Reviewing files that changed from the base of the PR and between bbeaacc and b92477e.

• cmd/cozystack-controller/main.go
• internal/controller/cozystackresourcedefinition_helmreconciler.go
• internal/controller/system_helm_reconciler.go
• internal/controller/tenant_helm_reconciler.go
• packages/apps/bucket/templates/bucketclaim.yaml
• packages/apps/bucket/templates/helmrelease.yaml
• packages/apps/clickhouse/templates/chkeeper.yaml
• packages/apps/clickhouse/templates/clickhouse.yaml
• packages/apps/ferretdb/templates/postgres.yaml
• packages/apps/foundationdb/templates/cluster.yaml
• packages/apps/kubernetes/templates/cluster.yaml
• packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml
• packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml
• packages/apps/kubernetes/templates/ingress.yaml
• packages/apps/nats/templates/nats.yaml
• packages/apps/postgres/templates/db.yaml
• packages/apps/tenant/templates/etcd.yaml
• packages/apps/tenant/templates/info.yaml
• packages/apps/tenant/templates/ingress.yaml
• packages/apps/tenant/templates/keycloakgroups.yaml
• packages/apps/tenant/templates/monitoring.yaml
• packages/apps/tenant/templates/namespace.yaml
• packages/apps/tenant/templates/seaweedfs.yaml
• packages/apps/virtual-machine/templates/_helpers.tpl
• packages/apps/vm-instance/templates/_helpers.tpl
• packages/apps/vpn/templates/secret.yaml
• packages/core/platform/templates/apps.yaml
• packages/core/platform/templates/helmreleases.yaml
• packages/core/platform/templates/namespaces.yaml
• packages/extra/bootbox/templates/matchbox/ingress.yaml
• packages/extra/bootbox/templates/matchbox/machines.yaml
• packages/extra/etcd/templates/etcd-cluster.yaml
• packages/extra/info/templates/dashboard-resourcemap.yaml
• packages/extra/info/templates/kubeconfig.yaml
• packages/extra/ingress/templates/nginx-ingress.yaml
• packages/extra/monitoring/templates/alerta/alerta-db.yaml
• packages/extra/monitoring/templates/alerta/alerta.yaml
• packages/extra/monitoring/templates/grafana/db.yaml
• packages/extra/monitoring/templates/grafana/grafana.yaml
• packages/extra/seaweedfs/templates/client/cosi-deployment.yaml
• packages/extra/seaweedfs/templates/ingress.yaml
• packages/extra/seaweedfs/templates/seaweedfs.yaml
• packages/library/cozy-lib/templates/_cozyconfig.tpl
• packages/system/bucket/templates/ingress.yaml
• packages/system/cert-manager-issuers/templates/cluster-issuers.yaml
• packages/system/cozystack-api/templates/api-ingress.yaml
• packages/system/dashboard/templates/configmap.yaml
• packages/system/dashboard/templates/gatekeeper.yaml
• packages/system/dashboard/templates/ingress.yaml
• packages/system/dashboard/templates/keycloakclient.yaml
• packages/system/dashboard/templates/nginx-config.yaml
• packages/system/keycloak-configure/templates/configure-kk.yaml
• packages/system/keycloak/templates/db.yaml
• packages/system/keycloak/templates/ingress.yaml
• packages/system/keycloak/templates/sts.yaml
• packages/system/kubevirt-cdi/templates/cdi-uploadproxy-ingress.yaml
• packages/system/kubevirt/templates/vm-exportproxy-ingress.yaml
• packages/tests/cozy-lib-tests/tests/quota_values.yaml
• pkg/registry/apps/application/rest.go

• cmd/cozystack-controller/main.go
• internal/controller/tenant_helm_reconciler.go
• internal/controller/system_helm_reconciler.go

packages/extra/ingress/templates/nginx-ingress.yaml (3)

1-2: LGTM! Values sourcing migrated correctly.

The migration from ConfigMap lookup to .Values._cluster is implemented correctly with sensible defaults ("tenant-root" and "").

---

1-1: Static analysis false positive - safely ignore.

YAMLlint reports a syntax error because it doesn't understand Helm template syntax. The {{- delimiter is valid Helm templating and will render correctly.

---

26-34: Code structure is correct and follows established patterns; no issues found.

The valuesFrom configuration correctly references the cozystack-values Secret with both required keys. This hard dependency is expected and by design—the Secret is created in the platform chart (packages/core/platform/templates/apps.yaml) before tenant charts reconcile. The same pattern is used consistently across other charts like seaweedfs. Since this is a custom chart (not a vendored upstream chart), it can be edited directly.

packages/system/dashboard/templates/keycloakclient.yaml (1)

1-2: This review comment is incorrect. The code is correct as written.

The root-host value is intentionally required without a default. The platform chart explicitly validates its presence in the cozystack ConfigMap with a fail statement before any charts are deployed. The absence of a default in line 1 is correct and consistent with all other templates that use root-host across the codebase (dashboard, keycloak, kubevirt, etc.). The extra-keycloak-redirect-uri-for-dashboard on line 2 appropriately has a default because it is genuinely optional, unlike root-host which is mandatory cluster configuration.

Likely an incorrect or invalid review comment.

packages/system/keycloak/templates/sts.yaml (1)

4-8: Password persistence lookup is intentional; verify it aligns with the system's secret management approach.

This lookup for password persistence across upgrades differs from the configuration migration being addressed in the PR. The pattern is used consistently in other custom templates (keycloak-configure, bucket, dashboard) to manage stateful secrets. Confirm whether the current lookup-based approach for credentials remains the preferred pattern, or if credentials should eventually be managed via external operators or dedicated Secrets referenced through valuesFrom.

packages/apps/tenant/templates/keycloakgroups.yaml (2)

2-53: LGTM: Proper conditional gating for KeycloakRealmGroup resources.

The double-conditional pattern correctly gates resource creation behind both the feature flag (oidc-enabled) and API availability check. This ensures the resources are only created when OIDC is enabled and the KeycloakRealmGroup CRD is installed.

---

1-1: The valuesFrom configuration is properly set up.

The HelmRelease in packages/core/platform/templates/apps.yaml correctly references the cozystack-values Secret with valuesKey: _cluster and targetPath: _cluster with optional: false. This ensures .Values._cluster is populated at deployment time, making the index .Values._cluster "oidc-enabled" usage on line 1 safe and correct.

packages/extra/etcd/templates/etcd-cluster.yaml (1)

52-69: Pattern is safe and consistent across the codebase.

The truthy check on .Values._cluster.scheduling before using the get function adequately protects against type issues. This pattern is consistently used across 8 different templates (etcd, grafana, alerta, keycloak, ferretdb, kubernetes, postgres) and relies on Flux's validated data parsing from the cozystack-values Secret. The fallback logic provides safe defaults when constraints are not present, making this implementation robust.

packages/system/cert-manager-issuers/templates/cluster-issuers.yaml (1)

1-1: Migration from ConfigMap lookup to values-based configuration is correct.

The change properly replaces the ConfigMap lookup with .Values._cluster.clusterissuer access and an appropriate "http01" default. The HelmRelease for cert-manager-issuers is automatically generated with the correct valuesFrom configuration (referencing Secret/cozystack-values for the _cluster namespace values), as shown in the platform's helmreleases.yaml template. This aligns with the PR's objective to use FluxCD valuesFrom mechanism.

packages/extra/bootbox/templates/matchbox/machines.yaml (2)

40-40: LGTM: Boot URL construction with user override capability.

The dual-source pattern allows users to override the host via .Values.host while falling back to the namespace default (.Values._namespace.host). This provides good flexibility for customization while maintaining sensible defaults from the new valuesFrom architecture.

---

1-1: No action required—.Values._namespace.host is properly guaranteed to be populated.

Bootbox deploys to the tenant-root namespace, where the cozystack-values Secret is created with _namespace.host set to the cluster's root hostname (determined from cluster config or tenant-root HelmRelease values, with fallback to "example.org"). The dual-source pattern on line 39 ($.Values.host | default $host) correctly allows user override while falling back to the namespace-provided value.

The YAMLlint syntax error is a false positive—Helm template syntax is valid.

packages/apps/clickhouse/templates/clickhouse.yaml (1)

1-1: LGTM! Clean migration to values-based configuration.

The replacement of ConfigMap lookup with .Values._cluster "cluster-domain" aligns with the PR's architecture of using FluxCD valuesFrom for configuration propagation. The default value is preserved.

packages/apps/vm-instance/templates/_helpers.tpl (1)

77-78: LGTM! Consistent with the valuesFrom pattern.

The migration from ConfigMap lookup to .Values._cluster.scheduling follows the PR's architectural goal. The Windows VM affinity logic remains intact.

packages/extra/seaweedfs/templates/ingress.yaml (1)

1-2: LGTM! Values-based configuration properly implemented.

Replacing Namespace annotation lookups with .Values._namespace.ingress and .Values._namespace.host is consistent with the PR's approach to eliminate runtime lookups in favor of value propagation.

packages/extra/monitoring/templates/alerta/alerta.yaml (1)

1-3: LGTM! Configuration migration correctly implemented.

The transition from ConfigMap/Namespace lookups to .Values._cluster and .Values._namespace follows the PR's pattern. Default values are preserved, and the variables are used consistently throughout the template.

packages/apps/kubernetes/templates/ingress.yaml (1)

1-1: LGTM! Clean refactor to values-based ingress configuration.

Replacing the Namespace annotation lookup with .Values._namespace.ingress is consistent with the PR's architecture to propagate configuration via FluxCD valuesFrom rather than runtime lookups.

packages/apps/postgres/templates/db.yaml (1)

49-57: LGTM: Proper nil-safety for optional scheduling configuration.

The nested conditional checks ensure safe access to optional topology spread constraints. The pattern correctly handles cases where .Values._cluster.scheduling or globalAppTopologySpreadConstraints may be absent, preventing template rendering failures.

packages/extra/monitoring/templates/grafana/db.yaml (1)

9-17: LGTM: Proper nil-safety for optional scheduling configuration.

The implementation correctly mirrors the pattern in postgres/templates/db.yaml with nested conditionals ensuring safe access to optional topology spread constraints.

Note: The YAMLlint syntax error on line 10 is a false positive—the tool doesn't recognize Helm templating directives.

packages/system/bucket/templates/ingress.yaml (1)

1-3: HelmRelease properly configured with valuesFrom—verify cozystack-values Secret contains required _namespace values.

The template depends on .Values._namespace.host and .Values._namespace.ingress without fallback defaults. The HelmRelease correctly pulls these from the cozystack-values Secret via valuesFrom (lines 24-32 in packages/apps/bucket/templates/helmrelease.yaml), but deployment will fail if the Secret is missing or lacks the _namespace key with host and ingress fields. Ensure the Secret populates these values when provisioning tenant environments.

packages/system/kubevirt/templates/vm-exportproxy-ingress.yaml (1)

1-3: Verify that .Values._cluster.root-host is populated.

The host variable (line 1) has no default value and is required if the Ingress is rendered (when vm-exportproxy is in expose-services). If .Values._cluster is missing root-host, the template will fail at line 17.

The conditional rendering at line 5 provides some protection, but it's still important to ensure the Secret is properly configured. Use the same verification as the keycloak ingress review above to confirm that _cluster.root-host is present in the cozystack-values Secret.

packages/apps/ferretdb/templates/postgres.yaml (1)

53-61: LGTM! Proper defensive nil checking.

The topology spread constraints logic correctly implements the migration pattern with multiple levels of safety:

1. Line 53 checks if .Values._cluster.scheduling exists
2. Line 54 uses get which safely returns nil for missing keys
3. Line 55 validates that constraints data is present

This ensures the template won't fail even if the Secret is missing scheduling configuration.

packages/system/keycloak/templates/ingress.yaml (1)

1-3: Upstream validation ensures .Values._cluster.root-host is populated.

The host variable (line 1) has no default value, but this is by design—the platform bundles (paas-hosted.yaml and paas-full.yaml) validate that root-host exists in the cozystack ConfigMap before rendering any system charts. The cozystack-values Secret is created from that ConfigMap, ensuring the required keys are present. All system templates in the packages follow this same pattern of relying on upstream platform-level validation.

packages/apps/virtual-machine/templates/_helpers.tpl (1)

77-78: Verify that .Values._cluster.scheduling is populated by valuesFrom — Confirmed.

The migration from ConfigMap lookup to Helm values is correctly implemented with defensive nil checking. The cozystack-values Secret includes the _cluster.scheduling data sourced from the cozystack-scheduling ConfigMap, and HelmRelease configurations properly reference this Secret via valuesFrom with valuesKey: _cluster and targetPath: _cluster. The code safely handles optional keys using the get() function.

packages/system/cozystack-api/templates/api-ingress.yaml (1)

1-3: LGTM!

The migration from ConfigMap lookup to .Values._cluster access is correctly implemented with appropriate defaults. The static analysis YAML syntax error on line 1 is a false positive—Helm template directives ({{-) are valid syntax for .tpl files processed by Helm.

packages/extra/bootbox/templates/matchbox/ingress.yaml (1)

1-3: LGTM with a minor consideration.

The migration to .Values._cluster and .Values._namespace is correctly implemented. Note that if .Values._namespace is not populated (e.g., the Secret is missing or valuesFrom fails), accessing .ingress and .host will return nil. This is acceptable since the HelmRelease controller validates valuesFrom configuration, and missing secrets would surface as reconciliation errors before template rendering.

packages/extra/seaweedfs/templates/seaweedfs.yaml (2)

37-38: LGTM!

The migration from Namespace annotation lookups to .Values._namespace.ingress and .Values._namespace.host is consistent with the PR's migration pattern.

---

62-70: LGTM!

The valuesFrom block correctly references the cozystack-values Secret for both _cluster and _namespace data. This follows the standardized pattern established across the PR for injecting configuration into HelmReleases.

packages/extra/seaweedfs/templates/client/cosi-deployment.yaml (1)

1-2: LGTM!

The migration to .Values._namespace.host is consistent with the PR pattern. Since this template renders a Deployment (not a HelmRelease), ensure that the parent chart's values.yaml or the HelmRelease deploying this chart includes the valuesFrom configuration to populate _namespace.

packages/library/cozy-lib/templates/_cozyconfig.tpl (3)

10-52: LGTM!

The cluster-wide configuration helpers are well-documented and provide consistent access patterns with sensible defaults. Using index for hyphenated keys (e.g., "root-host") is the correct approach in Helm templates.

---

85-119: LGTM!

The namespace-specific helpers follow the same consistent pattern as the cluster-wide helpers, with appropriate defaults for missing values.

---

121-129: LGTM!

The legacy helper is appropriately maintained for backward compatibility during migration. The deprecation note in the comment is helpful for future cleanup.

packages/apps/tenant/templates/info.yaml (1)

33-41: LGTM!

The valuesFrom configuration follows the standardized pattern for injecting _cluster and _namespace values from the cozystack-values Secret. This is consistent with other tenant templates and HelmReleases across the PR.

packages/tests/cozy-lib-tests/tests/quota_values.yaml (1)

6-8: LGTM!

Adding empty _cluster and _namespace mappings ensures the cozy-lib helper tests can execute without nil-reference errors when accessing .Values._cluster or .Values._namespace.

packages/apps/bucket/templates/helmrelease.yaml (1)

24-32: LGTM: Consistent valuesFrom implementation.

The valuesFrom block follows the same correct pattern as other templates, sourcing _cluster and _namespace from Secret cozystack-values.

packages/apps/tenant/templates/ingress.yaml (1)

34-42: LGTM: Consistent valuesFrom implementation.

The valuesFrom configuration correctly follows the established pattern.

packages/apps/tenant/templates/seaweedfs.yaml (1)

34-42: LGTM: Consistent valuesFrom implementation.

The valuesFrom configuration is correctly implemented.

packages/apps/tenant/templates/etcd.yaml (1)

34-42: valuesFrom configuration correctly implemented.

The valuesFrom block correctly references the cozystack-values Secret from packages/apps/tenant/templates/namespace.yaml, which defines both required keys (_cluster and _namespace) for each tenant namespace. The Helm Chart umbrella pattern with vendored charts (cozy-lib symlink) is properly followed, and the external chart reference to cozystack-extra is appropriately configured.

Ensure that the Secret cozystack-values exists in the tenant namespace and contains the required _cluster and _namespace keys before this HelmRelease reconciles.

packages/apps/foundationdb/templates/cluster.yaml (1)

1-1: Verify HelmRelease valuesFrom configuration for foundationdb.

The template correctly reads cluster-domain from .Values._cluster with a fallback to "cozy.local". However, the CozystackResourceDefinition for foundationdb does not explicitly show valuesFrom injection of the _cluster secret (unlike direct HelmRelease templates used by other apps). Confirm that the resource definition reconciler automatically injects valuesFrom to populate _cluster from Secret cozystack-values.

packages/extra/info/templates/dashboard-resourcemap.yaml (1)

1-1: LGTM!

