Skip to content

Conversation

@kvaps
Copy link
Member

@kvaps kvaps commented Nov 18, 2025

Overview

This PR introduces a significant architectural refactoring of Cozystack, moving from a static bundle-based configuration system to a dynamic, Kubernetes-native resource-driven architecture using custom resources and operators.

Major Changes

1. Introduction of New Custom Resources

Bundle API (cozystack.io/v1alpha1.Bundle)

  • Purpose: Replaces static YAML bundle definitions with a dynamic Kubernetes resource
  • Features:
    • Defines collections of Helm releases (packages) that can be installed together
    • Supports bundle dependencies via dependsOn mechanism
    • Allows defining dependency targets for cross-bundle references
    • Supports artifact generation for Helm charts
    • Includes library chart support
    • Configurable deletion policies (Delete/Orphan)
    • Base path configuration for source repositories

Platform API (cozystack.io/v1alpha1.Platform)

  • Purpose: Manages the core Cozystack platform installation
  • Features:
    • Declarative platform configuration
    • Source reference for platform charts
    • Helm values support
    • Configurable reconciliation intervals

2. New Cozystack Operator Component

  • New Component: cozystack-operator (separate from cozystack-controller)
  • Responsibilities:
    • Reconciles Bundle resources and creates corresponding HelmReleases
    • Reconciles Platform resources
    • Manages ArtifactGenerators for bundle artifacts
    • Handles namespace creation and management
    • Resolves bundle dependencies
    • Manages telemetry collection (moved from cozystack-controller)

3. ApplicationDefinition Refactoring

  • Replaced: CozystackResourceDefinition controller with ApplicationDefinition controller
  • Changes:
    • Simplified application definition management
    • Removed lookups for apps in platform controller
    • Better integration with the new bundle system

4. Artifact Generation System

  • New Feature: ArtifactGenerators and ExternalArtifacts
  • Purpose:
    • Build Helm charts from source repositories as artifacts
    • Reference artifacts in ApplicationDefinitions and bundles
    • Support OCI registry as artifact source
  • Implementation:
    • Uses FluxCD's source-watcher for artifact generation
    • Artifacts can be referenced by name in bundles and applications
    • Supports both GitRepository and OCIRepository sources

5. FluxCD Integration Improvements

  • Flux Version: Updated to FluxCD 2.7.x
  • New Package: flux-aio (All-In-One) package added to core
  • Source Watcher: Enabled and integrated for artifact generation
  • Network Policies: Disabled for Flux components to avoid probe issues
  • Embedded Manifests: Flux installation manifests embedded in operator

6. Bundle Architecture Migration

  • Old System: Static YAML files defining bundles (e.g., distro-full.yaml, paas-full.yaml)
  • New System: Bundle resources with structured definitions
  • New Bundle Structure:
    • iaas/bundle.yaml - Infrastructure-as-a-Service bundle
    • naas/bundle.yaml - Network-as-a-Service bundle
    • paas/bundle.yaml - Platform-as-a-Service bundle
    • system/bundle-*.yaml - System bundles (minimal, hosted, full)
  • Benefits:
    • Dynamic bundle management
    • Better dependency resolution
    • Easier customization and extension

7. Platform Package Restructuring

  • Templates Refactored:
    • Removed direct HelmRelease and HelmRepository templates
    • Added bundle-based templates
    • Migration hook for upgrading existing installations
    • ApplicationDefinitions template for managing apps
  • New Features:
    • Version tracking
    • Better namespace management

8. Migration System

  • New Component: Migration system for upgrading existing installations
  • Location: packages/core/platform/images/migrations/
  • Features:
    • Migration scripts (migrations 1-22)
    • Migration hook for automatic execution
    • Handles transition from old bundle system to new resource-based system

9. Telemetry Relocation

  • Moved: Telemetry collection from cozystack-controller to cozystack-operator
  • Rationale: Better separation of concerns, operator handles platform-level operations

10. Build System Improvements

  • Makefiles: Moved from scripts/ to hack/ directory
  • Common Scripts: Centralized in hack/ for better organization
  • Build Process: Updated to support new operator component

11. API and Controller Changes

  • API Server:
    • Updated to work with ApplicationDefinitions instead of CozystackResourceDefinitions
    • Improved label-based resource identification
    • Better integration with new bundle system
  • Controllers:
    • Removed: system_helm_reconciler.go, tenant_helm_reconciler.go
    • Added: namespace_helm_reconciler.go, applicationdefinition_controller.go
    • Simplified reconciliation logic

12. Application Package Updates

  • ExternalArtifacts: All application packages updated to use ExternalArtifacts instead of direct chart references
  • Consistency: Standardized artifact naming and referencing
  • Dependencies: Better dependency management between packages

Technical Details

New Dependencies

  • FluxCD source-watcher API v1beta1
  • Enhanced Helm controller integration
  • ArtifactGenerator CRD support

Removed Components

  • Static bundle YAML files
  • CozystackResourceDefinition CRD and controller
  • Old Helm reconciliation controllers
  • Direct Helm repository management in platform

New Components

  • Bundle and Platform CRDs
  • Cozystack operator
  • ArtifactGenerator reconciler
  • Migration system
  • Flux-aio package

Impact

This refactoring provides:

  1. Better Extensibility: Easier to add new bundles and applications
  2. Improved Maintainability: Kubernetes-native resources instead of static YAML
  3. Enhanced Flexibility: Dynamic bundle composition and dependencies
  4. Better Observability: Resource-based management enables better tracking
  5. Simplified Operations: Declarative platform and bundle management

Release note

[cozystack] refactor platform

…ate pod

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Nov 18, 2025

Important

Review skipped

More than 25% of the files skipped due to max files limit. The review is being skipped to prevent a low-quality review.

160 files out of 299 files are above the max files limit of 100. Please upgrade to Pro plan to get higher limits.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches
  • 📝 Generate docstrings
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch refactor-engine

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@kvaps kvaps changed the title refactor engine [cozystack-operator] refactor platform chart Nov 18, 2025
@kvaps kvaps changed the title [cozystack-operator] refactor platform chart [cozystack] refactor platform Nov 18, 2025
@kvaps kvaps force-pushed the refactor-engine branch 3 times, most recently from 3f9a966 to 98da8a4 Compare November 18, 2025 22:12
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
@kvaps kvaps force-pushed the refactor-engine branch 2 times, most recently from 1b90089 to fb924e7 Compare November 19, 2025 14:01
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
@kvaps kvaps force-pushed the refactor-engine branch 2 times, most recently from d8a115d to 71484d1 Compare November 19, 2025 14:28
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
@kvaps kvaps force-pushed the refactor-engine branch 2 times, most recently from f33a75f to 977e633 Compare November 20, 2025 02:11
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
@kingdonb
Copy link
Member

kingdonb commented Dec 6, 2025

One major negative downside to removing Flux Operator, is it removes also the opportunity for Flux Enterprise users. (I just got my Flux Enterprise subscription, and am about to test enabling it on Cozystack)

This distro enables faster CVE responses, FIPS encryption, and other compliance checkboxes that would potentially be a blocker for example at my employer if they can't be covered. Flux Enterprise only covers these needs, Flux Upstream does just what the open source project supports. I'm not sure if your mind is made up about this already @kvaps

@kingdonb
Copy link
Member

kingdonb commented Dec 6, 2025

I guess this is free for the user to customize, if you will adopt flux-aio then I will support in my fork flux-operator and that is fine A-OK (it is a reversible decision and it will be easy enough for the user to switch it for themselves, whether they used a hypothetical distro-A or distro-B of Cozystack)

@kvaps
Copy link
Member Author

kvaps commented Dec 6, 2025

@kingdonb I'd like to preserve the opportunity of using flux enterprise with Cozystack.

Right now you have the option to disable flux management by cozystack-operator:

This way, you can install Flux manually via flux-operator and just let Cozystack use it.


Another idea is to provide oportunity to the user to specify kustomize patches for flux-aio. It could be preserved in Secret or ConfigMap. Would it be enough to install flux enterprise?

@kingdonb
Copy link
Member

kingdonb commented Dec 6, 2025

I think so, yes. Have to come back to this when I can put hands on it. I had some troubles upgrading to 0.38 but they're all resolved now! The changelog is big this time 😅

BYO Flux sounds like a very reasonable interface! I think that flux-aio is probably also compatible with the images from the Flux Enterprise distribution, but that's something I'll need to check out for myself yet as well.

@kvaps
Copy link
Member Author

kvaps commented Dec 9, 2025

We have decided to not merge this PR as-is, and go apply changes one-by-one.

The plan:

  • Migrate to flux-aio (kubectl apply from a script) + migration to remove the old Flux
  • Move the asset-server into a separate Deployment
  • Add labels to HelmReleases for CozystackResourceDefinitions, cozystack-controller, webhook, and the API server + migration (patch existing resources)
  • Get rid of lookups and drop hr reconcilers
  • Extract Talos into a separate component
  • cozystack-operator
  • remove the asset-server and switch to artifactgenerators and ocirepository/gitrepository + move Grafana dashboards into a separate Deployment
  • start installing the platform chart via Flux
  • move migrations into the platform chart

@lllamnyp lllamnyp removed their assignment Dec 10, 2025
kvaps added a commit that referenced this pull request Dec 10, 2025
This change is extracted from
- #1641

and reworked to work standalone

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

## What this PR does


### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[fluxcd] Enable source-watcher
```
kvaps added a commit that referenced this pull request Dec 10, 2025
This change is extracted from
- #1641

and reworked to work standalone

requires:

- #1705


## What this PR does

Adds a new `flux-aio` module and migration script to upgrade FluxCD to
version 22. This introduces a new modular approach to FluxCD
installation using the flux-aio OCI module.

Changes:
- Created new `flux-aio` package with Chart.yaml, Makefile, and CUE
configuration
- Added flux-aio module configuration using OCI module from
`ghcr.io/stefanprodan/modules/flux-aio`
- Generated large fluxcd.yaml template (11956+ lines) for FluxCD
resources
- Added migration script (migrations/21) to handle upgrade from version
21 to 22
- Updated installer to include flux-aio module
- Added script `issue-flux-certificates.sh` for managing TLS
certificates for cozystack-assets
- Updated platform templates to support flux-aio module
- Updated cozystack-assets service references

### Release note

```release-note
[fluxcd] Add flux-aio module and migration
```



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Release Notes

* **New Features**
* Added TLS certificate support for Helm package repositories with
automatic certificate provisioning.

* **Chores**
  * Refactored FluxCD integration using Helm chart-based deployment.
  * Updated system to version 22 with automatic migration support.
  * Enhanced security dependencies (OpenSSL).

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This was referenced Dec 19, 2025
kvaps added a commit that referenced this pull request Dec 24, 2025
This change is extracted from
- #1641

and reworked to work standalone

## What this PR does

This PR extracts changes from the
#1641. It adds application
metadata labels to HelmReleases and updates the filtering mechanism to
use labels instead of chart/sourceRef matching.

Changes:
- Add three application metadata labels
(`apps.cozystack.io/application.kind`,
`apps.cozystack.io/application.group`,
`apps.cozystack.io/application.name`) when creating/updating HelmRelease
via Cozystack-API
- Replace `shouldIncludeHelmRelease` filtering with label-based
filtering in Get, List, and Update methods
- Always add kind and group label requirements in List for precise
filtering
- Update CozystackResourceDefinitionController to watch only
HelmReleases with `cozystack.io/ui=true` label
- Update LineageControllerWebhook to extract metadata directly from
HelmRelease labels instead of using chart mapping configuration
- Add functionality to update HelmRelease chart from
CozystackResourceDefinition using label selectors

### Release note

```release-note
[registry] Add application labels and update filtering mechanism to use label-based filtering instead of chart/sourceRef matching
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added application metadata labels (kind, group, name) and exported
label keys for HelmRelease identification.
* New reconciler keeps HelmRelease charts in sync with application CRDs.

* **Refactor**
* Mapping, listing and selection moved to label-driven logic;
reconciliation responsibilities split so core reconciler focuses on
restart/debounce while a separate reconciler updates HelmReleases.

* **Chores**
* Migration script to backfill application labels on existing
HelmReleases.

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
kvaps added a commit that referenced this pull request Dec 24, 2025
This change is extracted from
- #1641

and reworked to work standalone

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

## What this PR does


### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[cozystack] Update go modules
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated Go toolchain to 1.25.0 and upgraded core Kubernetes libraries,
OpenTelemetry, Prometheus, gRPC/protobuf and many indirect dependencies.
Bumped builder base images to golang:1.25-alpine across multiple
components.

* **Refactor**
* Removed legacy component versioning/emulation and simplified server
startup and configuration paths.

* **Tests**
  * Removed tests related to the legacy versioning/emulation behavior.

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
@lllamnyp lllamnyp self-assigned this Dec 29, 2025
kvaps added a commit that referenced this pull request Jan 8, 2026
This change is extracted from
- #1641

and reworked to work standalone

## What this PR does

This PR extracts changes from the
#1641. It adds application
metadata labels to HelmReleases and updates the filtering mechanism to
use labels instead of chart/sourceRef matching.

Changes:
- Add three application metadata labels
(`apps.cozystack.io/application.kind`,
`apps.cozystack.io/application.group`,
`apps.cozystack.io/application.name`) when creating/updating HelmRelease
via Cozystack-API
- Replace `shouldIncludeHelmRelease` filtering with label-based
filtering in Get, List, and Update methods
- Always add kind and group label requirements in List for precise
filtering
- Update CozystackResourceDefinitionController to watch only
HelmReleases with `cozystack.io/ui=true` label
- Update LineageControllerWebhook to extract metadata directly from
HelmRelease labels instead of using chart mapping configuration
- Add functionality to update HelmRelease chart from
CozystackResourceDefinition using label selectors

### Release note

```release-note
[registry] Add application labels and update filtering mechanism to use label-based filtering instead of chart/sourceRef matching
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added application metadata labels (kind, group, name) and exported
label keys for HelmRelease identification.
* New reconciler keeps HelmRelease charts in sync with application CRDs.

* **Refactor**
* Mapping, listing and selection moved to label-driven logic;
reconciliation responsibilities split so core reconciler focuses on
restart/debounce while a separate reconciler updates HelmReleases.

* **Chores**
* Migration script to backfill application labels on existing
HelmReleases.

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
kvaps added a commit that referenced this pull request Jan 8, 2026
This change is extracted from
- #1641

and reworked to work standalone

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[cozystack] Update go modules
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

* **Chores**
* Updated Go toolchain to 1.25.0 and upgraded core Kubernetes libraries,
OpenTelemetry, Prometheus, gRPC/protobuf and many indirect dependencies.
Bumped builder base images to golang:1.25-alpine across multiple
components.

* **Refactor**
* Removed legacy component versioning/emulation and simplified server
startup and configuration paths.

* **Tests**
  * Removed tests related to the legacy versioning/emulation behavior.

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
kvaps added a commit that referenced this pull request Jan 8, 2026
This change is extracted from
- #1641

and reworked to work standalone

## What this PR does

This PR extracts changes from the
#1641. It adds application
metadata labels to HelmReleases and updates the filtering mechanism to
use labels instead of chart/sourceRef matching.

Changes:
- Add three application metadata labels
(`apps.cozystack.io/application.kind`,
`apps.cozystack.io/application.group`,
`apps.cozystack.io/application.name`) when creating/updating HelmRelease
via Cozystack-API
- Replace `shouldIncludeHelmRelease` filtering with label-based
filtering in Get, List, and Update methods
- Always add kind and group label requirements in List for precise
filtering
- Update CozystackResourceDefinitionController to watch only
HelmReleases with `cozystack.io/ui=true` label
- Update LineageControllerWebhook to extract metadata directly from
HelmRelease labels instead of using chart mapping configuration
- Add functionality to update HelmRelease chart from
CozystackResourceDefinition using label selectors

### Release note

```release-note
[registry] Add application labels and update filtering mechanism to use label-based filtering instead of chart/sourceRef matching
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added application metadata labels (kind, group, name) and exported
label keys for HelmRelease identification.
* New reconciler keeps HelmRelease charts in sync with application CRDs.

* **Refactor**
* Mapping, listing and selection moved to label-driven logic;
reconciliation responsibilities split so core reconciler focuses on
restart/debounce while a separate reconciler updates HelmReleases.

* **Chores**
* Migration script to backfill application labels on existing
HelmReleases.

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
kvaps added a commit that referenced this pull request Jan 8, 2026
This change is extracted from
- #1641

and reworked to work standalone

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[cozystack] Update go modules
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

* **Chores**
* Updated Go toolchain to 1.25.0 and upgraded core Kubernetes libraries,
OpenTelemetry, Prometheus, gRPC/protobuf and many indirect dependencies.
Bumped builder base images to golang:1.25-alpine across multiple
components.

* **Refactor**
* Removed legacy component versioning/emulation and simplified server
startup and configuration paths.

* **Tests**
  * Removed tests related to the legacy versioning/emulation behavior.

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
kvaps added a commit that referenced this pull request Jan 9, 2026
This change is extracted from
- #1641

and reworked to work standalone

requires:

- #1705

Adds a new `flux-aio` module and migration script to upgrade FluxCD to
version 22. This introduces a new modular approach to FluxCD
installation using the flux-aio OCI module.

Changes:
- Created new `flux-aio` package with Chart.yaml, Makefile, and CUE
configuration
- Added flux-aio module configuration using OCI module from
`ghcr.io/stefanprodan/modules/flux-aio`
- Generated large fluxcd.yaml template (11956+ lines) for FluxCD
resources
- Added migration script (migrations/21) to handle upgrade from version
21 to 22
- Updated installer to include flux-aio module
- Added script `issue-flux-certificates.sh` for managing TLS
certificates for cozystack-assets
- Updated platform templates to support flux-aio module
- Updated cozystack-assets service references

```release-note
[fluxcd] Add flux-aio module and migration
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

* **New Features**
* Added TLS certificate support for Helm package repositories with
automatic certificate provisioning.

* **Chores**
  * Refactored FluxCD integration using Helm chart-based deployment.
  * Updated system to version 22 with automatic migration support.
  * Enhanced security dependencies (OpenSSL).

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
kvaps added a commit that referenced this pull request Jan 9, 2026
This change is extracted from
- #1641

and reworked to work standalone

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

## What this PR does


### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[fluxcd] Enable source-watcher
```
kvaps added a commit that referenced this pull request Jan 9, 2026
This change is extracted from
- #1641

and reworked to work standalone

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

## What this PR does


### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[fluxcd] Enable source-watcher
```
kvaps added a commit that referenced this pull request Jan 9, 2026
This change is extracted from
- #1641

and reworked to work standalone

requires:

- #1705


## What this PR does

Adds a new `flux-aio` module and migration script to upgrade FluxCD to
version 22. This introduces a new modular approach to FluxCD
installation using the flux-aio OCI module.

Changes:
- Created new `flux-aio` package with Chart.yaml, Makefile, and CUE
configuration
- Added flux-aio module configuration using OCI module from
`ghcr.io/stefanprodan/modules/flux-aio`
- Generated large fluxcd.yaml template (11956+ lines) for FluxCD
resources
- Added migration script (migrations/21) to handle upgrade from version
21 to 22
- Updated installer to include flux-aio module
- Added script `issue-flux-certificates.sh` for managing TLS
certificates for cozystack-assets
- Updated platform templates to support flux-aio module
- Updated cozystack-assets service references

### Release note

```release-note
[fluxcd] Add flux-aio module and migration
```



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Release Notes

* **New Features**
* Added TLS certificate support for Helm package repositories with
automatic certificate provisioning.

* **Chores**
  * Refactored FluxCD integration using Helm chart-based deployment.
  * Updated system to version 22 with automatic migration support.
  * Enhanced security dependencies (OpenSSL).

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
kvaps added a commit that referenced this pull request Jan 9, 2026
This change is extracted from
- #1641

and reworked to work standalone

## What this PR does

This PR extracts changes from the
#1641. It adds application
metadata labels to HelmReleases and updates the filtering mechanism to
use labels instead of chart/sourceRef matching.

Changes:
- Add three application metadata labels
(`apps.cozystack.io/application.kind`,
`apps.cozystack.io/application.group`,
`apps.cozystack.io/application.name`) when creating/updating HelmRelease
via Cozystack-API
- Replace `shouldIncludeHelmRelease` filtering with label-based
filtering in Get, List, and Update methods
- Always add kind and group label requirements in List for precise
filtering
- Update CozystackResourceDefinitionController to watch only
HelmReleases with `cozystack.io/ui=true` label
- Update LineageControllerWebhook to extract metadata directly from
HelmRelease labels instead of using chart mapping configuration
- Add functionality to update HelmRelease chart from
CozystackResourceDefinition using label selectors

### Release note

```release-note
[registry] Add application labels and update filtering mechanism to use label-based filtering instead of chart/sourceRef matching
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added application metadata labels (kind, group, name) and exported
label keys for HelmRelease identification.
* New reconciler keeps HelmRelease charts in sync with application CRDs.

* **Refactor**
* Mapping, listing and selection moved to label-driven logic;
reconciliation responsibilities split so core reconciler focuses on
restart/debounce while a separate reconciler updates HelmReleases.

* **Chores**
* Migration script to backfill application labels on existing
HelmReleases.

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
kvaps added a commit that referenced this pull request Jan 9, 2026
This change is extracted from
- #1641

and reworked to work standalone

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[cozystack] Update go modules
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

* **Chores**
* Updated Go toolchain to 1.25.0 and upgraded core Kubernetes libraries,
OpenTelemetry, Prometheus, gRPC/protobuf and many indirect dependencies.
Bumped builder base images to golang:1.25-alpine across multiple
components.

* **Refactor**
* Removed legacy component versioning/emulation and simplified server
startup and configuration paths.

* **Tests**
  * Removed tests related to the legacy versioning/emulation behavior.

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
@kvaps
Copy link
Member Author

kvaps commented Jan 15, 2026

closed in favor #1816

@kvaps kvaps closed this Jan 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

do-not-merge enhancement New feature or request size:XXL This PR changes 1000+ lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants