium
    dependsOn: []
    components:
-    - name: gateway-api-crds
-      path: system/gateway-api-crds
-      install:
-        namespace: cozy-gateway-api-crds
-        releaseName: gateway-api-crds
-        dependsOn: []
    - name: cilium
      path: system/cilium
      valuesFiles:
@@ -119,8 +92,7 @@ spec:
        privileged: true
        namespace: cozy-cilium
        releaseName: cilium
-        dependsOn:
-        - gateway-api-crds
+        dependsOn: []
    - name: cilium-networkpolicy
      path: system/cilium-networkpolicy
      install:
@@ -141,12 +113,6 @@ spec:
  - name: kubeovn-cilium-generic
    dependsOn: []
    components:
-    - name: gateway-api-crds
-      path: system/gateway-api-crds
-      install:
-        namespace: cozy-gateway-api-crds
-        releaseName: gateway-api-crds
-        dependsOn: []
    - name: cilium
      path: system/cilium
      valuesFiles:
@@ -156,8 +122,7 @@ spec:
        privileged: true
        namespace: cozy-cilium
        releaseName: cilium
-        dependsOn:
-        - gateway-api-crds
+        dependsOn: []
    - name: cilium-networkpolicy
      path: system/cilium-networkpolicy
      install:
--- a/packages/core/platform/sources/openbao-application.yaml
+++ b/packages/core/platform/sources/openbao-application.yaml
@@ -1,29 +0,0 @@
---
-apiVersion: cozystack.io/v1alpha1
-kind: PackageSource
-metadata:
-  name: cozystack.openbao-application
-spec:
-  sourceRef:
-    kind: OCIRepository
-    name: cozystack-packages
-    namespace: cozy-system
-    path: /
-  variants:
-    - name: default
-      dependsOn:
-        - cozystack.networking
-      libraries:
-        - name: cozy-lib
-          path: library/cozy-lib
-      components:
-        - name: openbao-system
-          path: system/openbao
-        - name: openbao
-          path: apps/openbao
-          libraries: ["cozy-lib"]
-        - name: openbao-rd
-          path: system/openbao-rd
-          install:
-            namespace: cozy-system
-            releaseName: openbao-rd
--- a/packages/core/platform/templates/apps.yaml
+++ b/packages/core/platform/templates/apps.yaml
@@ -39,13 +39,6 @@ stringData:
      scheduling:
        {{- . | toYaml | nindent 8 }}
      {{- end }}
-      gateway-api: {{ .Values.gateway.gatewayAPI | quote }}
-      gateway-name: {{ .Values.gateway.name | quote }}
-      gateway-namespace: {{ .Values.gateway.namespace | quote }}
-      {{- with .Values.publishing.hostnames }}
-      hostnames:
-        {{- . | toYaml | nindent 8 }}
-      {{- end }}
      {{- with $kubeRootCa.data }}
      kube-root-ca: {{ index . "ca.crt" | b64enc | quote }}
      {{- end }}
--- a/packages/core/platform/templates/bundles/paas.yaml
+++ b/packages/core/platform/templates/bundles/paas.yaml
@@ -16,7 +16,6 @@
 {{include "cozystack.platform.package.default" (list "cozystack.mariadb-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.mongodb-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.nats-application" $) }}
-{{include "cozystack.platform.package.default" (list "cozystack.openbao-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.postgres-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.qdrant-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.rabbitmq-application" $) }}
--- a/packages/core/platform/templates/bundles/system.yaml
+++ b/packages/core/platform/templates/bundles/system.yaml
@@ -16,14 +16,10 @@
 {{- $kubeovnValues := dict "kube-ovn" $kubeovnDict -}}
 {{- $_ := set $networkingComponents "kubeovn" (dict "values" $kubeovnValues) -}}
 {{- /* For Talos (isp-full): use KubePrism endpoint and disable cgroup autoMount */ -}}
-{{- $ciliumDict := dict
+{{- $ciliumValues := dict "cilium" (dict
  "k8sServiceHost" "localhost"
  "k8sServicePort" "7445"
-  "cgroup" (dict "autoMount" (dict "enabled" false)) -}}
-{{- if .Values.gateway.gatewayAPI -}}
-{{- $_ := set $ciliumDict "gatewayAPI" (dict "enabled" true) -}}
-{{- end -}}
-{{- $ciliumValues := dict "cilium" $ciliumDict -}}
+  "cgroup" (dict "autoMount" (dict "enabled" false))) -}}
 {{- $_ := set $networkingComponents "cilium" (dict "values" $ciliumValues) -}}
 {{- end -}}
 {{include "cozystack.platform.package" (list "cozystack.networking" "kubeovn-cilium" $ $networkingComponents) }}
@@ -87,14 +83,10 @@
 {{- $kubeovnValues := dict "kube-ovn" $kubeovnDict -}}
 {{- $_ := set $networkingComponents "kubeovn" (dict "values" $kubeovnValues) -}}
 {{- /* Cilium configuration - for generic k8s, always enable cgroup autoMount */ -}}
-{{- $ciliumDict := dict
+{{- $ciliumValues := dict "cilium" (dict
  "k8sServiceHost" $apiHost
  "k8sServicePort" $apiPort
-  "cgroup" (dict "autoMount" (dict "enabled" true)) -}}
-{{- if .Values.gateway.gatewayAPI -}}
-{{- $_ := set $ciliumDict "gatewayAPI" (dict "enabled" true) -}}
-{{- end -}}
-{{- $ciliumValues := dict "cilium" $ciliumDict -}}
+  "cgroup" (dict "autoMount" (dict "enabled" true))) -}}
 {{- $_ := set $networkingComponents "cilium" (dict "values" $ciliumValues) -}}
 {{- end -}}
 {{- /* Use kubeovn-cilium-generic variant (no values-talos.yaml) */ -}}
@@ -126,15 +118,7 @@
 {{- end }}

 # Common Packages
-{{- $certManagerComponents := dict -}}
-{{- if .Values.gateway.gatewayAPI -}}
-{{- $certManagerValues := dict "cert-manager" (dict "config" (dict "enableGatewayAPI" true)) -}}
-{{- $_ := set $certManagerComponents "cert-manager" (dict "values" $certManagerValues) -}}
-{{- end -}}
-{{include "cozystack.platform.package" (list "cozystack.cert-manager" "default" $ $certManagerComponents) }}
-{{- if .Values.gateway.gatewayAPI }}
-{{include "cozystack.platform.package.default" (list "cozystack.cozystack-gateway" $) }}
-{{- end }}
+{{include "cozystack.platform.package.default" (list "cozystack.cert-manager" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.flux-plunger" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.victoria-metrics-operator" $) }}
 {{- $tenantComponents := dict -}}
@@ -164,17 +148,7 @@
 # Optional System Packages (controlled via bundles.enabledPackages)
 {{include "cozystack.platform.package.optional.default" (list "cozystack.nfs-driver" $) }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.telepresence" $) }}
-{{- $externalDnsComponents := dict -}}
-{{- if .Values.gateway.gatewayAPI -}}
-{{- $externalDnsValues := dict "external-dns" (dict "sources" (list "service" "ingress" "gateway-httproute")) -}}
-{{- $_ := set $externalDnsComponents "external-dns" (dict "values" $externalDnsValues) -}}
-{{- end -}}
-{{- $disabled := default (list) .Values.bundles.disabledPackages -}}
-{{- $enabled := default (list) .Values.bundles.enabledPackages -}}
-{{- if and (has "cozystack.external-dns" $enabled) (not (has "cozystack.external-dns" $disabled)) -}}
-{{include "cozystack.platform.package" (list "cozystack.external-dns" "default" $ $externalDnsComponents) }}
-{{- end }}
-{{include "cozystack.platform.package.optional.default" (list "cozystack.external-dns-application" $) }}
+{{include "cozystack.platform.package.optional.default" (list "cozystack.external-dns" $) }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.external-secrets-operator" $) }}
 {{- if has "cozystack.bootbox" (default (list) .Values.bundles.enabledPackages) }}
 {{include "cozystack.platform.package.default" (list "cozystack.bootbox-application" $) }}
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -5,8 +5,8 @@ sourceRef:
  path: /
 migrations:
  enabled: false
-  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.1.0@sha256:d7e8955c1ad8c8fbd4ce42b014c0f849d73d0c3faf0cedaac8e15d647fb2f663
-  targetVersion: 36
+  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.3@sha256:d43c6f26c65edd448f586a29969ff76718338f1f1f78b24d3ad54c6c8977c748
+  targetVersion: 34
 # Bundle deployment configuration
 bundles:
  system:
@@ -34,16 +34,6 @@ networking:
  # Set this to comma-separated list of master node IPs to override.
  kubeovn:
    MASTER_NODES: ""
-# Gateway configuration
-# ingress and gatewayAPI can be enabled independently;
-# future work will wire gateway.ingress into ingress controller selection
-gateway:
-  ingress: true
-  gatewayAPI: false
-  # Gateway name and namespace for system-level Gateway resource
-  # Components reference this Gateway via parentRefs
-  name: cozystack
-  namespace: cozy-gateway
 # Service publishing and ingress configuration
 publishing:
  host: "example.org"
@@ -53,15 +43,6 @@ publishing:
    - dashboard
    - vm-exportproxy
    - cdi-uploadproxy
-  # Hostname overrides for system services
-  # By default, hostname = {service-name}.{host}
-  # Override individual hostnames when the convention doesn't fit
-  #
-  # Example:
-  # hostnames:
-  #   keycloak: "auth.example.org"
-  #   dashboard: "panel.example.org"
-  hostnames: {}
  apiServerEndpoint: "" # example: "https://api.example.org"
  externalIPs: []
  certificates:
--- a/packages/core/testing/values.yaml
+++ b/packages/core/testing/values.yaml
@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.1.0@sha256:0eae9f519669667d60b160ebb93c127843c470ad9ca3447fceaa54604503a7ba
+  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.0.3@sha256:0eae9f519669667d60b160ebb93c127843c470ad9ca3447fceaa54604503a7ba
--- a/packages/extra/bootbox/images/matchbox.tag
+++ b/packages/extra/bootbox/images/matchbox.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/matchbox:v1.1.0@sha256:e4c872f6dadc2bbcb9200d04a1d9878f62502f74e979b4eae6c7203abc6d8fa6
+ghcr.io/cozystack/cozystack/matchbox:v1.0.3@sha256:c115bdaeea215cb0e528800f7ec3c284f4a77098619c28ed586ed3a79bb045d1
--- a/packages/extra/bootbox/templates/matchbox/httproute.yaml
+++ b/packages/extra/bootbox/templates/matchbox/httproute.yaml
@@ -1,75 +0,0 @@
-{{- $gatewayAPI := (index .Values._cluster "gateway-api") | default "false" }}
-{{- $clusterIssuer := (index .Values._cluster "issuer-name") | default "letsencrypt-prod" }}
-{{- $gateway := .Values._namespace.gateway | default "" }}
-{{- $host := .Values._namespace.host }}
-{{- $bootboxHost := printf "bootbox.%s" (.Values.host | default $host) }}
-
-{{- if and (eq $gatewayAPI "true") (ne $gateway "") }}
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  name: bootbox
-  annotations:
-    cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
-spec:
-  gatewayClassName: cilium
-  infrastructure:
-    labels:
-      cozystack.io/gateway: {{ $gateway }}
-  listeners:
-  - name: http
-    protocol: HTTP
-    port: 80
-    hostname: {{ $bootboxHost | quote }}
-    allowedRoutes:
-      namespaces:
-        from: Same
-  - name: https
-    protocol: HTTPS
-    port: 443
-    hostname: {{ $bootboxHost | quote }}
-    tls:
-      mode: Terminate
-      certificateRefs:
-      - name: bootbox-gateway-tls
-    allowedRoutes:
-      namespaces:
-        from: Same
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: bootbox-redirect-to-https
-spec:
-  parentRefs:
-  - name: bootbox
-    sectionName: http
-  hostnames:
-  - {{ $bootboxHost | quote }}
-  rules:
-  - filters:
-    - type: RequestRedirect
-      requestRedirect:
-        scheme: https
-        statusCode: 301
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: bootbox
-spec:
-  parentRefs:
-  - name: bootbox
-    sectionName: https
-  hostnames:
-  - {{ $bootboxHost | quote }}
-  rules:
-  - matches:
-    - path:
-        type: PathPrefix
-        value: /
-    backendRefs:
-    - name: bootbox
-      port: 8080
-{{- end }}
--- a/packages/extra/etcd/templates/etcd-cluster.yaml
+++ b/packages/extra/etcd/templates/etcd-cluster.yaml
@@ -104,7 +104,6 @@ spec:
      - {{ .Release.Name }}
  secretName: etcd-peer-ca-tls
  privateKey:
-    rotationPolicy: Never
    algorithm: RSA
    size: 4096
  issuerRef:
@@ -131,7 +130,6 @@ spec:
      - {{ .Release.Name }}
  secretName: etcd-ca-tls
  privateKey:
-    rotationPolicy: Never
    algorithm: RSA
    size: 4096
  issuerRef:
--- a/packages/extra/external-dns/Chart.yaml
+++ b/packages/extra/external-dns/Chart.yaml
@@ -1,6 +0,0 @@
-apiVersion: v2
-name: external-dns
-description: External DNS for automatic DNS record management
-icon: /logos/external-dns.svg
-type: application
-version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
--- a/packages/extra/external-dns/Makefile
+++ b/packages/extra/external-dns/Makefile
@@ -1,7 +0,0 @@
-NAME=external-dns
-
-include ../../../hack/package.mk
-
-generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
-	../../../hack/update-crd.sh
--- a/packages/extra/external-dns/README.md
+++ b/packages/extra/external-dns/README.md
@@ -1,88 +0,0 @@
-# External DNS
-
-## Parameters
-
-### Common parameters
-
-| Name               | Description                                                                        | Type       | Value         |
-| ------------------ | ---------------------------------------------------------------------------------- | ---------- | ------------- |
-| `provider`         | DNS provider name.                                                                 | `string`   | `{}`          |
-| `domainFilters`    | List of domains this external-dns instance can manage.                             | `[]string` | `[]`          |
-| `policy`           | How DNS records are synchronized.                                                  | `string`   | `upsert-only` |
-| `extraArgs`        | Extra arguments for external-dns.                                                  | `[]string` | `[]`          |
-| `gatewayAPI`       | Enable Gateway API HTTPRoute as a source for DNS records.                          | `bool`     | `false`       |
-| `annotationPrefix` | Custom annotation prefix for external-dns (useful for running multiple instances). | `string`   | `""`          |
-
-
-### Cloudflare
-
-| Name         | Description                      | Type     | Value                                                       |
-| ------------ | -------------------------------- | -------- | ----------------------------------------------------------- |
-| `cloudflare` | Cloudflare provider credentials. | `object` | `{"apiEmail":"","apiKey":"","apiToken":"","proxied":false}` |
-
-
-### AWS
-
-| Name  | Description                       | Type     | Value                                                               |
-| ----- | --------------------------------- | -------- | ------------------------------------------------------------------- |
-| `aws` | AWS Route53 provider credentials. | `object` | `{"accessKeyId":"","region":"","secretAccessKey":"","zoneType":""}` |
-
-
-### Azure
-
-| Name    | Description                     | Type     | Value                                                                                          |
-| ------- | ------------------------------- | -------- | ---------------------------------------------------------------------------------------------- |
-| `azure` | Azure DNS provider credentials. | `object` | `{"aadClientId":"","aadClientSecret":"","resourceGroup":"","subscriptionId":"","tenantId":""}` |
-
-
-### Google
-
-| Name     | Description                            | Type     | Value                                   |
-| -------- | -------------------------------------- | -------- | --------------------------------------- |
-| `google` | Google Cloud DNS provider credentials. | `object` | `{"project":"","serviceAccountKey":""}` |
-
-
-### DigitalOcean
-
-| Name           | Description                            | Type     | Value          |
-| -------------- | -------------------------------------- | -------- | -------------- |
-| `digitalocean` | DigitalOcean DNS provider credentials. | `object` | `{"token":""}` |
-
-
-### Linode
-
-| Name     | Description                      | Type     | Value          |
-| -------- | -------------------------------- | -------- | -------------- |
-| `linode` | Linode DNS provider credentials. | `object` | `{"token":""}` |
-
-
-### OVH
-
-| Name  | Description                   | Type     | Value                                                                         |
-| ----- | ----------------------------- | -------- | ----------------------------------------------------------------------------- |
-| `ovh` | OVH DNS provider credentials. | `object` | `{"applicationKey":"","applicationSecret":"","consumerKey":"","endpoint":""}` |
-
-
-### Exoscale
-
-| Name       | Description                        | Type     | Value                          |
-| ---------- | ---------------------------------- | -------- | ------------------------------ |
-| `exoscale` | Exoscale DNS provider credentials. | `object` | `{"apiKey":"","apiSecret":""}` |
-
-
-### GoDaddy
-
-| Name      | Description                       | Type     | Value                          |
-| --------- | --------------------------------- | -------- | ------------------------------ |
-| `godaddy` | GoDaddy DNS provider credentials. | `object` | `{"apiKey":"","apiSecret":""}` |
-
-
-### Resources
-
-| Name               | Description                                                                                              | Type       | Value  |
-| ------------------ | -------------------------------------------------------------------------------------------------------- | ---------- | ------ |
-| `resources`        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`   | `{}`   |
-| `resources.cpu`    | CPU available to each replica.                                                                           | `quantity` | `""`   |
-| `resources.memory` | Memory (RAM) available to each replica.                                                                  | `quantity` | `""`   |
-| `resourcesPreset`  | Default sizing preset used when `resources` is omitted.                                                  | `string`   | `nano` |
-
--- a/packages/extra/external-dns/charts/cozy-lib
+++ b/packages/extra/external-dns/charts/cozy-lib
@@ -1 +0,0 @@
-../../../library/cozy-lib
--- a/packages/extra/external-dns/config.json
+++ b/packages/extra/external-dns/config.json
@@ -1,23 +0,0 @@
-{
-  "comments": {
-    "format": "##"
-  },
-  "tags": {
-    "param": "@param",
-    "section": "@section",
-    "descriptionStart": "@descriptionStart",
-    "descriptionEnd": "@descriptionEnd",
-    "skip": "@skip",
-    "extra": "@extra"
-  },
-  "modifiers": {
-    "array": "array",
-    "object": "object",
-    "string": "string",
-    "nullable": "nullable",
-    "default": "default"
-  },
-  "regexp": {
-    "paramsSectionTitle": "Parameters"
-  }
-}
--- a/packages/extra/external-dns/logos/external-dns.svg
+++ b/packages/extra/external-dns/logos/external-dns.svg
@@ -1,20 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 144 144" width="144" height="144">
-  <defs>
-    <linearGradient id="bg" x1="0%" y1="0%" x2="100%" y2="100%">
-      <stop offset="0%" style="stop-color:#3B82F6"/>
-      <stop offset="100%" style="stop-color:#1D4ED8"/>
-    </linearGradient>
-  </defs>
-  <rect width="144" height="144" rx="28" fill="url(#bg)"/>
-  <g transform="translate(72,72)" fill="none" stroke="#fff" stroke-width="4" stroke-linecap="round" stroke-linejoin="round">
-    <!-- Globe -->
-    <circle cx="0" cy="-4" r="32"/>
-    <ellipse cx="0" cy="-4" rx="14" ry="32"/>
-    <line x1="-32" y1="-4" x2="32" y2="-4"/>
-    <path d="M-28,12 Q0,18 28,12"/>
-    <path d="M-28,-20 Q0,-14 28,-20"/>
-    <!-- Arrow pointing out -->
-    <line x1="18" y1="18" x2="36" y2="36"/>
-    <polyline points="28,36 36,36 36,28"/>
-  </g>
-</svg>
--- a/packages/extra/external-dns/templates/dashboard-resourcemap.yaml
+++ b/packages/extra/external-dns/templates/dashboard-resourcemap.yaml
@@ -1,23 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ .Release.Name }}-dashboard-resources
-rules:
- apiGroups:
-  - helm.toolkit.fluxcd.io
-  resources:
-  - helmreleases
-  resourceNames:
-  - {{ .Release.Name }}
-  verbs: ["get", "list", "watch"]
---
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ .Release.Name }}-dashboard-resources
-subjects:
-{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "admin" .Release.Namespace) }}
-roleRef:
-  kind: Role
-  name: {{ .Release.Name }}-dashboard-resources
-  apiGroup: rbac.authorization.k8s.io
--- a/packages/extra/external-dns/templates/external-dns.yaml
+++ b/packages/extra/external-dns/templates/external-dns.yaml
@@ -1,169 +0,0 @@
-{{- if not .Values.provider }}
-{{- fail "provider is required: set it to one of cloudflare, aws, azure, google, digitalocean, linode, ovh, exoscale, godaddy, inmemory" }}
-{{- end }}
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: {{ .Release.Name }}-system
-  labels:
-    app.kubernetes.io/instance: {{ .Release.Name }}-system
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
-spec:
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-external-dns-application-default-external-dns-system
-    namespace: cozy-system
-  interval: 5m
-  timeout: 10m
-  install:
-    remediation:
-      retries: -1
-  upgrade:
-    force: true
-    remediation:
-      retries: -1
-  values:
-    external-dns:
-      namespaced: true
-      txtOwnerId: {{ .Release.Namespace | quote }}
-      policy: {{ .Values.policy | quote }}
-      {{- if .Values.annotationPrefix }}
-      annotationPrefix: {{ .Values.annotationPrefix | quote }}
-      {{- end }}
-      provider:
-        name: {{ .Values.provider | quote }}
-      sources:
-        - ingress
-        - service
-        {{- if .Values.gatewayAPI }}
-        - gateway-httproute
-        {{- end }}
-      {{- with .Values.domainFilters }}
-      domainFilters:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-
-      {{- /* Provider-specific credentials and config */}}
-
-      {{- if eq .Values.provider "cloudflare" }}
-      {{- if or .Values.cloudflare.apiToken (and .Values.cloudflare.apiKey .Values.cloudflare.apiEmail) }}
-      env:
-        {{- if .Values.cloudflare.apiToken }}
-        - name: CF_API_TOKEN
-          value: {{ .Values.cloudflare.apiToken | quote }}
-        {{- else }}
-        - name: CF_API_KEY
-          value: {{ .Values.cloudflare.apiKey | quote }}
-        - name: CF_API_EMAIL
-          value: {{ .Values.cloudflare.apiEmail | quote }}
-        {{- end }}
-      {{- end }}
-      {{- if .Values.cloudflare.proxied }}
-      cloudflare:
-        proxied: true
-      {{- end }}
-      {{- end }}
-
-      {{- if eq .Values.provider "aws" }}
-      {{- if or .Values.aws.accessKeyId .Values.aws.secretAccessKey .Values.aws.region }}
-      env:
-        {{- if .Values.aws.accessKeyId }}
-        - name: AWS_ACCESS_KEY_ID
-          value: {{ .Values.aws.accessKeyId | quote }}
-        {{- end }}
-        {{- if .Values.aws.secretAccessKey }}
-        - name: AWS_SECRET_ACCESS_KEY
-          value: {{ .Values.aws.secretAccessKey | quote }}
-        {{- end }}
-        {{- if .Values.aws.region }}
-        - name: AWS_DEFAULT_REGION
-          value: {{ .Values.aws.region | quote }}
-        {{- end }}
-      {{- end }}
-      {{- if .Values.aws.zoneType }}
-      aws:
-        zoneType: {{ .Values.aws.zoneType | quote }}
-      {{- end }}
-      {{- end }}
-
-      {{- if eq .Values.provider "azure" }}
-      {{- if or .Values.azure.tenantId .Values.azure.subscriptionId .Values.azure.resourceGroup .Values.azure.aadClientId .Values.azure.aadClientSecret }}
-      azure:
-        tenantId: {{ .Values.azure.tenantId | quote }}
-        subscriptionId: {{ .Values.azure.subscriptionId | quote }}
-        resourceGroup: {{ .Values.azure.resourceGroup | quote }}
-        aadClientId: {{ .Values.azure.aadClientId | quote }}
-        aadClientSecret: {{ .Values.azure.aadClientSecret | quote }}
-      {{- end }}
-      {{- end }}
-
-      {{- if eq .Values.provider "digitalocean" }}
-      {{- if .Values.digitalocean.token }}
-      env:
-        - name: DO_TOKEN
-          value: {{ .Values.digitalocean.token | quote }}
-      {{- end }}
-      {{- end }}
-
-      {{- if eq .Values.provider "google" }}
-      {{- if or .Values.google.project .Values.google.serviceAccountKey }}
-      google:
-        project: {{ .Values.google.project | quote }}
-        {{- if .Values.google.serviceAccountKey }}
-        serviceAccountKey: {{ .Values.google.serviceAccountKey | quote }}
-        {{- end }}
-      {{- end }}
-      {{- end }}
-
-      {{- if eq .Values.provider "linode" }}
-      {{- if .Values.linode.token }}
-      env:
-        - name: LINODE_TOKEN
-          value: {{ .Values.linode.token | quote }}
-      {{- end }}
-      {{- end }}
-
-      {{- if eq .Values.provider "ovh" }}
-      {{- if or .Values.ovh.endpoint .Values.ovh.applicationKey .Values.ovh.applicationSecret .Values.ovh.consumerKey }}
-      env:
-        - name: OVH_ENDPOINT
-          value: {{ .Values.ovh.endpoint | quote }}
-        - name: OVH_APPLICATION_KEY
-          value: {{ .Values.ovh.applicationKey | quote }}
-        - name: OVH_APPLICATION_SECRET
-          value: {{ .Values.ovh.applicationSecret | quote }}
-        - name: OVH_CONSUMER_KEY
-          value: {{ .Values.ovh.consumerKey | quote }}
-      {{- end }}
-      {{- end }}
-
-      {{- if eq .Values.provider "exoscale" }}
-      {{- if or .Values.exoscale.apiKey .Values.exoscale.apiSecret }}
-      env:
-        - name: EXOSCALE_API_KEY
-          value: {{ .Values.exoscale.apiKey | quote }}
-        - name: EXOSCALE_API_SECRET
-          value: {{ .Values.exoscale.apiSecret | quote }}
-      {{- end }}
-      {{- end }}
-
-      {{- /* extraArgs: merge user-supplied args with provider-specific args (godaddy) */}}
-      {{- $godaddyArgs := list }}
-      {{- if eq .Values.provider "godaddy" }}
-        {{- if .Values.godaddy.apiKey }}
-          {{- $godaddyArgs = append $godaddyArgs (printf "--godaddy-api-key=%s" .Values.godaddy.apiKey) }}
-        {{- end }}
-        {{- if .Values.godaddy.apiSecret }}
-          {{- $godaddyArgs = append $godaddyArgs (printf "--godaddy-api-secret=%s" .Values.godaddy.apiSecret) }}
-        {{- end }}
-      {{- end }}
-      {{- $allArgs := concat (.Values.extraArgs | default list) $godaddyArgs }}
-      {{- with $allArgs }}
-      extraArgs:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-
-      {{- with (include "cozy-lib.resources.defaultingSanitize" (list .Values.resourcesPreset .Values.resources $)) }}
-      resources:
-        {{- . | nindent 8 }}
-      {{- end }}
--- a/packages/extra/external-dns/values.schema.json
+++ b/packages/extra/external-dns/values.schema.json
@@ -1,193 +0,0 @@
-{
-  "title": "Chart Values",
-  "type": "object",
-  "properties": {
-    "annotationPrefix": {
-      "description": "Custom annotation prefix for external-dns (useful for running multiple instances).",
-      "type": "string",
-      "default": ""
-    },
-    "aws": {
-      "description": "AWS Route53 provider credentials.",
-      "type": "object",
-      "default": {
-        "accessKeyId": "",
-        "region": "",
-        "secretAccessKey": "",
-        "zoneType": ""
-      },
-      "x-kubernetes-preserve-unknown-fields": true
-    },
-    "azure": {
-      "description": "Azure DNS provider credentials.",
-      "type": "object",
-      "default": {
-        "aadClientId": "",
-        "aadClientSecret": "",
-        "resourceGroup": "",
-        "subscriptionId": "",
-        "tenantId": ""
-      },
-      "x-kubernetes-preserve-unknown-fields": true
-    },
-    "cloudflare": {
-      "description": "Cloudflare provider credentials.",
-      "type": "object",
-      "default": {
-        "apiEmail": "",
-        "apiKey": "",
-        "apiToken": "",
-        "proxied": false
-      },
-      "x-kubernetes-preserve-unknown-fields": true
-    },
-    "digitalocean": {
-      "description": "DigitalOcean DNS provider credentials.",
-      "type": "object",
-      "default": {
-        "token": ""
-      },
-      "x-kubernetes-preserve-unknown-fields": true
-    },
-    "domainFilters": {
-      "description": "List of domains this external-dns instance can manage.",
-      "type": "array",
-      "default": [],
-      "items": {
-        "type": "string"
-      }
-    },
-    "exoscale": {
-      "description": "Exoscale DNS provider credentials.",
-      "type": "object",
-      "default": {
-        "apiKey": "",
-        "apiSecret": ""
-      },
-      "x-kubernetes-preserve-unknown-fields": true
-    },
-    "extraArgs": {
-      "description": "Extra arguments for external-dns.",
-      "type": "array",
-      "default": [],
-      "items": {
-        "type": "string"
-      }
-    },
-    "gatewayAPI": {
-      "description": "Enable Gateway API HTTPRoute as a source for DNS records.",
-      "type": "boolean",
-      "default": false
-    },
-    "godaddy": {
-      "description": "GoDaddy DNS provider credentials.",
-      "type": "object",
-      "default": {
-        "apiKey": "",
-        "apiSecret": ""
-      },
-      "x-kubernetes-preserve-unknown-fields": true
-    },
-    "google": {
-      "description": "Google Cloud DNS provider credentials.",
-      "type": "object",
-      "default": {
-        "project": "",
-        "serviceAccountKey": ""
-      },
-      "x-kubernetes-preserve-unknown-fields": true
-    },
-    "linode": {
-      "description": "Linode DNS provider credentials.",
-      "type": "object",
-      "default": {
-        "token": ""
-      },
-      "x-kubernetes-preserve-unknown-fields": true
-    },
-    "ovh": {
-      "description": "OVH DNS provider credentials.",
-      "type": "object",
-      "default": {
-        "applicationKey": "",
-        "applicationSecret": "",
-        "consumerKey": "",
-        "endpoint": ""
-      },
-      "x-kubernetes-preserve-unknown-fields": true
-    },
-    "policy": {
-      "description": "How DNS records are synchronized.",
-      "type": "string",
-      "default": "upsert-only",
-      "enum": [
-        "create-only",
-        "sync",
-        "upsert-only"
-      ]
-    },
-    "provider": {
-      "description": "DNS provider name.",
-      "type": "string",
-      "enum": [
-        "cloudflare",
-        "aws",
-        "azure",
-        "google",
-        "digitalocean",
-        "linode",
-        "ovh",
-        "exoscale",
-        "godaddy",
-        "inmemory"
-      ]
-    },
-    "resources": {
-      "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
-      "type": "object",
-      "default": {},
-      "properties": {
-        "cpu": {
-          "description": "CPU available to each replica.",
-          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "string"
-            }
-          ],
-          "x-kubernetes-int-or-string": true
-        },
-        "memory": {
-          "description": "Memory (RAM) available to each replica.",
-          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "string"
-            }
-          ],
-          "x-kubernetes-int-or-string": true
-        }
-      }
-    },
-    "resourcesPreset": {
-      "description": "Default sizing preset used when `resources` is omitted.",
-      "type": "string",
-      "default": "nano",
-      "enum": [
-        "nano",
-        "micro",
-        "small",
-        "medium",
-        "large",
-        "xlarge",
-        "2xlarge"
-      ]
-    }
-  }
-}
--- a/packages/extra/external-dns/values.yaml
+++ b/packages/extra/external-dns/values.yaml
@@ -1,149 +0,0 @@
-##
-## @section Common parameters
-##
-
-## @enum {string} Provider - DNS provider.
-## @value cloudflare
-## @value aws
-## @value azure
-## @value google
-## @value digitalocean
-## @value linode
-## @value ovh
-## @value exoscale
-## @value godaddy
-## @value inmemory
-
-## @param {Provider} provider - DNS provider name.
-# provider:
-
-## @param {[]string} domainFilters - List of domains this external-dns instance can manage.
-domainFilters: []
-
-## @enum {string} Policy - How DNS records are synchronized.
-## @value create-only
-## @value sync
-## @value upsert-only
-
-## @param {Policy} policy="upsert-only" - How DNS records are synchronized.
-policy: "upsert-only"
-
-## @param {[]string} extraArgs - Extra arguments for external-dns.
-extraArgs: []
-
-## @param {bool} gatewayAPI=false - Enable Gateway API HTTPRoute as a source for DNS records.
-gatewayAPI: false
-
-## @param {string} [annotationPrefix] - Custom annotation prefix for external-dns (useful for running multiple instances).
-annotationPrefix: ""
-
-##
-## @section Cloudflare
-##
-
-## @param {object} cloudflare - Cloudflare provider credentials.
-cloudflare:
-  apiToken: ""
-  apiKey: ""
-  apiEmail: ""
-  proxied: false
-
-##
-## @section AWS
-##
-
-## @param {object} aws - AWS Route53 provider credentials.
-aws:
-  accessKeyId: ""
-  secretAccessKey: ""
-  region: ""
-  zoneType: ""
-
-##
-## @section Azure
-##
-
-## @param {object} azure - Azure DNS provider credentials.
-azure:
-  tenantId: ""
-  subscriptionId: ""
-  resourceGroup: ""
-  aadClientId: ""
-  aadClientSecret: ""
-
-##
-## @section Google
-##
-
-## @param {object} google - Google Cloud DNS provider credentials.
-google:
-  project: ""
-  serviceAccountKey: ""
-
-##
-## @section DigitalOcean
-##
-
-## @param {object} digitalocean - DigitalOcean DNS provider credentials.
-digitalocean:
-  token: ""
-
-##
-## @section Linode
-##
-
-## @param {object} linode - Linode DNS provider credentials.
-linode:
-  token: ""
-
-##
-## @section OVH
-##
-
-## @param {object} ovh - OVH DNS provider credentials.
-ovh:
-  endpoint: ""
-  applicationKey: ""
-  applicationSecret: ""
-  consumerKey: ""
-
-##
-## @section Exoscale
-##
-
-## @param {object} exoscale - Exoscale DNS provider credentials.
-exoscale:
-  apiKey: ""
-  apiSecret: ""
-
-##
-## @section GoDaddy
-##
-
-## @param {object} godaddy - GoDaddy DNS provider credentials.
-godaddy:
-  apiKey: ""
-  apiSecret: ""
-
-##
-## @section Resources
-##
-
-## @typedef {struct} Resources - Explicit CPU and memory configuration.
-## @field {quantity} [cpu] - CPU available to each replica.
-## @field {quantity} [memory] - Memory (RAM) available to each replica.
-
-## @enum {string} ResourcesPreset - Default sizing preset.
-## @value nano
-## @value micro
-## @value small
-## @value medium
-## @value large
-## @value xlarge
-## @value 2xlarge
-
-## @param {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
-resources: {}
-
-## @param {ResourcesPreset} resourcesPreset="nano" - Default sizing preset used when `resources` is omitted.
-resourcesPreset: "nano"
--- a/packages/extra/monitoring/templates/dashboard-resourcemap.yaml
+++ b/packages/extra/monitoring/templates/dashboard-resourcemap.yaml
@@ -42,9 +42,7 @@ rules:
  - {{ .name }}-vminsert
  {{- end }}
  {{- range .Values.logsStorages }}
-  - {{ .name }}-vlstorage
-  - {{ .name }}-vlselect
-  - {{ .name }}-vlinsert
+  - {{ $.Release.Name }}-vlogs-{{ .name }}
  {{- end }}
  {{- range .Values.metricsStorages }}
  - vmalert-{{ .name }}
--- a/packages/extra/monitoring/templates/workloadmonitors.yaml
+++ b/packages/extra/monitoring/templates/workloadmonitors.yaml
@@ -67,46 +67,16 @@ spec:
 apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
-  name: {{ .name }}-vlstorage
+  name: vlogs-{{ .name }}
 spec:
-  replicas: 2
+  replicas: 1
  minReplicas: 1
  kind: monitoring
-  type: vlstorage
+  type: vlogs
  selector:
    app.kubernetes.io/component: monitoring
    app.kubernetes.io/instance: {{ .name }}
-    app.kubernetes.io/name: vlstorage
-  version: {{ $.Chart.Version }}
---
-apiVersion: cozystack.io/v1alpha1
-kind: WorkloadMonitor
-metadata:
-  name: {{ .name }}-vlselect
-spec:
-  replicas: 2
-  minReplicas: 1
-  kind: monitoring
-  type: vlselect
-  selector:
-    app.kubernetes.io/component: monitoring
-    app.kubernetes.io/instance: {{ .name }}
-    app.kubernetes.io/name: vlselect
-  version: {{ $.Chart.Version }}
---
-apiVersion: cozystack.io/v1alpha1
-kind: WorkloadMonitor
-metadata:
-  name: {{ .name }}-vlinsert
-spec:
-  replicas: 2
-  minReplicas: 1
-  kind: monitoring
-  type: vlinsert
-  selector:
-    app.kubernetes.io/component: monitoring
-    app.kubernetes.io/instance: {{ .name }}
-    app.kubernetes.io/name: vlinsert
+    app.kubernetes.io/name: vlogs
  version: {{ $.Chart.Version }}
 {{- end }}
 ---
--- a/packages/extra/seaweedfs/README.md
+++ b/packages/extra/seaweedfs/README.md
@@ -1,4 +1,4 @@
-# Managed SeaweedFS Service
+# Managed NATS Service

 ## Parameters

@@ -13,68 +13,46 @@

 ### SeaweedFS Components Configuration

-| Name                                              | Description                                                                                                   | Type                | Value   |
-| ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ------------------- | ------- |
-| `db`                                              | Database configuration.                                                                                       | `object`            | `{}`    |
-| `db.replicas`                                     | Number of database replicas.                                                                                  | `int`               | `2`     |
-| `db.size`                                         | Persistent Volume size.                                                                                       | `quantity`          | `10Gi`  |
-| `db.storageClass`                                 | StorageClass used to store the data.                                                                          | `string`            | `""`    |
-| `db.resources`                                    | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.      | `object`            | `{}`    |
-| `db.resources.cpu`                                | Number of CPU cores allocated.                                                                                | `quantity`          | `""`    |
-| `db.resources.memory`                             | Amount of memory allocated.                                                                                   | `quantity`          | `""`    |
-| `db.resourcesPreset`                              | Default sizing preset used when `resources` is omitted.                                                       | `string`            | `small` |
-| `master`                                          | Master service configuration.                                                                                 | `object`            | `{}`    |
-| `master.replicas`                                 | Number of master replicas.                                                                                    | `int`               | `3`     |
-| `master.resources`                                | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.      | `object`            | `{}`    |
-| `master.resources.cpu`                            | Number of CPU cores allocated.                                                                                | `quantity`          | `""`    |
-| `master.resources.memory`                         | Amount of memory allocated.                                                                                   | `quantity`          | `""`    |
-| `master.resourcesPreset`                          | Default sizing preset used when `resources` is omitted.                                                       | `string`            | `small` |
-| `filer`                                           | Filer service configuration.                                                                                  | `object`            | `{}`    |
-| `filer.replicas`                                  | Number of filer replicas.                                                                                     | `int`               | `2`     |
-| `filer.resources`                                 | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.      | `object`            | `{}`    |
-| `filer.resources.cpu`                             | Number of CPU cores allocated.                                                                                | `quantity`          | `""`    |
-| `filer.resources.memory`                          | Amount of memory allocated.                                                                                   | `quantity`          | `""`    |
-| `filer.resourcesPreset`                           | Default sizing preset used when `resources` is omitted.                                                       | `string`            | `small` |
-| `filer.grpcHost`                                  | The hostname used to expose or access the filer service externally.                                           | `string`            | `""`    |
-| `filer.grpcPort`                                  | The port used to access the filer service externally.                                                         | `int`               | `443`   |
-| `filer.whitelist`                                 | A list of IP addresses or CIDR ranges that are allowed to access the filer service.                           | `[]string`          | `[]`    |
-| `volume`                                          | Volume service configuration.                                                                                 | `object`            | `{}`    |
-| `volume.replicas`                                 | Number of volume replicas.                                                                                    | `int`               | `2`     |
-| `volume.size`                                     | Persistent Volume size.                                                                                       | `quantity`          | `10Gi`  |
-| `volume.storageClass`                             | StorageClass used to store the data.                                                                          | `string`            | `""`    |
-| `volume.diskType`                                 | SeaweedFS disk type tag for the default volume servers (e.g., "hdd", "ssd").                                  | `string`            | `""`    |
-| `volume.resources`                                | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.      | `object`            | `{}`    |
-| `volume.resources.cpu`                            | Number of CPU cores allocated.                                                                                | `quantity`          | `""`    |
-| `volume.resources.memory`                         | Amount of memory allocated.                                                                                   | `quantity`          | `""`    |
-| `volume.resourcesPreset`                          | Default sizing preset used when `resources` is omitted.                                                       | `string`            | `small` |
-| `volume.zones`                                    | A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.                | `map[string]object` | `{}`    |
-| `volume.zones[name].replicas`                     | Number of replicas in the zone.                                                                               | `int`               | `0`     |
-| `volume.zones[name].size`                         | Zone storage size.                                                                                            | `quantity`          | `""`    |
-| `volume.zones[name].dataCenter`                   | SeaweedFS data center name for this zone. Defaults to the zone name.                                          | `string`            | `""`    |
-| `volume.zones[name].nodeSelector`                 | YAML nodeSelector for this zone (default: topology.kubernetes.io/zone: <zoneName>).                           | `string`            | `""`    |
-| `volume.zones[name].storageClass`                 | StorageClass used to store zone data. Defaults to volume.storageClass.                                        | `string`            | `""`    |
-| `volume.zones[name].pools`                        | A map of storage pools for this zone. Each pool creates a separate Volume StatefulSet per zone.               | `map[string]object` | `{}`    |
-| `volume.zones[name].pools[name].diskType`         | SeaweedFS disk type tag (e.g., "ssd", "hdd", "nvme").                                                         | `string`            | `""`    |
-| `volume.zones[name].pools[name].replicas`         | Number of volume replicas. Defaults to volume.replicas (Simple) or zone.replicas/volume.replicas (MultiZone). | `int`               | `0`     |
-| `volume.zones[name].pools[name].size`             | Persistent Volume size. Defaults to volume.size (Simple) or zone.size/volume.size (MultiZone).                | `quantity`          | `""`    |
-| `volume.zones[name].pools[name].storageClass`     | Kubernetes StorageClass for the pool. Defaults to volume.storageClass.                                        | `string`            | `""`    |
-| `volume.zones[name].pools[name].resources`        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.      | `object`            | `{}`    |
-| `volume.zones[name].pools[name].resources.cpu`    | Number of CPU cores allocated.                                                                                | `quantity`          | `""`    |
-| `volume.zones[name].pools[name].resources.memory` | Amount of memory allocated.                                                                                   | `quantity`          | `""`    |
-| `volume.zones[name].pools[name].resourcesPreset`  | Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.                   | `string`            | `{}`    |
-| `volume.pools`                                    | A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.               | `map[string]object` | `{}`    |
-| `volume.pools[name].diskType`                     | SeaweedFS disk type tag (e.g., "ssd", "hdd", "nvme").                                                         | `string`            | `""`    |
-| `volume.pools[name].replicas`                     | Number of volume replicas. Defaults to volume.replicas (Simple) or zone.replicas/volume.replicas (MultiZone). | `int`               | `0`     |
-| `volume.pools[name].size`                         | Persistent Volume size. Defaults to volume.size (Simple) or zone.size/volume.size (MultiZone).                | `quantity`          | `""`    |
-| `volume.pools[name].storageClass`                 | Kubernetes StorageClass for the pool. Defaults to volume.storageClass.                                        | `string`            | `""`    |
-| `volume.pools[name].resources`                    | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.      | `object`            | `{}`    |
-| `volume.pools[name].resources.cpu`                | Number of CPU cores allocated.                                                                                | `quantity`          | `""`    |
-| `volume.pools[name].resources.memory`             | Amount of memory allocated.                                                                                   | `quantity`          | `""`    |
-| `volume.pools[name].resourcesPreset`              | Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.                   | `string`            | `{}`    |
-| `s3`                                              | S3 service configuration.                                                                                     | `object`            | `{}`    |
-| `s3.replicas`                                     | Number of S3 replicas.                                                                                        | `int`               | `2`     |
-| `s3.resources`                                    | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.      | `object`            | `{}`    |
-| `s3.resources.cpu`                                | Number of CPU cores allocated.                                                                                | `quantity`          | `""`    |
-| `s3.resources.memory`                             | Amount of memory allocated.                                                                                   | `quantity`          | `""`    |
-| `s3.resourcesPreset`                              | Default sizing preset used when `resources` is omitted.                                                       | `string`            | `small` |
+| Name                          | Description                                                                                              | Type                | Value   |
+| ----------------------------- | -------------------------------------------------------------------------------------------------------- | ------------------- | ------- |
+| `db`                          | Database configuration.                                                                                  | `object`            | `{}`    |
+| `db.replicas`                 | Number of database replicas.                                                                             | `int`               | `2`     |
+| `db.size`                     | Persistent Volume size.                                                                                  | `quantity`          | `10Gi`  |
+| `db.storageClass`             | StorageClass used to store the data.                                                                     | `string`            | `""`    |
+| `db.resources`                | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
+| `db.resources.cpu`            | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
+| `db.resources.memory`         | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
+| `db.resourcesPreset`          | Default sizing preset used when `resources` is omitted.                                                  | `string`            | `small` |
+| `master`                      | Master service configuration.                                                                            | `object`            | `{}`    |
+| `master.replicas`             | Number of master replicas.                                                                               | `int`               | `3`     |
+| `master.resources`            | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
+| `master.resources.cpu`        | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
+| `master.resources.memory`     | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
+| `master.resourcesPreset`      | Default sizing preset used when `resources` is omitted.                                                  | `string`            | `small` |
+| `filer`                       | Filer service configuration.                                                                             | `object`            | `{}`    |
+| `filer.replicas`              | Number of filer replicas.                                                                                | `int`               | `2`     |
+| `filer.resources`             | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
+| `filer.resources.cpu`         | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
+| `filer.resources.memory`      | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
+| `filer.resourcesPreset`       | Default sizing preset used when `resources` is omitted.                                                  | `string`            | `small` |
+| `filer.grpcHost`              | The hostname used to expose or access the filer service externally.                                      | `string`            | `""`    |
+| `filer.grpcPort`              | The port used to access the filer service externally.                                                    | `int`               | `443`   |
+| `filer.whitelist`             | A list of IP addresses or CIDR ranges that are allowed to access the filer service.                      | `[]string`          | `[]`    |
+| `volume`                      | Volume service configuration.                                                                            | `object`            | `{}`    |
+| `volume.replicas`             | Number of volume replicas.                                                                               | `int`               | `2`     |
+| `volume.size`                 | Persistent Volume size.                                                                                  | `quantity`          | `10Gi`  |
+| `volume.storageClass`         | StorageClass used to store the data.                                                                     | `string`            | `""`    |
+| `volume.resources`            | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
+| `volume.resources.cpu`        | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
+| `volume.resources.memory`     | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
+| `volume.resourcesPreset`      | Default sizing preset used when `resources` is omitted.                                                  | `string`            | `small` |
+| `volume.zones`                | A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.           | `map[string]object` | `{}`    |
+| `volume.zones[name].replicas` | Number of replicas in the zone.                                                                          | `int`               | `0`     |
+| `volume.zones[name].size`     | Zone storage size.                                                                                       | `quantity`          | `""`    |
+| `s3`                          | S3 service configuration.                                                                                | `object`            | `{}`    |
+| `s3.replicas`                 | Number of S3 replicas.                                                                                   | `int`               | `2`     |
+| `s3.resources`                | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`            | `{}`    |
+| `s3.resources.cpu`            | Number of CPU cores allocated.                                                                           | `quantity`          | `""`    |
+| `s3.resources.memory`         | Amount of memory allocated.                                                                              | `quantity`          | `""`    |
+| `s3.resourcesPreset`          | Default sizing preset used when `resources` is omitted.                                                  | `string`            | `small` |

--- a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
+++ b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.1.0@sha256:2a3595cd88b30af55b2000d3ca204899beecef0012b0e0402754c3914aad1f7f
+ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.0.3@sha256:2a3595cd88b30af55b2000d3ca204899beecef0012b0e0402754c3914aad1f7f
--- a/packages/extra/seaweedfs/images/seaweedfs-cosi-driver.tag
+++ b/packages/extra/seaweedfs/images/seaweedfs-cosi-driver.tag
@@ -1 +1 @@
-ghcr.io/seaweedfs/seaweedfs-cosi-driver:v0.3.0
+ghcr.io/seaweedfs/seaweedfs-cosi-driver:v0.2.0
--- a/packages/extra/seaweedfs/templates/client/cosi-bucket-class.yaml
+++ b/packages/extra/seaweedfs/templates/client/cosi-bucket-class.yaml
@@ -7,32 +7,10 @@ metadata:
 driverName: {{ .Release.Namespace }}.seaweedfs.objectstorage.k8s.io
 deletionPolicy: Delete
 ---
-kind: BucketClass
-apiVersion: objectstorage.k8s.io/v1alpha1
-metadata:
-  name: {{ .Release.Namespace }}-lock
-driverName: {{ .Release.Namespace }}.seaweedfs.objectstorage.k8s.io
-deletionPolicy: Retain
-parameters:
-  objectLockEnabled: "true"
-  objectLockRetentionMode: "COMPLIANCE"
-  objectLockRetentionDays: "365"
---
 kind: BucketAccessClass
 apiVersion: objectstorage.k8s.io/v1alpha1
 metadata:
  name: {{ .Release.Namespace }}
 driverName: {{ .Release.Namespace }}.seaweedfs.objectstorage.k8s.io
 authenticationType: KEY
-parameters:
-  accessPolicy: readwrite
---
-kind: BucketAccessClass
-apiVersion: objectstorage.k8s.io/v1alpha1
-metadata:
-  name: {{ .Release.Namespace }}-readonly
-driverName: {{ .Release.Namespace }}.seaweedfs.objectstorage.k8s.io
-authenticationType: KEY
-parameters:
-  accessPolicy: readonly
 {{- end }}
--- a/packages/extra/seaweedfs/templates/dashboard-resourcemap.yaml
+++ b/packages/extra/seaweedfs/templates/dashboard-resourcemap.yaml
@@ -25,21 +25,8 @@ rules:
  resourceNames:
  - {{ $.Release.Name }}-master
  - {{ $.Release.Name }}-filer
-  - {{ $.Release.Name }}-db
-  - {{ $.Release.Name }}-s3
-  {{- if eq .Values.topology "Simple" }}
  - {{ $.Release.Name }}-volume
-  {{- range $poolName, $pool := .Values.volume.pools }}
-  - {{ $.Release.Name }}-volume-{{ $poolName }}
-  {{- end }}
-  {{- else if eq .Values.topology "MultiZone" }}
-  {{- range $zoneName, $zone := .Values.volume.zones }}
-  - {{ $.Release.Name }}-volume-{{ $zoneName }}
-  {{- range $poolName, $pool := (dig "pools" dict $zone) }}
-  - {{ $.Release.Name }}-volume-{{ $zoneName }}-{{ $poolName }}
-  {{- end }}
-  {{- end }}
-  {{- end }}
+  - {{ $.Release.Name }}-db
  verbs: ["get", "list", "watch"]
 {{- end }}

--- a/packages/extra/seaweedfs/templates/seaweedfs.yaml
+++ b/packages/extra/seaweedfs/templates/seaweedfs.yaml
@@ -16,65 +16,6 @@
 {{-     fail "replicationFactor must be less than or equal to the number of zones defined in .Values.volume.zones." }}
 {{-   end }}
 {{- end }}
-{{- if and (eq .Values.topology "Client") (gt (len .Values.volume.pools) 0) }}
-{{-   fail "volume.pools is not supported with Client topology." }}
-{{- end }}
-{{- if and (eq .Values.topology "MultiZone") (gt (len .Values.volume.pools) 0) }}
-{{-   fail "volume.pools is not supported with MultiZone topology. Use volume.zones[name].pools instead." }}
-{{- end }}
-{{- if and .Values.volume.diskType (not (regexMatch "^[a-z0-9]+$" .Values.volume.diskType)) }}
-{{-   fail (printf "volume.diskType must be lowercase alphanumeric (got: %s)." .Values.volume.diskType) }}
-{{- end }}
-
-{{- /* Collect and validate all pools from volume.pools and zones[].pools */ -}}
-{{- $allPools := dict }}
-{{- range $poolName, $pool := .Values.volume.pools }}
-{{-   if not (regexMatch "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$" $poolName) }}
-{{-     fail (printf "volume.pools key '%s' must be a valid DNS label (lowercase alphanumeric and hyphens, no dots)." $poolName) }}
-{{-   end }}
-{{-   if or (hasSuffix "-lock" $poolName) (hasSuffix "-readonly" $poolName) }}
-{{-     fail (printf "volume.pools key '%s' must not end with '-lock' or '-readonly' (reserved suffixes for COSI resources)." $poolName) }}
-{{-   end }}
-{{-   if not $pool.diskType }}
-{{-     fail (printf "volume.pools.%s.diskType is required." $poolName) }}
-{{-   end }}
-{{-   if not (regexMatch "^[a-z0-9]+$" $pool.diskType) }}
-{{-     fail (printf "volume.pools.%s.diskType must be lowercase alphanumeric (got: %s)." $poolName $pool.diskType) }}
-{{-   end }}
-{{-   if and $.Values.volume.diskType (eq $pool.diskType $.Values.volume.diskType) }}
-{{-     fail (printf "volume.pools.%s.diskType '%s' must differ from volume.diskType." $poolName $pool.diskType) }}
-{{-   end }}
-{{-   $_ := set $allPools $poolName $pool.diskType }}
-{{- end }}
-{{- if eq .Values.topology "MultiZone" }}
-{{-   range $zoneName, $zone := .Values.volume.zones }}
-{{-     range $poolName, $pool := (dig "pools" dict $zone) }}
-{{-       if not (regexMatch "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$" $poolName) }}
-{{-         fail (printf "volume.zones.%s.pools key '%s' must be a valid DNS label." $zoneName $poolName) }}
-{{-       end }}
-{{-       if or (hasSuffix "-lock" $poolName) (hasSuffix "-readonly" $poolName) }}
-{{-         fail (printf "volume.zones.%s.pools key '%s' must not end with '-lock' or '-readonly' (reserved suffixes for COSI resources)." $zoneName $poolName) }}
-{{-       end }}
-{{-       if not $pool.diskType }}
-{{-         fail (printf "volume.zones.%s.pools.%s.diskType is required." $zoneName $poolName) }}
-{{-       end }}
-{{-       if not (regexMatch "^[a-z0-9]+$" $pool.diskType) }}
-{{-         fail (printf "volume.zones.%s.pools.%s.diskType must be lowercase alphanumeric (got: %s)." $zoneName $poolName $pool.diskType) }}
-{{-       end }}
-{{-       if and $.Values.volume.diskType (eq $pool.diskType $.Values.volume.diskType) }}
-{{-         fail (printf "volume.zones.%s.pools.%s.diskType '%s' must differ from volume.diskType." $zoneName $poolName $pool.diskType) }}
-{{-       end }}
-{{-       if and (hasKey $allPools $poolName) (ne (get $allPools $poolName) $pool.diskType) }}
-{{-         fail (printf "Pool '%s' has inconsistent diskType across zones (expected '%s', got '%s' in zone '%s')." $poolName (get $allPools $poolName) $pool.diskType $zoneName) }}
-{{-       end }}
-{{-       $_ := set $allPools $poolName $pool.diskType }}
-{{-       $composedName := printf "%s-%s" $zoneName $poolName }}
-{{-       if hasKey $.Values.volume.zones $composedName }}
-{{-         fail (printf "Composed volume name '%s' (from zone '%s' and pool '%s') collides with an existing zone name." $composedName $zoneName $poolName) }}
-{{-       end }}
-{{-     end }}
-{{-   end }}
-{{- end }}

 {{- $detectedTopology := "Unknown" }}
 {{- $configMap := lookup "v1" "ConfigMap" .Release.Namespace (printf "%s-deployed-topology" .Release.Name) }}
@@ -153,77 +94,30 @@ spec:
          storageClass: {{ . }}
          {{- end }}
          maxVolumes: 0
-        {{- if .Values.volume.diskType }}
-        extraArgs:
-        - "-disk={{ .Values.volume.diskType }}"
-        {{- end }}
-      {{- if or (and (eq .Values.topology "Simple") (gt (len .Values.volume.pools) 0)) (eq .Values.topology "MultiZone") }}
+      {{ if eq .Values.topology "MultiZone" }}
      volumes:
-        {{- if eq .Values.topology "Simple" }}
-        {{- range $poolName, $pool := .Values.volume.pools }}
-        {{ $poolName }}:
-          replicas: {{ ternary $pool.replicas $.Values.volume.replicas (hasKey $pool "replicas") }}
-          resources: {{- include "cozy-lib.resources.defaultingSanitize" (list ($pool.resourcesPreset | default $.Values.volume.resourcesPreset) (default dict $pool.resources) $) | nindent 12 }}
-          dataDirs:
-          - name: data1
-            type: "persistentVolumeClaim"
-            size: "{{ $pool.size | default $.Values.volume.size }}"
-            {{- with ($pool.storageClass | default $.Values.volume.storageClass) }}
-            storageClass: "{{ . }}"
-            {{- end }}
-            maxVolumes: 0
-          extraArgs:
-          - "-disk={{ $pool.diskType }}"
-        {{- end }}
-        {{- else if eq .Values.topology "MultiZone" }}
        {{- range $zoneName, $zone := .Values.volume.zones }}
        {{ $zoneName }}:
-          replicas: {{ ternary $zone.replicas $.Values.volume.replicas (hasKey $zone "replicas") }}
-          resources: {{- include "cozy-lib.resources.defaultingSanitize" (list $.Values.volume.resourcesPreset $.Values.volume.resources $) | nindent 12 }}
-          dataDirs:
-          - name: data1
-            type: "persistentVolumeClaim"
-            size: "{{ $zone.size | default $.Values.volume.size }}"
-            {{- with ($zone.storageClass | default $.Values.volume.storageClass) }}
-            storageClass: "{{ . }}"
-            {{- end }}
-            maxVolumes: 0
-          nodeSelector: |
-            {{- with $zone.nodeSelector }}
-{{ . | indent 12 }}
-            {{- else }}
-            topology.kubernetes.io/zone: {{ $zoneName }}
-            {{- end }}
-          dataCenter: {{ $zone.dataCenter | default $zoneName }}
-          {{- if $.Values.volume.diskType }}
-          extraArgs:
-          - "-disk={{ $.Values.volume.diskType }}"
+          {{ with $zone.replicas }}
+          replicas: {{ . }}
          {{- end }}
-        {{- end }}
-        {{- range $zoneName, $zone := .Values.volume.zones }}
-        {{- range $poolName, $pool := (dig "pools" dict $zone) }}
-        {{ $zoneName }}-{{ $poolName }}:
-          replicas: {{ ternary $pool.replicas (ternary $zone.replicas $.Values.volume.replicas (hasKey $zone "replicas")) (hasKey $pool "replicas") }}
-          resources: {{- include "cozy-lib.resources.defaultingSanitize" (list ($pool.resourcesPreset | default $.Values.volume.resourcesPreset) (default dict $pool.resources) $) | nindent 12 }}
          dataDirs:
          - name: data1
            type: "persistentVolumeClaim"
-            size: "{{ $pool.size | default $zone.size | default $.Values.volume.size }}"
-            {{- with ($pool.storageClass | default $zone.storageClass | default $.Values.volume.storageClass) }}
-            storageClass: "{{ . }}"
+            {{- if $zone.size }}
+            size: "{{ $zone.size }}"
+            {{- else }}
+            size: "{{ $.Values.volume.size }}"
+            {{- end }}
+            {{- if $zone.storageClass }}
+            storageClass: {{ $zone.storageClass }}
+            {{- else if $.Values.volume.storageClass }}
+            storageClass: {{ $.Values.volume.storageClass }}
            {{- end }}
            maxVolumes: 0
          nodeSelector: |
-            {{- with $zone.nodeSelector }}
-{{ . | indent 12 }}
-            {{- else }}
            topology.kubernetes.io/zone: {{ $zoneName }}
-            {{- end }}
          dataCenter: {{ $zone.dataCenter | default $zoneName }}
-          extraArgs:
-          - "-disk={{ $pool.diskType }}"
-        {{- end }}
-        {{- end }}
        {{- end }}
      {{- end }}
      filer:
@@ -305,22 +199,6 @@ spec:
    app.kubernetes.io/component: volume
    app.kubernetes.io/name: seaweedfs
  version: {{ $.Chart.Version }}
-{{- range $poolName, $pool := .Values.volume.pools }}
---
-apiVersion: cozystack.io/v1alpha1
-kind: WorkloadMonitor
-metadata:
-  name: {{ $.Release.Name }}-volume-{{ $poolName }}
-spec:
-  replicas: {{ ternary $pool.replicas $.Values.volume.replicas (hasKey $pool "replicas") }}
-  minReplicas: 1
-  kind: seaweedfs
-  type: volume
-  selector:
-    app.kubernetes.io/component: volume-{{ $poolName }}
-    app.kubernetes.io/name: seaweedfs
-  version: {{ $.Chart.Version }}
-{{- end }}
 {{- else if eq .Values.topology "MultiZone" }}
 {{- range $zoneName, $zoneSpec := .Values.volume.zones }}
 ---
@@ -329,7 +207,7 @@ kind: WorkloadMonitor
 metadata:
  name: {{ $.Release.Name }}-volume-{{ $zoneName }}
 spec:
-  replicas: {{ ternary $zoneSpec.replicas $.Values.volume.replicas (hasKey $zoneSpec "replicas") }}
+  replicas: {{ default $.Values.volume.replicas $zoneSpec.replicas }}
  minReplicas: 1
  kind: seaweedfs
  type: volume
@@ -337,22 +215,6 @@ spec:
    app.kubernetes.io/component: volume-{{ $zoneName }}
    app.kubernetes.io/name: seaweedfs
  version: {{ $.Chart.Version }}
-{{- range $poolName, $pool := (dig "pools" dict $zoneSpec) }}
---
-apiVersion: cozystack.io/v1alpha1
-kind: WorkloadMonitor
-metadata:
-  name: {{ $.Release.Name }}-volume-{{ $zoneName }}-{{ $poolName }}
-spec:
-  replicas: {{ ternary $pool.replicas (ternary $zoneSpec.replicas $.Values.volume.replicas (hasKey $zoneSpec "replicas")) (hasKey $pool "replicas") }}
-  minReplicas: 1
-  kind: seaweedfs
-  type: volume
-  selector:
-    app.kubernetes.io/component: volume-{{ $zoneName }}-{{ $poolName }}
-    app.kubernetes.io/name: seaweedfs
-  version: {{ $.Chart.Version }}
-{{- end }}
 {{- end }}
 {{- end }}
 ---
--- a/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml
+++ b/packages/extra/seaweedfs/templates/storage-pool-bucket-classes.yaml
@@ -1,55 +0,0 @@
-{{- if ne .Values.topology "Client" }}
-{{- /* Collect unique pools from volume.pools and zones[].pools */ -}}
-{{- $uniquePools := dict }}
-{{- range $poolName, $pool := .Values.volume.pools }}
-{{-   $_ := set $uniquePools $poolName $pool.diskType }}
-{{- end }}
-{{- if eq .Values.topology "MultiZone" }}
-{{-   range $zoneName, $zone := .Values.volume.zones }}
-{{-     range $poolName, $pool := (dig "pools" dict $zone) }}
-{{-       $_ := set $uniquePools $poolName $pool.diskType }}
-{{-     end }}
-{{-   end }}
-{{- end }}
-{{- range $poolName, $diskType := $uniquePools }}
---
-kind: BucketClass
-apiVersion: objectstorage.k8s.io/v1alpha1
-metadata:
-  name: {{ $.Release.Namespace }}-{{ $poolName }}
-driverName: {{ $.Release.Namespace }}.seaweedfs.objectstorage.k8s.io
-deletionPolicy: Delete
-parameters:
-  disk: {{ $diskType }}
---
-kind: BucketClass
-apiVersion: objectstorage.k8s.io/v1alpha1
-metadata:
-  name: {{ $.Release.Namespace }}-{{ $poolName }}-lock
-driverName: {{ $.Release.Namespace }}.seaweedfs.objectstorage.k8s.io
-deletionPolicy: Retain
-parameters:
-  disk: {{ $diskType }}
-  objectLockEnabled: "true"
-  objectLockRetentionMode: "COMPLIANCE"
-  objectLockRetentionDays: "365"
---
-kind: BucketAccessClass
-apiVersion: objectstorage.k8s.io/v1alpha1
-metadata:
-  name: {{ $.Release.Namespace }}-{{ $poolName }}
-driverName: {{ $.Release.Namespace }}.seaweedfs.objectstorage.k8s.io
-authenticationType: KEY
-parameters:
-  accessPolicy: readwrite
---
-kind: BucketAccessClass
-apiVersion: objectstorage.k8s.io/v1alpha1
-metadata:
-  name: {{ $.Release.Namespace }}-{{ $poolName }}-readonly
-driverName: {{ $.Release.Namespace }}.seaweedfs.objectstorage.k8s.io
-authenticationType: KEY
-parameters:
-  accessPolicy: readonly
-{{- end }}
-{{- end }}
--- a/packages/extra/seaweedfs/templates/tlsroute.yaml
+++ b/packages/extra/seaweedfs/templates/tlsroute.yaml
@@ -1,41 +0,0 @@
-{{- $gatewayAPI := (index .Values._cluster "gateway-api") | default "false" }}
-{{- $gateway := .Values._namespace.gateway | default "" }}
-{{- $host := .Values._namespace.host }}
-
-{{- if and (eq $gatewayAPI "true") (ne $gateway "") (not (eq .Values.topology "Client")) (.Values.filer.grpcHost) }}
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  name: seaweedfs-filer
-spec:
-  gatewayClassName: cilium
-  infrastructure:
-    labels:
-      cozystack.io/gateway: {{ $gateway }}
-  listeners:
-  - name: tls-passthrough
-    protocol: TLS
-    port: 443
-    hostname: {{ .Values.filer.grpcHost | default (printf "filer.%s" $host) | quote }}
-    tls:
-      mode: Passthrough
-    allowedRoutes:
-      namespaces:
-        from: Same
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: TLSRoute
-metadata:
-  name: seaweedfs-filer
-spec:
-  parentRefs:
-  - name: seaweedfs-filer
-    sectionName: tls-passthrough
-  hostnames:
-  - {{ .Values.filer.grpcHost | default (printf "filer.%s" $host) | quote }}
-  rules:
-  - backendRefs:
-    - name: {{ $.Release.Name }}-filer-external
-      port: 18888
-{{- end }}
--- a/packages/extra/seaweedfs/values.schema.json
+++ b/packages/extra/seaweedfs/values.schema.json
@@ -300,94 +300,6 @@
      "type": "object",
      "default": {},
      "properties": {
-        "diskType": {
-          "description": "SeaweedFS disk type tag for the default volume servers (e.g., \"hdd\", \"ssd\").",
-          "type": "string",
-          "default": ""
-        },
-        "pools": {
-          "description": "A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.",
-          "type": "object",
-          "default": {},
-          "additionalProperties": {
-            "type": "object",
-            "required": [
-              "diskType"
-            ],
-            "properties": {
-              "diskType": {
-                "description": "SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").",
-                "type": "string"
-              },
-              "replicas": {
-                "description": "Number of volume replicas. Defaults to volume.replicas (Simple) or zone.replicas/volume.replicas (MultiZone).",
-                "type": "integer"
-              },
-              "resources": {
-                "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
-                "type": "object",
-                "properties": {
-                  "cpu": {
-                    "description": "Number of CPU cores allocated.",
-                    "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-                    "anyOf": [
-                      {
-                        "type": "integer"
-                      },
-                      {
-                        "type": "string"
-                      }
-                    ],
-                    "x-kubernetes-int-or-string": true
-                  },
-                  "memory": {
-                    "description": "Amount of memory allocated.",
-                    "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-                    "anyOf": [
-                      {
-                        "type": "integer"
-                      },
-                      {
-                        "type": "string"
-                      }
-                    ],
-                    "x-kubernetes-int-or-string": true
-                  }
-                }
-              },
-              "resourcesPreset": {
-                "description": "Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.",
-                "type": "string",
-                "enum": [
-                  "nano",
-                  "micro",
-                  "small",
-                  "medium",
-                  "large",
-                  "xlarge",
-                  "2xlarge"
-                ]
-              },
-              "size": {
-                "description": "Persistent Volume size. Defaults to volume.size (Simple) or zone.size/volume.size (MultiZone).",
-                "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-                "anyOf": [
-                  {
-                    "type": "integer"
-                  },
-                  {
-                    "type": "string"
-                  }
-                ],
-                "x-kubernetes-int-or-string": true
-              },
-              "storageClass": {
-                "description": "Kubernetes StorageClass for the pool. Defaults to volume.storageClass.",
-                "type": "string"
-              }
-            }
-          }
-        },
        "replicas": {
          "description": "Number of volume replicas.",
          "type": "integer",
@@ -466,96 +378,6 @@
          "additionalProperties": {
            "type": "object",
            "properties": {
-              "dataCenter": {
-                "description": "SeaweedFS data center name for this zone. Defaults to the zone name.",
-                "type": "string"
-              },
-              "nodeSelector": {
-                "description": "YAML nodeSelector for this zone (default: topology.kubernetes.io/zone: \u003czoneName\u003e).",
-                "type": "string"
-              },
-              "pools": {
-                "description": "A map of storage pools for this zone. Each pool creates a separate Volume StatefulSet per zone.",
-                "type": "object",
-                "additionalProperties": {
-                  "type": "object",
-                  "required": [
-                    "diskType"
-                  ],
-                  "properties": {
-                    "diskType": {
-                      "description": "SeaweedFS disk type tag (e.g., \"ssd\", \"hdd\", \"nvme\").",
-                      "type": "string"
-                    },
-                    "replicas": {
-                      "description": "Number of volume replicas. Defaults to volume.replicas (Simple) or zone.replicas/volume.replicas (MultiZone).",
-                      "type": "integer"
-                    },
-                    "resources": {
-                      "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
-                      "type": "object",
-                      "properties": {
-                        "cpu": {
-                          "description": "Number of CPU cores allocated.",
-                          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-                          "anyOf": [
-                            {
-                              "type": "integer"
-                            },
-                            {
-                              "type": "string"
-                            }
-                          ],
-                          "x-kubernetes-int-or-string": true
-                        },
-                        "memory": {
-                          "description": "Amount of memory allocated.",
-                          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-                          "anyOf": [
-                            {
-                              "type": "integer"
-                            },
-                            {
-                              "type": "string"
-                            }
-                          ],
-                          "x-kubernetes-int-or-string": true
-                        }
-                      }
-                    },
-                    "resourcesPreset": {
-                      "description": "Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.",
-                      "type": "string",
-                      "enum": [
-                        "nano",
-                        "micro",
-                        "small",
-                        "medium",
-                        "large",
-                        "xlarge",
-                        "2xlarge"
-                      ]
-                    },
-                    "size": {
-                      "description": "Persistent Volume size. Defaults to volume.size (Simple) or zone.size/volume.size (MultiZone).",
-                      "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
-                      "anyOf": [
-                        {
-                          "type": "integer"
-                        },
-                        {
-                          "type": "string"
-                        }
-                      ],
-                      "x-kubernetes-int-or-string": true
-                    },
-                    "storageClass": {
-                      "description": "Kubernetes StorageClass for the pool. Defaults to volume.storageClass.",
-                      "type": "string"
-                    }
-                  }
-                }
-              },
              "replicas": {
                "description": "Number of replicas in the zone.",
                "type": "integer"
@@ -572,10 +394,6 @@
                  }
                ],
                "x-kubernetes-int-or-string": true
-              },
-              "storageClass": {
-                "description": "StorageClass used to store zone data. Defaults to volume.storageClass.",
-                "type": "string"
              }
            }
          }
--- a/packages/extra/seaweedfs/values.yaml
+++ b/packages/extra/seaweedfs/values.yaml
@@ -76,49 +76,26 @@ filer:
  grpcPort: 443
  whitelist: []

-## @typedef {struct} StoragePool - Storage pool configuration for separating buckets by disk type.
-## @field {string} diskType - SeaweedFS disk type tag (e.g., "ssd", "hdd", "nvme").
-## @field {int} [replicas] - Number of volume replicas. Defaults to volume.replicas (Simple) or zone.replicas/volume.replicas (MultiZone).
-## @field {quantity} [size] - Persistent Volume size. Defaults to volume.size (Simple) or zone.size/volume.size (MultiZone).
-## @field {string} [storageClass] - Kubernetes StorageClass for the pool. Defaults to volume.storageClass.
-## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
-## @field {ResourcesPreset} [resourcesPreset] - Default sizing preset used when `resources` is omitted. Defaults to volume.resourcesPreset.
-
 ## @typedef {struct} Zone - Zone configuration.
 ## @field {int} [replicas] - Number of replicas in the zone.
 ## @field {quantity} [size] - Zone storage size.
-## @field {string} [dataCenter] - SeaweedFS data center name for this zone. Defaults to the zone name.
-## @field {string} [nodeSelector] - YAML nodeSelector for this zone (default: topology.kubernetes.io/zone: <zoneName>).
-## @field {string} [storageClass] - StorageClass used to store zone data. Defaults to volume.storageClass.
-## @field {map[string]StoragePool} [pools] - A map of storage pools for this zone. Each pool creates a separate Volume StatefulSet per zone.
-## NOTE: Zone-level resources/resourcesPreset are inherited from volume.* settings. Pools within a zone can define their own resources.

 ## @typedef {struct} Volume - Volume service configuration.
 ## @field {int} [replicas] - Number of volume replicas.
 ## @field {quantity} [size] - Persistent Volume size.
 ## @field {string} [storageClass] - StorageClass used to store the data.
-## @field {string} [diskType] - SeaweedFS disk type tag for the default volume servers (e.g., "hdd", "ssd").
 ## @field {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
 ## @field {ResourcesPreset} [resourcesPreset] - Default sizing preset used when `resources` is omitted.
 ## @field {map[string]Zone} [zones] - A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.
-## @field {map[string]StoragePool} [pools] - A map of storage pools. Each pool creates a separate Volume StatefulSet with its own disk type.

 ## @param {Volume} [volume] - Volume service configuration.
 volume:
  replicas: 2
  size: 10Gi
  storageClass: ""
-  diskType: ""
  resources: {}
  resourcesPreset: "small"
  zones: {}
-  pools: {}
-  #pools:
-  #  fast:
-  #    diskType: ssd
-  #    replicas: 2
-  #    size: 50Gi
-  #    storageClass: "local-nvme"

 ## @typedef {struct} S3 - S3 service configuration.
 ## @field {int} [replicas] - Number of S3 replicas.
--- a/packages/system/backup-controller/templates/rbac.yaml
+++ b/packages/system/backup-controller/templates/rbac.yaml
@@ -3,14 +3,30 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
  name: backups.cozystack.io:core-controller
 rules:
-# Plan: reconcile schedule and update status
 - apiGroups: ["backups.cozystack.io"]
  resources: ["plans"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["backups.cozystack.io"]
-  resources: ["plans/status"]
-  verbs: ["get", "update", "patch"]
-# BackupJob: create when schedule fires (status is updated by backupstrategy-controller)
 - apiGroups: ["backups.cozystack.io"]
  resources: ["backupjobs"]
+  verbs: ["create", "get", "list", "watch", "update", "patch"]
+- apiGroups: ["backups.cozystack.io"]
+  resources: ["backupjobs/status"]
+  verbs: ["get", "update", "patch"]
+- apiGroups: ["backups.cozystack.io"]
+  resources: ["backups"]
  verbs: ["create", "get", "list", "watch"]
+- apiGroups: ["apps.cozystack.io"]
+  resources: ["buckets", "bucketaccesses", "virtualmachines"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["objectstorage.k8s.io"]
+  resources: ["buckets", "bucketaccesses"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["create", "get", "list", "watch", "update", "patch"]
+- apiGroups: ["kubevirt.io"]
+  resources: ["virtualmachines"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["velero.io"]
+  resources: ["backups", "backupstoragelocations", "volumesnapshotlocations", "restores"]
+  verbs: ["create", "get", "list", "watch", "update", "patch"]
--- a/packages/system/backup-controller/values.yaml
+++ b/packages/system/backup-controller/values.yaml
@@ -1,5 +1,5 @@
 backupController:
-  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.1.0@sha256:8e42e29f5d30ecbef1f05cb0601c32703c5f9572b89d2c9032c1dff186e9a526"
+  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.0.3@sha256:714cf847c4b929cc5bf974ad716652aa849f51ba69b3fe7a25a8e846fc7d2125"
  replicas: 2
  debug: false
  metrics:
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
IvanHunters	64b4be5c78	Release v1.0.3 (#2159 ) This PR prepares the release `v1.0.3`.	2026-03-06 12:21:14 +03:00
cozystack-bot	c79545ba04	Prepare release v1.0.3 Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>	2026-03-06 01:37:07 +00:00
Andrei Kvapil	eda0e8ee50	[Backport release-1.0] Fixed packages name conversion in migration script (#2148 ) # Description Backport of #2144 to `release-1.0`.	2026-03-05 17:25:11 +01:00
Myasnikov Daniil	f68fc0c921	Fixed packages name conversion in migration script Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com> (cherry picked from commit `780af33ee1`)	2026-03-03 23:22:55 +00:00
Andrei Kvapil	48ce08f584	Release v1.0.2 (#2140 ) This PR prepares the release `v1.0.2`.	2026-03-02 21:48:54 +01:00
cozystack-bot	2675ff326a	Prepare release v1.0.2 Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>	2026-03-02 18:38:46 +00:00
Andrei Kvapil	51a5073175	[Backport release-1.0] [dashboard] fix: restore stock-instance sidebars for namespace-level pages (#2138 ) # Description Backport of #2136 to `release-1.0`.	2026-03-02 19:29:25 +01:00
Kirill Ilin	05d1c02eff	fix(dashboard): restore stock-instance sidebars for namespace-level pages PR #2106 removed stock-instance-* sidebar resources to fix broken URLs on the main page before namespace selection. However, these sidebars are required for rendering namespace-level pages (api-table, api-form, etc.) such as the Backup Plans page. Without stock-instance-api-table, the frontend cannot find the sidebar for namespace-scoped api-table pages and renders an empty page instead. The original bug (broken URLs with empty namespace placeholder) is already fixed by CUSTOMIZATION_SIDEBAR_FALLBACK_ID="" in web.yaml, so re-adding stock-instance-* sidebars does not reintroduce it. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Kirill Ilin <stitch14@yandex.ru> (cherry picked from commit `45b61f812d`)	2026-03-02 18:28:56 +00:00
Andrei Kvapil	f06817d4e8	[Backport release-1.0] [dashboard] fix: allow clearing instanceType and preserve secret copy newlines (#2137 ) # Description Backport of #2135 to `release-1.0`.	2026-03-02 19:28:55 +01:00
Kirill Ilin	0fefaa246f	fix(dashboard): preserve newlines when copying secrets with CMD+C Add onCopy handler to SecretBase64Plain inputs to intercept native browser copy events and explicitly write the full decoded text (including newlines) to the clipboard. Without this, input[type=text] strips newlines on copy. Upstream PR: https://github.com/PRO-Robotech/openapi-k8s-toolkit/pull/339 Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Kirill Ilin <stitch14@yandex.ru> (cherry picked from commit `99ee0e34bf`)	2026-03-02 18:27:55 +00:00
Kirill Ilin	7cea11e57b	feat(dashboard): set allowEmpty on instanceType and update openapi-ui toolkit Update openapi-k8s-toolkit commit to d6b9e4ad (release/1.4.0) which includes the FormListInput layout refactor, making formlistinput-value-binding.diff obsolete. Set allowEmpty: true on the VMInstance instanceType field so users can explicitly clear the selection and override the default instance type. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Kirill Ilin <stitch14@yandex.ru> (cherry picked from commit `6e8ce65e49`)	2026-03-02 18:27:55 +00:00
Kirill Ilin	31ae2bb826	feat(dashboard): allow clearing instanceType field in VMInstance form Update openapi-k8s-toolkit to release/1.4.0 (d6b9e4ad). The previous value-binding layout refactor is already included upstream, so drop the formlistinput-value-binding.diff patch. Add formlistinput-allow-empty.diff patch which introduces two props to the listInput component: - allowEmpty: when set, auto-persists the field so BFF sends an empty value instead of falling back to the schema default - persistType: controls the type of empty value ('str' \| 'number' \| 'arr' \| 'obj'), allowing the feature to work correctly for any field type Set allowEmpty: true on the VMInstance instanceType field so users can explicitly clear the selection and override the default instance type. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Kirill Ilin <stitch14@yandex.ru> (cherry picked from commit `a3ccb4f87d`)	2026-03-02 18:27:55 +00:00
Andrei Kvapil	c976378f2f	[Backport release-1.0] [system] Fix Keycloak proxy configuration for v26.x (#2134 ) # Description Backport of #2125 to `release-1.0`.	2026-03-02 18:56:45 +01:00
Kirill Ilin	edc32eec51	fix(keycloak): replace deprecated KC_PROXY with KC_PROXY_HEADERS KC_PROXY=edge was deprecated and removed in Keycloak 26.x, causing "Non-secure context detected" warnings and broken cookie handling behind reverse proxy. Replace with KC_PROXY_HEADERS=xforwarded and KC_HTTP_ENABLED=true. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Kirill Ilin <stitch14@yandex.ru> (cherry picked from commit `14228aa0d7`)	2026-03-02 17:30:05 +00:00
Andrei Kvapil	e51f05d850	[Backport release-1.0] [platform] Fixed run-migrations script (#2132 ) # Description Backport of #2126 to `release-1.0`.	2026-03-02 17:54:10 +01:00
Myasnikov Daniil	dac1a375e2	[platform] Fixed run-migrations script Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com> (cherry picked from commit `79c57874bb`)	2026-03-02 16:53:58 +00:00
Andrei Kvapil	2a956eb0f9	[Backport release-1.0] fix(migration): suspend cozy-proxy if it conflicts with installer release (#2130 ) # Description Backport of #2128 to `release-1.0`.	2026-03-02 16:34:02 +01:00
Andrei Kvapil	6fbe026927	fix(migration): suspend cozy-proxy if it conflicts with installer release In v0.41.x, cozy-proxy HelmRelease was configured with releaseName: cozystack, which collides with the installer helm release. If not suspended before upgrade, the cozy-proxy HR reconciles and overwrites the installer release, deleting cozystack-operator. Add a check in the migration script that detects this conflict and suspends the cozy-proxy HelmRelease before proceeding. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Andrei Kvapil <kvapss@gmail.com> (cherry picked from commit `14a9017932`)	2026-03-02 15:31:21 +00:00
Andrei Kvapil	4c3a6987c5	Release v1.0.1 (#2117 ) This PR prepares the release `v1.0.1`.	2026-02-28 15:16:04 +01:00
cozystack-bot	30c5696541	Prepare release v1.0.1 Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>	2026-02-28 11:00:44 +00:00
Andrei Kvapil	42780f26d2	[Backport release-1.0] fix(dashboard): add FlowSchema to exempt BFF from API throttling (#2124 ) # Description Backport of #2121 to `release-1.0`.	2026-02-28 11:56:50 +01:00
Andrei Kvapil	e9e2121153	fix(dashboard): add FlowSchema to exempt BFF from API throttling The dashboard BFF service account (incloud-web-web) falls under the default "service-accounts" FlowSchema which maps to the "workload-low" priority level. Under load, this causes API Priority and Fairness to return 429 (Too Many Requests) responses to the BFF, resulting in 500 errors for dashboard users. Add a FlowSchema that maps the BFF service account to the "exempt" priority level to prevent APF throttling of dashboard API requests. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Andrei Kvapil <kvapss@gmail.com> (cherry picked from commit `161b5be8c2`)	2026-02-28 10:55:27 +00:00
Andrei Kvapil	3033e718dd	[Backport release-1.0] fix(installer): add keep annotation to Namespace and update migration script (#2123 ) # Description Backport of #2122 to `release-1.0`.	2026-02-28 11:53:44 +01:00
Andrei Kvapil	aa8a7eae47	fix(installer): add keep annotation to Namespace and update migration script Add helm.sh/resource-policy=keep annotation to the cozy-system Namespace in the installer helm chart. This prevents Helm from deleting the namespace when the HelmRelease is removed, which would otherwise destroy all other HelmReleases within it. Update the migration script to annotate the cozy-system namespace and cozystack-version ConfigMap with helm.sh/resource-policy=keep before generating the Package resource. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Andrei Kvapil <kvapss@gmail.com> (cherry picked from commit `c83e41ea14`)	2026-02-28 10:53:06 +00:00
Andrei Kvapil	5a14dc6f54	[Backport release-1.0] [platform] Prevent version cm from deletion (#2114 ) # Description Backport of #2112 to `release-1.0`.	2026-02-27 13:05:06 +01:00
Myasnikov Daniil	2b59d4fc97	[platform] Prevent version cm from deletion Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com> (cherry picked from commit `c05dd5e7b1`)	2026-02-27 12:03:48 +00:00