The migration from ConfigMap lookup to .Values._cluster["oidc-enabled"] is correct and aligns with the PR's objective to replace lookups with valuesFrom-driven configuration. The YAMLlint error is a false positive—Helm template syntax is valid here.

packages/core/platform/templates/helmreleases.yaml (1)

86-94: LGTM!

The valuesFrom configuration correctly references the cozystack-values Secret with separate entries for _cluster and _namespace. This aligns with the FluxCD valuesFrom specification and the PR's migration pattern.

packages/system/dashboard/templates/gatekeeper.yaml (1)

1-2: LGTM!

The migration from ConfigMap lookup to .Values._cluster["root-host"] and .Values._cluster["oidc-enabled"] is correct. The YAMLlint syntax error is a false positive for Helm templates.

packages/extra/monitoring/templates/alerta/alerta-db.yaml (1)

8-16: LGTM!

The defensive nil-check pattern with nested conditionals is correct—first verifying .Values._cluster.scheduling exists before accessing globalAppTopologySpreadConstraints. The YAMLlint error is a false positive for Helm template syntax.

packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml (1)

1-1: LGTM!

The migration from Namespace annotation lookup to .Values._namespace.monitoring is correct. The YAMLlint syntax error is a false positive.

Consider verifying that the cozystack-values Secret always populates the monitoring key under _namespace for namespaces where this HelmRelease is deployed, to avoid empty $targetTenant values in service URLs.

packages/apps/tenant/templates/monitoring.yaml (1)

34-42: LGTM!

The valuesFrom configuration correctly injects _cluster and _namespace from the cozystack-values Secret, consistent with the pattern used across other HelmRelease templates in this PR.

packages/apps/vpn/templates/secret.yaml (1)

1-1: LGTM!

The migration from Namespace annotation lookup to .Values._namespace.host is correct and consistent with the PR pattern. The YAMLlint syntax error is a false positive.

packages/core/platform/templates/namespaces.yaml (2)

2-3: LGTM: ConfigMap lookups appropriate for platform chart.

The addition of branding and scheduling ConfigMap lookups is correct here. The platform chart aggregates configuration from multiple ConfigMaps into the cozystack-values Secret, which downstream charts consume via valuesFrom.

---

42-62: LGTM: Secret structure correctly aggregates cluster configuration.

The cozystack-values Secret properly aggregates configuration from multiple ConfigMaps into a single _cluster key. The indentation levels ensure branding and scheduling are merged at the correct level with the base configuration data.

The Flux watch label ensures the Secret is monitored for changes.

packages/apps/clickhouse/templates/chkeeper.yaml (1)

1-1: LGTM: Clean migration with appropriate default.

The migration from ConfigMap lookup to .Values._cluster with a sensible default value of "cozy.local" is correct and consistent with the PR's objective.

packages/system/keycloak/templates/db.yaml (1)

9-17: LGTM: Correct migration of scheduling constraints.

The migration from ConfigMap-based constraint retrieval to .Values._cluster.scheduling is correct. The get function safely extracts the globalAppTopologySpreadConstraints key from the scheduling map.

The static analysis error on line 10 is a false positive—yamllint doesn't recognize Helm template syntax. The template logic is sound: it checks for the existence of .Values._cluster.scheduling before attempting to extract constraints, preventing nil reference errors.

packages/system/dashboard/templates/ingress.yaml (1)

1-4: No action needed. The root-host value is guaranteed to be present in the cozystack ConfigMap by upstream platform validation. The platform bundles explicitly fail deployment with the error "ERROR need root-host in cozystack ConfigMap" if this value is missing. Multiple other system packages follow the same pattern without local defaults, which is consistent with the Helm Chart umbrella pattern used in this codebase where values are injected and validated at the platform level, not locally. Adding a default value would be unnecessary and inconsistent with the established architectural pattern.

packages/system/dashboard/templates/configmap.yaml (1)

1-1: LGTM on the migration to values-based branding config.

The pattern correctly sources branding from .Values._cluster.branding with a fallback to an empty dict, aligning with the PR's objective to replace ConfigMap lookups with valuesFrom-injected values.

packages/extra/info/templates/kubeconfig.yaml (1)

1-9: LGTM on the migration to values-based configuration.

The template correctly migrates:

• Host resolution from namespace values with fallback to cluster config
• API server and management kubeconfig endpoints from cluster values
• The conditional override logic for managementKubeconfigEndpoint is preserved

internal/controller/cozystackresourcedefinition_helmreconciler.go (2)

100-118: LGTM on expectedValuesFrom helper.

The function correctly defines the expected ValuesFrom configuration that aligns with the PR's architecture: sourcing _namespace and _cluster from the cozystack-values Secret.

---

194-200: LGTM on valuesFrom synchronization logic.

The logic correctly checks and updates the HelmRelease's ValuesFrom to match the expected configuration, ensuring consistency across all managed HelmReleases.

packages/apps/kubernetes/templates/cluster.yaml (2)

1-3: LGTM on namespace values extraction.

The template correctly sources etcd, ingress, and host from .Values._namespace, aligning with the PR's valuesFrom-based configuration approach.

---

33-41: No issue found with .Values context inside the define block.

The concern about context is unfounded. At line 251, $context := deepCopy $ copies the entire root context including .Values at the root template level. This context is then passed to the kubevirtmachinetemplate define block at line 254. Inside the define block, .Values._cluster.scheduling correctly accesses the root values through the passed context.

Likely an incorrect or invalid review comment.

packages/apps/nats/templates/nats.yaml (2)

55-63: LGTM on valuesFrom configuration.

The HelmRelease correctly references the cozystack-values Secret to inject _cluster and _namespace values, following the consistent pattern established across the PR.

---

1-1: LGTM on cluster-domain sourcing.

The template correctly sources cluster-domain from .Values._cluster with a sensible default of cozy.local.

pkg/registry/apps/application/rest.go (4)

885-900: Only top-level keys are validated.

validateNoInternalKeys only checks top-level keys in the JSON object. If users provide nested structures like {"foo": {"_internal": "value"}}, this would pass validation. Is this intentional, or should validation be recursive?

If recursive validation is needed:

🔎 Recursive validation approach

 // validateNoInternalKeys checks that values don't contain keys starting with "_"
 func validateNoInternalKeys(values *apiextv1.JSON) error {
 	if values == nil || len(values.Raw) == 0 {
 		return nil
 	}
 	var data map[string]interface{}
 	if err := json.Unmarshal(values.Raw, &data); err != nil {
 		return err
 	}
-	for key := range data {
-		if strings.HasPrefix(key, "_") {
-			return fmt.Errorf("values key %q is reserved (keys starting with '_' are not allowed)", key)
-		}
-	}
-	return nil
+	return validateNoInternalKeysRecursive(data, "")
+}
+
+func validateNoInternalKeysRecursive(data map[string]interface{}, path string) error {
+	for key, value := range data {
+		fullPath := key
+		if path != "" {
+			fullPath = path + "." + key
+		}
+		if strings.HasPrefix(key, "_") {
+			return fmt.Errorf("values key %q is reserved (keys starting with '_' are not allowed)", fullPath)
+		}
+		if nested, ok := value.(map[string]interface{}); ok {
+			if err := validateNoInternalKeysRecursive(nested, fullPath); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
 }

---

864-883: Filtering also only applies to top-level keys.

Similar to validation, filterInternalKeys only removes top-level keys starting with _. Nested internal keys would still be included in the response. Ensure this aligns with the intended security model.

---

989-1004: LGTM on ValuesFrom injection.

The HelmRelease conversion correctly adds ValuesFrom references for both _namespace and _cluster from the cozystack-values Secret, ensuring applications receive the required configuration.

---

151-154: LGTM on input validation.

Validation correctly rejects user-provided values containing reserved keys (starting with _) during both Create and Update operations, returning appropriate BadRequest errors.

Also applies to: 450-453

packages/core/platform/templates/apps.yaml (2)

36-61: LGTM on cozystack-values Secret structure.

The Secret correctly aggregates cluster-wide configuration (including branding and scheduling) into _cluster and namespace-specific service references into _namespace, providing a centralized configuration source for HelmReleases.

---

89-99: LGTM on valuesFrom configuration for tenant-root.

The HelmRelease correctly references the cozystack-values Secret with both _namespace and _cluster keys mapped to their respective target paths, enabling the tenant chart to access the injected configuration.

packages/apps/tenant/templates/namespace.yaml (3)

1-5: LGTM - Namespace UID lookup is appropriate here.

This lookup for the existing namespace UID is intentional and different from the ConfigMap/annotation lookups being removed in this PR. The UID is required for ownerReferences and cannot be pre-computed via values.

The YAMLlint syntax error at line 2 is a false positive — this is a Helm template file, and {{- is valid Go template syntax.

---

8-40: Clean value computation logic.

The pattern for computing service references is consistent and handles inheritance correctly:

• Services default to parent namespace values
• When a service is enabled in .Values, it's overridden to use the tenant name
• Host computation properly handles both explicit and derived (subdomain) cases

---

42-69: Network policy labels correctly migrated to computed values.

The namespace labels now use the computed service references ($etcd, $ingress, $monitoring, $seaweedfs, $computedHost) instead of reading from namespace annotations. This aligns with the PR's objective of replacing runtime lookups with pre-computed values.

Reviewing files that changed from the base of the PR and between b92477e and 2e79023.

• cmd/cozystack-controller/main.go
• internal/controller/cozystackresourcedefinition_helmreconciler.go
• internal/controller/system_helm_reconciler.go
• internal/controller/tenant_helm_reconciler.go
• packages/apps/bucket/templates/bucketclaim.yaml
• packages/apps/bucket/templates/helmrelease.yaml
• packages/apps/clickhouse/templates/chkeeper.yaml
• packages/apps/clickhouse/templates/clickhouse.yaml
• packages/apps/ferretdb/templates/postgres.yaml
• packages/apps/foundationdb/templates/cluster.yaml
• packages/apps/kubernetes/templates/cluster.yaml
• packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml
• packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml
• packages/apps/kubernetes/templates/ingress.yaml
• packages/apps/nats/templates/nats.yaml
• packages/apps/postgres/templates/db.yaml
• packages/apps/tenant/templates/etcd.yaml
• packages/apps/tenant/templates/info.yaml
• packages/apps/tenant/templates/ingress.yaml
• packages/apps/tenant/templates/keycloakgroups.yaml
• packages/apps/tenant/templates/monitoring.yaml
• packages/apps/tenant/templates/namespace.yaml
• packages/apps/tenant/templates/seaweedfs.yaml
• packages/apps/virtual-machine/templates/_helpers.tpl
• packages/apps/vm-instance/templates/_helpers.tpl
• packages/apps/vpn/templates/secret.yaml
• packages/core/platform/templates/apps.yaml
• packages/core/platform/templates/helmreleases.yaml
• packages/core/platform/templates/namespaces.yaml
• packages/extra/bootbox/templates/matchbox/ingress.yaml
• packages/extra/bootbox/templates/matchbox/machines.yaml
• packages/extra/etcd/templates/etcd-cluster.yaml
• packages/extra/info/templates/dashboard-resourcemap.yaml
• packages/extra/info/templates/kubeconfig.yaml
• packages/extra/ingress/templates/nginx-ingress.yaml
• packages/extra/monitoring/templates/alerta/alerta-db.yaml
• packages/extra/monitoring/templates/alerta/alerta.yaml
• packages/extra/monitoring/templates/grafana/db.yaml
• packages/extra/monitoring/templates/grafana/grafana.yaml
• packages/extra/seaweedfs/templates/client/cosi-deployment.yaml
• packages/extra/seaweedfs/templates/ingress.yaml
• packages/extra/seaweedfs/templates/seaweedfs.yaml
• packages/library/cozy-lib/templates/_cozyconfig.tpl
• packages/system/bucket/templates/ingress.yaml
• packages/system/cert-manager-issuers/templates/cluster-issuers.yaml
• packages/system/cozystack-api/templates/api-ingress.yaml
• packages/system/dashboard/templates/configmap.yaml
• packages/system/dashboard/templates/gatekeeper.yaml
• packages/system/dashboard/templates/ingress.yaml
• packages/system/dashboard/templates/keycloakclient.yaml
• packages/system/dashboard/templates/nginx-config.yaml
• packages/system/keycloak-configure/templates/configure-kk.yaml
• packages/system/keycloak/templates/db.yaml
• packages/system/keycloak/templates/ingress.yaml
• packages/system/keycloak/templates/sts.yaml
• packages/system/kubevirt-cdi/templates/cdi-uploadproxy-ingress.yaml
• packages/system/kubevirt/templates/vm-exportproxy-ingress.yaml
• packages/tests/cozy-lib-tests/tests/quota_values.yaml
• pkg/registry/apps/application/rest.go

• cmd/cozystack-controller/main.go
• internal/controller/system_helm_reconciler.go
• internal/controller/tenant_helm_reconciler.go

• packages/core/platform/templates/helmreleases.yaml
• packages/tests/cozy-lib-tests/tests/quota_values.yaml
• packages/apps/virtual-machine/templates/_helpers.tpl
• packages/apps/ferretdb/templates/postgres.yaml
• packages/apps/tenant/templates/info.yaml
• packages/library/cozy-lib/templates/_cozyconfig.tpl
• packages/apps/tenant/templates/etcd.yaml
• packages/extra/seaweedfs/templates/client/cosi-deployment.yaml
• packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml

packages/system/kubevirt-cdi/templates/cdi-uploadproxy-ingress.yaml (1)

1-3: Migration to .Values._cluster looks correct.

The replacement of ConfigMap lookups with .Values._cluster access aligns with the PR's valuesFrom mechanism. The conditional logic and Ingress configuration are appropriate.

Note: The past review comment about adding a default to line 1 for consistency remains pending.

packages/extra/info/templates/dashboard-resourcemap.yaml (1)

1-1: LGTM! Clean migration from lookup to values-based configuration.

The change correctly replaces the ConfigMap lookup with .Values._cluster["oidc-enabled"], aligning with the PR's architecture where cozystack-values Secrets are injected via valuesFrom. The index function properly accesses the hyphenated key, and the downstream conditional logic remains unchanged.

Note: The YAMLlint syntax error is a false positive—Helm template directives ({{-) are not recognized by standard YAML parsers but are valid in .tpl files.

packages/extra/bootbox/templates/matchbox/machines.yaml (2)

1-1: LGTM! Correctly adopts the new valuesFrom pattern.

The assignment of $host from .Values._namespace.host properly implements the new configuration mechanism, replacing the previous lookup-based approach.

---

40-40: Fallback pattern is intentional and consistent across bootbox templates.

The .Values.host | default $host pattern appears in three places across the bootbox templates (machines.yaml:40, ingress.yaml:22, ingress.yaml:25), indicating this is a deliberate design—not an oversight. This pattern allows optional override via top-level .Values.host while maintaining .Values._namespace.host as the default, which aligns with maintaining backward compatibility during standardization.

No changes needed.

packages/apps/tenant/templates/keycloakgroups.yaml (1)

1-1: LGTM: Correctly migrated to valuesFrom pattern.

The use of index .Values._cluster "oidc-enabled" correctly accesses the hyphenated key from the values map. This aligns with the PR's objective to replace ConfigMap lookups with valuesFrom references.

The cozystack-values Secret is created by the tenant chart's namespace.yaml template (lines 78-89) with _cluster data populated from parent chart values. Child HelmReleases within the tenant chart (etcd.yaml, info.yaml, ingress.yaml, monitoring.yaml, seaweedfs.yaml) reference this Secret via valuesFrom. The keycloakgroups.yaml template accesses .Values._cluster directly as part of the tenant chart itself, which is consistent with how other apps in packages/apps/ handle this pattern.

packages/extra/info/templates/kubeconfig.yaml (2)

1-1: LGTM! Host configuration successfully migrated to Helm values.

The migration from ConfigMap lookup to .Values._namespace.host with a fallback to .Values._cluster "root-host" aligns perfectly with the PR's objective of replacing lookup functions with the valuesFrom mechanism.

---

5-6: LGTM! API endpoint configuration successfully migrated to Helm values.

The migration from ConfigMap lookups to .Values._cluster keys for both api-server-endpoint and management-kubeconfig-endpoint is correct and consistent with the PR's architectural changes.

packages/apps/foundationdb/templates/cluster.yaml (1)

1-1: LGTM! Clean migration from ConfigMap lookup to values-based configuration.

The change correctly replaces the ConfigMap lookup with .Values._cluster "cluster-domain" while preserving the default value.

packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml (1)

1-1: LGTM! Correct migration from namespace annotation lookup to values-based configuration.

The change properly replaces the namespace annotation lookup with .Values._namespace.monitoring, aligning with the PR's valuesFrom mechanism.

packages/system/dashboard/templates/gatekeeper.yaml (1)

1-2: LGTM! Clean migration from ConfigMap lookups to values-based configuration.

Both configuration values are correctly migrated from ConfigMap lookups to .Values._cluster references, maintaining the existing conditional logic and URL construction.

packages/system/dashboard/templates/nginx-config.yaml (1)

1-1: LGTM! Clean migration from ConfigMap lookup to values-based configuration.

