[docs] Added actual go types

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>

.github/workflows/pull-requests.yaml

@@ -6,8 +6,6 @@ env:
 on:
   pull_request:
     types: [opened, synchronize, reopened]
-    paths-ignore:
-      - 'docs/**/*'
 
 # Cancel in‑flight runs for the same PR when a new push arrives.
 concurrency:
@@ -15,6 +13,19 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  detect-changes:
+    name: Detect changes
+    runs-on: ubuntu-latest
+    outputs:
+      code: ${{ steps.filter.outputs.code }}
+    steps:
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            code:
+              - '!docs/**'
+
   build:
     name: Build
     runs-on: [self-hosted]
@@ -22,9 +33,11 @@ jobs:
       contents: read
       packages: write
 
-    # Never run when the PR carries the "release" label.
+    needs: ["detect-changes"]
+    # Never run when the PR carries the "release" label or only docs changed.
     if: |
-      !contains(github.event.pull_request.labels.*.name, 'release')
+      needs.detect-changes.outputs.code == 'true'
+      && !contains(github.event.pull_request.labels.*.name, 'release')
 
     steps:
       - name: Checkout code

.github/workflows/tags.yaml

@@ -123,6 +123,20 @@ jobs:
           git commit -m "Prepare release ${GITHUB_REF#refs/tags/}" -s || echo "No changes to commit"
           git push origin HEAD || true
 
+      # Tag the api/apps/v1alpha1 submodule for pkg.go.dev
+      - name: Tag API submodule
+        if: steps.check_release.outputs.skip == 'false'
+        env:
+          GH_PAT: ${{ secrets.GH_PAT }}
+        run: |
+          VTAG="${{ steps.tag.outputs.tag }}"
+          SUBTAG="api/apps/v1alpha1/${VTAG}"
+          git config user.name  "cozystack-bot"
+          git config user.email "217169706+cozystack-bot@users.noreply.github.com"
+          git remote set-url origin https://cozystack-bot:${GH_PAT}@github.com/${GITHUB_REPOSITORY}
+          git tag "${SUBTAG}" "${VTAG}^{}" 2>/dev/null || git tag "${SUBTAG}" HEAD
+          git push origin "${SUBTAG}" || true
+
       # Create or reuse draft release
       - name: Create / reuse draft release
         if: steps.check_release.outputs.skip == 'false'
@@ -370,3 +384,74 @@ jobs:
               
               console.log(`Created PR #${pr.data.number} for changelog`);
             }
+
+  update-website-docs:
+    name: Update Website Docs
+    runs-on: [self-hosted]
+    needs: [generate-changelog]
+    if: needs.generate-changelog.result == 'success'
+    permissions:
+      contents: read
+    steps:
+      - name: Parse tag
+        id: tag
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const ref = context.ref.replace('refs/tags/', '');
+            const m = ref.match(/^v(\d+\.\d+\.\d+)(-(?:alpha|beta|rc)\.\d+)?$/);
+            if (!m) {
+              core.setFailed(`❌ tag '${ref}' must match 'vX.Y.Z' or 'vX.Y.Z-(alpha|beta|rc).N'`);
+              return;
+            }
+            const version = m[1] + (m[2] ?? '');
+            core.setOutput('tag',     ref);      // v0.22.0
+            core.setOutput('version', version);  // 0.22.0
+
+      - name: Checkout website repo
+        uses: actions/checkout@v4
+        with:
+          repository: cozystack/website
+          token: ${{ secrets.GH_PAT }}
+          ref: main
+
+      - name: Update docs from release branch
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT }}
+        run: make update-all BRANCH=release-${{ steps.tag.outputs.version }} RELEASE_TAG=${{ steps.tag.outputs.tag }}
+
+      - name: Commit and push
+        id: commit
+        run: |
+          git config user.name  "cozystack-bot"
+          git config user.email "217169706+cozystack-bot@users.noreply.github.com"
+          git add content
+          if git diff --cached --quiet; then
+            echo "No changes to commit"
+            echo "changed=false" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+          BRANCH="update-docs-v${{ steps.tag.outputs.version }}"
+          git branch -D "$BRANCH" 2>/dev/null || true
+          git checkout -b "$BRANCH"
+          git commit --signoff -m "[docs] Update managed apps reference for v${{ steps.tag.outputs.version }}"
+          git push --force --set-upstream origin "$BRANCH"
+          echo "changed=true" >> $GITHUB_OUTPUT
+
+      - name: Open pull request
+        if: steps.commit.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT }}
+        run: |
+          BRANCH="update-docs-v${{ steps.tag.outputs.version }}"
+          pr_state=$(gh pr view "$BRANCH" --repo cozystack/website --json state --jq .state 2>/dev/null || echo "")
+          if [[ "$pr_state" == "OPEN" ]]; then
+            echo "PR already open, skipping creation."
+          else
+            gh pr create \
+              --repo cozystack/website \
+              --title "[docs] Update managed apps reference for v${{ steps.tag.outputs.version }}" \
+              --body "Automated docs update for release \`v${{ steps.tag.outputs.version }}\`." \
+              --head "update-docs-v${{ steps.tag.outputs.version }}" \
+              --base main
+          fi

Makefile

@@ -58,7 +58,11 @@ manifests:
 cozypkg:
 	go build -ldflags "-X github.com/cozystack/cozystack/cmd/cozypkg/cmd.Version=v$(COZYSTACK_VERSION)" -o _out/bin/cozypkg ./cmd/cozypkg
 
-assets: assets-talos assets-cozypkg
+assets: assets-talos assets-cozypkg openapi-json
+
+openapi-json:
+	mkdir -p _out/assets
+	VERSION=$(shell git describe --tags --always 2>/dev/null || echo dev) go run ./tools/openapi-gen/ > _out/assets/openapi.json
 
 assets-talos:
 	make -C packages/core/talos assets

api/apps/v1alpha1/bucket/types.go

@@ -0,0 +1,35 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package bucket
+
+import (
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Provisions bucket from the `-lock` BucketClass (with object lock enabled).
+	// +kubebuilder:default:=false
+	Locking bool `json:"locking"`
+	// Selects a specific BucketClass by storage pool name.
+	// +kubebuilder:default:=""
+	StoragePool string `json:"storagePool,omitempty"`
+	// Users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
+}
+
+type User struct {
+	// Whether the user has read-only access.
+	Readonly bool `json:"readonly,omitempty"`
+}

api/apps/v1alpha1/clickhouse/types.go

@@ -0,0 +1,114 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package clickhouse
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Backup configuration.
+	// +kubebuilder:default:={}
+	Backup Backup `json:"backup"`
+	// ClickHouse Keeper configuration.
+	// +kubebuilder:default:={}
+	ClickhouseKeeper ClickHouseKeeper `json:"clickhouseKeeper"`
+	// Size of Persistent Volume for logs.
+	// +kubebuilder:default:="2Gi"
+	LogStorageSize resource.Quantity `json:"logStorageSize"`
+	// TTL (expiration time) for `query_log` and `query_thread_log`.
+	// +kubebuilder:default:=15
+	LogTTL int `json:"logTTL"`
+	// Number of ClickHouse replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each ClickHouse replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="small"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Number of ClickHouse shards.
+	// +kubebuilder:default:=1
+	Shards int `json:"shards"`
+	// Persistent Volume Claim size available for application data.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+	// Users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
+}
+
+type ClickHouseKeeper struct {
+	// Deploy ClickHouse Keeper for cluster coordination.
+	// +kubebuilder:default:=true
+	Enabled bool `json:"enabled,omitempty"`
+	// Number of Keeper replicas.
+	// +kubebuilder:default:=3
+	Replicas int `json:"replicas,omitempty"`
+	// Default sizing preset.
+	// +kubebuilder:default:="micro"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset,omitempty"`
+	// Persistent Volume Claim size available for application data.
+	// +kubebuilder:default:="1Gi"
+	Size resource.Quantity `json:"size,omitempty"`
+}
+
+type User struct {
+	// Password for the user.
+	Password string `json:"password,omitempty"`
+	// User is readonly (default: false).
+	Readonly bool `json:"readonly,omitempty"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type Backup struct {
+	// Retention strategy for cleaning up old backups.
+	// +kubebuilder:default:="--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
+	CleanupStrategy string `json:"cleanupStrategy"`
+	// Enable regular backups (default: false).
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Password for Restic backup encryption.
+	// +kubebuilder:default:="<password>"
+	ResticPassword string `json:"resticPassword"`
+	// Access key for S3 authentication.
+	// +kubebuilder:default:="<your-access-key>"
+	S3AccessKey string `json:"s3AccessKey"`
+	// S3 bucket used for storing backups.
+	// +kubebuilder:default:="s3.example.org/clickhouse-backups"
+	S3Bucket string `json:"s3Bucket"`
+	// AWS S3 region where backups are stored.
+	// +kubebuilder:default:="us-east-1"
+	S3Region string `json:"s3Region"`
+	// Secret key for S3 authentication.
+	// +kubebuilder:default:="<your-secret-key>"
+	S3SecretKey string `json:"s3SecretKey"`
+	// Cron schedule for automated backups.
+	// +kubebuilder:default:="0 2 * * *"
+	Schedule string `json:"schedule"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string

api/apps/v1alpha1/foundationdb/types.go

@@ -0,0 +1,164 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package foundationdb
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Enable automatic pod replacements.
+	// +kubebuilder:default:=true
+	AutomaticReplacements bool `json:"automaticReplacements"`
+	// Backup configuration.
+	// +kubebuilder:default:={}
+	Backup Backup `json:"backup"`
+	// Cluster configuration.
+	// +kubebuilder:default:={}
+	Cluster Cluster `json:"cluster"`
+	// Custom parameters to pass to FoundationDB.
+	// +kubebuilder:default:={}
+	CustomParameters []string `json:"customParameters,omitempty"`
+	// Container image deployment type.
+	// +kubebuilder:default:="unified"
+	ImageType ImageType `json:"imageType"`
+	// Monitoring configuration.
+	// +kubebuilder:default:={}
+	Monitoring Monitoring `json:"monitoring"`
+	// Explicit CPU and memory configuration for each FoundationDB instance. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="medium"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Security context for containers.
+	// +kubebuilder:default:={}
+	SecurityContext SecurityContext `json:"securityContext"`
+	// Storage configuration.
+	// +kubebuilder:default:={}
+	Storage Storage `json:"storage"`
+}
+
+type Cluster struct {
+	// Fault domain configuration.
+	// +kubebuilder:default:={}
+	FaultDomain ClusterFaultDomain `json:"faultDomain"`
+	// Process counts for different roles.
+	// +kubebuilder:default:={}
+	ProcessCounts ClusterProcessCounts `json:"processCounts"`
+	// Database redundancy mode (single, double, triple, three_datacenter, three_datacenter_fallback).
+	// +kubebuilder:default:="double"
+	RedundancyMode string `json:"redundancyMode"`
+	// Storage engine (ssd-2, ssd-redwood-v1, ssd-rocksdb-v1, memory).
+	// +kubebuilder:default:="ssd-2"
+	StorageEngine string `json:"storageEngine"`
+	// Version of FoundationDB to use.
+	// +kubebuilder:default:="7.3.63"
+	Version string `json:"version"`
+}
+
+type BackupS3Credentials struct {
+	// S3 access key ID.
+	// +kubebuilder:default:=""
+	AccessKeyId string `json:"accessKeyId"`
+	// S3 secret access key.
+	// +kubebuilder:default:=""
+	SecretAccessKey string `json:"secretAccessKey"`
+}
+
+type BackupS3 struct {
+	// S3 bucket name.
+	// +kubebuilder:default:=""
+	Bucket string `json:"bucket"`
+	// S3 credentials.
+	// +kubebuilder:default:={}
+	Credentials BackupS3Credentials `json:"credentials"`
+	// S3 endpoint URL.
+	// +kubebuilder:default:=""
+	Endpoint string `json:"endpoint"`
+	// S3 region.
+	// +kubebuilder:default:="us-east-1"
+	Region string `json:"region"`
+}
+
+type SecurityContext struct {
+	// Group ID to run the container.
+	// +kubebuilder:default:=4059
+	RunAsGroup int `json:"runAsGroup"`
+	// User ID to run the container.
+	// +kubebuilder:default:=4059
+	RunAsUser int `json:"runAsUser"`
+}
+
+type ClusterFaultDomain struct {
+	// Fault domain key.
+	// +kubebuilder:default:="kubernetes.io/hostname"
+	Key string `json:"key"`
+	// Fault domain value source.
+	// +kubebuilder:default:="spec.nodeName"
+	ValueFrom string `json:"valueFrom"`
+}
+
+type Storage struct {
+	// Size of persistent volumes for each instance.
+	// +kubebuilder:default:="16Gi"
+	Size resource.Quantity `json:"size"`
+	// Storage class (if not set, uses cluster default).
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+}
+
+type Resources struct {
+	// CPU available to each instance.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each instance.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type Backup struct {
+	// Enable backups.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Retention policy for backups.
+	// +kubebuilder:default:="7d"
+	RetentionPolicy string `json:"retentionPolicy"`
+	// S3 configuration for backups.
+	// +kubebuilder:default:={}
+	S3 BackupS3 `json:"s3"`
+}
+
+type ClusterProcessCounts struct {
+	// Number of cluster controller processes.
+	// +kubebuilder:default:=1
+	ClusterController int `json:"cluster_controller"`
+	// Number of stateless processes (-1 for automatic).
+	// +kubebuilder:default:=-1
+	Stateless int `json:"stateless"`
+	// Number of storage processes (determines cluster size).
+	// +kubebuilder:default:=3
+	Storage int `json:"storage"`
+}
+
+type Monitoring struct {
+	// Enable WorkloadMonitor integration.
+	// +kubebuilder:default:=true
+	Enabled bool `json:"enabled"`
+}
+
+// +kubebuilder:validation:Enum="unified";"split"
+type ImageType string
+
+// +kubebuilder:validation:Enum="small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string

api/apps/v1alpha1/go.mod

@@ -0,0 +1,24 @@
+module github.com/cozystack/cozystack/api/apps/v1alpha1
+
+go 1.25.0
+
+require k8s.io/apimachinery v0.35.2
+
+require (
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
+	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+)

api/apps/v1alpha1/go.sum

@@ -0,0 +1,56 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
+go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+k8s.io/apimachinery v0.35.2 h1:NqsM/mmZA7sHW02JZ9RTtk3wInRgbVxL8MPfzSANAK8=
+k8s.io/apimachinery v0.35.2/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
+k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
+k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE=
+k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
+k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzkbzn+gDM4X9T4Ck=
+k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=

api/apps/v1alpha1/harbor/types.go

@@ -0,0 +1,116 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package harbor
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Core API server configuration.
+	// +kubebuilder:default:={}
+	Core Core `json:"core"`
+	// PostgreSQL database configuration.
+	// +kubebuilder:default:={}
+	Database Database `json:"database"`
+	// Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).
+	// +kubebuilder:default:=""
+	Host string `json:"host,omitempty"`
+	// Background job service configuration.
+	// +kubebuilder:default:={}
+	Jobservice Jobservice `json:"jobservice"`
+	// Redis cache configuration.
+	// +kubebuilder:default:={}
+	Redis Redis `json:"redis"`
+	// Container image registry configuration.
+	// +kubebuilder:default:={}
+	Registry Registry `json:"registry"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+	// Trivy vulnerability scanner configuration.
+	// +kubebuilder:default:={}
+	Trivy Trivy `json:"trivy"`
+}
+
+type Trivy struct {
+	// Enable or disable the vulnerability scanner.
+	// +kubebuilder:default:=true
+	Enabled bool `json:"enabled"`
+	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="nano"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset,omitempty"`
+	// Persistent Volume size for vulnerability database cache.
+	// +kubebuilder:default:="5Gi"
+	Size resource.Quantity `json:"size"`
+}
+
+type Jobservice struct {
+	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="nano"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset,omitempty"`
+}
+
+type Resources struct {
+	// Number of CPU cores allocated.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Amount of memory allocated.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type Database struct {
+	// Number of database instances.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Persistent Volume size for database storage.
+	// +kubebuilder:default:="5Gi"
+	Size resource.Quantity `json:"size"`
+}
+
+type Redis struct {
+	// Number of Redis replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Persistent Volume size for cache storage.
+	// +kubebuilder:default:="1Gi"
+	Size resource.Quantity `json:"size"`
+}
+
+type Core struct {
+	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="small"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset,omitempty"`
+}
+
+type Registry struct {
+	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="small"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string

api/apps/v1alpha1/httpcache/types.go

@@ -0,0 +1,74 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package httpcache
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Endpoints configuration, as a list of <ip:port>.
+	// +kubebuilder:default:={}
+	Endpoints []string `json:"endpoints,omitempty"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// HAProxy configuration.
+	// +kubebuilder:default:={}
+	Haproxy HAProxy `json:"haproxy"`
+	// Nginx configuration.
+	// +kubebuilder:default:={}
+	Nginx Nginx `json:"nginx"`
+	// Persistent Volume Claim size available for application data.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type HAProxy struct {
+	// Number of HAProxy replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="nano"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+}
+
+type Nginx struct {
+	// Number of Nginx replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="nano"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string

api/apps/v1alpha1/kafka/types.go

@@ -0,0 +1,92 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package kafka
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	k8sRuntime "k8s.io/apimachinery/pkg/runtime"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// Kafka configuration.
+	// +kubebuilder:default:={}
+	Kafka Kafka `json:"kafka"`
+	// Topics configuration.
+	// +kubebuilder:default:={}
+	Topics []Topic `json:"topics,omitempty"`
+	// ZooKeeper configuration.
+	// +kubebuilder:default:={}
+	Zookeeper ZooKeeper `json:"zookeeper"`
+}
+
+type ZooKeeper struct {
+	// Number of ZooKeeper replicas.
+	// +kubebuilder:default:=3
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="small"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Persistent Volume size for ZooKeeper.
+	// +kubebuilder:default:="5Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the ZooKeeper data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+}
+
+type Topic struct {
+	// Topic configuration.
+	Config k8sRuntime.RawExtension `json:"config"`
+	// Topic name.
+	Name string `json:"name"`
+	// Number of partitions.
+	Partitions int `json:"partitions"`
+	// Number of replicas.
+	Replicas int `json:"replicas"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type Kafka struct {
+	// Number of Kafka replicas.
+	// +kubebuilder:default:=3
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="small"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Persistent Volume size for Kafka.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the Kafka data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string

api/apps/v1alpha1/kubernetes/types.go

@@ -0,0 +1,260 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package kubernetes
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	k8sRuntime "k8s.io/apimachinery/pkg/runtime"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Cluster addons configuration.
+	// +kubebuilder:default:={}
+	Addons Addons `json:"addons"`
+	// Kubernetes control-plane configuration.
+	// +kubebuilder:default:={}
+	ControlPlane ControlPlane `json:"controlPlane"`
+	// External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.
+	// +kubebuilder:default:=""
+	Host string `json:"host"`
+	// Worker nodes configuration map.
+	// +kubebuilder:default:={"md0":{"ephemeralStorage":"20Gi","gpus":{},"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":{"ingress-nginx"}}}
+	NodeGroups map[string]NodeGroup `json:"nodeGroups,omitempty"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:="replicated"
+	StorageClass string `json:"storageClass"`
+	// Kubernetes major.minor version to deploy
+	// +kubebuilder:default:="v1.35"
+	Version Version `json:"version"`
+}
+
+type VeleroAddon struct {
+	// Enable Velero.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Custom Helm values overrides.
+	// +kubebuilder:default:={}
+	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
+}
+
+type KonnectivityServer struct {
+	// CPU and memory resources for Konnectivity.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources"`
+	// Preset if `resources` omitted.
+	// +kubebuilder:default:="micro"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+}
+
+type IngressNginxAddon struct {
+	// Enable the controller (requires nodes labeled `ingress-nginx`).
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.
+	// +kubebuilder:default:="Proxied"
+	ExposeMethod IngressNginxExposeMethod `json:"exposeMethod"`
+	// Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.
+	// +kubebuilder:default:={}
+	Hosts []string `json:"hosts,omitempty"`
+	// Custom Helm values overrides.
+	// +kubebuilder:default:={}
+	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
+}
+
+type FluxCDAddon struct {
+	// Enable FluxCD.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Custom Helm values overrides.
+	// +kubebuilder:default:={}
+	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
+}
+
+type APIServer struct {
+	// CPU and memory resources for API Server.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources"`
+	// Preset if `resources` omitted.
+	// +kubebuilder:default:="large"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+}
+
+type Resources struct {
+	// CPU available.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type CoreDNSAddon struct {
+	// Custom Helm values overrides.
+	// +kubebuilder:default:={}
+	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
+}
+
+type Konnectivity struct {
+	// Konnectivity Server configuration.
+	// +kubebuilder:default:={}
+	Server KonnectivityServer `json:"server"`
+}
+
+type ControlPlane struct {
+	// API Server configuration.
+	// +kubebuilder:default:={}
+	ApiServer APIServer `json:"apiServer"`
+	// Controller Manager configuration.
+	// +kubebuilder:default:={}
+	ControllerManager ControllerManager `json:"controllerManager"`
+	// Konnectivity configuration.
+	// +kubebuilder:default:={}
+	Konnectivity Konnectivity `json:"konnectivity"`
+	// Number of control-plane replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Scheduler configuration.
+	// +kubebuilder:default:={}
+	Scheduler Scheduler `json:"scheduler"`
+}
+
+type GPUOperatorAddon struct {
+	// Enable GPU Operator.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Custom Helm values overrides.
+	// +kubebuilder:default:={}
+	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
+}
+
+type Addons struct {
+	// Cert-manager addon.
+	// +kubebuilder:default:={}
+	CertManager CertManagerAddon `json:"certManager"`
+	// Cilium CNI plugin.
+	// +kubebuilder:default:={}
+	Cilium CiliumAddon `json:"cilium"`
+	// CoreDNS addon.
+	// +kubebuilder:default:={}
+	Coredns CoreDNSAddon `json:"coredns"`
+	// FluxCD GitOps operator.
+	// +kubebuilder:default:={}
+	Fluxcd FluxCDAddon `json:"fluxcd"`
+	// Gateway API addon.
+	// +kubebuilder:default:={}
+	GatewayAPI GatewayAPIAddon `json:"gatewayAPI"`
+	// NVIDIA GPU Operator.
+	// +kubebuilder:default:={}
+	GpuOperator GPUOperatorAddon `json:"gpuOperator"`
+	// Ingress-NGINX controller.
+	// +kubebuilder:default:={}
+	IngressNginx IngressNginxAddon `json:"ingressNginx"`
+	// Monitoring agents.
+	// +kubebuilder:default:={}
+	MonitoringAgents MonitoringAgentsAddon `json:"monitoringAgents"`
+	// Velero backup/restore addon.
+	// +kubebuilder:default:={}
+	Velero VeleroAddon `json:"velero"`
+	// Vertical Pod Autoscaler.
+	// +kubebuilder:default:={}
+	VerticalPodAutoscaler VerticalPodAutoscalerAddon `json:"verticalPodAutoscaler"`
+}
+
+type Scheduler struct {
+	// CPU and memory resources for Scheduler.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources"`
+	// Preset if `resources` omitted.
+	// +kubebuilder:default:="micro"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+}
+
+type CertManagerAddon struct {
+	// Enable cert-manager.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Custom Helm values overrides.
+	// +kubebuilder:default:={}
+	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
+}
+
+type MonitoringAgentsAddon struct {
+	// Enable monitoring agents.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Custom Helm values overrides.
+	// +kubebuilder:default:={}
+	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
+}
+
+type GPU struct {
+	// Name of GPU, such as "nvidia.com/AD102GL_L40S".
+	Name string `json:"name"`
+}
+
+type GatewayAPIAddon struct {
+	// Enable Gateway API.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+}
+
+type VerticalPodAutoscalerAddon struct {
+	// Custom Helm values overrides.
+	// +kubebuilder:default:={}
+	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
+}
+
+type ControllerManager struct {
+	// CPU and memory resources for Controller Manager.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources"`
+	// Preset if `resources` omitted.
+	// +kubebuilder:default:="micro"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+}
+
+type NodeGroup struct {
+	// Ephemeral storage size.
+	// +kubebuilder:default:="20Gi"
+	EphemeralStorage resource.Quantity `json:"ephemeralStorage"`
+	// List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).
+	Gpus []GPU `json:"gpus,omitempty"`
+	// Virtual machine instance type.
+	// +kubebuilder:default:="u1.medium"
+	InstanceType string `json:"instanceType"`
+	// Maximum number of replicas.
+	// +kubebuilder:default:=10
+	MaxReplicas int `json:"maxReplicas"`
+	// Minimum number of replicas.
+	// +kubebuilder:default:=0
+	MinReplicas int `json:"minReplicas"`
+	// CPU and memory resources for each worker node.
+	Resources Resources `json:"resources"`
+	// List of node roles.
+	Roles []string `json:"roles,omitempty"`
+}
+
+type CiliumAddon struct {
+	// Custom Helm values overrides.
+	// +kubebuilder:default:={}
+	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
+}
+
+// +kubebuilder:validation:Enum="v1.35";"v1.34";"v1.33";"v1.32";"v1.31";"v1.30"
+type Version string
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
+
+// +kubebuilder:validation:Enum="Proxied";"LoadBalancer"
+type IngressNginxExposeMethod string

api/apps/v1alpha1/mariadb/types.go

@@ -0,0 +1,111 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package mariadb
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Backup configuration.
+	// +kubebuilder:default:={}
+	Backup Backup `json:"backup"`
+	// Databases configuration map.
+	// +kubebuilder:default:={}
+	Databases map[string]Database `json:"databases,omitempty"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// Number of MariaDB replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each MariaDB replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="nano"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Persistent Volume Claim size available for application data.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+	// Users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
+	// MariaDB major.minor version to deploy
+	// +kubebuilder:default:="v11.8"
+	Version Version `json:"version"`
+}
+
+type Backup struct {
+	// Retention strategy for cleaning up old backups.
+	// +kubebuilder:default:="--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
+	CleanupStrategy string `json:"cleanupStrategy"`
+	// Enable regular backups (default: false).
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Password for Restic backup encryption.
+	// +kubebuilder:default:="<password>"
+	ResticPassword string `json:"resticPassword"`
+	// Access key for S3 authentication.
+	// +kubebuilder:default:="<your-access-key>"
+	S3AccessKey string `json:"s3AccessKey"`
+	// S3 bucket used for storing backups.
+	// +kubebuilder:default:="s3.example.org/mariadb-backups"
+	S3Bucket string `json:"s3Bucket"`
+	// AWS S3 region where backups are stored.
+	// +kubebuilder:default:="us-east-1"
+	S3Region string `json:"s3Region"`
+	// Secret key for S3 authentication.
+	// +kubebuilder:default:="<your-secret-key>"
+	S3SecretKey string `json:"s3SecretKey"`
+	// Cron schedule for automated backups.
+	// +kubebuilder:default:="0 2 * * *"
+	Schedule string `json:"schedule"`
+}
+
+type Database struct {
+	// Roles assigned to users.
+	Roles DatabaseRoles `json:"roles,omitempty"`
+}
+
+type DatabaseRoles struct {
+	// List of users with admin privileges.
+	Admin []string `json:"admin,omitempty"`
+	// List of users with read-only privileges.
+	Readonly []string `json:"readonly,omitempty"`
+}
+
+type User struct {
+	// Maximum number of connections.
+	MaxUserConnections int `json:"maxUserConnections"`
+	// Password for the user.
+	Password string `json:"password"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
+
+// +kubebuilder:validation:Enum="v11.8";"v11.4";"v10.11";"v10.6"
+type Version string

api/apps/v1alpha1/mongodb/types.go

@@ -0,0 +1,151 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package mongodb
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Backup configuration.
+	// +kubebuilder:default:={}
+	Backup Backup `json:"backup"`
+	// Bootstrap configuration.
+	// +kubebuilder:default:={}
+	Bootstrap Bootstrap `json:"bootstrap"`
+	// Databases configuration map.
+	// +kubebuilder:default:={}
+	Databases map[string]Database `json:"databases,omitempty"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// Number of MongoDB replicas in replica set.
+	// +kubebuilder:default:=3
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each MongoDB replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="small"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Enable sharded cluster mode. When disabled, deploys a replica set.
+	// +kubebuilder:default:=false
+	Sharding bool `json:"sharding"`
+	// Configuration for sharded cluster mode.
+	// +kubebuilder:default:={}
+	ShardingConfig ShardingConfig `json:"shardingConfig"`
+	// Persistent Volume Claim size available for application data.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+	// Users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
+	// MongoDB major version to deploy.
+	// +kubebuilder:default:="v8"
+	Version Version `json:"version"`
+}
+
+type Shard struct {
+	// Shard name.
+	Name string `json:"name"`
+	// Number of replicas in this shard.
+	Replicas int `json:"replicas"`
+	// PVC size for this shard.
+	Size resource.Quantity `json:"size"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type DatabaseRoles struct {
+	// List of users with admin privileges (readWrite + dbAdmin).
+	Admin []string `json:"admin,omitempty"`
+	// List of users with read-only privileges.
+	Readonly []string `json:"readonly,omitempty"`
+}
+
+type Backup struct {
+	// Destination path for backups (e.g. s3://bucket/path/).
+	// +kubebuilder:default:="s3://bucket/path/to/folder/"
+	DestinationPath string `json:"destinationPath,omitempty"`
+	// Enable regular backups.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// S3 endpoint URL for uploads.
+	// +kubebuilder:default:="http://minio-gateway-service:9000"
+	EndpointURL string `json:"endpointURL,omitempty"`
+	// Retention policy (e.g. "30d").
+	// +kubebuilder:default:="30d"
+	RetentionPolicy string `json:"retentionPolicy,omitempty"`
+	// Access key for S3 authentication.
+	// +kubebuilder:default:=""
+	S3AccessKey string `json:"s3AccessKey,omitempty"`
+	// Secret key for S3 authentication.
+	// +kubebuilder:default:=""
+	S3SecretKey string `json:"s3SecretKey,omitempty"`
+	// Cron schedule for automated backups.
+	// +kubebuilder:default:="0 2 * * *"
+	Schedule string `json:"schedule,omitempty"`
+}
+
+type ShardingConfig struct {
+	// PVC size for config servers.
+	// +kubebuilder:default:="3Gi"
+	ConfigServerSize resource.Quantity `json:"configServerSize"`
+	// Number of config server replicas.
+	// +kubebuilder:default:=3
+	ConfigServers int `json:"configServers"`
+	// Number of mongos router replicas.
+	// +kubebuilder:default:=2
+	Mongos int `json:"mongos"`
+	// List of shard configurations.
+	// +kubebuilder:default:={{"name":"rs0","replicas":3,"size":"10Gi"}}
+	Shards []Shard `json:"shards,omitempty"`
+}
+
+type Bootstrap struct {
+	// Name of backup to restore from.
+	// +kubebuilder:default:=""
+	BackupName string `json:"backupName"`
+	// Whether to restore from a backup.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Timestamp for point-in-time recovery; empty means latest.
+	// +kubebuilder:default:=""
+	RecoveryTime string `json:"recoveryTime,omitempty"`
+}
+
+type User struct {
+	// Password for the user (auto-generated if omitted).
+	Password string `json:"password,omitempty"`
+}
+
+type Database struct {
+	// Roles assigned to users.
+	Roles DatabaseRoles `json:"roles,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="v8";"v7";"v6"
+type Version string
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string

api/apps/v1alpha1/nats/types.go

@@ -0,0 +1,80 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package nats
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	k8sRuntime "k8s.io/apimachinery/pkg/runtime"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// NATS configuration.
+	// +kubebuilder:default:={}
+	Config ValuesConfig `json:"config"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// Jetstream configuration.
+	// +kubebuilder:default:={}
+	Jetstream Jetstream `json:"jetstream"`
+	// Number of replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each NATS replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="nano"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+	// Users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
+}
+
+type User struct {
+	// Password for the user.
+	Password string `json:"password,omitempty"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type Jetstream struct {
+	// Enable or disable Jetstream for persistent messaging in NATS.
+	// +kubebuilder:default:=true
+	Enabled bool `json:"enabled"`
+	// Jetstream persistent storage size.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+}
+
+type ValuesConfig struct {
+	// Additional configuration to merge into NATS config.
+	// +kubebuilder:default:={}
+	Merge *k8sRuntime.RawExtension `json:"merge,omitempty"`
+	// Additional resolver configuration to merge into NATS config.
+	// +kubebuilder:default:={}
+	Resolver *k8sRuntime.RawExtension `json:"resolver,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string

api/apps/v1alpha1/openbao/types.go

@@ -0,0 +1,53 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package openbao
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// Number of OpenBAO replicas. HA with Raft is automatically enabled when replicas > 1. Switching between standalone (file storage) and HA (Raft storage) modes requires data migration.
+	// +kubebuilder:default:=1
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each OpenBAO replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="small"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Persistent Volume Claim size for data storage.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+	// Enable the OpenBAO web UI.
+	// +kubebuilder:default:=true
+	Ui bool `json:"ui"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string

api/apps/v1alpha1/postgresql/types.go

@@ -0,0 +1,152 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package postgresql
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Backup configuration.
+	// +kubebuilder:default:={}
+	Backup Backup `json:"backup"`
+	// Bootstrap configuration.
+	// +kubebuilder:default:={}
+	Bootstrap Bootstrap `json:"bootstrap"`
+	// Databases configuration map.
+	// +kubebuilder:default:={}
+	Databases map[string]Database `json:"databases,omitempty"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// PostgreSQL server configuration.
+	// +kubebuilder:default:={}
+	Postgresql PostgreSQL `json:"postgresql"`
+	// Quorum configuration for synchronous replication.
+	// +kubebuilder:default:={}
+	Quorum Quorum `json:"quorum"`
+	// Number of Postgres replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each PostgreSQL replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="micro"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Persistent Volume Claim size available for application data.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+	// Users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
+	// PostgreSQL major version to deploy
+	// +kubebuilder:default:="v18"
+	Version Version `json:"version"`
+}
+
+type User struct {
+	// Password for the user.
+	Password string `json:"password,omitempty"`
+	// Whether the user has replication privileges.
+	Replication bool `json:"replication,omitempty"`
+}
+
+type Bootstrap struct {
+	// Whether to restore from a backup.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// Previous cluster name before deletion.
+	// +kubebuilder:default:=""
+	OldName string `json:"oldName"`
+	// Timestamp (RFC3339) for point-in-time recovery; empty means latest.
+	// +kubebuilder:default:=""
+	RecoveryTime string `json:"recoveryTime,omitempty"`
+}
+
+type Quorum struct {
+	// Maximum number of synchronous replicas allowed (must be less than total replicas).
+	// +kubebuilder:default:=0
+	MaxSyncReplicas int `json:"maxSyncReplicas"`
+	// Minimum number of synchronous replicas required for commit.
+	// +kubebuilder:default:=0
+	MinSyncReplicas int `json:"minSyncReplicas"`
+}
+
+type DatabaseRoles struct {
+	// List of users with admin privileges.
+	Admin []string `json:"admin,omitempty"`
+	// List of users with read-only privileges.
+	Readonly []string `json:"readonly,omitempty"`
+}
+
+type Database struct {
+	// List of enabled PostgreSQL extensions.
+	Extensions []string `json:"extensions,omitempty"`
+	// Roles assigned to users.
+	Roles DatabaseRoles `json:"roles,omitempty"`
+}
+
+type Backup struct {
+	// Destination path for backups (e.g. s3://bucket/path/).
+	// +kubebuilder:default:="s3://bucket/path/to/folder/"
+	DestinationPath string `json:"destinationPath,omitempty"`
+	// Enable regular backups.
+	// +kubebuilder:default:=false
+	Enabled bool `json:"enabled"`
+	// S3 endpoint URL for uploads.
+	// +kubebuilder:default:="http://minio-gateway-service:9000"
+	EndpointURL string `json:"endpointURL,omitempty"`
+	// Retention policy (e.g. "30d").
+	// +kubebuilder:default:="30d"
+	RetentionPolicy string `json:"retentionPolicy,omitempty"`
+	// Access key for S3 authentication.
+	// +kubebuilder:default:="<your-access-key>"
+	S3AccessKey string `json:"s3AccessKey,omitempty"`
+	// Secret key for S3 authentication.
+	// +kubebuilder:default:="<your-secret-key>"
+	S3SecretKey string `json:"s3SecretKey,omitempty"`
+	// Cron schedule for automated backups.
+	// +kubebuilder:default:="0 2 * * * *"
+	Schedule string `json:"schedule,omitempty"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type PostgreSQLParameters struct {
+	// Maximum number of concurrent connections to the database server.
+	// +kubebuilder:default:=100
+	MaxConnections int `json:"max_connections,omitempty"`
+}
+
+type PostgreSQL struct {
+	// PostgreSQL server parameters.
+	// +kubebuilder:default:={}
+	Parameters PostgreSQLParameters `json:"parameters,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
+
+// +kubebuilder:validation:Enum="v18";"v17";"v16";"v15";"v14";"v13"
+type Version string

api/apps/v1alpha1/qdrant/types.go

@@ -0,0 +1,50 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package qdrant
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// Number of Qdrant replicas. Cluster mode is automatically enabled when replicas > 1.
+	// +kubebuilder:default:=1
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each Qdrant replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="small"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Persistent Volume Claim size available for vector data storage.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string

api/apps/v1alpha1/rabbitmq/types.go

@@ -0,0 +1,79 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package rabbitmq
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// Number of RabbitMQ replicas.
+	// +kubebuilder:default:=3
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each RabbitMQ replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="nano"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Persistent Volume Claim size available for application data.
+	// +kubebuilder:default:="10Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+	// Users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
+	// RabbitMQ major.minor version to deploy
+	// +kubebuilder:default:="v4.2"
+	Version Version `json:"version"`
+	// Virtual hosts configuration map.
+	// +kubebuilder:default:={}
+	Vhosts map[string]Vhost `json:"vhosts,omitempty"`
+}
+
+type Vhost struct {
+	// Virtual host roles list.
+	Roles Roles `json:"roles"`
+}
+
+type User struct {
+	// Password for the user.
+	Password string `json:"password,omitempty"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type Roles struct {
+	// List of admin users.
+	Admin []string `json:"admin,omitempty"`
+	// List of readonly users.
+	Readonly []string `json:"readonly,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
+
+// +kubebuilder:validation:Enum="v4.2";"v4.1";"v4.0";"v3.13"
+type Version string

api/apps/v1alpha1/redis/types.go

@@ -0,0 +1,59 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package redis
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Enable password generation.
+	// +kubebuilder:default:=true
+	AuthEnabled bool `json:"authEnabled"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// Number of Redis replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each Redis replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="nano"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Persistent Volume Claim size available for application data.
+	// +kubebuilder:default:="1Gi"
+	Size resource.Quantity `json:"size"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:=""
+	StorageClass string `json:"storageClass"`
+	// Redis major version to deploy
+	// +kubebuilder:default:="v8"
+	Version Version `json:"version"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
+
+// +kubebuilder:validation:Enum="v8";"v7"
+type Version string

api/apps/v1alpha1/tcpbalancer/types.go

@@ -0,0 +1,77 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package tcpbalancer
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// HTTP and HTTPS configuration.
+	// +kubebuilder:default:={}
+	HttpAndHttps HttpAndHttps `json:"httpAndHttps"`
+	// Number of HAProxy replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each TCP Balancer replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="nano"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// List of allowed client networks.
+	// +kubebuilder:default:={}
+	Whitelist []string `json:"whitelist,omitempty"`
+	// Secure HTTP by whitelisting client networks (default: false).
+	// +kubebuilder:default:=false
+	WhitelistHTTP bool `json:"whitelistHTTP"`
+}
+
+type TargetPorts struct {
+	// HTTP port number.
+	// +kubebuilder:default:=80
+	Http int `json:"http"`
+	// HTTPS port number.
+	// +kubebuilder:default:=443
+	Https int `json:"https"`
+}
+
+type HttpAndHttps struct {
+	// Endpoint addresses list.
+	// +kubebuilder:default:={}
+	Endpoints []string `json:"endpoints,omitempty"`
+	// Mode for balancer.
+	// +kubebuilder:default:="tcp"
+	Mode Mode `json:"mode"`
+	// Target ports configuration.
+	// +kubebuilder:default:={}
+	TargetPorts TargetPorts `json:"targetPorts"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string
+
+// +kubebuilder:validation:Enum="tcp";"tcp-with-proxy"
+type Mode string

api/apps/v1alpha1/tenant/types.go

@@ -0,0 +1,40 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package tenant
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Deploy own Etcd cluster.
+	// +kubebuilder:default:=false
+	Etcd bool `json:"etcd"`
+	// The hostname used to access tenant services (defaults to using the tenant name as a subdomain for its parent tenant host).
+	// +kubebuilder:default:=""
+	Host string `json:"host,omitempty"`
+	// Deploy own Ingress Controller.
+	// +kubebuilder:default:=false
+	Ingress bool `json:"ingress"`
+	// Deploy own Monitoring Stack.
+	// +kubebuilder:default:=false
+	Monitoring bool `json:"monitoring"`
+	// Define resource quotas for the tenant.
+	// +kubebuilder:default:={}
+	ResourceQuotas map[string]resource.Quantity `json:"resourceQuotas,omitempty"`
+	// Deploy own SeaweedFS.
+	// +kubebuilder:default:=false
+	Seaweedfs bool `json:"seaweedfs"`
+}

api/apps/v1alpha1/vmdisk/types.go

@@ -0,0 +1,53 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package vmdisk
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Defines if disk should be considered optical.
+	// +kubebuilder:default:=false
+	Optical bool `json:"optical"`
+	// The source image location used to create a disk.
+	// +kubebuilder:default:={}
+	Source Source `json:"source"`
+	// The size of the disk allocated for the virtual machine.
+	// +kubebuilder:default:="5Gi"
+	Storage resource.Quantity `json:"storage"`
+	// StorageClass used to store the data.
+	// +kubebuilder:default:="replicated"
+	StorageClass string `json:"storageClass"`
+}
+
+type SourceImage struct {
+	// Name of the image to use (uploaded as "golden image" or from the list: `ubuntu`, `fedora`, `cirros`, `alpine`, `talos`).
+	Name string `json:"name"`
+}
+
+type SourceHTTP struct {
+	// URL to download the image.
+	Url string `json:"url"`
+}
+
+type Source struct {
+	// Download image from an HTTP source.
+	Http *SourceHTTP `json:"http,omitempty"`
+	// Use image by name.
+	Image *SourceImage `json:"image,omitempty"`
+	// Upload local image.
+	Upload *SourceUpload `json:"upload,omitempty"`
+}

api/apps/v1alpha1/vminstance/types.go

@@ -0,0 +1,96 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package vminstance
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Cloud-init user data.
+	// +kubebuilder:default:=""
+	CloudInit string `json:"cloudInit"`
+	// Seed string to generate SMBIOS UUID for the VM.
+	// +kubebuilder:default:=""
+	CloudInitSeed string `json:"cloudInitSeed"`
+	// Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map
+	// +kubebuilder:default:=""
+	CpuModel string `json:"cpuModel"`
+	// List of disks to attach.
+	// +kubebuilder:default:={}
+	Disks []Disk `json:"disks,omitempty"`
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// Method to pass through traffic to the VM.
+	// +kubebuilder:default:="PortList"
+	ExternalMethod ExternalMethod `json:"externalMethod"`
+	// Ports to forward from outside the cluster.
+	// +kubebuilder:default:={22}
+	ExternalPorts []int `json:"externalPorts,omitempty"`
+	// List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).
+	// +kubebuilder:default:={}
+	Gpus []GPU `json:"gpus,omitempty"`
+	// Virtual Machine preferences profile.
+	// +kubebuilder:default:="ubuntu"
+	InstanceProfile string `json:"instanceProfile"`
+	// Virtual Machine instance type.
+	// +kubebuilder:default:="u1.medium"
+	InstanceType string `json:"instanceType"`
+	// Resource configuration for the virtual machine.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Requested running state of the VirtualMachineInstance
+	// +kubebuilder:default:="Always"
+	RunStrategy RunStrategy `json:"runStrategy"`
+	// List of SSH public keys for authentication.
+	// +kubebuilder:default:={}
+	SshKeys []string `json:"sshKeys,omitempty"`
+	// Additional subnets
+	// +kubebuilder:default:={}
+	Subnets []Subnet `json:"subnets,omitempty"`
+}
+
+type Disk struct {
+	// Disk bus type (e.g. "sata").
+	Bus string `json:"bus,omitempty"`
+	// Disk name.
+	Name string `json:"name"`
+}
+
+type Subnet struct {
+	// Subnet name
+	Name string `json:"name,omitempty"`
+}
+
+type GPU struct {
+	// The name of the GPU resource to attach.
+	Name string `json:"name"`
+}
+
+type Resources struct {
+	// Number of CPU cores allocated.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Amount of memory allocated.
+	Memory resource.Quantity `json:"memory,omitempty"`
+	// Number of CPU sockets (vCPU topology).
+	Sockets resource.Quantity `json:"sockets,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="Always";"Halted";"Manual";"RerunOnFailure";"Once"
+type RunStrategy string
+
+// +kubebuilder:validation:Enum="PortList";"WholeIP"
+type ExternalMethod string

api/apps/v1alpha1/vpc/types.go

@@ -0,0 +1,31 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package vpc
+
+import (
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Subnets of a VPC
+	// +kubebuilder:default:={}
+	Subnets []Subnet `json:"subnets,omitempty"`
+}
+
+type Subnet struct {
+	// IP address range
+	Cidr string `json:"cidr,omitempty"`
+	// Subnet name
+	Name string `json:"name"`
+}

api/apps/v1alpha1/vpn/types.go

@@ -0,0 +1,58 @@
+// +kubebuilder:object:generate=true
+// +kubebuilder:object:root=true
+// +groupName=values.helm.io
+
+// +versionName=v1alpha1
+
+// Code generated by values-gen. DO NOT EDIT.
+package vpn
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type Config struct {
+	v1.TypeMeta   `json:",inline"`
+	v1.ObjectMeta `json:"metadata,omitempty"`
+	Spec          ConfigSpec `json:"spec,omitempty"`
+}
+
+type ConfigSpec struct {
+	// Enable external access from outside the cluster.
+	// +kubebuilder:default:=false
+	External bool `json:"external"`
+	// List of externalIPs for service. Optional. If not specified, will use LoadBalancer service by default.
+	// +kubebuilder:default:={}
+	ExternalIPs []string `json:"externalIPs,omitempty"`
+	// Host used to substitute into generated URLs.
+	// +kubebuilder:default:=""
+	Host string `json:"host"`
+	// Number of VPN server replicas.
+	// +kubebuilder:default:=2
+	Replicas int `json:"replicas"`
+	// Explicit CPU and memory configuration for each VPN server replica. When omitted, the preset defined in `resourcesPreset` is applied.
+	// +kubebuilder:default:={}
+	Resources Resources `json:"resources,omitempty"`
+	// Default sizing preset used when `resources` is omitted.
+	// +kubebuilder:default:="nano"
+	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
+	// Users configuration map.
+	// +kubebuilder:default:={}
+	Users map[string]User `json:"users,omitempty"`
+}
+
+type Resources struct {
+	// CPU available to each replica.
+	Cpu resource.Quantity `json:"cpu,omitempty"`
+	// Memory (RAM) available to each replica.
+	Memory resource.Quantity `json:"memory,omitempty"`
+}
+
+type User struct {
+	// Password for the user (autogenerated if not provided).
+	Password string `json:"password,omitempty"`
+}
+
+// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
+type ResourcesPreset string

docs/changelogs/v1.0.4.md

@@ -0,0 +1,25 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.0.4
+-->
+
+## Fixes
+
+* **[system] Fix Keycloak probe crashloop with management port health endpoints**: Fixed a crashloop where Keycloak 26.x was endlessly restarting because liveness and readiness probes were sending HTTP requests to port 8080. Keycloak 26.x redirects all requests on port 8080 to `KC_HOSTNAME` (HTTPS), and since kubelet does not follow redirects, probes failed, eventually triggering container restarts. The fix switches probes to the dedicated management port 9000 (`/health/live`, `/health/ready`) enabled via `KC_HEALTH_ENABLED=true`, exposes management port 9000, and adds a `startupProbe` with appropriate failure thresholds for better startup tolerance ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2162, #2178).
+
+* **[system] Fix etcd-operator deprecated kube-rbac-proxy image**: Replaced the deprecated `gcr.io/kubebuilder/kube-rbac-proxy:v0.16.0` image with `quay.io/brancz/kube-rbac-proxy:v0.18.1` in the vendored etcd-operator chart. The GCR-hosted image became unavailable after March 18, 2025, causing etcd-operator pods to fail on image pull ([**@kvaps**](https://github.com/kvaps) in #2181, #2183).
+
+* **[platform] Fix VM MAC address not preserved during virtual-machine to vm-instance migration**: During the `virtual-machine` → `vm-instance` migration (script 29), VM MAC addresses were not preserved. Kube-OVN reads MAC addresses exclusively from the pod annotation `ovn.kubernetes.io/mac_address`, not from `spec.macAddress` of the IP resource. Without this annotation, migrated VMs received a new random MAC address, breaking OS-level network configuration that matches by MAC (e.g., netplan). The fix adds a Helm `lookup` in the vm-instance chart template to read the Kube-OVN IP resource and automatically inject the MAC and IP addresses as pod annotations ([**@sircthulhu**](https://github.com/sircthulhu) in #2169, #2191).
+
+* **[dashboard] Fix External IPs page showing empty rows**: Fixed the External IPs administration page displaying empty rows instead of service data. The `EnrichedTable` configuration in the `external-ips` factory was using incorrect property names — replaced `clusterNamePartOfUrl` with `cluster` and changed `pathToItems` from array format to dot-path string format, matching the convention used by all other `EnrichedTable` instances ([**@IvanHunters**](https://github.com/IvanHunters) in #2175, #2192).
+
+* **[dashboard] Fix disabled/hidden state reset on MarketplacePanel reconciliation**: Fixed a bug where the dashboard controller was hardcoding `disabled=false` and `hidden=false` on every reconcile loop, overwriting changes made through the dashboard UI. Services disabled or hidden via the marketplace panel now correctly retain their state after controller reconciliation ([**@IvanHunters**](https://github.com/IvanHunters) in #2176, #2202).
+
+* **[dashboard] Fix hidden MarketplacePanel resources appearing in sidebar menu**: Fixed the sidebar navigation showing all resources regardless of their MarketplacePanel `hidden` state. The controller now fetches MarketplacePanels during sidebar reconciliation and filters out resources where `hidden=true`, ensuring that hiding a resource from the marketplace also removes it from the sidebar navigation. Listing failures are non-fatal — if the configuration fetch fails, no hiding is applied and the dashboard remains functional ([**@IvanHunters**](https://github.com/IvanHunters) in #2177, #2204).
+
+## Documentation
+
+* **[website] Add OIDC self-signed certificates configuration guide**: Added a comprehensive guide for configuring OIDC authentication with Keycloak when using self-signed certificates (the default in Cozystack). Covers Talos machine configuration with certificate mounting and host entries, kubelogin setup instructions, and a troubleshooting section. The guide is available for both v0 and v1 versioned documentation paths ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#443).
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.3...v1.0.4

docs/changelogs/v1.1.0.md

@@ -0,0 +1,126 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.1.0
+-->
+
+# Cozystack v1.1.0
+
+Cozystack v1.1.0 delivers a major expansion of the managed application catalog with **OpenBAO** (open-source HashiCorp Vault fork) for secrets management, comprehensive **tiered object storage** with SeaweedFS storage pools, a new bucket **user model** with per-user credentials and S3 login support, **RabbitMQ version selection**, and **MongoDB Grafana dashboards**. The dashboard gains storageClass dropdowns for all stateful apps. This release also incorporates all fixes from the v1.0.x patch series.
+
+## Feature Highlights
+
+### OpenBAO: Managed Secrets Management Service
+
+Cozystack now ships **OpenBAO** as a fully managed PaaS application — an open-source fork of HashiCorp Vault providing enterprise-grade secrets management. Users can deploy OpenBAO instances in standalone mode (single replica with file storage) or in high-availability Raft mode (multiple replicas with integrated Raft consensus), with the mode switching automatically based on the `replicas` field.
+
+Each OpenBAO instance gets TLS enabled by default via cert-manager self-signed certificates, with DNS SANs covering all service endpoints and pod addresses. The Vault injector and CSI provider are intentionally disabled (they are cluster-scoped components not safe for per-tenant use). OpenBAO requires manual initialization and unsealing by design — no auto-unseal is configured.
+
+A full end-to-end E2E test covers the complete lifecycle: deploy, wait for certificate and API readiness, init, unseal, verify, and cleanup. OpenBAO is available in the application catalog for tenant namespaces.
+
+### SeaweedFS Tiered Storage Pools
+
+SeaweedFS now supports **tiered storage pools** — operators can define separate storage pools per disk type (SSD, HDD, NVMe) in the `volume.pools` field (Simple topology) or `volume.zones[name].pools` (MultiZone topology). Each pool creates an additional Volume StatefulSet alongside the default one, with SeaweedFS distinguishing storage via the `-disk=<type>` flag on volume servers.
+
+Each pool automatically generates its own set of COSI resources: a standard `BucketClass`, a `-lock` BucketClass (COMPLIANCE mode, 365-day retention), a read-write `BucketAccessClass`, and a `-readonly` BucketAccessClass. This allows applications to place data on specific storage tiers and request appropriate access policies per pool.
+
+In MultiZone topology, pools are defined per zone and each zone × pool combination creates a dedicated StatefulSet (e.g., `us-east-ssd`, `us-west-hdd`), with nodes selected via `topology.kubernetes.io/zone` labels. Existing deployments with no pools defined produce output identical to previous versions — no migration is required.
+
+### Bucket User Model with S3 Login
+
+The bucket application introduces a new **user model** for access management. Instead of a single implicit BucketAccess resource, operators now define a `users` map where each entry creates a dedicated `BucketAccess` with its own credentials secret and an optional `readonly` flag. The S3 Manager UI has been updated with a login screen that uses per-session credentials from the user's own secret, replacing the previous basic-auth approach.
+
+Two new bucket parameters are available: `locking` provisions from the `-lock` BucketClass (COMPLIANCE mode, 365-day object lock retention) for write-once-read-many use cases, and `storagePool` selects a specific pool's BucketClass for tiered storage placement. The COSI driver has been updated to v0.3.0 to support the new `diskType` parameter.
+
+**⚠️ Breaking change**: The implicit default BucketAccess resource is no longer created. Existing buckets that relied on the single auto-generated BucketAccess will need to explicitly define users in the `users` map after upgrading.
+
+### RabbitMQ Version Selection
+
+RabbitMQ instances now support a configurable **version selector** (`version` field with values: `v4.2`, `v4.1`, `v4.0`, `v3.13`; default `v4.2`). The chart validates the selection at deploy time and uses it to pin the runtime image, giving operators control over the RabbitMQ release channel per instance. An automatic migration backfills the `version` field on all existing RabbitMQ resources to `v4.2`.
+
+## Major Features and Improvements
+
+* **[apps] Add OpenBAO as a managed secrets management service**: Deployed as a PaaS application with standalone (file storage) and HA Raft modes, TLS enabled by default via cert-manager, injector and CSI provider disabled for tenant safety, and a full E2E lifecycle test ([**@lexfrei**](https://github.com/lexfrei) in #2059).
+
+* **[seaweedfs] Add storage pools support for tiered storage**: Added `volume.pools` (Simple) and `volume.zones[name].pools` (MultiZone) for per-disk-type StatefulSets, zone overrides (`nodeSelector`, `storageClass`, `dataCenter`), per-pool COSI BucketClass and BucketAccessClass resources, and bumped seaweedfs-cosi-driver to v0.3.0 ([**@sircthulhu**](https://github.com/sircthulhu) in #2097).
+
+* **[apps][system] Add bucket user model with locking and storage pool selection**: Replaced implicit BucketAccess with per-user `users` map, added `locking` and `storagePool` parameters, renamed COSI BucketClass suffix from `-worm` to `-lock`, added `-readonly` BucketAccessClass for all topologies, and updated S3 Manager with login screen using per-user credentials ([**@IvanHunters**](https://github.com/IvanHunters) in #2119).
+
+* **[rabbitmq] Add version selection for RabbitMQ instances**: Added `version` field (`v4.2`, `v4.1`, `v4.0`, `v3.13`) with chart-level validation, default `v4.2`, and an automatic migration to backfill the field on existing instances ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2092).
+
+* **[system] Add MongoDB Overview and InMemory Details Grafana dashboards**: Added two comprehensive Grafana dashboards for MongoDB monitoring — Overview (command operations, connections, cursors, query efficiency, write time) and InMemory Details (WiredTiger cache, transactions, concurrency, eviction). Dashboards are registered in `dashboards.list` for automatic GrafanaDashboard CRD generation ([**@IvanHunters**](https://github.com/IvanHunters) in #2158).
+
+* **[dashboard] Add storageClass dropdown for all stateful apps**: Replaced the free-text `storageClass` input with an API-backed dropdown listing available StorageClasses from the cluster. Affects ClickHouse, Harbor, HTTPCache, Kubernetes, MariaDB, MongoDB, NATS, OpenBAO, Postgres, Qdrant, RabbitMQ, Redis, VMDisk (top-level `storageClass`), FoundationDB (`storage.storageClass`), and Kafka (`kafka.storageClass`, `zookeeper.storageClass`) ([**@sircthulhu**](https://github.com/sircthulhu) in #2131).
+
+* **[bucket] Add readonly S3 access credentials**: Added a readonly `BucketAccessClass` to the SeaweedFS COSI chart and updated the bucket application to automatically provision two sets of S3 credentials per bucket: read-write (for UI) and readonly ([**@IvanHunters**](https://github.com/IvanHunters) in #2105).
+
+* **[dashboard] Hide sidebar on cluster-level pages when no tenant selected**: Fixed broken URLs with double `//` on the main cluster page (before tenant selection) by clearing `CUSTOMIZATION_SIDEBAR_FALLBACK_ID` so no sidebar renders when no namespace is selected ([**@sircthulhu**](https://github.com/sircthulhu) in #2106).
+
+* **[cert-manager] Update cert-manager to v1.19.3**: Upgraded cert-manager with new CRDs moved into a dedicated CRD package, added global `nodeSelector` and `hostUsers` (pod user-namespace isolation), and renamed `ServiceMonitor` targetPort default to `http-metrics` ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2070).
+
+* **[dashboard] Add backupClasses dropdown to Plan/BackupJob forms**: Replaced free-text input for `backupClass` field with an API-backed dropdown populated with available BackupClass resources, making it easier to select the correct backup target ([**@androndo**](https://github.com/androndo) in #2104).
+
+## Fixes
+
+* **[platform] Fix package name conversion in migration script**: Fixed the `migrate-to-version-1.0.sh` script to correctly prepend the `cozystack.` prefix when converting `BUNDLE_DISABLE` and `BUNDLE_ENABLE` package name lists, ensuring packages are properly identified during the v0.41→v1.0 upgrade ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2144, #2148).
+
+* **[backups] Fix RBAC for backup controllers**: Updated RBAC permissions for the backup strategy controller to support enhanced backup and restore capabilities, including Velero integration and status management ([**@androndo**](https://github.com/androndo) in #2145).
+
+* **[kubernetes] Set explicit MTU for Cilium in tenant clusters**: Set explicit MTU 1350 for Cilium in KubeVirt-based tenant Kubernetes clusters to prevent packet drops caused by VXLAN encapsulation overhead. Cilium's auto-detection does not account for VXLAN overhead (50 bytes) when the VM interface inherits MTU 1400 from the parent OVN/Geneve overlay, causing intermittent connectivity issues and HTTP 499 errors under load ([**@IvanHunters**](https://github.com/IvanHunters) in #2147).
+
+* **[platform] Prevent cozystack-version ConfigMap from deletion**: Added resource protection annotations to prevent the `cozystack-version` ConfigMap from being accidentally deleted, improving platform stability ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2112, #2114).
+
+* **[installer] Add keep annotation to Namespace and update migration script**: Added `helm.sh/resource-policy: keep` annotation to the `cozy-system` Namespace in the installer Helm chart to prevent Helm from deleting the namespace and all HelmReleases within it when the installer release is removed. The v1.0 migration script is also updated to annotate the namespace and `cozystack-version` ConfigMap before migration ([**@kvaps**](https://github.com/kvaps) in #2122, #2123).
+
+* **[dashboard] Add FlowSchema to exempt BFF from API throttling**: Added a `cozy-dashboard-exempt` FlowSchema to exempt the dashboard Back-End-for-Frontend service account from Kubernetes API Priority and Fairness throttling, preventing 429 errors under load ([**@kvaps**](https://github.com/kvaps) in #2121, #2124).
+
+* **[platform] Suspend cozy-proxy if it conflicts with installer release during migration**: Added a check in the v0.41→v1.0 migration script to detect and suspend the `cozy-proxy` HelmRelease when its `releaseName` is set to `cozystack`, which conflicts with the installer release and would cause `cozystack-operator` deletion during the upgrade ([**@kvaps**](https://github.com/kvaps) in #2128, #2130).
+
+* **[platform] Fix off-by-one error in run-migrations script**: Fixed a bug in the migration runner where the first required migration was always skipped due to an off-by-one error in the migration range calculation ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2126, #2132).
+
+* **[system] Fix Keycloak proxy configuration for v26.x**: Replaced the deprecated `KC_PROXY=edge` environment variable with `KC_PROXY_HEADERS=xforwarded` and `KC_HTTP_ENABLED=true` in the Keycloak StatefulSet. `KC_PROXY` was removed in Keycloak 26.x, previously causing "Non-secure context detected" warnings and broken cookie handling behind a reverse proxy with TLS termination ([**@sircthulhu**](https://github.com/sircthulhu) in #2125, #2134).
+
+* **[dashboard] Allow clearing instanceType field and preserve newlines in secret copy**: Added `allowEmpty: true` to the `instanceType` field in the VMInstance form so users can explicitly clear it to use custom KubeVirt resources without a named instance type. Also fixed newline preservation when copying secrets with CMD+C ([**@sircthulhu**](https://github.com/sircthulhu) in #2135, #2137).
+
+* **[dashboard] Restore stock-instance sidebars for namespace-level pages**: Restored `stock-instance-api-form`, `stock-instance-api-table`, `stock-instance-builtin-form`, and `stock-instance-builtin-table` sidebar resources that were inadvertently removed in #2106. Without these sidebars, namespace-level pages such as Backup Plans rendered as empty pages ([**@sircthulhu**](https://github.com/sircthulhu) in #2136, #2138).
+
+## System Configuration
+
+* **[platform] Disable private key rotation in CA certs**: Set `rotationPolicy: Never` for all CA/root certificates used by system components (ingress-nginx, linstor, linstor-scheduler, seaweedfs, victoria-metrics-operator, kubeovn-webhook, lineage-controller-webhook, cozystack-api, etcd, linstor API/internal) to prevent trust chain problems when CA certificates are reissued ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2113).
+
+## Development, Testing, and CI/CD
+
+* **[ci] Add debug improvements for CI tests**: Added extra debug commands for Kubernetes startup diagnostics and improved error output in CI test runs ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2111).
+
+## Documentation
+
+* **[website] Add object storage guide (pools, buckets, users)**: Added a comprehensive guide covering SeaweedFS object storage configuration including storage pools for tiered storage, bucket creation with access classes, per-user credential management, and credential rotation procedures ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#438).
+
+* **[website] Add Build Your Own Platform (BYOP) guide**: Added a new "Build Your Own Platform" guide and split the installation documentation into platform installation and BYOP sub-pages, with cross-references throughout the documentation ([**@kvaps**](https://github.com/kvaps) in cozystack/website#437).
+
+* **[website] Add white labeling guide**: Added a comprehensive guide for configuring white labeling (branding) in Cozystack v1, covering Dashboard fields (`titleText`, `footerText`, `tenantText`, `logoText`, `logoSvg`, `iconSvg`) and Keycloak fields (`brandName`, `brandHtmlName`). Includes SVG preparation workflow with theme-aware template variables and portable base64 encoding ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#441).
+
+* **[website] Actualize backup and recovery documentation**: Reworked the backup and recovery docs to be user-focused, separating operator and tenant workflows. Added tenant-facing documentation for `BackupJob` and `Plan` resources and a new Velero administration guide for operators ([**@androndo**](https://github.com/androndo) in cozystack/website#434).
+
+* **[website] Add step to protect namespace before upgrading**: Updated the cluster upgrade guide and v0.41→v1.0 migration guide with a required step to annotate the `cozy-system` namespace and `cozystack-version` ConfigMap with `helm.sh/resource-policy=keep` before running `helm upgrade` ([**@kvaps**](https://github.com/kvaps) in cozystack/website#435).
+
+* **[website] Replace bundles documentation with variants**: Renamed the "Bundles" documentation section to "Variants" to match current Cozystack terminology. Removed deprecated variants and added new ones: `default` and `isp-full-generic` ([**@kvaps**](https://github.com/kvaps) in cozystack/website#433).
+
+* **[website] Fix component values override instructions**: Corrected the component values override documentation to reflect current configuration patterns ([**@kvaps**](https://github.com/kvaps) in cozystack/website#436).
+
+## Breaking Changes & Upgrade Notes
+
+* **[bucket] Bucket user model now requires explicit user definitions**: The implicit default `BucketAccess` resource is no longer created automatically. Existing buckets that relied on a single auto-generated credential secret will need to define users explicitly in the `users` map after upgrading. Each user entry creates its own `BucketAccess` resource and credential secret (optionally with `readonly: true`). The COSI BucketClass suffix has also been renamed from `-worm` to `-lock` ([**@IvanHunters**](https://github.com/IvanHunters) in #2119).
+
+## Contributors
+
+We'd like to thank all contributors who made this release possible:
+
+* [**@androndo**](https://github.com/androndo)
+* [**@IvanHunters**](https://github.com/IvanHunters)
+* [**@kvaps**](https://github.com/kvaps)
+* [**@lexfrei**](https://github.com/lexfrei)
+* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil)
+* [**@sircthulhu**](https://github.com/sircthulhu)
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.0...v1.1.0

docs/changelogs/v1.1.1.md

@@ -0,0 +1,23 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.1.1
+-->
+
+## Fixes
+
+* **[dashboard] Fix hidden MarketplacePanel resources appearing in sidebar menu**: The sidebar was generated independently from MarketplacePanels, always showing all resources regardless of their `hidden` state. Fixed by fetching MarketplacePanels during sidebar reconciliation and skipping resources where `hidden=true`, so hiding a resource from the marketplace also removes it from the sidebar navigation ([**@IvanHunters**](https://github.com/IvanHunters) in #2177, #2203).
+
+* **[dashboard] Fix disabled/hidden state overwritten on every MarketplacePanel reconciliation**: The controller was hardcoding `disabled=false` and `hidden=false` on every reconciliation, silently overwriting any user changes made through the dashboard UI. Fixed by reading and preserving the current `disabled`/`hidden` values from the existing resource before updating ([**@IvanHunters**](https://github.com/IvanHunters) in #2176, #2201).
+
+* **[dashboard] Fix External IPs factory EnrichedTable rendering**: The external-IPs table displayed empty rows because the factory used incorrect `EnrichedTable` properties. Replaced `clusterNamePartOfUrl` with `cluster` and changed `pathToItems` from array to dot-path string format, consistent with all other working `EnrichedTable` instances ([**@IvanHunters**](https://github.com/IvanHunters) in #2175, #2193).
+
+* **[platform] Fix VM MAC address not preserved during virtual-machine to vm-instance migration**: Kube-OVN reads MAC address exclusively from the pod annotation `ovn.kubernetes.io/mac_address`, not from the IP resource `spec.macAddress`. Without the annotation, migrated VMs received a new random MAC, breaking OS-level network configurations that match by MAC (e.g. netplan). Added a Helm `lookup` for the Kube-OVN IP resource in the vm-instance chart so that MAC and IP addresses are automatically injected as pod annotations when the resource exists ([**@sircthulhu**](https://github.com/sircthulhu) in #2169, #2190).
+
+* **[etcd-operator] Replace deprecated kube-rbac-proxy image**: The `gcr.io/kubebuilder/kube-rbac-proxy` image became unavailable after Google Container Registry was deprecated. Replaced it with `quay.io/brancz/kube-rbac-proxy` from the original upstream author, restoring etcd-operator functionality ([**@kvaps**](https://github.com/kvaps) in #2181, #2182).
+
+* **[migrations] Handle missing RabbitMQ CRD in migration 34**: Migration 34 failed with an error when the `rabbitmqs.apps.cozystack.io` CRD did not exist — which occurs on clusters where RabbitMQ was never installed. Added a CRD presence check before attempting to list resources so that migration 34 completes cleanly on such clusters ([**@IvanHunters**](https://github.com/IvanHunters) in #2168, #2180).
+
+* **[keycloak] Fix Keycloak crashloop due to misconfigured health probes**: Keycloak 26.x redirects all HTTP requests on port 8080 to the configured HTTPS hostname; since kubelet does not follow redirects, liveness and readiness probes failed causing a crashloop. Fixed by enabling `KC_HEALTH_ENABLED=true`, exposing management port 9000, and switching all probes to `/health/live` and `/health/ready` on port 9000. Also added a `startupProbe` for improved startup tolerance ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #2162, #2179).
+
+---
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.1.0...v1.1.1

hack/e2e-apps/external-dns.bats

@@ -0,0 +1,50 @@
+#!/usr/bin/env bats
+
+teardown() {
+  kubectl -n tenant-test delete externaldns.apps.cozystack.io --all --ignore-not-found 2>/dev/null || true
+}
+
+@test "Create and Verify ExternalDNS with inmemory provider" {
+  name='test'
+  kubectl apply -f - <<EOF
+apiVersion: apps.cozystack.io/v1alpha1
+kind: ExternalDNS
+metadata:
+  name: ${name}
+  namespace: tenant-test
+spec:
+  provider: inmemory
+  domainFilters:
+    - example.com
+EOF
+
+  sleep 5
+  kubectl -n tenant-test wait hr ${name} --timeout=120s --for=condition=ready
+  kubectl -n tenant-test wait hr ${name}-system --timeout=120s --for=condition=ready
+  timeout 60 sh -ec "until kubectl -n tenant-test get deploy -l app.kubernetes.io/instance=${name}-system -o jsonpath='{.items[0].status.readyReplicas}' | grep -q '1'; do sleep 5; done"
+
+  kubectl -n tenant-test delete externaldns.apps.cozystack.io ${name}
+}
+
+@test "Create and Verify ExternalDNS with custom annotationPrefix" {
+  name='test-prefix'
+  kubectl apply -f - <<EOF
+apiVersion: apps.cozystack.io/v1alpha1
+kind: ExternalDNS
+metadata:
+  name: ${name}
+  namespace: tenant-test
+spec:
+  provider: inmemory
+  annotationPrefix: custom-dns/
+  domainFilters:
+    - example.org
+EOF
+
+  sleep 5
+  kubectl -n tenant-test wait hr ${name} --timeout=120s --for=condition=ready
+  kubectl -n tenant-test wait hr ${name}-system --timeout=120s --for=condition=ready
+  timeout 60 sh -ec "until kubectl -n tenant-test get deploy -l app.kubernetes.io/instance=${name}-system -o jsonpath='{.items[0].status.readyReplicas}' | grep -q '1'; do sleep 5; done"
+
+  kubectl -n tenant-test delete externaldns.apps.cozystack.io ${name}
+}

hack/e2e-install-cozystack.bats

@@ -46,6 +46,9 @@ spec:
         publishing:
           host: "example.org"
           apiServerEndpoint: "https://192.168.123.10:6443"
+        bundles:
+          enabledPackages:
+            - cozystack.external-dns-application
 EOF
 
   # Wait until HelmReleases appear & reconcile them
@@ -175,8 +178,8 @@ EOF
 
   # VictoriaMetrics components
   kubectl wait vmalert/vmalert-shortterm vmalertmanager/alertmanager -n tenant-root --for=jsonpath='{.status.updateStatus}'=operational --timeout=15m
-  kubectl wait vlogs/generic -n tenant-root --for=jsonpath='{.status.updateStatus}'=operational --timeout=5m
-  kubectl wait vmcluster/shortterm vmcluster/longterm -n tenant-root --for=jsonpath='{.status.clusterStatus}'=operational --timeout=5m
+  kubectl wait vlclusters/generic -n tenant-root --for=jsonpath='{.status.updateStatus}'=operational --timeout=5m
+  kubectl wait vmcluster/shortterm vmcluster/longterm -n tenant-root --for=jsonpath='{.status.updateStatus}'=operational --timeout=5m
 
   # Grafana
   kubectl wait clusters.postgresql.cnpg.io/grafana-db -n tenant-root --for=condition=ready --timeout=5m

hack/update-codegen.sh

@@ -68,7 +68,7 @@ kube::codegen::gen_client \
     "${SCRIPT_ROOT}/pkg/apis"
 
 $CONTROLLER_GEN object:headerFile="hack/boilerplate.go.txt" paths="./api/..."
-$CONTROLLER_GEN rbac:roleName=manager-role crd paths="./api/..." output:crd:artifacts:config=${TMPDIR} 
+$CONTROLLER_GEN rbac:roleName=manager-role crd paths="./api/..." output:crd:artifacts:config=${TMPDIR}
 
 mv ${TMPDIR}/cozystack.io_packages.yaml ${OPERATOR_CRDDIR}/cozystack.io_packages.yaml
 mv ${TMPDIR}/cozystack.io_packagesources.yaml ${OPERATOR_CRDDIR}/cozystack.io_packagesources.yaml
@@ -80,3 +80,6 @@ mv ${TMPDIR}/backups.cozystack.io*.yaml ${BACKUPS_CORE_CRDDIR}/
 mv ${TMPDIR}/strategy.backups.cozystack.io*.yaml ${BACKUPSTRATEGY_CRDDIR}/
 
 mv ${TMPDIR}/*.yaml ${COZY_CONTROLLER_CRDDIR}/
+
+# Tidy dependencies for standalone api/apps/v1alpha1 submodule
+(cd "${SCRIPT_ROOT}/api/apps/v1alpha1" && go mod tidy)

hack/upload-assets.sh

@@ -14,3 +14,4 @@ gh release upload --clobber $version _out/assets/kernel-amd64
 gh release upload --clobber $version _out/assets/initramfs-metal-amd64.xz
 gh release upload --clobber $version _out/assets/cozypkg-*.tar.gz
 gh release upload --clobber $version _out/assets/cozypkg-checksums.txt
+gh release upload --clobber $version _out/assets/openapi.json

internal/controller/dashboard/marketplacepanel.go

@@ -68,31 +68,46 @@ func (m *Manager) ensureMarketplacePanel(ctx context.Context, crd *cozyv1alpha1.
 		tags[i] = t
 	}
 
-	specMap := map[string]any{
-		"description": d.Description,
-		"name":        displayName,
-		"type":        "nonCrd",
-		"apiGroup":    "apps.cozystack.io",
-		"apiVersion":  "v1alpha1",
-		"plural":      app.Plural, // e.g., "buckets"
-		"disabled":    false,
-		"hidden":      false,
-		"tags":        tags,
-		"icon":        d.Icon,
-	}
-
-	specBytes, err := json.Marshal(specMap)
-	if err != nil {
-		return reconcile.Result{}, err
-	}
-
-	_, err = controllerutil.CreateOrUpdate(ctx, m.Client, mp, func() error {
+	_, err := controllerutil.CreateOrUpdate(ctx, m.Client, mp, func() error {
 		if err := controllerutil.SetOwnerReference(crd, mp, m.Scheme); err != nil {
 			return err
 		}
 		// Add dashboard labels to dynamic resources
 		m.addDashboardLabels(mp, crd, ResourceTypeDynamic)
 
+		// Preserve user-set disabled/hidden values from existing resource
+		disabled := false
+		hidden := false
+		if mp.Spec.Raw != nil {
+			var existing map[string]any
+			if err := json.Unmarshal(mp.Spec.Raw, &existing); err == nil {
+				if v, ok := existing["disabled"].(bool); ok {
+					disabled = v
+				}
+				if v, ok := existing["hidden"].(bool); ok {
+					hidden = v
+				}
+			}
+		}
+
+		specMap := map[string]any{
+			"description": d.Description,
+			"name":        displayName,
+			"type":        "nonCrd",
+			"apiGroup":    "apps.cozystack.io",
+			"apiVersion":  "v1alpha1",
+			"plural":      app.Plural, // e.g., "buckets"
+			"disabled":    disabled,
+			"hidden":      hidden,
+			"tags":        tags,
+			"icon":        d.Icon,
+		}
+
+		specBytes, err := json.Marshal(specMap)
+		if err != nil {
+			return err
+		}
+
 		// Only update spec if it's different to avoid unnecessary updates
 		newSpec := dashv1alpha1.ArbitrarySpec{
 			JSON: apiextv1.JSON{Raw: specBytes},

internal/controller/dashboard/sidebar.go

@@ -38,6 +38,23 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati
 	}
 	all = crdList.Items
 
+	// 1b) Fetch all MarketplacePanels to determine which resources are hidden
+	hiddenResources := map[string]bool{}
+	var mpList dashv1alpha1.MarketplacePanelList
+	if err := m.List(ctx, &mpList, &client.ListOptions{}); err == nil {
+		for i := range mpList.Items {
+			mp := &mpList.Items[i]
+			if mp.Spec.Raw != nil {
+				var spec map[string]any
+				if err := json.Unmarshal(mp.Spec.Raw, &spec); err == nil {
+					if hidden, ok := spec["hidden"].(bool); ok && hidden {
+						hiddenResources[mp.Name] = true
+					}
+				}
+			}
+		}
+	}
+
 	// 2) Build category -> []item map (only for CRDs with spec.dashboard != nil)
 	type item struct {
 		Key    string
@@ -63,6 +80,11 @@ func (m *Manager) ensureSidebar(ctx context.Context, crd *cozyv1alpha1.Applicati
 		plural := pickPlural(kind, def)
 		lowerKind := strings.ToLower(kind)
 
+		// Skip resources hidden via MarketplacePanel
+		if hiddenResources[def.Name] {
+			continue
+		}
+
 		// Check if this resource is a module
 		if def.Spec.Dashboard.Module {
 			// Special case: info should have its own keysAndTags, not be in modules

internal/controller/dashboard/static_refactored.go

@@ -1924,12 +1924,12 @@ func CreateAllFactories() []*dashboardv1alpha1.Factory {
 				map[string]any{
 					"type": "EnrichedTable",
 					"data": map[string]any{
-						"id":                   "external-ips-table",
-						"fetchUrl":             "/api/clusters/{2}/k8s/api/v1/namespaces/{3}/services",
-						"clusterNamePartOfUrl": "{2}",
-						"baseprefix":           "/openapi-ui",
-						"customizationId":      "factory-details-v1.services",
-						"pathToItems":          []any{"items"},
+						"id":              "external-ips-table",
+						"fetchUrl":        "/api/clusters/{2}/k8s/api/v1/namespaces/{3}/services",
+						"cluster":         "{2}",
+						"baseprefix":      "/openapi-ui",
+						"customizationId": "factory-details-v1.services",
+						"pathToItems":     ".items",
 						"fieldSelector": map[string]any{
 							"spec.type": "LoadBalancer",
 						},

packages/apps/bucket/Makefile

@@ -1,5 +1,5 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'bucket' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/bucket/types.go
 	../../../hack/update-crd.sh

packages/apps/clickhouse/Makefile

@@ -4,7 +4,7 @@ include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'clickhouse' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/clickhouse/types.go
 	../../../hack/update-crd.sh
 
 image:

packages/apps/foundationdb/Makefile

@@ -1,4 +1,4 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'foundationdb' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/foundationdb/types.go

packages/apps/foundationdb/README.md

@@ -1,4 +1,4 @@
-# FoundationDB
+# Managed FoundationDB Service
 
 A managed FoundationDB service for Cozystack.
 

packages/apps/harbor/Makefile

@@ -3,5 +3,5 @@ NAME=harbor
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'harbor' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/harbor/types.go
 	../../../hack/update-crd.sh

packages/apps/harbor/README.md

@@ -1,6 +1,6 @@
 # Managed Harbor Container Registry
 
-Harbor is an open source trusted cloud native registry project that stores, signs, and scans content.
+Harbor is an open-source trusted cloud-native registry project that stores, signs, and scans content.
 
 ## Parameters
 

packages/apps/http-cache/Makefile

@@ -17,7 +17,7 @@ image-nginx:
 	rm -f images/nginx-cache.json
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'httpcache' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/httpcache/types.go
 	../../../hack/update-crd.sh
 
 update:

packages/apps/kafka/Makefile

@@ -2,5 +2,5 @@ include ../../../hack/package.mk
 PRESET_ENUM := ["nano","micro","small","medium","large","xlarge","2xlarge"]
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'kafka' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/kafka/types.go
 	../../../hack/update-crd.sh

packages/apps/kubernetes/Makefile

@@ -5,7 +5,7 @@ include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'kubernetes' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/kubernetes/types.go
 	../../../hack/update-crd.sh
 
 update:

packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml

@@ -73,8 +73,8 @@ spec:
           [OUTPUT]
               Name http
               Match kube.*
-              Host vlogs-generic.{{ $targetTenant }}.svc.{{ $clusterDomain }}
-              port 9428
+              Host vlinsert-generic.{{ $targetTenant }}.svc.{{ $clusterDomain }}
+              port 9481
               compress gzip
               uri /insert/jsonline?_stream_fields=stream,kubernetes_pod_name,kubernetes_container_name,kubernetes_namespace_name&_msg_field=log&_time_field=date
               format json_lines

packages/apps/mariadb/Makefile

@@ -4,7 +4,7 @@ include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'mariadb' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/mariadb/types.go
 	../../../hack/update-crd.sh
 
 update:

packages/apps/mariadb/README.md

@@ -15,7 +15,7 @@ This managed service is controlled by mariadb-operator, ensuring efficient manag
 ### How to switch master/slave replica
 
 ```bash
-kubectl edit mariadb <instnace>
+kubectl edit mariadb <instance>
 ```
 update:
 
@@ -54,11 +54,11 @@ more details:
 - **Replication can't be finished with various errors**
 - **Replication can't be finished in case if `binlog` purged**
 
-  Until `mariadbbackup` is not used to bootstrap a node by mariadb-operator (this feature is not inmplemented yet), follow these manual steps to fix it:
+  Until `mariadbbackup` is not used to bootstrap a node by mariadb-operator (this feature is not implemented yet), follow these manual steps to fix it:
   https://github.com/mariadb-operator/mariadb-operator/issues/141#issuecomment-1804760231
 
-- **Corrupted indicies**
-  Sometimes some indecies can be corrupted on master replica, you can recover them from slave:
+- **Corrupted indices**
+  Sometimes some indices can be corrupted on master replica, you can recover them from slave:
 
   ```bash
   mysqldump -h <slave> -P 3306 -u<user> -p<password> --column-statistics=0 <database> <table> ~/tmp/fix-table.sql

packages/apps/mongodb/Makefile

@@ -3,7 +3,7 @@ include ../../../hack/package.mk
 .PHONY: generate update
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'mongodb' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/mongodb/types.go
 	../../../hack/update-crd.sh
 
 update:

packages/apps/nats/Makefile

@@ -1,5 +1,5 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'nats' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/nats/types.go
 	../../../hack/update-crd.sh

packages/apps/openbao/Makefile

@@ -1,5 +1,5 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'openbao' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/openbao/types.go
 	../../../hack/update-crd.sh

packages/apps/postgres/Makefile

@@ -1,7 +1,7 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'postgresql' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/postgresql/types.go
 	../../../hack/update-crd.sh
 
 update:

packages/apps/qdrant/Makefile

@@ -1,5 +1,5 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'qdrant' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/qdrant/types.go
 	../../../hack/update-crd.sh

packages/apps/rabbitmq/Makefile

@@ -1,7 +1,7 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'rabbitmq' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/rabbitmq/types.go
 	../../../hack/update-crd.sh
 
 update:

packages/apps/redis/Makefile

@@ -1,7 +1,7 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'redis' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/redis/types.go
 	../../../hack/update-crd.sh
 
 update:

packages/apps/tcp-balancer/Makefile

@@ -1,5 +1,5 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'tcpbalancer' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/tcpbalancer/types.go
 	../../../hack/update-crd.sh

packages/apps/tenant/Makefile

@@ -1,5 +1,5 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'tenant' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/tenant/types.go
 	../../../hack/update-crd.sh

packages/apps/tenant/templates/networkpolicy.yaml

@@ -207,6 +207,27 @@ spec:
   - toEndpoints:
       - matchLabels:
           "k8s:io.kubernetes.pod.namespace": cozy-kubevirt-cdi
+{{- if .Values.monitoring }}
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: {{ include "tenant.name" . }}-egress-virt-handler
+spec:
+  endpointSelector:
+    matchLabels:
+      "k8s:io.kubernetes.pod.namespace": "{{ include "tenant.name" . }}"
+      "k8s:app.kubernetes.io/name": "vmagent"
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        "k8s:kubevirt.io": "virt-handler"
+        "k8s:io.kubernetes.pod.namespace": "cozy-kubevirt"
+    toPorts:
+    - ports:
+      - port: "8443"
+        protocol: TCP
+{{- end }}
 ---
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy

packages/apps/vm-disk/Makefile

@@ -1,5 +1,5 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'vmdisk' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/vmdisk/types.go
 	../../../hack/update-crd.sh

packages/apps/vm-instance/Makefile

@@ -1,7 +1,7 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'vminstance' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/vminstance/types.go
 	#INSTANCE_TYPES=$$(yq e '.metadata.name' -o=json -r ../../system/kubevirt-instancetypes/templates/instancetypes.yaml | yq 'split(" ") | . + [""]' -o json) \
 	#  && yq -i -o json ".properties.instanceType.enum = $${INSTANCE_TYPES}" values.schema.json
 	PREFERENCES=$$(yq e '.metadata.name' -o=json -r ../../system/kubevirt-instancetypes/templates/preferences.yaml | yq 'split(" ") | . + [""]' -o json) \

packages/apps/vm-instance/templates/vm.yaml

@@ -34,6 +34,12 @@ spec:
     metadata:
       annotations:
         kubevirt.io/allow-pod-bridge-network-live-migration: "true"
+        {{- $ovnIPName := printf "%s.%s" (include "virtual-machine.fullname" .) .Release.Namespace }}
+        {{- $ovnIP := lookup "kubeovn.io/v1" "IP" "" $ovnIPName }}
+        {{- if $ovnIP }}
+        ovn.kubernetes.io/mac_address: {{ $ovnIP.spec.macAddress | quote }}
+        ovn.kubernetes.io/ip_address: {{ $ovnIP.spec.ipAddress | quote }}
+        {{- end }}
       labels:
         {{- include "virtual-machine.labels" . | nindent 8 }}
     spec:

packages/apps/vpc/Makefile

@@ -1,7 +1,7 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json
+	cozyvalues-gen -m 'vpc' -v values.yaml -s values.schema.json -g ../../../api/apps/v1alpha1/vpc/types.go
 	../../../hack/update-crd.sh
 
 update:

packages/apps/vpn/Makefile

@@ -1,5 +1,5 @@
 include ../../../hack/package.mk
 
 generate:
-	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	cozyvalues-gen -m 'vpn' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/vpn/types.go
 	../../../hack/update-crd.sh

packages/core/platform/images/migrations/migrations/34

@@ -13,6 +13,15 @@
 set -euo pipefail
 
 DEFAULT_VERSION="v3.13"
+
+# Skip if the CRD does not exist (rabbitmq was never installed)
+if ! kubectl api-resources --api-group=apps.cozystack.io -o name 2>/dev/null | grep -q '^rabbitmqs\.'; then
+  echo "CRD rabbitmqs.apps.cozystack.io not found, skipping migration"
+  kubectl create configmap -n cozy-system cozystack-version \
+    --from-literal=version=35 --dry-run=client -o yaml | kubectl apply -f-
+  exit 0
+fi
+
 RABBITMQS=$(kubectl get rabbitmqs.apps.cozystack.io -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\n"}{end}')
 for resource in $RABBITMQS; do
   NS="${resource%%/*}"

packages/core/platform/images/migrations/migrations/35

@@ -0,0 +1,21 @@
+#!/bin/sh
+# Migration 35 --> 36
+# Add helm.sh/resource-policy=keep annotation to existing VLogs resources
+# so they are preserved when the monitoring helm release upgrades to VLCluster.
+# Users will need to manually verify the new cluster is working, then optionally
+# migrate historical data and delete old VLogs resources.
+
+set -euo pipefail
+
+VLOGS=$(kubectl get vlogs.operator.victoriametrics.com --all-namespaces --output jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\n"}{end}' 2>/dev/null || true)
+for resource in $VLOGS; do
+  NS="${resource%%/*}"
+  NAME="${resource##*/}"
+  echo "Adding keep annotation to VLogs/$NAME in $NS"
+  kubectl annotate vlogs.operator.victoriametrics.com --namespace "$NS" "$NAME" \
+    helm.sh/resource-policy=keep \
+    --overwrite
+done
+
+kubectl create configmap --namespace cozy-system cozystack-version \
+  --from-literal=version=36 --dry-run=client --output yaml | kubectl apply --filename -

packages/core/platform/sources/external-dns-application.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: PackageSource
+metadata:
+  name: cozystack.external-dns-application
+spec:
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-packages
+    namespace: cozy-system
+    path: /
+  variants:
+    - name: default
+      dependsOn:
+        - cozystack.networking
+      libraries:
+        - name: cozy-lib
+          path: library/cozy-lib
+      components:
+        - name: external-dns-system
+          path: system/external-dns
+        - name: external-dns
+          path: extra/external-dns
+          libraries: ["cozy-lib"]
+        - name: external-dns-rd
+          path: system/external-dns-rd
+          install:
+            namespace: cozy-system
+            releaseName: external-dns-rd

packages/core/platform/templates/bundles/system.yaml

@@ -149,6 +149,7 @@
 {{include "cozystack.platform.package.optional.default" (list "cozystack.nfs-driver" $) }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.telepresence" $) }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.external-dns" $) }}
+{{include "cozystack.platform.package.optional.default" (list "cozystack.external-dns-application" $) }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.external-secrets-operator" $) }}
 {{- if has "cozystack.bootbox" (default (list) .Values.bundles.enabledPackages) }}
 {{include "cozystack.platform.package.default" (list "cozystack.bootbox-application" $) }}

packages/core/platform/values.yaml

@@ -6,7 +6,7 @@ sourceRef:
 migrations:
   enabled: false
   image: ghcr.io/cozystack/cozystack/platform-migrations:v1.1.0@sha256:d7e8955c1ad8c8fbd4ce42b014c0f849d73d0c3faf0cedaac8e15d647fb2f663
-  targetVersion: 35
+  targetVersion: 36
 # Bundle deployment configuration
 bundles:
   system:

packages/extra/external-dns/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: external-dns
+description: External DNS for automatic DNS record management
+icon: /logos/external-dns.svg
+type: application
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process

packages/extra/external-dns/Makefile

@@ -0,0 +1,7 @@
+NAME=external-dns
+
+include ../../../hack/package.mk
+
+generate:
+	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+	../../../hack/update-crd.sh

packages/extra/external-dns/README.md

@@ -0,0 +1,88 @@
+# External DNS
+
+## Parameters
+
+### Common parameters
+
+| Name               | Description                                                                        | Type       | Value         |
+| ------------------ | ---------------------------------------------------------------------------------- | ---------- | ------------- |
+| `provider`         | DNS provider name.                                                                 | `string`   | `{}`          |
+| `domainFilters`    | List of domains this external-dns instance can manage.                             | `[]string` | `[]`          |
+| `policy`           | How DNS records are synchronized.                                                  | `string`   | `upsert-only` |
+| `extraArgs`        | Extra arguments for external-dns.                                                  | `[]string` | `[]`          |
+| `gatewayAPI`       | Enable Gateway API HTTPRoute as a source for DNS records.                          | `bool`     | `false`       |
+| `annotationPrefix` | Custom annotation prefix for external-dns (useful for running multiple instances). | `string`   | `""`          |
+
+
+### Cloudflare
+
+| Name         | Description                      | Type     | Value                                                       |
+| ------------ | -------------------------------- | -------- | ----------------------------------------------------------- |
+| `cloudflare` | Cloudflare provider credentials. | `object` | `{"apiEmail":"","apiKey":"","apiToken":"","proxied":false}` |
+
+
+### AWS
+
+| Name  | Description                       | Type     | Value                                                               |
+| ----- | --------------------------------- | -------- | ------------------------------------------------------------------- |
+| `aws` | AWS Route53 provider credentials. | `object` | `{"accessKeyId":"","region":"","secretAccessKey":"","zoneType":""}` |
+
+
+### Azure
+
+| Name    | Description                     | Type     | Value                                                                                          |
+| ------- | ------------------------------- | -------- | ---------------------------------------------------------------------------------------------- |
+| `azure` | Azure DNS provider credentials. | `object` | `{"aadClientId":"","aadClientSecret":"","resourceGroup":"","subscriptionId":"","tenantId":""}` |
+
+
+### Google
+
+| Name     | Description                            | Type     | Value                                   |
+| -------- | -------------------------------------- | -------- | --------------------------------------- |
+| `google` | Google Cloud DNS provider credentials. | `object` | `{"project":"","serviceAccountKey":""}` |
+
+
+### DigitalOcean
+
+| Name           | Description                            | Type     | Value          |
+| -------------- | -------------------------------------- | -------- | -------------- |
+| `digitalocean` | DigitalOcean DNS provider credentials. | `object` | `{"token":""}` |
+
+
+### Linode
+
+| Name     | Description                      | Type     | Value          |
+| -------- | -------------------------------- | -------- | -------------- |
+| `linode` | Linode DNS provider credentials. | `object` | `{"token":""}` |
+
+
+### OVH
+
+| Name  | Description                   | Type     | Value                                                                         |
+| ----- | ----------------------------- | -------- | ----------------------------------------------------------------------------- |
+| `ovh` | OVH DNS provider credentials. | `object` | `{"applicationKey":"","applicationSecret":"","consumerKey":"","endpoint":""}` |
+
+
+### Exoscale
+
+| Name       | Description                        | Type     | Value                          |
+| ---------- | ---------------------------------- | -------- | ------------------------------ |
+| `exoscale` | Exoscale DNS provider credentials. | `object` | `{"apiKey":"","apiSecret":""}` |
+
+
+### GoDaddy
+
+| Name      | Description                       | Type     | Value                          |
+| --------- | --------------------------------- | -------- | ------------------------------ |
+| `godaddy` | GoDaddy DNS provider credentials. | `object` | `{"apiKey":"","apiSecret":""}` |
+
+
+### Resources
+
+| Name               | Description                                                                                              | Type       | Value  |
+| ------------------ | -------------------------------------------------------------------------------------------------------- | ---------- | ------ |
+| `resources`        | Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied. | `object`   | `{}`   |
+| `resources.cpu`    | CPU available to each replica.                                                                           | `quantity` | `""`   |
+| `resources.memory` | Memory (RAM) available to each replica.                                                                  | `quantity` | `""`   |
+| `resourcesPreset`  | Default sizing preset used when `resources` is omitted.                                                  | `string`   | `nano` |
+

packages/extra/external-dns/charts/cozy-lib

@@ -0,0 +1 @@
+../../../library/cozy-lib

packages/extra/external-dns/config.json

@@ -0,0 +1,23 @@
+{
+  "comments": {
+    "format": "##"
+  },
+  "tags": {
+    "param": "@param",
+    "section": "@section",
+    "descriptionStart": "@descriptionStart",
+    "descriptionEnd": "@descriptionEnd",
+    "skip": "@skip",
+    "extra": "@extra"
+  },
+  "modifiers": {
+    "array": "array",
+    "object": "object",
+    "string": "string",
+    "nullable": "nullable",
+    "default": "default"
+  },
+  "regexp": {
+    "paramsSectionTitle": "Parameters"
+  }
+}

packages/extra/external-dns/logos/external-dns.svg

@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 144 144" width="144" height="144">
+  <defs>
+    <linearGradient id="bg" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" style="stop-color:#3B82F6"/>
+      <stop offset="100%" style="stop-color:#1D4ED8"/>
+    </linearGradient>
+  </defs>
+  <rect width="144" height="144" rx="28" fill="url(#bg)"/>
+  <g transform="translate(72,72)" fill="none" stroke="#fff" stroke-width="4" stroke-linecap="round" stroke-linejoin="round">
+    <!-- Globe -->
+    <circle cx="0" cy="-4" r="32"/>
+    <ellipse cx="0" cy="-4" rx="14" ry="32"/>
+    <line x1="-32" y1="-4" x2="32" y2="-4"/>
+    <path d="M-28,12 Q0,18 28,12"/>
+    <path d="M-28,-20 Q0,-14 28,-20"/>
+    <!-- Arrow pointing out -->
+    <line x1="18" y1="18" x2="36" y2="36"/>
+    <polyline points="28,36 36,36 36,28"/>
+  </g>
+</svg>

packages/extra/external-dns/templates/dashboard-resourcemap.yaml

@@ -0,0 +1,23 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+rules:
+- apiGroups:
+  - helm.toolkit.fluxcd.io
+  resources:
+  - helmreleases
+  resourceNames:
+  - {{ .Release.Name }}
+  verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}-dashboard-resources
+subjects:
+{{ include "cozy-lib.rbac.subjectsForTenantAndAccessLevel" (list "admin" .Release.Namespace) }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}-dashboard-resources
+  apiGroup: rbac.authorization.k8s.io

packages/extra/external-dns/templates/external-dns.yaml

@@ -0,0 +1,169 @@
+{{- if not .Values.provider }}
+{{- fail "provider is required: set it to one of cloudflare, aws, azure, google, digitalocean, linode, ovh, exoscale, godaddy, inmemory" }}
+{{- end }}
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: {{ .Release.Name }}-system
+  labels:
+    app.kubernetes.io/instance: {{ .Release.Name }}-system
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+spec:
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-external-dns-application-default-external-dns-system
+    namespace: cozy-system
+  interval: 5m
+  timeout: 10m
+  install:
+    remediation:
+      retries: -1
+  upgrade:
+    force: true
+    remediation:
+      retries: -1
+  values:
+    external-dns:
+      namespaced: true
+      txtOwnerId: {{ .Release.Namespace | quote }}
+      policy: {{ .Values.policy | quote }}
+      {{- if .Values.annotationPrefix }}
+      annotationPrefix: {{ .Values.annotationPrefix | quote }}
+      {{- end }}
+      provider:
+        name: {{ .Values.provider | quote }}
+      sources:
+        - ingress
+        - service
+        {{- if .Values.gatewayAPI }}
+        - gateway-httproute
+        {{- end }}
+      {{- with .Values.domainFilters }}
+      domainFilters:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+
+      {{- /* Provider-specific credentials and config */}}
+
+      {{- if eq .Values.provider "cloudflare" }}
+      {{- if or .Values.cloudflare.apiToken (and .Values.cloudflare.apiKey .Values.cloudflare.apiEmail) }}
+      env:
+        {{- if .Values.cloudflare.apiToken }}
+        - name: CF_API_TOKEN
+          value: {{ .Values.cloudflare.apiToken | quote }}
+        {{- else }}
+        - name: CF_API_KEY
+          value: {{ .Values.cloudflare.apiKey | quote }}
+        - name: CF_API_EMAIL
+          value: {{ .Values.cloudflare.apiEmail | quote }}
+        {{- end }}
+      {{- end }}
+      {{- if .Values.cloudflare.proxied }}
+      cloudflare:
+        proxied: true
+      {{- end }}
+      {{- end }}
+
+      {{- if eq .Values.provider "aws" }}
+      {{- if or .Values.aws.accessKeyId .Values.aws.secretAccessKey .Values.aws.region }}
+      env:
+        {{- if .Values.aws.accessKeyId }}
+        - name: AWS_ACCESS_KEY_ID
+          value: {{ .Values.aws.accessKeyId | quote }}
+        {{- end }}
+        {{- if .Values.aws.secretAccessKey }}
+        - name: AWS_SECRET_ACCESS_KEY
+          value: {{ .Values.aws.secretAccessKey | quote }}
+        {{- end }}
+        {{- if .Values.aws.region }}
+        - name: AWS_DEFAULT_REGION
+          value: {{ .Values.aws.region | quote }}
+        {{- end }}
+      {{- end }}
+      {{- if .Values.aws.zoneType }}
+      aws:
+        zoneType: {{ .Values.aws.zoneType | quote }}
+      {{- end }}
+      {{- end }}
+
+      {{- if eq .Values.provider "azure" }}
+      {{- if or .Values.azure.tenantId .Values.azure.subscriptionId .Values.azure.resourceGroup .Values.azure.aadClientId .Values.azure.aadClientSecret }}
+      azure:
+        tenantId: {{ .Values.azure.tenantId | quote }}
+        subscriptionId: {{ .Values.azure.subscriptionId | quote }}
+        resourceGroup: {{ .Values.azure.resourceGroup | quote }}
+        aadClientId: {{ .Values.azure.aadClientId | quote }}
+        aadClientSecret: {{ .Values.azure.aadClientSecret | quote }}
+      {{- end }}
+      {{- end }}
+
+      {{- if eq .Values.provider "digitalocean" }}
+      {{- if .Values.digitalocean.token }}
+      env:
+        - name: DO_TOKEN
+          value: {{ .Values.digitalocean.token | quote }}
+      {{- end }}
+      {{- end }}
+
+      {{- if eq .Values.provider "google" }}
+      {{- if or .Values.google.project .Values.google.serviceAccountKey }}
+      google:
+        project: {{ .Values.google.project | quote }}
+        {{- if .Values.google.serviceAccountKey }}
+        serviceAccountKey: {{ .Values.google.serviceAccountKey | quote }}
+        {{- end }}
+      {{- end }}
+      {{- end }}
+
+      {{- if eq .Values.provider "linode" }}
+      {{- if .Values.linode.token }}
+      env:
+        - name: LINODE_TOKEN
+          value: {{ .Values.linode.token | quote }}
+      {{- end }}
+      {{- end }}
+
+      {{- if eq .Values.provider "ovh" }}
+      {{- if or .Values.ovh.endpoint .Values.ovh.applicationKey .Values.ovh.applicationSecret .Values.ovh.consumerKey }}
+      env:
+        - name: OVH_ENDPOINT
+          value: {{ .Values.ovh.endpoint | quote }}
+        - name: OVH_APPLICATION_KEY
+          value: {{ .Values.ovh.applicationKey | quote }}
+        - name: OVH_APPLICATION_SECRET
+          value: {{ .Values.ovh.applicationSecret | quote }}
+        - name: OVH_CONSUMER_KEY
+          value: {{ .Values.ovh.consumerKey | quote }}
+      {{- end }}
+      {{- end }}
+
+      {{- if eq .Values.provider "exoscale" }}
+      {{- if or .Values.exoscale.apiKey .Values.exoscale.apiSecret }}
+      env:
+        - name: EXOSCALE_API_KEY
+          value: {{ .Values.exoscale.apiKey | quote }}
+        - name: EXOSCALE_API_SECRET
+          value: {{ .Values.exoscale.apiSecret | quote }}
+      {{- end }}
+      {{- end }}
+
+      {{- /* extraArgs: merge user-supplied args with provider-specific args (godaddy) */}}
+      {{- $godaddyArgs := list }}
+      {{- if eq .Values.provider "godaddy" }}
+        {{- if .Values.godaddy.apiKey }}
+          {{- $godaddyArgs = append $godaddyArgs (printf "--godaddy-api-key=%s" .Values.godaddy.apiKey) }}
+        {{- end }}
+        {{- if .Values.godaddy.apiSecret }}
+          {{- $godaddyArgs = append $godaddyArgs (printf "--godaddy-api-secret=%s" .Values.godaddy.apiSecret) }}
+        {{- end }}
+      {{- end }}
+      {{- $allArgs := concat (.Values.extraArgs | default list) $godaddyArgs }}
+      {{- with $allArgs }}
+      extraArgs:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+
+      {{- with (include "cozy-lib.resources.defaultingSanitize" (list .Values.resourcesPreset .Values.resources $)) }}
+      resources:
+        {{- . | nindent 8 }}
+      {{- end }}

packages/extra/external-dns/values.schema.json

@@ -0,0 +1,193 @@
+{
+  "title": "Chart Values",
+  "type": "object",
+  "properties": {
+    "annotationPrefix": {
+      "description": "Custom annotation prefix for external-dns (useful for running multiple instances).",
+      "type": "string",
+      "default": ""
+    },
+    "aws": {
+      "description": "AWS Route53 provider credentials.",
+      "type": "object",
+      "default": {
+        "accessKeyId": "",
+        "region": "",
+        "secretAccessKey": "",
+        "zoneType": ""
+      },
+      "x-kubernetes-preserve-unknown-fields": true
+    },
+    "azure": {
+      "description": "Azure DNS provider credentials.",
+      "type": "object",
+      "default": {
+        "aadClientId": "",
+        "aadClientSecret": "",
+        "resourceGroup": "",
+        "subscriptionId": "",
+        "tenantId": ""
+      },
+      "x-kubernetes-preserve-unknown-fields": true
+    },
+    "cloudflare": {
+      "description": "Cloudflare provider credentials.",
+      "type": "object",
+      "default": {
+        "apiEmail": "",
+        "apiKey": "",
+        "apiToken": "",
+        "proxied": false
+      },
+      "x-kubernetes-preserve-unknown-fields": true
+    },
+    "digitalocean": {
+      "description": "DigitalOcean DNS provider credentials.",
+      "type": "object",
+      "default": {
+        "token": ""
+      },
+      "x-kubernetes-preserve-unknown-fields": true
+    },
+    "domainFilters": {
+      "description": "List of domains this external-dns instance can manage.",
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "string"
+      }
+    },
+    "exoscale": {
+      "description": "Exoscale DNS provider credentials.",
+      "type": "object",
+      "default": {
+        "apiKey": "",
+        "apiSecret": ""
+      },
+      "x-kubernetes-preserve-unknown-fields": true
+    },
+    "extraArgs": {
+      "description": "Extra arguments for external-dns.",
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "string"
+      }
+    },
+    "gatewayAPI": {
+      "description": "Enable Gateway API HTTPRoute as a source for DNS records.",
+      "type": "boolean",
+      "default": false
+    },
+    "godaddy": {
+      "description": "GoDaddy DNS provider credentials.",
+      "type": "object",
+      "default": {
+        "apiKey": "",
+        "apiSecret": ""
+      },
+      "x-kubernetes-preserve-unknown-fields": true
+    },
+    "google": {
+      "description": "Google Cloud DNS provider credentials.",
+      "type": "object",
+      "default": {
+        "project": "",
+        "serviceAccountKey": ""
+      },
+      "x-kubernetes-preserve-unknown-fields": true
+    },
+    "linode": {
+      "description": "Linode DNS provider credentials.",
+      "type": "object",
+      "default": {
+        "token": ""
+      },
+      "x-kubernetes-preserve-unknown-fields": true
+    },
+    "ovh": {
+      "description": "OVH DNS provider credentials.",
+      "type": "object",
+      "default": {
+        "applicationKey": "",
+        "applicationSecret": "",
+        "consumerKey": "",
+        "endpoint": ""
+      },
+      "x-kubernetes-preserve-unknown-fields": true
+    },
+    "policy": {
+      "description": "How DNS records are synchronized.",
+      "type": "string",
+      "default": "upsert-only",
+      "enum": [
+        "create-only",
+        "sync",
+        "upsert-only"
+      ]
+    },
+    "provider": {
+      "description": "DNS provider name.",
+      "type": "string",
+      "enum": [
+        "cloudflare",
+        "aws",
+        "azure",
+        "google",
+        "digitalocean",
+        "linode",
+        "ovh",
+        "exoscale",
+        "godaddy",
+        "inmemory"
+      ]
+    },
+    "resources": {
+      "description": "Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.",
+      "type": "object",
+      "default": {},
+      "properties": {
+        "cpu": {
+          "description": "CPU available to each replica.",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        },
+        "memory": {
+          "description": "Memory (RAM) available to each replica.",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "x-kubernetes-int-or-string": true
+        }
+      }
+    },
+    "resourcesPreset": {
+      "description": "Default sizing preset used when `resources` is omitted.",
+      "type": "string",
+      "default": "nano",
+      "enum": [
+        "nano",
+        "micro",
+        "small",
+        "medium",
+        "large",
+        "xlarge",
+        "2xlarge"
+      ]
+    }
+  }
+}

packages/extra/external-dns/values.yaml

@@ -0,0 +1,149 @@
+##
+## @section Common parameters
+##
+
+## @enum {string} Provider - DNS provider.
+## @value cloudflare
+## @value aws
+## @value azure
+## @value google
+## @value digitalocean
+## @value linode
+## @value ovh
+## @value exoscale
+## @value godaddy
+## @value inmemory
+
+## @param {Provider} provider - DNS provider name.
+# provider:
+
+## @param {[]string} domainFilters - List of domains this external-dns instance can manage.
+domainFilters: []
+
+## @enum {string} Policy - How DNS records are synchronized.
+## @value create-only
+## @value sync
+## @value upsert-only
+
+## @param {Policy} policy="upsert-only" - How DNS records are synchronized.
+policy: "upsert-only"
+
+## @param {[]string} extraArgs - Extra arguments for external-dns.
+extraArgs: []
+
+## @param {bool} gatewayAPI=false - Enable Gateway API HTTPRoute as a source for DNS records.
+gatewayAPI: false
+
+## @param {string} [annotationPrefix] - Custom annotation prefix for external-dns (useful for running multiple instances).
+annotationPrefix: ""
+
+##
+## @section Cloudflare
+##
+
+## @param {object} cloudflare - Cloudflare provider credentials.
+cloudflare:
+  apiToken: ""
+  apiKey: ""
+  apiEmail: ""
+  proxied: false
+
+##
+## @section AWS
+##
+
+## @param {object} aws - AWS Route53 provider credentials.
+aws:
+  accessKeyId: ""
+  secretAccessKey: ""
+  region: ""
+  zoneType: ""
+
+##
+## @section Azure
+##
+
+## @param {object} azure - Azure DNS provider credentials.
+azure:
+  tenantId: ""
+  subscriptionId: ""
+  resourceGroup: ""
+  aadClientId: ""
+  aadClientSecret: ""
+
+##
+## @section Google
+##
+
+## @param {object} google - Google Cloud DNS provider credentials.
+google:
+  project: ""
+  serviceAccountKey: ""
+
+##
+## @section DigitalOcean
+##
+
+## @param {object} digitalocean - DigitalOcean DNS provider credentials.
+digitalocean:
+  token: ""
+
+##
+## @section Linode
+##
+
+## @param {object} linode - Linode DNS provider credentials.
+linode:
+  token: ""
+
+##
+## @section OVH
+##
+
+## @param {object} ovh - OVH DNS provider credentials.
+ovh:
+  endpoint: ""
+  applicationKey: ""
+  applicationSecret: ""
+  consumerKey: ""
+
+##
+## @section Exoscale
+##
+
+## @param {object} exoscale - Exoscale DNS provider credentials.
+exoscale:
+  apiKey: ""
+  apiSecret: ""
+
+##
+## @section GoDaddy
+##
+
+## @param {object} godaddy - GoDaddy DNS provider credentials.
+godaddy:
+  apiKey: ""
+  apiSecret: ""
+
+##
+## @section Resources
+##
+
+## @typedef {struct} Resources - Explicit CPU and memory configuration.
+## @field {quantity} [cpu] - CPU available to each replica.
+## @field {quantity} [memory] - Memory (RAM) available to each replica.
+
+## @enum {string} ResourcesPreset - Default sizing preset.
+## @value nano
+## @value micro
+## @value small
+## @value medium
+## @value large
+## @value xlarge
+## @value 2xlarge
+
+## @param {Resources} [resources] - Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
+resources: {}
+
+## @param {ResourcesPreset} resourcesPreset="nano" - Default sizing preset used when `resources` is omitted.
+resourcesPreset: "nano"

packages/extra/monitoring/templates/dashboard-resourcemap.yaml

@@ -42,7 +42,9 @@ rules:
   - {{ .name }}-vminsert
   {{- end }}
   {{- range .Values.logsStorages }}
-  - {{ $.Release.Name }}-vlogs-{{ .name }}
+  - {{ .name }}-vlstorage
+  - {{ .name }}-vlselect
+  - {{ .name }}-vlinsert
   {{- end }}
   {{- range .Values.metricsStorages }}
   - vmalert-{{ .name }}

packages/extra/monitoring/templates/workloadmonitors.yaml

@@ -67,16 +67,46 @@ spec:
 apiVersion: cozystack.io/v1alpha1
 kind: WorkloadMonitor
 metadata:
-  name: vlogs-{{ .name }}
+  name: {{ .name }}-vlstorage
 spec:
-  replicas: 1
+  replicas: 2
   minReplicas: 1
   kind: monitoring
-  type: vlogs
+  type: vlstorage
   selector:
     app.kubernetes.io/component: monitoring
     app.kubernetes.io/instance: {{ .name }}
-    app.kubernetes.io/name: vlogs
+    app.kubernetes.io/name: vlstorage
+  version: {{ $.Chart.Version }}
+---
+apiVersion: cozystack.io/v1alpha1
+kind: WorkloadMonitor
+metadata:
+  name: {{ .name }}-vlselect
+spec:
+  replicas: 2
+  minReplicas: 1
+  kind: monitoring
+  type: vlselect
+  selector:
+    app.kubernetes.io/component: monitoring
+    app.kubernetes.io/instance: {{ .name }}
+    app.kubernetes.io/name: vlselect
+  version: {{ $.Chart.Version }}
+---
+apiVersion: cozystack.io/v1alpha1
+kind: WorkloadMonitor
+metadata:
+  name: {{ .name }}-vlinsert
+spec:
+  replicas: 2
+  minReplicas: 1
+  kind: monitoring
+  type: vlinsert
+  selector:
+    app.kubernetes.io/component: monitoring
+    app.kubernetes.io/instance: {{ .name }}
+    app.kubernetes.io/name: vlinsert
   version: {{ $.Chart.Version }}
 {{- end }}
 ---

packages/system/cilium/Makefile

@@ -10,7 +10,7 @@ update:
 	rm -rf charts
 	helm repo add cilium https://helm.cilium.io/
 	helm repo update cilium
-	helm pull cilium/cilium --untar --untardir charts --version 1.18
+	helm pull cilium/cilium --untar --untardir charts --version 1.19
 	$(SED_INPLACE) -e '/Used in iptables/d' -e '/SYS_MODULE/d' charts/cilium/values.yaml
 	version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \
 	$(SED_INPLACE) "s/ARG VERSION=.*/ARG VERSION=v$${version}/" images/cilium/Dockerfile

packages/system/cilium/charts/cilium/Chart.yaml

@@ -41,11 +41,8 @@ annotations:
     namespace context.\n- kind: CiliumNodeConfig\n  version: v2\n  name: ciliumnodeconfigs.cilium.io\n
     \ displayName: Cilium Node Configuration\n  description: |\n    CiliumNodeConfig
     is a list of configuration key-value pairs. It is applied to\n    nodes indicated
-    by a label selector.\n- kind: CiliumBGPPeeringPolicy\n  version: v2alpha1\n  name:
-    ciliumbgppeeringpolicies.cilium.io\n  displayName: Cilium BGP Peering Policy\n
-    \ description: |\n    Cilium BGP Peering Policy instructs Cilium to create specific
-    BGP peering\n    configurations.\n- kind: CiliumBGPClusterConfig\n  version: v2alpha1\n
-    \ name: ciliumbgpclusterconfigs.cilium.io\n  displayName: Cilium BGP Cluster Config\n
+    by a label selector.\n- kind: CiliumBGPClusterConfig\n  version: v2alpha1\n  name:
+    ciliumbgpclusterconfigs.cilium.io\n  displayName: Cilium BGP Cluster Config\n
     \ description: |\n    Cilium BGP Cluster Config instructs Cilium operator to create
     specific BGP cluster\n    configurations.\n- kind: CiliumBGPPeerConfig\n  version:
     v2alpha1\n  name: ciliumbgppeerconfigs.cilium.io\n  displayName: Cilium BGP Peer
@@ -79,7 +76,7 @@ annotations:
     Cilium Gateway Class Config\n  description: |\n    CiliumGatewayClassConfig defines
     a configuration for Gateway API GatewayClass.\n"
 apiVersion: v2
-appVersion: 1.18.6
+appVersion: 1.19.1
 description: eBPF-based Networking, Security, and Observability
 home: https://cilium.io/
 icon: https://cdn.jsdelivr.net/gh/cilium/cilium@main/Documentation/images/logo-solo.svg
@@ -95,4 +92,4 @@ kubeVersion: '>= 1.21.0-0'
 name: cilium
 sources:
 - https://github.com/cilium/cilium
-version: 1.18.6
+version: 1.19.1

packages/system/cilium/charts/cilium/README.md

@@ -1,6 +1,6 @@
 # cilium
 
-![Version: 1.18.6](https://img.shields.io/badge/Version-1.18.6-informational?style=flat-square) ![AppVersion: 1.18.6](https://img.shields.io/badge/AppVersion-1.18.6-informational?style=flat-square)
+![Version: 1.19.1](https://img.shields.io/badge/Version-1.19.1-informational?style=flat-square) ![AppVersion: 1.19.1](https://img.shields.io/badge/AppVersion-1.19.1-informational?style=flat-square)
 
 Cilium is open source software for providing and transparently securing
 network connectivity and loadbalancing between application workloads such as
@@ -59,10 +59,14 @@ contributors across the globe, there is almost always someone available to help.
 | agentNotReadyTaintKey | string | `"node.cilium.io/agent-not-ready"` | Configure the key of the taint indicating that Cilium is not ready on the node. When set to a value starting with `ignore-taint.cluster-autoscaler.kubernetes.io/`, the Cluster Autoscaler will ignore the taint on its decisions, allowing the cluster to scale up. |
 | aksbyocni.enabled | bool | `false` | Enable AKS BYOCNI integration. Note that this is incompatible with AKS clusters not created in BYOCNI mode: use Azure integration (`azure.enabled`) instead. |
 | alibabacloud.enabled | bool | `false` | Enable AlibabaCloud ENI integration |
+| alibabacloud.nodeSpec.securityGroupTags | list | `[]` |  |
+| alibabacloud.nodeSpec.securityGroups | list | `[]` |  |
+| alibabacloud.nodeSpec.vSwitchTags | list | `[]` |  |
+| alibabacloud.nodeSpec.vSwitches | list | `[]` |  |
 | annotateK8sNode | bool | `false` | Annotate k8s node upon initialization with Cilium's metadata. |
 | annotations | object | `{}` | Annotations to be added to all top-level cilium-agent objects (resources under templates/cilium-agent) |
 | apiRateLimit | string | `nil` | The api-rate-limit option can be used to overwrite individual settings of the default configuration for rate limiting calls to the Cilium Agent API |
-| authentication.enabled | bool | `true` | Enable authentication processing and garbage collection. Note that if disabled, policy enforcement will still block requests that require authentication. But the resulting authentication requests for these requests will not be processed, therefore the requests not be allowed. |
+| authentication.enabled | bool | `false` | Enable authentication processing and garbage collection. Note that if disabled, policy enforcement will still block requests that require authentication. But the resulting authentication requests for these requests will not be processed, therefore the requests not be allowed. |
 | authentication.gcInterval | string | `"5m0s"` | Interval for garbage collection of auth map entries. |
 | authentication.mutual.connectTimeout | string | `"5s"` | Timeout for connecting to the remote node TCP socket |
 | authentication.mutual.port | int | `4250` | Port on the agent where mutual authentication handshakes between agents will be performed |
@@ -73,7 +77,7 @@ contributors across the globe, there is almost always someone available to help.
 | authentication.mutual.spire.enabled | bool | `false` | Enable SPIRE integration (beta) |
 | authentication.mutual.spire.install.agent.affinity | object | `{}` | SPIRE agent affinity configuration |
 | authentication.mutual.spire.install.agent.annotations | object | `{}` | SPIRE agent annotations |
-| authentication.mutual.spire.install.agent.image | object | `{"digest":"sha256:163970884fba18860cac93655dc32b6af85a5dcf2ebb7e3e119a10888eff8fcd","override":null,"pullPolicy":"IfNotPresent","repository":"ghcr.io/spiffe/spire-agent","tag":"1.12.4","useDigest":true}` | SPIRE agent image |
+| authentication.mutual.spire.install.agent.image | object | `{"digest":"sha256:5106ac601272a88684db14daf7f54b9a45f31f77bb16a906bd5e87756ee7b97c","override":null,"pullPolicy":"IfNotPresent","repository":"ghcr.io/spiffe/spire-agent","tag":"1.9.6","useDigest":true}` | SPIRE agent image |
 | authentication.mutual.spire.install.agent.labels | object | `{}` | SPIRE agent labels |
 | authentication.mutual.spire.install.agent.nodeSelector | object | `{}` | SPIRE agent nodeSelector configuration ref: ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | authentication.mutual.spire.install.agent.podSecurityContext | object | `{}` | Security context to be added to spire agent pods. SecurityContext holds pod-level security attributes and common container settings. ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod |
@@ -85,7 +89,7 @@ contributors across the globe, there is almost always someone available to help.
 | authentication.mutual.spire.install.agent.tolerations | list | `[{"effect":"NoSchedule","key":"node.kubernetes.io/not-ready"},{"effect":"NoSchedule","key":"node-role.kubernetes.io/master"},{"effect":"NoSchedule","key":"node-role.kubernetes.io/control-plane"},{"effect":"NoSchedule","key":"node.cloudprovider.kubernetes.io/uninitialized","value":"true"},{"key":"CriticalAddonsOnly","operator":"Exists"}]` | SPIRE agent tolerations configuration By default it follows the same tolerations as the agent itself to allow the Cilium agent on this node to connect to SPIRE. ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
 | authentication.mutual.spire.install.enabled | bool | `true` | Enable SPIRE installation. This will only take effect only if authentication.mutual.spire.enabled is true |
 | authentication.mutual.spire.install.existingNamespace | bool | `false` | SPIRE namespace already exists. Set to true if Helm should not create, manage, and import the SPIRE namespace. |
-| authentication.mutual.spire.install.initImage | object | `{"digest":"sha256:2383baad1860bbe9d8a7a843775048fd07d8afe292b94bd876df64a69aae7cb1","override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/library/busybox","tag":"1.37.0","useDigest":true}` | init container image of SPIRE agent and server |
+| authentication.mutual.spire.install.initImage | object | `{"digest":"sha256:b3255e7dfbcd10cb367af0d409747d511aeb66dfac98cf30e97e87e4207dd76f","override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/library/busybox","tag":"1.37.0","useDigest":true}` | init container image of SPIRE agent and server |
 | authentication.mutual.spire.install.namespace | string | `"cilium-spire"` | SPIRE namespace to install into |
 | authentication.mutual.spire.install.server.affinity | object | `{}` | SPIRE server affinity configuration |
 | authentication.mutual.spire.install.server.annotations | object | `{}` | SPIRE server annotations |
@@ -95,7 +99,7 @@ contributors across the globe, there is almost always someone available to help.
 | authentication.mutual.spire.install.server.dataStorage.enabled | bool | `true` | Enable SPIRE server data storage |
 | authentication.mutual.spire.install.server.dataStorage.size | string | `"1Gi"` | Size of the SPIRE server data storage |
 | authentication.mutual.spire.install.server.dataStorage.storageClass | string | `nil` | StorageClass of the SPIRE server data storage |
-| authentication.mutual.spire.install.server.image | object | `{"digest":"sha256:34147f27066ab2be5cc10ca1d4bfd361144196467155d46c45f3519f41596e49","override":null,"pullPolicy":"IfNotPresent","repository":"ghcr.io/spiffe/spire-server","tag":"1.12.4","useDigest":true}` | SPIRE server image |
+| authentication.mutual.spire.install.server.image | object | `{"digest":"sha256:59a0b92b39773515e25e68a46c40d3b931b9c1860bc445a79ceb45a805cab8b4","override":null,"pullPolicy":"IfNotPresent","repository":"ghcr.io/spiffe/spire-server","tag":"1.9.6","useDigest":true}` | SPIRE server image |
 | authentication.mutual.spire.install.server.initContainers | list | `[]` | SPIRE server init containers |
 | authentication.mutual.spire.install.server.labels | object | `{}` | SPIRE server labels |
 | authentication.mutual.spire.install.server.nodeSelector | object | `{}` | SPIRE server nodeSelector configuration ref: ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
@@ -114,13 +118,14 @@ contributors across the globe, there is almost always someone available to help.
 | authentication.rotatedIdentitiesQueueSize | int | `1024` | Buffer size of the channel Cilium uses to receive certificate expiration events from auth handlers. |
 | autoDirectNodeRoutes | bool | `false` | Enable installation of PodCIDR routes between worker nodes if worker nodes share a common L2 network segment. |
 | azure.enabled | bool | `false` | Enable Azure integration. Note that this is incompatible with AKS clusters created in BYOCNI mode: use AKS BYOCNI integration (`aksbyocni.enabled`) instead. |
+| azure.nodeSpec.azureInterfaceName | string | `""` |  |
 | bandwidthManager | object | `{"bbr":false,"bbrHostNamespaceOnly":false,"enabled":false}` | Enable bandwidth manager to optimize TCP and UDP workloads and allow for rate-limiting traffic from individual Pods with EDT (Earliest Departure Time) through the "kubernetes.io/egress-bandwidth" Pod annotation. |
 | bandwidthManager.bbr | bool | `false` | Activate BBR TCP congestion control for Pods |
 | bandwidthManager.bbrHostNamespaceOnly | bool | `false` | Activate BBR TCP congestion control for Pods in the host namespace only. |
 | bandwidthManager.enabled | bool | `false` | Enable bandwidth manager infrastructure (also prerequirement for BBR) |
-| bgpControlPlane | object | `{"enabled":false,"legacyOriginAttribute":{"enabled":false},"routerIDAllocation":{"ipPool":"","mode":"default"},"secretsNamespace":{"create":false,"name":"kube-system"},"statusReport":{"enabled":true}}` | This feature set enables virtual BGP routers to be created via CiliumBGPPeeringPolicy CRDs. |
+| bgpControlPlane | object | `{"enabled":false,"legacyOriginAttribute":{"enabled":false},"routerIDAllocation":{"ipPool":"","mode":"default"},"secretsNamespace":{"create":false,"name":"kube-system"},"statusReport":{"enabled":true}}` | This feature set enables virtual BGP routers to be created via BGP CRDs. |
 | bgpControlPlane.enabled | bool | `false` | Enables the BGP control plane. |
-| bgpControlPlane.legacyOriginAttribute | object | `{"enabled":false}` | Legacy BGP ORIGIN attribute settings (BGPv2 only) |
+| bgpControlPlane.legacyOriginAttribute | object | `{"enabled":false}` | Legacy BGP ORIGIN attribute settings |
 | bgpControlPlane.legacyOriginAttribute.enabled | bool | `false` | Enable/Disable advertising LoadBalancerIP routes with the legacy BGP ORIGIN attribute value INCOMPLETE (2) instead of the default IGP (0). Enable for compatibility with the legacy behavior of MetalLB integration. |
 | bgpControlPlane.routerIDAllocation | object | `{"ipPool":"","mode":"default"}` | BGP router-id allocation mode |
 | bgpControlPlane.routerIDAllocation.ipPool | string | `""` | IP pool to allocate the BGP router-id from when the mode is ip-pool. |
@@ -128,20 +133,20 @@ contributors across the globe, there is almost always someone available to help.
 | bgpControlPlane.secretsNamespace | object | `{"create":false,"name":"kube-system"}` | SecretsNamespace is the namespace which BGP support will retrieve secrets from. |
 | bgpControlPlane.secretsNamespace.create | bool | `false` | Create secrets namespace for BGP secrets. |
 | bgpControlPlane.secretsNamespace.name | string | `"kube-system"` | The name of the secret namespace to which Cilium agents are given read access |
-| bgpControlPlane.statusReport | object | `{"enabled":true}` | Status reporting settings (BGPv2 only) |
-| bgpControlPlane.statusReport.enabled | bool | `true` | Enable/Disable BGPv2 status reporting It is recommended to enable status reporting in general, but if you have any issue such as high API server load, you can disable it by setting this to false. |
+| bgpControlPlane.statusReport | object | `{"enabled":true}` | Status reporting settings |
+| bgpControlPlane.statusReport.enabled | bool | `true` | Enable/Disable BGP status reporting It is recommended to enable status reporting in general, but if you have any issue such as high API server load, you can disable it by setting this to false. |
 | bpf.authMapMax | int | `524288` | Configure the maximum number of entries in auth map. |
 | bpf.autoMount.enabled | bool | `true` | Enable automatic mount of BPF filesystem When `autoMount` is enabled, the BPF filesystem is mounted at `bpf.root` path on the underlying host and inside the cilium agent pod. If users disable `autoMount`, it's expected that users have mounted bpffs filesystem at the specified `bpf.root` volume, and then the volume will be mounted inside the cilium agent pod at the same path. |
 | bpf.ctAccounting | bool | `false` | Enable CT accounting for packets and bytes |
 | bpf.ctAnyMax | int | `262144` | Configure the maximum number of entries for the non-TCP connection tracking table. |
 | bpf.ctTcpMax | int | `524288` | Configure the maximum number of entries in the TCP connection tracking table. |
-| bpf.datapathMode | string | `veth` | Mode for Pod devices for the core datapath (veth, netkit, netkit-l2) |
+| bpf.datapathMode | string | `veth` | Mode for Pod devices for the core datapath (veth, netkit, netkit-l2). Note netkit is incompatible with TPROXY (`bpf.tproxy`). |
 | bpf.disableExternalIPMitigation | bool | `false` | Disable ExternalIP mitigation (CVE-2020-8554) |
 | bpf.distributedLRU | object | `{"enabled":false}` | Control to use a distributed per-CPU backend memory for the core BPF LRU maps which Cilium uses. This improves performance significantly, but it is also recommended to increase BPF map sizing along with that. |
 | bpf.distributedLRU.enabled | bool | `false` | Enable distributed LRU backend memory. For compatibility with existing installations it is off by default. |
 | bpf.enableTCX | bool | `true` | Attach endpoint programs using tcx instead of legacy tc hooks on supported kernels. |
 | bpf.events | object | `{"default":{"burstLimit":null,"rateLimit":null},"drop":{"enabled":true},"policyVerdict":{"enabled":true},"trace":{"enabled":true}}` | Control events generated by the Cilium datapath exposed to Cilium monitor and Hubble. Helm configuration for BPF events map rate limiting is experimental and might change in upcoming releases. |
-| bpf.events.default | object | `{"burstLimit":null,"rateLimit":null}` | Default settings for all types of events except dbg and pcap. |
+| bpf.events.default | object | `{"burstLimit":null,"rateLimit":null}` | Default settings for all types of events except dbg. |
 | bpf.events.default.burstLimit | int | `0` | Configure the maximum number of messages that can be written to BPF events map in 1 second. If burstLimit is greater than 0, non-zero value for rateLimit must also be provided lest the configuration is considered invalid. Setting both burstLimit and rateLimit to 0 disables BPF events rate limiting. |
 | bpf.events.default.rateLimit | int | `0` | Configure the limit of messages per second that can be written to BPF events map. The number of messages is averaged, meaning that if no messages were written to the map over 5 seconds, it's possible to write more events in the 6th second. If rateLimit is greater than 0, non-zero value for burstLimit must also be provided lest the configuration is considered invalid. Setting both burstLimit and rateLimit to 0 disables BPF events rate limiting. |
 | bpf.events.drop.enabled | bool | `true` | Enable drop events. |
@@ -158,19 +163,23 @@ contributors across the globe, there is almost always someone available to help.
 | bpf.monitorAggregation | string | `"medium"` | Configure the level of aggregation for monitor notifications. Valid options are none, low, medium, maximum. |
 | bpf.monitorFlags | string | `"all"` | Configure which TCP flags trigger notifications when seen for the first time in a connection. |
 | bpf.monitorInterval | string | `"5s"` | Configure the typical time between monitor notifications for active connections. |
+| bpf.monitorTraceIPOption | int | `0` | Configure the IP tracing option type. This option is used to specify the IP option type to use for tracing. The value must be an integer between 0 and 255. @schema type: [null, integer] minimum: 0 maximum: 255 @schema |
 | bpf.natMax | int | `524288` | Configure the maximum number of entries for the NAT table. |
 | bpf.neighMax | int | `524288` | Configure the maximum number of entries for the neighbor table. |
 | bpf.nodeMapMax | int | `nil` | Configures the maximum number of entries for the node table. |
 | bpf.policyMapMax | int | `16384` | Configure the maximum number of entries in endpoint policy map (per endpoint). @schema type: [null, integer] @schema |
+| bpf.policyMapPressureMetricsThreshold | float64 | `0.1` | Configure threshold for emitting pressure metrics of policy maps. @schema type: [null, number] @schema |
 | bpf.policyStatsMapMax | int | `65536` | Configure the maximum number of entries in global policy stats map. @schema type: [null, integer] @schema |
 | bpf.preallocateMaps | bool | `false` | Enables pre-allocation of eBPF map values. This increases memory usage but can reduce latency. |
 | bpf.root | string | `"/sys/fs/bpf"` | Configure the mount point for the BPF filesystem |
-| bpf.tproxy | bool | `false` | Configure the eBPF-based TPROXY (beta) to reduce reliance on iptables rules for implementing Layer 7 policy. |
+| bpf.tproxy | bool | `false` | Configure the eBPF-based TPROXY (beta) to reduce reliance on iptables rules for implementing Layer 7 policy. Note this is incompatible with netkit (`bpf.datapathMode=netkit`, `bpf.datapathMode=netkit-l2`). |
 | bpf.vlanBypass | list | `[]` | Configure explicitly allowed VLAN id's for bpf logic bypass. [0] will allow all VLAN id's without any filtering. |
 | bpfClockProbe | bool | `false` | Enable BPF clock source probing for more efficient tick retrieval. |
-| certgen | object | `{"affinity":{},"annotations":{"cronJob":{},"job":{}},"extraVolumeMounts":[],"extraVolumes":[],"generateCA":true,"image":{"digest":"sha256:2825dbfa6f89cbed882fd1d81e46a56c087e35885825139923aa29eb8aec47a9","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/certgen","tag":"v0.3.1","useDigest":true},"nodeSelector":{},"podLabels":{},"priorityClassName":"","resources":{},"tolerations":[],"ttlSecondsAfterFinished":1800}` | Configure certificate generation for Hubble integration. If hubble.tls.auto.method=cronJob, these values are used for the Kubernetes CronJob which will be scheduled regularly to (re)generate any certificates not provided manually. |
+| certgen | object | `{"affinity":{},"annotations":{"cronJob":{},"job":{}},"cronJob":{"failedJobsHistoryLimit":1,"successfulJobsHistoryLimit":3},"extraVolumeMounts":[],"extraVolumes":[],"generateCA":true,"image":{"digest":"sha256:19921f48ee7e2295ea4dca955878a6cd8d70e6d4219d08f688e866ece9d95d4d","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/certgen","tag":"v0.3.2","useDigest":true},"nodeSelector":{},"podLabels":{},"priorityClassName":"","resources":{},"tolerations":[],"ttlSecondsAfterFinished":null}` | Configure certificate generation for Hubble integration. If hubble.tls.auto.method=cronJob, these values are used for the Kubernetes CronJob which will be scheduled regularly to (re)generate any certificates not provided manually. |
 | certgen.affinity | object | `{}` | Affinity for certgen |
 | certgen.annotations | object | `{"cronJob":{},"job":{}}` | Annotations to be added to the hubble-certgen initial Job and CronJob |
+| certgen.cronJob.failedJobsHistoryLimit | int | `1` | The number of failed finished jobs to keep |
+| certgen.cronJob.successfulJobsHistoryLimit | int | `3` | The number of successful finished jobs to keep |
 | certgen.extraVolumeMounts | list | `[]` | Additional certgen volumeMounts. |
 | certgen.extraVolumes | list | `[]` | Additional certgen volumes. |
 | certgen.generateCA | bool | `true` | When set to true the certificate authority secret is created. |
@@ -179,7 +188,7 @@ contributors across the globe, there is almost always someone available to help.
 | certgen.priorityClassName | string | `""` | Priority class for certgen ref: https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass |
 | certgen.resources | object | `{}` | Resource limits for certgen ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers |
 | certgen.tolerations | list | `[]` | Node tolerations for pod assignment on nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
-| certgen.ttlSecondsAfterFinished | int | `1800` | Seconds after which the completed job pod will be deleted |
+| certgen.ttlSecondsAfterFinished | string | `nil` | Seconds after which the completed job pod will be deleted |
 | cgroup | object | `{"autoMount":{"enabled":true,"resources":{}},"hostRoot":"/run/cilium/cgroupv2"}` | Configure cgroup related configuration |
 | cgroup.autoMount.enabled | bool | `true` | Enable auto mount of cgroup2 filesystem. When `autoMount` is enabled, cgroup2 filesystem is mounted at `cgroup.hostRoot` path on the underlying host and inside the cilium agent pod. If users disable `autoMount`, it's expected that users have mounted cgroup2 filesystem at the specified `cgroup.hostRoot` volume, and then the volume will be mounted inside the cilium agent pod at the same path. |
 | cgroup.autoMount.resources | object | `{}` | Init Container Cgroup Automount resource limits & requests |
@@ -205,7 +214,7 @@ contributors across the globe, there is almost always someone available to help.
 | clustermesh.apiserver.extraVolumeMounts | list | `[]` | Additional clustermesh-apiserver volumeMounts. |
 | clustermesh.apiserver.extraVolumes | list | `[]` | Additional clustermesh-apiserver volumes. |
 | clustermesh.apiserver.healthPort | int | `9880` | TCP port for the clustermesh-apiserver health API. |
-| clustermesh.apiserver.image | object | `{"digest":"sha256:8ee142912a0e261850c0802d9256ddbe3729e1cd35c6bea2d93077f334c3cf3b","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.18.6","useDigest":true}` | Clustermesh API server image. |
+| clustermesh.apiserver.image | object | `{"digest":"sha256:56d6c3dc13b50126b80ecb571707a0ea97f6db694182b9d61efd386d04e5bb28","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.19.1","useDigest":true}` | Clustermesh API server image. |
 | clustermesh.apiserver.kvstoremesh.enabled | bool | `true` | Enable KVStoreMesh. KVStoreMesh caches the information retrieved from the remote clusters in the local etcd instance (deprecated - KVStoreMesh will always be enabled once the option is removed). |
 | clustermesh.apiserver.kvstoremesh.extraArgs | list | `[]` | Additional KVStoreMesh arguments. |
 | clustermesh.apiserver.kvstoremesh.extraEnv | list | `[]` | Additional KVStoreMesh environment variables. |
@@ -255,38 +264,65 @@ contributors across the globe, there is almost always someone available to help.
 | clustermesh.apiserver.service.annotations | object | `{}` | Annotations for the clustermesh-apiserver service. Example annotations to configure an internal load balancer on different cloud providers: * AKS: service.beta.kubernetes.io/azure-load-balancer-internal: "true" * EKS: service.beta.kubernetes.io/aws-load-balancer-scheme: "internal" * GKE: networking.gke.io/load-balancer-type: "Internal" |
 | clustermesh.apiserver.service.enableSessionAffinity | string | `"HAOnly"` | Defines when to enable session affinity. Each replica in a clustermesh-apiserver deployment runs its own discrete etcd cluster. Remote clients connect to one of the replicas through a shared Kubernetes Service. A client reconnecting to a different backend will require a full resync to ensure data integrity. Session affinity can reduce the likelihood of this happening, but may not be supported by all cloud providers. Possible values:  - "HAOnly" (default) Only enable session affinity for deployments with more than 1 replica.  - "Always" Always enable session affinity.  - "Never" Never enable session affinity. Useful in environments where            session affinity is not supported, but may lead to slightly            degraded performance due to more frequent reconnections. |
 | clustermesh.apiserver.service.externalTrafficPolicy | string | `"Cluster"` | The externalTrafficPolicy of service used for apiserver access. |
+| clustermesh.apiserver.service.externallyCreated | bool | `false` | Set externallyCreated to true to create the clustermesh-apiserver service outside this helm chart. For example after external load balancer controllers are created. |
 | clustermesh.apiserver.service.internalTrafficPolicy | string | `"Cluster"` | The internalTrafficPolicy of service used for apiserver access. |
 | clustermesh.apiserver.service.labels | object | `{}` | Labels for the clustermesh-apiserver service. |
 | clustermesh.apiserver.service.loadBalancerClass | string | `nil` | Configure a loadBalancerClass. Allows to configure the loadBalancerClass on the clustermesh-apiserver LB service in case the Service type is set to LoadBalancer (requires Kubernetes 1.24+). |
 | clustermesh.apiserver.service.loadBalancerIP | string | `nil` | Configure a specific loadBalancerIP. Allows to configure a specific loadBalancerIP on the clustermesh-apiserver LB service in case the Service type is set to LoadBalancer. |
 | clustermesh.apiserver.service.loadBalancerSourceRanges | list | `[]` | Configure loadBalancerSourceRanges. Allows to configure the source IP ranges allowed to access the clustermesh-apiserver LB service in case the Service type is set to LoadBalancer. |
-| clustermesh.apiserver.service.nodePort | int | `32379` | Optional port to use as the node port for apiserver access.  WARNING: make sure to configure a different NodePort in each cluster if kube-proxy replacement is enabled, as Cilium is currently affected by a known bug (#24692) when NodePorts are handled by the KPR implementation. If a service with the same NodePort exists both in the local and the remote cluster, all traffic originating from inside the cluster and targeting the corresponding NodePort will be redirected to a local backend, regardless of whether the destination node belongs to the local or the remote cluster. |
+| clustermesh.apiserver.service.nodePort | int | `32379` | Optional port to use as the node port for apiserver access. |
 | clustermesh.apiserver.service.type | string | `"NodePort"` | The type of service used for apiserver access. |
 | clustermesh.apiserver.terminationGracePeriodSeconds | int | `30` | terminationGracePeriodSeconds for the clustermesh-apiserver deployment |
 | clustermesh.apiserver.tls.admin | object | `{"cert":"","key":""}` | base64 encoded PEM values for the clustermesh-apiserver admin certificate and private key. Used if 'auto' is not enabled. |
-| clustermesh.apiserver.tls.authMode | string | `"legacy"` | Configure the clustermesh authentication mode. Supported values: - legacy:     All clusters access remote clustermesh instances with the same               username (i.e., remote). The "remote" certificate must be               generated with CN=remote if provided manually. - migration:  Intermediate mode required to upgrade from legacy to cluster               (and vice versa) with no disruption. Specifically, it enables               the creation of the per-cluster usernames, while still using               the common one for authentication. The "remote" certificate must               be generated with CN=remote if provided manually (same as legacy). - cluster:    Each cluster accesses remote etcd instances with a username               depending on the local cluster name (i.e., remote-<cluster-name>).               The "remote" certificate must be generated with CN=remote-<cluster-name>               if provided manually. Cluster mode is meaningful only when the same               CA is shared across all clusters part of the mesh. |
+| clustermesh.apiserver.tls.admin.cert | string | `""` | Deprecated, as secrets will always need to be created externally if `auto` is disabled. |
+| clustermesh.apiserver.tls.admin.key | string | `""` | Deprecated, as secrets will always need to be created externally if `auto` is disabled. |
+| clustermesh.apiserver.tls.authMode | string | `"migration"` | Configure the clustermesh authentication mode. Supported values: - legacy:     All clusters access remote clustermesh instances with the same               username (i.e., remote). The "remote" certificate must be               generated with CN=remote if provided manually. - migration:  Intermediate mode required to upgrade from legacy to cluster               (and vice versa) with no disruption. Specifically, it enables               the creation of the per-cluster usernames, while still using               the common one for authentication. The "remote" certificate must               be generated with CN=remote if provided manually (same as legacy). - cluster:    Each cluster accesses remote etcd instances with a username               depending on the local cluster name (i.e., remote-<cluster-name>).               The "remote" certificate must be generated with CN=remote-<cluster-name>               if provided manually. Cluster mode is meaningful only when the same               CA is shared across all clusters part of the mesh. |
 | clustermesh.apiserver.tls.auto | object | `{"certManagerIssuerRef":{},"certValidityDuration":1095,"enabled":true,"method":"helm"}` | Configure automatic TLS certificates generation. A Kubernetes CronJob is used the generate any certificates not provided by the user at installation time. |
 | clustermesh.apiserver.tls.auto.certManagerIssuerRef | object | `{}` | certmanager issuer used when clustermesh.apiserver.tls.auto.method=certmanager. |
 | clustermesh.apiserver.tls.auto.certValidityDuration | int | `1095` | Generated certificates validity duration in days. |
-| clustermesh.apiserver.tls.auto.enabled | bool | `true` | When set to true, automatically generate a CA and certificates to enable mTLS between clustermesh-apiserver and external workload instances. If set to false, the certs to be provided by setting appropriate values below. |
-| clustermesh.apiserver.tls.client | object | `{"cert":"","key":""}` | base64 encoded PEM values for the clustermesh-apiserver client certificate and private key. Used if 'auto' is not enabled. |
-| clustermesh.apiserver.tls.enableSecrets | bool | `true` | Allow users to provide their own certificates Users may need to provide their certificates using a mechanism that requires they provide their own secrets. This setting does not apply to any of the auto-generated mechanisms below, it only restricts the creation of secrets via the `tls-provided` templates. |
+| clustermesh.apiserver.tls.auto.enabled | bool | `true` | When set to true, automatically generate a CA and certificates to enable mTLS between clustermesh-apiserver and external workload instances.  When set to false you need to pre-create the following secrets: - clustermesh-apiserver-server-cert - clustermesh-apiserver-admin-cert - clustermesh-apiserver-remote-cert - clustermesh-apiserver-local-cert The above secret should at least contains the keys `tls.crt` and `tls.key` and optionally `ca.crt` if a CA bundle is not configured. |
+| clustermesh.apiserver.tls.enableSecrets | deprecated | `true` | Allow users to provide their own certificates Users may need to provide their certificates using a mechanism that requires they provide their own secrets. This setting does not apply to any of the auto-generated mechanisms below, it only restricts the creation of secrets via the `tls-provided` templates. This option is deprecated as secrets are expected to be created externally when 'auto' is not enabled. |
 | clustermesh.apiserver.tls.remote | object | `{"cert":"","key":""}` | base64 encoded PEM values for the clustermesh-apiserver remote cluster certificate and private key. Used if 'auto' is not enabled. |
+| clustermesh.apiserver.tls.remote.cert | string | `""` | Deprecated, as secrets will always need to be created externally if `auto` is disabled. |
+| clustermesh.apiserver.tls.remote.key | string | `""` | Deprecated, as secrets will always need to be created externally if `auto` is disabled. |
 | clustermesh.apiserver.tls.server | object | `{"cert":"","extraDnsNames":[],"extraIpAddresses":[],"key":""}` | base64 encoded PEM values for the clustermesh-apiserver server certificate and private key. Used if 'auto' is not enabled. |
+| clustermesh.apiserver.tls.server.cert | string | `""` | Deprecated, as secrets will always need to be created externally if `auto` is disabled. |
 | clustermesh.apiserver.tls.server.extraDnsNames | list | `[]` | Extra DNS names added to certificate when it's auto generated |
 | clustermesh.apiserver.tls.server.extraIpAddresses | list | `[]` | Extra IP addresses added to certificate when it's auto generated |
+| clustermesh.apiserver.tls.server.key | string | `""` | Deprecated, as secrets will always need to be created externally if `auto` is disabled. |
 | clustermesh.apiserver.tolerations | list | `[]` | Node tolerations for pod assignment on nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
 | clustermesh.apiserver.topologySpreadConstraints | list | `[]` | Pod topology spread constraints for clustermesh-apiserver |
 | clustermesh.apiserver.updateStrategy | object | `{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0},"type":"RollingUpdate"}` | clustermesh-apiserver update strategy |
+| clustermesh.cacheTTL | string | `"0s"` | The time to live for the cache of a remote cluster after connectivity is lost. If the connection is not re-established within this duration, the cached data is revoked to prevent stale state. If not specified or set to 0s, the cache is never revoked (default). |
 | clustermesh.config | object | `{"clusters":[],"domain":"mesh.cilium.io","enabled":false}` | Clustermesh explicit configuration. |
-| clustermesh.config.clusters | list | `[]` | List of clusters to be peered in the mesh. |
+| clustermesh.config.clusters | list | `[]` | Clusters to be peered in the mesh. @schema type: [object, array] @schema |
 | clustermesh.config.domain | string | `"mesh.cilium.io"` | Default dns domain for the Clustermesh API servers This is used in the case cluster addresses are not provided and IPs are used. |
-| clustermesh.config.enabled | bool | `false` | Enable the Clustermesh explicit configuration. |
+| clustermesh.config.enabled | bool | `false` | Enable the Clustermesh explicit configuration. If set to false, you need to provide the following resources yourself: - (Secret) cilium-clustermesh (used by cilium-agent/cilium-operator to connect to   the local etcd instance if KVStoreMesh is enabled or the remote clusters   if KVStoreMesh is disabled) - (Secret) cilium-kvstoremesh (used by KVStoreMesh to connect to the remote clusters) - (ConfigMap) clustermesh-remote-users (used to create one etcd user per remote cluster   if clustermesh-apiserver is used and `clustermesh.apiserver.tls.authMode` is not   set to `legacy`) |
 | clustermesh.enableEndpointSliceSynchronization | bool | `false` | Enable the synchronization of Kubernetes EndpointSlices corresponding to the remote endpoints of appropriately-annotated global services through ClusterMesh |
-| clustermesh.enableMCSAPISupport | bool | `false` | Enable Multi-Cluster Services API support |
+| clustermesh.enableMCSAPISupport | bool | `false` | Enable Multi-Cluster Services API support (deprecated; use clustermesh.mcsapi.enabled) |
 | clustermesh.maxConnectedClusters | int | `255` | The maximum number of clusters to support in a ClusterMesh. This value cannot be changed on running clusters, and all clusters in a ClusterMesh must be configured with the same value. Values > 255 will decrease the maximum allocatable cluster-local identities. Supported values are 255 and 511. |
-| clustermesh.policyDefaultLocalCluster | bool | `false` | Control whether policy rules assume by default the local cluster if not explicitly selected |
-| clustermesh.useAPIServer | bool | `false` | Deploy clustermesh-apiserver for clustermesh |
+| clustermesh.mcsapi.corednsAutoConfigure.affinity | object | `{}` | Affinity for coredns-mcsapi-autoconfig |
+| clustermesh.mcsapi.corednsAutoConfigure.annotations | object | `{}` | Annotations to be added to the coredns-mcsapi-autoconfig Job |
+| clustermesh.mcsapi.corednsAutoConfigure.coredns.clusterDomain | string | `"cluster.local"` | The cluster domain for the cluster CoreDNS service |
+| clustermesh.mcsapi.corednsAutoConfigure.coredns.clustersetDomain | string | `"clusterset.local"` | The clusterset domain for the cluster CoreDNS service |
+| clustermesh.mcsapi.corednsAutoConfigure.coredns.configMapName | string | `"coredns"` | The ConfigMap name for the cluster CoreDNS service |
+| clustermesh.mcsapi.corednsAutoConfigure.coredns.deploymentName | string | `"coredns"` | The Deployment for the cluster CoreDNS service |
+| clustermesh.mcsapi.corednsAutoConfigure.coredns.namespace | string | `"kube-system"` | The namespace for the cluster CoreDNS service |
+| clustermesh.mcsapi.corednsAutoConfigure.coredns.serviceAccountName | string | `"coredns"` | The Service Account name for the cluster CoreDNS service |
+| clustermesh.mcsapi.corednsAutoConfigure.enabled | bool | `false` | Enable auto-configuration of CoreDNS for Multi-Cluster Services API.    CoreDNS MUST be at least in version v1.12.2 to run this. |
+| clustermesh.mcsapi.corednsAutoConfigure.extraArgs | list | `[]` | Additional arguments to `clustermesh-apiserver coredns-mcsapi-auto-configure`. |
+| clustermesh.mcsapi.corednsAutoConfigure.extraVolumeMounts | list | `[]` | Additional coredns-mcsapi-autoconfig volumeMounts. |
+| clustermesh.mcsapi.corednsAutoConfigure.extraVolumes | list | `[]` | Additional coredns-mcsapi-autoconfig volumes. |
+| clustermesh.mcsapi.corednsAutoConfigure.nodeSelector | object | `{}` | Node selector for coredns-mcsapi-autoconfig ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
+| clustermesh.mcsapi.corednsAutoConfigure.podLabels | object | `{}` | Labels to be added to coredns-mcsapi-autoconfig pods |
+| clustermesh.mcsapi.corednsAutoConfigure.priorityClassName | string | `""` | Priority class for coredns-mcsapi-autoconfig ref: https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass |
+| clustermesh.mcsapi.corednsAutoConfigure.resources | object | `{}` | Resource limits for coredns-mcsapi-autoconfig ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers |
+| clustermesh.mcsapi.corednsAutoConfigure.tolerations | list | `[]` | Node tolerations for pod assignment on nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
+| clustermesh.mcsapi.corednsAutoConfigure.ttlSecondsAfterFinished | int | `1800` | Seconds after which the completed job pod will be deleted |
+| clustermesh.mcsapi.enabled | bool | `false` | Enable Multi-Cluster Services API support |
+| clustermesh.mcsapi.installCRDs | bool | `true` | Enabled MCS-API CRDs auto-installation |
+| clustermesh.policyDefaultLocalCluster | bool | `true` | Control whether policy rules assume by default the local cluster if not explicitly selected |
+| clustermesh.useAPIServer | bool | `false` | Deploy clustermesh-apiserver for clustermesh. This option is typically used with ``clustermesh.config.enabled=true``. Refer to the ``clustermesh.config.enabled=true``documentation for more information. |
 | cni.binPath | string | `"/opt/cni/bin"` | Configure the path to the CNI binary directory on the host. |
 | cni.chainingMode | string | `nil` | Configure chaining on top of other CNI plugins. Possible values:  - none  - aws-cni  - flannel  - generic-veth  - portmap |
 | cni.chainingTarget | string | `nil` | A CNI network name in to which the Cilium plugin should be added as a chained plugin. This will cause the agent to watch for a CNI network with this network name. When it is found, this will be used as the basis for Cilium's CNI configuration file. If this is set, it assumes a chaining mode of generic-veth. As a special case, a chaining mode of aws-cni implies a chainingTarget of aws-cni. |
@@ -301,15 +337,13 @@ contributors across the globe, there is almost always someone available to help.
 | cni.install | bool | `true` | Install the CNI configuration and binary files into the filesystem. |
 | cni.iptablesRemoveAWSRules | bool | `true` | Enable the removal of iptables rules created by the AWS CNI VPC plugin. |
 | cni.logFile | string | `"/var/run/cilium/cilium-cni.log"` | Configure the log file for CNI logging with retention policy of 7 days. Disable CNI file logging by setting this field to empty explicitly. |
-| cni.resources | object | `{"requests":{"cpu":"100m","memory":"10Mi"}}` | Specifies the resources for the cni initContainer |
+| cni.resources | object | `{"limits":{"cpu":1,"memory":"1Gi"},"requests":{"cpu":"100m","memory":"10Mi"}}` | Specifies the resources for the cni initContainer |
 | cni.uninstall | bool | `false` | Remove the CNI configuration and binary files on agent shutdown. Enable this if you're removing Cilium from the cluster. Disable this to prevent the CNI configuration file from being removed during agent upgrade, which can cause nodes to go unmanageable. |
 | commonLabels | object | `{}` | commonLabels allows users to add common labels for all Cilium resources. |
 | connectivityProbeFrequencyRatio | float64 | `0.5` | Ratio of the connectivity probe frequency vs resource usage, a float in [0, 1]. 0 will give more frequent probing, 1 will give less frequent probing. Probing frequency is dynamically adjusted based on the cluster size. |
 | conntrackGCInterval | string | `"0s"` | Configure how frequently garbage collection should occur for the datapath connection tracking table. |
 | conntrackGCMaxInterval | string | `""` | Configure the maximum frequency for the garbage collection of the connection tracking table. Only affects the automatic computation for the frequency and has no effect when 'conntrackGCInterval' is set. This can be set to more frequently clean up unused identities created from ToFQDN policies. |
 | crdWaitTimeout | string | `"5m"` | Configure timeout in which Cilium will exit if CRDs are not available |
-| customCalls | object | `{"enabled":false}` | Tail call hooks for custom eBPF programs. |
-| customCalls.enabled | bool | `false` | Enable tail call hooks for custom eBPF programs. |
 | daemon.allowedConfigOverrides | string | `nil` | allowedConfigOverrides is a list of config-map keys that can be overridden. That is to say, if this value is set, config sources (excepting the first one) can only override keys in this list.  This takes precedence over blockedConfigOverrides.  By default, all keys may be overridden. To disable overrides, set this to "none" or change the configSources variable. |
 | daemon.blockedConfigOverrides | string | `nil` | blockedConfigOverrides is a list of config-map keys that may not be overridden. In other words, if any of these keys appear in a configuration source excepting the first one, they will be ignored  This is ignored if allowedConfigOverrides is set.  By default, all keys may be overridden. |
 | daemon.configSources | string | `nil` | Configure a custom list of possible configuration override sources The default is "config-map:cilium-config,cilium-node-config". For supported values, see the help text for the build-config subcommand. Note that this value should be a comma-separated string. |
@@ -318,8 +352,8 @@ contributors across the globe, there is almost always someone available to help.
 | dashboards | object | `{"annotations":{},"enabled":false,"label":"grafana_dashboard","labelValue":"1","namespace":null}` | Grafana dashboards for cilium-agent grafana can import dashboards based on the label and value ref: https://github.com/grafana/helm-charts/tree/main/charts/grafana#sidecar-for-dashboards |
 | debug.enabled | bool | `false` | Enable debug logging |
 | debug.metricsSamplingInterval | string | `"5m"` | Set the agent-internal metrics sampling frequency. This sets the frequency of the internal sampling of the agent metrics. These are available via the "cilium-dbg shell -- metrics -s" command and are part of the metrics HTML page included in the sysdump. @schema type: [null, string] @schema |
-| debug.verbose | string | `nil` | Configure verbosity levels for debug logging This option is used to enable debug messages for operations related to such sub-system such as (e.g. kvstore, envoy, datapath or policy), and flow is for enabling debug messages emitted per request, message and connection. Multiple values can be set via a space-separated string (e.g. "datapath envoy").  Applicable values: - flow - kvstore - envoy - datapath - policy |
-| defaultLBServiceIPAM | string | `"lbipam"` | defaultLBServiceIPAM indicates the default LoadBalancer Service IPAM when no LoadBalancer class is set. Applicable values: lbipam, nodeipam, none @schema type: [string] @schema |
+| debug.verbose | string | `nil` | Configure verbosity levels for debug logging This option is used to enable debug messages for operations related to such sub-system such as (e.g. kvstore, envoy, datapath, policy, or tagged), and flow is for enabling debug messages emitted per request, message and connection. Multiple values can be set via a space-separated string (e.g. "datapath envoy").  Applicable values: - flow - kvstore - envoy - datapath - policy - tagged |
+| defaultLBServiceIPAM | string | `"lbipam"` | defaultLBServiceIPAM indicates the default LoadBalancer Service IPAM when no LoadBalancer class is set. Applicable values: lbipam, nodeipam, none |
 | directRoutingSkipUnreachable | bool | `false` | Enable skipping of PodCIDR routes between worker nodes if the worker nodes are in a different L2 network segment. |
 | disableEndpointCRD | bool | `false` | Disable the usage of CiliumEndpoint CRD. |
 | dnsPolicy | string | `""` | DNS policy for Cilium agent pods. Ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy |
@@ -338,13 +372,15 @@ contributors across the globe, there is almost always someone available to help.
 | egressGateway.reconciliationTriggerInterval | string | `"1s"` | Time between triggers of egress gateway state reconciliations |
 | enableCriticalPriorityClass | bool | `true` | Explicitly enable or disable priority class. .Capabilities.KubeVersion is unsettable in `helm template` calls, it depends on k8s libraries version that Helm was compiled against. This option allows to explicitly disable setting the priority class, which is useful for rendering charts for gke clusters in advance. |
 | enableIPv4BIGTCP | bool | `false` | Enables IPv4 BIG TCP support which increases maximum IPv4 GSO/GRO limits for nodes and pods |
-| enableIPv4Masquerade | bool | `true` unless ipam eni mode is active  | Enables masquerading of IPv4 traffic leaving the node from endpoints. |
+| enableIPv4Masquerade | bool | `true` unless ipam eni mode is active | Enables masquerading of IPv4 traffic leaving the node from endpoints. |
 | enableIPv6BIGTCP | bool | `false` | Enables IPv6 BIG TCP support which increases maximum IPv6 GSO/GRO limits for nodes and pods |
 | enableIPv6Masquerade | bool | `true` | Enables masquerading of IPv6 traffic leaving the node from endpoints. |
 | enableInternalTrafficPolicy | bool | `true` | Enable Internal Traffic Policy |
 | enableLBIPAM | bool | `true` | Enable LoadBalancer IP Address Management |
 | enableMasqueradeRouteSource | bool | `false` | Enables masquerading to the source of the route for traffic leaving the node from endpoints. |
+| enableNoServiceEndpointsRoutable | bool | `true` | Enable routing to a service that has zero endpoints |
 | enableNonDefaultDenyPolicies | bool | `true` | Enable Non-Default-Deny policies |
+| enableTunnelBIGTCP | bool | `false` | Enable BIG TCP in tunneling mode and increase maximum GRO/GSO limits for VXLAN/GENEVE tunnels |
 | enableXTSocketFallback | bool | `true` | Enables the fallback compatibility solution for when the xt_socket kernel module is missing and it is needed for the datapath L7 redirection to work properly. See documentation for details on when this can be disabled: https://docs.cilium.io/en/stable/operations/system_requirements/#linux-kernel. |
 | encryption.enabled | bool | `false` | Enable transparent network encryption. |
 | encryption.ipsec.encryptedOverlay | bool | `false` | Enable IPsec encrypted overlay |
@@ -355,11 +391,15 @@ contributors across the globe, there is almost always someone available to help.
 | encryption.ipsec.mountPath | string | `"/etc/ipsec"` | Path to mount the secret inside the Cilium pod. |
 | encryption.ipsec.secretName | string | `"cilium-ipsec-keys"` | Name of the Kubernetes secret containing the encryption keys. |
 | encryption.nodeEncryption | bool | `false` | Enable encryption for pure node to node traffic. This option is only effective when encryption.type is set to "wireguard". |
-| encryption.strictMode | object | `{"allowRemoteNodeIdentities":false,"cidr":"","enabled":false}` | Configure the WireGuard Pod2Pod strict mode. |
-| encryption.strictMode.allowRemoteNodeIdentities | bool | `false` | Allow dynamic lookup of remote node identities. This is required when tunneling is used or direct routing is used and the node CIDR and pod CIDR overlap. |
-| encryption.strictMode.cidr | string | `""` | CIDR for the WireGuard Pod2Pod strict mode. |
-| encryption.strictMode.enabled | bool | `false` | Enable WireGuard Pod2Pod strict mode. |
-| encryption.type | string | `"ipsec"` | Encryption method. Can be either ipsec or wireguard. |
+| encryption.strictMode | object | `{"allowRemoteNodeIdentities":false,"cidr":"","egress":{"allowRemoteNodeIdentities":false,"cidr":"","enabled":false},"enabled":false,"ingress":{"enabled":false}}` | Configure the Encryption Pod2Pod strict mode. |
+| encryption.strictMode.allowRemoteNodeIdentities | bool | `false` | Allow dynamic lookup of remote node identities. (deprecated: please use encryption.strictMode.egress.allowRemoteNodeIdentities) This is required when tunneling is used or direct routing is used and the node CIDR and pod CIDR overlap. |
+| encryption.strictMode.cidr | string | `""` | CIDR for the Encryption Pod2Pod strict mode. (deprecated: please use encryption.strictMode.egress.cidr) |
+| encryption.strictMode.egress.allowRemoteNodeIdentities | bool | `false` | Allow dynamic lookup of remote node identities. This is required when tunneling is used or direct routing is used and the node CIDR and pod CIDR overlap. |
+| encryption.strictMode.egress.cidr | string | `""` | CIDR for the Encryption Pod2Pod strict egress mode. |
+| encryption.strictMode.egress.enabled | bool | `false` | Enable strict egress encryption. |
+| encryption.strictMode.enabled | bool | `false` | Enable Encryption Pod2Pod strict mode. (deprecated: please use encryption.strictMode.egress.enabled) |
+| encryption.strictMode.ingress.enabled | bool | `false` | Enable strict ingress encryption. When enabled, all unencrypted overlay ingress traffic will be dropped. This option is only applicable when WireGuard and tunneling are enabled. |
+| encryption.type | string | `"ipsec"` | Encryption method. Can be one of ipsec, wireguard or ztunnel. |
 | encryption.wireguard.persistentKeepalive | string | `"0s"` | Controls WireGuard PersistentKeepalive option. Set 0s to disable. |
 | endpointHealthChecking.enabled | bool | `true` | Enable connectivity health checking between virtual endpoints. |
 | endpointLockdownOnMapOverflow | bool | `false` | Enable endpoint lockdown on policy map overflow. |
@@ -373,12 +413,24 @@ contributors across the globe, there is almost always someone available to help.
 | eni.gcTags | object | `{"io.cilium/cilium-managed":"true,"io.cilium/cluster-name":"<auto-detected>"}` | Additional tags attached to ENIs created by Cilium. Dangling ENIs with this tag will be garbage collected |
 | eni.iamRole | string | `""` | If using IAM role for Service Accounts will not try to inject identity values from cilium-aws kubernetes secret. Adds annotation to service account if managed by Helm. See https://github.com/aws/amazon-eks-pod-identity-webhook |
 | eni.instanceTagsFilter | list | `[]` | Filter via AWS EC2 Instance tags (k=v) which will dictate which AWS EC2 Instances are going to be used to create new ENIs |
+| eni.nodeSpec | object | `{"deleteOnTermination":null,"disablePrefixDelegation":false,"excludeInterfaceTags":[],"firstInterfaceIndex":null,"securityGroupTags":[],"securityGroups":[],"subnetIDs":[],"subnetTags":[],"usePrimaryAddress":false}` | NodeSpec configuration for the ENI |
+| eni.nodeSpec.deleteOnTermination | string | `nil` | Delete ENI on termination @schema type: [null, boolean] @schema |
+| eni.nodeSpec.disablePrefixDelegation | bool | `false` | Disable prefix delegation for IP allocation |
+| eni.nodeSpec.excludeInterfaceTags | list | `[]` | Exclude interface tags to use for IP allocation |
+| eni.nodeSpec.firstInterfaceIndex | string | `nil` | First interface index to use for IP allocation @schema type: [null, integer] @schema |
+| eni.nodeSpec.securityGroupTags | list | `[]` | Security group tags to use for IP allocation |
+| eni.nodeSpec.securityGroups | list | `[]` | Security groups to use for IP allocation |
+| eni.nodeSpec.subnetIDs | list | `[]` | Subnet IDs to use for IP allocation |
+| eni.nodeSpec.subnetTags | list | `[]` | Subnet tags to use for IP allocation |
+| eni.nodeSpec.usePrimaryAddress | bool | `false` | Use primary address for IP allocation |
 | eni.subnetIDsFilter | list | `[]` | Filter via subnet IDs which will dictate which subnets are going to be used to create new ENIs Important note: This requires that each instance has an ENI with a matching subnet attached when Cilium is deployed. If you only want to control subnets for ENIs attached by Cilium, use the CNI configuration file settings (cni.customConf) instead. |
 | eni.subnetTagsFilter | list | `[]` | Filter via tags (k=v) which will dictate which subnets are going to be used to create new ENIs Important note: This requires that each instance has an ENI with a matching subnet attached when Cilium is deployed. If you only want to control subnets for ENIs attached by Cilium, use the CNI configuration file settings (cni.customConf) instead. |
 | envoy.affinity | object | `{"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchExpressions":[{"key":"cilium.io/no-schedule","operator":"NotIn","values":["true"]}]}]}},"podAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"k8s-app":"cilium"}},"topologyKey":"kubernetes.io/hostname"}]},"podAntiAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"k8s-app":"cilium-envoy"}},"topologyKey":"kubernetes.io/hostname"}]}}` | Affinity for cilium-envoy. |
 | envoy.annotations | object | `{}` | Annotations to be added to all top-level cilium-envoy objects (resources under templates/cilium-envoy) |
 | envoy.baseID | int | `0` |  Set Envoy'--base-id' to use when allocating shared memory regions. Only needs to be changed if multiple Envoy instances will run on the same node and may have conflicts. Supported values: 0 - 4294967295. Defaults to '0' |
 | envoy.bootstrapConfigMap | string | `nil` | ADVANCED OPTION: Bring your own custom Envoy bootstrap ConfigMap. Provide the name of a ConfigMap with a `bootstrap-config.json` key. When specified, Envoy will use this ConfigMap instead of the default provided by the chart. WARNING: Use of this setting has the potential to prevent cilium-envoy from starting up, and can cause unexpected behavior (e.g. due to syntax error or semantically incorrect configuration). Before submitting an issue, please ensure you have disabled this feature, as support cannot be provided for custom Envoy bootstrap configs. @schema type: [null, string] @schema |
+| envoy.clusterMaxConnections | int | `1024` | Maximum number of connections on Envoy clusters |
+| envoy.clusterMaxRequests | int | `1024` | Maximum number of requests on Envoy clusters |
 | envoy.connectTimeoutSeconds | int | `2` | Time in seconds after which a TCP connection attempt times out |
 | envoy.debug.admin.enabled | bool | `false` | Enable admin interface for cilium-envoy. This is useful for debugging and should not be enabled in production. |
 | envoy.debug.admin.port | int | `9901` | Port number (bound to loopback interface). kubectl port-forward can be used to access the admin interface. |
@@ -394,7 +446,8 @@ contributors across the globe, there is almost always someone available to help.
 | envoy.httpRetryCount | int | `3` | Maximum number of retries for each HTTP request |
 | envoy.httpUpstreamLingerTimeout | string | `nil` | Time in seconds to block Envoy worker thread while an upstream HTTP connection is closing. If set to 0, the connection is closed immediately (with TCP RST). If set to -1, the connection is closed asynchronously in the background. |
 | envoy.idleTimeoutDurationSeconds | int | `60` | Set Envoy upstream HTTP idle connection timeout seconds. Does not apply to connections with pending requests. Default 60s |
-| envoy.image | object | `{"digest":"sha256:81398e449f2d3d0a6a70527e4f641aaa685d3156bea0bb30712fae3fd8822b86","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9","useDigest":true}` | Envoy container image. |
+| envoy.image | object | `{"digest":"sha256:8188114a2768b5f49d6ce58e168b20d765e0fbc64eee0d83241aa2b150ccd788","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.35.9-1770979049-232ed4a26881e4ab4f766f251f258ed424fff663","useDigest":true}` | Envoy container image. |
+| envoy.initContainers | list | `[]` | Init containers added to the cilium Envoy DaemonSet. |
 | envoy.initialFetchTimeoutSeconds | int | `30` | Time in seconds after which the initial fetch on an xDS stream is considered timed out |
 | envoy.livenessProbe.enabled | bool | `true` | Enable liveness probe for cilium-envoy |
 | envoy.livenessProbe.failureThreshold | int | `10` | failure threshold of liveness probe |
@@ -406,6 +459,7 @@ contributors across the globe, there is almost always someone available to help.
 | envoy.log.path | string | `""` | Path to a separate Envoy log file, if any. Defaults to /dev/stdout. |
 | envoy.maxConcurrentRetries | int | `128` | Maximum number of concurrent retries on Envoy clusters |
 | envoy.maxConnectionDurationSeconds | int | `0` | Set Envoy HTTP option max_connection_duration seconds. Default 0 (disable) |
+| envoy.maxGlobalDownstreamConnections | int | `50000` | Maximum number of global downstream connections |
 | envoy.maxRequestsPerConnection | int | `0` | ProxyMaxRequestsPerConnection specifies the max_requests_per_connection setting for Envoy |
 | envoy.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node selector for cilium-envoy. |
 | envoy.podAnnotations | object | `{}` | Annotations to be added to envoy pods |
@@ -439,6 +493,7 @@ contributors across the globe, there is almost always someone available to help.
 | envoy.terminationGracePeriodSeconds | int | `1` | Configure termination grace period for cilium-envoy DaemonSet. |
 | envoy.tolerations | list | `[{"operator":"Exists"}]` | Node tolerations for envoy scheduling to nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
 | envoy.updateStrategy | object | `{"rollingUpdate":{"maxUnavailable":2},"type":"RollingUpdate"}` | cilium-envoy update strategy ref: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/#updating-a-daemonset |
+| envoy.useOriginalSourceAddress | bool | `true` | For cases when CiliumEnvoyConfig is not used directly (Ingress, Gateway), configures Cilium BPF Metadata listener filter to use the original source address when extracting the metadata for a request. |
 | envoy.xffNumTrustedHopsL7PolicyEgress | int | `0` | Number of trusted hops regarding the x-forwarded-for and related HTTP headers for the egress L7 policy enforcement Envoy listeners. |
 | envoy.xffNumTrustedHopsL7PolicyIngress | int | `0` | Number of trusted hops regarding the x-forwarded-for and related HTTP headers for the ingress L7 policy enforcement Envoy listeners. |
 | envoyConfig.enabled | bool | `false` | Enable CiliumEnvoyConfig CRD CiliumEnvoyConfig CRD can also be implicitly enabled by other options. |
@@ -482,12 +537,13 @@ contributors across the globe, there is almost always someone available to help.
 | hubble.dropEventEmitter.interval | string | `"2m"` | - Minimum time between emitting same events. |
 | hubble.dropEventEmitter.reasons | list | `["auth_required","policy_denied"]` | - Drop reasons to emit events for. ref: https://docs.cilium.io/en/stable/_api/v1/flow/README/#dropreason |
 | hubble.enabled | bool | `true` | Enable Hubble (true by default). |
-| hubble.export | object | `{"dynamic":{"config":{"configMapName":"cilium-flowlog-config","content":[{"excludeFilters":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}],"createConfigMap":true},"enabled":false},"static":{"allowList":[],"denyList":[],"enabled":false,"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log"}}` | Hubble flows export. |
-| hubble.export.dynamic | object | `{"config":{"configMapName":"cilium-flowlog-config","content":[{"excludeFilters":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}],"createConfigMap":true},"enabled":false}` | - Dynamic exporters configuration. Dynamic exporters may be reconfigured without a need of agent restarts. |
+| hubble.export | object | `{"dynamic":{"config":{"configMapName":"cilium-flowlog-config","content":[{"aggregationInterval":"0s","excludeFilters":[],"fieldAggregate":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}],"createConfigMap":true},"enabled":false},"static":{"aggregationInterval":"0s","allowList":[],"denyList":[],"enabled":false,"fieldAggregate":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log"}}` | Hubble flows export. |
+| hubble.export.dynamic | object | `{"config":{"configMapName":"cilium-flowlog-config","content":[{"aggregationInterval":"0s","excludeFilters":[],"fieldAggregate":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}],"createConfigMap":true},"enabled":false}` | - Dynamic exporters configuration. Dynamic exporters may be reconfigured without a need of agent restarts. |
 | hubble.export.dynamic.config.configMapName | string | `"cilium-flowlog-config"` | -- Name of configmap with configuration that may be altered to reconfigure exporters within a running agents. |
-| hubble.export.dynamic.config.content | list | `[{"excludeFilters":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}]` | -- Exporters configuration in YAML format. |
+| hubble.export.dynamic.config.content | list | `[{"aggregationInterval":"0s","excludeFilters":[],"fieldAggregate":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log","includeFilters":[],"name":"all"}]` | -- Exporters configuration in YAML format. |
 | hubble.export.dynamic.config.createConfigMap | bool | `true` | -- True if helm installer should create config map. Switch to false if you want to self maintain the file content. |
-| hubble.export.static | object | `{"allowList":[],"denyList":[],"enabled":false,"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log"}` | - Static exporter configuration. Static exporter is bound to agent lifecycle. |
+| hubble.export.static | object | `{"aggregationInterval":"0s","allowList":[],"denyList":[],"enabled":false,"fieldAggregate":[],"fieldMask":[],"fileCompress":false,"fileMaxBackups":5,"fileMaxSizeMb":10,"filePath":"/var/run/cilium/hubble/events.log"}` | - Static exporter configuration. Static exporter is bound to agent lifecycle. |
+| hubble.export.static.aggregationInterval | string | `"0s"` | - Defines the interval at which to aggregate before exporting Hubble flows.     Aggregation feature is only enabled when fieldAggregate is specified and aggregationInterval > 0s. |
 | hubble.export.static.fileCompress | bool | `false` | - Enable compression of rotated files. |
 | hubble.export.static.fileMaxBackups | int | `5` | - Defines max number of backup/rotated files. |
 | hubble.export.static.fileMaxSizeMb | int | `10` | - Defines max file size of output file before it gets rotated. |
@@ -535,9 +591,12 @@ contributors across the globe, there is almost always someone available to help.
 | hubble.relay.extraVolumes | list | `[]` | Additional hubble-relay volumes. |
 | hubble.relay.gops.enabled | bool | `true` | Enable gops for hubble-relay |
 | hubble.relay.gops.port | int | `9893` | Configure gops listen port for hubble-relay |
-| hubble.relay.image | object | `{"digest":"sha256:fb6135e34c31e5f175cb5e75f86cea52ef2ff12b49bcefb7088ed93f5009eb8e","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.18.6","useDigest":true}` | Hubble-relay container image. |
+| hubble.relay.image | object | `{"digest":"sha256:d8c4e13bc36a56179292bb52bc6255379cb94cb873700d316ea3139b1bdb8165","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.19.1","useDigest":true}` | Hubble-relay container image. |
 | hubble.relay.listenHost | string | `""` | Host to listen to. Specify an empty string to bind to all the interfaces. |
 | hubble.relay.listenPort | string | `"4245"` | Port to listen to. |
+| hubble.relay.logOptions | object | `{"format":null,"level":null}` | Logging configuration for hubble-relay. |
+| hubble.relay.logOptions.format | string | text-ts | Log format for hubble-relay. Valid values are: text, text-ts, json, json-ts. |
+| hubble.relay.logOptions.level | string | info | Log level for hubble-relay. Valid values are: debug, info, warn, error. |
 | hubble.relay.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | hubble.relay.podAnnotations | object | `{}` | Annotations to be added to hubble-relay pods |
 | hubble.relay.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
@@ -547,7 +606,9 @@ contributors across the globe, there is almost always someone available to help.
 | hubble.relay.podLabels | object | `{}` | Labels to be added to hubble-relay pods |
 | hubble.relay.podSecurityContext | object | `{"fsGroup":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | hubble-relay pod security context |
 | hubble.relay.pprof.address | string | `"localhost"` | Configure pprof listen address for hubble-relay |
+| hubble.relay.pprof.blockProfileRate | int | `0` | Enable goroutine blocking profiling for hubble-relay and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead]) |
 | hubble.relay.pprof.enabled | bool | `false` | Enable pprof for hubble-relay |
+| hubble.relay.pprof.mutexProfileFraction | int | `0` | Enable mutex contention profiling for hubble-relay and set the fraction of sampled events (set to 1 to sample all events) |
 | hubble.relay.pprof.port | int | `6062` | Configure pprof listen port for hubble-relay |
 | hubble.relay.priorityClassName | string | `""` | The priority class to use for hubble-relay |
 | hubble.relay.prometheus | object | `{"enabled":false,"port":9966,"serviceMonitor":{"annotations":{},"enabled":false,"interval":"10s","labels":{},"metricRelabelings":null,"relabelings":null,"scrapeTimeout":null}}` | Enable prometheus metrics for hubble-relay on the configured port at /metrics |
@@ -641,13 +702,14 @@ contributors across the globe, there is almost always someone available to help.
 | hubble.ui.tls.client.cert | string | `""` | base64 encoded PEM values for the Hubble UI client certificate (deprecated). Use existingSecret instead. |
 | hubble.ui.tls.client.existingSecret | string | `""` | Name of the Secret containing the client certificate and key for Hubble UI If specified, cert and key are ignored. |
 | hubble.ui.tls.client.key | string | `""` | base64 encoded PEM values for the Hubble UI client key (deprecated). Use existingSecret instead. |
+| hubble.ui.tmpVolume | object | `{}` | Configure temporary volume for hubble-ui |
 | hubble.ui.tolerations | list | `[]` | Node tolerations for pod assignment on nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
 | hubble.ui.topologySpreadConstraints | list | `[]` | Pod topology spread constraints for hubble-ui |
 | hubble.ui.updateStrategy | object | `{"rollingUpdate":{"maxUnavailable":1},"type":"RollingUpdate"}` | hubble-ui update strategy. |
 | identityAllocationMode | string | `"crd"` | Method to use for identity allocation (`crd`, `kvstore` or `doublewrite-readkvstore` / `doublewrite-readcrd` for migrating between identity backends). |
 | identityChangeGracePeriod | string | `"5s"` | Time to wait before using new identity on endpoint identity change. |
 | identityManagementMode | string | `"agent"` | Control whether CiliumIdentities are created by the agent ("agent"), the operator ("operator") or both ("both"). "Both" should be used only to migrate between "agent" and "operator". Operator-managed identities is a beta feature. |
-| image | object | `{"digest":"sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.18.6","useDigest":true}` | Agent container image. |
+| image | object | `{"digest":"sha256:41f1f74a0000de8656f1de4088ea00c8f2d49d6edea579034c73c5fd5fe01792","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.19.1","useDigest":true}` | Agent container image. |
 | imagePullSecrets | list | `[]` | Configure image pull secrets for pulling container images |
 | ingressController.default | bool | `false` | Set cilium ingress controller to be the default ingress controller This will let cilium ingress controller route entries without ingress class set |
 | ingressController.defaultSecretName | string | `nil` | Default secret name for ingresses without .spec.tls[].secretName set. |
@@ -682,6 +744,11 @@ contributors across the globe, there is almost always someone available to help.
 | ipam.installUplinkRoutesForDelegatedIPAM | bool | `false` | Install ingress/egress routes through uplink on host for Pods when working with delegated IPAM plugin. |
 | ipam.mode | string | `"cluster-pool"` | Configure IP Address Management mode. ref: https://docs.cilium.io/en/stable/network/concepts/ipam/ |
 | ipam.multiPoolPreAllocation | string | `""` | Pre-allocation settings for IPAM in Multi-Pool mode |
+| ipam.nodeSpec | object | `{"ipamMaxAllocate":null,"ipamMinAllocate":null,"ipamPreAllocate":null,"ipamStaticIPTags":[]}` | NodeSpec configuration for the IPAM |
+| ipam.nodeSpec.ipamMaxAllocate | string | `nil` | IPAM max allocate @schema type: [null, integer] @schema |
+| ipam.nodeSpec.ipamMinAllocate | string | `nil` | IPAM min allocate @schema type: [null, integer] @schema |
+| ipam.nodeSpec.ipamPreAllocate | string | `nil` | IPAM pre allocate @schema type: [null, integer] @schema |
+| ipam.nodeSpec.ipamStaticIPTags | list | `[]` | IPAM static IP tags (currently only works with AWS and Azure) |
 | ipam.operator.autoCreateCiliumPodIPPools | object | `{}` | IP pools to auto-create in multi-pool IPAM mode. |
 | ipam.operator.clusterPoolIPv4MaskSize | int | `24` | IPv4 CIDR mask size to delegate to individual nodes for IPAM. |
 | ipam.operator.clusterPoolIPv4PodCIDRList | list | `["10.0.0.0/8"]` | IPv4 CIDR list range to delegate to individual nodes for IPAM. |
@@ -744,19 +811,18 @@ contributors across the globe, there is almost always someone available to help.
 | monitor | object | `{"enabled":false}` | cilium-monitor sidecar. |
 | monitor.enabled | bool | `false` | Enable the cilium-monitor sidecar. |
 | name | string | `"cilium"` | Agent daemonset name. |
-| namespaceOverride | string | `""` | namespaceOverride allows to override the destination namespace for Cilium resources. This property allows to use Cilium as part of an Umbrella Chart with different targets. |
+| namespaceOverride | string | `""` | namespaceOverride allows to override the destination namespace for Cilium resources. |
 | nat.mapStatsEntries | int | `32` | Number of the top-k SNAT map connections to track in Cilium statedb. |
 | nat.mapStatsInterval | string | `"30s"` | Interval between how often SNAT map is counted for stats. |
 | nat46x64Gateway | object | `{"enabled":false}` | Configure standalone NAT46/NAT64 gateway |
 | nat46x64Gateway.enabled | bool | `false` | Enable RFC6052-prefixed translation |
 | nodeIPAM.enabled | bool | `false` | Configure Node IPAM ref: https://docs.cilium.io/en/stable/network/node-ipam/ |
-| nodePort | object | `{"addresses":null,"autoProtectPortRange":true,"bindProtection":true,"enableHealthCheck":true,"enableHealthCheckLoadBalancerIP":false,"enabled":false}` | Configure N-S k8s service loadbalancing |
+| nodePort | object | `{"addresses":null,"autoProtectPortRange":true,"bindProtection":true,"enableHealthCheck":true,"enableHealthCheckLoadBalancerIP":false}` | Configure N-S k8s service loadbalancing |
 | nodePort.addresses | string | `nil` | List of CIDRs for choosing which IP addresses assigned to native devices are used for NodePort load-balancing. By default this is empty and the first suitable, preferably private, IPv4 and IPv6 address assigned to each device is used.  Example:    addresses: ["192.168.1.0/24", "2001::/64"]  |
 | nodePort.autoProtectPortRange | bool | `true` | Append NodePort range to ip_local_reserved_ports if clash with ephemeral ports is detected. |
 | nodePort.bindProtection | bool | `true` | Set to true to prevent applications binding to service ports. |
 | nodePort.enableHealthCheck | bool | `true` | Enable healthcheck nodePort server for NodePort services |
 | nodePort.enableHealthCheckLoadBalancerIP | bool | `false` | Enable access of the healthcheck nodePort on the LoadBalancerIP. Needs EnableHealthCheck to be enabled |
-| nodePort.enabled | bool | `false` | Enable the Cilium NodePort service implementation. |
 | nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node selector for cilium-agent. |
 | nodeSelectorLabels | bool | `false` | Enable/Disable use of node label based identity |
 | nodeinit.affinity | object | `{}` | Affinity for cilium-nodeinit |
@@ -766,7 +832,7 @@ contributors across the globe, there is almost always someone available to help.
 | nodeinit.extraEnv | list | `[]` | Additional nodeinit environment variables. |
 | nodeinit.extraVolumeMounts | list | `[]` | Additional nodeinit volumeMounts. |
 | nodeinit.extraVolumes | list | `[]` | Additional nodeinit volumes. |
-| nodeinit.image | object | `{"digest":"sha256:5bdca3c2dec2c79f58d45a7a560bf1098c2126350c901379fe850b7f78d3d757","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/startup-script","tag":"1755531540-60ee83e","useDigest":true}` | node-init image. |
+| nodeinit.image | object | `{"digest":"sha256:50b9cf9c280096b59b80d2fc8ee6638facef79ac18998a22f0cbc40d5d28c16f","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/startup-script","tag":"1763560095-8f36c34","useDigest":true}` | node-init image. |
 | nodeinit.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for nodeinit pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | nodeinit.podAnnotations | object | `{}` | Annotations to be added to node-init pods. |
 | nodeinit.podLabels | object | `{}` | Labels to be added to node-init pods. |
@@ -779,6 +845,7 @@ contributors across the globe, there is almost always someone available to help.
 | nodeinit.startup | object | `{"postScript":"","preScript":""}` | startup offers way to customize startup nodeinit script (pre and post position) |
 | nodeinit.tolerations | list | `[{"operator":"Exists"}]` | Node tolerations for nodeinit scheduling to nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
 | nodeinit.updateStrategy | object | `{"type":"RollingUpdate"}` | node-init update strategy |
+| nodeinit.waitForCloudInit | bool | `false` | wait for Cloud init to finish on the host and assume the node has cloud init installed |
 | operator.affinity | object | `{"podAntiAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"io.cilium/app":"operator"}},"topologyKey":"kubernetes.io/hostname"}]}}` | Affinity for cilium-operator |
 | operator.annotations | object | `{}` | Annotations to be added to all top-level cilium-operator objects (resources under templates/cilium-operator) |
 | operator.dashboards | object | `{"annotations":{},"enabled":false,"label":"grafana_dashboard","labelValue":"1","namespace":null}` | Grafana dashboards for cilium-operator grafana can import dashboards based on the label and value ref: https://github.com/grafana/helm-charts/tree/main/charts/grafana#sidecar-for-dashboards |
@@ -793,7 +860,7 @@ contributors across the globe, there is almost always someone available to help.
 | operator.hostNetwork | bool | `true` | HostNetwork setting |
 | operator.identityGCInterval | string | `"15m0s"` | Interval for identity garbage collection. |
 | operator.identityHeartbeatTimeout | string | `"30m0s"` | Timeout for identity heartbeats. |
-| operator.image | object | `{"alibabacloudDigest":"sha256:212c4cbe27da3772bcb952b8f8cbaa0b0eef72488b52edf90ad2b32072a3ca4c","awsDigest":"sha256:47dbc1a5bd483fec170dab7fb0bf2cca3585a4893675b0324d41d97bac8be5eb","azureDigest":"sha256:a57aff47aeb32eccfedaa2a49d1af984d996d6d6de79609c232e0c4cf9ce97a1","genericDigest":"sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.18.6","useDigest":true}` | cilium-operator image. |
+| operator.image | object | `{"alibabacloudDigest":"sha256:837b12f4239e88ea5b4b5708ab982c319a94ee05edaecaafe5fd0e5b1962f554","awsDigest":"sha256:18913d05a6c4d205f0b7126c4723bb9ccbd4dc24403da46ed0f9f4bf2a142804","azureDigest":"sha256:82bce78603056e709d4c4e9f9ebb25c222c36d8a07f8c05381c2372d9078eca8","genericDigest":"sha256:e7278d763e448bf6c184b0682cf98cdca078d58a27e1b2f3c906792670aa211a","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.19.1","useDigest":true}` | cilium-operator image. |
 | operator.nodeGCInterval | string | `"5m0s"` | Interval for cilium node garbage collection. |
 | operator.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for cilium-operator pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | operator.podAnnotations | object | `{}` | Annotations to be added to cilium-operator pods |
@@ -804,10 +871,12 @@ contributors across the globe, there is almost always someone available to help.
 | operator.podLabels | object | `{}` | Labels to be added to cilium-operator pods |
 | operator.podSecurityContext | object | `{"seccompProfile":{"type":"RuntimeDefault"}}` | Security context to be added to cilium-operator pods |
 | operator.pprof.address | string | `"localhost"` | Configure pprof listen address for cilium-operator |
+| operator.pprof.blockProfileRate | int | `0` | Enable goroutine blocking profiling for cilium-operator and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead]) |
 | operator.pprof.enabled | bool | `false` | Enable pprof for cilium-operator |
+| operator.pprof.mutexProfileFraction | int | `0` | Enable mutex contention profiling for cilium-operator and set the fraction of sampled events (set to 1 to sample all events) |
 | operator.pprof.port | int | `6061` | Configure pprof listen port for cilium-operator |
 | operator.priorityClassName | string | `""` | The priority class to use for cilium-operator |
-| operator.prometheus | object | `{"enabled":true,"metricsService":false,"port":9963,"serviceMonitor":{"annotations":{},"enabled":false,"interval":"10s","jobLabel":"","labels":{},"metricRelabelings":null,"relabelings":null,"scrapeTimeout":null}}` | Enable prometheus metrics for cilium-operator on the configured port at /metrics |
+| operator.prometheus | object | `{"enabled":true,"metricsService":false,"port":9963,"serviceMonitor":{"annotations":{},"enabled":false,"interval":"10s","jobLabel":"","labels":{},"metricRelabelings":null,"relabelings":null,"scrapeTimeout":null},"tls":{"enabled":false,"server":{"existingSecret":"","mtls":{"enabled":false}}}}` | Enable prometheus metrics for cilium-operator on the configured port at /metrics |
 | operator.prometheus.serviceMonitor.annotations | object | `{}` | Annotations to add to ServiceMonitor cilium-operator |
 | operator.prometheus.serviceMonitor.enabled | bool | `false` | Enable service monitors. This requires the prometheus CRDs to be available (see https://github.com/prometheus-operator/prometheus-operator/blob/main/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml) |
 | operator.prometheus.serviceMonitor.interval | string | `"10s"` | Interval for scrape metrics. |
@@ -816,6 +885,8 @@ contributors across the globe, there is almost always someone available to help.
 | operator.prometheus.serviceMonitor.metricRelabelings | string | `nil` | Metrics relabeling configs for the ServiceMonitor cilium-operator |
 | operator.prometheus.serviceMonitor.relabelings | string | `nil` | Relabeling configs for the ServiceMonitor cilium-operator |
 | operator.prometheus.serviceMonitor.scrapeTimeout | string | `nil` | Timeout after which scrape is considered to be failed. |
+| operator.prometheus.tls | object | `{"enabled":false,"server":{"existingSecret":"","mtls":{"enabled":false}}}` | TLS configuration for Prometheus |
+| operator.prometheus.tls.server.existingSecret | string | `""` | Name of the Secret containing the certificate, key and CA files for the Prometheus server. |
 | operator.removeNodeTaints | bool | `true` | Remove Cilium node taint from Kubernetes nodes that have a healthy Cilium pod running. |
 | operator.replicas | int | `2` | Number of replicas to run for the cilium-operator deployment |
 | operator.resources | object | `{}` | cilium-operator resource limits & requests ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
@@ -828,25 +899,30 @@ contributors across the globe, there is almost always someone available to help.
 | operator.topologySpreadConstraints | list | `[]` | Pod topology spread constraints for cilium-operator |
 | operator.unmanagedPodWatcher.intervalSeconds | int | `15` | Interval, in seconds, to check if there are any pods that are not managed by Cilium. |
 | operator.unmanagedPodWatcher.restart | bool | `true` | Restart any pod that are not managed by Cilium. |
+| operator.unmanagedPodWatcher.selector | string | `nil` | Selector for pods that should be restarted when not managed by Cilium. If not set, defaults to built-in selector "k8s-app=kube-dns". Set to empty string to select all pods. @schema type: [null, string] @schema |
 | operator.updateStrategy | object | `{"rollingUpdate":{"maxSurge":"25%","maxUnavailable":"50%"},"type":"RollingUpdate"}` | cilium-operator update strategy |
 | pmtuDiscovery.enabled | bool | `false` | Enable path MTU discovery to send ICMP fragmentation-needed replies to the client. |
+| pmtuDiscovery.packetizationLayerPMTUDMode | string | `"blackhole"` | Enable kernel probing path MTU discovery for Pods which uses different message sizes to search for correct MTU value. Valid values are: always, blackhole, disabled and unset (or empty). If value is 'unset' or left empty then will not try to override setting. |
 | podAnnotations | object | `{}` | Annotations to be added to agent pods |
 | podLabels | object | `{}` | Labels to be added to agent pods |
 | podSecurityContext | object | `{"appArmorProfile":{"type":"Unconfined"},"seccompProfile":{"type":"Unconfined"}}` | Security Context for cilium-agent pods. |
 | podSecurityContext.appArmorProfile | object | `{"type":"Unconfined"}` | AppArmorProfile options for the `cilium-agent` and init containers |
 | policyCIDRMatchMode | string | `nil` | policyCIDRMatchMode is a list of entities that may be selected by CIDR selector. The possible value is "nodes". |
+| policyDenyResponse | string | `"none"` | Configure what the response should be to pod egress traffic denied by network policy. Possible values:  - none (default)  - icmp |
 | policyEnforcementMode | string | `"default"` | The agent can be put into one of the three policy enforcement modes: default, always and never. ref: https://docs.cilium.io/en/stable/security/policy/intro/#policy-enforcement-modes |
 | pprof.address | string | `"localhost"` | Configure pprof listen address for cilium-agent |
+| pprof.blockProfileRate | int | `0` | Enable goroutine blocking profiling for cilium-agent and set the rate of sampled events in nanoseconds (set to 1 to sample all events [warning: performance overhead]) |
 | pprof.enabled | bool | `false` | Enable pprof for cilium-agent |
+| pprof.mutexProfileFraction | int | `0` | Enable mutex contention profiling for cilium-agent and set the fraction of sampled events (set to 1 to sample all events) |
 | pprof.port | int | `6060` | Configure pprof listen port for cilium-agent |
 | preflight.affinity | object | `{"podAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"k8s-app":"cilium"}},"topologyKey":"kubernetes.io/hostname"}]}}` | Affinity for cilium-preflight |
 | preflight.annotations | object | `{}` | Annotations to be added to all top-level preflight objects (resources under templates/cilium-preflight) |
 | preflight.enabled | bool | `false` | Enable Cilium pre-flight resources (required for upgrade) |
-| preflight.envoy.image | object | `{"digest":"sha256:81398e449f2d3d0a6a70527e4f641aaa685d3156bea0bb30712fae3fd8822b86","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9","useDigest":true}` | Envoy pre-flight image. |
+| preflight.envoy.image | object | `{"digest":"sha256:8188114a2768b5f49d6ce58e168b20d765e0fbc64eee0d83241aa2b150ccd788","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.35.9-1770979049-232ed4a26881e4ab4f766f251f258ed424fff663","useDigest":true}` | Envoy pre-flight image. |
 | preflight.extraEnv | list | `[]` | Additional preflight environment variables. |
 | preflight.extraVolumeMounts | list | `[]` | Additional preflight volumeMounts. |
 | preflight.extraVolumes | list | `[]` | Additional preflight volumes. |
-| preflight.image | object | `{"digest":"sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.18.6","useDigest":true}` | Cilium pre-flight image. |
+| preflight.image | object | `{"digest":"sha256:41f1f74a0000de8656f1de4088ea00c8f2d49d6edea579034c73c5fd5fe01792","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.19.1","useDigest":true}` | Cilium pre-flight image. |
 | preflight.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for preflight pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
 | preflight.podAnnotations | object | `{}` | Annotations to be added to preflight pods |
 | preflight.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
@@ -890,24 +966,36 @@ contributors across the globe, there is almost always someone available to help.
 | sctp | object | `{"enabled":false}` | SCTP Configuration Values |
 | sctp.enabled | bool | `false` | Enable SCTP support. NOTE: Currently, SCTP support does not support rewriting ports or multihoming. |
 | secretsNamespaceAnnotations | object | `{}` | Annotations to be added to all cilium-secret namespaces (resources under templates/cilium-secrets-namespace) |
+| secretsNamespaceLabels | object | `{}` | Labels to be added to all cilium-secret namespaces (resources under templates/cilium-secrets-namespace) |
 | securityContext.allowPrivilegeEscalation | bool | `false` | disable privilege escalation |
 | securityContext.capabilities.applySysctlOverwrites | list | `["SYS_ADMIN","SYS_CHROOT","SYS_PTRACE"]` | capabilities for the `apply-sysctl-overwrites` init container |
-| securityContext.capabilities.ciliumAgent | list | `["CHOWN","KILL","NET_ADMIN","NET_RAW","IPC_LOCK","SYS_MODULE","SYS_ADMIN","SYS_RESOURCE","DAC_OVERRIDE","FOWNER","SETGID","SETUID"]` | Capabilities for the `cilium-agent` container |
+| securityContext.capabilities.ciliumAgent | list | `["CHOWN","KILL","NET_ADMIN","NET_RAW","IPC_LOCK","SYS_MODULE","SYS_ADMIN","SYS_RESOURCE","DAC_OVERRIDE","FOWNER","SETGID","SETUID","SYSLOG"]` | Capabilities for the `cilium-agent` container |
 | securityContext.capabilities.cleanCiliumState | list | `["NET_ADMIN","SYS_MODULE","SYS_ADMIN","SYS_RESOURCE"]` | Capabilities for the `clean-cilium-state` init container |
 | securityContext.capabilities.mountCgroup | list | `["SYS_ADMIN","SYS_CHROOT","SYS_PTRACE"]` | Capabilities for the `mount-cgroup` init container |
 | securityContext.privileged | bool | `false` | Run the pod with elevated privileges |
 | securityContext.seLinuxOptions | object | `{"level":"s0","type":"spc_t"}` | SELinux options for the `cilium-agent` and init containers |
 | serviceAccounts | object | Component's fully qualified name. | Define serviceAccount names for components. |
 | serviceAccounts.clustermeshcertgen | object | `{"annotations":{},"automount":true,"create":true,"name":"clustermesh-apiserver-generate-certs"}` | Clustermeshcertgen is used if clustermesh.apiserver.tls.auto.method=cronJob |
+| serviceAccounts.corednsMCSAPI | object | `{"annotations":{},"automount":true,"create":true,"name":"cilium-coredns-mcsapi-autoconfig"}` | CorednsMCSAPI is used if clustermesh.mcsapi.corednsAutoConfigure.enabled=true |
 | serviceAccounts.hubblecertgen | object | `{"annotations":{},"automount":true,"create":true,"name":"hubble-generate-certs"}` | Hubblecertgen is used if hubble.tls.auto.method=cronJob |
 | serviceAccounts.nodeinit.enabled | bool | `false` | Enabled is temporary until https://github.com/cilium/cilium-cli/issues/1396 is implemented. Cilium CLI doesn't create the SAs for node-init, thus the workaround. Helm is not affected by this issue. Name and automount can be configured, if enabled is set to true. Otherwise, they are ignored. Enabled can be removed once the issue is fixed. Cilium-nodeinit DS must also be fixed. |
 | serviceNoBackendResponse | string | `"reject"` | Configure what the response should be to traffic for a service without backends. Possible values:  - reject (default)  - drop |
 | sleepAfterInit | bool | `false` | Do not run Cilium agent when running with clean mode. Useful to completely uninstall Cilium as it will stop Cilium from starting and create artifacts in the node. |
 | socketLB | object | `{"enabled":false}` | Configure socket LB |
 | socketLB.enabled | bool | `false` | Enable socket LB |
+| standaloneDnsProxy | object | `{"annotations":{},"automountServiceAccountToken":false,"debug":false,"enabled":false,"image":{"digest":"","override":null,"pullPolicy":"IfNotPresent","repository":"","tag":"","useDigest":true},"nodeSelector":{"kubernetes.io/os":"linux"},"rollOutPods":false,"serverPort":10095,"tolerations":[],"updateStrategy":{"rollingUpdate":{"maxSurge":2,"maxUnavailable":0},"type":"RollingUpdate"}}` | Standalone DNS Proxy Configuration Note: The standalone DNS proxy uses the agent's dnsProxy.* configuration for DNS settings (proxyPort, enableDnsCompression) to ensure consistency. |
+| standaloneDnsProxy.annotations | object | `{}` | Standalone DNS proxy annotations |
+| standaloneDnsProxy.automountServiceAccountToken | bool | `false` | Standalone DNS proxy auto mount service account token |
+| standaloneDnsProxy.debug | bool | `false` | Standalone DNS proxy debug mode |
+| standaloneDnsProxy.enabled | bool | `false` | Enable standalone DNS proxy (alpha feature) |
+| standaloneDnsProxy.image | object | `{"digest":"","override":null,"pullPolicy":"IfNotPresent","repository":"","tag":"","useDigest":true}` | Standalone DNS proxy image |
+| standaloneDnsProxy.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Standalone DNS proxy Node Selector |
+| standaloneDnsProxy.rollOutPods | bool | `false` | Roll out Standalone DNS proxy automatically when configmap is updated. |
+| standaloneDnsProxy.serverPort | int | `10095` | Standalone DNS proxy server port |
+| standaloneDnsProxy.tolerations | list | `[]` | Standalone DNS proxy tolerations |
+| standaloneDnsProxy.updateStrategy | object | `{"rollingUpdate":{"maxSurge":2,"maxUnavailable":0},"type":"RollingUpdate"}` | Standalone DNS proxy update strategy |
 | startupProbe.failureThreshold | int | `300` | failure threshold of startup probe. Allow Cilium to take up to 600s to start up (300 attempts with 2s between attempts). |
 | startupProbe.periodSeconds | int | `2` | interval between checks of the startup probe |
-| svcSourceRangeCheck | bool | `true` | Enable check of service source ranges (currently, only for LoadBalancer). |
 | synchronizeK8sNodes | bool | `true` | Synchronize Kubernetes nodes to kvstore and perform CNP GC. |
 | sysctlfix | object | `{"enabled":true}` | Configure sysctl override described in #20072. |
 | sysctlfix.enabled | bool | `true` | Enable the sysctl override. When enabled, the init container will mount the /proc of the host so that the `sysctlfix` utility can execute. |
@@ -929,11 +1017,12 @@ contributors across the globe, there is almost always someone available to help.
 | tls.secretsNamespace | object | `{"create":true,"name":"cilium-secrets"}` | Configures where secrets used in CiliumNetworkPolicies will be looked for |
 | tls.secretsNamespace.create | bool | `true` | Create secrets namespace for TLS Interception secrets. |
 | tls.secretsNamespace.name | string | `"cilium-secrets"` | Name of TLS Interception secret namespace. |
+| tmpVolume | object | `{}` | Configure temporary volume for cilium-agent |
 | tolerations | list | `[{"operator":"Exists"}]` | Node tolerations for agent scheduling to nodes with taints ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
 | tunnelPort | int | Port 8472 for VXLAN, Port 6081 for Geneve | Configure VXLAN and Geneve tunnel port. |
 | tunnelProtocol | string | `"vxlan"` | Tunneling protocol to use in tunneling mode and for ad-hoc tunnels. Possible values:   - ""   - vxlan   - geneve |
 | tunnelSourcePortRange | string | 0-0 to let the kernel driver decide the range | Configure VXLAN and Geneve tunnel source port range hint. |
-| underlayProtocol | string | `"ipv4"` | IP family for the underlay. |
+| underlayProtocol | string | `"ipv4"` | IP family for the underlay. Possible values:   - "ipv4"   - "ipv6" |
 | updateStrategy | object | `{"rollingUpdate":{"maxUnavailable":2},"type":"RollingUpdate"}` | Cilium agent update strategy |
 | upgradeCompatibility | string | `nil` | upgradeCompatibility helps users upgrading to ensure that the configMap for Cilium will not change critical values to ensure continued operation This flag is not required for new installations. For example: '1.7', '1.8', '1.9' |
 | vtep.cidr | string | `""` | A space separated list of VTEP device CIDRs, for example "1.1.1.0/24 1.1.2.0/24" |

packages/system/cilium/charts/cilium/files/cilium-envoy/configmap/bootstrap-config.yaml

@@ -292,7 +292,7 @@ overloadManager:
   - name: "envoy.resource_monitors.global_downstream_max_connections"
     typedConfig:
       "@type": "type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig"
-      max_active_downstream_connections: "50000"
+      max_active_downstream_connections: "{{ .Values.envoy.maxGlobalDownstreamConnections }}"
 applicationLogConfig:
   logFormat:
     {{- if .Values.envoy.log.format_json }}

packages/system/cilium/charts/cilium/files/nodeinit/startup.bash

@@ -156,6 +156,14 @@ fi
 iptables -w -t nat -D POSTROUTING -m comment --comment "ip-masq: ensure nat POSTROUTING directs all non-LOCAL destination traffic to our custom IP-MASQ chain" -m addrtype ! --dst-type LOCAL -j IP-MASQ || true
 {{- end }}
 
+{{- if .Values.nodeinit.waitForCloudInit }}
+echo "Waiting for cloud-init..."
+if command -v cloud-init >/dev/null 2>&1; then
+  cloud-init status --wait
+  echo "cloud-init completed!"
+fi
+{{- end }}
+
 {{- if not (eq .Values.nodeinit.bootstrapFile "") }}
 mkdir -p {{ .Values.nodeinit.bootstrapFile | dir | quote }}
 date > {{ .Values.nodeinit.bootstrapFile | quote }}

packages/system/cilium/charts/cilium/templates/_extensions.tpl

@@ -21,6 +21,24 @@ dnsPolicy: {{ .Values.dnsPolicy }}
 {{- end }}
 {{- end }}
 
+{{/*
+Allow packagers to add extra volumes to cilium-operator.
+*/}}
+{{- define "cilium-operator.volumes.extra" }}
+{{- end }}
+
+{{- define "cilium-operator.volumeMounts.extra" }}
+{{- end }}
+
+{{/*
+Allow packagers to set securityContext for cilium-operator.
+*/}}
+{{- define "cilium.operator.securityContext" }}
+{{- with .Values.operator.securityContext }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
 {{/*
 Intentionally empty to allow downstream chart packagers to add extra
 containers to hubble-relay without having to modify the deployment manifest
@@ -72,3 +90,87 @@ Allow packagers to add extra configuration to certgen.
 */}}
 {{- define "certgen.config.extra" -}}
 {{- end }}
+
+{{/*
+Allow packagers to add extra arguments to the clustermesh-apiserver apiserver container.
+*/}}
+{{- define "clustermesh.apiserver.args.extra" -}}
+{{- end }}
+
+{{/*
+Allow packagers to add extra arguments to the clustermesh-apiserver kvstoremesh container.
+*/}}
+{{- define "clustermesh.kvstoremesh.args.extra" -}}
+{{- end }}
+
+{{/*
+Allow packagers to add init containers to the cilium-envoy pods.
+*/}}
+{{- define "envoy.initContainers" -}}
+{{- end }}
+
+{{/*
+Allow packagers to add extra args to the cilium-envoy container.
+*/}}
+{{- define "envoy.args.extra" -}}
+{{- end }}
+
+{{/*
+Allow packagers to add extra env vars to the cilium-envoy container.
+*/}}
+{{- define "envoy.env.extra" -}}
+{{- end }}
+
+{{/*
+Allow packagers to add extra volume mounts to the cilium-envoy container.
+*/}}
+{{- define "envoy.volumeMounts.extra" -}}
+{{- end }}
+
+{{/*
+Allow packagers to add extra host path mounts to the cilium-envoy container.
+*/}}
+{{- define "envoy.hostPathMounts.extra" -}}
+{{- end }}
+
+
+{{/*
+Allow packagers to define set of ports for cilium-envoy container.
+The template needs to allow overriding ports spec not just adding.
+*/}}
+{{- define "envoy.ports" -}}
+        {{- if .Values.envoy.prometheus.enabled }}
+        ports:
+        - name: envoy-metrics
+          containerPort: {{ .Values.envoy.prometheus.port }}
+          hostPort: {{ .Values.envoy.prometheus.port }}
+          protocol: TCP
+        {{- if and .Values.envoy.debug.admin.enabled .Values.envoy.debug.admin.port }}
+        - name: envoy-admin
+          containerPort: {{ .Values.envoy.debug.admin.port }}
+          hostPort: {{ .Values.envoy.debug.admin.port }}
+          protocol: TCP
+        {{- end }}
+        {{- end }}
+{{- end }}
+
+{{/*
+Allow packagers to define update strategy for cilium-envoy pods.
+*/}}
+{{- define "envoy.updateStrategy" -}}
+{{- with .Values.envoy.updateStrategy }}
+updateStrategy:
+  {{- toYaml . | trim | nindent 2 }}
+  {{- end }}
+{{- end }}
+
+{{/*
+Allow packagers to define affinity for cilium-envoy pods.
+*/}}
+{{- define "envoy.affinity" -}}
+{{- with .Values.envoy.affinity }}
+affinity:
+  {{- toYaml . | nindent 2 }}     
+{{- end }}
+{{- end }}
+

packages/system/cilium/charts/cilium/templates/_helpers.tpl

@@ -131,12 +131,16 @@ To override the namespace and configMap when using `auto`:
 {{- define "k8sServiceHost" }}
   {{- $configmapName := default "cluster-info" .Values.k8sServiceLookupConfigMapName }}
   {{- $configmapNamespace := default "kube-public" .Values.k8sServiceLookupNamespace }}
-  {{- if and (eq .Values.k8sServiceHost "auto") (lookup "v1" "ConfigMap" $configmapNamespace $configmapName) }}
+  {{- if eq .Values.k8sServiceHost "auto" }}
     {{- $configmap := (lookup "v1" "ConfigMap" $configmapNamespace $configmapName) }}
-    {{- $kubeconfig := get $configmap.data "kubeconfig" }}
-    {{- $k8sServer := get ($kubeconfig | fromYaml) "clusters" | mustFirst | dig "cluster" "server" "" }}
-    {{- $uri := (split "https://" $k8sServer)._1 | trim }}
-    {{- (split ":" $uri)._0 | quote }}
+    {{- if $configmap }}
+      {{- $kubeconfig := get $configmap.data "kubeconfig" }}
+      {{- $k8sServer := get ($kubeconfig | fromYaml) "clusters" | mustFirst | dig "cluster" "server" "" }}
+      {{- $uri := (split "https://" $k8sServer)._1 | trim }}
+      {{- (split ":" $uri)._0 | quote }}
+    {{- else }}
+      {{- fail (printf "ConfigMap %s/%s not found, please create it or set k8sServiceHost to a valid value" $configmapNamespace $configmapName) }}
+    {{- end }}
   {{- else }}
     {{- .Values.k8sServiceHost | quote }}
   {{- end }}

packages/system/cilium/charts/cilium/templates/cilium-agent/clusterrole.yaml

@@ -94,7 +94,6 @@ rules:
   - cilium.io
   resources:
   - ciliumloadbalancerippools
-  - ciliumbgppeeringpolicies
   - ciliumbgpnodeconfigs
   - ciliumbgpadvertisements
   - ciliumbgppeerconfigs

packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml

@@ -10,6 +10,7 @@
 
 {{- $kubeProxyReplacement := (coalesce .Values.kubeProxyReplacement "false") -}}
 {{- $envoyDS := eq (include "envoyDaemonSetEnabled" .) "true" -}}
+{{- $buildDaemonConfig := or (kindIs "invalid" .Values.daemon.configSources) (not (regexMatch "^config-map:[^,]+$" .Values.daemon.configSources)) -}}
 
 ---
 apiVersion: apps/v1
@@ -134,7 +135,7 @@ spec:
           httpGet:
             host: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }}
             path: /healthz
-            port: {{ .Values.healthPort }}
+            port: health
             scheme: HTTP
             httpHeaders:
             - name: "brief"
@@ -154,7 +155,7 @@ spec:
           httpGet:
             host: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }}
             path: /healthz
-            port: {{ .Values.healthPort }}
+            port: health
             scheme: HTTP
             httpHeaders:
             - name: "brief"
@@ -177,7 +178,7 @@ spec:
           httpGet:
             host: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }}
             path: /healthz
-            port: {{ .Values.healthPort }}
+            port: health
             scheme: HTTP
             httpHeaders:
             - name: "brief"
@@ -250,12 +251,17 @@ spec:
         resources:
           {{- toYaml . | trim | nindent 10 }}
         {{- end }}
-        {{- if or .Values.prometheus.enabled (or .Values.hubble.metrics.enabled .Values.hubble.metrics.dynamic.enabled) }}
         ports:
+        - name: health
+          containerPort: {{ .Values.healthPort }}
+          hostPort: {{ .Values.healthPort }}
+          protocol: TCP
+        {{- if .Values.hubble.enabled }}
         - name: peer-service
           containerPort: {{ .Values.hubble.peerService.targetPort }}
           hostPort: {{ .Values.hubble.peerService.targetPort }}
           protocol: TCP
+        {{- end }}
         {{- if .Values.prometheus.enabled }}
         - name: prometheus
           containerPort: {{ .Values.prometheus.port }}
@@ -280,7 +286,6 @@ spec:
           hostPort: {{ .Values.hubble.metrics.port }}
           protocol: TCP
         {{- end }}
-        {{- end }}
         securityContext:
           {{- if .Values.securityContext.privileged }}
           privileged: true
@@ -375,6 +380,10 @@ spec:
         - name: cilium-ipsec-secrets
           mountPath: {{ .Values.encryption.ipsec.mountPath }}
         {{- end }}
+        {{- if and .Values.encryption.enabled (eq .Values.encryption.type "ztunnel") }}
+        - name: cilium-ztunnel-secrets
+          mountPath: /etc/ztunnel
+        {{- end }}
         {{- if .Values.kubeConfigPath }}
         - name: kube-config
           mountPath: {{ .Values.kubeConfigPath }}
@@ -390,8 +399,14 @@ spec:
           mountPath: /var/lib/cilium/tls/hubble
           readOnly: true
         {{- end }}
+        {{- if $buildDaemonConfig }}
         - name: tmp
           mountPath: /tmp
+        {{- else }}
+        - name: cilium-config-path
+          mountPath: /tmp/cilium/config-map
+          readOnly: true
+        {{- end }}
         {{- range .Values.extraHostPathMounts }}
         - name: {{ .name }}
           mountPath: {{ .mountPath }}
@@ -447,6 +462,7 @@ spec:
       {{- toYaml .Values.extraContainers | nindent 6 }}
       {{- end }}
       initContainers:
+      {{- if $buildDaemonConfig }}
       - name: config
         image: {{ include "cilium.image" .Values.image | quote }}
         imagePullPolicy: {{ .Values.image.pullPolicy }}
@@ -513,6 +529,17 @@ spec:
         {{- toYaml . | nindent 8 }}
         {{- end }}
         terminationMessagePolicy: FallbackToLogsOnError
+        securityContext:
+          {{- if .Values.securityContext.privileged }}
+          privileged: true
+          {{- else }}
+          capabilities:
+            add:
+              - NET_ADMIN
+            drop:
+              - ALL
+          {{- end}}
+      {{- end }}
       {{- if .Values.cgroup.autoMount.enabled }}
       # Required to mount cgroup2 filesystem on the underlying Kubernetes node.
       # We use nsenter command with host's cgroup and mount namespaces enabled.
@@ -524,9 +551,12 @@ spec:
           value: {{ .Values.cgroup.hostRoot }}
         - name: BIN_PATH
           value: {{ .Values.cni.binPath }}
-        {{- with .Values.cgroup.autoMount.resources }}
+        {{- if .Values.cgroup.autoMount.resources }}
         resources:
-          {{- toYaml . | trim | nindent 10 }}
+          {{- toYaml .Values.cgroup.autoMount.resources | trim | nindent 10 }}
+        {{- else if .Values.initResources }}
+        resources:
+          {{- toYaml .Values.initResources | trim | nindent 10 }}
         {{- end }}
         command:
         - sh
@@ -821,7 +851,7 @@ spec:
       {{- end }}
       {{- if and .Values.clustermesh.config.enabled (not (and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.kvstoremesh.enabled )) }}
       hostAliases:
-      {{- range $cluster := .Values.clustermesh.config.clusters }}
+      {{- range $_, $cluster := (include "clustermesh-clusters" . | fromJson) }}
       {{- range $ip := $cluster.ips }}
       - ip: {{ $ip }}
         hostnames: [ "{{ $cluster.name }}.{{ $.Values.clustermesh.config.domain }}" ]
@@ -829,9 +859,20 @@ spec:
       {{- end }}
       {{- end }}
       volumes:
-        # For sharing configuration between the "config" initContainer and the agent
+      {{- if $buildDaemonConfig }}
+      # For sharing configuration between the "config" initContainer and the agent
       - name: tmp
+        {{- if .Values.tmpVolume }}
+          {{- toYaml .Values.tmpVolume | nindent 8 }}
+        {{- else }}
         emptyDir: {}
+        {{- end }}
+      {{- else }}
+      # To read the configuration from the config map
+      - name: cilium-config-path
+        configMap:
+          name: {{ trimPrefix "config-map:" .Values.daemon.configSources }}
+      {{- end }}
         # To keep state between restarts / upgrades
       - name: cilium-run
         hostPath:
@@ -992,6 +1033,11 @@ spec:
         secret:
           secretName: {{ .Values.encryption.ipsec.secretName }}
       {{- end }}
+      {{- if and .Values.encryption.enabled (eq .Values.encryption.type "ztunnel") }}
+      - name: cilium-ztunnel-secrets
+        secret:
+          secretName: cilium-ztunnel-secrets
+      {{- end }}
       {{- if .Values.cni.configMap }}
       - name: cni-configuration
         configMap:

packages/system/cilium/charts/cilium/templates/cilium-agent/role.yaml

@@ -120,7 +120,7 @@ rules:
   - watch
 {{- end}}
 
-{{- if and .Values.operator.enabled .Values.serviceAccounts.operator.create $readSecretsOnlyFromSecretsNamespace .Values.tls.secretsNamespace.name }}
+{{- if and .Values.agent (not .Values.preflight.enabled) .Values.serviceAccounts.cilium.create $readSecretsOnlyFromSecretsNamespace .Values.tls.secretsNamespace.name }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role

packages/system/cilium/charts/cilium/templates/cilium-agent/rolebinding.yaml

@@ -126,7 +126,7 @@ subjects:
   namespace: {{ include "cilium.namespace" . }}
 {{- end}}
 
-{{- if and (not .Values.preflight.enabled) $readSecretsOnlyFromSecretsNamespace .Values.tls.secretsNamespace.name }}
+{{- if and .Values.agent (not .Values.preflight.enabled) .Values.serviceAccounts.cilium.create $readSecretsOnlyFromSecretsNamespace .Values.tls.secretsNamespace.name }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding

packages/system/cilium/charts/cilium/templates/cilium-ca-secret.yaml

@@ -11,8 +11,13 @@ kind: Secret
 metadata:
   name: {{ .commonCASecretName }}
   namespace: {{ include "cilium.namespace" . }}
-  {{- with .Values.commonLabels }}
   labels:
+  {{- with .Values.commonLabels }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+    cilium.io/helm-template-non-idempotent: "true"
+  {{- with .Values.nonIdempotentAnnotations }}
+  annotations:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 data:

packages/system/cilium/charts/cilium/templates/cilium-configmap.yaml

@@ -33,12 +33,6 @@
   {{- end }}
   {{- $defaultBpfCtTcpMax = 0 -}}
   {{- $defaultBpfCtAnyMax = 0 -}}
-  {{- $defaultKubeProxyReplacement = "probe" -}}
-{{- end -}}
-
-{{- /* Default values when 1.9 was initially deployed */ -}}
-{{- if semverCompare ">=1.9" (default "1.9" .Values.upgradeCompatibility) -}}
-  {{- $defaultKubeProxyReplacement = "probe" -}}
 {{- end -}}
 
 {{- /* Default values when 1.10 was initially deployed */ -}}
@@ -52,7 +46,6 @@
   {{- if .Values.azure.enabled }}
       {{- $azureUsePrimaryAddress = "false" -}}
   {{- end }}
-  {{- $defaultKubeProxyReplacement = "disabled" -}}
   {{- $defaultDNSProxyEnableTransparentMode = "true" -}}
 {{- end -}}
 
@@ -71,6 +64,10 @@
   {{- end }}
 {{- end -}}
 {{- $ipam := (coalesce .Values.ipam.mode $defaultIPAM) -}}
+{{- if .Values.eni.enabled }}
+  {{- $ipam = "eni" -}}
+{{- end }}
+
 {{- $bpfCtTcpMax := (coalesce .Values.bpf.ctTcpMax $defaultBpfCtTcpMax) -}}
 {{- $bpfCtAnyMax := (coalesce .Values.bpf.ctAnyMax $defaultBpfCtAnyMax) -}}
 {{- $stringValueKPR := (toString .Values.kubeProxyReplacement) -}}
@@ -258,6 +255,14 @@ data:
   operator-prometheus-serve-addr: ":{{ .Values.operator.prometheus.port }}"
   enable-metrics: "true"
 {{- end }}
+{{- if and .Values.operator.prometheus.enabled .Values.operator.prometheus.tls.enabled }}
+  operator-prometheus-enable-tls: "true"
+  operator-prometheus-tls-cert-file: /var/lib/cilium/tls/prometheus/server.crt
+  operator-prometheus-tls-key-file: /var/lib/cilium/tls/prometheus/server.key
+  {{- if .Values.operator.prometheus.tls.server.mtls.enabled }}
+  operator-prometheus-tls-client-ca-files: /var/lib/cilium/tls/prometheus/client-ca.crt
+  {{- end }}
+{{- end }}
 
 {{- if .Values.operator.skipCRDCreation }}
   skip-crd-creation: "true"
@@ -456,6 +461,9 @@ data:
   # policy map (per endpoint)
   bpf-policy-map-max: "{{ .Values.bpf.policyMapMax | int }}"
 {{- end }}
+{{- if has (kindOf .Values.bpf.policyMapPressureMetricsThreshold) (list "int64" "float64") }}
+  bpf-policy-map-pressure-metrics-threshold: {{ .Values.bpf.policyMapPressureMetricsThreshold | quote }}
+{{- end }}
 {{- if hasKey .Values.bpf "policyStatsMapMax" }}
   # bpf-policy-stats-map-max specifies the maximum number of entries in global
   # policy stats map
@@ -505,7 +513,7 @@ data:
   cluster-name: {{ .Values.cluster.name | quote }}
 
 {{- if hasKey .Values.cluster "id" }}
-  # Unique ID of the cluster. Must be unique across all conneted clusters and
+  # Unique ID of the cluster. Must be unique across all connected clusters and
   # in the range of 1 and 255. Only relevant when building a mesh of clusters.
   cluster-id: "{{ .Values.cluster.id }}"
 {{- end }}
@@ -526,7 +534,7 @@ data:
   {{- end }}
 {{- end }}
 
-  routing-mode: {{ .Values.routingMode | default (ternary "native" "tunnel" .Values.gke.enabled) | quote }}
+  routing-mode: {{ .Values.routingMode | default (ternary "native" "tunnel" (or .Values.eni.enabled .Values.gke.enabled)) | quote }}
   tunnel-protocol: {{ .Values.tunnelProtocol | default "vxlan" | quote }}
 
 {{- if eq .Values.routingMode "native" }}
@@ -558,6 +566,10 @@ data:
   service-no-backend-response: "{{ .Values.serviceNoBackendResponse }}"
 {{- end}}
 
+{{- if .Values.policyDenyResponse }}
+  policy-deny-response: "{{ .Values.policyDenyResponse }}"
+{{- end}}
+
 {{- if .Values.MTU }}
   mtu: {{ .Values.MTU | quote }}
 {{- end }}
@@ -575,6 +587,35 @@ data:
 {{- end }}
   ec2-api-endpoint: {{ .Values.eni.ec2APIEndpoint | quote }}
   eni-tags: {{ .Values.eni.eniTags | toRawJson | quote }}
+{{- if .Values.eni.nodeSpec }}
+  {{- if ne .Values.eni.nodeSpec.firstInterfaceIndex nil }}
+  eni-first-interface-index: {{ .Values.eni.nodeSpec.firstInterfaceIndex | quote }}
+  {{- end }}
+  {{- if .Values.eni.nodeSpec.subnetIDs }}
+  eni-subnet-ids: {{ .Values.eni.nodeSpec.subnetIDs | join "," | quote }}
+  {{- end }}
+  {{- if .Values.eni.nodeSpec.subnetTags }}
+  eni-subnet-tags: {{ .Values.eni.nodeSpec.subnetTags | join "," | quote }}
+  {{- end }}
+  {{- if .Values.eni.nodeSpec.securityGroups }}
+  eni-security-groups: {{ .Values.eni.nodeSpec.securityGroups | join "," | quote }}
+  {{- end }}
+  {{- if .Values.eni.nodeSpec.securityGroupTags }}
+  eni-security-group-tags: {{ .Values.eni.nodeSpec.securityGroupTags | join "," | quote }}
+  {{- end }}
+  {{- if .Values.eni.nodeSpec.excludeInterfaceTags }}
+  eni-exclude-interface-tags: {{ .Values.eni.nodeSpec.excludeInterfaceTags | join "," | quote }}
+  {{- end }}
+  {{- if .Values.eni.nodeSpec.usePrimaryAddress }}
+  eni-use-primary-address: "true"
+  {{- end }}
+  {{- if .Values.eni.nodeSpec.disablePrefixDelegation }}
+  eni-disable-prefix-delegation: "true"
+  {{- end }}
+  {{- if ne .Values.eni.nodeSpec.deleteOnTermination nil }}
+  eni-delete-on-termination: {{ .Values.eni.nodeSpec.deleteOnTermination | quote }}
+  {{- end }}
+{{- end }}
 {{- if .Values.eni.subnetIDsFilter }}
   subnet-ids-filter: {{ .Values.eni.subnetIDsFilter | join " " | quote }}
 {{- end }}
@@ -600,17 +641,39 @@ data:
 {{- end }}
   azure-use-primary-address: {{ $azureUsePrimaryAddress | quote }}
 {{- end }}
+{{- if .Values.azure.nodeSpec.azureInterfaceName }}
+  azure-interface-name: {{ .Values.azure.nodeSpec.azureInterfaceName | quote }}
+{{- end }}
 
 {{- if .Values.alibabacloud.enabled }}
   enable-endpoint-routes: "true"
   auto-create-cilium-node-resource: "true"
 {{- end }}
+{{- if .Values.alibabacloud.nodeSpec.vSwitches }}
+  alibabacloud-vswitches: {{ .Values.alibabacloud.nodeSpec.vSwitches | join "," | quote }}
+{{- end }}
+{{- if .Values.alibabacloud.nodeSpec.vSwitchTags }}
+  alibabacloud-vswitch-tags: {{ .Values.alibabacloud.nodeSpec.vSwitchTags | join "," | quote }}
+{{- end }}
+{{- if .Values.alibabacloud.nodeSpec.securityGroups }}
+  alibabacloud-security-groups: {{ .Values.alibabacloud.nodeSpec.securityGroups | join "," | quote }}
+{{- end }}
+{{- if .Values.alibabacloud.nodeSpec.securityGroupTags }}
+  alibabacloud-security-group-tags: {{ .Values.alibabacloud.nodeSpec.securityGroupTags | join "," | quote }}
+{{- end }}
 
 {{- if hasKey .Values "l7Proxy" }}
   # Enables L7 proxy for L7 policy enforcement and visibility
   enable-l7-proxy: {{ .Values.l7Proxy | quote }}
 {{- end }}
 
+{{- if hasKey .Values "standaloneDnsProxy" }}
+  {{- if .Values.standaloneDnsProxy.enabled }}
+  enable-standalone-dns-proxy: {{ .Values.standaloneDnsProxy.enabled | quote }}
+  standalone-dns-proxy-server-port: {{ .Values.standaloneDnsProxy.serverPort | quote }}
+  {{- end }}
+{{- end }}
+
 {{- if ne $cniChainingMode "none" }}
   # Enable chaining with another CNI plugin
   #
@@ -643,6 +706,7 @@ data:
   enable-ipv4-big-tcp: {{ .Values.enableIPv4BIGTCP | quote }}
   enable-ipv6-big-tcp: {{ .Values.enableIPv6BIGTCP | quote }}
   enable-ipv6-masquerade: {{ .Values.enableIPv6Masquerade | quote }}
+  enable-tunnel-big-tcp: {{ .Values.enableTunnelBIGTCP | quote }}
 
 {{- if hasKey .Values.bpf "enableTCX" }}
   enable-tcx: {{ .Values.bpf.enableTCX | quote }}
@@ -687,6 +751,8 @@ data:
     {{- if .Values.encryption.wireguard.persistentKeepalive }}
   wireguard-persistent-keepalive: {{ .Values.encryption.wireguard.persistentKeepalive | quote }}
     {{- end }}
+  {{- else if eq .Values.encryption.type "ztunnel" }}
+  enable-ztunnel: {{ .Values.encryption.enabled | quote }}
   {{- end }}
   {{- if .Values.encryption.nodeEncryption }}
   encrypt-node: {{ .Values.encryption.nodeEncryption | quote }}
@@ -694,11 +760,20 @@ data:
 {{- end }}
 
 {{- if .Values.encryption.strictMode.enabled }}
-  enable-encryption-strict-mode: {{ .Values.encryption.strictMode.enabled | quote }}
+  # --- DEPRECATED: Please use encryption.strictMode.egress.enabled instead
+  enable-encryption-strict-mode-egress: {{ .Values.encryption.strictMode.enabled | quote }}
+  encryption-strict-egress-cidr: {{ .Values.encryption.strictMode.cidr | quote }}
+  encryption-strict-egress-allow-remote-node-identities: {{ .Values.encryption.strictMode.allowRemoteNodeIdentities | quote }}
+{{- end }}
 
-  encryption-strict-mode-cidr: {{ .Values.encryption.strictMode.cidr | quote }}
+{{- if .Values.encryption.strictMode.ingress.enabled }}
+  enable-encryption-strict-mode-ingress: {{ .Values.encryption.strictMode.ingress.enabled | quote }}
+{{- end }}
 
-  encryption-strict-mode-allow-remote-node-identities: {{ .Values.encryption.strictMode.allowRemoteNodeIdentities | quote }}
+{{- if .Values.encryption.strictMode.egress.enabled }}
+  enable-encryption-strict-mode-egress: {{ .Values.encryption.strictMode.egress.enabled | quote }}
+  encryption-strict-egress-cidr: {{ .Values.encryption.strictMode.egress.cidr | quote }}
+  encryption-strict-egress-allow-remote-node-identities: {{ .Values.encryption.strictMode.egress.allowRemoteNodeIdentities | quote }}
 {{- end }}
 
   enable-xt-socket-fallback: {{ .Values.enableXTSocketFallback | quote }}
@@ -773,6 +848,10 @@ data:
   kube-proxy-replacement-healthz-bind-address: {{ default "" .Values.kubeProxyReplacementHealthzBindAddr | quote}}
 {{- end }}
 
+{{- if hasKey .Values "enableNoServiceEndpointsRoutable" }}
+  enable-no-service-endpoints-routable: {{ .Values.enableNoServiceEndpointsRoutable | quote }}
+{{- end }}
+
 {{- if $socketLB }}
 {{- if hasKey $socketLB "enabled" }}
   bpf-lb-sock: {{ $socketLB.enabled | quote }}
@@ -789,9 +868,6 @@ data:
 {{- end }}
 
 {{- if hasKey .Values "nodePort" }}
-{{- if eq $kubeProxyReplacement "false" }}
-  enable-node-port: {{ .Values.nodePort.enabled | quote }}
-{{- end }}
 {{- if hasKey .Values.nodePort "range" }}
   node-port-range: {{ get .Values.nodePort "range" | quote }}
 {{- end }}
@@ -832,10 +908,6 @@ data:
   enable-service-topology: {{ .Values.loadBalancer.serviceTopology | quote }}
 # {{- end }}
 
-{{- if hasKey .Values.loadBalancer "protocolDifferentiation" }}
-  bpf-lb-proto-diff: {{ .Values.loadBalancer.protocolDifferentiation.enabled | quote }}
-{{- end }}
-
 {{- end }}
 {{- if hasKey .Values.maglev "tableSize" }}
   bpf-lb-maglev-table-size: {{ .Values.maglev.tableSize | quote}}
@@ -843,11 +915,9 @@ data:
 {{- if hasKey .Values.maglev "hashSeed" }}
   bpf-lb-maglev-hash-seed: {{ .Values.maglev.hashSeed | quote}}
 {{- end }}
-{{- if .Values.sessionAffinity }}
-  enable-session-affinity: {{ .Values.sessionAffinity | quote }}
-{{- end }}
-{{- if .Values.svcSourceRangeCheck }}
-  enable-svc-source-range-check: {{ .Values.svcSourceRangeCheck | quote }}
+
+{{- if .Values.bpf.monitorTraceIPOption }}
+  ip-tracing-option-type: {{ .Values.bpf.monitorTraceIPOption | quote }}
 {{- end }}
 
 {{- if hasKey .Values "l2NeighDiscovery" }}
@@ -860,12 +930,16 @@ data:
   pprof: {{ .Values.pprof.enabled | quote }}
   pprof-address: {{ .Values.pprof.address | quote }}
   pprof-port: {{ .Values.pprof.port | quote }}
+  pprof-mutex-profile-fraction: {{ .Values.pprof.mutexProfileFraction | quote }}
+  pprof-block-profile-rate: {{ .Values.pprof.blockProfileRate | quote }}
 {{- end }}
 
 {{- if .Values.operator.pprof.enabled }}
   operator-pprof: {{ .Values.operator.pprof.enabled | quote }}
   operator-pprof-address: {{ .Values.operator.pprof.address | quote }}
   operator-pprof-port: {{ .Values.operator.pprof.port | quote }}
+  operator-pprof-mutex-profile-fraction: {{ .Values.operator.pprof.mutexProfileFraction | quote }}
+  operator-pprof-block-profile-rate: {{ .Values.operator.pprof.blockProfileRate | quote }}
 {{- end }}
 
 {{- if .Values.logSystemLoad }}
@@ -973,6 +1047,10 @@ data:
   # Capacity of the buffer to store recent events.
   hubble-event-buffer-capacity: {{ .Values.hubble.eventBufferCapacity | quote }}
 {{- end }}
+{{- if hasKey .Values.hubble "lostEventSendInterval" }}
+  # Interval to send lost events from Observer server.
+  hubble-lost-event-send-interval: {{ include "validateDuration" .Values.hubble.lostEventSendInterval | quote }}
+{{- end }}
 {{- if or .Values.hubble.metrics.enabled .Values.hubble.metrics.dynamic.enabled}}
   # Address to expose Hubble metrics (e.g. ":7070"). Metrics server will be disabled if this
   # field is not set.
@@ -1040,8 +1118,10 @@ data:
   hubble-export-file-max-size-mb: {{ .Values.hubble.export.fileMaxSizeMb | default .Values.hubble.export.static.fileMaxSizeMb | quote }}
   hubble-export-file-max-backups: {{ .Values.hubble.export.fileMaxBackups | default .Values.hubble.export.static.fileMaxBackups | quote }}
   hubble-export-file-compress: {{ .Values.hubble.export.fileCompress | default .Values.hubble.export.static.fileCompress | quote }}
+  hubble-export-aggregation-interval: {{ include "validateDuration" .Values.hubble.export.aggregationInterval | default .Values.hubble.export.static.aggregationInterval | quote }}
   hubble-export-file-path: {{ .Values.hubble.export.static.filePath | quote }}
   hubble-export-fieldmask: {{ .Values.hubble.export.static.fieldMask | join " " | quote }}
+  hubble-export-fieldaggregate: {{ .Values.hubble.export.static.fieldAggregate | join " " | quote }}
   hubble-export-allowlist: {{ .Values.hubble.export.static.allowList | join " " | quote }}
   hubble-export-denylist: {{ .Values.hubble.export.static.denyList | join " " | quote }}
 {{- end }}
@@ -1078,10 +1158,28 @@ data:
   disable-iptables-feeder-rules: {{ .Values.disableIptablesFeederRules | join " " | quote }}
 {{- end }}
 {{- if .Values.aksbyocni.enabled }}
+  {{- if or (not .Values.ipam.mode) (eq .Values.ipam.mode "cluster-pool") }}
   ipam: "cluster-pool"
+  {{- else if eq .Values.ipam.mode "multi-pool" }}
+  ipam: "multi-pool"
+  {{- end }}
 {{- else }}
   ipam: {{ $ipam | quote }}
 {{- end }}
+{{- if .Values.ipam.nodeSpec }}
+  {{- if ne .Values.ipam.nodeSpec.ipamMinAllocate nil }}
+  ipam-min-allocate: {{ .Values.ipam.nodeSpec.ipamMinAllocate | quote }}
+  {{- end }}
+  {{- if ne .Values.ipam.nodeSpec.ipamPreAllocate nil }}
+  ipam-pre-allocate: {{ .Values.ipam.nodeSpec.ipamPreAllocate | quote }}
+  {{- end }}
+  {{- if ne .Values.ipam.nodeSpec.ipamMaxAllocate nil }}
+  ipam-max-allocate: {{ .Values.ipam.nodeSpec.ipamMaxAllocate | quote }}
+  {{- end }}
+  {{- if .Values.ipam.nodeSpec.ipamStaticIPTags }}
+  ipam-static-ip-tags: {{ .Values.ipam.nodeSpec.ipamStaticIPTags | join "," | quote }}
+  {{- end }}
+{{- end }}
 {{- if .Values.ipam.multiPoolPreAllocation }}
   ipam-multi-pool-pre-allocation: {{ .Values.ipam.multiPoolPreAllocation | quote }}
 {{- end }}
@@ -1092,18 +1190,10 @@ data:
 
 {{- if (eq $ipam "cluster-pool") }}
 {{- if .Values.ipv4.enabled }}
-  {{- if hasKey .Values.ipam.operator "clusterPoolIPv4PodCIDR" }}
-    {{- /* ipam.operator.clusterPoolIPv4PodCIDR removed in v1.14, remove this failsafe around v1.17 */ -}}
-    {{- fail "Value ipam.operator.clusterPoolIPv4PodCIDR removed, use ipam.operator.clusterPoolIPv4PodCIDRList instead" }}
-  {{- end }}
   cluster-pool-ipv4-cidr: {{ .Values.ipam.operator.clusterPoolIPv4PodCIDRList | join " " | quote }}
   cluster-pool-ipv4-mask-size: {{ .Values.ipam.operator.clusterPoolIPv4MaskSize | quote }}
 {{- end }}
 {{- if .Values.ipv6.enabled }}
-  {{- if hasKey .Values.ipam.operator "clusterPoolIPv6PodCIDR" }}
-    {{- /* ipam.operator.clusterPoolIPv6PodCIDR removed in v1.14, remove this failsafe around v1.17 */ -}}
-    {{- fail "Value ipam.operator.clusterPoolIPv6PodCIDR removed, use ipam.operator.clusterPoolIPv6PodCIDRList instead" }}
-  {{- end }}
   cluster-pool-ipv6-cidr: {{ .Values.ipam.operator.clusterPoolIPv6PodCIDRList | join " " | quote }}
   cluster-pool-ipv6-mask-size: {{ .Values.ipam.operator.clusterPoolIPv6MaskSize | quote }}
 {{- end }}
@@ -1172,20 +1262,11 @@ data:
   crd-wait-timeout: {{ include "validateDuration" .Values.crdWaitTimeout | quote }}
 {{- end }}
 
-{{- if .Values.enableK8sEndpointSlice }}
-  enable-k8s-endpoint-slice: {{ .Values.enableK8sEndpointSlice | quote }}
-{{- end }}
-
 {{- if hasKey .Values.k8s "serviceProxyName" }}
   # Configure service proxy name for Cilium.
   k8s-service-proxy-name: {{ .Values.k8s.serviceProxyName | quote }}
 {{- end }}
 
-{{- if and .Values.customCalls .Values.customCalls.enabled }}
-  # Enable tail call hooks for custom eBPF programs.
-  enable-custom-calls: {{ .Values.customCalls.enabled | quote }}
-{{- end }}
-
 {{- if .Values.l2announcements.enabled }}
   # Enable L2 announcements
   enable-l2-announcements: {{ .Values.l2announcements.enabled | quote }}
@@ -1222,6 +1303,8 @@ data:
   enable-pmtu-discovery: "true"
 {{- end }}
 
+  packetization-layer-pmtud-mode: {{ .Values.pmtuDiscovery.packetizationLayerPMTUDMode | quote }}
+
 {{- if not .Values.securityContext.privileged }}
   procfs: "/host/proc"
 {{- end }}
@@ -1296,11 +1379,20 @@ data:
 {{- end }}
 
 {{- if .Values.operator.unmanagedPodWatcher.restart }}
-  unmanaged-pod-watcher-interval: {{ .Values.operator.unmanagedPodWatcher.intervalSeconds | quote }}
+  {{- $interval := .Values.operator.unmanagedPodWatcher.intervalSeconds }}
+  {{- if kindIs "float64" $interval }}
+  unmanaged-pod-watcher-interval: {{ printf "%ds" (int $interval) | quote }}
+  {{- else }}
+  unmanaged-pod-watcher-interval: {{ $interval | quote }}
+  {{- end }}
 {{- else }}
   unmanaged-pod-watcher-interval: "0"
 {{- end }}
 
+{{- if ne .Values.operator.unmanagedPodWatcher.selector nil }}
+  pod-restart-selector: {{ .Values.operator.unmanagedPodWatcher.selector }}
+{{- end }}
+
 {{- if .Values.dnsProxy }}
   {{- if hasKey .Values.dnsProxy "enableTransparentMode" }}
   # explicit setting gets precedence
@@ -1370,10 +1462,14 @@ data:
   proxy-xff-num-trusted-hops-egress: {{ .Values.envoy.xffNumTrustedHopsL7PolicyEgress | quote }}
   proxy-connect-timeout: {{ .Values.envoy.connectTimeoutSeconds | quote }}
   proxy-initial-fetch-timeout: {{ .Values.envoy.initialFetchTimeoutSeconds | quote }}
+  proxy-max-active-downstream-connections: {{ .Values.envoy.maxGlobalDownstreamConnections | quote }}
   proxy-max-requests-per-connection: {{ .Values.envoy.maxRequestsPerConnection | quote }}
   proxy-max-connection-duration-seconds: {{ .Values.envoy.maxConnectionDurationSeconds | quote }}
   proxy-idle-timeout-seconds: {{ .Values.envoy.idleTimeoutDurationSeconds | quote }}
   proxy-max-concurrent-retries: {{ .Values.envoy.maxConcurrentRetries | quote }}
+  proxy-use-original-source-address: {{ .Values.envoy.useOriginalSourceAddress | quote }}
+  proxy-cluster-max-connections: {{ .Values.envoy.clusterMaxConnections | quote }}
+  proxy-cluster-max-requests: {{ .Values.envoy.clusterMaxRequests | quote }}
   http-retry-count: {{ .Values.envoy.httpRetryCount | quote }}
   http-stream-idle-timeout: {{ .Values.envoy.streamIdleTimeoutDurationSeconds | quote }}
 
@@ -1402,13 +1498,14 @@ data:
 {{- if hasKey .Values.clustermesh "maxConnectedClusters" }}
   max-connected-clusters: {{ .Values.clustermesh.maxConnectedClusters | quote }}
 {{- end }}
+  clustermesh-cache-ttl: {{ .Values.clustermesh.cacheTTL | quote }}
   clustermesh-enable-endpoint-sync: {{ .Values.clustermesh.enableEndpointSliceSynchronization | quote }}
-  clustermesh-enable-mcs-api: {{ .Values.clustermesh.enableMCSAPISupport | quote }}
+  clustermesh-enable-mcs-api: {{ (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) | quote }}
+  clustermesh-mcs-api-install-crds: {{ .Values.clustermesh.mcsapi.installCRDs | quote }}
   policy-default-local-cluster: {{ .Values.clustermesh.policyDefaultLocalCluster | quote }}
 
   nat-map-stats-entries: {{ .Values.nat.mapStatsEntries | quote }}
   nat-map-stats-interval: {{ .Values.nat.mapStatsInterval | quote }}
-  enable-internal-traffic-policy: {{ .Values.enableInternalTrafficPolicy | quote }}
   enable-lb-ipam: {{ .Values.enableLBIPAM | quote }}
   enable-non-default-deny-policies: {{ .Values.enableNonDefaultDenyPolicies | quote }}
 

packages/system/cilium/charts/cilium/templates/cilium-envoy/daemonset.yaml

@@ -22,10 +22,7 @@ spec:
   selector:
     matchLabels:
       k8s-app: cilium-envoy
-  {{- with .Values.envoy.updateStrategy }}
-  updateStrategy:
-    {{- toYaml . | trim | nindent 4 }}
-  {{- end }}
+  {{- include "envoy.updateStrategy" . | nindent 2 }}
   template:
     metadata:
       annotations:
@@ -69,6 +66,7 @@ spec:
       securityContext:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- include "envoy.initContainers" . | nindent 6 }}
       containers:
       - name: cilium-envoy
         image: {{ include "cilium.image" .Values.envoy.image | quote }}
@@ -94,6 +92,7 @@ spec:
         {{- if .Values.envoy.log.path }}
         - '--log-path {{ .Values.envoy.log.path }}'
         {{- end }}
+        {{- include "envoy.args.extra" . | nindent 8 }}
         {{- with .Values.envoy.extraArgs }}
         {{- toYaml . | trim | nindent 8 }}
         {{- end }}
@@ -157,6 +156,7 @@ spec:
         - name: KUBERNETES_SERVICE_PORT
           value: {{ include "k8sServicePort" . }}
         {{- end }}
+        {{- include "envoy.env.extra" . | nindent 8 }}
         {{- with .Values.envoy.extraEnv }}
         {{- toYaml . | trim | nindent 8 }}
         {{- end }}
@@ -164,19 +164,7 @@ spec:
         resources:
           {{- toYaml . | trim | nindent 10 }}
         {{- end }}
-        {{- if .Values.envoy.prometheus.enabled }}
-        ports:
-        - name: envoy-metrics
-          containerPort: {{ .Values.envoy.prometheus.port }}
-          hostPort: {{ .Values.envoy.prometheus.port }}
-          protocol: TCP
-        {{- if and .Values.envoy.debug.admin.enabled .Values.envoy.debug.admin.port }}
-        - name: envoy-admin
-          containerPort: {{ .Values.envoy.debug.admin.port }}
-          hostPort: {{ .Values.envoy.debug.admin.port }}
-          protocol: TCP
-        {{- end }}
-        {{- end }}
+        {{- include "envoy.ports" . }}
         securityContext:
           {{- if .Values.envoy.securityContext.privileged }}
           privileged: true
@@ -209,6 +197,7 @@ spec:
           mountPath: /sys/fs/bpf
           mountPropagation: HostToContainer
         {{- end }}
+        {{- include "envoy.volumeMounts.extra" . | nindent 8 }}
         {{- range .Values.envoy.extraHostPathMounts }}
         - name: {{ .name }}
           mountPath: {{ .mountPath }}
@@ -232,10 +221,7 @@ spec:
       {{- if .Values.envoy.dnsPolicy }}
       dnsPolicy: {{ .Values.envoy.dnsPolicy }}
       {{- end }}
-      {{- with .Values.envoy.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
+      {{- include "envoy.affinity" . | nindent 6  }}
       {{- with .Values.envoy.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
@@ -269,6 +255,7 @@ spec:
           path: /sys/fs/bpf
           type: DirectoryOrCreate
       {{- end }}
+      {{- include "envoy.hostPathMounts.extra" . | nindent 4 }}
       {{- range .Values.envoy.extraHostPathMounts }}
       - name: {{ .name }}
         hostPath:

packages/system/cilium/charts/cilium/templates/cilium-envoy/service.yaml

@@ -32,5 +32,5 @@ spec:
   - name: envoy-metrics
     port: {{ .Values.envoy.prometheus.port }}
     protocol: TCP
-    targetPort: envoy-metrics
+    targetPort: {{ .Values.envoy.prometheus.port }}
 {{- end }}

packages/system/cilium/charts/cilium/templates/cilium-ingress-service.yaml

@@ -49,8 +49,8 @@ spec:
   externalTrafficPolicy: {{ .Values.ingressController.service.externalTrafficPolicy }}
   {{- end }}
 ---
-apiVersion: v1
-kind: Endpoints
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
 metadata:
   name: {{ .Values.ingressController.service.name }}
   namespace: {{ include "cilium.namespace" . }}
@@ -65,9 +65,10 @@ metadata:
   annotations:
     {{- toYaml .Values.ingressController.service.annotations | nindent 4 }}
   {{- end }}
-subsets:
+addressType: IPv4
+endpoints:
 - addresses:
-  - ip: "192.192.192.192"
-  ports:
-  - port: 9999
+  - "192.192.192.192"
+ports:
+- port: 9999
 {{- end }}

packages/system/cilium/charts/cilium/templates/cilium-nodeinit/daemonset.yaml

@@ -122,6 +122,8 @@ spec:
       {{- if .Values.serviceAccounts.nodeinit.enabled }}
       serviceAccountName: {{ .Values.serviceAccounts.nodeinit.name | quote }}
       automountServiceAccountToken: {{ .Values.serviceAccounts.nodeinit.automount }}
+      {{- else }}
+      automountServiceAccountToken: false
       {{- end }}
       {{- with .Values.nodeinit.extraVolumes }}
       volumes:

packages/system/cilium/charts/cilium/templates/cilium-operator/clusterrole.yaml

@@ -69,7 +69,7 @@ rules:
   resources:
   - endpointslices
   verbs:
-{{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.enableMCSAPISupport }}
+{{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }}
   - create
   - update
   - delete
@@ -78,6 +78,17 @@ rules:
   - get
   - list
   - watch
+{{- if .Values.clustermesh.enableEndpointSliceSynchronization }}
+- apiGroups:
+  - ""
+  resources:
+  # The controller needs to be able to set a service's finalizers to be able to create an EndpointSlice
+  # resource that is owned by the service and sets blockOwnerDeletion=true in its ownerRef.
+  # This is required when the admission plugin OwnerReferencesPermissionEnforcement is activated.
+  - services/finalizers
+  verbs:
+  - update
+{{- end }}
 - apiGroups:
   - ""
   resources:
@@ -114,6 +125,20 @@ rules:
   - delete
   - patch
 {{- end }}
+{{- if or .Values.ingressController.enabled .Values.gatewayAPI.enabled }}
+- apiGroups:
+  - "discovery.k8s.io"
+  resources:
+  - endpointslices
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - delete
+  - patch
+{{- end }}
 {{- if .Values.clustermesh.enableEndpointSliceSynchronization }}
 - apiGroups:
   - ""
@@ -227,7 +252,6 @@ rules:
   - update
   resourceNames:
   - ciliumloadbalancerippools.cilium.io
-  - ciliumbgppeeringpolicies.cilium.io
   - ciliumbgpclusterconfigs.cilium.io
   - ciliumbgppeerconfigs.cilium.io
   - ciliumbgpadvertisements.cilium.io
@@ -248,12 +272,15 @@ rules:
   - ciliuml2announcementpolicies.cilium.io
   - ciliumpodippools.cilium.io
   - ciliumgatewayclassconfigs.cilium.io
+{{- if and (or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.mcsapi.installCRDs }}
+  - serviceimports.multicluster.x-k8s.io
+  - serviceexports.multicluster.x-k8s.io
+{{- end }}
 - apiGroups:
   - cilium.io
   resources:
   - ciliumloadbalancerippools
   - ciliumpodippools
-  - ciliumbgppeeringpolicies
   - ciliumbgpclusterconfigs
   - ciliumbgpnodeconfigoverrides
   - ciliumbgppeerconfigs
@@ -301,6 +328,10 @@ rules:
   - networking.k8s.io
   resources:
   - ingresses/status # To update ingress status with load balancer IP.
+  # The controller needs to be able to set ingress finalizers to be able to create a CiliumEnvoyConfig
+  # resource that is owned by the ingress, and set blockOwnerDeletion=true in its ownerRef.
+  # This is required when the admission plugin OwnerReferencesPermissionEnforcement is activated.
+  - ingresses/finalizers
   verbs:
   - update
 {{- end }}
@@ -352,7 +383,7 @@ rules:
   - update
   - patch
 {{- end }}
-{{- if or .Values.gatewayAPI.enabled .Values.clustermesh.enableMCSAPISupport }}
+{{- if or .Values.gatewayAPI.enabled .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }}
 - apiGroups:
   - multicluster.x-k8s.io
   resources:
@@ -361,14 +392,14 @@ rules:
   - get
   - list
   - watch
-{{- if .Values.clustermesh.enableMCSAPISupport }}
+{{- if or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }}
   - create
   - update
   - patch
   - delete
 {{- end }}
 {{- end }}
-{{- if .Values.clustermesh.enableMCSAPISupport }}
+{{- if or .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }}
 - apiGroups:
   - multicluster.x-k8s.io
   resources:
@@ -401,4 +432,10 @@ rules:
   - patch
   - delete
 {{- end }}
+- apiGroups:
+  - cilium.io
+  resources:
+  - ciliumendpointslices
+  verbs:
+  - deletecollection
 {{- end }}

packages/system/cilium/charts/cilium/templates/cilium-operator/deployment.yaml

@@ -98,7 +98,7 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.namespace
-        {{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.enableMCSAPISupport }}
+        {{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }}
         - name: CILIUM_CLUSTERMESH_CONFIG
           value: /var/lib/cilium/clustermesh/
         {{- end }}
@@ -170,6 +170,7 @@ spec:
         - name: AZURE_RESOURCE_GROUP
           value: {{ .Values.azure.resourceGroup }}
         {{- end }}
+        {{- if .Values.azure.clientID }}
         - name: AZURE_CLIENT_ID
           valueFrom:
             secretKeyRef:
@@ -181,11 +182,15 @@ spec:
               name: cilium-azure
               key: AZURE_CLIENT_SECRET
         {{- end }}
+        {{- end }}
         {{- with .Values.operator.extraEnv }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
-        {{- if .Values.operator.prometheus.enabled }}
         ports:
+        - name: health
+          containerPort: 9234
+          hostPort: 9234
+        {{- if .Values.operator.prometheus.enabled }}
         - name: prometheus
           containerPort: {{ .Values.operator.prometheus.port }}
         {{- if .Values.operator.hostNetwork }}
@@ -199,7 +204,7 @@ spec:
             host: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }}
         {{- end }}
             path: /healthz
-            port: 9234
+            port: health
             scheme: HTTP
           initialDelaySeconds: 60
           periodSeconds: 10
@@ -210,7 +215,7 @@ spec:
             host: {{ .Values.ipv4.enabled | ternary "127.0.0.1" "::1" | quote }}
         {{- end }}
             path: /healthz
-            port: 9234
+            port: health
             scheme: HTTP
           initialDelaySeconds: 0
           periodSeconds: 5
@@ -230,7 +235,7 @@ spec:
           readOnly: true
         {{- end }}
         {{- end }}
-        {{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.enableMCSAPISupport }}
+        {{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }}
         - name: clustermesh-secrets
           mountPath: /var/lib/cilium/clustermesh
           readOnly: true
@@ -245,6 +250,11 @@ spec:
           mountPath: {{ dir .Values.authentication.mutual.spire.agentSocketPath }}
           readOnly: true
         {{- end }}
+        {{- if and .Values.operator.prometheus.enabled .Values.operator.prometheus.tls.enabled }}
+        - name: prometheus-tls
+          mountPath: /var/lib/cilium/tls/prometheus
+          readOnly: true
+        {{- end }}
         {{- range .Values.operator.extraHostPathMounts }}
         - name: {{ .name }}
           mountPath: {{ .mountPath }}
@@ -256,13 +266,15 @@ spec:
         {{- with .Values.operator.extraVolumeMounts }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
+        {{- include "cilium-operator.volumeMounts.extra" . | nindent 8 }}
         {{- with .Values.operator.resources }}
         resources:
           {{- toYaml . | trim | nindent 10 }}
         {{- end }}
-        {{- with .Values.operator.securityContext }}
+        {{- $sc := include "cilium.operator.securityContext" . | trim }}
+        {{- if $sc }}
         securityContext:
-          {{- toYaml . | trim | nindent 10 }}
+          {{- $sc | nindent 10 }}
         {{- end }}
         terminationMessagePolicy: FallbackToLogsOnError
       hostNetwork: {{ .Values.operator.hostNetwork }}
@@ -295,23 +307,25 @@ spec:
       nodeSelector:
         {{- toYaml . | trim | nindent 8 }}
       {{- end }}
-      {{- if and (or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.config.enabled (not (and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.kvstoremesh.enabled )) }}
+      {{- if and (or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport) .Values.clustermesh.config.enabled (not (and .Values.clustermesh.useAPIServer .Values.clustermesh.apiserver.kvstoremesh.enabled )) }}
       hostAliases:
-      {{- range $cluster := .Values.clustermesh.config.clusters }}
+      {{- range $_, $cluster := (include "clustermesh-clusters" . | fromJson) }}
       {{- range $ip := $cluster.ips }}
       - ip: {{ $ip }}
         hostnames: [ "{{ $cluster.name }}.{{ $.Values.clustermesh.config.domain }}" ]
       {{- end }}
       {{- end }}
       {{- end }}
-      {{- with .Values.operator.tolerations }}
+      {{- if or (.Values.operator.tolerations) (hasKey .Values "agentNotReadyTaintKey") }}
       tolerations:
+      {{- with .Values.operator.tolerations }}
         {{- toYaml . | trim | nindent 8 }}
       {{- end }}
       {{- if hasKey .Values "agentNotReadyTaintKey" }}
         - key: {{ .Values.agentNotReadyTaintKey }}
           operator: Exists
       {{ end}}
+      {{- end}}
       volumes:
         # To read the configuration from the config map
       - name: cilium-config-path
@@ -360,7 +374,7 @@ spec:
       {{- with .Values.operator.extraVolumes }}
       {{- toYaml . | nindent 6 }}
       {{- end }}
-      {{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.enableMCSAPISupport }}
+      {{- if or .Values.clustermesh.enableEndpointSliceSynchronization .Values.clustermesh.mcsapi.enabled .Values.clustermesh.enableMCSAPISupport }}
         # To read the clustermesh configuration
       - name: clustermesh-secrets
         projected:
@@ -417,4 +431,25 @@ spec:
                 path: local-etcd-client-ca.crt
           {{- end }}
       {{- end }}
+      {{- if and .Values.operator.prometheus.enabled .Values.operator.prometheus.tls.enabled }}
+      # To read the prometheus configuration
+      - name: prometheus-tls
+        projected:
+          # note: the leading zero means this number is in octal representation: do not remove it
+          defaultMode: 0400
+          sources:
+          - secret:
+              name: {{ .Values.operator.prometheus.tls.server.existingSecret }}
+              optional: true
+              items:
+                - key: tls.crt
+                  path: server.crt
+                - key: tls.key
+                  path: server.key
+                {{- if .Values.operator.prometheus.tls.server.mtls.enabled }}
+                - key: ca.crt
+                  path: client-ca.crt
+                {{- end }}
+      {{- end }}
+      {{- include "cilium-operator.volumes.extra" . | nindent 6 }}
 {{- end }}

packages/system/cilium/charts/cilium/templates/cilium-operator/role.yaml

@@ -83,3 +83,35 @@ rules:
   - update
   - patch
 {{- end }}
+
+{{- if and .Values.operator.enabled .Values.serviceAccounts.operator.create }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cilium-operator-ztunnel
+  namespace: {{ include "cilium.namespace" . }}
+  {{- with .Values.operator.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    app.kubernetes.io/part-of: cilium
+    {{- with .Values.commonLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+rules:
+# ZTunnel DaemonSet management permissions
+# Note: These permissions must always be granted (not conditional on encryption.type)
+# because the controller needs to clean up stale DaemonSets when ztunnel is disabled.
+- apiGroups:
+  - apps
+  resources:
+  - daemonsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+{{- end }}