[kubernetes] No default nodegroups in values

Since nodegroups are defined as key-value pairs in the values, there's no easy way to remove the example md0 nodegroup that was provided there for purposes of documentation. Commenting it out from values.yaml keeps the documentation in place, but doesn't force the node group onto users. Release note: [kubernetes] Remove potentially undesirable node group from default values of kubernetes chart. Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
2026-03-05 06:28:55 +00:00 · 2025-07-24 22:01:05 +03:00
81 changed files with 686 additions and 4882 deletions
--- a/.github/workflows/tags.yaml
+++ b/.github/workflows/tags.yaml
@@ -149,35 +149,36 @@ jobs:
          version:     ${{ steps.tag.outputs.tag }}            # A
          compare-to:  ${{ steps.latest_release.outputs.tag }} # B

-      # Create or reuse draft release
+      # Create or reuse DRAFT GitHub Release
      - name: Create / reuse draft release
        if: steps.check_release.outputs.skip == 'false'
        id: release
        uses: actions/github-script@v7
        with:
          script: |
-            const tag      = '${{ steps.tag.outputs.tag }}';
-            const isRc     = ${{ steps.tag.outputs.is_rc }};
-            const releases = await github.rest.repos.listReleases({
+            const tag        = '${{ steps.tag.outputs.tag }}';
+            const isRc       = ${{ steps.tag.outputs.is_rc }};
+            const outdated   = '${{ steps.semver.outputs.comparison-result }}' === '<';
+            const makeLatest = outdated ? false : 'legacy';
+            const releases   = await github.rest.repos.listReleases({
              owner: context.repo.owner,
              repo:  context.repo.repo
            });
-
-            let rel = releases.data.find(r => r.tag_name === tag);
+            let rel          = releases.data.find(r => r.tag_name === tag);
            if (!rel) {
              rel = await github.rest.repos.createRelease({
                owner: context.repo.owner,
                repo:  context.repo.repo,
-                tag_name:   tag,
-                name:       tag,
-                draft:      true,
-                prerelease: isRc               // no make_latest for drafts
+                tag_name:    tag,
+                name:        tag,
+                draft:       true,
+                prerelease:  isRc,
+                make_latest: makeLatest
              });
              console.log(`Draft release created for ${tag}`);
            } else {
              console.log(`Re-using existing release ${tag}`);
            }
-
            core.setOutput('upload_url', rel.upload_url);

      # Build + upload assets (optional)
--- a/.gitignore
+++ b/.gitignore
@@ -77,5 +77,3 @@ fabric.properties

 .DS_Store
 **/.DS_Store
-
-tmp/
--- a/api/v1alpha1/cozystackresourcedefinitions_types.go
+++ b/api/v1alpha1/cozystackresourcedefinitions_types.go
@@ -1,89 +0,0 @@
-/*
-Copyright 2025.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1alpha1
-
-import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-
-// CozystackResourceDefinition is the Schema for the cozystackresourcedefinitions API
-type CozystackResourceDefinition struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec CozystackResourceDefinitionSpec `json:"spec,omitempty"`
-}
-
-// +kubebuilder:object:root=true
-
-// CozystackResourceDefinitionList contains a list of CozystackResourceDefinition
-type CozystackResourceDefinitionList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []CozystackResourceDefinition `json:"items"`
-}
-
-func init() {
-	SchemeBuilder.Register(&CozystackResourceDefinition{}, &CozystackResourceDefinitionList{})
-}
-
-type CozystackResourceDefinitionSpec struct {
-	// Application configuration
-	Application CozystackResourceDefinitionApplication `json:"application"`
-	// Release configuration
-	Release CozystackResourceDefinitionRelease `json:"release"`
-}
-
-type CozystackResourceDefinitionChart struct {
-	// Name of the Helm chart
-	Name string `json:"name"`
-	// Source reference for the Helm chart
-	SourceRef SourceRef `json:"sourceRef"`
-}
-
-type SourceRef struct {
-	// Kind of the source reference
-	// +kubebuilder:default:="HelmRepository"
-	Kind string `json:"kind"`
-	// Name of the source reference
-	Name string `json:"name"`
-	// Namespace of the source reference
-	// +kubebuilder:default:="cozy-public"
-	Namespace string `json:"namespace"`
-}
-
-type CozystackResourceDefinitionApplication struct {
-	// Kind of the application, used for UI and API
-	Kind string `json:"kind"`
-	// OpenAPI schema for the application, used for API validation
-	OpenAPISchema string `json:"openAPISchema"`
-	// Plural name of the application, used for UI and API
-	Plural string `json:"plural"`
-	// Singular name of the application, used for UI and API
-	Singular string `json:"singular"`
-}
-
-type CozystackResourceDefinitionRelease struct {
-	// Helm chart configuration
-	Chart CozystackResourceDefinitionChart `json:"chart"`
-	// Labels for the release
-	Labels map[string]string `json:"labels,omitempty"`
-	// Prefix for the release name
-	Prefix string `json:"prefix"`
-}
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -25,135 +25,6 @@ import (
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )

-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CozystackResourceDefinition) DeepCopyInto(out *CozystackResourceDefinition) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CozystackResourceDefinition.
-func (in *CozystackResourceDefinition) DeepCopy() *CozystackResourceDefinition {
-	if in == nil {
-		return nil
-	}
-	out := new(CozystackResourceDefinition)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *CozystackResourceDefinition) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CozystackResourceDefinitionApplication) DeepCopyInto(out *CozystackResourceDefinitionApplication) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CozystackResourceDefinitionApplication.
-func (in *CozystackResourceDefinitionApplication) DeepCopy() *CozystackResourceDefinitionApplication {
-	if in == nil {
-		return nil
-	}
-	out := new(CozystackResourceDefinitionApplication)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CozystackResourceDefinitionChart) DeepCopyInto(out *CozystackResourceDefinitionChart) {
-	*out = *in
-	out.SourceRef = in.SourceRef
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CozystackResourceDefinitionChart.
-func (in *CozystackResourceDefinitionChart) DeepCopy() *CozystackResourceDefinitionChart {
-	if in == nil {
-		return nil
-	}
-	out := new(CozystackResourceDefinitionChart)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CozystackResourceDefinitionList) DeepCopyInto(out *CozystackResourceDefinitionList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]CozystackResourceDefinition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CozystackResourceDefinitionList.
-func (in *CozystackResourceDefinitionList) DeepCopy() *CozystackResourceDefinitionList {
-	if in == nil {
-		return nil
-	}
-	out := new(CozystackResourceDefinitionList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *CozystackResourceDefinitionList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CozystackResourceDefinitionRelease) DeepCopyInto(out *CozystackResourceDefinitionRelease) {
-	*out = *in
-	out.Chart = in.Chart
-	if in.Labels != nil {
-		in, out := &in.Labels, &out.Labels
-		*out = make(map[string]string, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CozystackResourceDefinitionRelease.
-func (in *CozystackResourceDefinitionRelease) DeepCopy() *CozystackResourceDefinitionRelease {
-	if in == nil {
-		return nil
-	}
-	out := new(CozystackResourceDefinitionRelease)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CozystackResourceDefinitionSpec) DeepCopyInto(out *CozystackResourceDefinitionSpec) {
-	*out = *in
-	out.Application = in.Application
-	in.Release.DeepCopyInto(&out.Release)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CozystackResourceDefinitionSpec.
-func (in *CozystackResourceDefinitionSpec) DeepCopy() *CozystackResourceDefinitionSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(CozystackResourceDefinitionSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in Selector) DeepCopyInto(out *Selector) {
 	{
@@ -175,21 +46,6 @@ func (in Selector) DeepCopy() Selector {
 	return *out
 }

-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *SourceRef) DeepCopyInto(out *SourceRef) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourceRef.
-func (in *SourceRef) DeepCopy() *SourceRef {
-	if in == nil {
-		return nil
-	}
-	out := new(SourceRef)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Workload) DeepCopyInto(out *Workload) {
 	*out = *in
--- a/cmd/token-proxy/Dockerfile
+++ b/cmd/token-proxy/Dockerfile
@@ -1,15 +0,0 @@
-FROM golang:1.24-alpine as builder
-
-ARG TARGETOS
-ARG TARGETARCH
-
-COPY main.go go.mod go.sum /src/
-WORKDIR /src
-
-RUN go build -o /token-proxy -ldflags '-extldflags "-static" -w -s' main.go
-
-FROM scratch
-
-COPY --from=builder /token-proxy /token-proxy
-
-ENTRYPOINT ["/token-proxy"]
--- a/cmd/token-proxy/example_args.yaml
+++ b/cmd/token-proxy/example_args.yaml
@@ -1,8 +0,0 @@
-args:
- --upstream=http://incloud-web-nginx.incloud-web.svc:8080
- --http-address=0.0.0.0:8000
- --cookie-refresh=1h
- --cookie-name=kc-access
- --cookie-secure=true
- --cookie-secret=$(OAUTH2_PROXY_COOKIE_SECRET)
- --token-check-url=http://incloud-web-nginx.incloud-web.svc:8080/api/clusters/cozydev4/k8s/apis/core.cozystack.io/v1alpha1/tenantnamespaces
--- a/cmd/token-proxy/go.mod
+++ b/cmd/token-proxy/go.mod
@@ -1,8 +0,0 @@
-module token-proxy
-
-go 1.24.0
-
-require (
-	github.com/golang-jwt/jwt/v5 v5.3.0
-	github.com/gorilla/securecookie v1.1.2
-)
--- a/cmd/token-proxy/go.sum
+++ b/cmd/token-proxy/go.sum
@@ -1,6 +0,0 @@
-github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
-github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
-github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
-github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
-github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
--- a/cmd/token-proxy/main.go
+++ b/cmd/token-proxy/main.go
@@ -1,259 +0,0 @@
-package main
-
-import (
-	"encoding/base64"
-	"encoding/json"
-	"flag"
-	"fmt"
-	"html/template"
-	"log"
-	"net/http"
-	"net/http/httputil"
-	"net/url"
-	"os"
-	"path"
-	"strings"
-	"time"
-
-	"github.com/golang-jwt/jwt/v5"
-	"github.com/gorilla/securecookie"
-)
-
-/* ----------------------------- flags ------------------------------------ */
-
-var (
-	upstream, httpAddr, proxyPrefix string
-	cookieName, cookieSecretB64     string
-	cookieSecure                    bool
-	cookieRefresh                   time.Duration
-	tokenCheckURL                   string
-)
-
-func init() {
-	flag.StringVar(&upstream, "upstream", "", "Upstream URL to proxy to (required)")
-	flag.StringVar(&httpAddr, "http-address", "0.0.0.0:8000", "Listen address")
-	flag.StringVar(&proxyPrefix, "proxy-prefix", "/oauth2", "URL prefix for control endpoints")
-
-	flag.StringVar(&cookieName, "cookie-name", "_oauth2_proxy_0", "Cookie name")
-	flag.StringVar(&cookieSecretB64, "cookie-secret", "", "Base64-encoded cookie secret")
-	flag.BoolVar(&cookieSecure, "cookie-secure", false, "Set Secure flag on cookie")
-	flag.DurationVar(&cookieRefresh, "cookie-refresh", 0, "Cookie refresh interval (e.g. 1h)")
-	flag.StringVar(&tokenCheckURL, "token-check-url", "", "URL for external token validation")
-}
-
-/* ----------------------------- templates -------------------------------- */
-
-var loginTmpl = template.Must(template.New("login").Parse(`
-<!doctype html><html><head><title>Login</title></head>
-<body>
-	<h2>Enter ServiceAccount / OIDC token</h2>
-	{{if .Err}}<p style="color:red">{{.Err}}</p>{{end}}
-	<form method="POST" action="{{.Action}}">
-		<input style="width:420px" name="token" placeholder="Paste token" autofocus/>
-		<button type="submit">Login</button>
-	</form>
-</body></html>`))
-
-/* ----------------------------- helpers ---------------------------------- */
-
-func decodeJWT(raw string) jwt.MapClaims {
-	tkn, _ := jwt.Parse(raw, nil)
-	if c, ok := tkn.Claims.(jwt.MapClaims); ok {
-		return c
-	}
-	return jwt.MapClaims{}
-}
-
-func externalTokenCheck(raw string) error {
-	if tokenCheckURL == "" {
-		return nil
-	}
-	req, _ := http.NewRequest(http.MethodGet, tokenCheckURL, nil)
-	req.Header.Set("Authorization", "Bearer "+raw)
-	cli := &http.Client{Timeout: 5 * time.Second}
-	resp, err := cli.Do(req)
-	if err != nil {
-		return err
-	}
-	resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("status %d", resp.StatusCode)
-	}
-	return nil
-}
-
-func encodeSession(sc *securecookie.SecureCookie, token string, exp, issued int64) (string, error) {
-	v := map[string]interface{}{
-		"access_token": token,
-		"expires":      exp,
-		"issued":       issued,
-	}
-	return sc.Encode(cookieName, v)
-}
-
-/* ----------------------------- main ------------------------------------- */
-
-func main() {
-	flag.Parse()
-	if upstream == "" {
-		log.Fatal("--upstream is required")
-	}
-	upURL, err := url.Parse(upstream)
-	if err != nil {
-		log.Fatalf("invalid upstream url: %v", err)
-	}
-
-	if cookieSecretB64 == "" {
-		cookieSecretB64 = os.Getenv("COOKIE_SECRET")
-	}
-	if cookieSecretB64 == "" {
-		log.Fatal("--cookie-secret or $COOKIE_SECRET is required")
-	}
-	secret, err := base64.StdEncoding.DecodeString(cookieSecretB64)
-	if err != nil {
-		log.Fatalf("cookie-secret: %v", err)
-	}
-	sc := securecookie.New(secret, nil)
-
-	// control paths
-	signIn := path.Join(proxyPrefix, "sign_in")
-	signOut := path.Join(proxyPrefix, "sign_out")
-	userInfo := path.Join(proxyPrefix, "userinfo")
-
-	proxy := httputil.NewSingleHostReverseProxy(upURL)
-
-	/* ------------------------- /sign_in ---------------------------------- */
-
-	http.HandleFunc(signIn, func(w http.ResponseWriter, r *http.Request) {
-		switch r.Method {
-		case http.MethodGet:
-			_ = loginTmpl.Execute(w, struct {
-				Action string
-				Err    string
-			}{Action: signIn})
-		case http.MethodPost:
-			token := strings.TrimSpace(r.FormValue("token"))
-			if token == "" {
-				_ = loginTmpl.Execute(w, struct {
-					Action string
-					Err    string
-				}{Action: signIn, Err: "Token required"})
-				return
-			}
-			if err := externalTokenCheck(token); err != nil {
-				_ = loginTmpl.Execute(w, struct {
-					Action string
-					Err    string
-				}{Action: signIn, Err: "Invalid token"})
-				return
-			}
-
-			exp := time.Now().Add(24 * time.Hour).Unix()
-			claims := decodeJWT(token)
-			if v, ok := claims["exp"].(float64); ok {
-				exp = int64(v)
-			}
-			session, _ := encodeSession(sc, token, exp, time.Now().Unix())
-			http.SetCookie(w, &http.Cookie{
-				Name:     cookieName,
-				Value:    session,
-				Path:     "/",
-				Expires:  time.Unix(exp, 0),
-				Secure:   cookieSecure,
-				HttpOnly: true,
-				SameSite: http.SameSiteLaxMode,
-			})
-			http.Redirect(w, r, "/", http.StatusSeeOther)
-		}
-	})
-
-	/* ------------------------- /sign_out --------------------------------- */
-
-	http.HandleFunc(signOut, func(w http.ResponseWriter, r *http.Request) {
-		http.SetCookie(w, &http.Cookie{
-			Name:     cookieName,
-			Value:    "",
-			Path:     "/",
-			MaxAge:   -1,
-			Secure:   cookieSecure,
-			HttpOnly: true,
-		})
-		http.Redirect(w, r, signIn, http.StatusSeeOther)
-	})
-
-	/* ------------------------- /userinfo --------------------------------- */
-
-	http.HandleFunc(userInfo, func(w http.ResponseWriter, r *http.Request) {
-		c, err := r.Cookie(cookieName)
-		if err != nil {
-			http.Error(w, "unauthorized", http.StatusUnauthorized)
-			return
-		}
-		var sess map[string]interface{}
-		if err := sc.Decode(cookieName, c.Value, &sess); err != nil {
-			http.Error(w, "unauthorized", http.StatusUnauthorized)
-			return
-		}
-		token, _ := sess["access_token"].(string)
-		claims := decodeJWT(token)
-
-		out := map[string]interface{}{
-			"token":                 token,
-			"sub":                   claims["sub"],
-			"email":                 claims["email"],
-			"preferred_username":    claims["preferred_username"],
-			"groups":                claims["groups"],
-			"expires":               sess["expires"],
-			"issued":                sess["issued"],
-			"cookie_refresh_enable": cookieRefresh > 0,
-		}
-		w.Header().Set("Content-Type", "application/json")
-		_ = json.NewEncoder(w).Encode(out)
-	})
-
-	/* ----------------------------- proxy --------------------------------- */
-
-	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
-		c, err := r.Cookie(cookieName)
-		if err != nil {
-			http.Redirect(w, r, signIn, http.StatusFound)
-			return
-		}
-		var sess map[string]interface{}
-		if err := sc.Decode(cookieName, c.Value, &sess); err != nil {
-			http.Redirect(w, r, signIn, http.StatusFound)
-			return
-		}
-		token, _ := sess["access_token"].(string)
-		if token == "" {
-			http.Redirect(w, r, signIn, http.StatusFound)
-			return
-		}
-
-		// cookie refresh
-		if cookieRefresh > 0 {
-			if issued, ok := sess["issued"].(float64); ok {
-				if time.Since(time.Unix(int64(issued), 0)) > cookieRefresh {
-					enc, _ := encodeSession(sc, token, int64(sess["expires"].(float64)), time.Now().Unix())
-					http.SetCookie(w, &http.Cookie{
-						Name:     cookieName,
-						Value:    enc,
-						Path:     "/",
-						Expires:  time.Unix(int64(sess["expires"].(float64)), 0),
-						Secure:   cookieSecure,
-						HttpOnly: true,
-						SameSite: http.SameSiteLaxMode,
-					})
-				}
-			}
-		}
-
-		r.Header.Set("Authorization", "Bearer "+token)
-		proxy.ServeHTTP(w, r)
-	})
-
-	log.Printf("Listening on %s → %s (control prefix %s)", httpAddr, upURL, proxyPrefix)
-	if err := http.ListenAndServe(httpAddr, nil); err != nil {
-		log.Fatal(err)
-	}
-}
--- a/dashboards/seaweedfs/seaweedfs.json
+++ b/dashboards/seaweedfs/seaweedfs.json
--- a/hack/download-dashboards.sh
+++ b/hack/download-dashboards.sh
@@ -81,7 +81,6 @@ modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//main/capacity-p
 modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//flux/flux-control-plane.json
 modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//flux/flux-stats.json
 modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//kafka/strimzi-kafka.json
-modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//seaweedfs/seaweedfs.json
 modules/340-monitoring-kubernetes/monitoring/grafana-dashboards//goldpinger/goldpinger.json
 EOT

--- a/hack/e2e-apps/bucket.bats
+++ b/hack/e2e-apps/bucket.bats
@@ -1,47 +0,0 @@
-#!/usr/bin/env bats
-
-@test "Create and Verify Seeweedfs Bucket" {
-  # Create the bucket resource
-  name='test'
-  kubectl apply -f - <<EOF
-apiVersion: apps.cozystack.io/v1alpha1
-kind: Bucket
-metadata:
-  name: ${name}
-  namespace: tenant-test
-spec: {}
-EOF
-
-  # Wait for the bucket to be ready
-  kubectl -n tenant-test wait hr bucket-${name} --timeout=100s --for=condition=ready
-  kubectl -n tenant-test wait bucketclaims.objectstorage.k8s.io bucket-${name} --timeout=300s --for=jsonpath='{.status.bucketReady}'
-  kubectl -n tenant-test wait bucketaccesses.objectstorage.k8s.io bucket-${name} --timeout=300s --for=jsonpath='{.status.accessGranted}'
-
-  # Get and decode credentials
-  kubectl -n tenant-test get secret bucket-${name} -ojsonpath='{.data.BucketInfo}' | base64 -d > bucket-test-credentials.json
-
-  # Get credentials from the secret
-  ACCESS_KEY=$(jq -r '.spec.secretS3.accessKeyID' bucket-test-credentials.json)
-  SECRET_KEY=$(jq -r '.spec.secretS3.accessSecretKey' bucket-test-credentials.json)
-  BUCKET_NAME=$(jq -r '.spec.bucketName' bucket-test-credentials.json)
-
-  # Start port-forwarding
-  bash -c 'timeout 100s kubectl port-forward service/seaweedfs-s3 -n tenant-root 8333:8333 > /dev/null 2>&1 &'
-
-  # Wait for port-forward to be ready
-  timeout 30 sh -ec 'until nc -z localhost 8333; do sleep 1; done'
-
-  # Set up MinIO alias with error handling
-  mc alias set local https://localhost:8333 $ACCESS_KEY $SECRET_KEY --insecure
-
-  # Upload file to bucket
-  mc cp bucket-test-credentials.json $BUCKET_NAME/bucket-test-credentials.json
-
-  # Verify file was uploaded
-  mc ls $BUCKET_NAME/bucket-test-credentials.json
-
-  # Clean up uploaded file
-  mc rm $BUCKET_NAME/bucket-test-credentials.json
-
-  kubectl -n tenant-test delete bucket.apps.cozystack.io ${name}
-}
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -123,10 +123,10 @@ EOF

@test "Configure Tenant and wait for applications" {
  # Patch root tenant and wait for its releases
-  kubectl patch tenants/root -n tenant-root --type merge -p '{"spec":{"host":"example.org","ingress":true,"monitoring":true,"etcd":true,"isolated":true, "seaweedfs": true}}'
+  kubectl patch tenants/root -n tenant-root --type merge -p '{"spec":{"host":"example.org","ingress":true,"monitoring":true,"etcd":true,"isolated":true}}'

-  timeout 60 sh -ec 'until kubectl get hr -n tenant-root etcd ingress monitoring seaweedfs tenant-root >/dev/null 2>&1; do sleep 1; done'
-  kubectl wait hr/etcd hr/ingress hr/tenant-root hr/seaweedfs -n tenant-root --timeout=4m --for=condition=ready
+  timeout 60 sh -ec 'until kubectl get hr -n tenant-root etcd ingress monitoring tenant-root >/dev/null 2>&1; do sleep 1; done'
+  kubectl wait hr/etcd hr/ingress hr/tenant-root -n tenant-root --timeout=2m --for=condition=ready

  if ! kubectl wait hr/monitoring -n tenant-root --timeout=2m --for=condition=ready; then
    flux reconcile hr monitoring -n tenant-root --force
--- a/hack/update-codegen.sh
+++ b/hack/update-codegen.sh
@@ -32,10 +32,6 @@ kube::codegen::gen_helpers \
    --boilerplate "${SCRIPT_ROOT}/hack/boilerplate.go.txt" \
    "${SCRIPT_ROOT}/pkg/apis"

-kube::codegen::gen_helpers \
-    --boilerplate "${SCRIPT_ROOT}/hack/boilerplate.go.txt" \
-    "${SCRIPT_ROOT}/api"
-
 if [[ -n "${API_KNOWN_VIOLATIONS_DIR:-}" ]]; then
    report_filename="${API_KNOWN_VIOLATIONS_DIR}/cozystack_api_violation_exceptions.list"
    if [[ "${UPDATE_API_KNOWN_VIOLATIONS:-}" == "true" ]]; then
--- a/packages/apps/http-cache/images/nginx-cache.tag
+++ b/packages/apps/http-cache/images/nginx-cache.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/nginx-cache:0.6.1@sha256:b7633717cd7449c0042ae92d8ca9b36e4d69566561f5c7d44e21058e7d05c6d5
+ghcr.io/cozystack/cozystack/nginx-cache:0.6.1@sha256:e0a07082bb6fc6aeaae2315f335386f1705a646c72f9e0af512aebbca5cb2b15
--- a/packages/apps/kubernetes/Chart.yaml
+++ b/packages/apps/kubernetes/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.26.3
+version: 0.26.1

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/kubernetes/images/cluster-autoscaler.tag
+++ b/packages/apps/kubernetes/images/cluster-autoscaler.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/cluster-autoscaler:0.26.2@sha256:3a8170433e1632e5cc2b6d9db34d0605e8e6c63c158282c38450415e700e932e
+ghcr.io/cozystack/cozystack/cluster-autoscaler:0.26.0@sha256:3a8170433e1632e5cc2b6d9db34d0605e8e6c63c158282c38450415e700e932e
--- a/packages/apps/kubernetes/images/kubevirt-cloud-provider.tag
+++ b/packages/apps/kubernetes/images/kubevirt-cloud-provider.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-cloud-provider:0.26.2@sha256:5335c044313b69ee13b30ca4941687e509005e55f4ae25723861edbf2fbd6dd2
+ghcr.io/cozystack/cozystack/kubevirt-cloud-provider:0.26.0@sha256:49843a0b670eab061627e48df338b2b8bc9f577dc2cfd4c2ed4071e02e64b424
--- a/packages/apps/kubernetes/images/kubevirt-cloud-provider/Dockerfile
+++ b/packages/apps/kubernetes/images/kubevirt-cloud-provider/Dockerfile
@@ -21,6 +21,6 @@ RUN go mod vendor

 RUN CGO_ENABLED=0 go build -mod=vendor -ldflags="-s -w" -o bin/kubevirt-cloud-controller-manager ./cmd/kubevirt-cloud-controller-manager

-FROM scratch
+FROM registry.access.redhat.com/ubi9/ubi-micro
 COPY --from=builder /go/src/kubevirt.io/cloud-provider-kubevirt/bin/kubevirt-cloud-controller-manager /bin/kubevirt-cloud-controller-manager
 ENTRYPOINT [ "/bin/kubevirt-cloud-controller-manager" ]
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.26.2@sha256:761e7235ff9cb7f6f223f00954943e6a5af32ed6624ee592a8610122f96febb0
+ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.26.0@sha256:445c2727b04ac68595b43c988ff17b3d69a7b22b0644fde3b10c65b47a7bc036
--- a/packages/apps/kubernetes/templates/helmreleases/csi.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/csi.yaml
@@ -35,8 +35,6 @@ spec:
    storageClass: "{{ . }}"
  {{- end }}
  dependsOn:
-  - name: {{ .Release.Name }}-vsnap-crd
-    namespace: {{ .Release.Namespace }}
  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
  - name: {{ .Release.Name }}
    namespace: {{ .Release.Namespace }}
--- a/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml
@@ -4,7 +4,6 @@
 {{- $myNS := lookup "v1" "Namespace" "" .Release.Namespace }}
 {{- $targetTenant := index $myNS.metadata.annotations "namespace.cozystack.io/monitoring" }}
 vertical-pod-autoscaler:
-  vpaForVPA: false
  recommender:
    extraArgs:
      container-name-label: container
--- a/packages/apps/kubernetes/templates/helmreleases/volumesnapshot_crd.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/volumesnapshot_crd.yaml
@@ -1,16 +1,16 @@
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
-  name: {{ .Release.Name }}-vsnap-crd
+  name: {{ .Release.Name }}-volumesnapshot-crd-for-tenant-k8s
  labels:
    cozystack.io/repository: system
    cozystack.io/target-cluster-name: {{ .Release.Name }}
 spec:
  interval: 5m
-  releaseName: vsnap-crd
+  releaseName: volumesnapshot-crd-for-tenant-k8s
  chart:
    spec:
-      chart: cozy-vsnap-crd
+      chart: cozy-volumesnapshot-crd-for-tenant-k8s
      reconcileStrategy: Revision
      sourceRef:
        kind: HelmRepository
@@ -21,8 +21,8 @@ spec:
    secretRef:
      name: {{ .Release.Name }}-admin-kubeconfig
      key: super-admin.svc
-  targetNamespace: cozy-vsnap-crd
-  storageNamespace: cozy-vsnap-crd
+  targetNamespace: cozy-volumesnapshot-crd-for-tenant-k8s
+  storageNamespace: cozy-volumesnapshot-crd-for-tenant-k8s
  install:
    createNamespace: true
    remediation:
--- a/packages/apps/kubernetes/values.yaml
+++ b/packages/apps/kubernetes/values.yaml
@@ -10,25 +10,25 @@ version: "v1.32"
 host: ""
 ## @param nodeGroups [object] Worker nodes configuration (see example)
 ##
-nodeGroups:
-  md0:
-    minReplicas: 0
-    maxReplicas: 10
-    instanceType: "u1.medium"
-    ephemeralStorage: 20Gi
-    roles:
-    - ingress-nginx
-
-    resources:
-      cpu: ""
-      memory: ""
-
-    ## List of GPUs to attach (WARN: NVIDIA driver requires at least 4 GiB of RAM)
-    ## e.g:
-    ## instanceType: "u1.xlarge"
-    ## gpus:
-    ## - name: nvidia.com/AD102GL_L40S
-    gpus: []
+nodeGroups: {}
+#   md0:
+#     minReplicas: 0
+#     maxReplicas: 10
+#     instanceType: "u1.medium"
+#     ephemeralStorage: 20Gi
+#     roles:
+#     - ingress-nginx
+# 
+#     resources:
+#       cpu: ""
+#       memory: ""
+# 
+#     ## List of GPUs to attach (WARN: NVIDIA driver requires at least 4 GiB of RAM)
+#     ## e.g:
+#     ## instanceType: "u1.xlarge"
+#     ## gpus:
+#     ## - name: nvidia.com/AD102GL_L40S
+#     gpus: []


 ## @section Cluster Addons
--- a/packages/apps/versions_map
+++ b/packages/apps/versions_map
@@ -61,10 +61,8 @@ kubernetes 0.24.0 62cb694d
 kubernetes 0.25.0 70f82667
 kubernetes 0.25.1 acd4663a
 kubernetes 0.25.2 08cb7c0f
-kubernetes 0.26.0 9584e5f5
-kubernetes 0.26.1 0e47e1e8
-kubernetes 0.26.2 8ddbe32e
-kubernetes 0.26.3 HEAD
+kubernetes 0.26.0 68a47097
+kubernetes 0.26.1 HEAD
 mysql 0.1.0 263e47be
 mysql 0.2.0 c24a103f
 mysql 0.3.0 53f2365e
@@ -175,8 +173,7 @@ virtual-machine 0.10.2 632224a3
 virtual-machine 0.11.0 4369b031
 virtual-machine 0.12.0 acd4663a
 virtual-machine 0.12.1 909208ba
-virtual-machine 0.12.2 8ddbe32e
-virtual-machine 0.12.3 HEAD
+virtual-machine 0.12.2 HEAD
 vm-disk 0.1.0 d971f2ff
 vm-disk 0.1.1 6130f43d
 vm-disk 0.1.2 632224a3
@@ -195,8 +192,7 @@ vm-instance 0.7.2 632224a3
 vm-instance 0.8.0 4369b031
 vm-instance 0.9.0 acd4663a
 vm-instance 0.10.0 909208ba
-vm-instance 0.10.1 8ddbe32e
-vm-instance 0.10.2 HEAD
+vm-instance 0.10.1 HEAD
 vpn 0.1.0 263e47be
 vpn 0.2.0 53f2365e
 vpn 0.3.0 6c5cf5bf
--- a/packages/apps/virtual-machine/Chart.yaml
+++ b/packages/apps/virtual-machine/Chart.yaml
@@ -17,7 +17,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.12.3
+version: 0.12.2

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/virtual-machine/Makefile
+++ b/packages/apps/virtual-machine/Makefile
@@ -3,10 +3,10 @@ include ../../../scripts/package.mk
 generate:
 	readme-generator-for-helm -v values.yaml -s values.schema.json -r README.md
 	yq -o json -i '.properties.gpus.items.type = "object" | .properties.gpus.default = []' values.schema.json
-	# INSTANCE_TYPES=$$(yq e '.metadata.name' -o=json -r ../../system/kubevirt-instancetypes/templates/instancetypes.yaml | yq 'split(" ") | . + [""]' -o json) \
-	#  && yq -i -o json ".properties.instanceType.enum = $${INSTANCE_TYPES}" values.schema.json
+	INSTANCE_TYPES=$$(yq e '.metadata.name' -o=json -r ../../system/kubevirt-instancetypes/templates/instancetypes.yaml | yq 'split(" ") | . + [""]' -o json) \
+	  && yq -i -o json ".properties.instanceType.optional=true | .properties.instanceType.enum = $${INSTANCE_TYPES}" values.schema.json
 	PREFERENCES=$$(yq e '.metadata.name' -o=json -r ../../system/kubevirt-instancetypes/templates/preferences.yaml | yq 'split(" ") | . + [""]' -o json) \
-	  && yq -i -o json ".properties.instanceProfile.enum = $${PREFERENCES}" values.schema.json
+	  && yq -i -o json ".properties.instanceProfile.optional=true | .properties.instanceProfile.enum = $${PREFERENCES}" values.schema.json
 	yq -i -o json '.properties.externalPorts.items.type = "integer"' values.schema.json
 	yq -i -o json '.properties.systemDisk.properties.image.enum = ["ubuntu", "cirros", "alpine", "fedora", "talos"]' values.schema.json
 	yq -i -o json '.properties.externalMethod.enum = ["PortList", "WholeIP"]' values.schema.json
--- a/packages/apps/virtual-machine/values.schema.json
+++ b/packages/apps/virtual-machine/values.schema.json
@@ -44,6 +44,7 @@
      "default": "ubuntu",
      "description": "Virtual Machine preferences profile",
      "type": "string",
+      "optional": true,
      "enum": [
        "alpine",
        "centos.7",
@@ -93,7 +94,59 @@
    "instanceType": {
      "default": "u1.medium",
      "description": "Virtual Machine instance type",
-      "type": "string"
+      "type": "string",
+      "optional": true,
+      "enum": [
+        "cx1.2xlarge",
+        "cx1.4xlarge",
+        "cx1.8xlarge",
+        "cx1.large",
+        "cx1.medium",
+        "cx1.xlarge",
+        "gn1.2xlarge",
+        "gn1.4xlarge",
+        "gn1.8xlarge",
+        "gn1.xlarge",
+        "m1.2xlarge",
+        "m1.4xlarge",
+        "m1.8xlarge",
+        "m1.large",
+        "m1.xlarge",
+        "n1.2xlarge",
+        "n1.4xlarge",
+        "n1.8xlarge",
+        "n1.large",
+        "n1.medium",
+        "n1.xlarge",
+        "o1.2xlarge",
+        "o1.4xlarge",
+        "o1.8xlarge",
+        "o1.large",
+        "o1.medium",
+        "o1.micro",
+        "o1.nano",
+        "o1.small",
+        "o1.xlarge",
+        "rt1.2xlarge",
+        "rt1.4xlarge",
+        "rt1.8xlarge",
+        "rt1.large",
+        "rt1.medium",
+        "rt1.micro",
+        "rt1.small",
+        "rt1.xlarge",
+        "u1.2xlarge",
+        "u1.2xmedium",
+        "u1.4xlarge",
+        "u1.8xlarge",
+        "u1.large",
+        "u1.medium",
+        "u1.micro",
+        "u1.nano",
+        "u1.small",
+        "u1.xlarge",
+        ""
+      ]
    },
    "resources": {
      "properties": {
--- a/packages/apps/vm-instance/Chart.yaml
+++ b/packages/apps/vm-instance/Chart.yaml
@@ -17,7 +17,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.10.2
+version: 0.10.1

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/vm-instance/Makefile
+++ b/packages/apps/vm-instance/Makefile
@@ -4,9 +4,9 @@ generate:
 	readme-generator-for-helm -v values.yaml -s values.schema.json -r README.md
 	yq -o json -i '.properties.disks.items.type = "object" | .properties.disks.default = []' values.schema.json
 	yq -o json -i '.properties.gpus.items.type = "object" | .properties.gpus.default = []' values.schema.json
-	#INSTANCE_TYPES=$$(yq e '.metadata.name' -o=json -r ../../system/kubevirt-instancetypes/templates/instancetypes.yaml | yq 'split(" ") | . + [""]' -o json) \
-	#  && yq -i -o json ".properties.instanceType.enum = $${INSTANCE_TYPES}" values.schema.json
+	INSTANCE_TYPES=$$(yq e '.metadata.name' -o=json -r ../../system/kubevirt-instancetypes/templates/instancetypes.yaml | yq 'split(" ") | . + [""]' -o json) \
+	  && yq -i -o json ".properties.instanceType.optional=true | .properties.instanceType.enum = $${INSTANCE_TYPES}" values.schema.json
 	PREFERENCES=$$(yq e '.metadata.name' -o=json -r ../../system/kubevirt-instancetypes/templates/preferences.yaml | yq 'split(" ") | . + [""]' -o json) \
-	  && yq -i -o json ".properties.instanceProfile.enum = $${PREFERENCES}" values.schema.json
+	  && yq -i -o json ".properties.instanceProfile.optional=true | .properties.instanceProfile.enum = $${PREFERENCES}" values.schema.json
 	yq -i -o json '.properties.externalPorts.items.type = "integer"' values.schema.json
 	yq -i -o json '.properties.externalMethod.enum = ["PortList", "WholeIP"]' values.schema.json
--- a/packages/apps/vm-instance/values.schema.json
+++ b/packages/apps/vm-instance/values.schema.json
@@ -52,6 +52,7 @@
      "default": "ubuntu",
      "description": "Virtual Machine preferences profile",
      "type": "string",
+      "optional": true,
      "enum": [
        "alpine",
        "centos.7",
@@ -101,7 +102,59 @@
    "instanceType": {
      "default": "u1.medium",
      "description": "Virtual Machine instance type",
-      "type": "string"
+      "type": "string",
+      "optional": true,
+      "enum": [
+        "cx1.2xlarge",
+        "cx1.4xlarge",
+        "cx1.8xlarge",
+        "cx1.large",
+        "cx1.medium",
+        "cx1.xlarge",
+        "gn1.2xlarge",
+        "gn1.4xlarge",
+        "gn1.8xlarge",
+        "gn1.xlarge",
+        "m1.2xlarge",
+        "m1.4xlarge",
+        "m1.8xlarge",
+        "m1.large",
+        "m1.xlarge",
+        "n1.2xlarge",
+        "n1.4xlarge",
+        "n1.8xlarge",
+        "n1.large",
+        "n1.medium",
+        "n1.xlarge",
+        "o1.2xlarge",
+        "o1.4xlarge",
+        "o1.8xlarge",
+        "o1.large",
+        "o1.medium",
+        "o1.micro",
+        "o1.nano",
+        "o1.small",
+        "o1.xlarge",
+        "rt1.2xlarge",
+        "rt1.4xlarge",
+        "rt1.8xlarge",
+        "rt1.large",
+        "rt1.medium",
+        "rt1.micro",
+        "rt1.small",
+        "rt1.xlarge",
+        "u1.2xlarge",
+        "u1.2xmedium",
+        "u1.4xlarge",
+        "u1.8xlarge",
+        "u1.large",
+        "u1.medium",
+        "u1.micro",
+        "u1.nano",
+        "u1.small",
+        "u1.xlarge",
+        ""
+      ]
    },
    "resources": {
      "properties": {
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -1,2 +1,2 @@
 cozystack:
-  image: ghcr.io/cozystack/cozystack/installer:v0.35.0-alpha.3@sha256:b43615350697dbbc377d31152b290722c2bba7a053fd7c69403d666e6c7d53ee
+  image: ghcr.io/cozystack/cozystack/installer:v0.35.0-alpha.1@sha256:c50451e26a1a2a9f8962e26f6ab668b71b95186f53c1ae84118733e2cd464293
--- a/packages/core/testing/images/e2e-sandbox/Dockerfile
+++ b/packages/core/testing/images/e2e-sandbox/Dockerfile
@@ -19,7 +19,6 @@ RUN curl -sSL "https://github.com/mikefarah/yq/releases/download/v4.44.3/yq_${TA
 && chmod +x /usr/local/bin/yq
 RUN curl -sSL "https://fluxcd.io/install.sh" | bash
 RUN curl -sSL "https://github.com/cozystack/cozypkg/raw/refs/heads/main/hack/install.sh" | sh -s -- -v "${COZYPKG_VERSION}"
-RUN curl https://dl.min.io/client/mc/release/${TARGETOS}-${TARGETARCH}/mc --create-dirs -o  /usr/local/bin/mc \
-&& chmod +x /usr/local/bin/mc
+
 COPY entrypoint.sh /usr/local/bin/entrypoint.sh
 ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
--- a/packages/core/testing/values.yaml
+++ b/packages/core/testing/values.yaml
@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v0.35.0-alpha.3@sha256:cd6d65230150171c0e3934f71fcc270718f2bfec7509989b9d4d996ddef916d9
+  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v0.35.0-alpha.1@sha256:ea73a2aeeac810be8eaee636aba6d6d10051772297ee76b6ce28a2aa7aa6a7f4
--- a/packages/extra/bootbox/images/matchbox.tag
+++ b/packages/extra/bootbox/images/matchbox.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/matchbox:v0.35.0-alpha.3@sha256:043051d7c368b73943051b51bacfb3e383541b53190f74452d552ea2f30e420e
+ghcr.io/cozystack/cozystack/matchbox:v0.35.0-alpha.1@sha256:103e7c66ba47caee2126eca2d4b40e67041d4a3e6b729945b4dfc55decda74e7
--- a/packages/extra/monitoring/Chart.yaml
+++ b/packages/extra/monitoring/Chart.yaml
@@ -3,4 +3,4 @@ name: monitoring
 description: Monitoring and observability stack
 icon: /logos/monitoring.svg
 type: application
-version: 1.12.1
+version: 1.12.0
--- a/packages/extra/monitoring/dashboards.list
+++ b/packages/extra/monitoring/dashboards.list
@@ -37,5 +37,4 @@ flux/flux-stats
 kafka/strimzi-kafka
 goldpinger/goldpinger
 clickhouse/altinity-clickhouse-operator-dashboard
-storage/linstor
-seaweedfs/seaweedfs
+storage/linstor
--- a/packages/extra/monitoring/images/grafana.tag
+++ b/packages/extra/monitoring/images/grafana.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/grafana:1.12.1@sha256:c63978e1ed0304e8518b31ddee56c4e8115541b997d8efbe1c0a74da57140399
+ghcr.io/cozystack/cozystack/grafana:1.12.0@sha256:c63978e1ed0304e8518b31ddee56c4e8115541b997d8efbe1c0a74da57140399
--- a/packages/extra/seaweedfs/Chart.yaml
+++ b/packages/extra/seaweedfs/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.6.0
+version: 0.5.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/extra/seaweedfs/README.md
+++ b/packages/extra/seaweedfs/README.md
@@ -4,15 +4,14 @@

 ### Common parameters

-| Name                | Description                                                                                            | Value    |
-| ------------------- | ------------------------------------------------------------------------------------------------------ | -------- |
-| `host`              | The hostname used to access the SeaweedFS externally (defaults to 's3' subdomain for the tenant host). | `""`     |
-| `topology`          | The topology of the SeaweedFS cluster. (allowed values: Simple, MultiZone, Client)                     | `Simple` |
-| `replicationFactor` | The number of replicas for each volume in the SeaweedFS cluster.                                       | `2`      |
-| `replicas`          | Persistent Volume size for SeaweedFS                                                                   | `2`      |
-| `size`              | Persistent Volume size                                                                                 | `10Gi`   |
-| `storageClass`      | StorageClass used to store the data                                                                    | `""`     |
-| `zones`             | A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.         | `{}`     |
-| `filer.grpcHost`    | The hostname used to expose or access the filer service externally.                                    | `""`     |
-| `filer.grpcPort`    | The port used to access the filer service externally.                                                  | `443`    |
-| `filer.whitelist`   | A list of IP addresses or CIDR ranges that are allowed to access the filer service.                    | `[]`     |
+| Name                | Description                                                                                                              | Value           |
+| ------------------- | ------------------------------------------------------------------------------------------------------------------------ | --------------- |
+| `host`              | The hostname used to access the SeaweedFS externally (defaults to 's3' subdomain for the tenant host).                   | `""`            |
+| `topology`          | The topology of the SeaweedFS cluster. (allowed values: Simple, MultiZone, Client)                                       | `Simple`        |
+| `replicationFactor` | The number of replicas for each volume in the SeaweedFS cluster.                                                         | `2`             |
+| `replicas`          | Persistent Volume size for SeaweedFS                                                                                     | `2`             |
+| `size`              | Persistent Volume size                                                                                                   | `10Gi`          |
+| `storageClass`      | StorageClass used to store the data                                                                                      | `""`            |
+| `zones`             | A map of zones for MultiZone topology. Each zone can have its own number of replicas and size.                           | `{}`            |
+| `filer.external`    | Enable external access to the SeaweedFS filer from outside the cluster. Use this when `topology` is not set to `Client`. | `false`         |
+| `remoteEndpoint`    | The endpoint of the remote filer GRPC service. Used when `topology` is set to `Client`.                                  | `1.2.3.4:18888` |
--- a/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
+++ b/packages/extra/seaweedfs/images/objectstorage-sidecar.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/objectstorage-sidecar:v0.35.0-alpha.3@sha256:4a67ec40c13bf912151957dc0e7409f7e01a2859905285c98c20baae7b667ae2
+ghcr.io/cozystack/cozystack/objectstorage-sidecar:v0.35.0-alpha.1@sha256:e4f9a7302285ea9febeb28fc2fa97cb7c01bb91e602f975c31aad1fe46f778f7
--- a/packages/extra/seaweedfs/images/seaweedfs-cosi-driver.tag
+++ b/packages/extra/seaweedfs/images/seaweedfs-cosi-driver.tag
@@ -1 +0,0 @@
-ghcr.io/seaweedfs/seaweedfs-cosi-driver:v0.2.0
--- a/packages/extra/seaweedfs/templates/external/cosi-bucket-class.yaml
+++ b/packages/extra/seaweedfs/templates/external/cosi-bucket-class.yaml
--- a/packages/extra/seaweedfs/templates/external/cosi-cluster-role.yaml
+++ b/packages/extra/seaweedfs/templates/external/cosi-cluster-role.yaml
--- a/packages/extra/seaweedfs/templates/external/cosi-deployment.yaml
+++ b/packages/extra/seaweedfs/templates/external/cosi-deployment.yaml
@@ -35,7 +35,7 @@ spec:
    spec:
      containers:
      - name: seaweedfs-cosi-driver
-        image: "{{ $.Files.Get "images/seaweedfs-cosi-driver.tag" | trim }}"
+        image: ghcr.io/seaweedfs/seaweedfs-cosi-driver:v0.1.2
        imagePullPolicy: IfNotPresent
        env:
        - name: DRIVERNAME
@@ -43,7 +43,7 @@ spec:
        - name: ENDPOINT
          value: https://{{ .Values.host | default (printf "s3.%s" $host) }}
        - name: SEAWEEDFS_FILER
-          value: "{{ .Values.filer.grpcHost }}:{{ .Values.filer.grpcPort }}"
+          value: {{ .Values.remoteEndpoint }}
        - name: WEED_GRPC_CLIENT_KEY
          value: /usr/local/share/ca-certificates/client/tls.key
        - name: WEED_GRPC_CLIENT_CERT
--- a/packages/extra/seaweedfs/templates/external/cosi-service-account.yaml
+++ b/packages/extra/seaweedfs/templates/external/cosi-service-account.yaml
--- a/packages/extra/seaweedfs/templates/ingress.yaml
+++ b/packages/extra/seaweedfs/templates/ingress.yaml
@@ -1,44 +0,0 @@
-{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
-{{- $issuerType := (index $cozyConfig.data "clusterissuer") | default "http01" }}
-
-{{- $myNS := lookup "v1" "Namespace" "" .Release.Namespace }}
-{{- $ingress := index $myNS.metadata.annotations "namespace.cozystack.io/ingress" }}
-{{- $host := index $myNS.metadata.annotations "namespace.cozystack.io/host" }}
-{{- if and (not (eq .Values.topology "Client")) (.Values.filer.grpcHost) }}
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    nginx.ingress.kubernetes.io/backend-protocol: GRPCS
-    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-    nginx.ingress.kubernetes.io/whitelist-source-range: "{{ join "," (.Values.filer.whitelist | default "0.0.0.0/32") }}"
-  name: seaweedfs-filer-external
-spec:
-  ingressClassName: tenant-root
-  rules:
-  - host: {{ .Values.filer.grpcHost | default (printf "filer.%s" $host) }}
-    http:
-      paths:
-      - backend:
-          service:
-            name: {{ $.Release.Name }}-filer-external
-            port:
-              number: 18888
-        path: /
-        pathType: ImplementationSpecific
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ $.Release.Name }}-filer-external
-spec:
-  ports:
-  - name: swfs-filer-grpc
-    port: 18888
-    protocol: TCP
-    targetPort: 18888
-  selector:
-    app.kubernetes.io/component: filer
-    app.kubernetes.io/name: {{ $.Release.Name }}
-{{- end }}
--- a/packages/extra/seaweedfs/templates/seaweedfs.yaml
+++ b/packages/extra/seaweedfs/templates/seaweedfs.yaml
@@ -2,8 +2,8 @@
 {{- if not (has .Values.topology (list "Simple" "MultiZone" "Client")) }}
 {{-   fail "Invalid value for .Values.topology. Must be one of 'Simple', 'MultiZone' or 'Client'." }}
 {{- end }}
-{{- if and (eq .Values.topology "Client") (not .Values.filer.grpcHost) }}
-{{-   fail "When topology is 'Client', .Values.filer.grpcHost must be set to a valid remote filer GRPC service endpoint." }}
+{{- if and (eq .Values.topology "Client") (not .Values.remoteEndpoint) }}
+{{-   fail "When topology is 'Client', .Values.remoteEndpoint must be set to a valid remote filer GRPC service endpoint." }}
 {{- end }}
 {{- if lt (int .Values.replicationFactor) 1 }}
 {{-   fail "Invalid value for .Values.replicationFactor. Must be at least 1." }}
--- a/packages/extra/seaweedfs/templates/svc-external.yaml
+++ b/packages/extra/seaweedfs/templates/svc-external.yaml
@@ -0,0 +1,18 @@
+{{- if and (not (eq .Values.topology "Client")) (.Values.filer.external) }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $.Release.Name }}-filer-external
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+  ports:
+  - name: swfs-filer-grpc
+    port: 18888
+    protocol: TCP
+    targetPort: 18888
+  selector:
+    app.kubernetes.io/component: filer
+    app.kubernetes.io/name: {{ $.Release.Name }}
+{{- end }}
--- a/packages/extra/seaweedfs/values.schema.json
+++ b/packages/extra/seaweedfs/values.schema.json
@@ -2,21 +2,10 @@
  "properties": {
    "filer": {
      "properties": {
-        "grpcHost": {
-          "default": "",
-          "description": "The hostname used to expose or access the filer service externally.",
-          "type": "string"
-        },
-        "grpcPort": {
-          "default": 443,
-          "description": "The port used to access the filer service externally.",
-          "type": "number"
-        },
-        "whitelist": {
-          "default": [],
-          "description": "A list of IP addresses or CIDR ranges that are allowed to access the filer service.",
-          "items": {},
-          "type": "array"
+        "external": {
+          "default": false,
+          "description": "Enable external access to the SeaweedFS filer from outside the cluster. Use this when `topology` is not set to `Client`.",
+          "type": "boolean"
        }
      },
      "type": "object"
@@ -26,6 +15,11 @@
      "description": "The hostname used to access the SeaweedFS externally (defaults to 's3' subdomain for the tenant host).",
      "type": "string"
    },
+    "remoteEndpoint": {
+      "default": "1.2.3.4:18888",
+      "description": "The endpoint of the remote filer GRPC service. Used when `topology` is set to `Client`.",
+      "type": "string"
+    },
    "replicas": {
      "default": 2,
      "description": "Persistent Volume size for SeaweedFS",
--- a/packages/extra/seaweedfs/values.yaml
+++ b/packages/extra/seaweedfs/values.yaml
@@ -32,10 +32,9 @@ storageClass: ""
 ##     size: 10Gi
 zones: {}

-## @param filer.grpcHost The hostname used to expose or access the filer service externally.
-## @param filer.grpcPort The port used to access the filer service externally.
-## @param filer.whitelist A list of IP addresses or CIDR ranges that are allowed to access the filer service.
+## @param filer.external Enable external access to the SeaweedFS filer from outside the cluster. Use this when `topology` is not set to `Client`.
 filer:
-  grpcHost: ""
-  grpcPort: 443
-  whitelist: []
+  external: false
+
+## @param remoteEndpoint The endpoint of the remote filer GRPC service. Used when `topology` is set to `Client`.
+remoteEndpoint: "1.2.3.4:18888"
--- a/packages/extra/versions_map
+++ b/packages/extra/versions_map
@@ -47,13 +47,11 @@ monitoring 1.9.2 f9f8bb2f
 monitoring 1.10.0 632224a3
 monitoring 1.10.1 8c86905b
 monitoring 1.11.0 4369b031
-monitoring 1.12.0 0e47e1e8
-monitoring 1.12.1 HEAD
+monitoring 1.12.0 HEAD
 seaweedfs 0.1.0 71514249
 seaweedfs 0.2.0 5fb9cfe3
 seaweedfs 0.2.1 fde4bcfa
 seaweedfs 0.3.0 45a7416c
 seaweedfs 0.4.0 632224a3
 seaweedfs 0.4.1 8c86905b
-seaweedfs 0.5.0 9584e5f5
-seaweedfs 0.6.0 HEAD
+seaweedfs 0.5.0 HEAD
--- a/packages/system/bucket/images/s3manager.tag
+++ b/packages/system/bucket/images/s3manager.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/s3manager:v0.5.0@sha256:b39a00543d28cb72617bc50c7a9f873d65c3cd34114d9690cf044f7fac66c8da
+ghcr.io/cozystack/cozystack/s3manager:v0.5.0@sha256:34db8c950f14a3e2742b7c31bd3c6a1fe631c9b398caac611ed5cfdac5769d36
--- a/packages/system/cozystack-api/templates/configmap.yaml
+++ b/packages/system/cozystack-api/templates/configmap.yaml
@@ -0,0 +1,353 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cozystack-api
+  namespace: cozy-system
+data:
+  config.yaml: |
+    resources:
+    - application:
+        kind: Bucket
+        singular: bucket
+        plural: buckets
+        openAPISchema: {{ .Files.Get "openapi-schemas/bucket.json" | fromJson | toJson | quote }}
+      release:
+        prefix: bucket-
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: bucket
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-apps
+            namespace: cozy-public
+    - application:
+        kind: ClickHouse
+        singular: clickhouse
+        plural: clickhouses
+        openAPISchema: {{ .Files.Get "openapi-schemas/clickhouse.json" | fromJson | toJson | quote }}
+      release:
+        prefix: clickhouse-
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: clickhouse
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-apps
+            namespace: cozy-public
+    - application:
+        kind: HTTPCache
+        singular: httpcache
+        plural: httpcaches
+        openAPISchema: {{ .Files.Get "openapi-schemas/http-cache.json" | fromJson | toJson | quote }}
+      release:
+        prefix: http-cache-
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: http-cache
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-apps
+            namespace: cozy-public
+    - application:
+        kind: NATS
+        singular: nats
+        plural: natses
+        openAPISchema: {{ .Files.Get "openapi-schemas/nats.json" | fromJson | toJson | quote }}
+      release:
+        prefix: nats-
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: nats
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-apps
+            namespace: cozy-public
+    - application:
+        kind: TCPBalancer
+        singular: tcpbalancer
+        plural: tcpbalancers
+        openAPISchema: {{ .Files.Get "openapi-schemas/tcp-balancer.json" | fromJson | toJson | quote }}
+      release:
+        prefix: tcp-balancer-
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: tcp-balancer
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-apps
+            namespace: cozy-public
+    - application:
+        kind: VirtualMachine
+        singular: virtualmachine
+        plural: virtualmachines
+        openAPISchema: {{ .Files.Get "openapi-schemas/virtual-machine.json" | fromJson | toJson | quote }}
+      release:
+        prefix: virtual-machine-
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: virtual-machine
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-apps
+            namespace: cozy-public
+    - application:
+        kind: VPN
+        singular: vpn
+        plural: vpns
+        openAPISchema: {{ .Files.Get "openapi-schemas/vpn.json" | fromJson | toJson | quote }}
+      release:
+        prefix: vpn-
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: vpn
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-apps
+            namespace: cozy-public
+    - application:
+        kind: MySQL
+        singular: mysql
+        plural: mysqls
+        openAPISchema: {{ .Files.Get "openapi-schemas/mysql.json" | fromJson | toJson | quote }}
+      release:
+        prefix: mysql-
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: mysql
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-apps
+            namespace: cozy-public
+    - application:
+        kind: Tenant
+        singular: tenant
+        plural: tenants
+        openAPISchema: {{ .Files.Get "openapi-schemas/tenant.json" | fromJson | toJson | quote }}
+      release:
+        prefix: tenant-
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: tenant
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-apps
+            namespace: cozy-public
+    - application:
+        kind: Kubernetes
+        singular: kubernetes
+        plural: kuberneteses
+        openAPISchema: {{ .Files.Get "openapi-schemas/kubernetes.json" | fromJson | toJson | quote }}
+      release:
+        prefix: kubernetes-
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: kubernetes
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-apps
+            namespace: cozy-public
+    - application:
+        kind: Redis
+        singular: redis
+        plural: redises
+        openAPISchema: {{ .Files.Get "openapi-schemas/redis.json" | fromJson | toJson | quote }}
+      release:
+        prefix: redis-
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: redis
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-apps
+            namespace: cozy-public
+    - application:
+        kind: RabbitMQ
+        singular: rabbitmq
+        plural: rabbitmqs
+        openAPISchema: {{ .Files.Get "openapi-schemas/rabbitmq.json" | fromJson | toJson | quote }}
+      release:
+        prefix: rabbitmq-
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: rabbitmq
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-apps
+            namespace: cozy-public
+    - application:
+        kind: Postgres
+        singular: postgres
+        plural: postgreses
+        openAPISchema: {{ .Files.Get "openapi-schemas/postgres.json" | fromJson | toJson | quote }}
+      release:
+        prefix: postgres-
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: postgres
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-apps
+            namespace: cozy-public
+    - application:
+        kind: FerretDB
+        singular: ferretdb
+        plural: ferretdb
+        openAPISchema: {{ .Files.Get "openapi-schemas/ferretdb.json" | fromJson | toJson | quote }}
+      release:
+        prefix: ferretdb-
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: ferretdb
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-apps
+            namespace: cozy-public
+    - application:
+        kind: Kafka
+        singular: kafka
+        plural: kafkas
+        openAPISchema: {{ .Files.Get "openapi-schemas/kafka.json" | fromJson | toJson | quote }}
+      release:
+        prefix: kafka-
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: kafka
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-apps
+            namespace: cozy-public
+    - application:
+        kind: VMDisk
+        plural: vmdisks
+        singular: vmdisk
+        openAPISchema: {{ .Files.Get "openapi-schemas/vm-disk.json" | fromJson | toJson | quote }}
+      release:
+        prefix: vm-disk-
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: vm-disk
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-apps
+            namespace: cozy-public
+    - application:
+        kind: VMInstance
+        plural: vminstances
+        singular: vminstance
+        openAPISchema: {{ .Files.Get "openapi-schemas/vm-instance.json" | fromJson | toJson | quote }}
+      release:
+        prefix: vm-instance-
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: vm-instance
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-apps
+            namespace: cozy-public
+    - application:
+        kind: Monitoring
+        plural: monitorings
+        singular: monitoring
+        openAPISchema: {{ .Files.Get "openapi-schemas/monitoring.json" | fromJson | toJson | quote }}
+      release:
+        prefix: ""
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: monitoring
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-extra
+            namespace: cozy-public
+    - application:
+        kind: Etcd
+        plural: etcds
+        singular: etcd
+        openAPISchema: {{ .Files.Get "openapi-schemas/etcd.json" | fromJson | toJson | quote }}
+      release:
+        prefix: ""
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: etcd
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-extra
+            namespace: cozy-public
+    - application:
+        kind: Ingress
+        plural: ingresses
+        singular: ingress
+        openAPISchema: {{ .Files.Get "openapi-schemas/ingress.json" | fromJson | toJson | quote }}
+      release:
+        prefix: ""
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: ingress
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-extra
+            namespace: cozy-public
+    - application:
+        kind: SeaweedFS
+        plural: seaweedfses
+        singular: seaweedfs
+        openAPISchema: {{ .Files.Get "openapi-schemas/seaweedfs.json" | fromJson | toJson | quote }}
+      release:
+        prefix: ""
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: seaweedfs
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-extra
+            namespace: cozy-public
+    - application:
+        kind: BootBox
+        plural: bootboxes
+        singular: bootbox
+        openAPISchema: {{ .Files.Get "openapi-schemas/bootbox.json" | fromJson | toJson | quote }}
+      release:
+        prefix: ""
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: bootbox
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-extra
+            namespace: cozy-public
+    - application:
+        kind: Info
+        plural: infos
+        singular: info
+        openAPISchema: {{ .Files.Get "openapi-schemas/info.json" | fromJson | toJson | quote }}
+      release:
+        prefix: ""
+        labels:
+          cozystack.io/ui: "true"
+        chart:
+          name: info
+          sourceRef:
+            kind: HelmRepository
+            name: cozystack-extra
+            namespace: cozy-public
--- a/packages/system/cozystack-api/templates/cozystack-resource-definitions.yaml
+++ b/packages/system/cozystack-api/templates/cozystack-resource-definitions.yaml
@@ -1,505 +0,0 @@
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: bucket
-spec:
-  application:
-    kind: Bucket
-    singular: bucket
-    plural: buckets
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/bucket.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: bucket-
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: bucket
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-apps
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: clickhouse
-spec:
-  application:
-    kind: ClickHouse
-    singular: clickhouse
-    plural: clickhouses
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/clickhouse.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: clickhouse-
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: clickhouse
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-apps
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: httpcache
-spec:
-  application:
-    kind: HTTPCache
-    singular: httpcache
-    plural: httpcaches
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/http-cache.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: http-cache-
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: http-cache
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-apps
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: nats
-spec:
-  application:
-    kind: NATS
-    singular: nats
-    plural: natses
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/nats.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: nats-
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: nats
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-apps
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: tcpbalancer
-spec:
-  application:
-    kind: TCPBalancer
-    singular: tcpbalancer
-    plural: tcpbalancers
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/tcp-balancer.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: tcp-balancer-
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: tcp-balancer
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-apps
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: virtualmachine
-spec:
-  application:
-    kind: VirtualMachine
-    singular: virtualmachine
-    plural: virtualmachines
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/virtual-machine.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: virtual-machine-
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: virtual-machine
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-apps
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: vpn
-spec:
-  application:
-    kind: VPN
-    singular: vpn
-    plural: vpns
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/vpn.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: vpn-
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: vpn
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-apps
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: mysql
-spec:
-  application:
-    kind: MySQL
-    singular: mysql
-    plural: mysqls
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/mysql.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: mysql-
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: mysql
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-apps
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: tenant
-spec:
-  application:
-    kind: Tenant
-    singular: tenant
-    plural: tenants
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/tenant.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: tenant-
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: tenant
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-apps
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: kubernetes
-spec:
-  application:
-    kind: Kubernetes
-    singular: kubernetes
-    plural: kuberneteses
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/kubernetes.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: kubernetes-
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: kubernetes
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-apps
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: redis
-spec:
-  application:
-    kind: Redis
-    singular: redis
-    plural: redises
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/redis.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: redis-
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: redis
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-apps
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: rabbitmq
-spec:
-  application:
-    kind: RabbitMQ
-    singular: rabbitmq
-    plural: rabbitmqs
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/rabbitmq.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: rabbitmq-
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: rabbitmq
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-apps
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: postgres
-spec:
-  application:
-    kind: Postgres
-    singular: postgres
-    plural: postgreses
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/postgres.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: postgres-
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: postgres
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-apps
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: ferretdb
-spec:
-  application:
-    kind: FerretDB
-    singular: ferretdb
-    plural: ferretdbs
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/ferretdb.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: ferretdb-
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: ferretdb
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-apps
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: kafka
-spec:
-  application:
-    kind: Kafka
-    singular: kafka
-    plural: kafkas
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/kafka.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: kafka-
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: kafka
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-apps
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: vmdisk
-spec:
-  application:
-    kind: VMDisk
-    singular: vmdisk
-    plural: vmdisks
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/vm-disk.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: vm-disk-
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: vm-disk
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-apps
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: vminstance
-spec:
-  application:
-    kind: VMInstance
-    singular: vminstance
-    plural: vminstances
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/vm-instance.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: vm-instance-
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: vm-instance
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-apps
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: monitoring
-spec:
-  application:
-    kind: Monitoring
-    singular: monitoring
-    plural: monitorings
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/monitoring.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: ""
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: monitoring
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-extra
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: etcd
-spec:
-  application:
-    kind: Etcd
-    singular: etcd
-    plural: etcds
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/etcd.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: ""
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: etcd
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-extra
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: ingress
-spec:
-  application:
-    kind: Ingress
-    singular: ingress
-    plural: ingresses
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/ingress.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: ""
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: ingress
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-extra
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: seaweedfs
-spec:
-  application:
-    kind: SeaweedFS
-    singular: seaweedfs
-    plural: seaweedfses
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/seaweedfs.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: ""
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: seaweedfs
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-extra
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: bootbox
-spec:
-  application:
-    kind: BootBox
-    singular: bootbox
-    plural: bootboxes
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/bootbox.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: ""
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: bootbox
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-extra
-        namespace: cozy-public
---
-apiVersion: cozystack.io/v1alpha1
-kind: CozystackResourceDefinition
-metadata:
-  name: info
-spec:
-  application:
-    kind: Info
-    singular: info
-    plural: infos
-    openAPISchema: |
-      {{- .Files.Get "openapi-schemas/info.json" | fromJson | toJson | nindent 6 }}
-  release:
-    prefix: ""
-    labels:
-      cozystack.io/ui: "true"
-    chart:
-      name: info
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-extra
-        namespace: cozy-public
--- a/packages/system/cozystack-api/templates/deployment.yaml
+++ b/packages/system/cozystack-api/templates/deployment.yaml
@@ -14,8 +14,22 @@ spec:
    metadata:
      labels:
        app: cozystack-api
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
    spec:
      serviceAccountName: cozystack-api
      containers:
      - name: cozystack-api
        image: "{{ .Values.cozystackAPI.image }}"
+        args: ["--config=/config/config.yaml"]
+        volumeMounts:
+        - name: config-volume
+          mountPath: /config/config.yaml
+          subPath: config.yaml
+      volumes:
+      - name: config-volume
+        configMap:
+          name: cozystack-api
+          items:
+          - key: config.yaml
+            path: config.yaml
--- a/packages/system/cozystack-api/templates/rbac.yaml
+++ b/packages/system/cozystack-api/templates/rbac.yaml
@@ -10,11 +10,8 @@ rules:
  resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations", "validatingadmissionpolicies", "validatingadmissionpolicybindings"]
  verbs: ["get", "watch", "list"]
 - apiGroups: ["flowcontrol.apiserver.k8s.io"]
-  resources: ["prioritylevelconfigurations", "flowschemas"]
-  verbs: ["list", "watch"]
- apiGroups: ["cozystack.io"]
-  resources: ["*"]
-  verbs: ["get", "watch", "list"]
- apiGroups: ["helm.toolkit.fluxcd.io"]
-  resources: ["*"]
-  verbs: ["*"]
+  resources: ['prioritylevelconfigurations', 'flowschemas']
+  verbs: ['list', 'watch']
+- apiGroups: ['helm.toolkit.fluxcd.io']
+  resources: ['*']
+  verbs: ['*']
--- a/packages/system/cozystack-api/values.yaml
+++ b/packages/system/cozystack-api/values.yaml
@@ -1,2 +1,2 @@
 cozystackAPI:
-  image: ghcr.io/cozystack/cozystack/cozystack-api:v0.35.0-alpha.3@sha256:d4cfc2afacc30d383f7b5454e97bb77f2e9bfc33dbc3dc512bfe671300e3ad51
+  image: ghcr.io/cozystack/cozystack/cozystack-api:v0.35.0-alpha.1@sha256:677b5af99f2b7d1adb4c25d5637f2fa5a1baffb423269fa166d2ea15a0028864
--- a/packages/system/cozystack-controller/templates/crds/cozystack.io_cozystackresourcedefinitions.yaml
+++ b/packages/system/cozystack-controller/templates/crds/cozystack.io_cozystackresourcedefinitions.yaml
@@ -1,115 +0,0 @@
---
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.16.4
-  name: cozystackresourcedefinitions.cozystack.io
-spec:
-  group: cozystack.io
-  names:
-    kind: CozystackResourceDefinition
-    listKind: CozystackResourceDefinitionList
-    plural: cozystackresourcedefinitions
-    singular: cozystackresourcedefinition
-  scope: Namespaced
-  versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: CozystackResourceDefinition is the Schema for the cozystackresourcedefinitions
-          API
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            properties:
-              application:
-                description: Application configuration
-                properties:
-                  kind:
-                    description: Kind of the application, used for UI and API
-                    type: string
-                  openAPISchema:
-                    description: OpenAPI schema for the application, used for API
-                      validation
-                    type: string
-                  plural:
-                    description: Plural name of the application, used for UI and API
-                    type: string
-                  singular:
-                    description: Singular name of the application, used for UI and
-                      API
-                    type: string
-                required:
-                - kind
-                - openAPISchema
-                - plural
-                - singular
-                type: object
-              release:
-                description: Release configuration
-                properties:
-                  chart:
-                    description: Helm chart configuration
-                    properties:
-                      name:
-                        description: Name of the Helm chart
-                        type: string
-                      sourceRef:
-                        description: Source reference for the Helm chart
-                        properties:
-                          kind:
-                            default: HelmRepository
-                            description: Kind of the source reference
-                            type: string
-                          name:
-                            description: Name of the source reference
-                            type: string
-                          namespace:
-                            default: cozy-public
-                            description: Namespace of the source reference
-                            type: string
-                        required:
-                        - kind
-                        - name
-                        - namespace
-                        type: object
-                    required:
-                    - name
-                    - sourceRef
-                    type: object
-                  labels:
-                    additionalProperties:
-                      type: string
-                    description: Labels for the release
-                    type: object
-                  prefix:
-                    description: Prefix for the release name
-                    type: string
-                required:
-                - chart
-                - prefix
-                type: object
-            required:
-            - application
-            - release
-            type: object
-        type: object
-    served: true
-    storage: true
--- a/packages/system/cozystack-controller/values.yaml
+++ b/packages/system/cozystack-controller/values.yaml
@@ -1,5 +1,5 @@
 cozystackController:
-  image: ghcr.io/cozystack/cozystack/cozystack-controller:v0.35.0-alpha.3@sha256:98d0b945630c3dd7c39adc7a5326f0e0e0b49a18641bec911aeb6c62beca4e1f
+  image: ghcr.io/cozystack/cozystack/cozystack-controller:v0.35.0-alpha.1@sha256:7a510d046d7e1dd1f82a06f7a014bf7690f95cbd42005a417520b216141f86a0
  debug: false
  disableTelemetry: false
-  cozystackVersion: "v0.35.0-alpha.3"
+  cozystackVersion: "v0.35.0-alpha.1"
--- a/packages/system/dashboard/charts/kubeapps/templates/dashboard/configmap.yaml
+++ b/packages/system/dashboard/charts/kubeapps/templates/dashboard/configmap.yaml
@@ -76,7 +76,7 @@ data:
      "kubeappsNamespace": {{ .Release.Namespace | quote }},
      "helmGlobalNamespace": {{ include "kubeapps.helmGlobalPackagingNamespace" . | quote }},
      "carvelGlobalNamespace": {{ .Values.kubeappsapis.pluginConfig.kappController.packages.v1alpha1.globalPackagingNamespace | quote }},
-      "appVersion": "v0.35.0-alpha.3",
+      "appVersion": "v0.35.0-alpha.1",
      "authProxyEnabled": {{ .Values.authProxy.enabled }},
      "oauthLoginURI": {{ .Values.authProxy.oauthLoginURI | quote }},
      "oauthLogoutURI": {{ .Values.authProxy.oauthLogoutURI | quote }},
--- a/packages/system/dashboard/values.yaml
+++ b/packages/system/dashboard/values.yaml
@@ -19,7 +19,7 @@ kubeapps:
    image:
      registry: ghcr.io/cozystack/cozystack
      repository: dashboard
-      tag: v0.35.0-alpha.3
+      tag: v0.35.0-alpha.1
      digest: "sha256:ad4b95660b6c5c1b9736ca4768a3f9648705c2855d0a08880d570b4e480dba78"
  redis:
    master:
@@ -37,8 +37,8 @@ kubeapps:
    image:
      registry: ghcr.io/cozystack/cozystack
      repository: kubeapps-apis
-      tag: v0.35.0-alpha.3
-      digest: "sha256:55b1aacdcb8f7e96b75396e461fbba612498095515b9a437b8f925802f06c485"
+      tag: v0.35.0-alpha.1
+      digest: "sha256:5eb100bab12012659caaa335e510438fec4db22929d2ff8131d51572f609c4b5"
    pluginConfig:
      flux:
        packages:
--- a/packages/system/kamaji/values.yaml
+++ b/packages/system/kamaji/values.yaml
@@ -3,7 +3,7 @@ kamaji:
    deploy: false
  image:
    pullPolicy: IfNotPresent
-    tag: v0.35.0-alpha.3@sha256:34500654751ceef7a57562fb1edc6928d91245ad8e41da732788dcf10ec330b5
+    tag: v0.35.0-alpha.1@sha256:7ce47da363e7be4f297e6de42a72416238c66c613e2effdbfa3fef987701d61a
    repository: ghcr.io/cozystack/cozystack/kamaji
  resources:
    limits:
--- a/packages/system/keycloak-configure/templates/configure-kk.yaml
+++ b/packages/system/keycloak-configure/templates/configure-kk.yaml
@@ -200,7 +200,7 @@ spec:
    - groups
    - kubernetes-client
  redirectUris:
-    - "https://dashboard.{{ $host }}/oauth2/callback/*"
+    - "http://dashboard.{{ $host }}/oauth2/callback/*"
    {{- range $i, $v := $extraRedirectUris }}
    - "{{ $v }}"
    {{- end }}
@@ -223,7 +223,8 @@ data:
        clientSecret: {{ $kubeappsClient }}
        cookieSecret: {{ $cookieSecret }}
        extraFlags:
-          - --cookie-secure
+          - --ssl-insecure-skip-verify
+          - --cookie-secure=false
          - --scope=openid email groups
          - --oidc-issuer-url=https://keycloak.{{ $host }}/realms/cozy

--- a/packages/system/keycloak/templates/sts.yaml
+++ b/packages/system/keycloak/templates/sts.yaml
@@ -87,10 +87,7 @@ spec:
            - name: KEYCLOAK_ADMIN
              value: admin
            - name: KEYCLOAK_ADMIN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Release.Name }}-credentials
-                  key: password
+              value: {{ $password }}
            - name: KC_DB
              value: "postgres"
            - name: KC_DB_URL_HOST
--- a/packages/system/kubeovn-webhook/values.yaml
+++ b/packages/system/kubeovn-webhook/values.yaml
@@ -1,3 +1,3 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v0.35.0-alpha.3@sha256:ad4e506065458b039a86c7f03a35dbb6918756e117ce74dd931089383cfd91f8
+image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v0.35.0-alpha.1@sha256:dab57f5f68e77830b63c37c1b0c3228f404137435eced38bb21982954e280398
--- a/packages/system/kubeovn/values.yaml
+++ b/packages/system/kubeovn/values.yaml
@@ -64,4 +64,4 @@ global:
  images:
    kubeovn:
      repository: kubeovn
-      tag: v1.13.14@sha256:bacd68243ee9fd94f5f0e377801ed3e99cd0762ff5df0d0ec73a73130180d8ca
+      tag: v1.13.14@sha256:beb6e0bac9321fe9b26a11b24bf99a7e176af5e60a2826acc34a7edec5198e6a
--- a/packages/system/kubevirt-csi-node/values.yaml
+++ b/packages/system/kubevirt-csi-node/values.yaml
@@ -1,3 +1,3 @@
 storageClass: replicated
 csiDriver:
-  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.26.2@sha256:761e7235ff9cb7f6f223f00954943e6a5af32ed6624ee592a8610122f96febb0
+  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:0.26.0@sha256:445c2727b04ac68595b43c988ff17b3d69a7b22b0644fde3b10c65b47a7bc036
--- a/packages/system/objectstorage-controller/values.yaml
+++ b/packages/system/objectstorage-controller/values.yaml
@@ -1,3 +1,3 @@
 objectstorage:
  controller:
-    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v0.35.0-alpha.3@sha256:4d3f20ae946736d9260193dd1ce0e72114ad6bd6f78fb6528a68efffa2092b07"
+    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v0.35.0-alpha.1@sha256:2fe77880b81b0210273c85a142cb13e6857d13dd941337456b426597f5778bc3"
--- a/packages/system/seaweedfs/Makefile
+++ b/packages/system/seaweedfs/Makefile
@@ -8,5 +8,4 @@ update:
 	curl -sSL https://github.com/seaweedfs/seaweedfs/archive/refs/heads/master.tar.gz | \
 	tar xzvf - --strip 3 -C charts seaweedfs-master/k8s/charts/seaweedfs
 	patch --no-backup-if-mismatch -p4 < patches/resize-api-server-annotation.diff
-	patch --no-backup-if-mismatch -p4 < patches/fix-volume-servicemonitor.patch
 	#patch --no-backup-if-mismatch -p4 < patches/retention-policy-delete.yaml
--- a/packages/system/seaweedfs/charts/seaweedfs/templates/volume-servicemonitor.yaml
+++ b/packages/system/seaweedfs/charts/seaweedfs/templates/volume-servicemonitor.yaml
@@ -21,9 +21,9 @@ metadata:
    {{- with $.Values.global.monitoring.additionalLabels }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
-{{- if $.Values.volume.annotations }}
+{{- if .Values.volume.annotations }}
  annotations:
-    {{- toYaml $.Values.volume.annotations | nindent 4 }}
+    {{- toYaml .Values.volume.annotations | nindent 4 }}
 {{- end }}
 spec:
  endpoints:
--- a/packages/system/seaweedfs/patches/fix-volume-servicemonitor.patch
+++ b/packages/system/seaweedfs/patches/fix-volume-servicemonitor.patch
@@ -1,15 +0,0 @@
-diff --git a/packages/system/seaweedfs/charts/seaweedfs/templates/volume-servicemonitor.yaml b/packages/system/seaweedfs/charts/seaweedfs/templates/volume-servicemonitor.yaml
--- a/packages/system/seaweedfs/charts/seaweedfs/templates/volume-servicemonitor.yaml	(revision 8951bc13d7d02b5e6982a239570ed58ed7cb025a)
-+++ b/packages/system/seaweedfs/charts/seaweedfs/templates/volume-servicemonitor.yaml	(revision fa4fff2292c4b79a92db5cd654a3c6bf590252a6)
-@@ -21,9 +21,9 @@
-     {{- with $.Values.global.monitoring.additionalLabels }}
-     {{- toYaml . | nindent 4 }}
-     {{- end }}
-{{- if .Values.volume.annotations }}
-+{{- if $.Values.volume.annotations }}
-   annotations:
-    {{- toYaml .Values.volume.annotations | nindent 4 }}
-+    {{- toYaml $.Values.volume.annotations | nindent 4 }}
- {{- end }}
- spec:
-   endpoints:
--- a/packages/system/seaweedfs/values.yaml
+++ b/packages/system/seaweedfs/values.yaml
@@ -4,8 +4,6 @@ global:
  extraEnvironmentVars:
    WEED_CLUSTER_SW_MASTER: "seaweedfs-master:9333"
    WEED_CLUSTER_SW_FILER: "seaweedfs-filer-client:8888"
-  monitoring:
-    enabled: true
 seaweedfs:
  master:
    replicas: 3
@@ -80,10 +78,7 @@ seaweedfs:
      existingConfigSecret: null
      auditLogConfig: {}
  s3:
-    enabled: true
    enableAuth: true
-    readinessProbe:
-      scheme: HTTPS
    logs:
      type: ""
    ingress:
@@ -99,13 +94,6 @@ seaweedfs:
        - hosts:
            - seaweedfs.demo.cozystack.io
          secretName: seaweedfs-s3-ingress-tls
-    resources:
-      limits:
-        cpu: "2"
-        memory: "2Gi"
-      requests:
-        cpu: "500m"
-        memory: "1Gi"
  cosi:
    enabled: true
    podLabels:
@@ -114,7 +102,7 @@ seaweedfs:
    bucketClassName: "seaweedfs"
    region: ""
    sidecar:
-      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v0.35.0-alpha.3@sha256:4a67ec40c13bf912151957dc0e7409f7e01a2859905285c98c20baae7b667ae2"
+      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v0.35.0-alpha.1@sha256:e4f9a7302285ea9febeb28fc2fa97cb7c01bb91e602f975c31aad1fe46f778f7"
  certificates:
    commonName: "SeaweedFS CA"
    ipAddresses: []
--- a/packages/system/volumesnapshot-crd-for-tenant-k8s/Chart.yaml
+++ b/packages/system/volumesnapshot-crd-for-tenant-k8s/Chart.yaml
@@ -1,3 +1,3 @@
 apiVersion: v2
-name: cozy-vsnap-crd
+name: cozy-volumesnapshot-crd-for-tenant-k8s
 version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
--- a/packages/system/volumesnapshot-crd-for-tenant-k8s/Makefile
+++ b/packages/system/volumesnapshot-crd-for-tenant-k8s/Makefile
@@ -1,4 +1,4 @@
-export NAME=vsnap-crd
+export NAME=volumesnapshot-crd-for-tenant-k8s
 export NAMESPACE=cozy-$(NAME)

 include ../../../scripts/package.mk
--- a/pkg/cmd/server/start.go
+++ b/pkg/cmd/server/start.go
@@ -25,13 +25,11 @@ import (
 	"io"
 	"net"

-	corev1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
 	"github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1"
 	"github.com/cozystack/cozystack/pkg/apiserver"
 	"github.com/cozystack/cozystack/pkg/config"
 	sampleopenapi "github.com/cozystack/cozystack/pkg/generated/openapi"
 	"github.com/spf13/cobra"
-	"k8s.io/apimachinery/pkg/runtime"
 	utilerrors "k8s.io/apimachinery/pkg/util/errors"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	"k8s.io/apimachinery/pkg/util/version"
@@ -40,11 +38,9 @@ import (
 	genericoptions "k8s.io/apiserver/pkg/server/options"
 	utilfeature "k8s.io/apiserver/pkg/util/feature"
 	utilversionpkg "k8s.io/apiserver/pkg/util/version"
-	"k8s.io/client-go/tools/clientcmd"
 	"k8s.io/component-base/featuregate"
 	baseversion "k8s.io/component-base/version"
 	netutils "k8s.io/utils/net"
-	"sigs.k8s.io/controller-runtime/pkg/client"
 )

 // AppsServerOptions holds the state for the Apps API server
@@ -55,7 +51,9 @@ type AppsServerOptions struct {
 	StdErr io.Writer

 	AlternateDNS []string
-	Client       client.Client
+
+	// Add a field to store the configuration path
+	ResourceConfigPath string

 	// Add a field to store the configuration
 	ResourceConfig *config.ResourceConfig
@@ -68,6 +66,7 @@ func NewAppsServerOptions(out, errOut io.Writer) *AppsServerOptions {
 			"",
 			apiserver.Codecs.LegacyCodec(v1alpha1.SchemeGroupVersion),
 		),
+
 		StdOut: out,
 		StdErr: errOut,
 	}
@@ -102,6 +101,9 @@ func NewCommandStartAppsServer(ctx context.Context, defaults *AppsServerOptions)
 	flags := cmd.Flags()
 	o.RecommendedOptions.AddFlags(flags)

+	// Add a flag for the config path
+	flags.StringVar(&o.ResourceConfigPath, "config", "config.yaml", "Path to the resource configuration file")
+
 	// The following lines demonstrate how to configure version compatibility and feature gates
 	// for the "Apps" component according to KEP-4330.

@@ -140,54 +142,12 @@ func NewCommandStartAppsServer(ctx context.Context, defaults *AppsServerOptions)

 // Complete fills in the fields that are not set
 func (o *AppsServerOptions) Complete() error {
-	scheme := runtime.NewScheme()
-	if err := corev1alpha1.AddToScheme(scheme); err != nil {
-		return fmt.Errorf("failed to register types: %w", err)
-	}
-
-	cfg, err := clientcmd.BuildConfigFromFlags("", "")
+	// Load the configuration file
+	cfg, err := config.LoadConfig(o.ResourceConfigPath)
 	if err != nil {
-		return fmt.Errorf("failed to get kubeconfig: %w", err)
+		return fmt.Errorf("failed to load config from %s: %v", o.ResourceConfigPath, err)
 	}
-
-	o.Client, err = client.New(cfg, client.Options{Scheme: scheme})
-	if err != nil {
-		return fmt.Errorf("client initialization failed: %w", err)
-	}
-
-	crdList := &corev1alpha1.CozystackResourceDefinitionList{}
-
-	if err := o.Client.List(context.Background(), crdList); err != nil {
-		return fmt.Errorf("failed to list CozystackResourceDefinitions: %w", err)
-	}
-
-	// Convert to ResourceConfig
-	o.ResourceConfig = &config.ResourceConfig{}
-	for _, crd := range crdList.Items {
-		resource := config.Resource{
-			Application: config.ApplicationConfig{
-				Kind:          crd.Spec.Application.Kind,
-				Singular:      crd.Spec.Application.Singular,
-				Plural:        crd.Spec.Application.Plural,
-				ShortNames:    []string{}, // TODO: implement shortnames
-				OpenAPISchema: crd.Spec.Application.OpenAPISchema,
-			},
-			Release: config.ReleaseConfig{
-				Prefix: crd.Spec.Release.Prefix,
-				Labels: crd.Spec.Release.Labels,
-				Chart: config.ChartConfig{
-					Name: crd.Spec.Release.Chart.Name,
-					SourceRef: config.SourceRefConfig{
-						Kind:      crd.Spec.Release.Chart.SourceRef.Kind,
-						Name:      crd.Spec.Release.Chart.SourceRef.Name,
-						Namespace: crd.Spec.Release.Chart.SourceRef.Namespace,
-					},
-				},
-			},
-		}
-		o.ResourceConfig.Resources = append(o.ResourceConfig.Resources, resource)
-	}
-
+	o.ResourceConfig = cfg
 	return nil
 }

--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -16,6 +16,13 @@ limitations under the License.

 package config

+import (
+	"fmt"
+	"os"
+
+	"gopkg.in/yaml.v2"
+)
+
 // ResourceConfig represents the structure of the configuration file.
 type ResourceConfig struct {
 	Resources []Resource `yaml:"resources"`
@@ -55,3 +62,33 @@ type SourceRefConfig struct {
 	Name      string `yaml:"name"`
 	Namespace string `yaml:"namespace"`
 }
+
+// LoadConfig loads the configuration from the specified path and validates it.
+func LoadConfig(path string) (*ResourceConfig, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+
+	var config ResourceConfig
+	if err := yaml.Unmarshal(data, &config); err != nil {
+		return nil, err
+	}
+
+	// Validate the configuration.
+	for i, res := range config.Resources {
+		if res.Application.Kind == "" {
+			return nil, fmt.Errorf("resource at index %d has an empty kind", i)
+		}
+		if res.Application.Plural == "" {
+			return nil, fmt.Errorf("resource at index %d has an empty plural", i)
+		}
+		if res.Release.Chart.Name == "" {
+			return nil, fmt.Errorf("resource at index %d has an empty chart name in release", i)
+		}
+		if res.Release.Chart.SourceRef.Kind == "" || res.Release.Chart.SourceRef.Name == "" || res.Release.Chart.SourceRef.Namespace == "" {
+			return nil, fmt.Errorf("resource at index %d has an incomplete sourceRef for chart in release", i)
+		}
+	}
+	return &config, nil
+}
--- a/pkg/generated/openapi/zz_generated.openapi.go
+++ b/pkg/generated/openapi/zz_generated.openapi.go
@@ -30,9 +30,9 @@ import (

 func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenAPIDefinition {
 	return map[string]common.OpenAPIDefinition{
-		"github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1.Application":                          schema_pkg_apis_apps_v1alpha1_Application(ref),
-		"github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1.ApplicationList":                      schema_pkg_apis_apps_v1alpha1_ApplicationList(ref),
-		"github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1.ApplicationStatus":                    schema_pkg_apis_apps_v1alpha1_ApplicationStatus(ref),
+		"github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1.Application":                           schema_pkg_apis_apps_v1alpha1_Application(ref),
+		"github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1.ApplicationList":                       schema_pkg_apis_apps_v1alpha1_ApplicationList(ref),
+		"github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1.ApplicationStatus":                     schema_pkg_apis_apps_v1alpha1_ApplicationStatus(ref),
 		"k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1.ConversionRequest":                 schema_pkg_apis_apiextensions_v1_ConversionRequest(ref),
 		"k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1.ConversionResponse":                schema_pkg_apis_apiextensions_v1_ConversionResponse(ref),
 		"k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1.ConversionReview":                  schema_pkg_apis_apiextensions_v1_ConversionReview(ref),
--- a/pkg/registry/apps/application/rest.go
+++ b/pkg/registry/apps/application/rest.go
@@ -271,6 +271,7 @@ func (r *REST) List(ctx context.Context, options *metainternalversion.ListOption
 			klog.Errorf("Invalid field selector: %v", err)
 			return nil, fmt.Errorf("invalid field selector: %v", err)
 		}
+
 		// Check if selector is for metadata.name
 		if name, exists := fs.RequiresExactMatch("metadata.name"); exists {
 			// Convert Application name to HelmRelease name
@@ -320,8 +321,17 @@ func (r *REST) List(ctx context.Context, options *metainternalversion.ListOption
 		return nil, err
 	}

-	// Initialize unstructured items array
-	items := make([]unstructured.Unstructured, 0)
+	// Initialize empty Application list
+	appList := &appsv1alpha1.ApplicationList{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "apps.cozystack.io/v1alpha1",
+			Kind:       "ApplicationList",
+		},
+		ListMeta: metav1.ListMeta{
+			ResourceVersion: hrList.GetResourceVersion(),
+		},
+		Items: []appsv1alpha1.Application{},
+	}

 	// Iterate over HelmReleases and convert to Applications
 	for _, hr := range hrList.Items {
@@ -359,6 +369,7 @@ func (r *REST) List(ctx context.Context, options *metainternalversion.ListOption
 				klog.Errorf("Invalid field selector: %v", err)
 				continue
 			}
+
 			fieldsSet := fields.Set{
 				"metadata.name":      app.Name,
 				"metadata.namespace": app.Namespace,
@@ -368,23 +379,10 @@ func (r *REST) List(ctx context.Context, options *metainternalversion.ListOption
 			}
 		}

-		// Convert Application to unstructured
-		unstructuredApp, err := runtime.DefaultUnstructuredConverter.ToUnstructured(&app)
-		if err != nil {
-			klog.Errorf("Error converting Application %s to unstructured: %v", app.Name, err)
-			continue
-		}
-		items = append(items, unstructured.Unstructured{Object: unstructuredApp})
+		appList.Items = append(appList.Items, app)
 	}

-	// Explicitly set apiVersion and kind in unstructured object
-	appList := &unstructured.UnstructuredList{}
-	appList.SetAPIVersion("apps.cozystack.io/v1alpha1")
-	appList.SetKind(r.kindName + "List")
-	appList.SetResourceVersion(hrList.GetResourceVersion())
-	appList.Items = items
-
-	klog.V(6).Infof("Successfully listed %d Application resources in namespace %s", len(items), namespace)
+	klog.V(6).Infof("Successfully listed %d Application resources in namespace %s", len(appList.Items), namespace)
 	return appList, nil
 }

@@ -1038,19 +1036,6 @@ func (r *REST) ConvertToTable(ctx context.Context, object runtime.Object, tableO
 	case *appsv1alpha1.Application:
 		table = r.buildTableFromApplication(*obj)
 		table.ListMeta.ResourceVersion = obj.GetResourceVersion()
-	case *unstructured.UnstructuredList:
-		apps := make([]appsv1alpha1.Application, 0, len(obj.Items))
-		for _, u := range obj.Items {
-			var a appsv1alpha1.Application
-			err := runtime.DefaultUnstructuredConverter.FromUnstructured(u.Object, &a)
-			if err != nil {
-				klog.Errorf("Failed to convert Unstructured to Application: %v", err)
-				continue
-			}
-			apps = append(apps, a)
-		}
-		table = r.buildTableFromApplications(apps)
-		table.ListMeta.ResourceVersion = obj.GetResourceVersion()
 	case *unstructured.Unstructured:
 		var app appsv1alpha1.Application
 		err := runtime.DefaultUnstructuredConverter.FromUnstructured(obj.UnstructuredContent(), &app)
@@ -1082,6 +1067,7 @@ func (r *REST) ConvertToTable(ctx context.Context, object runtime.Object, tableO
 	}

 	klog.V(6).Infof("ConvertToTable: returning table with %d rows", len(table.Rows))
+
 	return &table, nil
 }

--- a/scripts/common-envs.mk
+++ b/scripts/common-envs.mk
@@ -17,8 +17,6 @@ endif

 # Get the name of the selected docker buildx builder
 BUILDER ?= $(shell docker buildx inspect --bootstrap | head -n2 | awk '/^Name:/{print $$NF}')
+# Get platforms supported by the builder
+PLATFORM ?= $(shell docker buildx ls --format=json | jq -r 'select(.Name == "$(BUILDER)") | [.Nodes[].Platforms // []] | flatten | unique | map(select(test("^linux/amd64$$|^linux/arm64$$"))) | join(",")')

-# Get platforms supported by the builder (only if PLATFORM is not provided)
-ifeq ($(origin PLATFORM), undefined)
-PLATFORM := $(shell docker buildx ls --format=json | jq -r 'select(.Name == "$(BUILDER)") | [.Nodes[].Platforms // []] | flatten | unique | map(select(test("^linux/amd64$$|^linux/arm64$$"))) | join(",")')
-endif
--- a/scripts/migrations/17
+++ b/scripts/migrations/17
@@ -1,10 +0,0 @@
-#!/bin/sh
-# Migration 17 --> 18
-
-# Upgrade kubernetes.apps to new chart version
-kubectl get kuberneteses.apps.cozystack.io -A --no-headers --output=custom-columns='NAMESPACE:.metadata.namespace,NAME:.metadata.name' | while read NAMESPACE NAME; do
-  kubectl patch kuberneteses.apps.cozystack.io -n "$NAMESPACE" "$NAME" --type merge -p '{"appVersion":"0.26.1"}'
-done
-
-# Write version to cozystack-version config
-kubectl create configmap -n cozy-system cozystack-version --from-literal=version=18 --dry-run=client -o yaml | kubectl apply -f-
				`@@ -1 +0,0 @@`
				`ghcr.io/seaweedfs/seaweedfs-cosi-driver:v0.2.0`