chore(release): promote v1.6.1-rc.1 -> v1.6.1 (#3550)

Promotes `v1.6.1-rc.1` to stable `v1.6.1` — no rebuild. The tree pins the rc's images by digest. On merge, pull-requests-release.yaml creates the write-once `v1.6.1` tag at the merge commit, retags those digests to `v1.6.1` (+`:latest` when this is the newest stable), publishes the stable cozy-installer chart, and publishes the release — so the stable artifacts are bit-for-bit the rc that passed e2e. Do NOT squash-merge (decision B): the stable tag must attach to a real merge commit. ⚠️ **RC e2e gate bypassed** — this promotion did not verify green full e2e evidence for `v1.6.1-rc.1`. ℹ️ E2E already ran against the immutable rc, so this promote PR does not run E2E by default. A maintainer may add the `full-e2e` label to run the full suite again. ✅ Includes `docs/changelogs/v1.6.1.md`, which finalize uses verbatim as the published release body. ✅ Website docs PR opened/refreshed on `cozystack/website` (branch `update-docs-v1.6.1`), generated from the `release-1.6.1` staging branch. **Do NOT merge that PR until `v1.6.1` is published** — merging it early flips the site's latest-version pointer to an unpublished version and 404s its docs/API links (see the PR body).
2026-11-04 02:57:27 +09:00 · 2026-08-05 15:00:09 +05:00
commit 8f4c19daae
@@ -0,0 +1,72 @@
+<!--
+https://github.com/cozystack/cozystack/releases/tag/v1.6.1
+-->
+
+# v1.6.1 (2026-08-05)
+
+A patch release with seven fixes covering PostgreSQL, etcd, managed Kubernetes, Keycloak, `cozystack-basics`, and SeaweedFS, plus release-pipeline reliability fixes and a `talm` update adding declarative Talos preset knobs.
+
+## Fixes
+
+* **fix(postgres-operator): align CNPG operator and CRDs to 1.28.2 for PVC resize-deadlock fix**: A simultaneous `resources` + `size` change on a single-instance PostgreSQL cluster could make the CloudNativePG operator delete the sole primary Pod, classify the PVC as `resizing`, and never recreate the Pod — wedging the cluster with zero instances and leaving the filesystem resize incomplete. Bumping the operator image and CRDs together to 1.28.2 (which carries upstream's fix, cloudnative-pg#9980 / cloudnative-pg#9981) resolves the deadlock ([**@scooby87**](https://github.com/scooby87) in #3510, backport #3542).
+
+* **chore(etcd-operator): bump etcd-operator to v0.5.4**: Rolls up four upstream controller bug fixes: the operator no longer exempts the bootstrap seed from crash-loop self-heal, self-heal now also covers memory-backed etcd members, `--initial-cluster-state` is derived from cluster phase instead of the seed, and each EtcdCluster's PodDisruptionBudget switches from `maxUnavailable` to `minAvailable` (existing clusters are reconciled onto the new field automatically on upgrade). Tenant etcd clusters recover more reliably from member crashes and are less likely to have their PDB block a node drain ([**@androndo**](https://github.com/androndo) in #3529, backport #3538).
+
+* **fix(kubernetes): render the talos-reconcile Job for the default md0 group**: On a managed Kubernetes cluster left with the default (undeclared) `nodeGroups`, the Job that creates each worker's `TalosConfigTemplate` and patches the control-plane's cert SANs only iterated the user-supplied node-group map, so it silently skipped the implicit `md0` group. Nothing failed at install time, since `md0` defaults to zero replicas, but the first scale-up (for example, autoscaler-driven growth after enabling ingress-nginx) left new Machines permanently blocked with no matching `TalosConfigTemplate`. The Job now iterates the same helper that produces the `MachineDeployment`, so `md0` gets its reconcile Job like any explicitly declared group ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #3535, backport #3536).