The change correctly replaces the ConfigMap lookup with .Values._cluster "root-host", maintaining consistency with the broader migration across dashboard templates.

packages/system/bucket/templates/ingress.yaml (1)

3-3: Good use of default value for issuerType.

The default value "http01" for .Values._cluster.clusterissuer ensures the template handles missing configuration gracefully.

packages/extra/monitoring/templates/alerta/alerta-db.yaml (1)

8-16: Well-structured defensive conditional logic.

The nested conditionals properly handle optional scheduling configuration. The template safely skips the topology spread constraints block if .Values._cluster.scheduling is absent or if globalAppTopologySpreadConstraints is not defined.

packages/apps/clickhouse/templates/chkeeper.yaml (1)

1-1: Good use of default value for cluster domain.

The default value "cozy.local" for .Values._cluster["cluster-domain"] ensures the template handles missing configuration gracefully, and the entire template is properly gated by the feature flag on line 3.

packages/extra/etcd/templates/etcd-cluster.yaml (1)

53-54: LGTM! Clean migration from ConfigMap lookup to values-based configuration.

The change correctly replaces ConfigMap-based scheduling constraint lookup with direct access to .Values._cluster.scheduling. The conditional logic and downstream processing remain consistent with the original behavior.

packages/extra/ingress/templates/nginx-ingress.yaml (1)

1-2: LGTM! Proper valuesFrom integration with values-based configuration.

The changes correctly implement the migration pattern:

• Lines 1-2: Extract cluster configuration from .Values._cluster with appropriate defaults
• Lines 26-28: Add valuesFrom to populate .Values._cluster from the cozystack-values Secret

This aligns with the PR's architecture of removing Helm lookups in favor of FluxCD's valuesFrom mechanism.

Also applies to: 26-28

packages/system/cozystack-api/templates/api-ingress.yaml (1)

1-3: LGTM! Correct migration to values-based cluster configuration.

The changes properly extract cluster configuration from .Values._cluster with appropriate defaults for expose-services and expose-ingress. The root-host value is used unconditionally (line 18), which assumes it will be provided by the parent HelmRelease's valuesFrom configuration.

packages/apps/postgres/templates/db.yaml (1)

49-50: LGTM! Consistent migration pattern for scheduling constraints.

The change correctly replaces ConfigMap-based lookup with .Values._cluster.scheduling access, matching the pattern used in other application templates (e.g., etcd). The conditional check ensures safe access to the nested scheduling configuration.

packages/apps/kubernetes/templates/cluster.yaml (2)

1-3: LGTM! Proper migration to namespace-scoped values.

The changes correctly replace Namespace annotation lookups with direct access to .Values._namespace for service references (etcd, ingress, host). These values are used unconditionally throughout the template (e.g., lines 126, 142, 143), which assumes they will be provided by the parent HelmRelease's valuesFrom configuration.

---

33-34: LGTM! Consistent scheduling constraint migration.

The change follows the established pattern for migrating scheduling constraints from ConfigMap lookups to .Values._cluster.scheduling, consistent with similar changes in etcd and postgres templates. The conditional check safely handles cases where scheduling configuration may not be present.

packages/extra/bootbox/templates/matchbox/ingress.yaml (2)

11-13: Conditional annotation logic is correct.

The acme.cert-manager.io/http01-ingress-class annotation is appropriately excluded when using the cloudflare issuer type, as cloudflare uses DNS-01 challenges rather than HTTP-01.

---

1-3: LGTM! Values correctly sourced from Helm values.

The migration from ConfigMap lookups to .Values._cluster and .Values._namespace is correct and aligns with the PR's architecture. The default value for issuerType ("http01") provides a sensible fallback. The cozystack-values Secret properly populates these paths via the tenant namespace template.

packages/system/kubevirt/templates/vm-exportproxy-ingress.yaml (1)

1-5: LGTM! Correct migration to values-based configuration.

The replacement of ConfigMap lookups with .Values._cluster access is correct. The splitList usage properly handles comma-separated values from expose-services, and the conditional logic using has is the appropriate Helm function for checking list membership.

internal/controller/cozystackresourcedefinition_helmreconciler.go (3)

110-125: LGTM! Comprehensive equality check.

The valuesFromEqual() function correctly compares all fields of ValuesReference and optimizes by checking length first. The field-by-field comparison ensures accurate detection of differences.

---

184-190: LGTM! ValuesFrom synchronization correctly integrated.

The ValuesFrom synchronization logic properly:

• Computes expected configuration via expectedValuesFrom()
• Compares with current state using valuesFromEqual()
• Updates when needed and sets the updated flag
• Logs the update action at appropriate verbosity level

This integrates cleanly with the existing chart update flow.

---

100-108: No changes needed - ValuesReference configuration is correct and intentional.

The cozystack-values Secret consistently uses a single values.yaml key across all namespaces (verified in packages/core/platform/templates/ and packages/apps/tenant/templates/). The ValuesReference configuration correctly omits valuesKey and targetPath, which allows Flux to merge the entire Secret data at the root level of .Values as intended. This pattern is uniform across all HelmReleases in the codebase, confirming the design is deliberate.

packages/apps/bucket/templates/helmrelease.yaml (1)

24-26: LGTM! ValuesFrom correctly configured.

The addition of the valuesFrom block referencing the cozystack-values Secret aligns with the PR's architecture and matches the expected configuration enforced by the controller (see expectedValuesFrom() in cozystackresourcedefinition_helmreconciler.go).

packages/apps/tenant/templates/seaweedfs.yaml (1)

34-36: LGTM! Consistent valuesFrom configuration.

The valuesFrom block correctly references the cozystack-values Secret, consistent with the pattern applied across all HelmReleases in this PR.

packages/apps/tenant/templates/ingress.yaml (1)

34-36: LGTM! Clean migration to valuesFrom mechanism.

The addition of the valuesFrom block correctly references the cozystack-values Secret, enabling FluxCD to inject cluster and namespace configuration into the HelmRelease. This aligns with the PR's objective to replace Helm lookups with the valuesFrom mechanism.

packages/system/cert-manager-issuers/templates/cluster-issuers.yaml (1)

1-1: LGTM! Correct migration to values-based configuration.

The migration from ConfigMap lookup to .Values._cluster["clusterissuer"] with a default of "http01" is correct and aligns with the PR's objective to move configuration from runtime lookups to Helm values.

Note: The YAMLlint syntax error is a false positive—{{- is valid Helm template syntax.

packages/apps/tenant/templates/monitoring.yaml (1)

34-36: LGTM! Consistent valuesFrom implementation.

The addition of the valuesFrom block correctly references the cozystack-values Secret, maintaining consistency with other HelmRelease templates in this PR. This enables proper injection of cluster and namespace configuration.

packages/apps/vpn/templates/secret.yaml (1)

1-1: LGTM!

The migration from namespace annotation lookup to .Values._namespace.host is clean and aligns with the PR's objective to use FluxCD valuesFrom mechanism.

packages/system/keycloak-configure/templates/configure-kk.yaml (2)

1-2: LGTM!

The migration from ConfigMap lookups to .Values._cluster for host and redirect URIs is clean and follows the PR's valuesFrom pattern consistently.

---

9-21: The branding data structure is correct as implemented.

Verification confirms that .Values._cluster.branding is indeed a map containing a branding key, along with other fields like tenantText, footerText, titleText, logoText, logoSvg, and iconSvg. The code at line 20 ({{- $branding = $brandingConfig.branding }}) correctly accesses this nested field. The cozystack-branding ConfigMap data is injected into _cluster.branding via the platform chart, and each consumer (keycloak-configure and dashboard) accesses the appropriate fields for their needs.

packages/system/dashboard/templates/ingress.yaml (1)

1-4: LGTM!

The migration from ConfigMap lookups to .Values._cluster is clean and maintains the same default values. This aligns perfectly with the PR's objective to use FluxCD valuesFrom mechanism.

packages/extra/monitoring/templates/alerta/alerta.yaml (1)

1-3: LGTM!

The migration appropriately uses .Values._cluster for cluster-wide configuration (issuerType) and .Values._namespace for namespace-specific configuration (ingress, host). This follows the architecture described in the PR objectives.

packages/extra/monitoring/templates/grafana/db.yaml (1)

9-10: LGTM!

The migration from ConfigMap lookup to .Values._cluster.scheduling is clean and uses the get function appropriately to safely extract the nested globalAppTopologySpreadConstraints key.

packages/system/keycloak/templates/db.yaml (1)

9-17: LGTM! Proper defensive access to scheduling constraints.

The migration correctly checks for the existence of .Values._cluster.scheduling before attempting to access globalAppTopologySpreadConstraints. The use of the get function and conditional rendering ensures the template won't fail if the scheduling configuration is absent from the Secret.

packages/system/dashboard/templates/configmap.yaml (1)

1-1: LGTM! Safe migration with proper defaults at multiple levels.

The migration correctly uses a two-tier default strategy:

1. Line 1 defaults to an empty dict if .Values._cluster.branding is missing
2. Lines 19-24 provide field-level defaults using the existing fallback variables

This ensures the ConfigMap will render successfully even if the cozystack-values Secret doesn't contain branding configuration.

Also applies to: 19-24

packages/extra/seaweedfs/templates/seaweedfs.yaml (1)

62-64: LGTM! Correct addition of valuesFrom mechanism.

The valuesFrom block correctly references the cozystack-values Secret, aligning with the PR's objective to replace Helm lookup functions with FluxCD's valuesFrom mechanism.

packages/core/platform/templates/namespaces.yaml (2)

5-17: LGTM!

The cluster defaults dictionary provides sensible fallback values ensuring all required keys exist before merging with actual ConfigMap data. This prevents nil reference issues downstream.

---

55-75: LGTM!

The Secret cozystack-values is correctly structured with:

• Proper namespace scoping
• reconcile.fluxcd.io/watch: Enabled label for FluxCD integration
• YAML structure with _cluster containing merged config plus optional branding/scheduling

pkg/registry/apps/application/rest.go (6)

151-154: LGTM!

Validation for reserved _-prefixed keys is correctly placed before the conversion to HelmRelease, returning a BadRequest error with a clear message.

---

450-453: LGTM!

Consistent validation in the Update path, matching the Create path behavior.

---

864-883: Top-level only filtering is consistent with validation.

The function correctly removes _-prefixed keys from the top level only. This matches the validation logic and the documented behavior that _cluster and _namespace are injected at the top level via valuesFrom.

---

885-900: LGTM!

The validation function correctly identifies reserved keys and provides a clear, actionable error message including the offending key name.

---

904-922: LGTM!

The filtered spec is correctly applied to strip internal keys when converting HelmRelease to Application, ensuring users don't see injected system values.

---

989-994: LGTM!

The ValuesFrom block correctly references the cozystack-values Secret. This ensures HelmReleases created via the API will automatically receive the namespace-scoped configuration. The Secret name is consistently used across all platform templates in the codebase.

packages/apps/nats/templates/nats.yaml (2)

1-1: LGTM!

The migration from ConfigMap lookup to .Values._cluster with a sensible default (cozy.local) is correct. The YAMLlint error is a false positive - this is valid Helm template syntax that will be rendered to proper YAML.

---

55-57: LGTM!

The valuesFrom block correctly references the cozystack-values Secret, enabling the HelmRelease to receive _cluster and _namespace values automatically.

packages/core/platform/templates/apps.yaml (2)

49-74: LGTM!

The Secret structure correctly includes both _cluster and _namespace sections with the tenant-root specific values hardcoded appropriately.

---

103-105: LGTM!

The valuesFrom block is correctly added to the tenant-root HelmRelease, enabling it to receive configuration from the cozystack-values Secret.

packages/apps/tenant/templates/namespace.yaml (3)

8-40: LGTM!

The computed values pattern is well-structured:

• Values are computed once and reused in both Namespace labels and Secret
• Parent namespace values are correctly inherited with | default ""
• Service references (etcd, ingress, etc.) are overridden to tenant name when the tenant enables them

This is a clean refactoring that improves maintainability.

---

55-60: LGTM!

The labels correctly use the computed values for network policy references, ensuring consistency between Namespace labels and the Secret's _namespace content.

---

70-89: LGTM!

The cozystack-values Secret for tenant namespaces:

• Correctly inherits _cluster from parent via .Values._cluster
• Populates _namespace with the computed service references
• Is created inside the conditional block (only for non-root tenants)

The static analysis error on line 2 is a false positive - this is valid Helm template syntax.

Reviewing files that changed from the base of the PR and between 2e79023 and 2e61810.

• cmd/cozystack-controller/main.go
• internal/controller/cozystackresourcedefinition_helmreconciler.go
• internal/controller/system_helm_reconciler.go
• internal/controller/tenant_helm_reconciler.go
• packages/apps/bucket/templates/bucketclaim.yaml
• packages/apps/bucket/templates/helmrelease.yaml
• packages/apps/clickhouse/templates/chkeeper.yaml
• packages/apps/clickhouse/templates/clickhouse.yaml
• packages/apps/ferretdb/templates/postgres.yaml
• packages/apps/foundationdb/templates/cluster.yaml
• packages/apps/kubernetes/templates/cluster.yaml
• packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml
• packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml
• packages/apps/kubernetes/templates/ingress.yaml
• packages/apps/nats/templates/nats.yaml
• packages/apps/postgres/templates/db.yaml
• packages/apps/tenant/templates/etcd.yaml
• packages/apps/tenant/templates/info.yaml
• packages/apps/tenant/templates/ingress.yaml
• packages/apps/tenant/templates/keycloakgroups.yaml
• packages/apps/tenant/templates/monitoring.yaml
• packages/apps/tenant/templates/namespace.yaml
• packages/apps/tenant/templates/seaweedfs.yaml
• packages/apps/virtual-machine/templates/_helpers.tpl
• packages/apps/vm-instance/templates/_helpers.tpl
• packages/apps/vpn/templates/secret.yaml
• packages/core/platform/templates/apps.yaml
• packages/core/platform/templates/helmreleases.yaml
• packages/core/platform/templates/namespaces.yaml
• packages/extra/bootbox/templates/matchbox/ingress.yaml
• packages/extra/bootbox/templates/matchbox/machines.yaml
• packages/extra/etcd/templates/etcd-cluster.yaml
• packages/extra/info/templates/dashboard-resourcemap.yaml
• packages/extra/info/templates/kubeconfig.yaml
• packages/extra/ingress/templates/nginx-ingress.yaml
• packages/extra/monitoring/templates/alerta/alerta-db.yaml
• packages/extra/monitoring/templates/alerta/alerta.yaml
• packages/extra/monitoring/templates/grafana/db.yaml
• packages/extra/monitoring/templates/grafana/grafana.yaml
• packages/extra/seaweedfs/templates/client/cosi-deployment.yaml
• packages/extra/seaweedfs/templates/ingress.yaml
• packages/extra/seaweedfs/templates/seaweedfs.yaml
• packages/library/cozy-lib/templates/_cozyconfig.tpl
• packages/system/bucket/templates/ingress.yaml
• packages/system/cert-manager-issuers/templates/cluster-issuers.yaml
• packages/system/cozystack-api/templates/api-ingress.yaml
• packages/system/dashboard/templates/configmap.yaml
• packages/system/dashboard/templates/gatekeeper.yaml
• packages/system/dashboard/templates/ingress.yaml
• packages/system/dashboard/templates/keycloakclient.yaml
• packages/system/dashboard/templates/nginx-config.yaml
• packages/system/keycloak-configure/templates/configure-kk.yaml
• packages/system/keycloak/templates/db.yaml
• packages/system/keycloak/templates/ingress.yaml
• packages/system/keycloak/templates/sts.yaml
• packages/system/kubevirt-cdi/templates/cdi-uploadproxy-ingress.yaml
• packages/system/kubevirt/templates/vm-exportproxy-ingress.yaml
• packages/tests/cozy-lib-tests/tests/quota_values.yaml
• pkg/registry/apps/application/rest.go

• cmd/cozystack-controller/main.go
• internal/controller/tenant_helm_reconciler.go
• internal/controller/system_helm_reconciler.go

• internal/controller/cozystackresourcedefinition_helmreconciler.go
• packages/extra/seaweedfs/templates/client/cosi-deployment.yaml
• packages/apps/tenant/templates/info.yaml
• packages/extra/etcd/templates/etcd-cluster.yaml
• packages/tests/cozy-lib-tests/tests/quota_values.yaml
• packages/apps/vm-instance/templates/_helpers.tpl
• packages/apps/tenant/templates/monitoring.yaml
• packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml
• packages/apps/postgres/templates/db.yaml

• GitHub Check: Install Cozystack

packages/system/dashboard/templates/nginx-config.yaml (1)

1-1: Verify valuesFrom configuration and consider adding a default value.

The change correctly implements the PR objective by replacing the Helm lookup with .Values._cluster["root-host"]. However, the template will fail at render time if the key doesn't exist.

Please verify:

1. The HelmRelease for this chart includes a valuesFrom reference to the cozystack-values Secret
2. The Secret's _cluster data contains the root-host key

Optionally, consider adding a default value for robustness:

🔎 Proposed enhancement with default value

-{{- $host := index .Values._cluster "root-host" }}
+{{- $host := index .Values._cluster "root-host" | default "example.com" }}

packages/apps/kubernetes/templates/ingress.yaml (1)

1-1: Verify that .Values._namespace.ingress is always populated.

The change correctly implements the new valuesFrom pattern. However, ensure that the Secret cozystack-values always includes the _namespace.ingress field, as an empty or missing value would result in an invalid ingressClassName at line 18.

Optional: Add defensive validation

If you want to add an extra safety check, consider validating the value exists:

-{{- $ingress := .Values._namespace.ingress }}
+{{- if not .Values._namespace.ingress }}
+{{- fail "Missing required value: .Values._namespace.ingress" }}
+{{- end }}
+{{- $ingress := .Values._namespace.ingress }}

However, if the controller guarantees the Secret structure, this may be unnecessary.

Based on PR architecture, where the controller validates HelmRelease valuesFrom configuration.

packages/apps/tenant/templates/etcd.yaml (1)

34-36: LGTM! Clean integration of valuesFrom mechanism.

The addition of the valuesFrom block correctly references the cozystack-values Secret, enabling the HelmRelease to receive configuration from the centralized Secret as intended by this PR.

packages/extra/seaweedfs/templates/seaweedfs.yaml (1)

62-64: LGTM! Correct valuesFrom integration.

The valuesFrom block properly references the cozystack-values Secret, enabling configuration propagation as intended.

packages/apps/clickhouse/templates/clickhouse.yaml (1)

1-1: LGTM! Clean migration to values-based configuration.

The replacement of ConfigMap lookup with .Values._cluster.cluster-domain includes a sensible default value ("cozy.local"), ensuring the template remains robust if the key is missing.

Note: The YAMLlint syntax error is a false positive caused by Go template directives, which are valid in Helm templates.

packages/apps/foundationdb/templates/cluster.yaml (1)

1-1: LGTM! Proper values-based configuration with fallback.

The migration from ConfigMap lookup to .Values._cluster.cluster-domain includes an appropriate default ("cozy.local"), ensuring the template functions correctly even if the Secret key is absent.

Note: The YAMLlint syntax error is a false positive resulting from Go template syntax.

packages/apps/tenant/templates/seaweedfs.yaml (1)

34-36: LGTM! Correct valuesFrom implementation.

The valuesFrom block correctly integrates the cozystack-values Secret reference, enabling centralized configuration management consistent with the PR's architecture.

packages/system/cert-manager-issuers/templates/cluster-issuers.yaml (1)

1-1: LGTM!

The migration from ConfigMap lookup to .Values._cluster with a sensible default ("http01") is correct and aligns with the PR objectives. The conditional logic for solver selection remains intact.

packages/extra/info/templates/dashboard-resourcemap.yaml (1)

1-1: LGTM!

The migration from ConfigMap to .Values._cluster is correct. The absence of a default for oidc-enabled is appropriate since OIDC is optional, and the conditional logic properly handles both enabled and disabled states.

packages/apps/tenant/templates/keycloakgroups.yaml (1)

1-1: LGTM!

The migration to .Values._cluster is correct. The conditional rendering (line 2) appropriately skips KeycloakRealmGroup resources when OIDC is not enabled, making the absence of a default acceptable.

packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml (1)

1-1: The review comment is incorrect. The _namespace.monitoring value is always populated in the cozystack-values Secret.

When a Kubernetes application is deployed, the kubernetes HelmRelease uses valuesFrom: [{kind: Secret, name: cozystack-values}], which injects the Secret's values into the template context. The Secret definition in packages/core/platform/templates/apps.yaml (lines 73-78) always includes:

_namespace:
  etcd: tenant-root
  monitoring: tenant-root
  ingress: tenant-root
  seaweedfs: tenant-root

Therefore, .Values._namespace.monitoring is guaranteed to be tenant-root, and the URLs will render correctly as http://vminsert-shortterm.tenant-root.svc:8480/insert/0/prometheus and http://vlogs-generic.tenant-root.svc:9428. No default value is needed because the field is always present in the Secret.

packages/apps/ferretdb/templates/postgres.yaml (1)

53-61: LGTM! Defensive coding for optional scheduling constraints.

The conditional logic properly handles the optional .Values._cluster.scheduling configuration. The code checks for existence before accessing nested values and gracefully handles missing constraints, which is the correct approach for optional configuration.

packages/apps/clickhouse/templates/chkeeper.yaml (1)

1-1: LGTM! Proper default value for cluster-domain.

The template correctly provides a default value of "cozy.local" for the cluster domain, ensuring the template renders successfully even if .Values._cluster["cluster-domain"] is not populated in the cozystack-values Secret.

packages/extra/bootbox/templates/matchbox/machines.yaml (1)

1-1: LGTM! Clean migration to values-driven configuration.

The replacement of dynamic ConfigMap/Namespace lookups with .Values._namespace.host aligns with the PR objectives. The fallback pattern $.Values.host | default $host on line 40 provides a proper user override mechanism.

Note: The YAMLlint syntax error is a false positive—this is valid Go template syntax.

Also applies to: 40-40

packages/system/keycloak/templates/db.yaml (1)

9-17: LGTM! Proper guard and safe value access.

The migration from ConfigMap-based lookup to .Values._cluster.scheduling is correct. The conditional guard and get function ensure safe access, and the constraint processing logic remains unchanged.

Note: The YAMLlint syntax error on line 10 is a false positive—this is valid Go template syntax.

packages/apps/virtual-machine/templates/_helpers.tpl (1)

77-103: LGTM! Clean refactor of node affinity configuration.

The migration from ConfigMap lookup to .Values._cluster.scheduling is implemented correctly with proper guards. The Windows VM node affinity logic remains intact, and the use of the get function ensures safe value extraction.

packages/extra/monitoring/templates/alerta/alerta.yaml (1)

1-3: LGTM! Consolidated configuration sources.

The migration consolidates three separate lookups (issuerType, ingress, host) into direct .Values._cluster and .Values._namespace references. The default value for issuerType is appropriate, and the fallback patterns throughout the template (e.g., lines 128, 182, 185) allow proper user overrides.

Note: The YAMLlint syntax error is a false positive—this is valid Go template syntax.

packages/extra/monitoring/templates/grafana/db.yaml (1)

9-17: LGTM! Consistent scheduling configuration migration.

The replacement of ConfigMap-based topology spread constraints with .Values._cluster.scheduling follows the same correct pattern used in other database templates (e.g., keycloak/db.yaml). The guard and safe access ensure robust value handling.

Note: The YAMLlint syntax error on line 10 is a false positive—this is valid Go template syntax.

packages/extra/monitoring/templates/alerta/alerta-db.yaml (1)

8-16: LGTM!

The migration from ConfigMap lookup to .Values._cluster.scheduling is correctly implemented. The nested conditional properly guards against nil values before accessing the globalAppTopologySpreadConstraints key.

Note: The YAMLlint error on line 9 is a false positive—Helm template directives using {{- for whitespace control are valid syntax.

packages/system/cozystack-api/templates/api-ingress.yaml (1)

1-3: LGTM with a note on consistency.

The migration to .Values._cluster is correctly implemented. Lines 2-3 have appropriate defaults, but line 1 for root-host does not. This is acceptable since root-host is a required platform configuration, but for defensive consistency you could add | default "" to line 1 as well.

packages/apps/kubernetes/templates/cluster.yaml (2)

1-3: LGTM!

The migration from namespace annotations to .Values._namespace for etcd, ingress, and host is correctly implemented.

---

33-41: LGTM!

The scheduling constraint logic correctly checks for .Values._cluster.scheduling existence before accessing globalAppTopologySpreadConstraints. This is consistent with the pattern used across other templates in this PR.

packages/system/kubevirt/templates/vm-exportproxy-ingress.yaml (1)

1-3: LGTM!

The migration pattern is consistent with other ingress templates in this PR. The root-host value is appropriately sourced from .Values._cluster.

packages/system/kubevirt-cdi/templates/cdi-uploadproxy-ingress.yaml (1)

1-3: LGTM!

The migration to .Values._cluster is consistent with other ingress templates. The pattern correctly handles optional expose-services and expose-ingress with appropriate defaults.

pkg/registry/apps/application/rest.go (4)

151-154: LGTM!

The validation in Create() correctly rejects values containing reserved keys (starting with _) before proceeding with HelmRelease creation. This prevents users from accidentally overwriting internal configuration injected via valuesFrom.

---

450-453: LGTM!

Consistent validation in Update() path, preventing reserved key injection during updates.

---

904-922: LGTM!

The filtering of internal keys during HelmRelease-to-Application conversion ensures that injected system values (like _cluster and _namespace) are not exposed in the Application spec returned to users.

---

989-994: LGTM with a note on Secret dependency.

The ValuesFrom reference to cozystack-values Secret is correctly added. Since Optional is not set (defaults to false), HelmRelease reconciliation requires the Secret to exist in the target namespace. This is guaranteed by the platform and tenant chart architecture: the platform charts create this Secret in the tenant-root and platform namespaces (via packages/core/platform/templates/namespaces.yaml), while the tenant chart creates it in each tenant namespace (via packages/apps/tenant/templates/namespace.yaml).

packages/core/platform/templates/apps.yaml (4)

2-4: LGTM: ConfigMap lookups for Secret population.

These lookups are appropriate here as the platform chart is responsible for aggregating cluster configuration into the cozystack-values Secret that child charts will consume via valuesFrom.

---

7-19: LGTM: Defensive defaults pattern.

The combination of $clusterDefaults with mergeOverwrite and | default dict ensures all required keys exist with sensible fallback values, preventing template errors from missing configuration.

---

50-78: LGTM: Secret structure aligns with valuesFrom architecture.

The Secret correctly aggregates cluster and namespace configuration into _cluster and _namespace sections that will be consumed by HelmReleases via valuesFrom. The reconcile.fluxcd.io/watch: Enabled label ensures FluxCD watches for changes.

---

107-109: LGTM: Correct valuesFrom implementation.

The valuesFrom block correctly references the cozystack-values Secret, enabling FluxCD to populate .Values._cluster and .Values._namespace in the tenant-root HelmRelease.

packages/library/cozy-lib/templates/_cozyconfig.tpl (5)

1-12: LGTM: Well-documented helper with safe defaults.

The helper correctly uses index for hyphenated keys and | default "" provides a safe fallback when the key is missing or .Values._cluster is nil.

---

18-52: LGTM: Consistent helper pattern across cluster configuration accessors.

All helpers follow the same safe pattern with index for hyphenated keys and empty string defaults.

---

59-74: LGTM: YAML helpers with appropriate existence checks.

The scheduling and branding helpers correctly check for existence before rendering YAML, preventing empty output when these optional configurations are not present.

---

85-119: LGTM: Namespace configuration helpers follow consistent pattern.

The namespace-scoped helpers correctly read from .Values._namespace and provide safe defaults, aligning with the Secret structure defined in the platform chart.

---

125-129: LGTM: Backward compatibility preserved during migration.

The legacy loadCozyConfig helper correctly redirects to .Values._cluster, enabling gradual migration of templates while maintaining compatibility with existing code.

packages/core/platform/templates/helmreleases.yaml (1)

86-88: LGTM: Consistent valuesFrom implementation for system releases.

The valuesFrom block correctly enables all system HelmReleases to consume cluster and namespace configuration from the cozystack-values Secret, consistent with the PR's architectural goals.

packages/extra/seaweedfs/templates/ingress.yaml (1)

1-2: LGTM: Replaced lookups with values-based configuration.

The migration from runtime lookups to .Values._namespace access aligns with the PR's architectural shift to values-driven configuration.

packages/system/dashboard/templates/gatekeeper.yaml (1)

1-2: No action required — dashboard HelmRelease already has valuesFrom configured.

The dashboard chart's reliance on .Values._cluster is properly supported. The dashboard HelmRelease is generated by packages/core/platform/templates/helmreleases.yaml (not located in dashboard templates), and automatically includes valuesFrom: [{kind: Secret, name: cozystack-values}]. The cozystack-values Secret is created in each namespace by packages/core/platform/templates/namespaces.yaml and contains the _cluster configuration.

packages/apps/tenant/templates/ingress.yaml (1)

34-37: LGTM! valuesFrom mechanism correctly implemented.

The addition of the valuesFrom block referencing the cozystack-values Secret aligns with the PR's objective to replace Helm lookup functions with FluxCD valuesFrom for configuration propagation.

packages/apps/bucket/templates/helmrelease.yaml (1)

24-26: LGTM! valuesFrom configuration is correct.

The valuesFrom block is properly configured to source values from the cozystack-values Secret, consistent with the PR's architectural changes.

packages/apps/vpn/templates/secret.yaml (1)

1-1: LGTM! Migration from namespace annotation to values-based lookup.

The change correctly replaces the namespace annotation lookup with .Values._namespace.host, aligning with the PR's shift to values-driven configuration. The usage on line 66 appropriately allows override via .Values.host while falling back to the namespace host.

Note: The YAMLlint syntax error is a false positive—it doesn't recognize Helm template syntax.

packages/extra/ingress/templates/nginx-ingress.yaml (1)

1-2: LGTM! ConfigMap lookup replacement and valuesFrom addition are correct.

The changes successfully migrate from ConfigMap-based lookups to .Values._cluster access with appropriate defaults:

• expose-ingress defaults to "tenant-root"
• expose-external-ips defaults to empty string

The valuesFrom block ensures the cozystack-values Secret populates these values. This aligns perfectly with the PR's architectural shift to values-driven configuration.

Note: The YAMLlint syntax error is a false positive—it doesn't understand Helm template syntax.

Also applies to: 26-28

packages/system/dashboard/templates/ingress.yaml (1)

1-4: LGTM! Clean migration from ConfigMap lookup to values-based configuration.

The migration from runtime ConfigMap lookups to .Values._cluster is correct and maintains the same default values as before. The configuration will now be properly injected via the valuesFrom mechanism.

packages/extra/bootbox/templates/matchbox/ingress.yaml (1)

1-3: LGTM! Proper use of both cluster and namespace values.

The migration correctly uses .Values._cluster for cluster-wide configuration (issuerType) and .Values._namespace for namespace-specific settings (ingress, host). The conditional logic for the cloudflare issuer type is properly preserved.

packages/system/dashboard/templates/configmap.yaml (1)

1-24: LGTM! Clean branding configuration migration.

The migration from ConfigMap-based branding lookup to .Values._cluster.branding is correct. The template properly accesses individual branding fields with appropriate fallbacks to default values.

packages/extra/info/templates/kubeconfig.yaml (2)

1-1: LGTM! Configuration values properly migrated.

The migration of host, API server endpoint, management kubeconfig endpoint, and kube-root-ca from runtime lookups to .Values._cluster and .Values._namespace is correct and complete.

Also applies to: 5-6, 11-11

---

2-2: Clarify architectural intent: Is cross-namespace k8s-client lookup still required?

The k8s-client Secret lookup on line 2 is part of a consistent pattern across the codebase (also used in keycloak-configure and dashboard templates), with no current migration to valuesFrom. However, note that this lookup accesses the secret in the "cozy-keycloak" namespace, while keycloak-configure creates the k8s-client Secret in its own release namespace.

Since force-reconcile controllers are being removed, confirm whether this runtime lookup remains the intended mechanism for accessing the OIDC client credential, or if a values-based approach is now preferred for consistency with other secret handling.

packages/core/platform/templates/namespaces.yaml (1)

5-17: Good use of defaults pattern with mergeOverwrite.

The $clusterDefaults dictionary provides sensible defaults for all required keys, ensuring consuming templates don't fail when optional config values are missing. The mergeOverwrite correctly applies user config on top of defaults.

packages/apps/nats/templates/nats.yaml (2)

1-1: Correctly migrated to Values-based cluster-domain access.

The change from ConfigMap lookup to .Values._cluster["cluster-domain"] aligns with the PR's objective. The default "cozy.local" is consistent with the $clusterDefaults defined in the platform chart.

Note: The YAMLlint error is a false positive — this is a Helm template file where {{- is valid templating syntax, not raw YAML.

---

55-57: valuesFrom correctly references cozystack-values Secret.

The valuesFrom block properly sources values from the namespace-scoped Secret, enabling FluxCD to inject _cluster (and _namespace where applicable) into the HelmRelease values.

packages/apps/tenant/templates/namespace.yaml (2)

8-40: Well-structured computed values for reuse across Namespace and Secret.

The service reference computation correctly inherits from parent namespace and overrides when the tenant explicitly enables a service (e.g., if .Values.etcd). The host derivation logic appropriately extracts the last segment of the tenant name for subdomain construction.

---

55-60: Network policy labels enable cross-namespace access control.

Adding namespace.cozystack.io/* labels allows NetworkPolicies to select namespaces based on their service references (etcd, ingress, monitoring, seaweedfs, host). This is a clean approach for multi-tenant network isolation.