admin/cozystack
1
0 Fork 0
mirror of https://github.com/cozystack/cozystack.git synced 2026-10-23 03:27:50 +09:00
Code Issues Packages Projects Releases Wiki Activity

docs(release): add changelog for v1.6.5 (#4940)

Browse Source 
This PR adds the changelog for release `v1.6.5`.

✅ Changelog has been automatically generated in
`docs/changelogs/v1.6.5.md`.
This commit is contained in:
myasnikovdaniil authored and GitHub committed 2026-10-16 17:44:30 +05:00
2 parents 8bd6d91dbb 4814ccfed9
commit aed7fa896e
1 file changed
+157
Download Patch File Download Diff File Expand all files Collapse all files
docs/changelogs/v1.6.5.md
+157
View File
@@ -0,0 +1,157 @@
<!--
https://github.com/cozystack/cozystack/releases/tag/v1.6.5
-->
# v1.6.5 (2026-10-16)
A patch release with backported fixes for tenant Kubernetes cluster bootstrap, Application updates through the API, suspended `HelmRelease` handling, Cilium and Kube-OVN address allocation, `tcp-balancer` on HAProxy 3.3+, Alertmanager delivery, and a batch of PostgreSQL, MongoDB, NATS, etcd, Velero and dashboard fixes, plus optional email alert delivery, OpenBao static-key auto-unseal and zone placement for Keycloak. **This release contains a breaking change on the Kube-OVN platform variants — read the upgrade notes before upgrading.**
## Features and Improvements
* **feat(monitoring): add optional email receiver to alertmanager**: Alerta alerts can now be delivered by email through an optional receiver configured in the monitoring application values, with the alert severity guard tightened so rules using non-Alerta severities are caught ([**@yankawai**](https://github.com/yankawai) in #3800, backport #4614).
* **feat(openbao): optional static-key auto-unseal and apiserver egress label**: OpenBao can now be auto-unsealed with a static key instead of manual Shamir unseal, with the seal values constrained so only valid settings reach the server config, and the pods can carry an apiserver egress label for network-policy setups. The static seal trade-off and the Shamir migration path are documented in the chart ([**@yankawai**](https://github.com/yankawai) in #4766, backport #4906).
* **feat(keycloak): expose zone placement for Keycloak and the database proxy**: Keycloak, its database proxy and the `keycloak-db` instances can now be spread across zones, so a zone outage no longer takes the identity provider down with it ([**@sircthulhu**](https://github.com/sircthulhu) in #4606, backport #4856).
## Fixes
* **fix(kubernetes): break bootstrap-token Job out of Helm hook to unblock fresh installs**: The bootstrap-token Job is no longer a `post-install,post-upgrade` Helm hook, which deadlocked the chart: the release waited for workers, workers could not register without the bootstrap-token Secret, and the Secret was only created after the wait succeeded. Tenant Kubernetes clusters on fresh installs and upgrades no longer get stuck with `Provisioned` machines that never join ([**@IvanHunters**](https://github.com/IvanHunters) in #3887, backport #4541).
* **fix(api): keep a suspended HelmRelease suspended across an app update**: Updating an Application through the API no longer resumes a `HelmRelease` that an operator or controller suspended. This fixes backup restores of PostgreSQL stalling at `TargetPurged` because the release was resumed and re-rendered before the purge finished ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #4411, backport #4928).
* **fix(api): preserve foreign HelmRelease metadata and repair empty required fields**: `Update` on an Application now carries over finalizers, owner references and foreign labels/annotations from the live `HelmRelease`, so a delete racing an update no longer orphans every resource of the release; and a required field written with nothing under it (`replicas:`) is dropped so the chart default applies, with a warning to the client, instead of failing the release with a "missing property" error ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri), [**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2914, #3956, backport #4919).
* **fix(api): let the garbage collector finalize Applications**: Deleting an Application no longer leaves the garbage-collection finalizer behind, so Applications finalize instead of hanging in `Terminating` ([**@yankawai**](https://github.com/yankawai) in #4610, backport #4683).
* **fix(cilium)!: take cilium's own addresses from a block kube-ovn does not hand out**: On the Kube-OVN variants (`isp-full`, `isp-full-generic`) Cilium now runs `ipam.mode: cluster-pool` with a /29 per node out of the last /21 of `networking.podCIDR`, and the same block is excluded from Kube-OVN, so Kube-OVN can no longer hand a pod an address Cilium already holds for its router or Gateway API ingress. A post-upgrade hook migrates existing clusters. **Breaking, see "Migration and Upgrades" below** ([**@yankawai**](https://github.com/yankawai) in #4778, backport #4918).
* **fix(tcp-balancer): rename backends and pin HAProxy so the chart starts on 3.3+**: Backend names no longer collide with frontend names, HAProxy is pinned to 3.4.4, and an empty whitelist leaves Kubernetes and Talos frontends unfiltered. Enabling `whitelistHTTP` without a whitelist now fails at render time instead of producing a configuration that rejects all traffic ([**@yankawai**](https://github.com/yankawai) in #4366, backport #4516).
* **fix(monitoring): send alerts to every Alertmanager replica**: Alerts are now sent to every Alertmanager replica instead of a single one, so alerts are not lost when the replica receiving them is not the active one ([**@yankawai**](https://github.com/yankawai) in #4889, backport #4890).
* **fix(velero): bump velero-plugin-for-aws to v1.14.4 so backups work on R2**: Updates the AWS plugin so Velero backups to Cloudflare R2 (and compatible S3 stores) work again ([**@yrahman82**](https://github.com/yrahman82) in #4834, backport #4854).
* **fix(postgres): read the live Cluster when deciding the WAL-archive prefix**: The WAL-archive prefix is now decided from the live CNPG `Cluster`, so upgrades and restores keep archiving WAL to the right location instead of switching prefix ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #4299, backport #4592).
* **fix(postgres): cap the default shared_buffers at a quarter of the memory limit**: The default `shared_buffers` is capped at a quarter of the memory limit (and at the memory request), so small PostgreSQL instances no longer start with a buffer size that causes out-of-memory kills ([**@yankawai**](https://github.com/yankawai) in #4724, backport #4725).
* **fix(mongodb): set the s3 bucket and prefix on the bootstrap restore**: The bootstrap restore now gets the S3 bucket and prefix, so restoring a new MongoDB from a backup actually finds the data ([**@yankawai**](https://github.com/yankawai) in #4779, backport #4780).
* **fix(nats): enable JetStream for the generated account**: JetStream is now enabled for the generated NATS account, so streams and consumers work out of the box ([**@yankawai**](https://github.com/yankawai) in #4675, backport #4677).
* **fix(etcd): leave compaction to etcd and pass the real quota to defrag**: etcd compaction is left to etcd itself and defragmentation is given the real backend quota, so etcd no longer compacts redundantly or defragments against the wrong size ([**@yankawai**](https://github.com/yankawai) in #4873, backport #4874).
* **fix(platform): keep the legacy etcd-operator stopped after etcd adoption**: After etcd is adopted by the new operator, the legacy `etcd-operator` stays stopped instead of being scaled back up and fighting over the same clusters ([**@yankawai**](https://github.com/yankawai) in #4738, backport #4739).
* **fix(linstor): use severity warning in piraeus-datastore alerts**: The `piraeus-datastore` alerts now use the `warning` severity instead of `warn`, which Alerta did not recognise, so these alerts arrive with the correct severity ([**@yankawai**](https://github.com/yankawai) in #3799, backport #4740).
* **fix(dashboard): allow editing free-form objects in application forms**: Free-form object fields in application forms can now be edited, and a field is marked invalid when the schema rejects it, instead of being locked or silently accepted ([**@yankawai**](https://github.com/yankawai) in #4682, backport #4905).
* **fix(dashboard, foundationdb): show the connection ConfigMap to tenants**: The application page gets a ConfigMaps tab, with a copy button per value, for ConfigMaps in the application's resource map, and tenant roles may read the FoundationDB connection ConfigMap — so tenants can obtain their FoundationDB connection string. The tab goes away if the resource map becomes unreadable instead of showing stale names ([**@yankawai**](https://github.com/yankawai) in #4612, backport #4684).
* **fix(cert-manager): enable the Gateway API solver in the host cert-manager**: The host cert-manager controller now has the Gateway API solver enabled, so ACME HTTP-01 challenges can be solved through Gateway API routes ([**@lexfrei**](https://github.com/lexfrei) in #4039, backport #4808).
* **fix(kubernetes): apply worker TalosConfigTemplate server-side**: The worker `TalosConfigTemplate` is applied server-side, avoiding conflicts and field ownership problems when it is updated on existing tenant clusters ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #4163, backport #4575).
* **fix(kubernetes): probe Keycloak CRDs by output in oidc-bootstrap cleanup**: The OIDC bootstrap cleanup now probes for Keycloak CRDs by their output, so it no longer fails on clusters where those CRDs are absent ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #3520, backport #4571).
* **fix(cozy-lib): round the sanitized CPU request up to a whole milli-CPU**: Sanitized CPU requests are rounded up to a whole milli-CPU, so fractional requests no longer produce invalid values that Kubernetes rejects ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #3522, backport #4590).
## Dependencies
* **chore(hetzner-robotlb): update robotlb to 0.1.0**: Updates `hetzner-robotlb` to robotlb 0.1.0 ([**@sircthulhu**](https://github.com/sircthulhu) in #4557, backport #4560).
## Development, Testing, and CI/CD
* **ci(e2e): run nightly and release-tag e2e on the container lane**: Nightly and release-tag E2E runs now use the Talos container lane, with the nightly runner given headroom over its nodes, matching the merge-gating lanes ([**@lexfrei**](https://github.com/lexfrei) in #4828, backport #4913).
* **fix(e2e-sandbox): install mc from its GitHub release**: The sandbox image installs the final `mc` release from its pinned GitHub asset and verifies its per-architecture checksum, because `dl.min.io` now returns HTTP 410 and the release-line image build was failing ([**@lexfrei**](https://github.com/lexfrei) in #4447, backport #4535).
## Documentation
* **[website] docs(platform-package): note the /21 the kube-ovn variants keep for cilium**: Documents the /21 of `networking.podCIDR` that the Kube-OVN variants now reserve for Cilium ([**@yankawai**](https://github.com/yankawai) in cozystack/website#739).
* **[website] docs(platform-package): document kubevirt.migrations for v1.6**: Documents the `kubevirt.migrations` platform value in the v1.6 docs ([**@yankawai**](https://github.com/yankawai) in cozystack/website#705).
* **[website] docs(platform): document the monitoring platform values**: Documents the monitoring platform values ([**@scooby87**](https://github.com/scooby87) in cozystack/website#738).
* **[website] docs(platform-package): add publishing.serviceDomain**: Adds `publishing.serviceDomain` to the platform values reference ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#724).
* **[website] docs(variants): document the slim platform variants**: Documents the `isp-slim`, `isp-slim-generic` and `isp-hosted-slim` variants ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#718).
* **[website] docs(talm): document the ZFS export-on-shutdown knob**: Documents the `talm` knob controlling ZFS pool export on shutdown ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#721).
* **[website] docs(install): note the talm version pins on the update path**: Notes the `talm` version pins that apply when updating ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#703).
* **[website] docs(gpu): select the container variant from bundle values**: Documents selecting the GPU container variant from bundle values ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#714).
* **[website] fix(operations): replace the component removal recipe that undoes itself**: Replaces a component removal recipe that reverted itself, and warns what removing a v0 component destroys ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#684).
* **[website] fix(docs): correct stale hairpin-proxy uninstall claim and package names**: Corrects a stale hairpin-proxy uninstall claim and package names in `enabledPackages` examples ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#709).
* **[website] docs(development): describe the multi-arch default of make image**: Describes the multi-arch default of `make image` ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#711).
* **[website] docs: move the next docs to Talos v1.14.2**: Moves the next docs version to Talos v1.14.2 ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#720).
* **[website] fix(versions): pin the trunk to published releases and fix released pin headers**: Pins the docs trunk to published releases and fixes released pin file headers ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#710).
* **[website] docs(marketplace): point the Repositories view to Admin**: Points the Marketplace docs at the Admin page for the Repositories view ([**@kvaps**](https://github.com/kvaps) in cozystack/website#700).
* **[website] fix(llms): point llms.txt docs links at the current release**: Makes `llms.txt` link to the current release docs ([**@themoriarti**](https://github.com/themoriarti) in cozystack/website#737).
* **[website] fix(footer): use the LF Projects copyright notice on every page**: Uses the LF Projects copyright notice in the footer on every page ([**@themoriarti**](https://github.com/themoriarti) in cozystack/website#736).
* **[website] docs(community): drop the Russian-language Telegram channel**: Removes the Russian-language Telegram channel from the community pages ([**@tym83**](https://github.com/tym83) in cozystack/website#744).
* **[website] feat(i18n): automated translation pipeline with machine review gate**: Adds an automated documentation translation pipeline with a machine review gate ([**@tym83**](https://github.com/tym83) in cozystack/website#623).
* **[website] feat(blog): announce the CNCF General Technical Review and compliance results**: Publishes news and a page on the CNCF General Technical Review and conformance results ([**@tym83**](https://github.com/tym83) in cozystack/website#722).
* **[website] blog: Oberon RISC5 machine as a Cozystack catalog app**: Publishes a news post on the Oberon RISC5 machine as a catalog app ([**@tym83**](https://github.com/tym83) in cozystack/website#723).
* **[website] docs: update managed apps reference for v1.6.4**: Refreshes the managed applications reference for v1.6.4 ([**@app/cozystack-ci**](https://github.com/apps/cozystack-ci) in cozystack/website#712).
* **[cozy-proxy] feat(image): publish a linux/amd64 and linux/arm64 index**: `cozy-proxy` v0.4.0 publishes a multi-architecture image index for linux/amd64 and linux/arm64 ([**@lexfrei**](https://github.com/lexfrei) in cozystack/cozy-proxy#22).
## Migration and Upgrades
**Breaking change on the Kube-OVN variants (`isp-full`, `isp-full-generic`)** — introduced by #4778 / #4918 (`fix(cilium)!`):
* `networking.podCIDR` must be /20 or wider; otherwise the platform refuses to render and the upgrade stops before anything changes. Widening the value later does not help, because the migration hook refuses a block outside the subnet the cluster was installed with.
* A /21 of /29 blocks caps these variants at 256 nodes.
* Every Cilium agent restarts twice, once for the configuration change and once in the migration hook. While the `cilium` release is failed, packages that depend on networking wait for it.
* If Kube-OVN has already handed out an address from the last /21, the hook names that address and stops before moving any node. Recreate the pods holding it and the next retry succeeds.
* Rolling back to v1.6.4 restores `ipam.mode: kubernetes`, but the exclusions stay in the `ovn-default` subnet and have to be removed by hand.
* `isp-hosted` is not affected.
Other upgrade notes:
* `tcp-balancer`: enabling `whitelistHTTP` now requires a non-empty whitelist; rendering fails otherwise.
* Tenant Kubernetes clusters stuck on v1.6.3/v1.6.4 because of the missing bootstrap-token Secret recover on upgrade; no manual Secret creation is needed.
* PostgreSQL restarts on upgrade for small clusters: a cluster with a memory limit below 512Mi and no explicit `shared_buffers` (the `t1.nano` preset and the default `t1.micro`) now gets `shared_buffers` set to a quarter of the limit, 64MB for `t1.micro`, where PostgreSQL used its built-in 128MB before. The setting needs a restart, so CloudNativePG restarts the replicas first and then the primary in place: writes pause for one restart, and a single-instance cluster is unavailable during it. Upgrade in a quiet window, or set `postgresql.parameters.shared_buffers` yourself beforehand to take the restart on your own schedule. Clusters with 512Mi or more are unchanged.
## Contributors
Thanks to everyone who contributed to this patch release:
* [**@IvanHunters**](https://github.com/IvanHunters)
* [**@kvaps**](https://github.com/kvaps)
* [**@lexfrei**](https://github.com/lexfrei)
* [**@mattia-eleuteri**](https://github.com/mattia-eleuteri)
* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil)
* [**@scooby87**](https://github.com/scooby87)
* [**@sircthulhu**](https://github.com/sircthulhu)
* [**@themoriarti**](https://github.com/themoriarti)
* [**@tym83**](https://github.com/tym83)
* [**@yankawai**](https://github.com/yankawai)
* [**@yrahman82**](https://github.com/yrahman82)
### New Contributors
We're excited to welcome our first-time contributors:
* [**@themoriarti**](https://github.com/themoriarti) - First contribution!
* [**@yrahman82**](https://github.com/yrahman82) - First contribution!
**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.6.4...v1.6.5