+
+* **fix(keycloak-configure): patch HelmRelease in release namespace on teardown**: The `keycloak-configure` pre-delete Job cleared the Flux `HelmRelease` finalizer in a hardcoded namespace that did not match where the release actually installs (`cozy-keycloak`), so its `ServiceAccount` was forbidden to patch it, the Job retried forever, and the `HelmRelease` stuck in `Terminating` — blocking any uninstall or reinstall of Keycloak. The teardown Job now templates both the release name and namespace from the Helm release itself, so teardown completes correctly ([**@lexfrei**](https://github.com/lexfrei) in #3372, backport #3478).
+
+* **fix(cozystack-basics): gate the hostname VAP policies on the VAP API**: The hostname `ValidatingAdmissionPolicy` templates rendered unconditionally, so a first install on a cluster where the `ValidatingAdmissionPolicy` API is unavailable dropped the policies permanently — a later cluster upgrade that gains the API would not bring them back. The templates are now gated on `.Capabilities.APIVersions.Has`, so they render only where the API exists and are picked up automatically once it becomes available ([**@lexfrei**](https://github.com/lexfrei) in #3409, backport #3442).
+
+* **fix(seaweedfs): make naming audit fail closed on kubectl and payload errors**: `hack/seaweedfs-naming-audit.sh`, used by operators to classify SeaweedFS instances before the naming-migration cleanup, was fail-open — any `kubectl` failure or unreadable Helm release payload produced an empty result table indistinguishable from a genuinely clean fleet. Since the runbook uses this script as the gate before deleting old PVCs, a transient API error could have green-lit destroying live data. Every query now fails loudly on error instead of silently reporting "nothing found," and incomplete evidence now falls back to a conservative "direction cannot be established" verdict rather than a wrong deletion candidate ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #3436, backport #3474).
+
+* **chore(release): don't activate `kubernetes-nodes` on the release-1.6 line**: The `kubernetes-nodes` app package was not ready to ship on the 1.6 line, so its single include is removed from the `iaas` platform bundle — the platform stops activating the package on this line while its code, API types, and `kubernetes-nodes-rd` system package are all kept intact for when it is ready ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #3437).
+
+## Development, Testing, and CI/CD
+
+* **ci(release): carry the finalize fixes onto the 1.6 line**: `release-1.6` was cut before three release-pipeline fixes landed on `main`: dropping `persist-credentials` on checkout (which had let a stale `GITHUB_TOKEN` silently win over the app token, so the stable tag push created no workflow run and the automated changelog/docs backstops never fired, as happened for v1.6.0), publishing the GitHub release with the merged changelog as its body instead of a placeholder, and dropping a `paths-ignore` filter that could drop a changelog-only promotion PR. All three are backported so v1.6.1 releases correctly with real release notes ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #3530).
+
+* **fix(ci): overlay images from the PR base branch, and publish per-line artifacts**: PR validation always overlaid unbuilt packages from `cozystack-packages:main`, so a `release-1.6` PR was tested against `main`'s controller binaries against its own line's charts — which is exactly what made #3437 above fail install deterministically with a schema-validation error. Each maintained `release-X.Y` branch now builds and publishes its own packages artifact, and PR validation overlays from the artifact matching the PR's own base branch ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #3471, backport #3514).
+
+* **fix(release): make promote-retag digest verification media-type-agnostic**: The v1.6.0 finalize run aborted partway through promoting rc images to stable tags because its post-copy digest check used `skopeo inspect --format '{{.Digest}}'`, which prints nothing for OCI artifacts like `cozystack-packages`, leaving most repositories without a stable tag and skipping the installer publish. The digest is now computed as the sha256 of the raw manifest, which works identically for container images and OCI artifacts, so promotion can no longer abort mid-way on this class of artifact ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #3435, backport #3473).
+
+## Other repositories
+
+### talm v0.34.0
+
+* **[talm] feat(charts): add preset value knobs**: Exposes `timeServers`, control-plane component `extraArgs`, `registryMirrors`, per-host `registryTLS`, multiple Layer2 `vips`, `network.preserveExisting`, and `network.extraLinks` (bonds, VLANs, extra addresses and routes) as values on the cozystack, generic, and talm presets, so a node's Talos machine config can be described declaratively instead of via a template fork. Every knob defaults empty and a stock render stays byte-identical; each input Talos would reject fails fast at render time with a hinted error ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm#232).
+
+* **[talm] chore(deps): migrate to Helm 4 and drop the cozystack/talos fork**: Moves talm's vendored Helm template engine from v3 to v4 and drops the `cozystack/talos` fork (carried solely for a `--skip-verify` flag, now reimplemented locally), tracking stock upstream Talos v1.13.7. Golden render snapshots confirm the generated machine config is unchanged for users ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm#231).
+
+## Documentation
+
+* **[website] feat(blog): add Cozystack 1.6 release and Blockstor announcement**: Publishes the v1.6.0 release-announcement blog post — covering Talos Linux tenant workers, tenant-controlled OIDC, the `SecurityGroup` API, hierarchical quotas, and in-place etcd-operator adoption — alongside a companion post announcing the open-sourcing of Blockstor, the LINSTOR-compatible storage control plane ([**@tym83**](https://github.com/tym83) in cozystack/website#641).
+
+* **[website] chore(blog): repair front matter, links and bundle names**: Follow-up cleanup on the two new blog posts, fixing front matter, internal links, and page bundle names ([**@tym83**](https://github.com/tym83) in cozystack/website@4b5d1ad).
+
+* **[website] chore: upgrade Hugo to 0.164.0 and convert HTML content to markdown**: Upgrades the site generator to Hugo 0.164.0, requiring Node 22 under its new node permission model, and converts remaining raw-HTML content to markdown along the way, keeping the site buildable on current tooling ([**@tym83**](https://github.com/tym83) in cozystack/website#636).
+
+* **[website] chore(blog): make the two taxonomy axes disjoint**: Cleans up the blog's tagging so its two taxonomy axes no longer overlap, making blog post categorization and filtering more consistent ([**@tym83**](https://github.com/tym83) in cozystack/website#635).
+
+* **[website] docs(talm): describe the preset value knobs for network and registries**: Documents the new `talm` preset value knobs (cozystack/talm#232) for time servers, control-plane extra args, registry mirrors and TLS, VIPs, and network links, so operators can find the declarative equivalents to a template fork ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#633).
+
+* **[website] feat(hack): generate docs from a pre-tag ref and fail loudly on fetch errors**: Hardens the docs-generation tooling to build from a pinned pre-tag ref and to fail loudly instead of silently on a fetch error, reducing the chance of publishing docs generated from the wrong ref ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#631).
+
+* **[website] docs(backups): document PostgreSQL point-in-time recovery (PITR)**: Adds documentation for PostgreSQL point-in-time recovery, covering how to configure and perform a PITR restore for managed PostgreSQL clusters ([**@androndo**](https://github.com/androndo) in cozystack/website#629).
+
+* **[website] docs: update managed apps reference for v1.6.0**: Refreshes the managed applications reference pages to match what shipped in v1.6.0 ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#628).
+
+* **[website] docs(monitoring): add OIDC authentication guide for Grafana**: Adds a guide for configuring OIDC single sign-on authentication for per-instance Grafana, complementing v1.6.0's tenant OIDC support ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#597).
+
+## Contributors
+
+Thanks to everyone who contributed to this patch release:
+
+* [**@IvanHunters**](https://github.com/IvanHunters)
+* [**@androndo**](https://github.com/androndo)
+* [**@lexfrei**](https://github.com/lexfrei)
+* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil)
+* [**@scooby87**](https://github.com/scooby87)
+* [**@tym83**](https://github.com/tym83)
+
+**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.6.0...v1.6.1
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/altinity-clickhouse-backup:v1.6.0@sha256:e890d78cd83968bdff9a36c9ca4312afc05e138af486e476da0a935f81f9b7a7
+ghcr.io/cozystack/cozystack/altinity-clickhouse-backup:v1.6.1@sha256:e890d78cd83968bdff9a36c9ca4312afc05e138af486e476da0a935f81f9b7a7
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/clickhouse-backup:v1.6.0@sha256:8efef62d59fb82d39544823f81a797c2b9ac130a50241fee48e701161ce2670d
+ghcr.io/cozystack/cozystack/clickhouse-backup:v1.6.1@sha256:8efef62d59fb82d39544823f81a797c2b9ac130a50241fee48e701161ce2670d
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/nginx-cache:v1.6.0@sha256:bd042a8a9789e8b21b12cb266e390484a3a48f4af6ca6e2d2864a8a83c74bd25
+ghcr.io/cozystack/cozystack/nginx-cache:v1.6.1@sha256:bd042a8a9789e8b21b12cb266e390484a3a48f4af6ca6e2d2864a8a83c74bd25
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/cluster-autoscaler:v1.6.0@sha256:d188f395a31e37ea09bfa91e45d7ce1606b7459192a437fa66bb760ffb5f17d2
+ghcr.io/cozystack/cozystack/cluster-autoscaler:v1.6.1@sha256:e77ff02b328e4e119439efd1edd3aa71e9325fabf10a4a84b03a87d12d90b308
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-cloud-provider:v1.6.0@sha256:f005b99041d191eed9dde98f9f6691ba2d0cbfa1b3b0b2fe4b32cc0fdba74acf
+ghcr.io/cozystack/cozystack/kubevirt-cloud-provider:v1.6.1@sha256:f005b99041d191eed9dde98f9f6691ba2d0cbfa1b3b0b2fe4b32cc0fdba74acf
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/kubevirt-csi-driver:v1.6.0@sha256:d6326e343c7932ce3d375c6742b9b9745090a4a26bf5bbc5ad19f5504ea93d65
+ghcr.io/cozystack/cozystack/kubevirt-csi-driver:v1.6.1@sha256:7a47bb5aa46fccfe33dc0e0d857a6ec2ce2c6284a213e37beff5edcf6f37c673
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/talos-csr-signer:v1.6.0@sha256:85b41e16e5e40398b1272fe0a69de72e205532c8034d0e6a9fc4a1d510f17818
+ghcr.io/cozystack/cozystack/talos-csr-signer:v1.6.1@sha256:7051e90245cb446ce4deb857d4337e2fd69ce84436243ba60939d374defc2a07
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/mariadb-backup:v1.6.0@sha256:1de944b5c4fbeef94004b8620b0865aa7886a692dacb23d50c8f9b31fbeece07
+ghcr.io/cozystack/cozystack/mariadb-backup:v1.6.1@sha256:1de944b5c4fbeef94004b8620b0865aa7886a692dacb23d50c8f9b31fbeece07
@@ -14,9 +14,9 @@ cozystackOperator:
  # to the value baked at build time. The Makefile sets this for the
  # kubectl-apply release artifacts (_out/assets/cozystack-operator-*.yaml).
  platformVersion: ""
-  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.6.0@sha256:93b305f78823b070c59ca631b213e39bd9d8a256d5c520f156a03f5f72f57a5d
+  image: ghcr.io/cozystack/cozystack/cozystack-operator:v1.6.1@sha256:ab2c0c8f87dc70f675bf36ce55f8615f810bbe3d0840d3a7d1a412f38abdf78a
  platformSourceUrl: 'oci://ghcr.io/cozystack/cozystack/cozystack-packages'
-  platformSourceRef: 'digest=sha256:bf68208730860fa8e47f378a0260e79a0262e0783fa63ba4f7f97f57a48b2d23'
+  platformSourceRef: 'digest=sha256:2d7e07e4cf3d49a97f5b9c62ad732cfb93586483723788eed489b32643a1a8df'
  # When non-empty, overrides the operator's --helmrelease-interval flag
  # (operator default: 5m). E2E sets this to 30s; production should leave empty.
  helmReleaseInterval: ""
@@ -13,7 +13,7 @@ migrations:
  # below therefore lags targetVersion in-tree by design; run-migrations.sh
  # refuses to advance past a migration file missing from the image (exit 1), so
  # a stale pin fails loudly rather than silently skipping the etcd adoption.
-  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.6.0@sha256:6777042e3e9c6bad76e7d96fb64baa115061975f39061cb3ede84e21d0e2213f
+  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.6.1@sha256:a34e7156a52dc55b27662917e5f9d5bbea671188d8db233296d0a98c800dc6c6
  targetVersion: 54
  # Adopt legacy etcd clusters onto the v1alpha2 operator WITHOUT the mandatory
  # pre-adoption safety snapshot (migration 50). Leave false unless migration 50
@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.6.0@sha256:a9980e8c48d6e50ed2b5d8245a4e0aae00970777b6e2255577fdb66035a44c68
+  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v1.6.1@sha256:a9980e8c48d6e50ed2b5d8245a4e0aae00970777b6e2255577fdb66035a44c68
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/matchbox:v1.6.0@sha256:7805917462ad1288272a6324c0f32a4f9a250e1723a2759f7afebce181400f96
+ghcr.io/cozystack/cozystack/matchbox:v1.6.1@sha256:3f492d2bd2d14de94c88dc995e3092911e2ca8ed7e17d305398e7fd49135d351
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.6.0@sha256:4d665becd3399c2fe1e8a66e15d14d16e4a5a75395fb0ae65cff46679a8989f1
+ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.6.1@sha256:ef3c154c1a6dd1ac9fa1b0763a2bd23707d68f2f16f16a97ebf331f3646b53ce
@@ -1,5 +1,5 @@
 backupController:
-  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.6.0@sha256:fc4571354413d86ed11fa38dee8fd3d2d879e11c48d7d92c28630b2d54a2bcbb"
+  image: "ghcr.io/cozystack/cozystack/backup-controller:v1.6.1@sha256:ef3c45ac4b23d6231a4166b4331a622374960caeeef3e4a901b0ee1dabcb6922"
  replicas: 2
  debug: false
  metrics:
@@ -1,5 +1,5 @@
 backupStrategyController:
-  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.6.0@sha256:e8bf0521d1d1d8b90ebe66e9013010887033ba2653901799d57f2df47c9d879e"
+  image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.6.1@sha256:7cb5af7bd8fae2ef5d6e58d1eb6eb7d9579bff8df228ac3d936c6e14ae5e063f"
  # chBackupClientImage is the image rendered into the Altinity strategy
  # Pod: it drives clickhouse-backup's HTTP API via curl + jq.
  #
@@ -35,7 +35,7 @@ backupStrategyController:
  # retag both to the same stable tag, and the write-once guard in
  # hack/promote-retag.sh fails the release. hack/image-pin-consistency.bats
  # asserts no repository is pinned at more than one digest.
-  chBackupClientImage: "ghcr.io/cozystack/cozystack/platform-migrations:v1.6.0@sha256:6777042e3e9c6bad76e7d96fb64baa115061975f39061cb3ede84e21d0e2213f"
+  chBackupClientImage: "ghcr.io/cozystack/cozystack/platform-migrations:v1.6.1@sha256:a34e7156a52dc55b27662917e5f9d5bbea671188d8db233296d0a98c800dc6c6"
  replicas: 2
  debug: false
  metrics:
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/s3manager:v1.6.0@sha256:73665aaf7f5406b4a1e456d14060fe874e0ae2a436ba7fd3058fa73abff8a927
+ghcr.io/cozystack/cozystack/s3manager:v1.6.1@sha256:73665aaf7f5406b4a1e456d14060fe874e0ae2a436ba7fd3058fa73abff8a927
@@ -16292,7 +16292,7 @@ spec:
        - --dynamic-infrastructure-clusters=${CACPPK_INFRASTRUCTURE_CLUSTERS:= }
        command:
        - /manager
-        image: ghcr.io/cozystack/cozystack/cluster-api-control-plane-provider-kamaji:v0.19.0-cozystack.0@sha256:a0b8367f374432a5fa0b12018a35b0e4828466f53eb6de263d90c3408d9fd07d
+        image: ghcr.io/cozystack/cozystack/cluster-api-control-plane-provider-kamaji:v0.19.0-cozystack.0@sha256:e996a072eee1c74d71421ad82a8f898b38e9fe73fbe3a1308e3170399d863bc4
        livenessProbe:
          httpGet:
            path: /healthz
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/cluster-api-control-plane-provider-kamaji:v0.19.0-cozystack.0@sha256:a0b8367f374432a5fa0b12018a35b0e4828466f53eb6de263d90c3408d9fd07d
+ghcr.io/cozystack/cozystack/cluster-api-control-plane-provider-kamaji:v0.19.0-cozystack.0@sha256:e996a072eee1c74d71421ad82a8f898b38e9fe73fbe3a1308e3170399d863bc4
@@ -23,7 +23,7 @@ cilium:
    mode: "kubernetes"
  image:
    repository: ghcr.io/cozystack/cozystack/cilium
-    tag: v1.6.0
+    tag: v1.6.1
    digest: "sha256:136a7dfff4d6adcd448424c2354144160028a8e96eb6558b917fd3ee6d7b39fe"
  envoy:
    enabled: true
@@ -1,3 +1,3 @@
 cozystackAPI:
-  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.6.0@sha256:c4d374a9bc5e6f6e66d24b29396f1eae9d7f06fd268ff767d05c45ca35e84e2e
+  image: ghcr.io/cozystack/cozystack/cozystack-api:v1.6.1@sha256:6d1db0a4fc1f21282f7825fed13807f80e40998f6703a087f372f19cc4197173
  replicas: 2
@@ -1,4 +1,4 @@
 cozystackController:
-  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.6.0@sha256:b01f6fe6e8fe6426b112fbda2b4abac946b4e45cd118137c9001c9e6ee784b3d
+  image: ghcr.io/cozystack/cozystack/cozystack-controller:v1.6.1@sha256:1b60f18b37c140fa9e50baacd62a8fe9ed8d549c26746b081d5b460c7ca98a04
  debug: false
  disableTelemetry: false
@@ -1,4 +1,4 @@
 console:
-  image: ghcr.io/cozystack/cozystack/cozystack-ui:v1.6.0@sha256:ad0e132ce506bbc9e0f6a5dfb94311c9bbc08da3d8eca84eb0e527ba6c1a8897
+  image: ghcr.io/cozystack/cozystack/cozystack-ui:v1.6.1@sha256:e8a7f00cf8f970c2d8e598570ca4ed98c5448e2362489f4470a2a89543f760ed
 tokenProxy:
-  image: ghcr.io/cozystack/cozystack/token-proxy:v1.6.0@sha256:97124c012246c33cdcac60e8f884097b48c0081624716fe8161efc2b3ceeb2a8
+  image: ghcr.io/cozystack/cozystack/token-proxy:v1.6.1@sha256:97124c012246c33cdcac60e8f884097b48c0081624716fe8161efc2b3ceeb2a8
@@ -1,5 +1,5 @@
 fluxShardOperator:
-  image: ghcr.io/cozystack/cozystack/flux-shard-operator:v1.6.0@sha256:daf002af34671371646185d4135c5096f8aba9518f132089bd5d6fbe7d9d06e7
+  image: ghcr.io/cozystack/cozystack/flux-shard-operator:v1.6.1@sha256:5774b606d182ebc70319f1adf6641c52afe417e968bdd64540eb32fb8f28605f
  debug: false
  replicas: 2
  ## Number of helm-controller shards to provision and distribute tenants
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/grafana-dashboards:v1.6.0@sha256:cb22416b34d4385e4df58314de390920af805c03358fe00734c8fa44ba505fe9
+ghcr.io/cozystack/cozystack/grafana-dashboards:v1.6.1@sha256:fbbcfed72e9d23f223d990b9cd38a8c49ea3f985d7da65defc79eb730c0861e3
@@ -30,7 +30,7 @@ kamaji:
            topologyKey: kubernetes.io/hostname
  image:
    pullPolicy: IfNotPresent
-    tag: v1.6.0@sha256:7f7751b3d01b256621a131c217fc90464cd51d3d07a6d870c3d8f28784745293
+    tag: v1.6.1@sha256:dd81f5b76208e11665f2d2eed00396653c32182079ee53f44169074ac35d62ed
    repository: ghcr.io/cozystack/cozystack/kamaji
  resources:
    limits:
@@ -63,4 +63,4 @@ kamaji:
    periodSeconds: 10
    timeoutSeconds: 1
  extraArgs:
-    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.6.0@sha256:7f7751b3d01b256621a131c217fc90464cd51d3d07a6d870c3d8f28784745293
+    - --migrate-image=ghcr.io/cozystack/cozystack/kamaji:v1.6.1@sha256:dd81f5b76208e11665f2d2eed00396653c32182079ee53f44169074ac35d62ed
@@ -1,4 +1,4 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.6.0@sha256:0d2a42d5aa05f73e9a5bab2ffbcf20c64e2925b7b5f50d7b39b7d366a1d8f3d6
+image: ghcr.io/cozystack/cozystack/kubeovn-plunger:v1.6.1@sha256:6f38f72c16f86a5937630ba58ee42afca2fd8f14dfe45bb79670f9a4a8447b60
 ovnCentralName: ovn-central
@@ -1,3 +1,3 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.6.0@sha256:593c324a38db59495497c5b68b90cad25dfe6753c73b7a287b3280e26f70a15f
+image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v1.6.1@sha256:593c324a38db59495497c5b68b90cad25dfe6753c73b7a287b3280e26f70a15f
@@ -9,4 +9,4 @@ storageClasses:
    infraStorageClass: replicated
    default: false
 csiDriver:
-  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:v1.6.0@sha256:d6326e343c7932ce3d375c6742b9b9745090a4a26bf5bbc5ad19f5504ea93d65
+  image: ghcr.io/cozystack/cozystack/kubevirt-csi-driver:v1.6.1@sha256:7a47bb5aa46fccfe33dc0e0d857a6ec2ce2c6284a213e37beff5edcf6f37c673
@@ -1,5 +1,5 @@
 lineageControllerWebhook:
-  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.6.0@sha256:3a5b4951a78d507eb847f4f3311052810dc658fd7c85c49eeb32ac5469cb39a2
+  image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.6.1@sha256:b8bfe1573ef75f74e32eff6fe3c57d16413860836299d2f64a8a28fd482a65ab
  debug: false
  replicas: 2
  # DEPRECATED. Injects KUBERNETES_SERVICE_HOST=status.hostIP and
@@ -3,7 +3,7 @@
 ## @param image.tag LINSTOR GUI container image tag (digest recommended)
 image:
  repository: ghcr.io/cozystack/cozystack/linstor-gui
-  tag: v1.6.0@sha256:6e11829de86709f5e21636cdd1a1ada1239a7dcc1741f91e9d95d9f6ade603a2
+  tag: v1.6.1@sha256:6e11829de86709f5e21636cdd1a1ada1239a7dcc1741f91e9d95d9f6ade603a2
 ## @section Deployment
 ## @param replicas Number of linstor-gui replicas
 replicas: 1
@@ -1,7 +1,7 @@
 piraeusServer:
  image:
    repository: ghcr.io/cozystack/cozystack/piraeus-server
-    tag: v1.6.0@sha256:70ddd1a66fbc1ea58078f4645fc572ab8e2e189dbb4d9a5f9ca43d5663106483
+    tag: v1.6.1@sha256:82d2234181ac8d5942e57286101b242a08fbcc49a9bf37d5df529921624fdca9
 # Talos-specific workarounds (disable for generic Linux like Ubuntu/Debian)
 talos:
  enabled: true
@@ -13,7 +13,7 @@ linstor:
 linstorCSI:
  image:
    repository: ghcr.io/cozystack/cozystack/linstor-csi
-    tag: v1.6.0@sha256:ae854423de62e94fb89b59d92c20da8939196e643e83b2d60d9f6915d5b0e55c
+    tag: v1.6.1@sha256:3228487ae861ddf02cac984289f8c377fc9e66a71fb3c387e9af9f72c1dbc78b
 controller:
  # Resource requests for the linstor-controller JVM. Requests (not limits) are
  # set on purpose: a CPU request guarantees CPU shares so the JVM can answer its
@@ -37,11 +37,11 @@ metallb:
  controller:
    image:
      repository: ghcr.io/cozystack/cozystack/metallb-controller
-      tag: v1.6.0@sha256:cb7321c5674509048dfbea7938378b84013d1370eca5ace7f9665fc79b4a8a05
+      tag: v1.6.1@sha256:9d8ba76cdb9c7c6221334ad05d706dee22b138b3e90c1fe8fc884925b7480c02
  speaker:
    image:
      repository: ghcr.io/cozystack/cozystack/metallb-speaker
-      tag: v1.6.0@sha256:61ab7e2381f0897607b15df7cb5ba4d51a947c261c1c197fcda3b79c7a280016
+      tag: v1.6.1@sha256:87df3c82d0b6ea223b26fd5d6fbba6e940c13e56418dfc1cd90863d145795be9
  # The vendored metallb chart's values.yaml leaves `frr-k8s.prometheus:` as
  # a YAML block containing only commented examples — it parses to null.
  # Helm-controller's deep-merge then writes that null over the frr-k8s
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/grafana:v1.6.0@sha256:d29c2306b96dfc47aab05e6afd1bce581c552f02d022084c11737632d8839029
+ghcr.io/cozystack/cozystack/grafana:v1.6.1@sha256:d29c2306b96dfc47aab05e6afd1bce581c552f02d022084c11737632d8839029
@@ -156,7 +156,7 @@ spec:
      serviceAccountName: multus
      containers:
        - name: kube-multus
-          image: ghcr.io/cozystack/cozystack/multus-cni:v1.6.0@sha256:0a92e861ead179dd6b46f475fd8878d44b3cfa40ce4d7a8ff92f790d54250d25
+          image: ghcr.io/cozystack/cozystack/multus-cni:v1.6.1@sha256:f94fdd68d674a1f8c8a2b45fa8fd4b478fc632e66fa147aea73a6b60b721920c
          command: [ "/usr/src/multus-cni/bin/multus-daemon" ]
          resources:
            requests:
@@ -202,7 +202,7 @@ spec:
                  fieldPath: spec.nodeName
      initContainers:
        - name: install-multus-binary
-          image: ghcr.io/cozystack/cozystack/multus-cni:v1.6.0@sha256:0a92e861ead179dd6b46f475fd8878d44b3cfa40ce4d7a8ff92f790d54250d25
+          image: ghcr.io/cozystack/cozystack/multus-cni:v1.6.1@sha256:f94fdd68d674a1f8c8a2b45fa8fd4b478fc632e66fa147aea73a6b60b721920c
          command:
            - "/usr/src/multus-cni/bin/install_multus"
            - "-d"
@@ -1,3 +1,3 @@
 objectstorage:
  controller:
-    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.6.0@sha256:9c284ef4f2fbbf5ee3ccd75f86ec6c993dc60aa673c6df3f9bd15d21a7e8485c"
+    image: "ghcr.io/cozystack/cozystack/objectstorage-controller:v1.6.1@sha256:0d9ff6c2a3453fdc7e72894bbfdd3e5a292be78342c7c5352f655c976c3b7f0b"
@@ -259,7 +259,7 @@ seaweedfs:
    bucketClassName: "seaweedfs"
    region: ""
    sidecar:
-      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.6.0@sha256:4d665becd3399c2fe1e8a66e15d14d16e4a5a75395fb0ae65cff46679a8989f1"
+      image: "ghcr.io/cozystack/cozystack/objectstorage-sidecar:v1.6.1@sha256:ef3c154c1a6dd1ac9fa1b0763a2bd23707d68f2f16f16a97ebf331f3646b53ce"
  certificates:
    commonName: "SeaweedFS CA"
    ipAddresses: []
@@ -1,5 +1,5 @@
 securityGroupController:
-  image: "ghcr.io/cozystack/cozystack/securitygroup-controller:v1.6.0@sha256:09ee1d8fbfacc5b4ac24d0efbc8313bb0ad0e5507a149235894ac7d4b5539232"
+  image: "ghcr.io/cozystack/cozystack/securitygroup-controller:v1.6.1@sha256:1eaaed61b595ed79460709a410d1da830031e82926b0a2fd8cfd917e0e120844"
  replicas: 2
  debug: false
  resources: